blob: 898cbd3cf18b759cbb6c96531d5657c29318d6fb (plain)

ofs	hex dump	ascii
0000	61 0d 0d 0a 00 00 00 00 df c5 94 62 7a 48 00 00 e3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	a..........bzH..................
0020	00 04 00 00 00 40 00 00 00 73 ae 00 00 00 64 00 5a 00 64 01 64 02 6c 01 6d 02 5a 02 01 00 64 01	.....@...s....d.Z.d.d.l.m.Z...d.
0040	64 03 6c 03 6d 04 5a 04 01 00 65 04 a0 05 a1 00 01 00 64 01 64 04 6c 06 6d 07 5a 07 01 00 64 01	d.l.m.Z...e.......d.d.l.m.Z...d.
0060	64 05 6c 06 6d 08 5a 08 01 00 64 01 64 06 6c 09 5a 09 64 01 64 06 6c 0a 5a 0a 64 01 64 06 6c 0b	d.l.m.Z...d.d.l.Z.d.d.l.Z.d.d.l.
0080	5a 0b 64 01 64 06 6c 0c 5a 0d 64 01 64 06 6c 0e 5a 0d 64 01 64 06 6c 0f 5a 0d 64 01 64 06 6c 10	Z.d.d.l.Z.d.d.l.Z.d.d.l.Z.d.d.l.
00a0	5a 10 64 07 5a 11 65 10 6a 12 5a 12 64 08 5a 13 47 00 64 09 64 0a 84 00 64 0a 65 08 83 03 5a 14	Z.d.Z.e.j.Z.d.Z.G.d.d...d.e...Z.
00c0	64 0b 64 0c 84 00 5a 15 64 0d 64 0e 84 00 5a 16 64 0f 64 10 84 00 5a 17 64 06 53 00 29 11 7a 82	d.d...Z.d.d...Z.d.d...Z.d.S.).z.
00e0	70 65 75 74 69 6c 73 2c 20 50 6f 72 74 61 62 6c 65 20 45 78 65 63 75 74 61 62 6c 65 20 75 74 69	peutils,.Portable.Executable.uti
0100	6c 69 74 69 65 73 20 6d 6f 64 75 6c 65 0a 0a 0a 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30	lities.module...Copyright.(c).20
0120	30 35 2d 32 30 32 32 20 45 72 6f 20 43 61 72 72 65 72 61 20 3c 65 72 6f 2e 63 61 72 72 65 72 61	05-2022.Ero.Carrera.<ero.carrera
0140	40 67 6d 61 69 6c 2e 63 6f 6d 3e 0a 0a 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64	@gmail.com>..All.rights.reserved
0160	2e 0a e9 00 00 00 00 29 01 da 08 64 69 76 69 73 69 6f 6e 29 01 da 10 73 74 61 6e 64 61 72 64 5f	.......)...division)...standard_
0180	6c 69 62 72 61 72 79 29 01 da 05 72 61 6e 67 65 29 01 da 06 6f 62 6a 65 63 74 4e 7a 0b 45 72 6f	library)...range)...objectNz.Ero
01a0	20 43 61 72 72 65 72 61 7a 15 65 72 6f 2e 63 61 72 72 65 72 61 40 67 6d 61 69 6c 2e 63 6f 6d 63	.Carreraz.ero.carrera@gmail.comc
01c0	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 40 00 00 00 73 7c 00 00 00 65 00 5a	....................@...s|...e.Z
01e0	01 64 00 5a 02 64 01 5a 03 64 1d 64 03 64 04 84 01 5a 04 64 1e 64 06 64 07 84 01 5a 05 64 1f 64	.d.Z.d.Z.d.d.d...Z.d.d.d...Z.d.d
0200	08 64 09 84 01 5a 06 64 20 64 0b 64 0c 84 01 5a 07 64 21 64 0e 64 0f 84 01 5a 08 64 22 64 10 64	.d...Z.d.d.d...Z.d!d.d...Z.d"d.d
0220	11 84 01 5a 09 64 12 64 13 84 00 5a 0a 64 23 64 14 64 15 84 01 5a 0b 64 24 64 17 64 18 84 01 5a	...Z.d.d...Z.d#d.d...Z.d$d.d...Z
0240	0c 64 25 64 19 64 1a 84 01 5a 0d 64 26 64 1b 64 1c 84 01 5a 0e 64 02 53 00 29 27 da 11 53 69 67	.d%d.d...Z.d&d.d...Z.d.S.)'..Sig
0260	6e 61 74 75 72 65 44 61 74 61 62 61 73 65 61 b1 01 00 00 54 68 69 73 20 63 6c 61 73 73 20 6c 6f	natureDatabasea....This.class.lo
0280	61 64 73 20 61 6e 64 20 6b 65 65 70 73 20 61 20 70 61 72 73 65 64 20 50 45 69 44 20 73 69 67 6e	ads.and.keeps.a.parsed.PEiD.sign
02a0	61 74 75 72 65 20 64 61 74 61 62 61 73 65 2e 0a 0a 20 20 20 20 55 73 61 67 65 3a 0a 0a 20 20 20	ature.database.......Usage:.....
02c0	20 20 20 20 20 73 69 67 5f 64 62 20 3d 20 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 28	.....sig_db.=.SignatureDatabase(
02e0	27 2f 70 61 74 68 2f 74 6f 2f 73 69 67 6e 61 74 75 72 65 2f 66 69 6c 65 27 29 0a 0a 20 20 20 20	'/path/to/signature/file')......
0300	61 6e 64 2f 6f 72 0a 0a 20 20 20 20 20 20 20 20 73 69 67 5f 64 62 20 3d 20 53 69 67 6e 61 74 75	and/or..........sig_db.=.Signatu
0320	72 65 44 61 74 61 62 61 73 65 28 29 0a 20 20 20 20 20 20 20 20 73 69 67 5f 64 62 2e 6c 6f 61 64	reDatabase().........sig_db.load
0340	28 27 2f 70 61 74 68 2f 74 6f 2f 73 69 67 6e 61 74 75 72 65 2f 66 69 6c 65 27 29 0a 0a 20 20 20	('/path/to/signature/file').....
0360	20 53 69 67 6e 61 74 75 72 65 20 64 61 74 61 62 61 73 65 73 20 63 61 6e 20 62 65 20 63 6f 6d 62	.Signature.databases.can.be.comb
0380	69 6e 65 64 20 62 79 20 70 65 72 66 6f 72 6d 69 6e 67 20 6d 75 6c 74 69 70 6c 65 20 6c 6f 61 64	ined.by.performing.multiple.load
03a0	73 2e 0a 0a 20 20 20 20 54 68 65 20 66 69 6c 65 6e 61 6d 65 20 70 61 72 61 6d 65 74 65 72 20 63	s.......The.filename.parameter.c
03c0	61 6e 20 62 65 20 61 20 55 52 4c 20 74 6f 6f 2e 20 49 6e 20 74 68 61 74 20 63 61 73 65 20 74 68	an.be.a.URL.too..In.that.case.th
03e0	65 0a 20 20 20 20 73 69 67 6e 61 74 75 72 65 20 64 61 74 61 62 61 73 65 20 77 69 6c 6c 20 62 65	e.....signature.database.will.be
0400	20 64 6f 77 6e 6c 6f 61 64 65 64 20 66 72 6f 6d 20 74 68 61 74 20 6c 6f 63 61 74 69 6f 6e 2e 0a	.downloaded.from.that.location..
0420	20 20 20 20 4e 63 03 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 04 00 00 00 43 00 00 00 73 52	....Nc....................C...sR
0440	00 00 00 74 00 a0 01 64 01 74 00 6a 02 a1 02 7c 00 5f 03 74 04 83 00 7c 00 5f 05 64 02 7c 00 5f	...t...d.t.j...|._.t...|._.d.|._
0460	06 74 04 83 00 7c 00 5f 07 64 02 7c 00 5f 08 74 04 83 00 7c 00 5f 09 64 02 7c 00 5f 0a 64 02 7c	.t...|._.d.|._.t...|._.d.|._.d.|
0480	00 5f 0b 7c 00 6a 0c 7c 01 7c 02 64 03 8d 02 01 00 64 00 53 00 29 04 4e 7a 68 5c 5b 28 2e 2a 3f	._.|.j.|.|.d.....d.S.).Nzh\[(.*?
04a0	29 5c 5d 5c 73 2b 3f 73 69 67 6e 61 74 75 72 65 5c 73 2a 3d 5c 73 2a 28 2e 2a 3f 29 28 5c 73 2b	)\]\s+?signature\s*=\s*(.*?)(\s+
04c0	5c 3f 5c 3f 29 2a 5c 73 2a 65 70 5f 6f 6e 6c 79 5c 73 2a 3d 5c 73 2a 28 5c 77 2b 29 28 3f 3a 5c	\?\?)*\s*ep_only\s*=\s*(\w+)(?:\
04e0	73 2a 73 65 63 74 69 6f 6e 5f 73 74 61 72 74 5f 6f 6e 6c 79 5c 73 2a 3d 5c 73 2a 28 5c 77 2b 29	s*section_start_only\s*=\s*(\w+)
0500	7c 29 72 01 00 00 00 a9 02 da 08 66 69 6c 65 6e 61 6d 65 da 04 64 61 74 61 29 0d da 02 72 65 da	|)r........filename..data)...re.
0520	07 63 6f 6d 70 69 6c 65 da 01 53 da 09 70 61 72 73 65 5f 73 69 67 da 04 64 69 63 74 da 1a 73 69	.compile..S..parse_sig..dict..si
0540	67 6e 61 74 75 72 65 5f 74 72 65 65 5f 65 70 6f 6e 6c 79 5f 74 72 75 65 da 1b 73 69 67 6e 61 74	gnature_tree_eponly_true..signat
0560	75 72 65 5f 63 6f 75 6e 74 5f 65 70 6f 6e 6c 79 5f 74 72 75 65 da 1b 73 69 67 6e 61 74 75 72 65	ure_count_eponly_true..signature
0580	5f 74 72 65 65 5f 65 70 6f 6e 6c 79 5f 66 61 6c 73 65 da 1c 73 69 67 6e 61 74 75 72 65 5f 63 6f	_tree_eponly_false..signature_co
05a0	75 6e 74 5f 65 70 6f 6e 6c 79 5f 66 61 6c 73 65 da 1c 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65	unt_eponly_false..signature_tree
05c0	5f 73 65 63 74 69 6f 6e 5f 73 74 61 72 74 da 1d 73 69 67 6e 61 74 75 72 65 5f 63 6f 75 6e 74 5f	_section_start..signature_count_
05e0	73 65 63 74 69 6f 6e 5f 73 74 61 72 74 da 09 6d 61 78 5f 64 65 70 74 68 da 18 5f 53 69 67 6e 61	section_start..max_depth.._Signa
0600	74 75 72 65 44 61 74 61 62 61 73 65 5f 5f 6c 6f 61 64 a9 03 da 04 73 65 6c 66 72 08 00 00 00 72	tureDatabase__load....selfr....r
0620	09 00 00 00 a9 00 72 19 00 00 00 fa 4c 63 3a 5c 75 73 65 72 73 5c 61 64 6d 6f 6e 5c 70 79 63 68	......r.....Lc:\users\admon\pych
0640	61 72 6d 70 72 6f 6a 65 63 74 73 5c 63 6f 64 69 6e 67 5f 63 6c 75 62 5c 76 65 6e 76 5c 4c 69 62	armprojects\coding_club\venv\Lib
0660	5c 73 69 74 65 2d 70 61 63 6b 61 67 65 73 5c 70 65 75 74 69 6c 73 2e 70 79 da 08 5f 5f 69 6e 69	\site-packages\peutils.py..__ini
0680	74 5f 5f 2d 00 00 00 73 18 00 00 00 00 04 04 01 02 01 04 fe 06 11 08 01 06 01 08 01 06 01 08 01	t__-...s........................
06a0	06 04 06 02 7a 1a 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 69 6e 69 74 5f 5f	....z.SignatureDatabase.__init__
06c0	e9 00 02 00 00 63 04 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 0b 00 00 00 43 00 00 00 73 82	.....c....................C...s.
06e0	00 00 00 74 00 83 00 7d 04 74 01 7c 01 6a 02 83 01 44 00 5d 62 5c 02 7d 05 7d 06 7c 06 6a 03 7c	...t...}.t.|.j...D.]b\.}.}.|.j.|
0700	03 6b 00 72 24 71 10 7c 06 6a 04 7d 07 64 01 7c 02 7c 05 64 02 17 00 74 05 7c 01 6a 02 83 01 64	.k.r$q.|.j.}.d.|.|.d...t.|.j...d
0720	03 a0 06 64 04 64 05 84 00 7c 06 6a 07 44 00 83 01 a1 01 66 04 16 00 7d 08 7c 04 a0 08 7c 00 6a	...d.d...|.j.D.....f...}.|...|.j
0740	09 7c 01 7c 07 7c 08 64 06 64 07 7c 03 64 08 8d 06 a1 01 01 00 71 10 64 09 a0 06 7c 04 a1 01 64	.|.|.|.d.d.|.d.......q.d...|...d
0760	09 17 00 53 00 29 0a 61 04 01 00 00 47 65 6e 65 72 61 74 65 73 20 73 69 67 6e 61 74 75 72 65 73	...S.).a....Generates.signatures
0780	20 66 6f 72 20 61 6c 6c 20 74 68 65 20 73 65 63 74 69 6f 6e 73 20 69 6e 20 61 20 50 45 20 66 69	.for.all.the.sections.in.a.PE.fi
07a0	6c 65 2e 0a 0a 20 20 20 20 20 20 20 20 49 66 20 74 68 65 20 73 65 63 74 69 6f 6e 20 63 6f 6e 74	le...........If.the.section.cont
07c0	61 69 6e 73 20 61 6e 79 20 64 61 74 61 20 61 20 73 69 67 6e 61 74 75 72 65 20 77 69 6c 6c 20 62	ains.any.data.a.signature.will.b
07e0	65 20 63 72 65 61 74 65 64 0a 20 20 20 20 20 20 20 20 66 6f 72 20 69 74 2e 20 54 68 65 20 73 69	e.created.........for.it..The.si
0800	67 6e 61 74 75 72 65 20 6e 61 6d 65 20 77 69 6c 6c 20 62 65 20 61 20 63 6f 6d 62 69 6e 61 74 69	gnature.name.will.be.a.combinati
0820	6f 6e 20 6f 66 20 74 68 65 0a 20 20 20 20 20 20 20 20 70 61 72 61 6d 65 74 65 72 20 27 6e 61 6d	on.of.the.........parameter.'nam
0840	65 27 20 61 6e 64 20 74 68 65 20 73 65 63 74 69 6f 6e 20 6e 75 6d 62 65 72 20 61 6e 64 20 69 74	e'.and.the.section.number.and.it
0860	73 20 6e 61 6d 65 2e 0a 20 20 20 20 20 20 20 20 7a 14 25 73 20 53 65 63 74 69 6f 6e 28 25 64 2f	s.name..........z.%s.Section(%d/
0880	25 64 2c 25 73 29 e9 01 00 00 00 da 00 63 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 04 00	%d,%s).......c..................
08a0	00 00 53 00 00 00 73 1a 00 00 00 67 00 7c 00 5d 12 7d 01 7c 01 74 00 6a 01 76 00 72 04 7c 01 91	..S...s....g.|.].}.|.t.j.v.r.|..
08c0	02 71 04 53 00 72 19 00 00 00 29 02 da 06 73 74 72 69 6e 67 da 09 70 72 69 6e 74 61 62 6c 65 a9	.q.S.r....)...string..printable.
08e0	02 da 02 2e 30 da 01 63 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 da 0a 3c 6c 69 73 74 63 6f	....0..cr....r....r......<listco
0900	6d 70 3e 65 00 00 00 f3 00 00 00 00 7a 41 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e	mp>e........zASignatureDatabase.
0920	67 65 6e 65 72 61 74 65 5f 73 65 63 74 69 6f 6e 5f 73 69 67 6e 61 74 75 72 65 73 2e 3c 6c 6f 63	generate_section_signatures.<loc
0940	61 6c 73 3e 2e 3c 6c 69 73 74 63 6f 6d 70 3e 46 54 29 03 da 07 65 70 5f 6f 6e 6c 79 da 12 73 65	als>.<listcomp>FT)...ep_only..se
0960	63 74 69 6f 6e 5f 73 74 61 72 74 5f 6f 6e 6c 79 da 0a 73 69 67 5f 6c 65 6e 67 74 68 da 01 0a 29	ction_start_only..sig_length...)
0980	0a da 04 6c 69 73 74 da 09 65 6e 75 6d 65 72 61 74 65 da 08 73 65 63 74 69 6f 6e 73 5a 0d 53 69	...list..enumerate..sectionsZ.Si
09a0	7a 65 4f 66 52 61 77 44 61 74 61 da 10 50 6f 69 6e 74 65 72 54 6f 52 61 77 44 61 74 61 da 03 6c	zeOfRawData..PointerToRawData..l
09c0	65 6e da 04 6a 6f 69 6e da 04 4e 61 6d 65 da 06 61 70 70 65 6e 64 da 26 5f 53 69 67 6e 61 74 75	en..join..Name..append.&_Signatu
09e0	72 65 44 61 74 61 62 61 73 65 5f 5f 67 65 6e 65 72 61 74 65 5f 73 69 67 6e 61 74 75 72 65 29 09	reDatabase__generate_signature).
0a00	72 18 00 00 00 da 02 70 65 da 04 6e 61 6d 65 72 28 00 00 00 5a 12 73 65 63 74 69 6f 6e 5f 73 69	r......pe..namer(...Z.section_si
0a20	67 6e 61 74 75 72 65 73 da 03 69 64 78 da 07 73 65 63 74 69 6f 6e da 06 6f 66 66 73 65 74 5a 08	gnatures..idx..section..offsetZ.
0a40	73 69 67 5f 6e 61 6d 65 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 da 1b 67 65 6e 65 72 61 74	sig_namer....r....r......generat
0a60	65 5f 73 65 63 74 69 6f 6e 5f 73 69 67 6e 61 74 75 72 65 73 4f 00 00 00 73 2c 00 00 00 00 08 06	e_section_signaturesO...s,......
0a80	02 12 02 0a 01 02 03 06 02 02 01 02 01 06 01 08 01 14 fc 06 07 04 01 04 01 02 01 02 01 02 01 02	................................
0aa0	01 02 01 02 fa 04 ff 06 0b 7a 2d 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 67 65 6e	.........z-SignatureDatabase.gen
0ac0	65 72 61 74 65 5f 73 65 63 74 69 6f 6e 5f 73 69 67 6e 61 74 75 72 65 73 63 04 00 00 00 00 00 00	erate_section_signaturesc.......
0ae0	00 00 00 00 00 05 00 00 00 07 00 00 00 43 00 00 00 73 22 00 00 00 7c 01 a0 00 7c 01 6a 01 6a 02	.............C...s"...|...|.j.j.
0b00	a1 01 7d 04 7c 00 6a 03 7c 01 7c 04 7c 02 64 01 7c 03 64 02 8d 05 53 00 29 03 7a b0 47 65 6e 65	..}.|.j.|.|.|.d.|.d...S.).z.Gene
0b20	72 61 74 65 20 73 69 67 6e 61 74 75 72 65 73 20 66 6f 72 20 74 68 65 20 65 6e 74 72 79 20 70 6f	rate.signatures.for.the.entry.po
0b40	69 6e 74 20 6f 66 20 61 20 50 45 20 66 69 6c 65 2e 0a 0a 20 20 20 20 20 20 20 20 43 72 65 61 74	int.of.a.PE.file...........Creat
0b60	65 73 20 61 20 73 69 67 6e 61 74 75 72 65 20 77 68 6f 73 65 20 6e 61 6d 65 20 77 69 6c 6c 20 62	es.a.signature.whose.name.will.b
0b80	65 20 74 68 65 20 70 61 72 61 6d 65 74 65 72 20 27 6e 61 6d 65 27 0a 20 20 20 20 20 20 20 20 61	e.the.parameter.'name'.........a
0ba0	6e 64 20 74 68 65 20 73 65 63 74 69 6f 6e 20 6e 75 6d 62 65 72 20 61 6e 64 20 69 74 73 20 6e 61	nd.the.section.number.and.its.na
0bc0	6d 65 2e 0a 20 20 20 20 20 20 20 20 54 29 02 72 26 00 00 00 72 28 00 00 00 29 04 5a 13 67 65 74	me..........T).r&...r(...).Z.get
0be0	5f 6f 66 66 73 65 74 5f 66 72 6f 6d 5f 72 76 61 da 0f 4f 50 54 49 4f 4e 41 4c 5f 48 45 41 44 45	_offset_from_rva..OPTIONAL_HEADE
0c00	52 da 13 41 64 64 72 65 73 73 4f 66 45 6e 74 72 79 50 6f 69 6e 74 72 32 00 00 00 29 05 72 18 00	R..AddressOfEntryPointr2...).r..
0c20	00 00 72 33 00 00 00 72 34 00 00 00 72 28 00 00 00 72 37 00 00 00 72 19 00 00 00 72 19 00 00 00	..r3...r4...r(...r7...r....r....
0c40	72 1a 00 00 00 da 15 67 65 6e 65 72 61 74 65 5f 65 70 5f 73 69 67 6e 61 74 75 72 65 75 00 00 00	r......generate_ep_signatureu...
0c60	73 08 00 00 00 00 07 0e 02 04 01 0a ff 7a 27 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65	s............z'SignatureDatabase
0c80	2e 67 65 6e 65 72 61 74 65 5f 65 70 5f 73 69 67 6e 61 74 75 72 65 46 63 07 00 00 00 00 00 00 00	.generate_ep_signatureFc........
0ca0	00 00 00 00 0a 00 00 00 05 00 00 00 43 00 00 00 73 5e 00 00 00 7c 01 6a 00 7c 02 7c 02 7c 06 17	............C...s^...|.j.|.|.|..
0cc0	00 85 02 19 00 7d 07 64 01 a0 01 64 02 64 03 84 00 7c 07 44 00 83 01 a1 01 7d 08 7c 04 64 04 6b	.....}.d...d.d...|.D.....}.|.d.k
0ce0	02 72 34 64 05 7d 04 6e 04 64 06 7d 04 7c 05 64 04 6b 02 72 46 64 05 7d 05 6e 04 64 06 7d 05 64	.r4d.}.n.d.}.|.d.k.rFd.}.n.d.}.d
0d00	07 7c 03 7c 08 7c 04 7c 05 66 04 16 00 7d 09 7c 09 53 00 29 08 4e fa 01 20 63 01 00 00 00 00 00	.|.|.|.|.f...}.|.S.).N...c......
0d20	00 00 00 00 00 00 02 00 00 00 05 00 00 00 53 00 00 00 73 18 00 00 00 67 00 7c 00 5d 10 7d 01 64	..............S...s....g.|.].}.d
0d40	00 74 00 7c 01 83 01 16 00 91 02 71 04 53 00 29 01 7a 04 25 30 32 78 29 01 da 03 6f 72 64 72 21	.t.|.......q.S.).z.%02x)...ordr!
0d60	00 00 00 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 24 00 00 00 88 00 00 00 72 25 00 00 00	...r....r....r....r$.......r%...
0d80	7a 3a 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 67 65 6e 65 72 61 74 65 5f 73	z:SignatureDatabase.__generate_s
0da0	69 67 6e 61 74 75 72 65 2e 3c 6c 6f 63 61 6c 73 3e 2e 3c 6c 69 73 74 63 6f 6d 70 3e 54 da 04 74	ignature.<locals>.<listcomp>T..t
0dc0	72 75 65 da 05 66 61 6c 73 65 7a 39 5b 25 73 5d 0a 73 69 67 6e 61 74 75 72 65 20 3d 20 25 73 0a	rue..falsez9[%s].signature.=.%s.
0de0	65 70 5f 6f 6e 6c 79 20 3d 20 25 73 0a 73 65 63 74 69 6f 6e 5f 73 74 61 72 74 5f 6f 6e 6c 79 20	ep_only.=.%s.section_start_only.
0e00	3d 20 25 73 0a 29 02 da 08 5f 5f 64 61 74 61 5f 5f 72 2f 00 00 00 29 0a 72 18 00 00 00 72 33 00	=.%s.)...__data__r/...).r....r3.
0e20	00 00 72 37 00 00 00 72 34 00 00 00 72 26 00 00 00 72 27 00 00 00 72 28 00 00 00 72 09 00 00 00	..r7...r4...r&...r'...r(...r....
0e40	da 0f 73 69 67 6e 61 74 75 72 65 5f 62 79 74 65 73 da 09 73 69 67 6e 61 74 75 72 65 72 19 00 00	..signature_bytes..signaturer...
0e60	00 72 19 00 00 00 72 1a 00 00 00 5a 14 5f 5f 67 65 6e 65 72 61 74 65 5f 73 69 67 6e 61 74 75 72	.r....r....Z.__generate_signatur
0e80	65 82 00 00 00 73 1e 00 00 00 00 04 12 02 14 02 08 01 06 02 04 02 08 01 06 02 04 02 02 01 02 01	e....s..........................
0ea0	02 01 02 01 02 fc 06 07 7a 26 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 67 65	........z&SignatureDatabase.__ge
0ec0	6e 65 72 61 74 65 5f 73 69 67 6e 61 74 75 72 65 54 63 04 00 00 00 00 00 00 00 00 00 00 00 05 00	nerate_signatureTc..............
0ee0	00 00 05 00 00 00 43 00 00 00 73 38 00 00 00 7c 00 a0 00 7c 01 7c 02 7c 03 a1 03 7d 04 7c 04 72	......C...s8...|...|.|.|...}.|.r
0f00	34 7c 02 64 01 6b 02 72 28 64 02 64 03 84 00 7c 04 44 00 83 01 53 00 7c 04 64 04 19 00 64 05 19	4|.d.k.r(d.d...|.D...S.|.d...d..
0f20	00 53 00 64 06 53 00 29 07 61 10 01 00 00 4d 61 74 63 68 65 73 20 61 6e 64 20 72 65 74 75 72 6e	.S.d.S.).a....Matches.and.return
0f40	73 20 74 68 65 20 65 78 61 63 74 20 6d 61 74 63 68 28 65 73 29 2e 0a 0a 20 20 20 20 20 20 20 20	s.the.exact.match(es)...........
0f60	49 66 20 65 70 5f 6f 6e 6c 79 20 69 73 20 54 72 75 65 20 74 68 65 20 72 65 73 75 6c 74 20 77 69	If.ep_only.is.True.the.result.wi
0f80	6c 6c 20 62 65 20 61 20 73 74 72 69 6e 67 20 77 69 74 68 0a 20 20 20 20 20 20 20 20 74 68 65 20	ll.be.a.string.with.........the.
0fa0	70 61 63 6b 65 72 20 6e 61 6d 65 2e 20 4f 74 68 65 72 77 69 73 65 20 69 74 20 77 69 6c 6c 20 62	packer.name..Otherwise.it.will.b
0fc0	65 20 61 20 6c 69 73 74 20 6f 66 20 74 68 65 0a 20 20 20 20 20 20 20 20 66 6f 72 6d 20 28 66 69	e.a.list.of.the.........form.(fi
0fe0	6c 65 5f 6f 66 66 73 65 74 2c 20 70 61 63 6b 65 72 5f 6e 61 6d 65 29 20 73 70 65 63 69 66 79 69	le_offset,.packer_name).specifyi
1000	6e 67 20 77 68 65 72 65 0a 20 20 20 20 20 20 20 20 69 6e 20 74 68 65 20 66 69 6c 65 20 74 68 65	ng.where.........in.the.file.the
1020	20 73 69 67 6e 61 74 75 72 65 20 77 61 73 20 66 6f 75 6e 64 2e 0a 20 20 20 20 20 20 20 20 46 63	.signature.was.found..........Fc
1040	01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 05 00 00 00 53 00 00 00 73 20 00 00 00 67 00 7c	....................S...s....g.|
1060	00 5d 18 7d 01 7c 01 64 00 19 00 7c 01 64 01 19 00 64 02 19 00 66 02 91 02 71 04 53 00 29 03 72	.].}.|.d...|.d...d...f...q.S.).r
1080	01 00 00 00 72 1d 00 00 00 e9 ff ff ff ff 72 19 00 00 00 29 02 72 22 00 00 00 da 05 6d 61 74 63	....r.........r....).r".....matc
10a0	68 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 24 00 00 00 b0 00 00 00 72 25 00 00 00 7a 2b	hr....r....r....r$.......r%...z+
10c0	53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 6d 61 74 63 68 2e 3c 6c 6f 63 61 6c 73 3e	SignatureDatabase.match.<locals>
10e0	2e 3c 6c 69 73 74 63 6f 6d 70 3e 72 1d 00 00 00 72 43 00 00 00 4e a9 01 da 19 5f 53 69 67 6e 61	.<listcomp>r....rC...N...._Signa
1100	74 75 72 65 44 61 74 61 62 61 73 65 5f 5f 6d 61 74 63 68 a9 05 72 18 00 00 00 72 33 00 00 00 72	tureDatabase__match..r....r3...r
1120	26 00 00 00 72 27 00 00 00 da 07 6d 61 74 63 68 65 73 72 19 00 00 00 72 19 00 00 00 72 1a 00 00	&...r'.....matchesr....r....r...
1140	00 72 44 00 00 00 9d 00 00 00 73 0c 00 00 00 00 09 0e 05 04 01 08 04 0e 02 0c 02 7a 17 53 69 67	.rD.......s................z.Sig
1160	6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 6d 61 74 63 68 63 04 00 00 00 00 00 00 00 00 00 00	natureDatabase.matchc...........
1180	00 05 00 00 00 05 00 00 00 43 00 00 00 73 2a 00 00 00 7c 00 a0 00 7c 01 7c 02 7c 03 a1 03 7d 04	.........C...s*...|...|.|.|...}.
11a0	7c 04 72 26 7c 02 64 01 6b 02 72 1e 7c 04 53 00 7c 04 64 02 19 00 53 00 64 03 53 00 29 04 7a 2b	|.r&|.d.k.r.|.S.|.d...S.d.S.).z+
11c0	4d 61 74 63 68 65 73 20 61 6e 64 20 72 65 74 75 72 6e 73 20 61 6c 6c 20 74 68 65 20 6c 69 6b 65	Matches.and.returns.all.the.like
11e0	6c 79 20 6d 61 74 63 68 65 73 2e 46 72 1d 00 00 00 4e 72 45 00 00 00 72 47 00 00 00 72 19 00 00	ly.matches.Fr....NrE...rG...r...
1200	00 72 19 00 00 00 72 1a 00 00 00 da 09 6d 61 74 63 68 5f 61 6c 6c b6 00 00 00 73 0c 00 00 00 00	.r....r......match_all....s.....
1220	03 0e 02 04 01 08 04 04 02 08 02 7a 1b 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 6d	...........z.SignatureDatabase.m
1240	61 74 63 68 5f 61 6c 6c 63 04 00 00 00 00 00 00 00 00 00 00 00 0c 00 00 00 0a 00 00 00 43 00 00	atch_allc....................C..
1260	00 73 12 01 00 00 7c 03 64 01 75 00 72 52 7a 0a 7c 01 6a 00 7d 04 57 00 6e 26 04 00 74 01 79 38	.s....|.d.u.rRz.|.j.}.W.n&..t.y8
1280	01 00 7d 05 01 00 7a 0e 82 00 57 00 59 00 64 00 7d 05 7e 05 6e 0a 64 00 7d 05 7e 05 30 00 30 00	..}...z...W.Y.d.}.~.n.d.}.~.0.0.
12a0	7c 00 6a 02 7d 06 64 02 64 03 84 00 7c 01 6a 03 44 00 83 01 7d 07 6e 6a 7c 02 64 01 75 00 72 a4	|.j.}.d.d...|.j.D...}.nj|.d.u.r.
12c0	7a 0c 7c 01 a0 04 a1 00 7d 04 57 00 6e 26 04 00 74 01 79 8c 01 00 7d 05 01 00 7a 0e 82 00 57 00	z.|.....}.W.n&..t.y...}...z...W.
12e0	59 00 64 00 7d 05 7e 05 6e 0a 64 00 7d 05 7e 05 30 00 30 00 7c 00 6a 05 7d 06 7c 01 6a 06 6a 07	Y.d.}.~.n.d.}.~.0.0.|.j.}.|.j.j.
1300	7d 08 7c 08 67 01 7d 07 6e 18 7c 01 6a 00 7d 04 7c 00 6a 08 7d 06 74 09 74 0a 7c 04 83 01 83 01	}.|.g.}.n.|.j.}.|.j.}.t.t.|.....
1320	7d 07 67 00 7d 09 7c 07 44 00 5d 30 7d 0a 7c 00 a0 0b 7c 06 7c 04 7c 0a 7c 0a 7c 00 6a 0c 17 00	}.g.}.|.D.]0}.|...|.|.|.|.|.j...
1340	85 02 19 00 a1 02 7d 0b 7c 0b 72 c4 7c 09 a0 0d 7c 0a 7c 0b 66 02 a1 01 01 00 71 c4 7c 02 64 01	......}.|.r.|...|.|.f.....q.|.d.
1360	75 00 90 01 72 0e 7c 09 90 01 72 0e 7c 09 64 04 19 00 53 00 7c 09 53 00 29 05 4e 54 63 01 00 00	u...r.|...r.|.d...S.|.S.).NTc...
1380	00 00 00 00 00 00 00 00 00 02 00 00 00 03 00 00 00 53 00 00 00 73 12 00 00 00 67 00 7c 00 5d 0a	.................S...s....g.|.].
13a0	7d 01 7c 01 6a 00 91 02 71 04 53 00 72 19 00 00 00 29 01 72 2d 00 00 00 29 02 72 22 00 00 00 72	}.|.j...q.S.r....).r-...).r"...r
13c0	36 00 00 00 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 24 00 00 00 dc 00 00 00 72 25 00 00	6...r....r....r....r$.......r%..
13e0	00 7a 2d 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 6d 61 74 63 68 2e 3c 6c 6f	.z-SignatureDatabase.__match.<lo
1400	63 61 6c 73 3e 2e 3c 6c 69 73 74 63 6f 6d 70 3e 72 01 00 00 00 29 0e 72 40 00 00 00 da 09 45 78	cals>.<listcomp>r....).r@.....Ex
1420	63 65 70 74 69 6f 6e 72 13 00 00 00 72 2c 00 00 00 5a 17 67 65 74 5f 6d 65 6d 6f 72 79 5f 6d 61	ceptionr....r,...Z.get_memory_ma
1440	70 70 65 64 5f 69 6d 61 67 65 72 0f 00 00 00 72 39 00 00 00 72 3a 00 00 00 72 11 00 00 00 72 04	pped_imager....r9...r:...r....r.
1460	00 00 00 72 2e 00 00 00 da 28 5f 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 5f 5f 6d 61	...r.....(_SignatureDatabase__ma
1480	74 63 68 5f 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 72 15 00 00 00 72 31 00 00 00 29 0c 72 18	tch_signature_treer....r1...).r.
14a0	00 00 00 72 33 00 00 00 72 26 00 00 00 72 27 00 00 00 72 09 00 00 00 da 04 65 78 63 70 da 0a 73	...r3...r&...r'...r......excp..s
14c0	69 67 6e 61 74 75 72 65 73 da 0e 73 63 61 6e 5f 61 64 64 72 65 73 73 65 73 da 02 65 70 72 48 00	ignatures..scan_addresses..eprH.
14e0	00 00 72 35 00 00 00 da 06 72 65 73 75 6c 74 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 5a 07	..r5.....resultr....r....r....Z.
1500	5f 5f 6d 61 74 63 68 c6 00 00 00 73 3a 00 00 00 00 06 08 05 02 01 0a 01 0e 01 18 04 06 04 12 02	__match....s:...................
1520	08 05 02 01 0c 01 0e 01 18 04 06 05 08 04 08 04 06 02 06 02 0c 04 04 01 08 01 04 01 12 ff 04 03	................................
1540	04 01 10 06 0a 01 06 01 08 02 7a 19 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f	..........z.SignatureDatabase.__
1560	6d 61 74 63 68 63 04 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 08 00 00 00 43 00 00 00 73 7a	matchc....................C...sz
1580	00 00 00 7c 01 7d 04 64 01 67 01 7d 05 7c 03 64 02 75 00 72 1a 7c 00 6a 00 7d 06 6e 0e 7c 02 64	...|.}.d.g.}.|.d.u.r.|.j.}.n.|.d
15a0	02 75 00 72 28 7c 00 6a 01 7d 06 67 00 7d 07 7c 05 44 00 5d 30 7d 08 7c 00 a0 02 7c 06 7c 04 7c	.u.r(|.j.}.g.}.|.D.]0}.|...|.|.|
15c0	08 7c 08 7c 00 6a 03 17 00 85 02 19 00 a1 02 7d 09 7c 09 72 30 7c 07 a0 04 7c 08 7c 09 66 02 a1	.|.|.j.........}.|.r0|...|.|.f..
15e0	01 01 00 71 30 7c 02 64 02 75 00 72 76 7c 07 72 76 7c 07 64 01 19 00 53 00 7c 07 53 00 29 03 4e	...q0|.d.u.rv|.rv|.d...S.|.S.).N
1600	72 01 00 00 00 54 29 05 72 13 00 00 00 72 0f 00 00 00 72 4b 00 00 00 72 15 00 00 00 72 31 00 00	r....T).r....r....rK...r....r1..
1620	00 29 0a 72 18 00 00 00 5a 09 63 6f 64 65 5f 64 61 74 61 72 26 00 00 00 72 27 00 00 00 72 09 00	.).r....Z.code_datar&...r'...r..
1640	00 00 72 4e 00 00 00 72 4d 00 00 00 72 48 00 00 00 72 35 00 00 00 72 50 00 00 00 72 19 00 00 00	..rN...rM...rH...r5...rP...r....
1660	72 19 00 00 00 72 1a 00 00 00 da 0a 6d 61 74 63 68 5f 64 61 74 61 11 01 00 00 73 22 00 00 00 00	r....r......match_data....s"....
1680	02 04 01 06 06 08 04 08 05 08 04 06 04 04 01 08 01 04 01 12 ff 04 03 04 01 10 06 08 01 04 01 08	................................
16a0	02 7a 1c 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 6d 61 74 63 68 5f 64 61 74 61 72	.z.SignatureDatabase.match_datar
16c0	01 00 00 00 63 04 00 00 00 00 00 00 00 00 00 00 00 0d 00 00 00 09 00 00 00 43 00 00 00 73 32 01	....c....................C...s2.
16e0	00 00 74 00 83 00 7d 04 7c 01 7d 05 74 01 64 01 64 02 84 00 7c 02 44 00 83 01 83 01 44 00 5d b4	..t...}.|.}.t.d.d...|.D.....D.].
1700	5c 02 7d 06 7d 07 7c 05 64 03 75 00 72 30 01 00 71 d2 7c 05 a0 02 7c 07 64 03 a1 02 7d 08 64 03	\.}.}.|.d.u.r0..q.|...|.d...}.d.
1720	74 00 7c 05 a0 03 a1 00 83 01 76 00 72 88 74 00 83 00 7d 09 74 00 7c 05 a0 04 a1 00 83 01 44 00	t.|.......v.r.t...}.t.|.......D.
1740	5d 1e 7d 0a 7c 0a 64 04 19 00 64 03 75 00 72 5e 7c 09 a0 05 7c 0a 64 05 19 00 a1 01 01 00 71 5e	].}.|.d...d.u.r^|...|.d.......q^
1760	7c 04 a0 05 7c 09 a1 01 01 00 64 06 7c 05 76 00 72 cc 7c 05 a0 02 64 06 64 03 a1 02 7d 0b 7c 02	|...|.....d.|.v.r.|...d.d...}.|.
1780	7c 06 64 04 17 00 64 03 85 02 19 00 7d 0c 7c 0c 72 cc 7c 04 a0 06 7c 00 a0 07 7c 0b 7c 0c 7c 06	|.d...d.....}.|.r.|...|...|.|.|.
17a0	7c 03 17 00 64 04 17 00 a1 03 a1 01 01 00 7c 08 7d 05 71 1c 7c 05 64 03 75 01 90 01 72 2e 64 03	|...d.........|.}.q.|.d.u...r.d.
17c0	74 00 7c 05 a0 03 a1 00 83 01 76 00 90 01 72 2e 74 00 83 00 7d 09 74 00 7c 05 a0 04 a1 00 83 01	t.|.......v...r.t...}.t.|.......
17e0	44 00 5d 22 7d 0a 7c 0a 64 04 19 00 64 03 75 00 90 01 72 00 7c 09 a0 05 7c 0a 64 05 19 00 a1 01	D.]"}.|.d...d.u...r.|...|.d.....
1800	01 00 90 01 71 00 7c 04 a0 05 7c 09 a1 01 01 00 7c 04 53 00 29 07 61 0a 01 00 00 52 65 63 75 72	....q.|...|.....|.S.).a....Recur
1820	73 69 76 65 20 66 75 6e 63 74 69 6f 6e 20 74 6f 20 66 69 6e 64 20 6d 61 74 63 68 65 73 20 61 6c	sive.function.to.find.matches.al
1840	6f 6e 67 20 74 68 65 20 73 69 67 6e 61 74 75 72 65 20 74 72 65 65 2e 0a 0a 20 20 20 20 20 20 20	ong.the.signature.tree..........
1860	20 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 20 20 69 73 20 74 68 65 20 70 61 72 74 20 6f 66 20	.signature_tree..is.the.part.of.
1880	74 68 65 20 74 72 65 65 20 6c 65 66 74 20 74 6f 20 77 61 6c 6b 0a 20 20 20 20 20 20 20 20 64 61	the.tree.left.to.walk.........da
18a0	74 61 20 20 20 20 69 73 20 74 68 65 20 64 61 74 61 20 62 65 69 6e 67 20 63 68 65 63 6b 65 64 20	ta....is.the.data.being.checked.
18c0	61 67 61 69 6e 73 74 20 74 68 65 20 73 69 67 6e 61 74 75 72 65 20 74 72 65 65 0a 20 20 20 20 20	against.the.signature.tree......
18e0	20 20 20 64 65 70 74 68 20 20 20 6b 65 65 70 73 20 74 72 61 63 6b 20 6f 66 20 68 6f 77 20 66 61	...depth...keeps.track.of.how.fa
1900	72 20 77 65 20 68 61 76 65 20 67 6f 6e 65 20 64 6f 77 6e 20 74 68 65 20 74 72 65 65 0a 20 20 20	r.we.have.gone.down.the.tree....
1920	20 20 20 20 20 63 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 05 00 00 00 53 00 00 00 73 22	.....c....................S...s"
1940	00 00 00 67 00 7c 00 5d 1a 7d 01 74 00 7c 01 74 01 83 02 72 16 7c 01 6e 06 74 02 7c 01 83 01 91	...g.|.].}.t.|.t...r.|.n.t.|....
1960	02 71 04 53 00 72 19 00 00 00 29 03 da 0a 69 73 69 6e 73 74 61 6e 63 65 da 03 69 6e 74 72 3d 00	.q.S.r....)...isinstance..intr=.
1980	00 00 a9 02 72 22 00 00 00 da 01 62 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 24 00 00 00	....r".....br....r....r....r$...
19a0	4b 01 00 00 72 25 00 00 00 7a 3c 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 6d	K...r%...z<SignatureDatabase.__m
19c0	61 74 63 68 5f 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 2e 3c 6c 6f 63 61 6c 73 3e 2e 3c 6c 69	atch_signature_tree.<locals>.<li
19e0	73 74 63 6f 6d 70 3e 4e 72 1d 00 00 00 72 01 00 00 00 7a 02 3f 3f 29 08 72 2a 00 00 00 72 2b 00	stcomp>Nr....r....z.??).r*...r+.
1a00	00 00 da 03 67 65 74 da 06 76 61 6c 75 65 73 da 05 69 74 65 6d 73 72 31 00 00 00 da 06 65 78 74	....get..values..itemsr1.....ext
1a20	65 6e 64 72 4b 00 00 00 29 0d 72 18 00 00 00 5a 0e 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 72	endrK...).r....Z.signature_treer
1a40	09 00 00 00 da 05 64 65 70 74 68 5a 0d 6d 61 74 63 68 65 64 5f 6e 61 6d 65 73 72 44 00 00 00 72	......depthZ.matched_namesrD...r
1a60	35 00 00 00 da 04 62 79 74 65 5a 0a 6d 61 74 63 68 5f 6e 65 78 74 da 05 6e 61 6d 65 73 da 04 69	5.....byteZ.match_next..names..i
1a80	74 65 6d 5a 14 6d 61 74 63 68 5f 74 72 65 65 5f 61 6c 74 65 72 6e 61 74 65 5a 0e 64 61 74 61 5f	temZ.match_tree_alternateZ.data_
1aa0	72 65 6d 61 69 6e 69 6e 67 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 5a 16 5f 5f 6d 61 74 63	remainingr....r....r....Z.__matc
1ac0	68 5f 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 3d 01 00 00 73 3a 00 00 00 00 08 06 01 04 05 1a	h_signature_tree=...s:..........
1ae0	04 08 01 04 04 0c 06 10 04 06 06 10 01 0c 01 10 01 0a 05 08 01 0c 01 10 01 04 01 04 01 04 01 0e	................................
1b00	ff 02 ff 04 06 06 05 1c 02 06 01 10 01 0e 01 12 01 0a 02 7a 28 53 69 67 6e 61 74 75 72 65 44 61	...................z(SignatureDa
1b20	74 61 62 61 73 65 2e 5f 5f 6d 61 74 63 68 5f 73 69 67 6e 61 74 75 72 65 5f 74 72 65 65 63 03 00	tabase.__match_signature_treec..
1b40	00 00 00 00 00 00 00 00 00 00 03 00 00 00 04 00 00 00 43 00 00 00 73 12 00 00 00 7c 00 6a 00 7c	..................C...s....|.j.|
1b60	01 7c 02 64 01 8d 02 01 00 64 02 53 00 29 03 7a 6e 4c 6f 61 64 20 61 20 50 45 69 44 20 73 69 67	.|.d.....d.S.).znLoad.a.PEiD.sig
1b80	6e 61 74 75 72 65 20 66 69 6c 65 2e 0a 0a 20 20 20 20 20 20 20 20 49 6e 76 6f 6b 69 6e 67 20 74	nature.file...........Invoking.t
1ba0	68 69 73 20 6d 65 74 68 6f 64 20 6f 6e 20 64 69 66 66 65 72 65 6e 74 20 66 69 6c 65 73 20 63 6f	his.method.on.different.files.co
1bc0	6d 62 69 6e 65 73 20 74 68 65 20 73 69 67 6e 61 74 75 72 65 73 2e 0a 20 20 20 20 20 20 20 20 72	mbines.the.signatures..........r
1be0	07 00 00 00 4e 29 01 72 16 00 00 00 72 17 00 00 00 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00	....N).r....r....r....r....r....
1c00	da 04 6c 6f 61 64 85 01 00 00 73 02 00 00 00 00 06 7a 16 53 69 67 6e 61 74 75 72 65 44 61 74 61	..load....s......z.SignatureData
1c20	62 61 73 65 2e 6c 6f 61 64 63 03 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 08 00 00 00 03 00	base.loadc......................
1c40	00 00 73 e4 01 00 00 7c 01 64 00 75 01 72 82 74 00 6a 01 a0 02 7c 01 a1 01 73 4c 7a 20 74 03 6a	..s....|.d.u.r.t.j...|...sLz.t.j
1c60	04 a0 05 7c 01 a1 01 7d 03 7c 03 a0 06 a1 00 7d 04 7c 03 a0 07 a1 00 01 00 57 00 71 80 04 00 74	...|...}.|.....}.|.......W.q...t
1c80	08 79 48 01 00 01 00 01 00 82 00 59 00 71 80 30 00 71 86 7a 1e 74 09 7c 01 64 01 83 02 7d 03 7c	.yH........Y.q.0.q.z.t.|.d...}.|
1ca0	03 a0 06 a1 00 7d 04 7c 03 a0 07 a1 00 01 00 57 00 71 86 04 00 74 08 79 7e 01 00 01 00 01 00 82	.....}.|.......W.q...t.y~.......
1cc0	00 59 00 71 86 30 00 6e 04 7c 02 7d 04 7c 04 73 8e 64 00 53 00 64 02 64 03 84 00 89 00 7c 00 6a	.Y.q.0.n.|.}.|.s.d.S.d.d.....|.j
1ce0	0a a0 0b 7c 04 a1 01 7d 05 7c 05 44 00 90 01 5d 36 5c 05 7d 06 7d 07 7d 08 7d 09 7d 0a 7c 09 a0	...|...}.|.D...]6\.}.}.}.}.}.|..
1d00	0c a1 00 a0 0d a1 00 7d 09 7c 07 a0 0e 64 04 64 05 a1 02 a0 0c a1 00 7d 07 87 00 66 01 64 06 64	.......}.|...d.d.......}...f.d.d
1d20	07 84 08 7c 07 a0 0f a1 00 44 00 83 01 7d 0b 7c 09 64 08 6b 02 72 f6 64 09 7d 09 6e 04 64 0a 7d	...|.....D...}.|.d.k.r.d.}.n.d.}
1d40	09 7c 0a 64 08 6b 02 90 01 72 0a 64 09 7d 0a 6e 04 64 0a 7d 0a 64 0b 7d 0c 7c 0a 64 09 75 00 90	.|.d.k...r.d.}.n.d.}.d.}.|.d.u..
1d60	01 72 32 7c 00 6a 10 7d 0d 7c 00 04 00 6a 11 64 0c 37 00 02 00 5f 11 6e 34 7c 09 64 09 75 00 90	.r2|.j.}.|...j.d.7..._.n4|.d.u..
1d80	01 72 52 7c 00 6a 12 7d 0d 7c 00 04 00 6a 13 64 0c 37 00 02 00 5f 13 6e 14 7c 00 6a 14 7d 0d 7c	.rR|.j.}.|...j.d.7..._.n.|.j.}.|
1da0	00 04 00 6a 15 64 0c 37 00 02 00 5f 15 74 16 7c 0b 83 01 44 00 5d 5e 5c 02 7d 0e 7d 0f 7c 0e 64	...j.d.7..._.t.|...D.]^\.}.}.|.d
1dc0	0c 17 00 74 17 7c 0b 83 01 6b 02 90 01 72 a8 7c 0d a0 18 7c 0f 74 19 83 00 a1 02 7c 0d 7c 0f 3c	...t.|...k...r.|...|.t.....|.|.<
1de0	00 64 00 7c 0d 7c 0f 19 00 7c 06 3c 00 6e 12 7c 0d a0 18 7c 0f 74 19 83 00 a1 02 7c 0d 7c 0f 3c	.d.|.|...|.<.n.|...|.t.....|.|.<
1e00	00 7c 0d 7c 0f 19 00 7d 0d 7c 0c 64 0c 37 00 7d 0c 90 01 71 6e 7c 0c 7c 00 6a 1a 6b 04 72 a6 7c	.|.|...}.|.d.7.}...qn|.|.j.k.r.|
1e20	0c 7c 00 5f 1a 71 a6 64 00 53 00 29 0d 4e da 02 72 74 63 01 00 00 00 00 00 00 00 00 00 00 00 01	.|._.q.d.S.).N..rtc.............
1e40	00 00 00 03 00 00 00 53 00 00 00 73 16 00 00 00 64 01 7c 00 76 00 72 0c 7c 00 53 00 74 00 7c 00	.......S...s....d.|.v.r.|.S.t.|.
1e60	64 02 83 02 53 00 29 03 4e fa 01 3f e9 10 00 00 00 29 01 72 53 00 00 00 29 01 da 05 76 61 6c 75	d...S.).N..?.....).rS...)...valu
1e80	65 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 da 07 74 6f 5f 62 79 74 65 af 01 00 00 73 06 00	er....r....r......to_byte....s..
1ea0	00 00 00 01 08 01 04 01 7a 29 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 6c 6f	........z)SignatureDatabase.__lo
1ec0	61 64 2e 3c 6c 6f 63 61 6c 73 3e 2e 74 6f 5f 62 79 74 65 7a 02 5c 6e 72 1e 00 00 00 63 01 00 00	ad.<locals>.to_bytez.\nr....c...
1ee0	00 00 00 00 00 00 00 00 00 02 00 00 00 04 00 00 00 13 00 00 00 73 14 00 00 00 67 00 7c 00 5d 0c	.....................s....g.|.].
1f00	7d 01 88 00 7c 01 83 01 91 02 71 04 53 00 72 19 00 00 00 72 19 00 00 00 72 54 00 00 00 a9 01 72	}...|.....q.S.r....r....rT.....r
1f20	63 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 24 00 00 00 c7 01 00 00 72 25 00 00 00 7a 2c 53 69	c...r....r....r$.......r%...z,Si
1f40	67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 6c 6f 61 64 2e 3c 6c 6f 63 61 6c 73 3e 2e	gnatureDatabase.__load.<locals>.
1f60	3c 6c 69 73 74 63 6f 6d 70 3e 72 3e 00 00 00 54 46 72 01 00 00 00 72 1d 00 00 00 29 1b da 02 6f	<listcomp>r>...TFr....r....)...o
1f80	73 da 04 70 61 74 68 da 06 65 78 69 73 74 73 da 06 75 72 6c 6c 69 62 5a 07 72 65 71 75 65 73 74	s..path..exists..urllibZ.request
1fa0	5a 07 75 72 6c 6f 70 65 6e da 04 72 65 61 64 da 05 63 6c 6f 73 65 da 07 49 4f 45 72 72 6f 72 da	Z.urlopen..read..close..IOError.
1fc0	04 6f 70 65 6e 72 0d 00 00 00 da 07 66 69 6e 64 61 6c 6c da 05 73 74 72 69 70 da 05 6c 6f 77 65	.openr......findall..strip..lowe
1fe0	72 da 07 72 65 70 6c 61 63 65 da 05 73 70 6c 69 74 72 13 00 00 00 72 14 00 00 00 72 0f 00 00 00	r..replace..splitr....r....r....
2000	72 10 00 00 00 72 11 00 00 00 72 12 00 00 00 72 2b 00 00 00 72 2e 00 00 00 72 56 00 00 00 72 0e	r....r....r....r+...r....rV...r.
2020	00 00 00 72 15 00 00 00 29 10 72 18 00 00 00 72 08 00 00 00 72 09 00 00 00 5a 05 73 69 67 5f 66	...r....).r....r....r....Z.sig_f
2040	5a 08 73 69 67 5f 64 61 74 61 72 48 00 00 00 5a 0b 70 61 63 6b 65 72 5f 6e 61 6d 65 72 42 00 00	Z.sig_datarH...Z.packer_namerB..
2060	00 5a 15 73 75 70 65 72 66 6c 75 6f 75 73 5f 77 69 6c 64 63 61 72 64 73 72 26 00 00 00 72 27 00	.Z.superfluous_wildcardsr&...r'.
2080	00 00 72 41 00 00 00 72 5a 00 00 00 da 04 74 72 65 65 72 35 00 00 00 72 5b 00 00 00 72 19 00 00	..rA...rZ.....treer5...r[...r...
20a0	00 72 64 00 00 00 72 1a 00 00 00 5a 06 5f 5f 6c 6f 61 64 8d 01 00 00 73 6a 00 00 00 00 02 08 03	.rd...r....Z.__load....sj.......
20c0	0c 01 02 01 0c 01 08 01 0c 01 0c 02 0a 04 02 01 0a 01 08 01 0c 01 0c 02 0a 02 04 05 04 01 04 04	................................
20e0	08 07 0c 0b 02 fa 08 01 02 01 02 01 02 01 02 01 02 03 0c 02 10 02 16 02 08 01 06 02 04 02 0a 01	................................
2100	06 02 04 02 04 02 0a 02 06 01 10 03 0a 01 06 01 10 02 06 01 0e 02 10 02 12 02 12 01 0e 04 12 02	................................
2120	08 01 0c 02 0a 01 7a 18 53 69 67 6e 61 74 75 72 65 44 61 74 61 62 61 73 65 2e 5f 5f 6c 6f 61 64	......z.SignatureDatabase.__load
2140	29 02 4e 4e 29 01 72 1c 00 00 00 29 01 72 1c 00 00 00 29 03 46 46 72 1c 00 00 00 29 02 54 46 29	).NN).r....).r....).FFr....).TF)
2160	02 54 46 29 02 54 46 29 01 72 01 00 00 00 29 02 4e 4e 29 02 4e 4e 29 0f da 08 5f 5f 6e 61 6d 65	.TF).TF).r....).NN).NN)...__name
2180	5f 5f da 0a 5f 5f 6d 6f 64 75 6c 65 5f 5f da 0c 5f 5f 71 75 61 6c 6e 61 6d 65 5f 5f da 07 5f 5f	__..__module__..__qualname__..__
21a0	64 6f 63 5f 5f 72 1b 00 00 00 72 38 00 00 00 72 3b 00 00 00 72 32 00 00 00 72 44 00 00 00 72 49	doc__r....r8...r;...r2...rD...rI
21c0	00 00 00 72 46 00 00 00 72 51 00 00 00 72 4b 00 00 00 72 5e 00 00 00 72 16 00 00 00 72 19 00 00	...rF...rQ...rK...r^...r....r...
21e0	00 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 72 06 00 00 00 1b 00 00 00 73 1a 00 00 00 08 01	.r....r....r....r........s......
2200	04 11 0a 22 0a 26 0a 0e 00 ff 0a 1b 0a 19 0a 10 08 4b 0a 2c 0a 48 0a 08 72 06 00 00 00 63 01 00	...".&...........K.,.H..r....c..
2220	00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 43 00 00 00 73 04 00 00 00 64 01 53 00 29	..................C...s....d.S.)
2240	02 72 1e 00 00 00 4e 72 19 00 00 00 29 01 72 33 00 00 00 72 19 00 00 00 72 19 00 00 00 72 1a 00	.r....Nr....).r3...r....r....r..
2260	00 00 da 08 69 73 5f 76 61 6c 69 64 f4 01 00 00 73 02 00 00 00 00 02 72 77 00 00 00 63 01 00 00	....is_valid....s......rw...c...
2280	00 00 00 00 00 00 00 00 00 08 00 00 00 05 00 00 00 43 00 00 00 73 a2 00 00 00 64 01 7d 01 64 02	.................C...s....d.}.d.
22a0	7d 02 74 00 7c 00 64 03 83 02 72 8a 7c 00 6a 01 44 00 5d 70 7d 03 64 04 7d 04 7c 03 6a 02 44 00	}.t.|.d...r.|.j.D.]p}.d.}.|.j.D.
22c0	5d 60 7d 05 7c 05 6a 03 7c 00 6a 04 6a 05 04 00 03 00 6b 01 72 4a 7c 05 6a 03 64 05 17 00 6b 01	]`}.|.j.|.j.j.....k.rJ|.j.d...k.
22e0	72 52 6e 04 01 00 6e 04 64 06 7d 01 7c 04 64 04 75 01 72 80 7c 04 7c 05 6a 03 04 00 03 00 6b 01	rRn...n.d.}.|.d.u.r.|.|.j.....k.
2300	72 74 7c 04 64 05 17 00 6b 01 72 80 6e 04 01 00 6e 08 7c 02 64 07 37 00 7d 02 7c 05 6a 03 7d 04	rt|.d...k.r.n...n.|.d.7.}.|.j.}.
2320	71 26 71 18 64 01 7d 06 7c 00 a0 06 a1 00 7d 07 7c 07 72 9e 7c 06 01 00 64 04 53 00 29 08 7a 70	q&q.d.}.|.....}.|.r.|...d.S.).zp
2340	0a 20 20 20 20 75 6e 75 73 75 61 6c 20 6c 6f 63 61 74 69 6f 6e 73 20 6f 66 20 69 6d 70 6f 72 74	.....unusual.locations.of.import
2360	20 74 61 62 6c 65 73 0a 20 20 20 20 6e 6f 6e 20 72 65 63 6f 67 6e 69 7a 65 64 20 73 65 63 74 69	.tables.....non.recognized.secti
2380	6f 6e 20 6e 61 6d 65 73 0a 20 20 20 20 70 72 65 73 65 6e 63 65 20 6f 66 20 6c 6f 6e 67 20 41 53	on.names.....presence.of.long.AS
23a0	43 49 49 20 73 74 72 69 6e 67 73 0a 20 20 20 20 46 72 01 00 00 00 da 19 44 49 52 45 43 54 4f 52	CII.strings.....Fr......DIRECTOR
23c0	59 5f 45 4e 54 52 59 5f 42 41 53 45 52 45 4c 4f 43 4e e9 04 00 00 00 54 72 1d 00 00 00 29 07 da	Y_ENTRY_BASERELOCN.....Tr....)..
23e0	07 68 61 73 61 74 74 72 72 78 00 00 00 da 07 65 6e 74 72 69 65 73 5a 03 72 76 61 72 39 00 00 00	.hasattrrx.....entriesZ.rvar9...
2400	72 3a 00 00 00 5a 0c 67 65 74 5f 77 61 72 6e 69 6e 67 73 29 08 72 33 00 00 00 5a 1f 72 65 6c 6f	r:...Z.get_warnings).r3...Z.relo
2420	63 61 74 69 6f 6e 73 5f 6f 76 65 72 6c 61 70 5f 65 6e 74 72 79 5f 70 6f 69 6e 74 5a 11 73 65 71	cations_overlap_entry_pointZ.seq
2440	75 65 6e 74 69 61 6c 5f 72 65 6c 6f 63 73 5a 0a 62 61 73 65 5f 72 65 6c 6f 63 5a 0e 6c 61 73 74	uential_relocsZ.base_relocZ.last
2460	5f 72 65 6c 6f 63 5f 72 76 61 5a 05 72 65 6c 6f 63 5a 16 77 61 72 6e 69 6e 67 73 5f 77 68 69 6c	_reloc_rvaZ.relocZ.warnings_whil
2480	65 5f 70 61 72 73 69 6e 67 da 08 77 61 72 6e 69 6e 67 73 72 19 00 00 00 72 19 00 00 00 72 1a 00	e_parsing..warningsr....r....r..
24a0	00 00 da 0d 69 73 5f 73 75 73 70 69 63 69 6f 75 73 f9 01 00 00 73 2a 00 00 00 00 07 04 01 04 06	....is_suspicious....s*.........
24c0	0a 01 0a 01 04 01 0a 01 24 01 04 03 06 ff 02 02 06 fe 08 02 06 fe 0a 04 08 02 0a 07 04 07 08 01	........$.......................
24e0	04 01 04 08 72 7d 00 00 00 63 01 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 00 00 00 43 00	....r}...c....................C.
2500	00 00 73 64 00 00 00 74 00 7c 00 a0 01 a1 00 83 01 7d 01 7c 01 73 14 64 01 53 00 64 02 7d 02 64	..sd...t.|.......}.|.s.d.S.d.}.d
2520	03 7d 03 7c 00 6a 02 44 00 5d 28 7d 04 7c 04 a0 03 a1 00 7d 05 74 00 7c 04 a0 04 a1 00 83 01 7d	.}.|.j.D.](}.|.....}.t.|.......}
2540	06 7c 05 64 04 6b 04 72 22 7c 03 7c 06 37 00 7d 03 71 22 64 05 7c 03 14 00 7c 01 1b 00 64 06 6b	.|.d.k.r"|.|.7.}.q"d.|...|...d.k
2560	04 72 60 64 01 7d 02 7c 02 53 00 29 07 61 38 01 00 00 52 65 74 75 72 6e 73 20 54 72 75 65 20 69	.r`d.}.|.S.).a8...Returns.True.i
2580	73 20 74 68 65 72 65 20 69 73 20 61 20 68 69 67 68 20 6c 69 6b 65 6c 69 68 6f 6f 64 20 74 68 61	s.there.is.a.high.likelihood.tha
25a0	74 20 61 20 66 69 6c 65 20 69 73 20 70 61 63 6b 65 64 20 6f 72 20 63 6f 6e 74 61 69 6e 73 20 63	t.a.file.is.packed.or.contains.c
25c0	6f 6d 70 72 65 73 73 65 64 20 64 61 74 61 2e 0a 0a 20 20 20 20 54 68 65 20 73 65 63 74 69 6f 6e	ompressed.data.......The.section
25e0	73 20 6f 66 20 74 68 65 20 50 45 20 66 69 6c 65 20 77 69 6c 6c 20 62 65 20 61 6e 61 6c 79 7a 65	s.of.the.PE.file.will.be.analyze
2600	64 2c 20 69 66 20 65 6e 6f 75 67 68 20 73 65 63 74 69 6f 6e 73 0a 20 20 20 20 6c 6f 6f 6b 20 6c	d,.if.enough.sections.....look.l
2620	69 6b 65 20 63 6f 6e 74 61 69 6e 69 6e 67 20 63 6f 6d 70 72 65 73 73 65 64 20 64 61 74 61 20 61	ike.containing.compressed.data.a
2640	6e 64 20 74 68 65 20 64 61 74 61 20 6d 61 6b 65 73 0a 20 20 20 20 75 70 20 66 6f 72 20 6d 6f 72	nd.the.data.makes.....up.for.mor
2660	65 20 74 68 61 6e 20 32 30 25 20 6f 66 20 74 68 65 20 74 6f 74 61 6c 20 66 69 6c 65 20 73 69 7a	e.than.20%.of.the.total.file.siz
2680	65 2c 20 74 68 65 20 66 75 6e 63 74 69 6f 6e 20 77 69 6c 6c 0a 20 20 20 20 72 65 74 75 72 6e 20	e,.the.function.will.....return.
26a0	54 72 75 65 2e 0a 20 20 20 20 54 46 72 01 00 00 00 67 9a 99 99 99 99 99 1d 40 67 00 00 00 00 00	True......TFr....g.......@g.....
26c0	00 f0 3f 67 9a 99 99 99 99 99 c9 3f 29 05 72 2e 00 00 00 5a 04 74 72 69 6d 72 2c 00 00 00 5a 0b	..?g.......?).r....Z.trimr,...Z.
26e0	67 65 74 5f 65 6e 74 72 6f 70 79 da 08 67 65 74 5f 64 61 74 61 29 07 72 33 00 00 00 5a 14 74 6f	get_entropy..get_data).r3...Z.to
2700	74 61 6c 5f 70 65 5f 64 61 74 61 5f 6c 65 6e 67 74 68 5a 29 68 61 73 5f 73 69 67 6e 69 66 69 63	tal_pe_data_lengthZ)has_signific
2720	61 6e 74 5f 61 6d 6f 75 6e 74 5f 6f 66 5f 63 6f 6d 70 72 65 73 73 65 64 5f 64 61 74 61 5a 15 74	ant_amount_of_compressed_dataZ.t
2740	6f 74 61 6c 5f 63 6f 6d 70 72 65 73 73 65 64 5f 64 61 74 61 72 36 00 00 00 5a 09 73 5f 65 6e 74	otal_compressed_datar6...Z.s_ent
2760	72 6f 70 79 5a 08 73 5f 6c 65 6e 67 74 68 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 da 12 69	ropyZ.s_lengthr....r....r......i
2780	73 5f 70 72 6f 62 61 62 6c 79 5f 70 61 63 6b 65 64 2f 02 00 00 73 1a 00 00 00 00 0c 0c 02 04 01	s_probably_packed/...s..........
27a0	04 01 04 05 04 01 0a 01 08 01 0c 03 08 01 0a 02 10 01 04 02 72 7f 00 00 00 29 18 72 76 00 00 00	....................r....).rv...
27c0	da 0a 5f 5f 66 75 74 75 72 65 5f 5f 72 02 00 00 00 da 06 66 75 74 75 72 65 72 03 00 00 00 5a 0f	..__future__r......futurer....Z.
27e0	69 6e 73 74 61 6c 6c 5f 61 6c 69 61 73 65 73 da 08 62 75 69 6c 74 69 6e 73 72 04 00 00 00 72 05	install_aliases..builtinsr....r.
2800	00 00 00 72 65 00 00 00 72 0a 00 00 00 72 1f 00 00 00 5a 0e 75 72 6c 6c 69 62 2e 72 65 71 75 65	...re...r....r....Z.urllib.reque
2820	73 74 72 68 00 00 00 da 0c 75 72 6c 6c 69 62 2e 70 61 72 73 65 5a 0c 75 72 6c 6c 69 62 2e 65 72	strh.....urllib.parseZ.urllib.er
2840	72 6f 72 da 06 70 65 66 69 6c 65 da 0a 5f 5f 61 75 74 68 6f 72 5f 5f da 0b 5f 5f 76 65 72 73 69	ror..pefile..__author__..__versi
2860	6f 6e 5f 5f da 0b 5f 5f 63 6f 6e 74 61 63 74 5f 5f 72 06 00 00 00 72 77 00 00 00 72 7d 00 00 00	on__..__contact__r....rw...r}...
2880	72 7f 00 00 00 72 19 00 00 00 72 19 00 00 00 72 19 00 00 00 72 1a 00 00 00 da 08 3c 6d 6f 64 75	r....r....r....r....r......<modu
28a0	6c 65 3e 02 00 00 00 73 28 00 00 00 04 07 0c 01 0c 02 08 01 0c 01 0c 02 08 01 08 01 08 01 18 01	le>....s(.......................
28c0	08 02 04 01 06 01 04 03 10 7f 00 7f 00 7f 00 5c 08 05 08 36	...............\...6