From 6de15faa2cbc2b909500a67e854980deb0c0ba8c Mon Sep 17 00:00:00 2001 From: hypervis0r Date: Thu, 21 Oct 2021 16:37:59 -0700 Subject: [PATCH] remove ucrtbased stuff from pebutils --- DarkLoadLibrary/amsi.dll | Bin 0 -> 77824 bytes DarkLoadLibrary/include/darkloadlibrary.h | 5 ++- DarkLoadLibrary/include/pebutils.h | 10 +++++- DarkLoadLibrary/src/darkloadlibrary.c | 34 ++++++++++++++++++ DarkLoadLibrary/src/main.c | 2 +- DarkLoadLibrary/src/pebutils.c | 41 +++++++++++++++++----- 6 files changed, 80 insertions(+), 12 deletions(-) create mode 100644 DarkLoadLibrary/amsi.dll diff --git a/DarkLoadLibrary/amsi.dll b/DarkLoadLibrary/amsi.dll new file mode 100644 index 0000000000000000000000000000000000000000..5cd2d9a7e044a9412a1aa25d4c469beed2346aa9 GIT binary patch literal 77824 zcmd?SeSB2K_4vObSy&$8F6wGfkX3_5Q5%g9i2>auyK)yc8bvf!)K~;#eTuLPK}Ca` zRF>9{PVH23om5&n zs$7GbYi7xq6lQ+g7ryuHrJ}L zBm_Xj!?UCSA%f)VKB>jdsM<(d6)~Yj;g5X4yM~Oq%?+eO1J@z@1@=04y*bm+`V*h{f+dSwOoMj~655~;9%iCzbVeY8! zcsV{NX3i;ZG1u{WbaG!&;;4}KsoqW(RLicdPtEW}+Pmvhmy~%UYeT7FnUYZQC|A^+ zR$+8>$B&GfGb)W#th~}NW96;#R$-Vg#!_?216lu`Zt6&G2wuA0L4(>2?^DBK=?jVs z^TP7hn7L!^uCi3PyfWl{dKk}BfjlglTsO)fP;HnYkC7T?KQ1h<@ILKH&F~oM()a)D za`j9bBfT6;UEouNr!{seJ0|t0K>vDM~ zh81!~4!7WJBYj=@4rAH-pbc%@SHp-#)dnLKIn*#Cw}(1~*$It^RBa++F|T`h-pKPk zo>#|Gkq`NM&ghAFh3^d0L-Z9S_wc-!=hH?y@?B|JMOaXYRCODv`qyaB1IP!8WmU1B z$Xha032&3I)$@5aYnb(i8daOE+7%=$+t5w?WjV|@Z?A)+ zry^dd&_*193h@tlUQJDh>Y7LB=U&y;Tm!a&_+#Mu7P#&!1+=uGhbD}W>UtvYX@p;s zV%8xx!V?AI6)AWM)kNq zI;_Z5tr|FConT?Q*Yn8G#DfgD_aMWZ7JR%Y>t9L-llY+INv`)8wS5cTppsXgB062V z_y;^v?o|MTI|G;YFMy~vLS)*6Xd(45g^+uv9U4!lfZPr{ZzlhmQk8#{o&PgCv{_)M z-K7Vpw0G^$bAA=F2syAA4;5hK22rb>hS}|%O%B!GO^8fG+M6ytN{~)&sOWzlf)> zyzSIum>(M*I}?3I@@gMVm4D`WL8D_+ywore7eQav|9})tpI1h?`?@rK$*ZNpIU<7M zhzxr4iX3*GA_jJQ*M`PqyK|8R^hx$+?bP0(Qa5ilLt_Rc3~Vbk{vEzcjOZ*5y4o`5 zR%MO!mxD%4ZDMjPUAns$TtyI8y&O(YFQO~9N=(*&=b1&e_%Zi&bhjR2n4^u<0rKA* z3j=$y{%0YHiOiT&9+Wm2w5c-RrULW_(>|08K#JFs{UvdK@{^+Yh|Y^?f98^^Y*lyg zls%cMsJRIQwytsHpV@1e`-pioAG0mEVmC2Aabot=9X2cuZZqk{O@=qJBULwE2RXfeU%Dm`p9}OchH+nm^^1{e|XQOoPgs@Bz>8U5mBjr9qJ*IB+ zNaSfg6`C+s9z7~em@#G!H`3D?FEYKQOKU|`LWN2r9WD>Xhz%O)MI_HDH$rQqfV?tx zUXv1mSZcaVV1D#?djd1hHafD2Ux4>D)C$+#%)@)}rdZnDpwRG-+(!-RSb5Ov3-12d zdwXdU@jRubtpDSuHKdMiZ^vGRpL-%1(ib!9mY&F4gh`i-e{wSRza&VdORr>xv0VSk zW@{!KL$>&(hB;O8gUU%fGAA1588YsVWZVY^j^Z~#-$-2^AZxLdNcJG2_bu28)Xzo` z&ia3gq*e_~P1qzcX6aAlk(%&*9;pclJJ(qbPE>t~M5RxgC6C(A<7Z^XBRxD)uMc?d zJMfIu6$l|kw6~1ZY2{>3{<|pQsh;rm!9}iw`xzm*xn8uH2ARHIyn`-F&na(;nwR>b z=Cx%}b73HAzBBZ2+zb!VSMCU~Xv|siFoR{(52jU{pz%Fx&9x%NhaMiA4HL#|r2Cs; z%9b)C)fxz0q@?Q9?%|+TZ|;r(!2D}s)HAH-+WOxD-TIC_1d9 z;blyGxRG4z$vkVMZwnYT6B7~IbrBFDYW4|-3yD9BZbkv~zrJ27ImZ_>d$Rt2LUyx{ z66JP@Kjuo9Ug?^H5$yHmM#KDrVY;&ZjVgOId6p|Ns$*y8*rJj)Z@AAeuPd*XF3}=B zXqdMunHUINKA4Q1r!YqqL>eZ#ru!&`(+glXUcCjGKPG*d%5ri^23}bV?KLoK_C+EI zDylv(($liWRL1A+hWU~C?==?#+B^M|j%;hKk-h{4YO7(s5@TdFoBxIy-+VGRl3KmS zy+-Z&#h%2t`Kc2w&m1KGpSzjz894Igc=7zyNr)xb;EKyH%PGeNI4Bele=iI8#@OVS zkdM)qK1E-T=8#%k5l!C=7Ozpa->F-8taYT+-m`dE!Z$xP=9bK;s!gKhQ|V}<_T%_i zgGtZGcF(UFQ43mbunDxI28_bW?oMlT> zCcgA(udGG+*%UuM*7_!JFI6wEaUBRsA~`|mRweQ7dtCQZG(F`u!%ViRQSn;LoY@*Rx5jF2sf-^j zB`RT@rBq0cPaJ|@p;!$A;JCS_X=k$+aP=tx*~KrY@Z*bL(IcS z*xd*@R08Jz#5smJQt{V1+G}fUMY2wnnb3Sp_h!r-QS~zD5qGr{XC#jmMbhKyS3Q&U zU*@F5(&v;o*@I4`0W-t0S0)24qvL}(JZF^9K{4}r!+aIESLC|RmR=_e!X^8w{c+jp z#2KlHMryHVceZ#nx~vjqh&55~f@<*P>5&skyrfFEvNBX!Y%YV)OU9;*%OWAK`&pUv zL}g)Is+j($`H3h^eX19gmij>)ofP&()~*>Ye46#&=->v8A@H8~*+&k~ps&;M5-K(S zfZ*Bt$HTjiUY8nAdnwkb@hh!}|}?#+yB zTaulFGN0Wf1Gdtr?OlwJou2JdGPZWz;**WZuNjkHG}0w!N=F>HqGViqcYO5nVk3)$ z`miYR7nB_%U6(byk@YBGB2BaL;*G^Fp($J^h{1J-+#+PTzkIob;W{1zI4)0Nk@PD{ z=d=83--O*`O^^n{&GU$WJ<_GOf|_OWZ=*X%97?=9%JU0naORaOA1#~KJ`7Ij#l_yS zQJ>d0E#Ms+BG-&c!j*)BgwbSYG!Ske+(fu(O&i@tpe5uT8!p}L^^F-k8&DWyYbDUY!n%Hn2~%j8>!mE0Gl7KiC^YQ{4Vs(UThZdaXz`9{@lK=o&1m{bnRE>EfN1gSM)B*>;y1uC9;qoxjEvU&;9k-e zMkJZr@@s31{69W~RAY9*>wM^)QV%|tcps7ZEI3sEgP>JE%O;MG7>gO1AD zQH?}3>ZmzH8I${}URHyy*E%I>4`+&8S5BsQd6UczGG~S^3(d)`I+Pr_SQZ8>_hsdr z^>6xxrm(V)(8jcT{sTZujWCiwmQF)z{a8B4Wqp-Zn~{8oRhZPqfPJXjewAs7>T=a= z4$kVV!~$mh{tj|Z-o;#VK~Zk536Nr>?-MYFSuCUIl2|%a)+L()M*6Pu0IHbv>wlt= z=s=e!XNcEDtj=Xt2w07ufr(5@QTRm|ylslhmDt0ZOfWR=MeC1yg&B%9BN&Hw8%MJM z0=m?Wus<%rbJ+$#Gq1loayL&WMJDS6aNV=MDDJh*1oLtnXwS$Zy9!#5T~+Mmps~X+ zQ>vY?cCdi8%OSkyp&V-`C6B}2yB>5pB>7XD)XATAlMb=WhvhK@tlv6iVrEkEII!+^ z;*I1_C7!1y>fUlg1#W#X|&aN6xW)k@~&s!i69ZreYROz05%1R9FD>W>FR6HNPm z_cn1V;_7_4JS~ybLXxciM57;PUyML|Hcz=5BsuNBPg0bgy0;*))-D?#Wp2a%2S=HG zL!tA9_A}{^wEM(Wz)lq*&ubnR%4 zmArtTxss=FDC(O3)t~8BtTfUyJs6o7a;`29|HA2M9_z)Mlv(b-TPq9cr^h2kz=HAk z2d5&f((E@L;pghS^-wJf;+Rg+{=_=`HAcxwhC|*ut@0BhP&71QuS{)eGp-%P$#EjM( zN;iBKP0iXRK!9G!`*z~?67EGTKKF#cpVduL1yP-X0O8dNZ6Y3~;>iUSx8{}vQm^QF z;9gko0r`4Am3pb;QdLL3dZ}8~*HhQ6+c#vrzxk=d$jJ>u)|;nU*I1zw^im80*{Sx= zzky+d`qU@%yQ%=(Ao}Tc|`Ek4n-I1i)*mZtM|2SHgw zuK!8Cy^TZBx!HkT>99tqGoXPNnIBg)YZIyUCZ8I zE^swV21A`?`KIjFO=-8mOH-<)M%}G~TVc1tRuY&e|elpGwSOa1zhXf zqJA)=*Si16cu%mqQ-}T6-A8~$w@QdVNdneEm2jg3Mi{9xs=6~HMTm6{3%c6AVAYey zRmp2*k1d^Q<952n?Qn&gUoZkW1LV3!3u0T*Mr@V;i!8JZF!aaL4|c1zzAF#fIuPDI zW}vPy0`E3~C%QB;X=sZt<2IVQ)Dulz>x-rqmf7|;cIcz#M-g+MOtbw|cbi?^VjeN` ziSjmqm?yC`qdv8;kAbs2Y`zd-L|bucuG)!V*xP;}f;^Nuq9f~VXYxX1tw@ zc(RLrpBFQN6?-@Us=E7EN`g5%AokB-&ICDrT4HZ{idu<&-rge*2!D*?pMW7Q1wwt>Txc5!Ur;;y*0rAsD+!w> zHxvlC+8|2n||R9Lr+cba!y zc^S6g3-zkKGA6rqGUosCf#~y--sBOj-Rz8cA&D|@gl2GdkH$_@`Nl#G4gzFO#S!mkmSxM$gn0L?349R$zdsy#}aMpOF+L&BQTDR zDH1n;s4v|h_Rs5n$uQi@3gQ{ryzYMpP~MBXjpCi&vC?ku*r2b+r3jn#@4{z9>uT)J zX~@MxK|Tn`2MXjLWWY^{re9Jh47@9;r=NX#;$!7avGjQ&w^~S)^?@iqY%!%s zSFjPGr7;_J{5nOD`CWd>W`0p6o4?EM&+(Z|bX~b1elgB_YI<2Tbyn1ro-5Lzv_RLG z9Yp0_ta@qm7V8|g7(?b;VvJ+7Y_n#FRroC7h*MSlC)phFqP2x~WCD^PBC{y&h~VcR z0h$kJ*33Qhl|43TsjYyjZE@7Qhd@t8Ym2QJH#15q)yjCz75i-j>1m)~{Z?9?k&bYm zERTWG6Jpj028XKlyl5=~O>8G|kE}nJs>O1_cr2V@M4C+(ET`GyGjS$f4<1*%%65J@ zA*800kl8I>24x`(H}~Stl<*CXslq!!iKM*fQPl|H>>duV!g~;*T3EZ%H;0-(TI$VD zLNY=arz~Adr~Xwn{d9SlkCu0;c0N(Qnx~NBXgZ@LK0)^qlhJDClZQo+iNbKNwLsBh zPkcTd{1q`9T_)6NTvjV1CxKXInr2Bg-H}0Oi9l?G_ka0qDo9;e9#sBE;>p0OK8Orx zh?&nTSrB9E9qFri`1$X_rfx+D*>r7T)0M4&Yb)4vtz^@6kZ^_+$mi-v)lTV#sWJ1y z@+R5og823hSGb1xWsgzZ9eM_lpN+C5cW4ZBD%4IN=FYI$ZLPt&tLucJ@=FIz|DpF| zE4BQygsvyP$s?9NE&H&Lb4&b4Mb5*8oL%D-skgGpX$7!^&=-$O8Fp;TC97Wz1FR7U ztcwnlTr)n_lT-hK0=XA1b7T{}ifEb)pk@Iy2u8!<0%N$qPy+8HE%4I*17&QFb*;Hq zVwBjEdBOVW)d0Z+P4|68t>_pb?|qZF6c(46nBUx~zl#B<^e5;sYO_l%`5u*G&SEj0 zTrP~1{Hd%NU29|@P}WGQ;R8*?-4ySwRCHdXG|r8Zc|TG$2Bq zN@8cOlp(livKDPp>Ly)kx*}ajQF#JYA}6Kj=@iXOj$si+?GSp03Ti14!w;ms_z21R z4ag+Cla+zK&AJ;YW-1dvP^63@Isv?WE1WEXW=IiJC|~;Cr8#N$OY+!HzP!WIv}+=0 z#%RwWRGgD96U0BGaLz3p;REJhaRgu(d=zEkvn?=Y>0D}q_2%%1)^2rXVD|2*N17^Q zSVmyL3fYx<+hz1GtCimOb|A&+e)?IqZ_x$dO!UO>sFx4C?P>LbBG@i3tfL#K49^Hg zFB=fn%g0OUIpq!F$h71Hi2eJ&*m#_!I;UDNK)Ak(X5V!rAY?APXEz;mgdt7}2odJ$ zVl`=kZ4j5y_0&zbk>XPxQ6V1e7(Yt1+2agTs%(@lYO*_~K>8cWBf)5GPKxUFN^b7~ z3I;H0i%|T;sC^-Rj`$aa=7(x3a8%P$BUE!j5UG(q)!rarORDzO1rtP}$@=Hq<4m4l zSZt*51SmNxGg|O1j;2tul(SK#AV=f(-`m@7{p27L5=5qi+Nxdg(~aa-w4sfmwkeg^ zLd8Zi0EfQ2hr(fu;7}4(?RSva&mC^F%rnk!Fl`*|u8NHyc&slbmMz%g1;qrI+Sl^J z?r&n$bH%b=z@>%db4{qGI&pfarnMwd8Curr=_WRD3~yt2IVXV^&Lti;5$HwL(?JjZ ze>5PPIwG^gNH6eZW*g=WyJb?DXcpH*T!|1H`ZbY~L=Ce_O~jKp*{mB=6B&aBn>?#1 zen!kZcOQdSZ4Y4W$6B@$a1d{tz$n4}0co?b%&0jl@!)gAz%z58xi5o_=<TVfmMZjlM zB6;(gV2;ZA zU;GvWycdv%Oq~k$aj*C3wWTgH!hz?m%?$T;WyT|%3+1H7Wtj$oW9iobG5`ha_u|Bo z-*9X;%=U606-02#WGTH1wChEjK2a_jeAxVxfp7eFV&VQ6dHZ+`i6_GSxDOro-2KBww86V5 zLe==HREmi}idWPlS4CKd%->r-D~2N5tgniC;^RepOfn;QDdWYo!l^3N&8b^Tq^BRE zN3z{j*%Yc6XcJN$;t$)ZFUSwNqlLXVg@mx+RFM9y>nv`>}P+iWRc{5$FvWU0EvypJVMLN!W2N zEN={Tx-c**Y5wL)1^Bx)258^I~tuPB7}JD-qAPVD;3q z$(oo&MJMSpqqF`b1vtHsIf%x-b(d~zN4L2R&pSjH9&c`+&V3aiN(IEFY*)xaig_kX z@ytvzW!`tWey29FXh0b`-ytHw&b#sjk*wp$Iv*)>fLiw9z_!)e__}C#GEZFRR82`) z=fw{M=F_|gJ>b+gzQJp9LvwCpPx*maCqf}dJj>ow?kK`z2=xRmSF-(fB5Rw?#@xCRIT%1DH2G?A z8NnNsWQl2@R5hIFvWg_H^9#Y)wja*7q4mo7;EF!pD8I ztP0b2m;0nPogwQ#jp5>ith=zOP0I741h1KP{&@xs`aKpP3t zuz>XpER+vM5&H-#;MZ%BCWv3LZO$c zL|Uo!+;!y@_)4hCg!}(NeVzA{>V3M8>}$wwBW%9b(M<;LxqTYzJi>s`*#1Ix9+{7u zZ56!9vB)*#rsRRTQv*nwpF$YL|10qr5OFPNOC{0|ujQ)2hl`jBmN^PpkQ)zj))}fw z)}Kz5kSbT3T3Z?-3JvnV&&oRtd0A|3%7GP_8vA_$Dw((R!4q~_RYycXLWzt_(P@WHAk{)iT|JHchW|b(NLc9Oxi^_8`PzX<+QP z$0oagy?EU#``AiaTCh%5KFfy3v0dZcAKV3+xV1N8I&8*?xg~(Qjh9I{)zY_yl-pzJ zsbBvtN}$<;*GXl3l#%Qnrq+nNqmz4#m-eB2Gw#kEMy)fPTJva%*dx6ftwv|4hWAL*vbsiiW%QZBi3sM)beIp;OKi+FUYRcV_C1~((YH10-(@7 zTjSIt`^3pFum^?Zu-ZB!HN%tZ5)IjYDEP>QBJ}Gp88L@I8!_L#0C=?$t1&!@QRZm$ z$dc6}9!0;a%#Yv!;5HkzGjP=o*9?=)>o=cLsOw2iS&uS6a>&^23qd&Zb?dduWUzD_ zJ?zp8y*f|{&=S)A2PqQ9>&_e59JaD{p+K$ zkT`4}scM_1YKx_&`NGSGg*uVS^tJy2ie;vPnHBsZw7mZVv>vG%3auQ`z^`b3{4_oG z&iMj*d5ah2_sQC7=snF3I~)N&VB*Qc&hKf4)}V>F*iqW0fmO)v zlHOGe@ZO!@m1U=zVfd{A;LSOH%fl|*mp(j?_XmQvuA`E7*$?lRdJte&&{IVH$Nlib z3#x6+Rl8ZlZU8~XkiWaUO{%Nvj^X6O3aZRm=Z9-b#5$NBqt^Ku_nJ}UlZhfof4p-K z{UHJ$JYJ*wDam4u5wWfd392S>lq8Oo=I9{$RfSMZP4G~pt$j#x7x)Mi^yOfB3yrtu zU<*Njc+!v%owjnAwq2QY#guT6k$eFo!a9ryK4nB$mvMKw!Hz_l=c9R1Zv@$LRe2K_ zEB*XS8udFv07F0=rsxvGp6pc%B}m`yA?)l~3q{5k058;~^6(4zZjF?t z+8n<{(xHFhBJ1!qJYLsL?e7V3wEqR!R~L4}!&Lgv9YeH8+2VDZ3dWH-Gb{jrz01K| zw&|t0+l5`EZ>5R4@~`U3spss1dh$a`=I2In7<@_W4moZP)f^n!kDH}8gq!^=(a9|= zTCG?VO}CA@CA|_pSgTaW(3%4UAK0884TRF?j{}LWW%@>-hp+>wOsrJGs8oj zHeXAH)l}$I6-0@)HT_(>Wwp+dfq_cBatB1NYaIk$ge(rX=9??^D~$>CSs7JAm#^kB zq9Rrzt}7hrBQig?XR2(rwi6bnKD>i*__k#K6ynK({HK^5bbZG%0bohw;09~Etba*9 zH7s~p9>4uw>(qsLYt%iOO6o{yPGVQWh3UrMjjzVV@ z6mq8<7GySo8u?h=M%76N|G*3jGY^wNS$=H=+T7SB8W#981f-U%|COw!8+drq4T=7R z=y_E8#irUq-%5Kwdn|BffuW|yTshXO2qJ{K1V==jaI|ZH{-xIi7ux5Ko6y>nTS^{g z_V!%SfiQ;`!VIk$DNUjC0zxlVHa%-;WE*vFT&e+hpWe4@n_7c)d(Yk1kzG=aacZ0x6-@z~v#&Yw$9jwTD`sFOCjD<#uF@wl!0~6FHc`=km#!FCE z_&lpsR`|{wO{i6k6s^32S@{=Yb}X2kV`Fx<#;je8^4|8F=^5qk(tjCm$+-u+;NaG5 zx7myKXS=KHeVfLUD88UO7?OrJ$Rf1Y8h0V@Vq&6~PosjrY$2R>zbOxzK5$ca70Y1T z4`xxH-jB-Qic#mQdbysBP{4&RQua%Dq=g=B8mRBEuZd3#2QE_!1EN6%%@9uBxF2#S zMAaT*ccV<1=VM&jLBL{AH}Kq*o>s)8FBKwTBosRE)?DB9F5BevU2n&xB_qtW{p;y+ za~9qTbskPeun%x*(A)8I;RCbOqZ)T&k!su)$H^yb&IB^s8X_aDyV)6~eDc#{7c7!( z(D}*gTN2mJPqxljnwU4grX`lRVt%S+hB~dmE=zLlFi`r^%{i3%^pYNS>g(9KgpKmj zZ*CT1Zc$q~@R4SrS>J$|2Y^@@-TQ*qWM!WjiB;9z`Sal;+6so5Ufl%q#0<{n_=k4h zNIzQMBn}zN-d{DGY8b#`C1Bz0zWEixa)zj5CE`?_GZni)r0UQ0DeRG4pHO<<8)V7) zD{s;0hgNKk;m`UyNUbP6gv3burud28r(TMsOD@1bKeM)E9hN5Z9M8qh3!>(nbu2bYKf$O6)IT{yVa4X{_&OsmmSPmB4P)D;*7%vOS9v*FIs zOj1j9GtkoDq;wzTmVL2JA0o5miX7~TQXlRQ*3r}!T7zpaQ<*Y{-6K^gH;$t|&4Edb z>bjOJikXcx4mRGW$-E{2w`4}(-#g6v^oaQk&ws2riYVULdnPuo2bWJra{!&v`L(g> zpC^X1lD=yC=W1JSo7F#sAtLlShmrmdMi4yufjodXL2dILDl(HDSLW15p{{VObuj}2 zR_*GLw%d)g9{C#<>@VrbOHS#3zF4=xUfU;5=~`Kk{SC6qiixA^%!=OjiISG}hd$AT z`Z*bg^eOG!q2j;Us^h&+`BOx-ed=2nK)b)d>*K_|`|m8U*p4pgMZ)*`K3})of0dL= zmoBl3AMX@j>C~wFt6tgXpqTdGxq<@hV`cqQbBH4d*}_zv*!3guv5t{OE)m{skUm3~ z_P@4V%5hlh-6fioBf5S<-VD}gIc6?rpv9&^uPal)b56EHx*i}K%;8Y*nhyY8ETd5s zL|4Fh5|6HFYz7Hmi6JX3<5$d{zA(>a8)Tq6UNV;!9J|C87%TV863HrZpwgBDJCav= z#6=1R{;?sS9KJGAp~~f-0fNfkTxI0MOPDBaPxN;~%su7(@3{+oo zdSxZ93qcUv`cff+<#pm6o}TGzTTFk4v?3 zY|2DpvrEe1NJGVZse59$Ei9rvSqZ z*}(Esq+AO^$ogA`u0NN9SGIls*Ck{>$I0$}symkchR`#0r%*hWo=#`oDSe^jl67x| z%QdyQXhd6Lbhzee$rAEL*hE!6`~Sh$LDL|XGT?&-U*Tq2y7|XUBVy{74P#E6G9SOr zN${|lWsR8_rM!6hH-LL6RV}(Z8{{>}j>n&u7Q25T53MfYC#li9sM*vgYBtE43 zXl0YrO0zd+zSlXiBXj=Vx7YsFeeJrdCikZ5-;0`Gw;NiI-vDxABdx1X-xiFemhP=j z|4OKm;T-SMy{V;(t*U?E2PC>I*EgB7Zxq4fI3F3*6E^o*KC;B9YckhZ)laNh`kuGr zJHSXz{d|MV<@SD!u5uY&{Nuhc-a7nyiH|e=yZ7*79K8--=J$C^%$2J?{11PRUWsJ5 zKq(`A!ORi)P+sVu2u{tc$awL}3yc-{SYDV%xN?e@KsdFOE2Zj3#8TIL!>M^6%S}zx zJIp%oNkOuHVuTHq+r#E?ZgmRRcHe$dYIrO)kNLcGhTxL+*U1A%hx3utCGnYR0TfDK zJW*=NRFLl|mCt>+%GVn|PUSmV?m za!cP>FSWVIXr^*kkiyV-WT6S z3f`}_g%PO2@&)^L&azM081-7DaDOErUPx>p?=WiCD5Q=x(l-Se$cEf{A;{zQvUwp0 zWf2Hm{ZjjkWLxk@+Z@Q2NcB*jB(_OYc2+B~O(jHgym+1Jga&!g374zpGgzIu3- zcAzF$o9Vop#}L~V4^S*%7aOOG9jl5R*;P)44DDv;5;0u7~Ta<*6QQCp61XcaQ|L{@4Q^H9+mM8%9WDgPyu%RS+m$3+??M&KeIa0|P| z%TE=jz*esA5GCkTnWmU+xLr=IIhkwlfuMiHXnxNEJ)w^4QaYHKei*DpMLru(+x{&j zB(t`G*&Ac2M4Mq^YR!YJZ|f?S?CELl9K<>Y;)t#kiJ3njI)zTIQcdWeG>I0pXu^M(B5?%-8qx&W_(6kb$5Q7V6;pz`1SnI;SG z82uAewAziaz1EjHhzNSSlb+!v`mHSa=N+DwZxKR*;JQYHo zR|{(Y;X4j_)TH%Ky1f4#881RHk!*4%V77x2k&U%qm+`mI6EffImpKkC%{w-NBSxe_ z$k<|jO@?J{uXlPcLncV^1DxV=$rp3-5t=b_9QaQVvJM85{w9hdOM)CAiJ1{biskczOI8Br!v z8onyjDO&{0s!w83GR&_lp|=g$pg2*j-uLc?#}sV6`CX?@Fo_#TWHg>%Na%qZ?#s z-S;Qg>IkL#K9EZmzt6P)D#W9BRHjS6NA02tXZ_7i3CNgNey0i%KN8m|tSF`NXH-M3 zmxpc$SKaB^?Mu>-W27N&X-N9c<)DdPyj(g>6du%KkM;bKg8M+l7tKF!FVStro>-{v zn(s5AwE+p|$a-^^ee8`BEtdG~)OY;ZQF#9?J~47xb#^=T z?n0flQcHi&*xF6S!>nb$P}=N1)V26|)SX^K-D&sNt`)yd;1pwvkW4z@bk&fJPR z+2=ul5_Qt3eO8F)z2i^l9hvI^ca{zA3=QsdrQuXcgM{KpfM(q#TyYGIHD8S?XNbF+bHfmqY;U`VwA#k(UE%TMFSGh?!f28rIjLC@jYnk4EyAGS33kqhfLFTR%TlE!U$U_p7bn zjbJ&g#<1)G!njwlz-JN7;SSFNY!bH0QS2ZTVvW*k6mQCQhoGJU3&g|IB?+0UL#gl< zPbhWkmNEUmwozU2v_ds0j{;OrAXOF-4yy0aF#|x?1H_dsk$K&QT1AE7En_lYp+#wT zl@0a;4fa4K32~OU8$JnWLpOUs9eMPlJ>V@>MN@OOKw740k2Cg)xkC6doPWQ+_3Y+Jl zGgJBWw-uZRfD`&HoWz)(XCc>iVS5xAG4Ejlt0b_JKrexA39KftoIo3aTgzL-%+{>V z5vg#4trG3#QmK-{xqij;F)UBQq7;OQ_aS%6ptozqbPw^|Xej^mde% zBM(z4SB0%CAjvM-ph&yN73OaELYn-V+@iR$YhBC^@bn6DG7@E6LTp*26=fCzt}BtF zuv7V90$goZys9v#UGd9XLY+N(h$x6@O&8GJAQt9)$(ohllBK+gu2`~&)daVBJ zD|)PIO;Mz{EDVOR^0mgWONOR+JOoW61Ra8+-*h2PgrMgNWE#$i)pRaHR+48@L7str~f+)NXO>E)HsA) zHV~_s!4<6^u|dd&-ro)Hv;_pajlJ8&_)@#k`?V*jyy^pW{Mh7`3m_|vP7%2LZs!JC z@16GvdNoVR7LH=o6-JY{iMo&l=x&}`8 z`+Panv}1nF@re@i-B_=0%UbH$&A#`FuUo56WURy{!>0QJvi8_W9TY5zBrhfb^ptj#%&8ldMlK`ZM)1${b3#1iua+=u|R^#}0ys0D9QahPTP8}g<5_if;McHb)z{&O>*DMZG zpj*UJTyKl5-bfjq{Kl{H=?!)Zvnze_Pv{a#e`MWK9ON|D$1)&N)z6BzaOw%=NUeNE z))*vMD-r410k=HW>d_lSb!-sT1z@kr;PPA0``wX7;WpLHZwY$^GFU%j90h0tNX*24 zA;$i63#V;Fvz8VGq^Yg3)Iuh!nLexS$Js1LxJowGRTp`qJ?37NSYtP*WjRgD2I^zGb<#ql9d z5m{9jvPfEak-!^KpSsb*6f#PdZ;oyJdK$b^WYTA@I^u~KA4Qjfa^KMxpKXP@{?J!OQ_g~ z{wjQ{R4X`*9gkkCSef3^?qeYs+zPS&*jYfVAPBCMo@nJ1k+7@qY%_Fe5{7LR|Ah8C zpj_xV(78P`Ds2?)_C7w-6ZhZ%5~}S<{7td)lRs3X8zZbNGVYhuS_N}^jeSyv?+y$o zqb3=%7=b9$g-jlh@ySb}6$?486E=%A8DE5q6bqlP>MQj`sI{ zDL-RC#aw)QVf_9!9(6``AA-OAnEDoQ_3z10Jw96b?!0PUqWDwJIt4DtNj90c za+A(2OgbmrqGvRj-fX$*h$?6PiRlq}a4uY}j$U=W_2k9`*P9b$1s&l0Cw8zq;p0;JL#PLGUUn!v93%yX1{b>2eHMP{tCtnWLnK( ziQ{T6DM^$syV=vtP)QtaZ#bQkI53*B5t1#tS0O^Cj6T7+pv>-<7iYn>Us*4jFxt={ zjfMLdwJczQ6=5LV6{M$x5{gQh10fLx0q)z7zJf$`p0JQ8lx~&Yn#N$?{Y1fFp9Koi zgBTo((-+G?wRe_kiC;^uihdOD9 z>}pVG_OE?&Fr(}K&y9y!7cd_FiqGFb2KnEhcblvZotfwzk-3BEUBUTZ;)UL`RAx=@ zrzCPndJl=0Y*N4s5WBu%KVqw`SGf)meo@~Z7zR@hYN+6+*)M8(JWJ4YdzCH3m(0eIY{(|SI$F| zmYwst#{)+tp`VUMkR65CQ-Um(s$yM(Rw7oztS9QNdvpG@)Ty@!X=J8XS3+CwRM4e) z9#ism(0y`$7rJmzBWBM7x%HMTE|^4QZcwX>VuUQKi%Eh`!E(x8UZ{n|D>Co?co;(F zCQ$l(@vTP9EoBSG;_d0vi;6ec0CQG&N80Aj0#F-iE3`N{SHozvu2V+iSFJ`&(JE!& za&BV@F1rOQIcMGzT$b!}7{rmkGWV+a#=Z~p2}~;m_hCNIsLan2`yUJ1-2dL|10d$- zFB{(PITKp|FY({t!M8)Ntqt>L7SoojtMRvGseH%Dh@t4@eX-hYQSUUlOe3*$M!IB# zQG?sq9fy&q^adjpvb(El&-~P>A;W~owf|mhvzL)tSU~OhsY&5Fs}j%f zQ|n8c^2X$U$NBOCi@Nl|*I4hs%TAt5e8B3_d*=@UAX1jKJSVi}8j;tm`B1~@ZF@a` zld9iY&!cE(<5RzIJuekU(+A&RT`m<5wU9rx^}j9Tui$>G&DNLI|7+#H{nO)MfZvEF zxqXR~BKcO@G?3&cY@{7(E!h(Oym9=bV$mtT)$+82*12!D?H`y6h;(VN2Q@ zGN>0y&dM!=B4=f8M$Yb$3)r>vvgNG0+GMNsuX0UGG3$t!edb)JrH+_gC}P%UAZDj+ zEUBXFS;%T3d)v{4LN-rB!=!f+uC<>oSSrF~^15hk_u_GyYtAq1^b(&dGeh+Kh`~I> zD6~hha9?^1)AKfC@(b~UW~L7=;(J7VRm{3bFqQ$UE8JOQL-l%;RdhzZG2|2CuYvOJ(?^p7e@$OM|Agd;$q&q4x&EHu#|uQ3dx9t z^}~m7ia3)*X#ZBdraiZ`DEGtA-d*B<_`+4;$!o*vtBzB5-Y*M6@vw|0ruAQ;X7Lq59cvyK!D#Z$<-;zcxJ?(0cM9%5zlWobgXeuP!BT}ZIo3aaGo z#^hIw)a=LPa*}hX=Xj@{WxAeW-u6XO&!IvLRH+KA7Xc!m4E~3lBZjo9;?2)fahQ~P z^Hgq(i1f@b$1sX6dq^zSwW8digfc^mChf`kKZ*%Sb*}t|DQeVfPD*M#X#9JHIA}-qimSdSaO)ou zv4Nam4I+2@bj?)kkR(xY)WR$Jf5};Wn$$uR91=f9h%hWZQC;q6v+s%6c~t8wf2OiV z3P4Zf?p$39PUE_k3+-AakgwhxQ!Wlp6#~0XU>9*ARr>t#p*6zRaKJVUBMSP<4=|4g zBwv}`5n~mw$AI-M@}#D z3q|f%SMsnqAmU(%%>hSl%*H^J9$IdsT99|{AFTphPImOjCt7g_Ms^%qC_2VoN-i0o zk8YB2vrCJPVek#2q#F6@@eH9#6gofM=|6o#n6v= zOI#T;N2DUZ>4`io&~cw(k9I!^^c(3zkw8z&i%6ht@*;jX`%9p!#60-?oeH}nq_X`a zQ1x_bGW|s)Mw4gz5J2;70rcTLcJqf2K#yV}QSE+gm4dv1tPbQM1<)(!s7mf9U%l!5 z&+_Ly2lxd5-(UU+WmMfig10!gM!h-t^RLJk$)922oczIQ%9cN``amjeJA88mX(iW> zVrZA^N97wVg&UO0{-q54_W2o1&rLL#-CuQF%m3)b(ta$t84$1?K`~GK3MN3NJR}bm z=k43T9Cd^l_<7#Cy!^|A0o6b*Tw_IAvz^~yTc&>OKsp0RSJ{v*b0BqSNb%d%b-H*N zBexG#NFbRG`w?`T2VgmQ%8`G7H&~}JbOf{3(d;HSaw${Q&J3S}a*wn@53@nX%LT#s z5$bY(7Of0J3In|BB58~4Nk7LSPdB?q*vF%NHsbaG)7BgdN-LXQ!I_@i-35kuclj!i z=XBWr_@0I)u&lk1>N{Qztr78Hh|@{>ZgmL)XZtg8>>CUuiyRMsTN=iD02%n?v>f~7zkZNkE2H$bs57dSY~7ikrVf)+Fl(1L za?(|~d;sCnkOP6+=GX(egt)~)9mj=91?NEFjP$pt8~-&mI*v zw@OEV>gk|r{S2Rg{&%24{9NpsCDG*&#E&#luHGPgy%UDkLx{ZbmRD;wujwh|b2 zWnUATQW;geG8@JmP1x@Ht=8#Omth@K`t~;!uCL1jN3Am`S`t4w?0t%=)$w0}fJHWx z+%;mYRU*^{^RQ4BxVHe;y7`%Gb_Lm2^tQb{qV1ES1qYPxo>H0c^zdCfhQhEEdjVU( z|F*MpM7)kmN7v`b-CgI1;R1JJ@(%qaPjRXZb5vC%ZcP<`4C$adi~E{h-}c6 zsV%Pn=R{CnK9Q?Zq10L|<7|QarpTJeB9$AIn&~JyvQpByM2+(wL_}-14LUh2XSVgp z;a;ok`?6KIn3Ko~W`_;a+QLd}0H`rTg4#-UC7sYVtu5bEpjaC!P#0)WcMJx#7K6k7 zSS1CNkKPqfcL*ri&RMa3IbE$>AZ}GA_CTn>#xAxpWh-R4c#(laZu0$xwyC{80t)N+ z;0jDrpYS1`bm>z>Sw9C6{Nbu0%vqqoa5_UC+LthY_xL9lfXP^3SljMHg8k?q?umaL zzN^}a*N<@|$aIm|CVRPUys-2YWf%1h-=exAy1#FV!Rz(NMvJn*AT}B>n&fA6Tc$Gz?Qbv7&RrdvZtlb|A?soAJ6GmJwV?2cuZQgO z8=`$EZHvykyn%NT!tDA>97{j{S9DyAi$x>2*@*lL$>~>L7{xKH&xgx<4DPwg!IrPw zHc~Q_o{bJLHNm*}ssQvu$@e99b+klQrDQ3ig`!Z9>m_mppDqbK z%Ob+nvGcalQ0<$yd6J)%B#MJiV=O=o4KKg0JQ!T@nm8y-0|7C#l|E?-Vcfrx2i-qO zL7ym7MNq1MCY7>iVDiAib1SU>2FJ)D$7Rl75(~^L^)Qf@6=N7xYUpq>=s}mF*=k|J%>~Fb)40@S%a6e0;JN`j7g$igi1ier7@VrpE zvB8jYBfMP53j@zSNwP~`<`A=;LD~q~b3}7!5@u)y(lAT|_CXWp1WHfDQcThl>654I zvLHO|o9ZJqCvXNotnZx8K*Fil%X)+=n#A{&YF5ES!>+XBnmMx4OWaC?-8C!hxR!A0 zdgeX2&GuFlDTT|FIM%KPmrhtsjB55_o1VzM9>UgjH$$<{ibCG-KgAP^PblJ>_nO;Q ze}&sof6;Y@^75_{O1CeuY6{=JN}`OIwI>|QzJ!6r%4ghT_w3|-{w1_ zwfo{*W9Hj@87L-Oh`Tf0hPfr{e;tI3)P&KJJvCtrkJN-c_cAH)9iI+10$j$O6W%1; zzYnC6pW?jxAuqWWnwkCEcm>^~+xP$_X`@@6Of=o{p-&JUW4G{lSSfP_lIo%wTp--H zk|>nm!!WanFxN+G|FQ6B`s#3_=7=~(D7pW(8ibM?JtQso3y|c3=&NDyF%*D5o+sJ* zA%yF3p9C}|Wj;vYVz=J7(_Kc4Q8VFW9{BU5ODlM>iopRm2s4$A8C{(gRTqTcSWS<) z*D_@(X3<(>!45fE28XET48ehUy-X>S_^5~g{RsLc+}6?5$;OAMhFi7PA}%RO+z0zd zKmg6g_M8$BzdY@hC*M_PHfexL%BkOGoHu2%uYGm#@Ra{A%x@g(J*dV%8mtqet9DA7 zQcJj|23OWQ;Z7N1r+!xi37;P^-BPCZRd0A>%KbX8F|)nAjSAQ&#{Z3;H2WBYflQeV zE4{D?x4c#|h$C1FPjPEnqQZ7TK61-`@6#f>{|6<{-ml~jZvF2iRFLo)YuEbb z@5NA(C|Yl<-Q??+?FYNeAl{X`AHv$FR2&@TMzd=9LcrWUwkDHJy@;pJ4DVx~8pWR& z_=YAkMKEhi>o{Zb=dze-LSv4~s;PpJimr}}pL=7K zh;)PUGI%dtuPzF-YM2IBlG>fiZ@M4V??I*Gh!Le)_E(P~t2%op;gtXDlFP)%!28X- z+wlI$td9iCd|x+K<~D0CUCjrL5AWXFm&FaL(63a|v;GBDPQOU8{9c~g-_QDsNtO*! z4^+1PjD1cEBJm6?a45^QziLy~?`28@YtDmzN!qXrf}7MJiYEF&gqlFr&vrp zh_2<*ed*E(3|{uf6acpe#uB<3j5TeqiplqJJ0+R;pqvd0y5iGBMM5MC1f@zT6Q!t5 zWI~|3ds23RfE-B=#yF*m4Fe;N;64{%nWO2IGezyetu5tVsovbj$s^g#3ekOp9kW;- zDYpf(2E%Zr)R=Pj1HH%n9FfxC9`_pFgd2O@>v@xPow~EpxVBqbDEHkPJtajl1v&9( z;-x>8c+(%2N9y1rCy9-q(&cv2$%B%}Ug}qIv65ydKie>+9w(Br7Y3Ni&ST}uwg=I< zOBQ6z3E7m_n>7qhTA5*kRdmz5>Xe=I7pP-*S9a1jbMM3q8q@fAD4UhzC(fu=CWlJC z8x;{vU6#_wr^dci;~O&dpx-ZLZe<|%Wc?FQrqRV}a5rSvXWjxYb=*~0uSwQb%^>Am zudL9?PO8gclb!Tf?tOD?ZfFYXYOHvzd`-jqbnsvn@8HcSo?^A7M6(iPgTm zV3cWiieHG;zO>+gP?oDCyDK8KFE02~;Rj8qDnCACpF2JEUzf{>*e0e&Q4fwXCcmXj zIoqr|WZ)6yHG}1At%-ZLCwFn%@)wwAY?|`Fvz~2-`F!m>V1T(%ymnc2Lj-v`cFkxw zWPXiNmKd&-jP-fM1gF4k+g=f1FSyKQJafuV-a7HV$-+YJBCKpi?Rswqf&z}K$3^<{ z6D1`=7e&|!+;;+VMz?XYyqA#Tyl=PP*X}B_)4J`jd|k=+%7(n z{D8i8SAbmd=TqO)=A7?(zQoyCl|zj6Md`c_L1Yf&k3%#m_vI2qt~lC%cG4RsISgl$ zXq^+xPI^3-l$~@>!TXiD_Z(H}H)LJC$t_dn3sLhWOUyC0u2vusgR>$gJjhkj?{FY? zQ)rKiTYX-N9~5Gnxqfa#$=<$L@k_?sUinb`-1RfegMIiT_+T3zo;~5BVsCsj>${@j zePRB);jw@crFOIYhd0UJ8w9b_t`;tr|vs~7--bbGw!YN@SW^rH$FqH9#`Tc zq?34Ok8`54lX?o?*XQ09i0q`U zTts%#Qw8t8E_nY{?p^rd=l@Sb^h_vb&E~Gf|AisC@nKMTImde-cbCLK$N#VL11_;T zxk2!M0lAQ%(g&N^eFbu7NX*8p2^=oze}#K1byEhx8;4iTV0dtoz&mF@c#_b+@Rviw zGV7a-RDCl#WO8j${Kx?w_=`)$`#y@U!L*F+XeY7~-K>>ixfnk^jet@(9AdDH`ZZHk zeUo(wC|12(waMDSFw)-h1G1805E;2dmbPcF}*xevn%+N_|&-zuiqtKcfUvC z%=!xJ4Te1TEM!LXM5HUxRoT^4qook0FAwu!G68ctkJRjHGg6(0DRE|fwY6Nq3<}I3 zQNRoi0kbR*6YWZ1_VGxeu1AbKOo=n=4eL||vq4}s5Cu$Gf61sW#8ZqLy6vmU1k7DL zQnMS)NMjzR#F_Pt)-KdVZp0IqO+*2+X$Y7Vd6-X-378g-)a+(6(wv7Waj=4Qmx9?M zFk6TMX3G#T)s~{&N1bE>=58LT*{x=z)rNT}eI#*aeXCV1Fgw}^Wk&U=C$BD3y$u1p zI*;&g$p`R#JW}^8SB2!iUBzKkAt`2B;;ffHl3G^sDz(T{ex`aGqLyI3mTvM&2S z_uQ)r$^U#Ul47PM&bm(3vWi!!MV|6AJ67?3a4pH-wNkK1Y;!YOF?aCOS?qC;>-pr; zfGcqbmvXj-h2G}uW;J+^<9@W2Lzh5WU@oe!fZ6zCxlzxY7pYuUEdwMzrY8~rA386P z8Ikp0bEKG~3MFH%X4}4W4;?fx!$294oQFSA+Px9oXJ|0VrR8=5T4+Fk1~jVasF@ou z2g0=*F8^~V=*iAKu|3Q3r*zLr^COngRb2={PjU$yd2cef&X!_9rpaeuJ0d% z!g67u{G4>39dtS6+2>F{2cN4(+F_^uZ|d|i4S%!{hhL=*!;b1_=x~D$JMCq~tA0&7 z{a77#@{iGB2OqBvJNW48Ty47iaGmbdf6JgSV_yC4)%kxvD4f(`r~JE`K2H4}oxWO^ z_v>)44vV2hewGg3Ubx!-qG+~uiE`{fX?s0cak0Y$Qo3B9u5BwST5z~)DLf~ zpOYTYVF!Pm-BqURo1oL3{09xnKS6g$rOqGJVMB*QI^3wkXX|i_4xgsOD|L9B4zJeX zhz|GaaJ>%i(&2M-c%KfRp~Jq{Yaa8Z8ghxoD*pcTII_$_V zM_x4R{Eqx@(_xH5>UXaWJL7$|4m;!9;qOCqen*};{+CVmoo7ByNyP+N!NX-O{*9>VjL^Mvm>oZk<#(c48pKRxHKVB1=M&6FCfU zJ1C}<;gzmmGXj-=Bv$N{xxjcCC}0>c!^&n#2LAGGna2tG@Nq8}nVe zj^C^46FUBYjt}Vg`*b{|@k6zmCu7xG~?%>v)+?U()e)2EEqzRXXl? zTIu6GI_}c(59oNkj^h)jbgepmzm9k5I9~Qhm(X#CjvMnAcLdQ5>h!3JijBVu=etfp_dhG>snGBS1%-x54c$8x z9``}1_2hG!?ivN%uTyYtQR5RDuc6b3zg6KQcPlvEr{JQN!+uiZHFRm{xlQ9W?Ekrn zw`;!Bnr>FdlkZaL;ui|K_Gx;(?rqmFqVe+@4rn;1`8!XkdQl7m*mFLv3PeW_{2DH8nJy@Yt-|h2?uVH{j|2E=Q z=y{d&d>!+J zP{HKBw^hZTf31R-YG{z$u`Qc^mnHs;&VT!B6x~}jOj*h)u;eSV#H%!)2Q{43(2(P+ zI)0UgwHkgx!)c4$5sf$Ue_qR#(C`66UJKn;i(E-fXYd)&<;>{%&1pEL;iyH9>vVp* zhA&vk6Pmt+U-RHX8s4s9k*0TPx}zH2VJYW%3*TpTd9xPzpS0vl>T*7-;S(C(ui+sL z@3rthrTP4)PQPBm1+9l?bo^76^73^01`R7TJfLAvLwWHB^znd>KUb>sGq^>;JtYc8 zH0;x`UBj0&-E}(tOPxQV>TwVEHGShLQF*YfS_MR~fJ_aW7SmdMcG2-}`=0k|3Z{x8z zE5qi;QLoSG4FrmLKtgn-o;Zzyw1s zDKAP*^Htfzv7S%|H7bjV^+Y1!Xq=TqJ}CRR(|f`j2zrkOQ6=f5G@)=$XP2|v-wpXR zK3$uhP&$h<4)ML6-T>OGBN~pyw04}qK*)HH5Qc(flR7)Rp$>o0P%zcj?G5!hDR|5Y zG8!ywD%~D!S?%HV`5;29Ef8w!i9uK+4td+s0wKSFKj!TY1bf?km!v|h8t7lBY5cGeS-jSLRjp4zPT zWK>?uX^1V*E^TZVsf1Wtx?Q@V9dD<O@%t5{kJiL$^JwB_{nhec$+VLQZ}d& zhjyhBjJUN*p>W&Lo@2-S(Kc!3uunEhJlqiuLI^b`P$6tkv&^#n+hQg&(QV~a_Gay6ne;%&X|`KQ zm}R%h7@g+2vA#yTp-;u)rokqShltMbF{dxwE&HJyM^#^8cG|P-V(6M#_DsBPQ$-gI zANPlxk$|p$#(tgN-1d&)TJ|3&s+Q?LrhF^(2M&xm`-9WarMW-&6aJ2#I4$3KEFA6j zVyu+Is2uO)*b7ad$=FYvR-;1A0vJW&fnxzb2juSX3B%9>!Jxm>8+0D+jr*N3bU;5w zC(?(!5!5CU4S11&Q5zMCN5esmP--BP>N5Hjvijvv7l=8%=D}C%)@k$?ZTD!WtbUPJ zhLLWq0>)|8FVyf4`*(J91%f`RyhDyyN*<2q9CZPWqRr-I!l&ttE`h3<`y5?zd?yYgSF=A^%9&P` z7w+ij;f#Xxo*;Uz>b+5Kh(-(-i_`8{2-XKM*Qg%!b)#@tl7mv*pNOlDEteNUj#p$S zx!|+&^7)mTOUsu|r`4c|)A3ku_t9`L&>_vq8T6m<2WbIVmGtPvj_h!9+@ul8A=;T9 zH%;rY7T7=40oyk^6bTO zXsdDMaP;M zbj)Yel<-=l@Y{odS1}=REc3XmPYBPTIEpf22vtCG)|9Tv8;JQ0Wtx<~{iGgGAcdkf z=R&@C@Id?^IzdmYIb0i#)p4{x5N`G#m25@D=_l_!y7-gYzxd{De|AIJ@ZZ}MI^Evy z`NT~hcsa6EdB@-U+dF@@?yXBr8zx^Y86LXh!=JA?`~?wxE{xS5ekUA}>!gr3cqHaK zj!4ImlY!t73=SdHZDrKx!xddv?|Xw>c8YkkM|RXsKgNqdhv*3%4`J*`FYW`Fhd6v{ zv9RvfJy!!goCu>M9uO^}5&!58v^1&!!iJpQZYi!8lUTPmc+v~ewS?a8Sl|eL?i^vj zlwQ#hi3o8J?R^Y7K8d!8qHT_d8ng`Ci7geA@kUS?J#D+hsb>Q$C4yXG*zQ44N5u*G zyix3ua`I6d4DR#CYl7Zb?5?AKfEBe)SzhjbSagTv7Sl2v5!GV9Ec*!hI?FjBt)3-i zEL<^swftI8$Bv6|#d@MT62bT;m*5Amf>q@JUlZ=e%GcKz2myyUs_5}XbyGso2mMiu z$9u3sz^@|2o49I-=^qHj?>01ZAk^uMgku3Ysp_~~sqk0g{(Ql|$|!%k0`wIGT&1Id>Sm+PL*=+bR;rAU3 zbcP^nBZqi_PPYOcYKg$?%+zS4y|4%`?5hWD<`;X=esS4$udcoDd)fP|yT93+y1nd| zf4u#+z?VjT{EL0JU%2N@`#|$;d>7+4 zWui0qu^vv~8FvFR-n9bV12#o>9*}f%faQR620zMeyhkcSI^&)kbd>WmG8Y1HTw2T{ zUN2)Ae&idm&?OMJ+5zSH%*#46Kmq(b;sY9G$d{o|A;}+fPMu)ZpU1?HbghV6%a!#t z(Xk%oh_`BfM!AHkmoyT9@kzw3`pZychnzY}`OK~|xh}vs<+u|5^snHbCPoM&jo;Pz z$C{^+Hf>3>BdrWR{%iPuKmg9jSAsD0I*7DEq&a?y`ag^JihwhKi}0_+Q741QV>ma$ zzYVX*mDHMY+?mUe8@|uPo4ANYF8fu=UYTajH)x^rfX>jbnQq>~pM2;jO+k({;+-bm zW}Pvg)n#ghz5*Fo-c%00%tzWa@TmpHlv{va3?62=CrvVta^94O@dV1E-O!oy4Or-m z_Ewac=kyBg(Un7X%17O{TX>TjWoR|YYVa)p-Yl1uuVD}MCc6CyTkQcT=_o_Nb2?%I zEPv)_CWH=>etre~jERq-duEGVjWG;)u;*f#TY|m~T64Wz7TP4@j(=X3U3BHZk&68* zWs=95Hwl??mFqU;F_$K7!ck;Nf&7Lu=XY50XQ(hPBM<9`y)w%j+t_eser$KM%TQtb!yoRo|2yWR9Q;zx zn{z>TWj5Kzi8b@@`;q5=qP9~n?)|@GyneR0Cy8ab&qAA_rP)@!50&N0M+n7c935$#dtr^Zh7aq_V z^eOO9{M&N-GUqXef7`s~dO1)pfpW2TX_>S0k2z~+Zs!E*X?7VZWgD~u>{VLk%yev9 z*^W8%L|q%S=5ncjvx`8!T=U_SMZOtb59@gCLA&L09Ixt4WhFpY4mp!6&>OOnm**Or zm_=UfIm_ut%QefaMMe_S*4xqkR!97j3Gae_FDB2cwMA>ajCOaUT(kbI?M^vaANHrE z73z~T$!*qCE84hkzxyH3Yi=4p{KXM8UqEfKP0!?a^P;ity^aph-0xHG<)9jVs7OcifBjFkQ=^}K zU)^J=XPpl{_nEKXBK8Nk`67HQUQwNSOI$&{RWxunz%gta5nF`q(wOJ2zx}|y`#wGY z)WSFOPki3ibg=f|UzI<8@9oLEe^&O?@aMnh9QZMVI79aL*cMVdJ^Mgnpdxn z`NTAS`xJvF>hs3EWk;hOh<_XX9-XNoAaOU540~rOny7HOI*xUsEX3I_D{7i>w|q@C zY5KEqjl>NA=K|DpEyPV{({V?Yn90I5NPe>x9FcR`IGGpwXXX2ricWtQKOvJJ_V(ia z6w2*97VyO&`von3Cq6bK?nK;Of^=DLtP2(}Mr8C5C65`*Q?kxVH>cPyiJt?W$Aq=c zh~G)P2k%$z1T^7y5&tpZL2kz1Og!J!M`q zlVx%b>6)T6oh(y0@taJRnKo6i2;3wlxe95jQE9+Q%o}Vdi36NPe6|qrqug}_=LR3f zBT7zo3R9h>y^D7IUZd>MShSJwB3>Xi zHX%;BXr4>cyGl#fh*BJWEkXL4ro70Hz~A!>ZpYZF=HXJ@U0UL^i<0JzpxGcwK4p)j zhCu_VY?NsaU}=#kjTeGXfhcWWD@svz>8?xWZJSq%&3iUPird$F) z^iYy*bH3QzB+GKywyhW2eDKZd#J0*Jv2B-QaqE1^?B;2E#8#9qiomaE*BbC!1zz{% z+aR?M;f9GiT^6# zhCH#swn^9=MZ)3RARNub!cn3?M(5|ITY>NW1xp}?VT)B>Vn$Pe+nb4C1dU7;r z9-9iqrmq$+uA48MT|2!xlHb0{Lmk-)SBXNKLoi%=6+UR$&g89%_OO=Y(v-#>Q;ifl{|=gN&75DJFXWSA6yqHHR*BspM=;{RwT-N#li_$w?S5Wld=x# zc@XJb`+O8OfAv1qFJxIwD67yW3RyPcj{rC3ql^t=5V>%{iTOT~8EW^w7FV}9#w$@J#Prgl4IVcT79 zyFtJnW|d{H^H9E}pJ2Zj3TL@uT*R3ZI`+7xD6yOO^TkZ!VF z<-5hJ*20eflFuCGbmmh!EP@WzSW(i1w!ET9Tv6!|SN!6V#VzxjW;agDzU?W!Hn;sy z_F2fziI+Uz09oJKrNYMn=}rVxy!4HQ;&qj`i&EPgGHs;WCj}nEy8iXL-fsm2N(6QN z-wlXmh#1i6$>Zv`{SUhpeh@1k%1~OiR%|;e#|Nc%*f!g!4`nc&G8vFzI+jCUWwQx4 zpy7s5R+WzIi>ko?1!VrxBG|{SH6DX^=~d{L(JZ}5+h{eFOAgO~C(C*f&@2brhV^6G zv_+1;G|BNfHEW4y07<(#uG;l5pj9rGU3%3TacR@m#gchxg;FM$MW)IL#cMy{N-{O) zW$R`OXsMf*Q7&CckK(Zlkaf8q&?*nh-Bgl~KAV}F3bZVbe_XN=S775a^ECp}m2NA* z*pIPH+i5{leuO%o|FKH{yr#GEozm$a#>RT`dmNB1*E}!)+H2ma<;|h5E~JwO^Ba)5 zr!%06W!i9XmHHiMZrAg`xeY?VHmyT5?$0&O&a)hF4+FByKL(z>h5+gQ29Wk*wnNHU z>Rc@xM~&82w(r)uU_QgfsxY>bpIN>};M^qA?gv^Hw}Ak>{Jd)SQ}-z3uK_9Fi&{QA z(&=skw8}?0N?nEGs!FHWYP)pVIN(6~SCN2e# z0myu%+g4#7#+-(+h4a`Xl1nj1yv}!}xm-05>hWh0^F7O@JKL}LUU$EWHvzJoM|AwA z51Px_nl2{^noXP&uok0z&VVQ7d7G}s`;m{X_W^}h<1gl}W{kn;4|4pyq(EE}hsS#F z60B)1*|llWMx1XW;v2*z56XGoQ@XQQTpiybuJ&CouC9E&xY|}G(kmieZ?0G6I?lXq z*d@oO>C(&Aip#L>x(w?stfL}Z+SNL=5c2)>qw4ffH{|9iq8s6PkmxIj6L!P%OwlEe zD){FJ^LSAJal-Gx{}}#@h!Yk<7d&*d>5~fb&v5emQ3!Fud*FE#=>p<}kD>hYfVccP zwWV}l_?k81HCQjbCW=`pVsAIr%-=n&PB8r`XnB%plOx;q4Z0Z8J`UfZd2Zr*W>=oe zNUz4&b07TEMw#pL#Cojd%xjsd3rZeCCfY>T+U)-F67n1K#os-m=*|6;JT}SktQcz{ ztcRLpt3?bsYLn0}d>M@vuF$l$HE3Q;;y3h=5bdBLv=!%zVyu0NF&8lp<+5R{mg_ql zs&&AyZECJ^*^Ib`q|eJ=g*B;IlaJprhI?vMg<5%+o5kfJ9szz9>oT*mBQklF!qM)T z=72BJycjnef2Yxz>HaVW-SZkZpF<9gEm*vY!5p$MiOzB5t1GA8QYZ3YIbFY@9QP|I zhk8qak5z9hgWpH#41LTX+*mGASr6mer9nsi{)e_RGokw$6&uJ=pER9Q-v^};l%O5< z>Dhtbx*nUD<~sxYhBq8Ti`XxcKzbF@7m!|VNq7Db>nx=6H#FZJxJ~H>pOxUdjSHDH zL8XrG)sXKU=zHA!Zp}18uvGZu=iUYLf8Xbvp05p zzrVYhN8$wbZl*DNqkccmG1hQTbra50d1KhP7?N-14vK?v_u<}XxVxtDU_-6gB}jkEoe1Ed3lEejlGxsGv?b<`;#WqA;)QL2_1;*Q+VQwX;cBtHF&geAp1nwx$w)0< z0j*MTCA=iDDNJ>TJkF%0LJ9xBow0Z5x?=S$pcn$tr(hRP!P|l7iA^5jbT z9Uj}{flZ#=6u|K`DG!tKEGhks$X5%05WWLG3V#p$N8lfU|1|v9;4i@c1bzvgBV!(P zmoHX}HTa5F01GG*>%@BX)|F=#`TDgc7>@Z5;(P}WLlV&t!hTYm48-XxM(@H-Wpgs$ z_U@7Ar(`mts-a~RZ{{uejd%6rg>VZtf@bm0LSQ3ojW^U13WmMD1L2c7_WpvR$=`_+ zO8%(YB}oUpwS>W6#!)~Jc9&ii5B}{Z!a0w4^E)(u5;0l0qnsD{N@w{%oKC4a{?+30O@3vQR zzrQC!wdL>ciBJ~u`+FjkJ^WJlq5m!SM3ji#yKi*ArMlHqSKW#W1l}gv+G-Msy*TgS zug8iZ=;z=4IZP~0xB|!dKVrIplIf z?oL^*Dwd@@lh2cIShwaM<3dT?mycsJat+lY+FCmz@x6f{W-0MW(dO-rb++M%Ki(X@ z%Z6jr0UR8Rc8l)ViH>Mo9Z0)D>?V!}w*78a7jpi@hV#xi`&+#V=dxw!ozM~{ZXDSm zvw^%e9oo#A@?;#C9}8z{id7jFY|$DVj>9>W;6ZgBoqGc6PGE(WnK#8{qS5a?;a^6% zR%D2pqxind@5-pXLuBT8Yo=8=^QNZbOpe1?jbPy?5p^LRHB?`n@!dBIyEn)$`FUw9 zPRw=sqsmVB{!_}010)ToClBdz)v`)qjY7pnQH$kjd|72SlI#AkuP5k7+xU4Tr<(h2 z>iyn`TbyGWRts4@jo_Oma#joL zOUMJ??mMb8N2WCf`ANt1v88nI%tu|0_H^z+smECYC>n8SP##tjVuv^w^!p%lew>J7g?YQjCVPV`6AO6ymXL%~~#Jt$AP zaz{gTjBO_OHeAY-=0L}B$p9zUEjM$-dP5yuStmeE6gY!~y$hkv9TB}*#7vlru7fAf z0v)-?mz6Bf+(|XE1oIhG6K8pQNHB0Tiql;funHepsXIjH6N*#>{^`UArBWp>J{TN!+Op>Fl7zed1nhmQ@ zcEm!s7eag@uPp+jN5z8T%c6}i?~TWr={B)uL4JH_skUEa9c zG)=VB?Wy)4J4WU^1*fp)u4wpVy0_qqo1TM&c!(k10U)l*Yr%lY-^uD%(qULTdXuRS zmvFR%K_B9|XY}~X8RxIAJN>;Jel{>(7wYNO@jNx!d9?Ye!4y5X40Q5G`oX5djhHqd zSg zSZ$6#ib%0p*8eP2`nIE|Z3p7%#?=$Cq2*8@KUR#?pfKN?{$VmReYk91C>nO_*-%%sW)WcR?!A?RH}i*Gh7>v>~x=|6R2$jdgEy z8I;S*1;=<$GfcC~Rc|F9-WVz3X7@_6tf03n$+a3*F6TEClA|8DD+iZFVV*WCdpTW8 zLyNi$Kq_u|`XRN~Gd(rAapi#0@x|(;-s)j~z@-AD&cW9-8|F-x`oUX1)ArDdmD|!l zOURU{G`hUpmIitJf3H{GV`gy7MVG7K<#dN&2RLkA-Px&b6wqdnmD#Yiob{AF42zAp zzY`ainHvjL$WdOKTF0sm_iFO(QJ4aj}a0hVq-j;dos_mA@Z1+61ut!cQ@DGJo(uxaOde;No&9z2G|t*Yvqs zy=>=h`8}g8%NA~IY1`M*Q0sQ@F|p58Pig;IS##S%ZXN2j$e{<)tJb6z_TWp5S&)_U zneE_W`dg+uvdkfep}$ZZSAh9_ugbuTZ+OPvgZ=j1&L@vuP~S~i9JT=cw;b>B`~dvI zud!zeaQh~}7lpVU@bBT5u-AisZIye<+gIaVI^cC%uucGd67c)*l`p`T;4T_??nCwg z{s;UF!k$Zn_%{3;!o2r0iv6X;^ZL)NuK|CAw*el(cN+)z@Egv@;K`HUa(;yGIJY8P z{#xw0fNw_lJmAi4C7gf9SYxDq&ooq%`4lji{7FX1V}3xMys z3QY$5djX%^j{UC)&jH^2I_Lyp-aPuR@XsSG@V%6OuS4Pi{~exs;DP)N@Z|3V+zVd- z9rD}ko32&#ysh+GIy?*b&g<|-0W`e8^snH_llPeZ2fPb-@p`lcd_CI&uoK>ca0GB3 zz7^pG!s}JI9dHbuG?Rco)8Xd<>vy2-fcF4?2EGg7#{qAz06*dZpM$4Pc!TO~@T?0j zQvHw)^FGz8o%l`xdN*J{`~bqdUG+=w)Wg>RZ^1V@hWV}TXO-By2^xNzI{;5Szuo;E zzTHg%&u@5@Z&Y>Ux4Z*4Lk8gaJ@1q7r04g&pWXsm@_7@=g=hN?02bV;WZnjN<85do z(D1U>&%jfD-r4%B4ts9LA7O?k{tp4a2T%S_0WN90*p0l^LacuY`T_Lp!S6$aTLIr* zgLXmK2RH&>i|~2C!dkR5!gj!Kz&9iO1Yl(y^o;PWfKhnrDgpSg4xa}63mtwO@CQ1) z2>ANFioO!?2z&y3e1O;PL;VrvHMDPsr~JH#_OIcmfafi=UGT*79@>|6m^aZT;3Xb# z8lLtx1Gw!DWgBIHz3{Y+KEOqI+Sn4{2k%54@P7#KX?WVwGk^~^f(P(}fIo*PehJXG zU*!z~J^@dj7XaUUKfL$@@58*1nBk(MjZ;i*}kP!p@B;Y^y!0xec=Xt=@ zClt+kz{_;F4DciHtjlS@7vR~idBN}`Jlmaj3V$7*`sCHZ-d?mJcy~|1B|{C<1_XpCIJ7>A3`q(CjlRNm*USmiN6m|{=Ay_ns=+P3vl>7N)IW(^LlV02dIpLSUGyh)f!Gb4#6!5$EK{m`mPXQkOAo?cepmxBIJ^&lxd<1ytLy!UO zegyF6e~dW@_$9zcKCJkp0KYzfz76~nfY*Km^a#5E-}W%<2Vq{K{3v|=i?DUT=i#aU z7XT|h3j10EodCWIp89+*;Oxg>Yrxx2g9d(vG=O99&m%kunD=qmAi@QJe+s`1d%;cv zej1+qxu5l~bXeZp{0Sv<0pP9hY$IOg{FO%#N8TC0e}bsn0t(6)>*D+;{bH9UcYz zF8q4#w>pEl5}xhFTc*Q0oB$kzXCF@j{-q8-0r+zre(EglK^wyxeDLW7T!i0-F!zgp z7oPLJI0qfVFF|G}U^jd@Xn6kRBkoE6Xe-XYN{e}CXe+a*XF!v!>!1u$R zxu2H%XBS{^gco#}`&hYewIB9ISfj(-uI z87AcZMTQBvcadSjyLFg*4?nEK+^_h39p;|HB^~De!OJHhCv?I+fF5}A;a)$U*JGGh zeE&aq+7EB~4nC&Z2pY|D-DBDBL#9Sl{979C(C}>*y4kaeZb{>dQYyYp!wL=E8fF#x z`^f)F4RGhv0!*kJejOxq1KI&Gh4ulMoZ6=qSpna_0zR1oUzm@1+{9T0ah3=8nHBJJ zz%Tf1;-%sY!K4rKCWa%!@!Z|%RYr{a$qtJ;aY!_aHuyT+Z|K3CT`j{ID$HlAuxJI{ zLC_rnU6Z^A@h))y@diBi;wv597xRDq68DPn#?5E*ymuIIw@l?1$b4us+x-Fv>_)>) zd{NxT7s7p@djWa#C~tH;hIQcb^ORMts@B{yorii-_=oz8BJX z5%bGJmfzy&l+;mBhfyBy0t_G&0(HCC23|(lwcrqwH$VnJo1wxw1=Ni1fVOx?s&QAP z6LsLNsUhK%lJnNmDCFnOj+7=SUT5NeNT$ZprQ^37YE&WpPF=^Hh`$kaeFHd_qot^w zJ-EA&+VLT6CsJH8A1Qg`stfMcHPOA|xfvXoebM+2&hJ`w+81qkgmi>qV_b zpij0+CvI8AG7Hm=6ScP9jJc9dD?nWhPC>v7mza!EyT%=ztP93_Df3;Ll69pNMtd-( zS~ZvKe;~F)c6BSK4;t!#w3*ss@BK2FKM5(6Mse%1yrY(wyHI0FrR;*X$X4xztZdD0 zNQpCV_=asQ%i5Y3YfJK|g}0$6@s?Agh8b(;_cwHO^g>D!Lg~B%)og=>`I96_yVVE* z;h}dUY{OJX->$-cg7BYw24UReIZ3~S@MHPnF?uHwoycL7A4NSgr4^$mQxaPa9qvf? z1?I@~1neZxJz(evu^o-F9H7gUzow~S z{|gu|S0kO{lJy?aD&VYlnSN~z*4%Z6njZk9jtf9T{bPI=YvHHiIRrlhBzZp1L^?$; z+<+W{8v)sfeSkIf)dyG>_(?a4C+8Tx=h_BX4ej&R+Z&)YKW;AWfo0M)H}7e@04B`W zT({pdgD~5R{s|O9{6D_Q+0*U~c)oPSmdh8u`Rv;^V%=wZ`Q>jxw%U8~xm8}1%OR~+ zHoF&D@~U5c`DVcT!`L#C#$E}`nmhkA-_)~K+t$i{%=>xOIGTs5+w+m1LwmiLAca70B!)eW{)J%5G z@`~4r4b;qy%OrViE=lq+fAALPF6gvCJu!hb9ja~z9h(E*o`O!6&)>h@+yj>4E>DeGtRmc4cc{?~ z$g5v@S$VcG{O%7wgPf4s=~wr{GS+eQ3>MsFY582 zc|EmW%|+L1TdM*jp9CQ1qW1!_+$liLMU@C^8H5WwjJe1GyqZU|XClr+obQ;2^H4v+ z#ym8M0P%f)`ISd+*nFVn>m$xHOP^cyNj(phqx_4_Lu{+;c?9pomyf-hG1B?PJ23Kd z{EtgZRqH{nzBxZN$k77t2{~@TSP^oan4YETmT}vWi(9eg z#&sQMxj5!@HRq96o|^Gqaecku!Ftxg68)IOId}Rkl5z$sW_@2VSN^319M+NZU{J1_ zGiyO(MV+3{Ua=Mx*BVHRoyw3jgtlmu{fjln>g!d_vWiK(+IpKECTCdeyZqxih4 znWYYx%skg5_(B5CJjadZz|Cl!d9GQ|IP<($f^mY*jC1F}`Eua;a^OZaZsP{U zm(Q;OcRk=M>93?OgTGiWB#kpoldEs3@?J@QAur1IN_qilDci+tn>3uCb6c#+udHSz zD^zt`$+F0wW3o!m*bDKTM?HWXd*SVi(EF>IN3(w~{pNYogSq2>a^6gWALmW096$-{ zyoukjS@R};*W#)q>1x4;j(S)^*a`fA#>s?Sk7@jFV}@iw(w=lAoyqc~D_NgxO?D*{ z$^PVEGL@W4&LroO3(2Kq!H{F9e5h)ueyDY*YbY_)KQuU$8k!oK8JZhf7+M-C754R3?4JU^ChX;pK!&AdE!*jz6!%M>jBaV^sk*bmUk=Bu}k;F*<$lyq7WNKt) zWNu_(WND;e)G=BwU@DcG zO3kF^QVXf2RKYpNx$<*W=jzY3p6fc7IM;t}@LcNL)VY~+^XC@MEuLFCC&mlL?ctX#{0(y#s|lfqPrR*Fea3z^g0`7CE5?Kvj+hR@k0o!tdShN(27|QhTUl literal 0 HcmV?d00001 diff --git a/DarkLoadLibrary/include/darkloadlibrary.h b/DarkLoadLibrary/include/darkloadlibrary.h index 219f660..e5780d1 100644 --- a/DarkLoadLibrary/include/darkloadlibrary.h +++ b/DarkLoadLibrary/include/darkloadlibrary.h @@ -36,4 +36,7 @@ PDARKMODULE DarkLoadLibrary( LPVOID lpFileBuffer, DWORD dwLen, LPCWSTR lpwName -); \ No newline at end of file +); + +SIZE_T WideStringLength(LPWSTR str); +BOOL WideStringCompare(LPWSTR lpwStr1, LPWSTR lpwStr2, SIZE_T cbMaxCount); \ No newline at end of file diff --git a/DarkLoadLibrary/include/pebutils.h b/DarkLoadLibrary/include/pebutils.h index 5bf1f41..bb35324 100644 --- a/DarkLoadLibrary/include/pebutils.h +++ b/DarkLoadLibrary/include/pebutils.h @@ -1,4 +1,5 @@ #include +#include #include "pebstructs.h" #include "darkloadlibrary.h" @@ -16,7 +17,14 @@ typedef NTSTATUS(NTAPI* RTLHASHUNICODESTRING)(UNICODE_STRING* String, BOOLEAN Ca typedef SIZE_T(NTAPI* RTLCOMPAREMEMORY)(const VOID* Source1, const VOID* Source2, SIZE_T Length); typedef int(__cdecl* _WCSNICMP)(const wchar_t* _Str1, const wchar_t* _Str2, size_t _MaxCount); typedef int(__cdecl* STRCMP)(const char* _Str1, const char* _Str2); -typedef size_t(__cdecl* MBSTOWCS)(wchar_t* Dest, const char* _Source, size_t _MaxCount); +typedef int(WINAPI *MULTIBYTETOWIDECHAR)( + UINT CodePage, + DWORD dwFlags, + LPCCH lpMultiByteStr, + int cbMultiByte, + LPWSTR lpWideCharStr, + int cchWideChar +); typedef int(__cdecl* _WCSICMP)(const wchar_t* _Str1, const wchar_t* _Str2); #ifdef _WIN64 diff --git a/DarkLoadLibrary/src/darkloadlibrary.c b/DarkLoadLibrary/src/darkloadlibrary.c index cf6a43f..a998d23 100644 --- a/DarkLoadLibrary/src/darkloadlibrary.c +++ b/DarkLoadLibrary/src/darkloadlibrary.c @@ -1,6 +1,40 @@ #include "darkloadlibrary.h" #include "ldrutils.h" +SIZE_T WideStringLength(LPWSTR str) +{ + SIZE_T len = 0; + SIZE_T i = 0; + + while (str[i++]) + ++len; + + return len; +} + +BOOL WideStringCompare(LPWSTR lpwStr1, LPWSTR lpwStr2, SIZE_T cbMaxCount) +{ + BOOL match = TRUE; + + for (SIZE_T i = 0; i < cbMaxCount; i++) + { + WCHAR a, b; + a = lpwStr1[i]; + b = lpwStr2[i]; + if (a >= 'A' && a <= 'Z') + a += 32; + if (b >= 'A' && b <= 'Z') + b += 32; + if (a != b) + { + match = FALSE; + break; + } + } + + return match; +} + BOOL ParseFileName( PDARKMODULE pdModule, LPWSTR lpwFileName diff --git a/DarkLoadLibrary/src/main.c b/DarkLoadLibrary/src/main.c index 014e32c..d48b5cc 100644 --- a/DarkLoadLibrary/src/main.c +++ b/DarkLoadLibrary/src/main.c @@ -13,7 +13,7 @@ VOID main() PDARKMODULE DarkModule = DarkLoadLibrary( LOAD_LOCAL_FILE, - L"TestDLL.dll", + L"amsi.dll", NULL, 0, NULL diff --git a/DarkLoadLibrary/src/pebutils.c b/DarkLoadLibrary/src/pebutils.c index 55aba36..7743f5b 100644 --- a/DarkLoadLibrary/src/pebutils.c +++ b/DarkLoadLibrary/src/pebutils.c @@ -26,8 +26,6 @@ PLDR_DATA_TABLE_ENTRY2 FindLdrTableEntry( PPEB2 pPeb; PLDR_DATA_TABLE_ENTRY2 pCurEntry; PLIST_ENTRY pListHead, pListEntry; - - _WCSNICMP p_wcsnicmp = (_WCSNICMP)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "_wcsnicmp"); pPeb = (PPEB2)READ_MEMLOC(PEB_OFFSET); @@ -44,10 +42,10 @@ PLDR_DATA_TABLE_ENTRY2 FindLdrTableEntry( pCurEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY2, InLoadOrderLinks); pListEntry = pListEntry->Flink; - INT BaseName1 = p_wcsnicmp(BaseName, pCurEntry->BaseDllName.Buffer, (pCurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4); - INT BaseName2 = p_wcsnicmp(BaseName, pCurEntry->BaseDllName.Buffer, pCurEntry->BaseDllName.Length / sizeof(wchar_t)); + //BOOL BaseName1 = WideStringCompare(BaseName, pCurEntry->BaseDllName.Buffer, (pCurEntry->BaseDllName.Length / sizeof(wchar_t)) - 4); + BOOL BaseName2 = WideStringCompare(BaseName, pCurEntry->BaseDllName.Buffer, WideStringLength(BaseName)); - if (!BaseName1 || !BaseName2) + if (BaseName2 == TRUE) { return pCurEntry; } @@ -64,6 +62,11 @@ PRTL_RB_TREE FindModuleBaseAddressIndex() PRTL_BALANCED_NODE pNode = NULL; PRTL_RB_TREE pModBaseAddrIndex = NULL; + /* + TODO: + Implement these manually cause these could totally be hooked + and various other reasons + */ RTLCOMPAREMEMORY pRtlCompareMemory = (RTLCOMPAREMEMORY)GetFunctionAddress(IsModulePresent(L"ntdll.dll"), "RtlCompareMemory"); STRCMP pstrcmp = (STRCMP)GetFunctionAddress(IsModulePresent(L"ntdll.dll"), "strcmp"); @@ -307,11 +310,27 @@ HMODULE IsModulePresentA( char* Name ) { - MBSTOWCS pmbstowcs = (MBSTOWCS)GetFunctionAddress(IsModulePresent(L"ucrtbased.dll"), "mbstowcs"); + MULTIBYTETOWIDECHAR pMultiByteToWideChar = (MULTIBYTETOWIDECHAR)GetFunctionAddress(IsModulePresent(L"kernel32.dll"), "MultiByteToWideChar"); - wchar_t wtext[500]; - pmbstowcs(wtext, Name, strlen(Name) + 1); - return IsModulePresent(wtext); + WCHAR* wideName = NULL; + DWORD wideNameSize = 0; + + // MultiByteToWideChar returns size in characters, not bytes + wideNameSize = pMultiByteToWideChar(CP_UTF8, 0, Name, -1, NULL, 0) * 2; + + /* + Attempt to allocate this on the stack, seeing as it's faster and we can attempt + to avoid funny shit like heap fragmentation on a simple temp var + */ + wideName = (WCHAR*)_malloca(wideNameSize); + + pMultiByteToWideChar(CP_UTF8, 0, Name, -1, wideName, wideNameSize); + + HMODULE hModule = IsModulePresent(wideName); + + _freea(wideName); + + return hModule; } HMODULE IsModulePresent( @@ -336,6 +355,10 @@ HMODULE IsModulePresent( pLdrTbl = (PLDR_DATA_TABLE_ENTRY2)ucModPtrOff; + /* + TODO: + Make this its own ANSI case-insensitive string compare function + */ BOOL match = TRUE; for (int i = 0; i < pLdrTbl->BaseDllName.Length/2; i++) {