From bd88bfde5270e1372c98c76bc2fbdd828e53c623 Mon Sep 17 00:00:00 2001 From: hasherezade Date: Mon, 20 Aug 2018 01:56:30 +0200 Subject: [PATCH] [INIT] First working version (for 32bit PE) --- .gitignore | 1 + .gitmodules | 3 + CMakeLists.txt | 18 ++++++ README.md | 9 +++ libpeconv | 1 + pe_to_shellcode/CMakeLists.txt | 30 +++++++++ pe_to_shellcode/LICENSE | 10 +++ pe_to_shellcode/main.cpp | 108 ++++++++++++++++++++++++++++++++ pe_to_shellcode/resource.h | 4 ++ pe_to_shellcode/resource.rc | 56 +++++++++++++++++ pe_to_shellcode/stub32.bin | Bin 0 -> 51712 bytes pe_to_shellcode/stub_license.md | 31 +++++++++ test_shc/CMakeLists.txt | 21 +++++++ test_shc/LICENSE | 10 +++ test_shc/main.cpp | 32 ++++++++++ 15 files changed, 334 insertions(+) create mode 100644 .gitignore create mode 100644 .gitmodules create mode 100644 CMakeLists.txt create mode 100644 README.md create mode 160000 libpeconv create mode 100644 pe_to_shellcode/CMakeLists.txt create mode 100644 pe_to_shellcode/LICENSE create mode 100644 pe_to_shellcode/main.cpp create mode 100644 pe_to_shellcode/resource.h create mode 100644 pe_to_shellcode/resource.rc create mode 100644 pe_to_shellcode/stub32.bin create mode 100644 pe_to_shellcode/stub_license.md create mode 100644 test_shc/CMakeLists.txt create mode 100644 test_shc/LICENSE create mode 100644 test_shc/main.cpp diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..fc2ff53 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.aps diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..4cc5a67 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "libpeconv"] + path = libpeconv + url = https://github.com/hasherezade/libpeconv.git diff --git a/CMakeLists.txt b/CMakeLists.txt new file mode 100644 index 0000000..c64e34f --- /dev/null +++ b/CMakeLists.txt @@ -0,0 +1,18 @@ +cmake_minimum_required ( VERSION 2.8 ) + +# replace "peconv_project" by your own project name: +project ( pe_to_shellcode ) + +# libs +# modules: +set ( M_PARSER "libpeconv/libpeconv" ) + +# modules paths: +set (PECONV_DIR "${CMAKE_SOURCE_DIR}/${M_PARSER}" CACHE PATH "PEConv main path") +add_subdirectory ( ${PECONV_DIR} ) +set ( PECONV_LIB $ CACHE FILE "PEConvLib library path" ) + +# Add sub-directories +# +add_subdirectory ( pe_to_shellcode ) +add_subdirectory ( test_shc ) diff --git a/README.md b/README.md new file mode 100644 index 0000000..4cbba0d --- /dev/null +++ b/README.md @@ -0,0 +1,9 @@ +# pe_to_shellcode +Converts PE so that it can be then injected just like a normal shellcode. + +Clone: +- +Use recursive clone to get the repo together with all the submodules: +
+git clone --recursive https://github.com/hasherezade/pe_to_shellcode.git
+
diff --git a/libpeconv b/libpeconv new file mode 160000 index 0000000..10a841b --- /dev/null +++ b/libpeconv @@ -0,0 +1 @@ +Subproject commit 10a841b47e5d5922306f97e80a3610139fd79759 diff --git a/pe_to_shellcode/CMakeLists.txt b/pe_to_shellcode/CMakeLists.txt new file mode 100644 index 0000000..1abad99 --- /dev/null +++ b/pe_to_shellcode/CMakeLists.txt @@ -0,0 +1,30 @@ +cmake_minimum_required (VERSION 2.8) + +project ( pe_to_shellcode ) + +set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} /MT") + +# include libpeconv headers: +include_directories ( ${PECONV_DIR}/include ) + +set (srcs +#put your sources here +) + +# general headers - they will be used for both EXE and DLL: +set (hdrs + resource.h +) + +set (rsrc + resource.rc +) + +add_executable ( ${PROJECT_NAME} ${hdrs} ${srcs} ${rsrc} main.cpp ) + + +# link with libpeconv.lib +target_link_libraries ( ${PROJECT_NAME} ${PECONV_LIB} ) + +#dependencies: +add_dependencies( ${PROJECT_NAME} libpeconv ) diff --git a/pe_to_shellcode/LICENSE b/pe_to_shellcode/LICENSE new file mode 100644 index 0000000..c32a489 --- /dev/null +++ b/pe_to_shellcode/LICENSE @@ -0,0 +1,10 @@ +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/pe_to_shellcode/main.cpp b/pe_to_shellcode/main.cpp new file mode 100644 index 0000000..b36cf39 --- /dev/null +++ b/pe_to_shellcode/main.cpp @@ -0,0 +1,108 @@ +#include +#include + +#include "peconv.h" +#include "resource.h" + +bool overwrite_hdr(BYTE *my_exe, size_t exe_size, DWORD raw) +{ + BYTE redir_code[] = "\x4D\x5A" + "\xE8\x00\x00\x00\x00" + "\x5B" // pop ebx + "\x81\xC3" // add ebx, + "\x59\x04\x00\x00" // value + "\x53\xC3"; + raw -= 7; //offset + //TODO: peconv virtual to raw + memcpy(redir_code + 10, &raw, sizeof(DWORD)); + memcpy(my_exe, redir_code, sizeof(redir_code)); + return true; +} + +BYTE* shellcodify32(BYTE *my_exe, size_t exe_size, size_t &out_size) +{ + out_size = 0; + size_t stub_size = 0; + BYTE *stub32 = peconv::load_resource_data(stub_size, STUB32); + if (!stub32) { + std::cout << "Stub not loaded" << std::endl; + return nullptr; + } + size_t ext_size = exe_size + stub_size; + BYTE *ext_buf = peconv::alloc_aligned(ext_size, PAGE_READWRITE); + if (!ext_buf) { + return nullptr; + } + memcpy(ext_buf, my_exe, exe_size); + memcpy(ext_buf + exe_size, stub32, stub_size); + + DWORD raw_addr = exe_size; + overwrite_hdr(ext_buf, ext_size, raw_addr); + + out_size = ext_size; + return ext_buf; +} + +bool is_supported_pe(BYTE *my_exe, size_t exe_size) +{ + if (!my_exe) return false; + WORD arch = peconv::get_nt_hdr_architecture(my_exe); + if (arch != IMAGE_NT_OPTIONAL_HDR32_MAGIC) { + std::cout << "Only PE 32bit is supported!" << std::endl; + return false; + } + if (!peconv::has_relocations(my_exe)) { + std::cout << "The PE must have relocations!" << std::endl; + return false; + } + if (peconv::get_subsystem(my_exe) != IMAGE_SUBSYSTEM_WINDOWS_GUI) { + std::cout << "Subsystem must be GUI!" << std::endl; + return false; + } + return true; +} + +int main(int argc, char *argv[]) +{ + if (argc < 2) { + std::cout << "PE to shellcode" << std::endl; + std::cout << "Args: [output_file]" << std::endl; + system("pause"); + return 0; + } + + size_t exe_size = 0; + std::string in_path = argv[1]; + std::string out_str = in_path + ".shc"; + if (argc > 2) { + out_str = argv[2]; + } + + std::cout << "Reading module from: " << in_path << std::endl; + BYTE *my_exe = peconv::load_file(in_path.c_str(), exe_size); + if (!my_exe) { + system("pause"); + return -1; + } + if (!is_supported_pe(my_exe, exe_size)) { + std::cout << "[-] Not supported input file!" << std::endl; + peconv::free_file(my_exe); + return -2; + } + size_t ext_size = 0; + BYTE *ext_buf = shellcodify32(my_exe, exe_size, ext_size); + if (!ext_buf) { + std::cout << "[-] Adding the stub failed!" << std::endl; + peconv::free_file(my_exe); + return -3; + } + if (peconv::dump_to_file(out_str.c_str(), ext_buf, ext_size)) { + std::cout << "[+] Saved to file: " << out_str << std::endl; + } + else { + std::cout << "[-] Failed to save the output!" << std::endl; + } + peconv::free_file(my_exe); + peconv::free_aligned(ext_buf); + return 0; +} diff --git a/pe_to_shellcode/resource.h b/pe_to_shellcode/resource.h new file mode 100644 index 0000000..24afdfb --- /dev/null +++ b/pe_to_shellcode/resource.h @@ -0,0 +1,4 @@ +// resource.h + +#define STUB32 101 +#define STUB64 102 diff --git a/pe_to_shellcode/resource.rc b/pe_to_shellcode/resource.rc new file mode 100644 index 0000000..0250fce --- /dev/null +++ b/pe_to_shellcode/resource.rc @@ -0,0 +1,56 @@ +// resource.rc : + +// Microsoft Visual C++ generated resource script. +// +#include "resource.h" + +#define APSTUDIO_READONLY_SYMBOLS +///////////////////////////////////////////////////////////////////////////// +// +// Generated from the TEXTINCLUDE 2 resource. +// +#include "windows.h" + +///////////////////////////////////////////////////////////////////////////// +#undef APSTUDIO_READONLY_SYMBOLS + +///////////////////////////////////////////////////////////////////////////// + +#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_PLK) +LANGUAGE LANG_ENGLISH, SUBLANG_DEFAULT + +#ifdef APSTUDIO_INVOKED +///////////////////////////////////////////////////////////////////////////// +// +// TEXTINCLUDE +// + +1 TEXTINCLUDE +BEGIN + "resource.h\0" +END + +2 TEXTINCLUDE +BEGIN + "#include ""windows.h""\r\n" + "\0" +END + +3 TEXTINCLUDE +BEGIN + "\r\n" + "\0" +END + +#endif // APSTUDIO_INVOKED + + +///////////////////////////////////////////////////////////////////////////// +// +// RCDATA +// + +STUB32 RCDATA "stub32.bin" + +#endif +///////////////////////////////////////////////////////////////////////////// diff --git a/pe_to_shellcode/stub32.bin b/pe_to_shellcode/stub32.bin new file mode 100644 index 0000000000000000000000000000000000000000..2b8cc8aac03f8bd025c7337707e614e910a64eee GIT binary patch literal 51712 zcmeFae|%KcwKsewbCL`&VFpMbXp|_SqCo{mgg8VKU_w-a6JjPzF~QzKnvT{YoD;Am zka#khlkK$hUcHZfulCAC@5R=(SQVqSIw6<@M1FcP7SyQJ?s(D~Bu#?EoaejtnVAH& zeV@kS-nHKBGSA5lU$2CJ zfr<_vrw6^VU#~pP51OXQhF&T8wj{Y`ES03{ylLuGcKf18VKo1ByCiKI*RUwh?~^3O ze!KC}+8uMLXk8yGaI%7Q-8USLx*DIbQQ<~{DzWvmJ^NiR`Ey(|>gnCJ=cd;EY4taK zXMnv!HcTvQ!Crk-v%xBAsvL$2_PRIYNEs*~78H!E7imd@R5Z`Xa@Y*jWZ z$g#gqFGH>w1rnQLKjDcskB`^a+L;zvX>+}{-`?6hzHz_$S^iH}Ozc%A=KpdyZHtnc zf5(B}{!I0;k|EbilUPYNyCo~){F(ib$fb^BHUivhTq?51-?=f-Dwk?~?{DZJv^C#Q zlGY|yhfP;l1=)-(4d*IrzF4Gg0`eWcAy7eLtKDn~(9hg#ZzJ?KXS4M=_Vf0$EY-6= zlAhU|1ZoI`qxR0`q{gWFS;M)O@ypB9%b2g*_0mLEkQI@en4C%FPcz?8GF6Sn8+N>C z9kSM*R2`10zh#yET3xTCxV1ViDdWQ@l@zV+w4}P3Z zLhtG7kXh>wN#=1DxPu+0jK`EqSYPg-=>KM0 z98@#UKEiGvx{XbUwgVdLQ(poZw2t(6{pv%6*B7~4uh(9C z3YbW)#$OSR4?c;jeXs80tXK~3cQrmrsdFR2AuZ~#e}2>ew}049j)A5ZIkC2ZX_qEEP;APqgO^ z6yxV*Now+a{JgEH^3U43VM)s$y440a;aBjrBbi=k+;9)-Y>X-;e5V6%1t`VW;8K(G zq2#Vf$A#Z9AE1L^{VVxNd_m^y8aI7)($_y;PhTy7NdS1=NmSV38^!=I`BEe_o^*x3 zM=zPF=+QpyCP}$8z!zEgDpO3=8A?K9*$wOvSAm0h!c1;iW^;ow{113v2Sd)9xzzk}lRK!U^6s#yBx|N!4O-Qdj#i@-S!e>Ny~wyBj^Posn=mwTSV=Flm6~&Fu1=T0 zu=w9e6_K zcH$oKId;BH@8MI!rrD9~#qtHldkV>`?v6?w z^>5>yMvnE)gzV6lClBGhwOe9oGGqz8*W5wl?L(Sb{v?{N^`>j<`lX1kUt2dMfhgG^ z3MMO$uOG9EnURIpdGwHJJw$xH$doQJ^+igCJ-%L#Z`jjH;H+u`6|b-Oq~Q0jp<7Jv zVMPufQoqIjndDxl_pqA!^6mI&OhoGVv`Nb(skPfZp;H$K4<22k3rwrpYPum?%#0k= zV?FbqV*mx)S~$|%TKee9KO>;UvgVNWVwwLr{+5I{>Q&}*1X%GRd#CHA!t_XKru_&W zQts}XZU5YRLYdA=oZefV8^*K64*O!Kw{wG2+dJEPLjBYetwLM&8t3@+U^U1r`*qQ_ zwL3_V23{LR&CD+wviFDr@xl)Dxt^PdJbl+itJ-$ks@k{-VF(^dpL0@q*Uz z|0U{CGsQTVj3K~E(#5D%z{_TNx~XQFY9^lnwILX+Y~$av@N(8jw?WpNxRJ=omq7B; zggzB_!sn-`B-ryC)PgFsI)|jDwkJ zQ#tGNGf_%XQg_>Wnuu~tbwC|R)<$gVHZcc)7~g_axZJ`=C44|fSB;a>;;<{{1|W*q{*KK=C5uTyy|0Y$8|HSNiSjSc-n zd>TsTCxFtykfUb3kpCDtBw<@fk*>}Iog}wfxdW|pH?+_TsnF{3mq`*==QV*5-0Dr> zE(iF3K-O z<)S}3Kwm&`)f3gnd7>{9t36~9v_7BuKvGib>ztB`&UWw@K_R+-47kA{5x%9n6r&;` z&dMOqvZ0*=W-=>ryme*B&d&qm4msx_>Wm1969Q|V00hWPJ^V0Qp+}nN`e-9vpQxwn zi(BaWht0TFKm6!Z;ud*K+@4UxExcabp1w!ieqDpx<39~QjvLGwJ^TnBBJ}Vi9y&z5 zB;#1YaLBKRw~Md42$SW&1SNn>hi_MgBo%b{o+Wvw`(7|JW_L^OkQ7;E4xWtocA>wm z7F=`^eLT`;3Hpd{2+~PHPOy@*@gx*0JI5fFf}~ZoX|uA3jBRCs*CcfO@9E+_yD_tZ z-Gmuz96QVxBCq+5)-HR`ZuoRf)oRM>psaMcFl*XZvzoIU5Uz3CjqWvbvnBUh6S@!D zwKT`A-;?8x;4inkEKni18lu(nhF@RDO(=yv7$QRFp~m_8*6yTopSQ7+zO@jL_!nFQ zl+cjU ZWS=rPYtv3f2;*xQfxG@q!F(36+V| zohozv2Rpl3Pt`Zc`t1(Se!arUe5Y95X$+l)!F!c;_ds)<|NVQ{-2!A_-OOLM?p_s? zh8AKKjZ~h}q1_Ja8|4Wd6EOO2bLeGGbqS!%>bu!=%S6*L?Snrf^4az`??9T_Fkd>qOOy1A8QFnMi9ptvUKJF+8Q6lrqqktxVQBv#n&Xtd;DE3LXQ2+C0&`PFyQa-^^3ux_Myx8c1(wu6!`0yg&?airr3|20|j!mE4&9N3;Psul1D(| zCBvFI;%aO~I*jeevZRQ-jAb=MJa~T zq51)AzconOtbFVpsHr=xDkz`6%E=Yde@c1@i4*J=2VaiQ)HxPP-c}V>0Hj50vKCEl zcHcNj&1^iT^fvo#HpLDZu9X`Oh%!S$hz3 z+!-hod>y8D-j8{b_kfP^iGGXqoXXu`Bx|C72iRav2Jc{Ey&o@-?lj)T#4wp}M+yEB zF8KNZO}ixf`Hzr*Y!~tiTb|=|?OB@R01>w22$OgbSmgUr8~$nMvRyy<0Ay`ASC6af zVMfz z)CrU~WSs?2{4H~99obq>Hqtis4z|ufS>>N1TU_0V?=k!bTR}nyho;nJT93_oQ$HVU z1;Hf6A-oM*k385qgnE_icnkgwUnPjgWwO@c(0Ux!cl9qZpcb7W#n~M>aA)MCgVdSj zEB&RVHU6B0%oifwvrk74tkq``L}Z=IRymM+j%PYs@6<*{6fa<0uYED1$llLuuZdh= z8@cm&H=CdrJGCFnl6tVlhCahk=if(fzf41%UVe-hWB1yhlKde{i6$$6l?MxDn($gE zpW;D%4p!{&bn<7REtj*JOmn@{T<}D2=6$nyYOEN16y<@6G6sFwbJBCnGvG1JqpKmf+P1S#*%{UvvhkOIiuk-A z8BFt&$StH-f@~paWzD!*lDpK*ScowL5{``|}ZGR)+s@J(ya)H*V?k<1Mzp)sd&V(IImYpU7;Y(9MlWwY;Y&#Z{F zD0l<*%ZY4hqUdLtE&kz;@`ZaDL2&O2d@mlBT*+JYhBO*Vs3*gvX zXc(wrf;M8h8Z~?}>R8qjT^!y52_icrm6;j$phDIMNe=Cj`b-zmZ&4RTXe?t?|sz60#QTPQyK9yyN79TR%0nZWb!x_g9z_$H1yuvap*gH%W zW}ussNEPPERq(E$2{lwrRLP1J{z#DP06TL0fJcCPXqquyP%@MaTEf;ke#kSQ>Un4Z zVIzncsCf(xt=Uc&dcth92Gzhhw~so^h4~PkC=Rv8Jb@BbmFBEFP%Rn|sCkwOJw+FK z0yob>E|g<^C`EmNlD`opjTAHEE)Wxw8!Ud&z9qq4X&513YBvaV!5HvF<3nI4)qbIZfX={>C?{8R&Cjoj`N>EgSH@ZH zs}ss~Vy-J5#)PuEM@%U2hRj~c{5dOmI>ruEs;|u_H0ogdl>0*?H9JsC%pekIdiMDv zP%|u32f1d`WJ++}vt095kggKtG0{VV$tJVuTRxH1v+vyRfXG&M^~{xjMP!tvQfF zB~IN28>5Gmcx_#$)Zsh$$TgBXhDN6ciw#GZFH`ruEwJcfzAPPvoi7`nTW#HGl;Qa6 zmGpI|^&jv!N}Um3r&V`+EzD;%1SUd1UqJrh0wfGWT)};cxfu4TACkzNYnBfOgXB9D z3tH3GvP-Cu3A7zgf*-zpaHDTIoS$_=MZ;) zVwxdXF}3Mtt&_mI&02C=b8RvWsccL70V?Sr`b7R;gXoXq9DRk%AIGD&1yLY74;T>{4@Ca!o zFo_;G2E)LzXEr8m5Z41gL2A#(KyQqN^b`b^vuaHn>+rNc1Jy=SC&rBy*8|;9ykdDJ zm-Y-w4w8oti)XarKG<$OlY7hc%Ab=qrokc5BS&gwJvFjTMv{Hwq_eKA6JdHpY8}vW^3|x9mz?HRg?k!W!x_$_Xxg)h`*)~wj zZE)8sAAX&>AAS>cnH+h09wxzVtD~?kp3;BZj={+!oAC|EqQoq&yfZZ5JlEwjZ^Kx6uDr8O5NH7!eu=Z#!H zF|x=dYAveMt*|=2A#ihCcmwWxV)ZT^5*7Y%q{&r;BR)K8W z)*#!q?;+c^A0pefO~|%w+xoZzp&lBTx*g5mFjM<$w)PoHB&rdvgWEAqvIkqcDc^g8 zt>lwZGC&#-h^4?GK;8gKR1G-3T-s+86+umb`#?Ptql#gNOkwR>w+qHy_+vB%tnuNt z)=yKF>X;8f@OKJvJB_md4azDEN8u8=ofxzNNoWhws|#?s*N;o>UASyrj}PBN8rp}; zCZwT#kv&8+%UN=(x)ZpqLDzno3}yeai11f@y`hm>4C?G#)jz>BQ0B5$aDw7uQ}t;g z7)7>P)Tw=Fx46A%*)8f|+y!zAc`Hc1CED|f8wlhc$vset_z6*JT=UeXX`)msPl7uW zkRih$!HU(h!JZyS_^}=-q0z`?r8EAgReOW57wJd^K`F|JrXY@6yUNJHyGb(vgxwZbr<4(9N{($P#PSzT=QO3gtOS z@37HVQrH6Q3<66!Qe?bq*^+jbERhr1v++m|!e*RlZ|7u}Be+B52mKaWL8p^PDjU?0MyoNNi^t+%1Sn42;qz7{{vf!iq< zgwDo~!9l|cpl==I9pVuYTAln=JnEa>`~^xXaqGoct`)HWx-W_u&{VUnbv{^nWjypZ znmJKU#4Pk|2VqRLm%j%R25Hra-wP<(UD*idNe40wKa%T_Wm}5twIvROsw{zq*Uf(9 z#%e%GSKh78+8ghFH(jqhE4Fl@TtG!`bubxvXSXq~5G83< zwcWoGhBF_4UJJX<(mRI{+~A0hs9E9@abazII_T6!E4`&rbfA>B?k0Tt*M$@NhXE)N5JgX{~Ob zq+W^Gr&*vm{|qcl3w2mFjm86FD)<6Q4T1!fr`tku%R}$NCqhGt=c7t(bC#rDLS*N4 zwi(Z_?e+zwse}9IhI%##;68!U7^|5fk~Oz*5nt|6W`)!7C5GKaYlDki?d?E!s|7T>gefT5&T`1xFv zhmIo@KT^@8m^=OkZ8OL+w_$UfESuwG*=&&|Lo~_7*Zc+Uh5dzkaW-qM#HxjWr1ch9 zD-5hIv)y+}qJ@TrZE`(&ia2F8ams23yi~4-Kf$QW8c+OiFHsu-MvY-W;8DD?^={sRJ20_{ zpv57IX!!v?Ta~G~RFOI>UdiNmCF5e1sN+QijW-g+dqo9Vl2XXOOTY_Y8*#o0kEY54 z+Fe-^uZ3b3q$sFMk;G-FeRy$&B^2)&K))~_hNuYL=0<#7ehQ~31D8~A<8$KkUJPGW-sL^u(oPa>qNt2VHuvdu2hkmQtNL6&eGci~ zRsF7??!p6e)2fw!SVs)bG1pK2nUadKD8SR9m%JS*mYJ_lFFB%@^s|z;^^()!{adeP zCH-b?mO0PQvx(nI`h_!2y$XwMTB}@)ybvJaC`xX7hn08VN=TGkP-+jX;w-Ou*H5~p!NW(LjKf$OJ+(WT&U4>dST`%cHW6-n*azXF< zI&{PMkS)MpaT3Mr>rAl01Jr<2atF=GCtlg0XxlLQoCC|UWu=Bjm-t`rg86bVWbQJ)gU%!R*Ir7stMG>9#6~DZP5|vH zR1bTL7on&aBdIY*2yeO=u0SB0CXkJkMESqMD6UcFQVdVj&!2&J0n=K*&kvq~Sz}tn zaPoez69zu8-z*@1gi~u4{W?Yvfc?dfw!oC%Xhs+L))rY3fn5TcFSzb!hS4_PhkO>-RbU! zv0eXT2d1%1bs;in9ewr=v}8akP~nmWLXj2ysGt-+aqx7^B&*3SaNGw~eIdZ4|EQ zh+>q5p5}TU&!>AOKL4nX1wqvQ~AmT(GU<7<9NAX~KfPAiQ67to`ozdGhriTVFpz3f^0oUj z!QMZOeSZjdb5lB&r~-Tdq8dG}ZA+Kc0QpNxshoKOpN_Q{=vpa80ifrt$y8@ThxWtq zyBtLYY@x7#S^@r?1;ofemaCEF%7IilB&~Km+O|Zm?2eI&wHXs)gfbkSC|`+owDHPm z7Rh!~51xAuJqR_`=Wf_6*8@wMLu+Xct#u%*k)MKl#Vp9A{`9Kp%4%AL_{oFF2W8KD zpIo<<6*^dY9|SP!1eGOiOP?$$S71Qsen*WRNq%H8l|Gq20pGQeMjGE8(7S}jXYoll zYBHXT_b>TrQI|TCV61oW$AMxS11^5xqHWHUwmP_v&??SskL8*%kQ8 zN-{kI7-qjm#u=~Ebe^|9TfMyDMp6NkiyChH7Q~w}nb~Hxc{?_YA1KVWxx&Nq zWmevOva9hiyymG{t}u0D$b>5tLc__UFdHBP3wwmC4OP+l{Mi>O@2fAZ7s3NT;!clPp380Er@va|cop%{!3fK%j)rJs=^N zdmzcCqzyxC9J0sbq<8MaH2{(AA3@EQI8%fEG(54f(!Wi$So@b@_W61e`4 zf9rqzTkyI5-|%liRqG_($bABGSp<@7jG5tg3p0G(-#5c=WyM)gFP5-U89uxjG*_?0 zN(#RTvtewqHooPFF7!Dm7;FH+DVeMwlR?db56@PLi4HTsga0jNfOl{c3fl*8sfbuM zD3_#citrh(k{VJ#R?tLfSa}YGR;r+H{tXjL!t#fji3vTxZ0tU0(O8K~LvS2RpURx$ z?T75Gu~jI`(IAYFOB)snqhxBV#h39k)T7;%DfO%Z8r;NG8&fFyY1S>yjQJQyldj(e zJ*Jqs(3-`OQd_gF5Jva8+yiBSNYGZs3*c5kfD7ii>E;3$NN)ll3@mmCsvUNOINA$j zm}6g(5Wd7s@vKNWoeDI5(cfSek-cLLODM{*|1RFUL;FaGiYBWRA)pYIfAbh zK-3CqcXJqnt@Rv6PnJo7|$ zI0oPy^z?WNYF3@3{m6wg~#{O4nVw2PiR_$2t@#dEH#tc)Evet5J2HABl0ATgdcMNX)Z zOHkRvWNXAQV<~x=>ZF>52oR{5jSH8)B&)clfD#r_!e^Lx;AAh7kuj}3nJ}~=?zvsE z@lC+GO>CDygD6-7A;dzYIboHU*-592oD2t8(H-p`qt zSF!!9AELMvyU_Hy{?ZC~#D529VWpMASL?A5mY(xkg`TTt~f4J~2cX zMC1qkSVrpOn^6)DF<^-u^uFQZom)^NYiENy>*?VG<5mz`uN#7Epc*a_#Aybxq>zm9 zY-Hl6zy9XS)wIU_yD!IvqGfnD=9_kOb8>TP zQ%X^D>ar%^i0d_YC3j?_9+Y;D`Mj*zH-cd@9f9`Pa{uC@Y(-u)PW?5Cr?wZFl3}}@ z22FD+yxxs(p#E5fh-0YlIPfBn6ydD3YuN@=k8Pn z>(5=T&chJ7RMe!nBDdS>^DbA(i!}jBo@0&sU61(8quiKKjN0Y)lsk)nXH-2yl`Hw= z5mp_j-m_?&axFBZS=2<)K+(8;SaT7LTQ;V3rhQq@M$FR|KnVbQ=HV6ig4jUWu3ZL- z0^7vwNmFJ6xZAvW1DWItAe)ifb8JwB4BYq^*KbSQt)C>Z_Q50G*4p@p@*aD-TqwD?zi!tQ5;_i#p! z)Bq8_BO-SEe*W*SxMU^rqqAnPlnORtK{FHX zspj4?$^9~Q3jZ-uYIJ(-rPq7#YR)G}{5tVSCHWP23>HSc&XbluK zU}{@LO9=64op?a($d1qLH1T1VbLs(Wc8AULIl#L; ze*u6pMB&lAemuYyU}|UB)_xWN!sm}4I)0dxHX7IDX>5EI4-|`fKv(;rjMeo)0l?W6 zy@-bJj%=u5E~o)#J#S(oM9C04z$%B1zscT=(fT+o?ZoP#N+kS8abn0`GURE4-cT}h zypvX7e5bu7{ptiSMMm~2JH@W9J_a4Hmz{wZ-uM}CQPKi@4VMW9Bcd7s0{UTupO)iD}LDeb#JGvcJ#I@4}G3 zKn7rzNCy3k*(}9d4Wrdlpua)c6T5^vk{`h~uk}8g8y? zPW^8JWNawZ)L>dc^LPNgxZ7s62Act%1WtSk<_>fIQ+R~6WF^sbV$P?zNEaXYXDDaR zZxjiX%-<)z*oV)QMm35tLqk;CZ?cp=SF1zKsCeBE-pad484t_qS(FIsH(`8Ygw^bV z=20^n7rt#K(y_t#VrYlfW+whGDPoI~07)Uu*hH8AIPjB{Wd0Jy0qtWN10gCP#D+a- z8_$rUNtrOLisu2_FSkIdejiW~F$@uMsTflUEysZVA=WVBBa2pVEj5xhHY-;HCiJHH z>u;x>=8ZyoQn7sS9Qpx)=pxSF&#%H8mJH(JN04Hqd(&KS%d{dRoiE9y_9@u`{yoAM zj~Rhcs7;nm_O6k}zYRbg5=Jpp@i;WHwlS|kfYEF^9y33IZBLT;9OSn2q;*h!#q3gn z6Hh*GmT$s7Cd`h>B6MdB6v_!r=`hQ3;LE-uyYWL?aQ1}WDPcc!C7p> zcFjWB$k6g%Afl_2cFZmUC)jt)q1zJKC=Bo{$a(}IZgQ0QS@Cjx0xK>?xM>^O7%&%b zjyrQv7(;{KE=g6plGHSuaqP0xU*fMoz zPWoUQNlnF{dth)cvPsG`*B*J&jY(=TsCeUI&9K#8Kd{%X_C(}Kv*p;YW13fXEhB&h)V1FpbKh?yNv4#Zhlj1!xzoS|;du~mZuUY~Qr z^{(Gyoh!x-^D+Nf+z`Ah!3~Z$kB#Am!s_e!P{xo z-gy{=duivP@rmoDB-cyha>*kjdK=3Z6j%cqVu~5&nPhY&WLss=Vw#E^H8nJ5z7L{X z(-0jLV@*Tws*vn1DDE>aG%+7Q=7fp)7Uidv$z25JvILwTd=*Y{G59SLq7>r7rn(x= zk+@J&OL;xne(}+W!7K?Vi3;wCSI|inL~+`bg{U)L0TeDm6;tS!7|J*>#@a2-1*j9q zp8$1P98?p5QWKzP(_eh*#b6*<%m#SB{yMw|$HF^G<>Iq1!U?cpx-hgvFGkd}qeHq2 z78oA%CgOHH1VhOk1;x~Ayj1JO_lR5522=uRjTh}n+Hnf=jbiMr$qAMznWBC8>-F;$ zn4A)`S4f5-3mpv^5kP@itQVPLv)FWuphQm#u_g`&fUgVzL=HajJSZ-qg|ztGw|FgDjO;vZVi=K8t(MEvo3{$~7fA&ALoG93>UNI*t>G?D*D{0zhoR|Pj@8#L(Lg7_fUWFlwl&dHOw(C-K6z%Z448a@q zWZRL&JcWcfec^3L3h;kJkI;08g+Oa+U_*(57x{UyunA!ijzeISx*7ZQ6!AG^`uPL+ zh8m5UwIBsHJN*uwVyW2bG_g@nRC6bCmGMdhl?082n8ZcmGEr2WG@5NbQUb<1HKcb0 zc!($_@heb@jF9(ZJNtk~3W6xHy^q^a*+GFyfZCYp=TBgHS~M}0w64v@y$M9$#TOvD zE{^E9QA9KRF^pbBo&euNQH#c+IGRt2f~qT?X**>y-i;yo28KP5d_d?iG*Qc#&u|_I zcmh)O?+|nl>&~p}n+ZD4!ZSh8?+~vEn`JCPCm>fDcM41s1RVfa2-z_NJ&lx6f=;(^ zJ%P}}u>`edf43EulywTpT*1PA?njc9 z0b928a2Ik$!t_xW2Zre3ZhDTKqU)nwbbaD&y1saXu75a)D^4dF61PaNxINJ+ZsC36 z_Hha00qNjM(F=_LJl=nz%LPAAdBr$r_ljY5dS5JQT1K(Sst#1AE5 zaHPo~UPPdc9+8Afp-!Qryoe4K8R~uyGQ_NvOMVA{aR)vm@Xod9x%hNGO2h#FBkIAR zoX>XO3G$+EbFFAmE1UsBe$=lA&@dFpr~LYJ7Ib9At|gj?5dM(vnNO7<5*%fZ$2KfN zb9s$psYN;%H_gc;2AH-BRHJ05MuCv+wP`qqDu8X5;~@?)K*;PyQ_*54ZZUHKdZ#Dq zb-qEyfO18FHZ*6$nMmPZw4q6xutR%QWm}|SDe4GK40<~+j?QewUN1CUe&bo>k5M2X zj;#ZrQr*G-3z>s(wLtR0`2d}Vw?i;tz@@Y-N7LF6TG+;)k0%vdNilCE1ishjs3pU$ zvhCvNU{|aHq-(vi0|1iF;UF+AUHcqb)$@CdIv6~(o}p*5^YE0vsn>PsC8rSggO2zP z+>O=HJg&OA)ZbJ&!do!yz@bfNKux8H&a$#n-b^59cPKWC8B-$VT{swk&$c3p$Rmge z#uaWtbI7o2mvwYv3d&>osf(4If=ORFoZG<$*%6d){Q|)w_QhBu@*dL5`!60CJTbFR zxt4XX&pi-z;V+>UA2d#=&7ik%^xBX#A2-a3*`Q=vgtY60jV6mL* zXg!ytM|Pt`{U124*QnE)BeZ!0$G^<3KX;AlSop-JcvUX;n=e}UP&PRHvvITfYr z1^5R*35K|ZP!JsEhEs|O@VR?ihmyRVuEy_S%-2+YmyYj(k2E4T`}t>=iSF%Lj!!g~ zo~dA49eG=25va8RafE7aNXFLhv*K~wm1v?U{j1`}Mk#6KmpvWH;lB8PD>_oh}e zsR5wOZJRzWgI1e$a~a$vS4^NvVkN2!x1JJlwnXH|u$7a1N;o8ee;Z)I7C1=*Q#z*N z%AQ*x+hS8J9bYttBYciXgeEd*!p@pxbXO@valJM9Op3cONI?(6vpof3KO*KmD7vL! z6d)pIqbmN>Us;_&YmnDL=Uwt5-hJe({3&h1h&wB@AtEj?y1s*a38U*-$|}^5GcVJT zC8e~;2&+Ggwz7;zz705P8*ita$H=j+hTRWf{o8YKF8HhVa8NuYg|^cG@gci^RTGJ^7fAO zztCK>!)@K1*3BVqg3?+q9BX~(jo;7)kXZ_lBg+nFHmQ?4lIay_W6|wN(At=z4SjiG z^5c}8p$!dVZO6{i8zFchOKhXmsn?PbfH`%%%L+QU|2RYo)WC&Y8*skJtto$u&k}AF_}&& zD?lJ-e{=Y+$Q+5#wLMJ92&;7MDJ4l_qON}K| z%`TfVv3~i)>F(ynv|+$D+`E#L3`)tS6hLcgoJh1YQkxzZ4~5>t8(NL^p?~+Bj66tR zzMXpns=%Y&fF>w`bA7|7@uEeu?R&MM>6^xj3L=Hs#$`-=v9gJ8X_2Do_SSkwcBHV| zNNR3lk5bXXrX&kC6JSx}FG)U%5RdcFdlJlnV>(4}teZQ437PigXar(}i7jx{z%9i% z0EdpPGRk03)ntPd{5AtQhO{?Ln#8VwbMa-Na?}cplk}xO6%t7E|L6f*yW|DpMxrZCVaL#l@HOVHN`bp-#Bx^!_)%=V2r`c@vi6xNamfeYl4SfE z0n>ojLh#zKUQ+=S+W5bK3B$IgCyo8=e4z6DetgEpNL%8t4 z`k^m*x;2%xCsS!0RoN!KaUIivpHD_>;ZBdqrtGl;m`nhyZ~JJH=)$73IuSv_c!9|8 zc?sQs03&n+RJqf6kJT^5p>&P?Xh5MBor|P=3ccCzNyB+A#{V(Axn63+B=T5nVJcRuV-$i%}JYQsAr`OKK>pkY$mgOw7|8o~L=* zsaMH3@jS@_qDJfM{)#exRW55TwqdHj$hGIFYmdW7p>ZS^dJohNAa0u0`#*>jUG(w@ zP^ot~3P{imV(9a9Ol)AU2MHs@iY)7)6}h~8lFrJ60RK;X?s*P{p#1kdi~AUSKKh-& z=WgHWx!AWDsoxI5V3`Vau})=vb0LJ3lIz+tiNx5nhA&9)ZJg5l&}L+FES)-iv1?DE z&3mNwPY`H`23HSZNoyJG7=X}Bc|%JX8ro4rLlt|@gmXr=(8NiKkrmERN@RN@K&`1} zNs*OF)jG~?Poixnp9Oe1H7bg6S28TbK>tqkYur%8Jf9BLoyPeOFdaehn8Iy1amF%V zZUi$TSRB6pIyZ)VI)chJxB{TQ{JLl@N@1%ZPG|7*k6<98KVYAZ6JsJY)o>#F#wq-F z01~>KA~XzATM>I6nz|~n{EB&zcHLrbG+ldegoSUYxg@=D`P}L1#hzn%VCdlM~#YDHoVGwvhkM5uI#z{%JJCfrFeAZEt1 z^!P9yg$D&{5t{$<{C(id)=jgOb=uHX%3b-nc(2XKzlLrr^XK8F+?Ma5+fpdc#+CVx zoxpQe{xewTs{Kp;^K`o^pIBd+nNLiv!v1nsoLA2{w?>=(Q}dXTd}Ty@9KwDk;O@f zo)m4QBTvkX7Jy=X9tx*GFaoV@!bV|T6}j&pJ&z0(yjMuA9Lv_Z0f)(Ag9xGxz|sasz4lm%LH3g_FxEEEBB=1 zBHzV{wHNnB7ndPJJJ zMD}8>4*t2{h`~VTp~1UQ(|rbum|b+Cr%*co1So(bvA|1-eRQEGEG8X{eMwLZ6VT}K zVvm7c|IYDZ#ZWc>PmdS-fVSn3&7h1PFZO04?f>fWVitG%9Ay=etS~3^?Xfe$4v#rt z>>VM1O0jZDhm73=^{=qvx`I0;$W@Q%Mw6w2-zJp5G<(w^bep$37`NiPBxSIF9qKx&L>0s z@>r;MjY4()1E`$@Re*k#jvq_rcl<-Bt45*jdE)O=;0Qq#pv8%3DSQMfCHS09VWY## zK;EyQd*>+N${65yc=K4&b`f9!U7VISnLkasD*3|zG6Sqa-bkt;K?=NB@BYym&OdIU zju2N7Ks}}gz6$!fSi`si+vEuv?c*IQ2IKHVP|ykEtKY<2BOHq0)97fO55?-t`Gz`2 zNWr3|A*`?wUB;j#GO9y|3-PeDvVAMDRuY z@HY}BfB*0|0*J%kC_2K-*oOv%qdTcm3LVvE(G#5xD+sCe7SqWSX2u+3tJdm1g>L=7 zAjcp)@#7_~#%4SRm?yGCrk~dtZjrJv$@XnYVu;211Z~{08B0$=Z{Jp=U}6D5;IbQL z4mz!CsdjEexw-j{8S=nhn{oqoa;g(BAsrM5DKp`;Jgjx!+-nVf2Ukjg-*ejHJ-ODzv+k`n!vc*-WGLB`B&zNlob>Ku5C==N4yqdgw z6pMB9&&AmNx-`ceo~JsLOW|9iJro2gu}OhIc~yscnsndYHd@CRd~6IHXnZ@jfa>2c zN$_hxFEKc$i3uStSSTJx{5%diHzvKGih-mcBI=)2{{f+g*gR;SJ4qc8zOLAs36@Gc z^Qp??hhQy^?HgEp>rjxk&7$D%s37%t6G2RgK?J_=Rjv3&piN%|8Vmb#qbxbpV4Ie> z&3Sy4fE=Hei^+j?HTkoqXnY(wwNl17wOR-$eg>e?x;<>&>cve!xI3*6%l=TJfs!ld9ZF)$g=w z<;QWj66~S2(CnHTqRGk%u<5!}_&X?$5dRn}A0fwT@7Zmc%7RFdNe#PPH1A5fs>_UY zZDaykIO4)j-i)Mgy+Iq9x@{f~mJlt~2jG5>I^aQJWyT0yY z3Gq>O{t1X0#L2s(!}5ZLAmZf|&H%wrtN`c)ZoH31(CIw1{e4e4HgEvMP6C1Zk;CwY z2uvA%sAD_W17tkjX@vvEd3q#x&*n@>Urzj5vO{Buj zY)VE7D{^X%#4!mDkeAKF^-R1&6CvSy7YXPgksh9|Y#YM?2Rgg zEDy0;xkI{*h67FqnOlMNM$yZDei9lAj3xY1)`XCIRo}Q2IDZf!o`Qu$;FA*ia#i1D zDb^vz0t<>E0$+`TZi7)6G_DEo2DDL398~mDbb2eFfU=VVJRKd3;4B353+eKKh~z{> z&#$Oxo9Nd-$d2$LHMNE2VI#%cUYE++cT$g2EdERHKpBvB5*P3d*s%#rV==I_xD?Rm zQ%3%?F}apsn2Q#&tJ+dihg|y>wv0tcjsIt zKPr^0r4DE{h(w^@ouI9ssU1Z^ZPD5nE^8Peuc`XmHE0p(7$Soei?9}t?3d3_4M zCx)ft&UyAJUuEk=C08uQ` zcI-ldIAglWg9YD|tC8I9^aE#5ODE#7{$`0B&fqjxqZ99*{nfgoCkanvgOXFqMD1Y9 zhRqJ)&bh4SS-`c9;JO3o$BYn{{wr{0&rV#lmR-0K*b>@To8sD&3U?e%T@b%oM6PJ0 zU}F(TA#B^l41V*ivTf^?-YR*^75JqOp94xZ932i?jR=i1YaM(wEwdxvzD&@00y1ux zTfYszhH@3Fl?_k4jAwvK0ox+%LWS?#!DphJRcIo=>I0e-5L_T(o&IZ!M(tQT)MioR z@Dp^q=?0!2b(@fV<=u8TcgIFMi_A5! zF0di?tC{Hp=+VrU1jyj`y`PwIpLq{eQ{)9Ah(y>nC&Bm$X<$CmjjlV1aYIw>YZT7* zItA=O&uSQUrvN% z57t}7<2gP(lE`td;BvEe3;*xY!~=MwVxl=w#Ycb(*n`+sD_u=4c|YHU9PGhI@ceo` zF1a0k{-{WLEcW)0fJOlL7CeF*%{`)hWOoKbDXSvCcoI)A`XXCrH*B+rbO}pEv(l+L zm!B^s5FVb78<6o0YuiA$sce}Dv7kH{q}lY5zO~_ODl+~6P~9Ei4oXj$lH@xUV|{AF zxrOj3DHE|z0E<}-w66`D;agDAwwRQ%W(Vvh9uYY+*@Kh`gBoirAAy{3i9*K-Cc5Y= zfWiB5z{M8=7K26E*k@v{j5E`?vCM>*da6pW8D2)2Y24pqrtx24rt#W^%=B$Ej4*|r z;_zS`Ry~TYfaSx#g*hg&c{xiHOJ^dA8D822m=^O9?-0RkBnGKDpGIi~_W&>S0sV|* zd^nCHR0k9+B9K8O^Bq)%mc->BevVvKI+r^J24U z=~OKEG~H@q>xKF;6V0~DGeL;l!%Sdep$-He5^J)ebu`+kgtiehC0ULo#0!lzP)jy)bh|!1@|1 zVZhNirUVu+E`)4luHbD}J{A^`yR7E1M+rNNG#3BhZ14s4&-EAkfQWZ+<17{toDkn^ z_$a+ur7YBsdq+0q$AAjz;g=@+HqC&uCE+g_likX=^(1?O=x^1+UL=?}% zjnzk6^YW>p=VSeDFag0rDh`>*o1r|HUMv-91 z*ud;_X$}BjojnUt*pfjdu&XQGkQuZ*n}%IkX;@8Fu>@x1LR4T!IW6C~@GZIBCK(*7 z^wXNA^CAddYw30y>8%I_tZd7DmmRG@*aiaWCN;}bnkdQ=KP!pF;WGvfB1t5TN0PM* z3_s6?c}KNl-&ojOqcSR*h8jcu_N6vcT4n4)o&1le0b9iWS>RjQ;{$cX@6pA=esPdK zRvHCQjK>)Y+FqOMS8@)18vq)r*_?tj*p@cePB~{IPEf`m%dXmQ>FZ-WjI;qIpiYOA z4+qmc0pW$nr6Px3grhw0TdBrBK}m;O3pGOTjgR_rgs_P17x^ew;4O02I{hepKT2bs zz1Av%pG6P~c6`MkQOJP;ioL-21^?nWD2RRO;!KU#8}Sl1O`!_cyzvMfi9kU3GPFFV z4RkL2r)Ns+~Ac zCS5Yd;fmkn(6?fbIcKw=r&rp)w=uPX^UwVIJUwQ4ftVZTf2I!(3d7? zK!~9rGz$fqR8cYv0OO*st#0(08QWnyu|8oOU>iVpal#@j;F)7YP~$c*^_YHHX7$VU|1bTLM*ZR_u=+ifR|;5`cbH$U#XBcX zf0@Y07a~*W@*sZ0qcu+2Do_&#AQh%7_NKygz0jc-;+HjIhGIkSJ+QIIOxzR=`7A~z zVN9#`kAOU6DvGeRFnxKM&X~|KHSQ(}fZ)L}ZOa9ZB3M*BI9ZtX2LNvtru_nXQ92X* z2lOI{2-;7e<9OXL?KaShvRRlmAC&1uIXD$FOxqDE^rG3X&;1Ry0u;^B#gC+xS-*d( zi=RV{h~Gl3@MEI@L5R?fC%^v0Q@Axfu?tu3g8&0}g7t4ffPCb^xrFdP00e)~H$X7~ z3Q$XlZJf6<{3V*R!x_fQ1@31nNMUYCV>0yALPW5>I{jCR(kL;ecBIh{y=(bPj5r^)wl z07S{#P2K@IJ={8|7sCg8R41a^`b875ZuVzEf0!MIet3Pe<5s*}l;Jt^49^^gnM1ieQ7;DKS zbYElze$Ajr#O|LlW(NXeF#eA?7&VPQlK^4ZBkSRU=o4|Pr{i&}?PD#f${s%$SIC_B z{^Hac+Fy)Cw=uqmT#LK0h2tGaR?mJo&#hlXCPf|{Jvx{v`h?<)PV+gm)3h=RQ)UYF z;VO8VJ!YOSy8;=~;d&uJo>Jjq6Bx?>(?Yy90Dbh{_-`;)v@2-}Nx) ztMcmeu88 zO=1E7Vp`nn(Cc!@@id!G^8wYUM4W8+NxnYb4HVe-~yUIU4EQp=&DmEbx5LGf>8}=z+CI*7YX3 ze%cmfMb}%=3&v{|d=Qcwzo}@Aq+ZZN#M;dUZisY%)cVFy2mHLe5coM?lcRCA8WTq) zWP1ibfCENi5;F;pkeK4kD~#6Ii3o2C$E-kvL@)6Y_0Hd3BLs6|^T0Upj!1B8Bi*&L zxFVoBscR6=gK<9dQ$eOr0(==Qv4LVI>DNEwm2`=|`+DE^ZoV&b_St9u zU3>4f*IsMwwQ?dim1w&GXS2;t?^L~9lyr#v*3&KwtqgP7Fme>e< z)`nz5lt`MV+Z{>^1Y&RD$aEEy_hm^;QG=S%CMy*am*4hYFEwqr6W+>@6r0ZZZWl5W z)yTeu_9xDCUlF1}2r3)%hFv0rYr-r?vwl7`OEx6w- zA+(gN&`sm@+W=UrO&DeRY=WT@QA=hXS$Lh9jP6XZNYU_o)UO;)Z!Fl_e*YET0@cn- zA&z_IMh9}f+fFOD3Sgn9Xk|_q0S^oA?R~0n{R5s>eV0j;tZ&hIkU?Dw6=>?q`-Bbu zq#!0yidTjpW+(yD7o z)2Ufl_8I+#rBd~<+(#xU9+4qFt{N`Jzy#?1K5LZbFiMb&bCGb3NVd$jT^7M^Ku|CS zS_@nqz&;!zOUq1xomLwc=zn1vSuhz#5SWZ6Gv|#^9|DOs4DVCba;5`wt*Tn2ujXt+ z7?0V1h>X{{k09;_4yB898FS9cLruQD<;^I>hjGI=;PoBSLN)AvP;TAZ|6XV@NElyR zkuJ8G*k@h2h&2GH+(?&j37&mVp)98C&uYMmE-OBgN z`?Q_={WGsyLS1!b_{y2->()XY%qlT=q@(LS_%0notT+G(`!?~&>le>6Cb0Diaj7Rp zeQq{Cm$xsjtejWtq=_Qq#dQD)F)6ZF*EmzNkKt-aHeQTv%7zWy5!Q%C!=(w5( zf%_1nm-#yEt#YXHL1%QWzq`J!CpS2a8^3fq$u=pXYAHO)E;*9(E1|lsto1X}i(F~c zi0Te$4mxNRV z(aB)cq4naXb*PmMY?!OfgrV*SHTI9$MeU=+6sx7!36AYPnHxU+kStTL-wP!ZdAq^fZATJ8%NBA^eg=MxGnwm-k|B70=EMj!7?Y?aL`x z#09g6?=x@j`s0zUlA>vuyR0{&%0Y#?%8aaFKd~kRhh!-(Yk|YNZ#|+zcUV=0(~rl8 z0cn@P!w8}bUcrV@gSXo)ojZBm|8M7dX~B*iMsT=OleJx<`yLv|#d6UCS9Wc|o&Kg9 zp$z;YUt|THrH5}>kWl?BnhqZ7NTdjGEqG&d`#f4U@E8 z8WTBmCO0^?w%|5@lbf402+#SA;EE->{)iB`>sErMBM}+6%1A`AmPI=UD#FnUzRAH^ zKgXevMhH^as*?u6D-2DEP4DMvqW6>>5;#FL z{u57g@6bZq1T06RpXG?#KGBS5T9ynu9v|64zf-0Ete^b|^NdY(%7vQsIlL^XHW{|( ze;Tes51Q2)qWlhJ424Stpk7f)8C^!2Ua^T)*rP>d}5@;E|6DB_Orf) zv!;{;v|3L0oQw2vbQA6gm%-|iJF0f<(2t#^n=r2D;s;~$&}$Sdg!Z--v2oA{u0$1zX~sP7f0$2Q4nab*0y7Z>`o+Fj=Hjm!h&P1J;rw^ z5SM?M+DLe( zrOhg=DK6nE&XW8+0^a}D59E}J=@KgYx5@z_DXxY5jP=#`an zkc90ew8~sO>!BWN?Ok5Rkpqwq*tyv4~Lkmkw^JE$`K2_A3LTE62K9Ei?%EvydXtu!mTJ|(kCcMb)bq-iDUNff9>m0OV zrkXLuUZ)L*T$1ZTGiIXK>9As)W=x6K>9S%z!Ttm#d%VtkE2hVcnc;PoSTS#!F|)l+ zj}`Nh88gr8oMOf7Fk=>aomW{gKQm*Nc%9R&m~CdvQm^wmD<&v08O0v6_gteuFH5QP z(1jId7Khh)!s_NtW{k`0?6qR1n=#Y9&SI>%x37 zZ=t;lBR@PLpDFuV^;vW_iVPWMVJZ(6m~*L5ga%ifHvrB&bM5$6bU-dvqp zdJZrs)hDsEH6ts4jjQ~?n0fVVJHgYKHED*UWhSnyRExbz|K|@?`8Dte&(q)dQ)a8= zO4VD&GBs-l*u!L}gt^nJ4xB;F9H|O@9qDVZEGu@L21{GKt$|hvzaeK_*l?V2^A#Je ze(g0=&W$>xQm$F1a7XU}oXqx&97F#FhI@h0nBB578tT*w3rB2_zrYs=LqPP7UwC<$ zEz(3o5aHug`_a^B=>mSYP zaXbm3m0ty^MjO^u-|-MY^ZYAYJ8N}mA$KCd>Hr)H);f#T&R5w2tOwyakQRPHt(xzlg=^MB>;4J;v>oN1Ia~l5UTBlC#m~eNg5vZbv3Qlr}}i`;_ami z(ms9rUQhGvdeb?qwsWuW|BmJ4Q46{B^+&?1lit{d3G~9RxKG_z`i@Jv<9W?Vor5C5 zfCEI&dRN2Q^xIHjb9koRwvE@5rPbG4Pdmho598kI8xWGoyJD-p{z5>LjidC-Z6UwI z)_-`yfzpG(m+cQWu)67KaxRvClgW{pqD)sI;_q@`nEL;WqL)mSL%aeoV79=up%X6c z={r0Q98ftX*KfwOas8#p`n33Lk3a12_(RFf{?NeY$Xbsp=uA0fJ)Fo-6ngZBIiOp< zQSxJv6&{B^jhL@LM#jKWacAXknC;n|9mt7KYrHhejf|{!b6^b*TYYeT{6xGx{&8r| z>(U5q>ry%F7u+SU(Y z(iyf-w1)toUz<|&2)*Fh#{Ym{+t6{HUwf$8udQ%CqduJN@M{P6|4xQDuyjtEb+@U` zuYIzA&b72_bDm%O%TkXcL0K`sc6Is(o;@d^l(BWuw8E1gJ``#xB;exT(Zm?k&~~th zN}g%KC;O?n%dfRWbLI$@y=n5CYaJB*jI^PiHk{H{(YWDi63%8KsjcPWCkW(_>|#kq z5~hVJT48wHRE@#`kR>P+En|`BAOjG=agGa|kW4?QEPTxA*Y$=592<}to`z9iIK$jr zJfZCxvz#k3{|L~y_zH8FyRXZ!zVF=^aL-)rUVqK<3e2WGDEK*Fq_~m%^7;qTHY}>Q zX7g^RPzo=L*+0QSdJ{H1{uQUY1_z_aKjNNNFAFA{aFAilCJZh{s@9Zi{5`hF!L)%f z^_!fZARx2%QkZIpaOL%PF;Ofn!CmxW!@k6hEY7lfWWUo~Pw42f+f`RBhk2OS9#{qf z=4iBQ{Kp{{>xtZ`3!KImFT8dwxZvCn^C$u<4WR#@Dl! zk0~C(9?pLH$o>Pd@do6ndA|NqAx)S%EFq2ZJ@H$qC9@}qlA{vR6zKtq0o&=Dhl?}5 z@!ue63;_*K34iA1$Ry(q}wX zh0@ut$H4W1LT6PMY$5@)`=0hpTxI)K!6B9jP9*0MnK5qw&oDc5WLtky6A>FSP zg8Mf72T1VMKTAwOQlXY9MZM>u88`zDhgYbB;#J&-=6MRdHbi(Y>BzNeA4~?Y3`?%zjF3UvwwGyCLuv?|Xy1QI zyYgci*B9-{wMU-^=cC=hUueLlE$ozbK4G>8L^`GD85OPpYt|g0WI?b+&BUEj?^C9g znBPAo{@Iv^*yRsRK;`s&lsZTZ0J+HGkQWrwg zgrZr%nrdPB@VjA_U#o5>cl(~P0@4!`>BLgc@D3&c{0GQGZDK!#rl5mv9L7rriRG6L zvu{%Wh65!8I;nus%!^8UpD-Kxzavj_5}{dW|Gd6$D{T4nQ0|ApTZFPOCR!h@$0OGF zYd?&CaI{@7gKCKDN27gPzdWEsvW&*J3g_ zJCNP?AC%o=JdrZ^nED;iN^}X4kpv`W1=+Fqhom|FSmLF-DETq7g89J%@sDFxiVRf} z%WV%XkHt?I*^-5qr%99giB$V0y^@lN92Y++4(@WyR%OaCtCSBP@*x#Z8t*2$Qa6#8 z#|5-&)fbz9_k&DJKUb6^m9KJTKAMfROXL1M6Bmm&$9s-U8={v-<6rFAqkJ43scrkC z0?~MTSI=-nJjBP zwj(cb)<_@ugZ%bw{SLqL0xk=1)-1JkJJ$eQ)Bnjx-DZ7XmVd03-xy;Bjz%+8KJsPh zOXBTc7X8IyvM5IN$2>9Aza*H#w%MvAE4Muc4QDRo6|~n}9=W)bOE~?!A8ltb2uc_= zyIy}?=5BWnOFbFy6-*L8mx#x3C*x>1W@G(@_HXus-*V#jcyeN#WYEjXQIk8??X0Iz zGaSCj!EvT{^Bi?HvL~`*#Dq@dLe-}?H!bw!@EXq5o@~pD_T=&IXv+5-xylpTn=6MS z8((7_v|OXg;I1hVG3)4Mk6-1vEvAlfb2y1z!eOo?P{e{$f&ATq)b%(&x5ZRSS!0DB zISF#(MU{%}i@%Bs%rV=G$w1DBQt*{hUT{*T;9^y9=H6xCN)pcB0{|cg z#DHQ?_r?FpyI_IctSsAx*6xBAi7;MCIG_AN!k=am0%6PSR2xv0dcIOZGDX7t-fR%oq_toLT1q2>gy)bmasuhCsrR% zz~SsptUi&*sYt9oZC#Lf3k5%ItB64L#$O5*J&7Etn|a4Vyj5OGZW$2XD}efy886|K zu&}8_0LkYLiIRyB(zQUP7<5^nS|)5)J|Fsg%Ve1TM$1wyBjp>LtQw3L;%FSX6U8Z+ zz9D@=;C6w;Eg`)qFjFd>64LE~3#aX%Rowd#(A1LA!vvsA5z^Px7~kTN zaQ4#d<Q{jF-MBPKS<6b8wE37}0wh8$T&zV4{n+64+LTd>CoQV>In^l`*(Jml|RH7qD?^ zYMy!|c*}6q{Y*X?S%$2pCJ~omE9)+pJ|)Xd76x>pM_;Lu3>;2L5=o$hx?{NmZa5NM zn2E}OfO4LfEh65-zR{bWxvVhgRi1`}alNZk=7jS>EfHrAb2d+9`lpx|5--)x2O(-( z56etpV^4JwnCZ*pzkVctp5!ONAO0%u&sAQlXwke&bj@6rAG}(G#3m;+elp>6n+=(- zZ4m}SS6sD-oIf+fM$ud=WYihbW!)=mfe(-{kj)cx+1xp}q zCtAfls7cH?>1PN16etNsDNb;KO_=%1!`;ZPk0a=HtPFqG(R2@N%@YkL8fo(g5)Utc zZ?GZ1THEDnifp2-7|sU^O_iS#`MFSj#>o%*9QNQnwQgfv?fFJ-?Rl7Pb8w5qb!R1} zgpr#4o<%Hts^;M0@K;fqbz=hS%y^_JXD$xpgzj!0GR{W>F|i2c&38g=_QdLE&|j3S za(}N9YvWQqGW2>Zxv<{2i?B{mO8Pm8*M|mKV>f~#0)_f~WPIqbz&cq&2*eL(<}3QO zoSekYpK_sIwN#;}@H@Ag{1G)ho)nk5OE$ml4Fz zrNYK~8#*`S!zzFUmm9zOdANWhMH#Uw{7LA&OZ#H3!1z9&J1gMEc+PI})`Z^cPd(1S zhGUov1~gd9(SKon_$;-B4}CG*!~ZYl6!~1*mPZJoda{WmY;HBri%vV2dse8+J%JnM zC{FK1ST*}5I4pj$`|ntn&NikmtM&&=jU~ge@_v>1$+&iO?1PtBv1~sUB%rEL+>sWi}Bj+iwtpkU&%u{m7B9h2GBsoM0VrjusZ}4$<>8m*g{S z7)aI_zJ?YXvWdjX-uTIevv1J5x-sSHqwR~0Zy!~Qdwy^%YB<2dW;m3MGGE{GcA2tC zE!5^l(YDXqSvMW-EZ$94p6>JYGP}6Bk+rx}@AI7&w=Dq|gs!cgQ0E6|feCZ83x7_a z&0e9mh4d+gwVO_KE#@{cCc)hLc$&lro$HIa1Lpz%5^O7#=+aPPKjJoC-x_S8jodX5 z*5`;tVw0t*GhJj;%&5Bya}1Xx_|OyHSoJG3s@dd_HDMBCnOn9Bxx4hrkNGfmm7_13 zjWtr<5!p6}mN>Fyzfln&M~NVX!;FCDlL(h=K`I54MIz+32zxLVZK6s1MV8NZg_7=T z=DUav=h!ie_ab#kmy4{M(mZ%&uMs=r(Dvc4NFG0&E+##kf$H=C5bH2N; z#X(rue)%q}VP?XZ$3#)ZjL+_CVdEn_b`?#_%w+SLTHrEsCX0Q(sgm4fHzrAYvqH%s zalM%ZvNK=L<;4sraKul8QVN)j^-wZL%upd8js`DN-`+9MMpD_|54AaPNMpVjp*Ail zlLA6L+T$#DHS{FYS+;A0V>xzJNvN(wE+A6)T_ruB{azueCY-E|kA zTycARRfRE2%AH@LFmQI${1VwNBu`>E58qc$49~wSlSE2M*b}QN^zR_B<(Pn~c&!b6 z;(##Cr8L)5Zt(l%LlSaH=raj9B-Ae$wHUE9nRX5{zO)WT~r0Hm#yV8 z`6=KhIHh5npbT!*=S)ts%nAfypzGw8cN$P&V@Vn(CyfthVL2?6#EPgb@OP43NaWx} zlg1n4!#Slb1p;3#3#lM5M~xU*tqF{Y&##D2Fr10`6^RMMc8%#H>?3x#<{_RNi*?_l z8KM^jwi)VW66++hNLJ#cs-(O<9GzMC>I{e&Zd8W`F5dJp_mJ{molOL%E6fY51O=*l z1st+Y0BZ9nCVYC1W89iE_qX5_%piq*9;Dc)!RtkR0%oojJ&abIxp5%cTqzp@Th|(6 zLME4Pd`hHsy(!^i>&PG8*r1U>YEWBMLP?EH#LN3q5KXpff4FX(wyX7bLXn%~3Ro0- zll@U8S9G9;a^KPT%YwSzPJ#!72FY5`=Nsn^USX%h_>_<8Zti2{h1#<+ul57CG6#}U zcGF7N?vL2D{iOrwkL+soH`R^1JutSwR!>}$ZyXJ)wVBBE8ijcBv2|#xOmxZFK)-}2 zZC5`%iJo*cyr;ORCxu0Qr$AC%j49z;B~GKD*i~thHA-e%k2FcTXpckD!b78X`3Brn zKrb@LK`a*qi%?25qcF11yU>}d;R`Gqw`TyT_)GWuz59cXTDzg|5irTydHop4qd7qb z>@}PX8GjyDV+43y{l%_>dy;!n1s(t>9++Zk0vzXV%xw}egQ53FMcXRqXv{Ubmsj;i zZD`V>DBSmK^CF|1R~xSwKC_&(F>l<0CRFsd%A9)_d- z(iXqBC0Ne*n4{AIHOc{vg;gv+iUJgkOC%xLP<;+SrcCKUAMI*y=uzVfFfUPnLPE`Y zgUzG$$0xLhdLD^1FiI>RH7|w4muZ=AeoRK@Q>ug;F!0ahZ$Q#d+Vo^MC`JibU|cYI zV%ontykxe$P1`lUP}^05vAbe>6hY_&(apRsAJ6Dx(d)9m;XSiH_oh(u6z{?Hx=4Pw z%%#f7{7_!)&^q^ZS?+byOKk47zoc=t3Ya@oplIW3IIF!1Vb;6$*Yc_9Zk^p-LhJZ< z>znw6tY$8(pk31>uEPBCbvnS=lrOWw^E^@g(*6!^(pwt32w>MX$u4gjwt59#;O~ z)5A5JI-ZrMi0m!@^C`V-emZ?Bb(jh()~30)0s*wplV7&hgKxF!rYT|FIxS!mqZhXU z^o69LsM98FPR0IKw!6PPTV^nLR>5T}%xlJEIFb><`Q-=tKMr>Z_l{?8IM%xCD%S^Dr@>kKRsbFexc^P{G)*KO& zc$sM@Lv&n*sBx|g(f_y^(=h6fGF<|yyf*RM9URNMqrZnXFYoWMzy=8HCIEZv2XE)o zNb6pIy}D{8O2i+M4XD=@E%pIPcYjy^;ZT%kU=O`L)Aqaiz%d#)b38BGp>f}2t&otl4_zFs^a0HDzt{mZ4Om212j<$ zl^V2V4~+S%(fV326SsQJozm6%GxIhS)t@QZkfZ&fE3-h`nAJ zS?Y0>wS{^#dvrp3UbH545yLthJ0=qgt)bv1UmRsP#l*=+TX^qe*bZrL+o|<=;b_fI zu@&s_oQh4exzU@m8Sew=QT6|(meO6MqWFe7ldS>_!C2xog(#tg^Xn>_BfnO-td0%Wky?4v0* z=}Y1hJ>h&$!^iZazJV=1y_q|SG8Ul&HsdPms~O*A#visBg_5AZMN$WM$M5hI%YS<; zH8qr(e`XuA*58SmKQpl-nsntMo&4V6Q`&t;Y})uEl;C(Cd9$dbm+n89EbIJ4`-fb= z_R#^q7C@pLc+IaFJm1=1+J@FbTN(+d(XG80wYMPOJd9F^Tk}PM)^^HY9`2$7iga22 z=!>@JVh3r~Yk?YUb5xpk3o5;Wyg3`TQJie=DL<>GjH6e?Od53 zZiycI0_+srO5X%1!0k-=0U)P+9&!q5#XzsUv`u>{YHvl;$k!oIY;_wQ%lQy5?dt5| zHgvSK?dHpbqWQN~*Xa4=42 zFTQ1OFW5o_ZQtd4C+zWxFr`9B-{zGsY;dj#vd4q#_ye$W8g-TTYa>>04%{ w)4Q*m4nyxJ5W^^Qr>@=%A(KhcOp +#include + +#include "peconv.h" + +int main(int argc, char *argv[]) +{ + if (argc < 2) { + std::cerr << "Args: " << std::endl; + system("pause"); + return 0; + } + + size_t exe_size = 0; + char* in_path = argv[1]; + + std::cout << "Reading module from: " << in_path << std::endl; + BYTE *my_exe = peconv::load_file(in_path, exe_size); + if (!my_exe) { + system("pause"); + return -1; + } + + std::cout << "Test it!" << std::endl; + BYTE *test_buf = peconv::alloc_aligned(exe_size, PAGE_EXECUTE_READWRITE); + if (test_buf) { + memcpy(test_buf, my_exe, exe_size); + void (*my_main)() = (void (*)()) ((ULONGLONG)test_buf); + my_main(); + } + return 0; +}