From 3f3ab535ad0f64c6d4644beab88fdd9cd45cc8b2 Mon Sep 17 00:00:00 2001
From: sztkp
Date: Sun, 26 Jan 2020 22:56:32 +0100
Subject: [PATCH] ilm0 - second submission deadline + updated readme
---
writeups/ilm0/hxp36c3.md | 548 ++++++++++++++++++
.../hxp2019__check__h578f31d490e10a31.c | 317 ++++++++++
writeups/ilm0/hxp36c3/page.png | Bin 0 -> 720271 bytes
writeups/ilm0/hxp36c3/page2.png | Bin 0 -> 14515 bytes
writeups/ilm0/readme.md | 13 +-
5 files changed, 876 insertions(+), 2 deletions(-)
create mode 100644 writeups/ilm0/hxp36c3.md
create mode 100644 writeups/ilm0/hxp36c3/hxp2019__check__h578f31d490e10a31.c
create mode 100644 writeups/ilm0/hxp36c3/page.png
create mode 100644 writeups/ilm0/hxp36c3/page2.png
diff --git a/writeups/ilm0/hxp36c3.md b/writeups/ilm0/hxp36c3.md
new file mode 100644
index 0000000..20ac255
--- /dev/null
+++ b/writeups/ilm0/hxp36c3.md
@@ -0,0 +1,548 @@
+# hxp 36C3 CTF
+
+## xmas_future
+
+**category**: rev, (web)
+
+**description**:
+
+Most people just give you a present for christmas, hxp gives you a glorious future.
+
+If youâre confused, simply extract the flag from this å±±èµ and you shall understand. :)
+
+___
+
+### Recon
+
+As previous experience shows, it is always best to read the description very carefully and look for clues! Of course, the Asian characters stand out: Google Translate quickly tells us that they mean "wasabi" (in Japanese), the Japanese hot sauce/paste. If we search for "wasabi web framework" on Google, the first site is a Kotlin based HTTP framework [https://github.com/wasabifx/wasabi], for now that does not seem particularly interesting or valuable. On the other hand, the second page takes us to [https://github.com/danleh/wasabi], an analysis framework for the inspection of WebAssembly files. This sounds more relevant as we are in fact given a .wasm file. More on this later.
+
+We are given the skeleton of a php web server. Among others we are presented with:
+
+- a JavaScript
+
+- a WebAssembly file
+
+- and a html file.
+
+With the provided shell script (run.sh) we are quickly up and running our PHP based web server.
+
+![page.png](hxp36c3/page.png)
+
+We have a funky Matrix inspired flag checker tool. As the page advertises, it is supposed to be running Rust and WebAssembly. Let's check the underlying structure and how all this comes together!
+
+The interesting part of the HTML source looks like this:
+
+```html
+
+
+
High-speed flag checking
+
Powered by Rust and WASM
+
+
+
+
+
+
+```
+
+We see that there's a button submitting information that is checked by an other JavaScript function defined in the file `hxp2019.js` (reformatted for easier reading):
+
+```javascript
+let wasm;
+
+let WASM_VECTOR_LEN = 0;
+
+let cachegetUint8Memory0 = null;
+function getUint8Memory0()
+{
+ if (cachegetUint8Memory0 === null || cachegetUint8Memory0.buffer !== wasm.memory.buffer)
+ {
+ cachegetUint8Memory0 = new Uint8Array(wasm.memory.buffer);
+ }
+
+ return cachegetUint8Memory0;
+}
+
+let cachedTextEncoder = new TextEncoder('utf-8');
+
+const encodeString = (typeof cachedTextEncoder.encodeInto === 'function'
+ ? function (arg, view)
+{
+ return cachedTextEncoder.encodeInto(arg, view);
+}
+: function (arg, view)
+{
+ const buf = cachedTextEncoder.encode(arg);
+ view.set(buf);
+ return {
+ read: arg.length,
+ written: buf.length
+};
+});
+
+function passStringToWasm0(arg, malloc, realloc)
+{
+
+if (realloc === undefined)
+{
+ const buf = cachedTextEncoder.encode(arg);
+ const ptr = malloc(buf.length);
+ getUint8Memory0().subarray(ptr, ptr + buf.length).set(buf);
+ WASM_VECTOR_LEN = buf.length;
+ return ptr;
+}
+
+let len = arg.length;
+let ptr = malloc(len);
+
+const mem = getUint8Memory0();
+
+let offset = 0;
+
+for (; offset < len; offset++)
+{
+ const code = arg.charCodeAt(offset);
+ if (code > 0x7F) break;
+ mem[ptr + offset] = code;
+}
+
+if (offset !== len)
+{
+ if (offset !== 0)
+ {
+ arg = arg.slice(offset);
+ }
+ ptr = realloc(ptr, len, len = offset + arg.length * 3);
+ const view = getUint8Memory0().subarray(ptr + offset, ptr + len);
+ const ret = encodeString(arg, view);
+
+ offset += ret.written;
+}
+
+WASM_VECTOR_LEN = offset;
+return ptr;
+
+}
+/**
+
+* @param {string} pwd
+* @returns {bool}
+ */
+export function check(pwd)
+{
+ var ptr0 = passStringToWasm0(pwd, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+ var len0 = WASM_VECTOR_LEN;
+ var ret = wasm.check(ptr0, len0);
+ return ret !== 0;
+}
+
+function init(module)
+{
+ if (typeof module === 'undefined')
+ {
+ module = import.meta.url.replace(/\.js$/, '_bg.wasm');
+ }
+ let result;
+ const imports = {};
+
+if ((typeof URL === 'function' && module instanceof URL) || typeof module === 'string' || (typeof Request === 'function' && module instanceof Request))
+{
+
+ const response = fetch(module);
+ if (typeof WebAssembly.instantiateStreaming === 'function') {
+ result = WebAssembly.instantiateStreaming(response, imports)
+ .catch(e => {
+ return response
+ .then(r => {
+ if (r.headers.get('Content-Type') != 'application/wasm') {
+ console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);
+ return r.arrayBuffer();
+ } else {
+ throw e;
+ }
+ })
+ .then(bytes => WebAssembly.instantiate(bytes, imports));
+ });
+ } else
+ {
+ result = response
+ .then(r => r.arrayBuffer())
+ .then(bytes => WebAssembly.instantiate(bytes, imports));
+ }
+} else
+{
+
+ result = WebAssembly.instantiate(module, imports)
+ .then(result => {
+ if (result instanceof WebAssembly.Instance) {
+ return { instance: result, module };
+ } else {
+ return result;
+ }
+ });
+}
+return result.then(({instance, module}) => {
+ wasm = instance.exports;
+ init.__wbindgen_wasm_module = module;
+
+ return wasm;
+});
+
+}
+
+export default init;
+```
+
+If we take a closer look at the definition of the function "check", we see that it passes a string to the function "passStringToWasm0", then it passes this processed string to the .wasm binary. The string-processing function takes a string and copies it to a prepared area of memory. Probably this area is used for communication between the binary and the JavaScript function.
+
+Let's take a look at the binary with our new tool! I set up wasabi and completed all the steps on their website, but as to how to actually use their software, I found no description. After trying around for a few hours and finally giving up, I moved on to wabt[https://github.com/WebAssembly/wabt].
+
+I managed to disassemble the .wasm file with the wabt module wasm2c. It returned me a very strange looking 6000 lines long C-file and a short but unusual header file. After some searching around I have found the definition of the check function called by the JavaScript file:
+
+```c
+static u32 check(u32 p0, u32 p1) {
+ u32 l2 = 0, l3 = 0;
+ FUNC_PROLOGUE;
+ u32 i0, i1, i2, i3;
+ i0 = g0;
+ i1 = 32u;
+ i0 -= i1;
+ l2 = i0;
+ g0 = i0;
+ i0 = l2;
+ i1 = 16u;
+ i0 += i1;
+ i1 = p0;
+ i2 = p1;
+ i3 = p1;
+ alloc__vec__Vec_T___from_raw_parts__h6aeafb6342a4f3ed(i0, i1, i2, i3);
+ i0 = l2;
+ i1 = 8u;
+ i0 += i1;
+ i1 = l2;
+ i2 = 16u;
+ i1 += i2;
+ alloc__vec__Vec_T___into_boxed_slice__h0afc7190c9c73a6d(i0, i1);
+ i0 = l2;
+ i0 = i32_load((&memory), (u64)(i0 + 8));
+ l3 = i0;
+ i1 = l2;
+ i1 = i32_load((&memory), (u64)(i1 + 12));
+ p1 = i1;
+ i0 = hxp2019__check__h578f31d490e10a31(i0, i1);
+ p0 = i0;
+ i0 = p1;
+ i0 = !(i0);
+ if (i0) {goto B0;}
+ i0 = l3;
+ i1 = p1;
+ i2 = 1u;
+ __rust_dealloc(i0, i1, i2);
+ B0:;
+ i0 = l2;
+ i1 = 32u;
+ i0 += i1;
+ g0 = i0;
+ i0 = p0;
+ FUNC_EPILOGUE;
+ return i0;
+}
+```
+
+I was not able to guess what the code does exactly, but there is a suspicious looking function being called: `hxp2019__check__h578f31d490e10a31`. It's definition is similarly fuzzy, I did not include it due to its size 300+ lines. It can be found in the folder hxp36c3 under the filename: `hxp2019__check__h578f31d490e10a31.c`.
+
+### Technical details
+
+WebAssembly was a new technology for me:
+
+> WebAssembly is a new type of code that can be run in modern web browsers and provides new features and major gains in performance. It is not primarily intended to be written by hand, rather it is designed to be an effective compilation target for low-level source languages like C, C++, Rust, etc.
+
+[https://developer.mozilla.org/en-US/docs/WebAssembly/Concepts]
+
+So it is a binary, that either resides server- or client-side, and provides "near native speed" functionality to JavaScript applications. After some research on the security implications of WebAssembly, I have found the following potential issues:
+
+The sandboxed environment it runs in has complete control over what the binary can access.
+
+> There currently is no way to do integrity checking on Wasm applications. This means that there is no process for verifying that a Wasm application has not been tampered with.
+
+[https://www.forcepoint.com/blog/x-labs/webassembly-potentials-and-pitfalls]
+
+The lack of integrity checking could open up a lot of ways for various MITM attacks.
+
+### Lessons (to be) learned
+
+- Tools for unconventional SQL injection
+
+## bacon
+
+**category**: crypto
+
+**description**:
+
+Please hack.
+
+___
+
+### Recon
+
+We get a netcat service, we connect to it, we are presented with a 12 character hex value. After it, we have approximately 2 minutes to provide the correct "answer".
+
+We are also presented with python file that :
+
+**vuln.py**:
+
+```python
+import os, signal
+
+def Speck(key, blk):
+ assert tuple(map(len, (key, blk))) == (9,6)
+ S = lambda j,v: (v << j | (v&0xffffff) >> 24-j)
+ ws = blk[:3],blk[3:], key[:3],key[3:6],key[6:]
+ x,y, l1,l0,k0 = (int.from_bytes(w,'big') for w in ws)
+ l, k = [l0,l1], [k0]
+ for i in range(21):
+ l.append(S(16,l[i]) + k[i] ^ i)
+ k.append(S( 3,k[i]) ^ l[-1])
+ for i in range(22):
+ x = S(16,x) + y ^ k[i]
+ y = S( 3,y) ^ x
+ x,y = (z&0xffffff for z in (x,y))
+ return b''.join(z.to_bytes(3,'big') for z in (x,y))
+
+# did I implement this correctly?
+assert Speck(*map(bytes.fromhex, ('1211100a0908020100', '20796c6c6172'))) == b'\xc0\x49\xa5\x38\x5a\xdc'
+
+def H(m):
+ s = bytes(6)
+ v = m + bytes(-len(m) % 9) + len(m).to_bytes(9,'big')
+ for i in range(0,len(v),9):
+ s = Speck(v[i:i+9], s)
+ return s
+
+
+signal.alarm(100)
+
+h = os.urandom(6)
+print(h.hex())
+
+s = bytes.fromhex(input())
+if H(s) == h:
+ print('The flag is: {}'.format(open('flag.txt').read().strip()))
+else:
+ print('Nope.')
+```
+
+We recognize some kind of unusual encryption scheme, which is unidirectional, only the way of encryption is provided to us. The main function used for encryption is called "Speck", which is equivalent of bacon in German. This seems interesting! After some googling around we find the Speck cipher (see TD).
+
+```python
+def Speck(key, blk):
+ assert tuple(map(len, (key, blk))) == (9,6)
+ S = lambda j,v: (v << j | (v&0xffffff) >> 24-j)
+ ws = blk[:3],blk[3:], key[:3],key[3:6],key[6:]
+ x,y, l1,l0,k0 = (int.from_bytes(w,'big') for w in ws)
+ l, k = [l0,l1], [k0]
+ for i in range(21):
+ l.append(S(16,l[i]) + k[i] ^ i)
+ k.append(S( 3,k[i]) ^ l[-1])
+ for i in range(22):
+ x = S(16,x) + y ^ k[i]
+ y = S( 3,y) ^ x
+ x,y = (z&0xffffff for z in (x,y))
+ return b''.join(z.to_bytes(3,'big') for z in (x,y))
+```
+
+Here is a variant that's a bit easier to read, let's compare!
+[https://en.wikipedia.org/wiki/Speck_(cipher)]:
+
+```c++
+#define ROR(x, r) ((x >> r) | (x << (64 - r)))
+#define ROL(x, r) ((x << r) | (x >> (64 - r)))
+#define R(x, y, k) (x = ROR(x, 8), x += y, x ^= k, y = ROL(y, 3), y ^= x)
+#define ROUNDS 32
+
+void encrypt(uint64_t ct[2],
+ uint64_t const pt[2],
+ uint64_t const K[2])
+{
+ uint64_t y = pt[0], x = pt[1], b = K[0], a = K[1];
+
+ R(x, y, b);
+ for (int i = 0; i < ROUNDS - 1; i++) {
+ R(a, b, i);
+ R(x, y, b);
+ }
+
+ ct[0] = y;
+ ct[1] = x;
+}
+```
+
+The first thing that stands out, is the fixed number of rounds in our variant. 22 rounds mean that our key size is 64 or 72 bits. This in turn means that our block size is 32 or 48 bits.
+
+The assignment `s = bytes(6)` from the function "H" reveals us that we have to do with the variant where the block size is 48 bits.
+
+`assert tuple(map(len, (key, blk))) == (9,6)` This assertion makes sure that we are using the correct key and block sizes.
+
+The main loop seems to behave according to the cipher specification and the cor of the example C code:
+
+```python
+for i in range(22):
+ x = S(16,x) + y ^ k[i]
+ y = S( 3,y) ^ x
+```
+
+The key is XORed into the left word (y) then the left word is XORed into the right word (x).
+
+I have felt here, that my cryptanalysis skills are not yet sufficient enough, so I looked at the other function, maybe I can find some way to brute force Speck.
+
+```python
+def H(m):
+ s = bytes(6)
+ v = m + bytes(-len(m) % 9) + len(m).to_bytes(9,'big')
+ for i in range(0,len(v),9):
+ s = Speck(v[i:i+9], s)
+ return s
+```
+
+Here I made the revelation that our Speck function is actually only one "step" of the calculation! Speck is a block cipher:
+
+```python
+for i in range(0,len(v),9):
+ s = Speck(v[i:i+9], s)
+```
+
+this loop goes through the message block-by-block. So actually `H` is an implementation of the complete 72/48 Speck encryption scheme. Now we know what precisely the code does, we can try to brute force it!
+
+After some trying around, I realised that there is no chance, that consumer-grade hardware is able to brute-force this encryption under 2 minutes, not even 2 hours.
+
+### Technical details
+
+> Speck is a family of lightweight block ciphers publicly released by the National Security Agency (NSA) in June 2013. [...] a cipher that would operate well on a diverse collection of Internet of Things devices while maintaining an acceptable level of security.
+
+[https://en.wikipedia.org/wiki/Speck_(cipher)]
+
+I think the effectiveness of the cipher comes from the fact that is uses lower key and block sizes when compared to other ciphers, such as AES.
+
+> As of 2018, no successful attack on full-round Speck of any variant is known. [...] they [the NSA] found differential attacks to be the limiting attacks, i.e. the type of attack that makes it through the most rounds; they then set the number of rounds to leave a security margin similar to AES-128's at approximately 30%.
+
+[https://en.wikipedia.org/wiki/Speck_(cipher)]
+
+So, according to the NSA, the Speck cipher is as resilient against differential attacks as AES-128.
+
+### Lessons (to be) learned
+
+- Applied cryptanalysis?
+- Brute forcing through the use of clusters?
+
+# file_magician
+
+**category**: web
+
+**description**:
+
+Finally (again), a minimalistic, open-source file hosting solution.
+
+___
+
+### Recon
+
+We get a dockerfile, with which we try to set up as a webserver. No matter how we try, the build command returns an error because the file `flag.txt` is (understandably) not found. After some trying around and understanding the problem, I was able to start the container just by creating the mentioned file in the directory.
+
+The service provided is a barebones website where we can upload small files, I have noticed (initially) that files over 500kB get rejected. The accepted files are then assigned links with their serial number. The file type is also displayed.
+
+![page2.png](hxp36c3/page2.png)
+
+We grab the webserver banner with `nmap`:
+
+```
+8000/tcp open http nginx 1.14.2
+|_http-server-header: nginx/1.14.2
+```
+
+We have an nginx server running!
+
+In the provided files, apart from the Dockerfile we have a .php index file too,
+**index.php**:
+
+```php
+setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+$db->exec('CREATE TABLE IF NOT EXISTS upload(id INTEGER PRIMARY KEY, info TEXT);');
+
+if (isset($_FILES['file']) && $_FILES['file']['size'] < 10*1024 ){
+ $s = "INSERT INTO upload(info) VALUES ('" .(new finfo)->file($_FILES['file']['tmp_name']). " ');";
+ $db->exec($s);
+ move_uploaded_file( $_FILES['file']['tmp_name'], $d . $db->lastInsertId()) || die('move_upload_file');
+}
+
+$uploads = [];
+$sql = 'SELECT * FROM upload';
+foreach ($db->query($sql) as $row) {
+ $uploads[] = [$row['id'], $row['info']];
+}
+?>
+```
+
+The server is assigning a unique PHP session variable to each user, files are identified by being placed in a folder with the respective session id. The server uses a sqlite3 database and the connection is handled by the PHP engine. We also discover, that the file size limit is not 500kB but only 10kB! `$_FILES['file']['size'] < 10*1024`
+
+The queries used seem pretty basic, for now, I do not see any countermeasures against sql-injection. This command seems especially vulnerable:
+
+```php
+"INSERT INTO upload(info) VALUES ('" .(new finfo)->file($_FILES['file']['tmp_name']). " ');"
+```
+
+After some reading around online, it turns out, file upload vulnerabilities are not performed through the filename(what I would have expected), but through image metadata. The sanitization of said metadata makes this possible.
+
+Apparently, traditional tools, like `sqlmap` are not capable of such attacks.
+
+Unfortunately, I could not find any tools online, which are able to perform an sql injection attack from such an unusual attack vector.
+
+### Technical details
+
+I have found an explanation for the vulnerability, it is an RCE:
+
+> I discovered a technique to hide php code in the EXIF data of the image file. When the image is loaded by the page, the php tags located in the headers are interpreted as php code and run by the server.
+
+[https://spencerdodd.github.io/2017/03/05/dvwa_file_upload/]
+
+When PHP handles images, it is possible to escape processing from inside EXIF headers and run instructions. The vulnerability lies in the fact, that PHP tags are recognized in areas where it should not be possible, such as image metadata.
+
+### Lessons (to be) learned
+
+- SQL injection is not only possible through GET and POST parameters
+- The use of more advanced SQL injection tools
\ No newline at end of file
diff --git a/writeups/ilm0/hxp36c3/hxp2019__check__h578f31d490e10a31.c b/writeups/ilm0/hxp36c3/hxp2019__check__h578f31d490e10a31.c
new file mode 100644
index 0000000..b0af4e6
--- /dev/null
+++ b/writeups/ilm0/hxp36c3/hxp2019__check__h578f31d490e10a31.c
@@ -0,0 +1,317 @@
+static u32 hxp2019__check__h578f31d490e10a31(u32 p0, u32 p1) {
+ u32 l2 = 0, l3 = 0, l4 = 0, l5 = 0, l6 = 0, l7 = 0, l8 = 0, l9 = 0,
+ l10 = 0;
+ FUNC_PROLOGUE;
+ u32 i0, i1, i2;
+ i0 = g0;
+ i1 = 32u;
+ i0 -= i1;
+ l2 = i0;
+ g0 = i0;
+ i0 = 0u;
+ l3 = i0;
+ i0 = p1;
+ i1 = 50u;
+ i0 = i0 != i1;
+ if (i0) {goto B0;}
+ i0 = l2;
+ i1 = 50u;
+ i32_store((&memory), (u64)(i0 + 4), i1);
+ i0 = l2;
+ i1 = p0;
+ i32_store((&memory), (u64)(i0), i1);
+ i0 = l2;
+ i1 = 0u;
+ i32_store((&memory), (u64)(i0 + 8), i1);
+ i0 = l2;
+ i1 = 4u;
+ i32_store((&memory), (u64)(i0 + 12), i1);
+ i0 = p0;
+ i0 = i32_load8_s((&memory), (u64)(i0 + 4));
+ i1 = 4294967231u;
+ i0 = (u32)((s32)i0 <= (s32)i1);
+ if (i0) {goto B2;}
+ i0 = p0;
+ i1 = 1049664u;
+ i0 = i0 == i1;
+ if (i0) {goto B1;}
+ i0 = 0u;
+ l3 = i0;
+ i0 = p0;
+ i0 = i32_load((&memory), (u64)(i0));
+ i1 = 2070968424u;
+ i0 = i0 == i1;
+ if (i0) {goto B1;}
+ goto B0;
+ B2:;
+ i0 = l2;
+ i1 = l2;
+ i2 = 12u;
+ i1 += i2;
+ i32_store((&memory), (u64)(i0 + 24), i1);
+ i0 = l2;
+ i1 = l2;
+ i2 = 8u;
+ i1 += i2;
+ i32_store((&memory), (u64)(i0 + 20), i1);
+ i0 = l2;
+ i1 = l2;
+ i32_store((&memory), (u64)(i0 + 16), i1);
+ i0 = l2;
+ i1 = 16u;
+ i0 += i1;
+ core__str__traits___impl_core__slice__SliceIndex_str__for_core__ops__range__Range_usize____index____closure____h81e1d06525c0564b(i0);
+ UNREACHABLE;
+ B1:;
+ i0 = l2;
+ i1 = 50u;
+ i32_store((&memory), (u64)(i0 + 4), i1);
+ i0 = l2;
+ i1 = p0;
+ i32_store((&memory), (u64)(i0), i1);
+ i0 = l2;
+ i1 = 49u;
+ i32_store((&memory), (u64)(i0 + 8), i1);
+ i0 = l2;
+ i1 = 50u;
+ i32_store((&memory), (u64)(i0 + 12), i1);
+ i0 = p0;
+ i0 = i32_load8_s((&memory), (u64)(i0 + 49));
+ p1 = i0;
+ i1 = 4294967231u;
+ i0 = (u32)((s32)i0 <= (s32)i1);
+ if (i0) {goto B3;}
+ i0 = p0;
+ i1 = 49u;
+ i0 += i1;
+ l4 = i0;
+ i1 = 1049668u;
+ i0 = i0 == i1;
+ if (i0) {goto B4;}
+ i0 = 0u;
+ l3 = i0;
+ i0 = p1;
+ i1 = 125u;
+ i0 = i0 != i1;
+ if (i0) {goto B0;}
+ B4:;
+ i0 = p0;
+ i1 = 4u;
+ i0 += i1;
+ p0 = i0;
+ i0 = 0u;
+ p1 = i0;
+ i0 = 1u;
+ l3 = i0;
+ L7:
+ i0 = l4;
+ i1 = p0;
+ i0 = i0 == i1;
+ if (i0) {goto B0;}
+ i0 = p0;
+ i1 = 1u;
+ i0 += i1;
+ l5 = i0;
+ i0 = p0;
+ i0 = i32_load8_s((&memory), (u64)(i0));
+ l6 = i0;
+ i1 = 4294967295u;
+ i0 = (u32)((s32)i0 > (s32)i1);
+ if (i0) {goto B9;}
+ i0 = l5;
+ i1 = l4;
+ i0 = i0 != i1;
+ if (i0) {goto B11;}
+ i0 = 0u;
+ l7 = i0;
+ i0 = l4;
+ l8 = i0;
+ goto B10;
+ B11:;
+ i0 = p0;
+ i0 = i32_load8_u((&memory), (u64)(i0 + 1));
+ i1 = 63u;
+ i0 &= i1;
+ l7 = i0;
+ i0 = p0;
+ i1 = 2u;
+ i0 += i1;
+ l5 = i0;
+ l8 = i0;
+ B10:;
+ i0 = l6;
+ i1 = 31u;
+ i0 &= i1;
+ l9 = i0;
+ i0 = l6;
+ i1 = 255u;
+ i0 &= i1;
+ l6 = i0;
+ i1 = 223u;
+ i0 = i0 > i1;
+ if (i0) {goto B12;}
+ i0 = l7;
+ i1 = l9;
+ i2 = 6u;
+ i1 <<= (i2 & 31);
+ i0 |= i1;
+ l6 = i0;
+ goto B8;
+ B12:;
+ i0 = l8;
+ i1 = l4;
+ i0 = i0 != i1;
+ if (i0) {goto B14;}
+ i0 = 0u;
+ l10 = i0;
+ i0 = l4;
+ l8 = i0;
+ goto B13;
+ B14:;
+ i0 = l8;
+ i0 = i32_load8_u((&memory), (u64)(i0));
+ i1 = 63u;
+ i0 &= i1;
+ l10 = i0;
+ i0 = l8;
+ i1 = 1u;
+ i0 += i1;
+ l5 = i0;
+ l8 = i0;
+ B13:;
+ i0 = l10;
+ i1 = l7;
+ i2 = 6u;
+ i1 <<= (i2 & 31);
+ i0 |= i1;
+ l7 = i0;
+ i0 = l6;
+ i1 = 240u;
+ i0 = i0 >= i1;
+ if (i0) {goto B15;}
+ i0 = l7;
+ i1 = l9;
+ i2 = 12u;
+ i1 <<= (i2 & 31);
+ i0 |= i1;
+ l6 = i0;
+ goto B8;
+ B15:;
+ i0 = l8;
+ i1 = l4;
+ i0 = i0 != i1;
+ if (i0) {goto B17;}
+ i0 = 0u;
+ l6 = i0;
+ goto B16;
+ B17:;
+ i0 = l8;
+ i1 = 1u;
+ i0 += i1;
+ l5 = i0;
+ i0 = l8;
+ i0 = i32_load8_u((&memory), (u64)(i0));
+ i1 = 63u;
+ i0 &= i1;
+ l6 = i0;
+ B16:;
+ i0 = l7;
+ i1 = 6u;
+ i0 <<= (i1 & 31);
+ i1 = l9;
+ i2 = 18u;
+ i1 <<= (i2 & 31);
+ i2 = 1835008u;
+ i1 &= i2;
+ i0 |= i1;
+ i1 = l6;
+ i0 |= i1;
+ l6 = i0;
+ i1 = 1114112u;
+ i0 = i0 == i1;
+ if (i0) {goto B0;}
+ goto B8;
+ B9:;
+ i0 = l6;
+ i1 = 255u;
+ i0 &= i1;
+ l6 = i0;
+ B8:;
+ i0 = p1;
+ i1 = 44u;
+ i0 = i0 > i1;
+ if (i0) {goto B6;}
+ i0 = p1;
+ i1 = 2u;
+ i0 <<= (i1 & 31);
+ i1 = 1049716u;
+ i0 += i1;
+ i0 = i32_load((&memory), (u64)(i0));
+ i1 = p1;
+ i2 = 1337u;
+ i1 *= i2;
+ i0 ^= i1;
+ l8 = i0;
+ i1 = 44u;
+ i0 = i0 > i1;
+ if (i0) {goto B5;}
+ i0 = p1;
+ i1 = p0;
+ i0 -= i1;
+ i1 = l5;
+ i0 += i1;
+ p1 = i0;
+ i0 = l5;
+ p0 = i0;
+ i0 = l8;
+ i1 = 1049669u;
+ i0 += i1;
+ i0 = i32_load8_u((&memory), (u64)(i0));
+ i1 = l6;
+ i2 = 255u;
+ i1 &= i2;
+ i0 = i0 == i1;
+ if (i0) {goto L7;}
+ i0 = 0u;
+ l3 = i0;
+ goto B0;
+ B6:;
+ i0 = 1049908u;
+ i1 = p1;
+ i2 = 45u;
+ core__panicking__panic_bounds_check__h1fae5a314994f748(i0, i1, i2);
+ UNREACHABLE;
+ B5:;
+ i0 = 1049924u;
+ i1 = l8;
+ i2 = 45u;
+ core__panicking__panic_bounds_check__h1fae5a314994f748(i0, i1, i2);
+ UNREACHABLE;
+ B3:;
+ i0 = l2;
+ i1 = l2;
+ i2 = 12u;
+ i1 += i2;
+ i32_store((&memory), (u64)(i0 + 24), i1);
+ i0 = l2;
+ i1 = l2;
+ i2 = 8u;
+ i1 += i2;
+ i32_store((&memory), (u64)(i0 + 20), i1);
+ i0 = l2;
+ i1 = l2;
+ i32_store((&memory), (u64)(i0 + 16), i1);
+ i0 = l2;
+ i1 = 16u;
+ i0 += i1;
+ core__str__traits___impl_core__slice__SliceIndex_str__for_core__ops__range__Range_usize____index____closure____h81e1d06525c0564b(i0);
+ UNREACHABLE;
+ B0:;
+ i0 = l2;
+ i1 = 32u;
+ i0 += i1;
+ g0 = i0;
+ i0 = l3;
+ FUNC_EPILOGUE;
+ return i0;
+}
\ No newline at end of file
diff --git a/writeups/ilm0/hxp36c3/page.png b/writeups/ilm0/hxp36c3/page.png
new file mode 100644
index 0000000000000000000000000000000000000000..ebd6df487d385e9dabb2b2b3f6f9167758e9022b
GIT binary patch
literal 720271
zcmXtBI4DQSluKvH7p9)@lh
zVqk!&m;Z-li5b6scewbuUK_x}9yg)TiU7cBq)pnse^=fmoxW5h7-Q-b*l9J`*6Cn
z>{;>FUszK4b+6m0na$K@aXQ1fFXj+hv0wGr@8S$NmMAH6XSEY7bq>@|3dE}_In(2w
z)At+kn6EcYgAozycawaS6xJc!hHHZ+qfol8lvNJP*3Pv>c?uld32SZxjk`>0}YYZ@txf6PeBqdJp$I1qU>{t
z_^)xxf7UHN*>m-iJnc_c;_Ezl#RL4ZF2a-T*_N9ZJuPoc4SLQYSDMf2nvc*QW|ywmd4SbatPQUP|uN|6?#0wDBO_E#LP{z&?5!
zgs~
z@OaNNmF-qHc4)IX;ZX9ZpSYOZiY1l9Hf;mp+hpHlB<2#y|IwpLn1Z?3GUkg6Z?eEELo`5x_$n}yPjQm|Y_(~J+u9Ao^
z_qxX!V=k|z+C+O?(uIIsH)RAv9rx^`u~o-q`Ss;97_7hjg4n*Lc4?=!!-pTzMMx5_
z*f6Wa?Z58(5H~+wY5$EYGoK9vj&ir)F;PlMEhf}6c`Z;hiQTI$VqFid7^dWoh7cL+
zp3N4hoVO8iG(7z>yIp-UJ^W_*D%NL2`-k?wgYCavnj0+?>S{(Fb>(+v~Y{adwFhju@+M0jxSvlS&|(eqGPDTm5jR
zj7lYdwbn3L*ofTxS~*itqn(c?#&&|HIlgbV>q2c>WBvs?^YPkwKgo(M_})HF`M#i-
zj{N&68(lr6xi75UDkWBZH6ouRBa8JW81@f!m_P(I5?lVkP4`^g@XgpWu_Oke$kjyBE>VYmESXSG0@)i{V0PX#XsK-U(!1gFt_(I8ts01Aq8A
zj-32HYuRe<_^cMNnC0OkP0Y?hxPg7Mtxkj`d6HMQh#R3$R4aA~k8DTs5?9yVKMcKG
zzFPQj_j}dGKr_rn>5iNpLkZZQg;bGj$9;y;Zto0ou5$)WC!`csmz)x(@F@LnFvNwd
zgUMmmCOOr2<)Im2n{MCLtE>|uY&kB`c>Q_fPQBxfn_AlQMK9~s{4>anQNcF`r
zkG?LqNWc@XiS2C4HKM7mx$6GUBuP8lqw>%0yq~SAdQv}A?e-lUYl1J|2peoh6{9~*
z6tZEzKQ=mwKXe$qPGp~(we>BP`sP#zETQt@=xrJCL@V~KZ>*$gpplKhx9jxfxKX4$QC=?dRTc^8E@l}7)P-VWpOjy_M3t6Wm
z&FRqSTlzIfVO;6|R!9+dFM8q-SY4_z$_7wqZLu8_a3Jd9f@iVS_HD`}D>~==^#S@5
zhPPFvpVsa3&>k;Gr!_GMgb;X=@KJX^<@mVx9`+T+rhxZ?GXh)5$2Z=>e$(_oaM&4z
zsU<0}Z+yre3gTS~K5XD_1r0y9%khU?S3|rNiHH&ROWjy27QhSom%ZEPJW1dv++&yV
zu%(!FUEFuHpiL#!?mN^y@_6`lwV^QVpUqB~&sFJ_q{3z6eeHlysWtX3m;a_QYqe4N
zrM-}BaFN+OT~mNJ!+X
zY${oVz-2T~%-cYcN-doIukIqDSX3zsylnm)8sGN9#xRFb_6updZpujGt={xMLTVpL
zR{U?Jgy3tWaJ2}z05I~`itMx<;vm?lU!bLQIv@_LaD88g?v@@4M;Ylo5n=dDhUCgV
zMR-NF%l@uz7KX<=zw)jL1D!w&YzQc8?UXm9Tq$&@%zCMs^lgY?^%7u2YAD$2(t#vu
z^z-1z1m{nv^zNlB|siTO|MqFMj)
zM(uq*CwJHvOA7IP5-Aam!JbuRdCl$&G}|RkBy&pN!gDEJ;w=s_PQ%2uOhy3TMaZP?
zuWOrKBB%;E*$ArC&^Ij8&kMwh
z*L4wdVfIPFO%&UAnktBU&X_-_j*&x$|&^Ku9~r)$K02VN@Wh8W$3G5i>G7arFcunZ@g%W?OEj?kHF>a
zIUyZH)g_FDof|v8pXYt?rnaKSwj3TfH3+fUt{puNWtfN+ePwiI)}vT4J#g#8fvT0f{zAR7%U~@(
z`}LWvw%!w7A@WFbrZnt2pk`OcG(>48%e7~^IVN~2-u3hu5$KI}Y?Y43FHM5JG4wFI
zu9J88k9$ZdO+2{xQB_JdSgOJ#F}wH@5C}|j3J^xVluxm9R=qr1Oo-6KzUmB+qIG^D
z+;R|4aO6GeLFIX}6VJ2*E-PYryz;|fT!d}p-2yyx<6SM
zGQzn5ZKdh25Gw#vj(3=@b=+bDJlTLB-Pb$`Ar)CkcIrTp!b-mG+_qW)i=U&+%R8LV
zPY$+u-uY|)7|h;7a06xrs_+vwqAv|>eMLT!&%I%9S$P&8sFj}5XNO<##hcfjs
zjOiCm?j^>@lp;C*&A_4FcbS2vN17sCbOj4_jREl`}4?uby1%>Y{v%t&y954oo
z(`3dv8kG8Xt#cmx{*<3rOyvA+sq;%~5-QkH
zOD_(ZWg?w4UG?G6I9QI#$hHw{RlMC&N`0^dFsk6mmmF8M(fK839rHm}ky~v#T%3Mz
z!ksqY1?2~N1aW;p@YFwJ?oC4*$Cz4VPGBB?cRQZ)arE~o)66NaE^*8#eT-fld=pZU
z%oFxk201Il+nw`*Y*>fqV{ect%44M3o@T_H*k@0Zwi}XaJDqq0cP|pP`+
zxNXcw7pY{psm6cjJ?2$ULIjhnxD#8MG_^AuxxWN`nHM&0@hQtUtunXV~ih}^P`
z_O;H2#amD2N!b~{r%SSqd9?4)V5S}?P)k416iMd)Ev2oA*`00p7U
z6!AL^t!w?iJt2f-i2p1u-NhQk+kSf9PzYL#4gJfn)61?X3_Rh4q2NLvw%4PaTfQnS
z$1XIs$Km`-Uuoj;1ESwTV6Ma}x39a>It;ajHIiIqXI4z{6dBJuEYzXb(5*!|w46cr
zpK=AQM!n}XlJqCJ*EmhmpTiQ4XN#bXkZ+E_;(V#Y1y6s|k^JQhVXB(~cu
zU$5F!Bpm(2RDC!}k%T!%MZqOJcmPtJCYq91vNHiMIF?Wfyw)Ue@|q^j$6qca`56wK#l3nfS;~)$%U>@Zkcf3
z*JChZtXwN-0cK@`xPt5|*2FcevRv?G*vU-{LV`DwNv8V`7A_?`oSze%>eGdCPeZ(P+$8XdWP-~(*9Jp{
zX@#5w`h!MNCc|SV;CW1Zw=o9!n
z+=>{#-`MBCiRDKb(y@GmRXZwW`sQ!%0h_n2sxA_d%8I+9x*gESu4XYVky*&zLy2Z!
z8QPKZOlZ$s>0F>aP`*nr?biGcZ+Cxwm$*Et?<#N7>va(WyEV6VGmN8X!x3>*3w%Y#
z5NqlVZ9Ur;SouTs(PEOK(id0onN(32myIEvI1)vy?y7gwmg#1WUb~PI(ftTAN&}h*
z&PWHWIkYxX4;Da^qP8mvzXXmaeyHOk_f;&&YEn)rC)xOSwTzC=UTU|4%^n8(&Q=mb
zu6;@o%c2)8(OS2hsvSrXlh1k#{DpFzWn17Qd$L*BN^f+!*_a`16sQzD!*gtJZTY#i
z2NF5o>zHkkaxYW#PGH$RMmk2u^*%h@08h-hR~;+`LO!^gt|0hWrfJXFvmC8zc*3x8
z3`xVyj5@2Oy-xo5W_?5t%BiJrZT~BG3Pe;CL1i7r4+h+F=NO@9DxZ`bv=LPUb+>O<
zFR$|vv-=UdK(#}@tAOODZ6Yox;21$=gM4bY3@Z5zj0K_#2{1^H7s;-azi8Ga9K_Mc
zFBA5Wmli;La=J<&Kc#Blf>-nHSxVr0NZv@ASgykJe;lXQLwwEwzqhqe_e`*s?+Q&B
z7jqTku1(?){t?ti_tf1`+I3!D=qs5bt5Jd6I$yy3OzD`px7u`+&FwJ;w;Xh+Y0%~@
zJM-`E$%-v|QjVL`Wb`_&t9U5z_TYkOCXz3hERPa|2%#bqSw>7;-gx+-oFy+HY20Jj
z@IA8s;?1+*0gd}df&!vblNh>aL1jP=b8RvirMPs;+C$5XhhXQPj(CGv`xkexpx+>|
zzi~{S{m^zdZ}u0
zQN5`j_!jG*feF7dCpJbld9dBo`j6L^Td7%AiIr~-dhF}kn
z4~_jusr4T)kv!bs^vq1%zlSsRQCpKKnaA;8o*iYh-8+Ob7IGF^9%{(jd^XEyvmBF<
zQ6(lxs3Befx|AL?=jnAwBVbdiM8r0tm3WEx4c3BXKT+Iuzs5ax@BJ#drv_;=pFZdd
zMw`h1a;&-_2Efc3bM5ADw|a|@uWT>y|8d?LkhRs{Clk4PR^C?M$PI7g`)E(z-zPSq
z{2y4aG2q8Mc;CtGE91qm_3cI-%%lWqY3l7}s$CO>7@Efc&VVN2^)Pk;stm!HgL|Du
zhRo&kecushb>v}v_Ekh!1+{8=EDmF4V;(`dH}2FrfXo4ymSHEp;Kkb^BMHHE?R(X~
zPSZumOR>~hW<(v#exD&?=Kg?H>t|y&$
z0oxbN1?eAwlZfSLy~bo$e0$Udg(=q~-&%>_Zh+uh0YaOEo%6u&<-
zSud=`$W!kpM*Vp|^zAuB`BcQOXv}J}qk^SodOtf|b03t*g;Cnp6octTG@GZg8#j
zAC&9dMJW-N9JBO?ROAQ0unGFwYi(V0sTT>`xeeZ~Szw6#@1WO@d>QHgQ`hEl)T^OV1Oc+Y10DudC`|9%B1010?X3
zck@*(Q#_U!3_OR6W8J|eLrrp?4#BQ|1SNng#lu?Sd>X&;Xa(X@>xlx(LdCc05M>gL
z0(5XW`i)reWE`yeE~~r+w`z84OlWw35I>T&OA*F=^=ecIqAzY2mISVDP|f?tph6wG
zLjI+nN2j575rt#}fsGdl4MGLLX!zESM-`fXMoaypL)Y6R0%w0IWtknxlb!><biM!yZtggneg9Vw`3PvNNte#RM
z1@~}I+lxos7Q-ZQ%Zy1NcBJcF_iXThg}**+l;2)76z@URwCy;9+_@Un(wTQ8jnd&~
zZgaGF?U<>dAf=&yD)nnEK;O0C!eNBdDuL-uDG|IQhcH2%~p)CESj0bS4
zmn#^So8JdO?DEP{)~Ef0tk>^p$IScbJ!?ong``B(HH;$VEJ>`tK+Jbb$6*GXwWkl0
zShxKM`&>Q7qA7yu`oO9Po@ZZYm2m|dgi=Q_?i`%oFa8
z>1h~<7#cvR*hUzD32Cic!m~|KV)r7V=R3`8W1Gtbu2}M(fjOXb4>&Rg-;5d@d2QHA
z9`2L)%YTB(2!q^m_a#^m?V>NQf=RmvEH&*`G#sh2ExV9wc^?d@cb<;y4E#9~>>(xz
z@(wZE^{2E!H+mjSkSU1o*Phwv>wy~X$c2%&yBC8yBI{_VPU6Tqw<_x!6JDwTtl?^I
z8+7`boyEt{oO9?RA!Ekr2WMv7o2m#paRGm7Q@`MlzH)HZQ+Rge#da%Zu>GhO2^vP=
zdb7a~?Q{)eTlcq*TJDPdr#KM;Weo0i7ZCWlNgkev%v>Ov1dV@572-dfckcnt%C@q5
zBnnK@kw_A-5^K4M!D1|CT^|)LioouyC*9U_@Jn90uHN##3ZG10x<$Qa)K~0j$)r|J
zXZ!8>JrCV3%1PmvR}3qQIN36c1P+U~&#>uw>8%*?>y0NcqLx?z@z%hfhMt_wUjpmOzS8W1KY+1c
z0E@bD)?FhS7fAU-HpZboh{{v>Oe5iUsw>!?P>wS4BMC=Fyb(ltNV7S&8
zhNz#2XTrP;uhksSe)2_x>MK`I-~_e7zm7`Ttey+*fW_}LC^K5y*3(~O8Q
z?J8XeDkkeJ@hE*_XVf7VV(Y_3*-*anP?wmnZX8B#!aqrjrFnRL(a|fAZ@*d9gKOqq
z*g5mj(D^2GtpkR!&|p~NINi1WC3dZv2-a|kjOCOZ*@#`9YKaBPeU1ooN_ppXo1z@K
zyRC5f`6KLTZhSm3YJ!#dc5%q@906K40Zl#62v+kCeEm1T$M?BV%MU?xSM8T!msgZC
ziG=&rPdT+_v^oi~oFGFXhcnRKDU8sMz&jLLeX=tUu9P^=8E#eXTQv`!LiX{tbITUR
z4Gvk{?Ut|(8ckSRaTJ}Ru_isC^3`JlKZ~N}0F`RCfj5^9tQ+n8oHP(^%EjBh{G}h4
z=G^ZvZ%gzjCJAZ#NgEyCW+ct|LzosTJa=GyS&yU_?)7Fc5|9?Kou>vrw*gBAchB#f
zpx7|wGNp|Uvn9(}IcNIKuo2DM3N3j?DIfe{M)azM@N_ZpEw{J;OZZ?qq5dx?Dx2kH
z^3GeNF?J~(Ml8av*oBU@pFx**WB$;M{I2|H#@B9ZWGX2j=d+>h-noeW(;Q4vdb?G+
zO!d|xjZqz14BsI_fBAs)?yPsukSNUyt_tgiRHjMolfw_cnMFEQbo*=_ZHEF;529>+
zk`M6)C#@**`)Bg@A1f)qMHPJBdxT
zKjr;C&q846U{?!GSb-@=j`NZhG}tyQ@6KMMQUx^c>p)-L)6;^!;`Xs@1Vm7CvEuV%
z7s+;rIIb(tjXjQ_MAE`9(xMg<(Qf{9-HX`jN4T2GD^!*e3{I(Biu@p|Hp{Em$MA7E
ziGtUCdb(n%5DA(JLstX$@-CNIj$%BPR@|@uJwJ*D26g3L)yleGt#0man+DHW2B#z+
zasQG+mf}Fb$oyO|C!51u`>u9ypOYufo~K#>IFu}i?n}=9nP@YB3}E~CSQlzHDFKX0
zB`C%OMm09<2r|?T;s*cf#maGfSl5UzZ0x)K+|_2~UAWu&h{w;VTO~8b^?9*k$P6hc
zUGL7((>6D*D{$659MN&cnAglz?$gdY-j?irn)Z#uwmZUBt8Q@$9y)4WkBDlD*Km*0
z|Bj*ApKe3O;9Ivuu1nfVV`w7e#CrIttYLQ;uZRweT_(llK`Or_9L=Vew
z-Ak=Ieyw@zsG3xrpO2K+J9$Xr`nu5S-XWfLi>e<(z64U**J#kSzRb8fB})jf0;cvyJ4BFyo*+!T0wbJhL#|3v(@r@S*Mk
z5}(K{Tok&_Cl~T{%8v8N>qDmT|Jh9Pk87FB1?UDf%*26l3mhIX~5(RgjEwUSF&AiISTiw535g_oQ{bdb>3!A(p1&%%~R
z6~7|=g}%E|4*QY++U|{`;$NFk+mqrDZq;3~0fuB@Cy?O5TpaqDId`>92VTx3tqJz5
z9{XJ;A8l3jJ~s|AxcculJm`n*z=4H(UUVWJ)}ka`@{F>;q0&9IH&@K
z?|k&rzc%VDVNTy7JN1qlo9XMqd!iy4kt{l|jjj+ab5d{*4`x=*KWSx&x
zIYNJ#5-quZ^+o|a9f1ASoB>$KJnA;gbM7$AyLyp$0D^8^%l~$%bWsRPD!|rJ&0ABd
zw2?aOIsU&3K-M+vp?&Q|t2&1**$WZb1?qNeTvB=O^q0rc)pnCUx~Ec(8Q=J4Ez^5M
z8x=Jx6^C&<-By0~>+bNpA-5_>P0PgckT~n?__w84zsGc?2l%Oz01wGIpUbf0Ym
z6z;WezXCY1?Owad5@P8GMj!9MXFd!v9>$=T+D3!iJAbI@h`-s(W7!F{kq1y9&MhB~fG$9T#armh8UmA6RUz09gT3G#5$&@8(ae`
z?0;*1nsb_QCu9a%FubWJxn?>{5U?4${2R(l)|u%3%YpUJT6cpGz%@n53}h#A+okPE
zWQJ>`oN^q;7RS5%%-rc`0(m-|*7|+v#O$E6t>#aIB+$)IQb(OohNkbRk)~z#U_{$)
zkUP5b*CH_%i|9ZuZqKxV6RiS$3uY#?1{|S)V`t*+8M00ZQcLZz^A+xjuunb|o{=Hn
zd&9jsdxA|&KPG_5#RIabrfk6q@}LS*5GfPbVn$ME^A?jRlZIA8x1q5)Q@I
z;~8o5j($GD_wRG+>LbLT+GVHweD}#_KYi}Go>CyC=_4?CS7LU=8R$K_ja_3P!xDN3
z-UZa;&axWi^)t0ssiPfnK4K?r`YQkV=D7$@Y$l^&t`6R|PZ(fs{P@=RW
z{dZ?)-}B~#a>R$*igZ8st3X6_QDk`#?dM-t^Ly^z&;x;y?O;@MU5fFM{q6Rzd{rw%
zky+zw(B?9GWQA3KG0BRei-mU7yoeX0((IT5=cMk3^Q8xE7?
z64~G0MdCveTuPO@BjEd8=`&T{EYDW+{yjsV7dqQqdH~EdHUp?*jd{`F=>-C
z>Pd`5ATZMMnDctReV~+iQ4CMre&QmwOME-UaJlUnItbakXEK#uui&x^jbO|<)WM8?
zF*I7q+)o5)lCH{VzIpfiE=y#1Qb>9-V?;sO3B?&SOX66sn7GHG6?}0gg5Rf=*s%a<
zPaRJPbFM;{P!p!6$)jS~2%NV7n8MbONPdiv9r|2M%(ZKEk$Lu&k*)c8vCh_mLvTIu
z(HGKf^FsCO>8J~>ed>VP>1(a}b?>`kSrd?oQ?Z$__3cXPhRoW$sqqBZyB>x~;s{Fq
z02qJeG(jS#@A>D_UucXqI-mBl{cAnb;yKdv_MLZ@$A_%tC2gNl*qYM;rLM0J5*_25
zG<5>*?|818C$|O=W>gUUgvtJ;XjuD7CUMDI5eDv9JWY~1VgX}mZZwdKw*d$b>uu-s
zj_waNb<2(8mQun4*Do6O4l2D%ZL5E9+$l0q7ormKd$o3UV)2O-g-wxZ%Tw32!g0>k
z8>9d_SWHC{E@fNe$Wi|up8;bs`uR0qt|%7L4$r;}_llcQ=h%F_GQ+Y$Ot=^G9kDN#
z2j*qYFKJ6)Op~Fz^R}Uj=+Tf_cVtby!&k)75w*_F{vWQDW!$B*;epP4FG}mvvJ-XteLl^xGfch&+Gu~&>vD@DMV{zB19VWj
zUV1Yi<)i9^7ZKbt(v`(kjkinlGFnElwpTD7^4;S=hKcRea1QoNaDtU@mssP=ZS%!u
z-1L!I6DihJKOz2J4;vQ;=80*zyBOa4S3Wso_1cW0SI6#sV2CaRynwcWn~Z!6t0l(U0>1oRHrl<<9V-gMP%cXV0^l7*%i1@1LOThqmo}i-ZDy8!epS26MC*z%AF|QZr
zJ8vKSYF7f}v;apcOE*FSgbSS8O#?2^=CpULT;v>5WH17Hki}FZa2D~3m1JT{hd(0q
zik5bR)2&*QGe-JK*=pQge7kK8;5mKeG<^|Yc-2ZxxqeqLeM}~c{*H@R_f_9NtwLH|
zr#{fa6^OClaQ%{_{2EWggVg$jW&PGQqz!jss(KAy7BtZaQe9)9Onr40LSVkpNXmyH
zI-hA=UI}$;QG=ie(#|sUN37C+zj7>}>oNX#8W2o5{$cOh$C9!r$3ybUs&Lyh4T2F=
zYq>qR7W+z}vB0-d-4_%CsJHdrc;B{lWT+Ykv&j6j*3mY-D;f)I7{c%UJP7u_fFWdl
ztYe!J=1uj^>rS)B;PpHG65jMjWt>XGmu)T7(^i=)Ej-HnCDf+xt0tf>dhSO;4RH?%
z^3j*Rqga2r+CPnY(#Y7HsaD44_jO}1N)wX?hlVOQ2v=7HfpOd|m?CUUBrAu~iF5{I
zxxjI#5XCh?gKxaY^*w3J3HZ-seFm>c2Vb%7D90U*nrX6yP3we7Cb0(n5C;25ycpI1
zem)4-k0v^P$T%Ja!*oYpMko5<2sDZYtDg7U|ERqnNzU*8vP^w9gViP
zw|-9N;Qu?vWY%R>oL*B)bX>Yk-MajSjHP-hu(Sou>$1~G8Mo8=^%1@n$jL^5OM~n`
zW!ZkzchFtLwsVyHsCDfjbj^*X;5vXBftcNwUN$%${01YONp>Ypb8=6_Z
zVzOfLKa+LB{Kt6-ovW`o(+!EMlSeqk(bkj6SAalP3Tc0qH$DLZ+O88YIO`@^rx(EE
zw^KP=r--Bg_iOkjmn3zH0E^g4^E8HLGP
zEXJxl4U+a7^zW6C|8k)#BgB?0j!>!Shim-`O75fX{>?7Vx5&urq4jTsl62_{XKLap
z#6r*|1F~^Y%6W|HKPd-h6%+7aZViRa<-gX!eA->h{V7HPJQN`M>rGl1L;=jOCy%C>
z^0~HA0W>9zy7aB-5-Q!2}HU8
zf5Og&&HjX>Fx98yI`#KdN*@b&V@mmaE5nwxY`gV8US-Qzj-QF^^1EbV+4iBuJfUS6
zXfCPd#qCUh^NZBy!#Z{!Gx@v^3!5~5vJY-BaT(qVYj2d+@c#!Y5`Mj(ofrieZArk4
zyq?sAVOmooU8N_Gf3DzvQp`y**XRB$2i`*l2y((GDWE0P?T3AM(ANbBkqOX&YnZtm
z+T2oNea(6IIL4jy&@x3aGZ`_Z%kaxgrKs}n%T#H+EV6^d{${AIU8+m2-;LgaH$U7C0l2Qxc!KqX8t&?q4a%JT`;yovX8HucZ
zI3x0CyAku~X|bcAGtxCU4%6`Jdhpr6w`A9x)>NM4NarxUzU5U|Cc1y&I%EtFBe`Py
zqvNvhNg%&kqfXul=!0t)L0^@t`UyLCU9c+==#x;w@1gPJ_=z3xqtnD29UItlvj59%
z=KR;U?a~xOhoG(3Qz=N-v~cS`41sCgu
zwEUZj*nGNB-i8rSR*nl?^d~j4{tC2nzfOSgpX|?V!G3G`cT(O}$z&0jcf*?(v^vMp
zIZ;!%52ac+<@Ft=^E@^vfLjNdd?A`Z>|!s`rUSYTVOh{?pTXvRaaX*98V)d7p=J^aYMLpBaU@z$&`Xha
zKs70&_l&ULPH1x_XzRTMbDi6(Cdv@a1Xl@yJiyPSgSicc$?(8$WbWJ~&i_D)aXSHz
zNG7@>e$D)S$4l}qMCiJ?hz$DA&}caTKoJg$c$49wRWk^Sm+|js*&ccgQw1VXhp(S{
zl;W443wQh(LVE8y3KRt
zqLIx}*Qj`{Mn!0ToGIWm_15vPjkHdimgp@zvK67>}~npG#CM9(zOXXD5G<=Yllj
zQ{6zSGm5Aak%p9j;@-(`I9rvoU;-b-;;-31@%VtjK}3=F=qDASaf
z9Vo04VS-9@SB=k^7|9M2L|>ka3I7tmHY&MJJRC&_PMD;jT`K2Wg_R>j%n0)9Of8l-A)?
z;Sj>;V+b
zD}i70jCY*`f1XgiqB!iwUlGKTqzj#oy8fLN^Njg-q*Fh}DHlyW7kJ!4#p&s#;7>ok
zTR-q7DBBM8;Qa<7IqeRgZu_U%6w1$bEt;yLB=0yVXcU-8J0)=)z4~D)6j48dkQrA#
zJHY5X9|r{A9HkK%uQZFSOA$x
z=DC@?tucUjsEC+s?$~=whZ}$8;|f~dsn1UFyu-Z_MmU>};#lBDv8!KZYE4zT&rE;=sQ|@9i}%_;cq#6IWB);ak`K3=i%zk
z_qmg%0o2ETVabqWvQBv*k+o&EIjqg#Y|%PsJWegW1){uPorhJb`$SK>#O&v$dJ9+6
zIg+-6p%k|@>_7_zc@01|CBS)R-(A>3-d7@n`HxP|3{7Whm)`y3pSeBWUL{8uVIbm8)o|
z@~-+{kEb%7!N-;pZ@;v^e>h>L?aYQ9qIo$vleM(q;K#z~UK#7qC>@p*YItr~vRBb;
zPcy-m%qX$q5~WsSys-;aCa8wksSy3ht?chz&lCD^Ax?~;SFbg{?y30(I8pCBo3X7J
zKhL?dBs7?x_x01SooH6=BDRTO}~qn&oQgMPSXw$+yw#au3a0mR_@{TRd4Ox4+%Y4hoE2TL!^TcK;B1
z&7fB<*@&_41!FP&X?R=o_PH7lIBE>p5l#AcRw(T5c3aCB{>Rhc87|FEg^T2KrU=@^
z1%p38VRG~*8X(=rZqm*e^$%bdQzXmlmgAe7>C%mFKQ`I^>m+;FC5+
zx~dPpQ+Bp}1b%>rrK&*+85+Ft=gcDO-SC{7@+>RgHMGTluT$Nsw%^E+D%?#~TLDQ|
zlSXBoCQvRyJeP26DTM#0=O_HLnNQqQG}Y+*wkG6OWMoICK-8^{0L(x4fFn_OvnZJO
zECA8}+s9_8b*XLP$t-XlWs93+NBoaxx&>qJDT3dCsNcBi=wt3`tR~4e_gRMepDfRA
zUACbIywtbV`4S7>pmd7p=<)>?Y{7g6H2*AsMgq5g=A+uhECQKC1YHFlKJwuK0Vu#X
zW5ui|?p{O`h`t{#P#p5m9xpD;F0?#THv`Mo;Q9}%`ndr9Za_S8V=+AA8$C$60-s@!
z#1s5W(DuZE2mEDSR!@*eU1Ji%T;61mXYTi3VK~Z%dh{w+?{%5u=`3y;#@%nY5*QsG
zehf%TF1SAv8JB5AQETMwaev2+@o{GJV~y~!vc}7{<%75X{9ALg9BP)McP=%a_B%21
zhp`T7gv6%dZuG;A$NAW1*0nx0lrTaN`6ZKoWb7}I8m$1-7p-h~M_`TXy^0d3Q0}=$
zJxGox7Y&eL<>{MBKx*3J<@q
zCSDfO`yY^ozZzs&$%tc&GW1Gg{wM@#t=to183z(Il!IKAJTER+N
z#D2%S@lav4Y%5jU1-_4^*vt>#^4NXSD_Q^Of|dkAL4I52qSK
z@M__1_FMa~4)k+;WhF;hyj+Ov*E}ndE0-rXidz+L1cf^#%`e42kg65Y_BcNOeCNr=
z0X_>9%nVzF5ya#8Os4*HCsz!tk37ORa2J8UfWFo76+&;{Erben1hAfHpP5&S+@&rW
z)2hIGcnz6wpZi{!fR-h|sf|l=ybEb>-a%eJyZ-O1t|@Vm*%2C7N1o?wjdz?|iii+OE>IuI)tg_4`nLYS#K9yG{P_Cu(slMst0)LXgV}?H
zOd~KAnC26gJ_PR5l{+du1W`deGR2I;2)|VD^OL^=Y&<+4xas`&K}6#Or9m3X8^nPg
zNm%|s*Ki5$N56T!U%Z7nMtd=GKC!~t8e(OYBS^dMecNWKtMV7p2$j}XYgz`{zm~KC
z5r1pb_8*GvV28xgkCjbc{~)^=RFH{piw{a^9vQz>5G<~Rqf+tKBk!R_F>K_Uy)t9{
zG^CB_0j4)+Uc6Y9rJr`MH(H1#i+*_5to9-_~O5R-06_y4p{ioea?QH}RP#SbUhRnn5pLci^{$+f5aZQBfGH%S>wDBdwVALfK
zwqYtvTy>b!1(+T7x+3(BId5hrd$A;`vF=e2y#S)cGHCMeLHTGPT|tQ3!!hCE-<|*3
zVX6ZUTDg>?oTx_|5()K(4SkT8KM0G5YClw`BR8fq_*tTgME2>epQCq0(Ik97K@^@(
zW&~A($m-9_o4(vLw+#@6^so`Y90zBVunR#)=m(eg9^MD3JOtwjyNq>@T5Jg5D(*sH
zzA|oId-XfU-6n
zu(A~f&TBn{d-#Mv7F4jIAt}HsG9|*JByi+Xqw2L7Rx|2R&N+-r%0#d$qvGQlrap;gD2QBe~j
zpDxK%Mau9}#0Rh+IxWTNbNyVa8Q<{dRBJ
z91nSWI&ks-E&zVV*7oZ0{5-i_6qkD_c?xKC;5{$e}S<3X%{r_k>>%XSouU_hBIa=%w
z_+=ZthH0F*+?&p_bLJH!F8#7pMmFw4G%B-K!ic>d1i-x^6u8MNE@o%Lf$_lLpw0N91AVh|C{A5F1A5(_wInYZPHgSVgO-K&!s?CfRO;lG5edWX#R-*_OrxrKvbLYDzqfweG
z(O4*5n;mvW8U}-}o#dnAg;qPTEk11r8Re^;XMPQPx{DLJlu;IHpzp4ykxFnwtZk
z4OZPJ;j{$J?$GhKpMZ1uw&c(#icean
zdI)XC(iOi%N(;AbIHZX|HM=9aQ?HD_m>i;>=o7rFotBja3f%wS+6rs
zjX@(GnQnw?l}4wb(u=^xBz0^-Ge0ODzPkE66z+_g6B4}U8){+u85H>$x`Jt}CqB3_
zLir@w%#w=JP|8YW(*St*8fQ)5^G_netB+E~S43}=UWESWoUU~u`jvjoYaS4HPO$#(
z!bu4GeJfK$OyULEy1u6LWoKk)l>YH0*nAp7p}&u6Ub1rlff^
zBg_u=%%jm+j;Z30_korN^U}&c=$k*@zbMQcU)Ij37K=4`SO@crA~wn*c|
zC(FAHuIEi{TRQ7oH5BFQ*>8072i){MH6EZZ^nZNCIqh?|6ookbybx`|UGe^f3IlSp
z*QfCZ>eS%7PJR|i@pQ<}p^@Ud?Blx3Tc>`!3Yl>Kov|2~zWr|YiV5Kt|6<;Ry$lg{
zM^^Vwx?BQwzgfCFYrIMK8+ary**JAVu6iy>Ob|qE8Wd?N}qU*w6rAC!hI=@v+aSkF%RDhDWz;2I9ArXb#*hgG!z#UA6qz(Z2la
z>p^sxqI@uwgbNUB>q%kA2G(NB{oTQ>92Glt{}K7+cUX&KsPo3jBGiQ3Dc{
z?VGZn+WsLI>*3JAT+Bu^2Fp93H*_+rel6l~TAnmbkn=WJZ;2qa0hqW}`xeuG=gg47
zpT-%~UMDyFosqDp+VxXET%rGSOu2yHkU$nu$U0M5W#7+
z%d4~whHmtPtoct4wK;AU(Me{vaNQaB}Dw%`al
z$%D=(OR0rf7Fi|Y-4|f-`%{)T8-tjA=RM+1ny3JdX%8cMU+gDB_nvzP^pnlFO0=9V
zZ{FYT8fC1uHfz1llM+fQz;Z5VTac=$s7TSv`0HQZ^GeHjdrWAE9jMj80MMEPXi^OO
zc&!mmBQt)Ca=^|8zn#2(dVcZ>3FWvvCLpE@;y5`nvro&{J_!lriB5f~5aW3tA4Mrr
zu&$QV_bf9+LU%V?t_aIC6iN{dStw_0UF(j%Gf6;2V13u0le13Z8)0g$Qo6InQsOmi
zM9KJ_{z+$ob@j;m%W~E=fI5aaxjP*x9-Dl`Q)h%pK74~nUaK_HgZCK)C7@>mVa5U<
zX+MKr+A=YG>s>!l4S%LdUf%68=306B{_2(>V`V~Ji_bYN-(w$N1#@FUE5#e2Ge7x)~!4?YK9%jxa8b$kE6#x?8$
zRs-%DO@wiYHLSG_l8@{Mu-ahF6OpT{!-di?glD%Uj)D`ISn(J7#dkQE34nc*7UG>9n>M(OU_fIIQgC|fp&_AH2L=(WYo<Vtl*1isghYYef(La##N_
z9!b-r0a{9}ztyuadvfw9W1&C3Yu#Zv)u+ccSERvR>Fbd$Vzo=Z5=ziZPmr3|-#gkhNy)G&V)2pK82_w~qN)6{yjZ@}{GLekUUU=)vg9IN_r*PxxOm
z3YHG>AK=1eZ6!T$yQsP+$-=w~)SZF$~L!w08KNeF&{0pDSbk7FwdqV#&Zuo6YCOAnGz
znt>8FVe~Y!P8)%G1Z_i=d&F3i=sqi9dmi%n^XT`L`_&%-Pt(CA2}tZ9+u3(kx$w(G
zx9wr}5o6u)p!%B=m?2oQuPN(gKm_qh^!6{lvbT)iv#0hr{N~=b(!lVR3}%$
zNXkz8XMU|gba=0#u7KUxo3vbqM}CHHzP*?blUf)IDmUiU3YDGYqC);X>HEs}jNYzfnl!WpWxyPfbm{d>s*
zA;TZkWCtUJ7--U?R&?3gm`ermR44jh%h0eu4d6Dyn{;);V0#sj`$17{f*;sp9?6TN
z5w2@Y1%NDHK!=|%JYECW`<$O3_w$c+%G_9z2t*8WLpDrw;sGfdF
zo5^D>eQs3pcEL=&_y%f==B#AUHBIoHq$HG(;%J&eD`;JZw@z?z5sC1#IX
z#4y5pIXo(VOzjvTtC7@oW~py%DI^m|pvXnTeW9NdW>HNxkLP~Cx3yO%^iq79uir&?
z7yxpx@8Rr1mpi98L*?!Ce~1^;W(wnA>w;@u?s}?&{$+Yg%Vg@R{IQ#yjTXGN#q`^<
zDz5oTWG$k%QU17YQca`j{U(N%*OGQISIdg~h}DYjhk#tlwk%bbGk?<5e7}G28K&u(
zWZqS~$b$GX;!S;+ONR>k?t;P@HU|^fM%Ytbr>S>^W4cKv;^Rmjh%9gh_Qslh*)~_x
zO8GR{X5o^lxU6Y!>6t=rZybfDmf+wY|Xa0^}W+7jJcz4
zHF7&_0czFf*>9ohwPqXAyi5@U5^9zCBX9RmMJf3KW?l>%WXP|ipcDN2)z1qjk`SF#
z%d>_DDS237Q9VDVq0t{*znO`J*QSFx%@D%pva8AT88zoy{v{#C^>{qi^-r{%z=pep
zQ+@|#w56jX_*%SWtC!39CUwX8csP>-;=Q7H)}h;K7JPnJ_E&(~1l?vUo$T3!(8`|>
zuj$n@A)nT7A#T%o*p3+(7KaK(42SsjJE0DrELOC^*R-_?7Q$g^f+&+;x8Ar8jR3$h
z*0Ttu5QgTRAy)dQyRJTaXyfSeD-%G#)gt`p_W7&*=d*NXd=gP9SYLs5vUxrwpMJ2q
zIBu+|{1%N{O+r@P7zvS6*j#sCpxM@9DOX^s&pGCAuYjTG>Ag4Uw>zzsE`#>XrPhZR
z`oqBs$!OhZ^6G7TC_Ll4&zW6DU-`c=fA>v^>%b-(W7!P;?esZl_E|J5R3=|86b5rA
zq?7g6=C_YOm%SwvA>xpvs{F@C%QZ>PK+3aD3PtO__x64NU45A3~Fhm8yO2ce@;7`|;s5z9Wse4a38}
z_ha;5?^+4iX3{4}lmB8>s?YgF9mJ=CEbFX=hxlxQ!FY(!L_F*isCc}Pbi@hwWa;+m
zRlM2LZRgU3x1x`NiZ7NDndYR2UrU1^*?f4k;+}cTcrewFguoI?z2r2Takb(Ohu38~
zEvt-l6*OGV^q7`odx>(IsE6yze6D|p$F7SIxxIeqToK?j`VBpjD+ZUR8bfKszcl_w
zSmI=TbY~(cQj{)2rJ38MZ8ky<{mj5(&k&hKv=SwPbR#)6%gfgW8$A#$(j(Hs=h&)Q
zk2FYUygw$u)slX31@{MCxX*nXb=jj_keR6zw!q#0Sj%eqM&iZFQslN*rF{d398q#X
zN&QR=PwjBv&s;X~5bbjwE
z@Fzug8Amf!$T&?(`97T_reCpFGxMaix&?QiQDRSFx!tI+XF73z{9Uwf{1ssBRj^**
z$nbxJIJN+BM4oK0V`d(!OdOh;5qpsdHokI6x83Y7CI|=qUeBDT|D4Bt4>(6}
zdS`n9qL31@<$o`ti~-j*H37+`2RO5YSks1x{{+6h(M=4!-@-7YImK0_K9SKZo2cni
z4A?yxwzQ$RHN0{N{8{!pg>9bqugZeL=
z__{_PaUT3@c)aqviE8y5?)*8T8S0y3=Ix#Z>xJ~pVh#Q(qIr0{HABvR_&P}2)n}*t
zYh^!>teoVsj79bj_RF1gl1^cA)!JuBnE=i2=P1R~6$K)R%UBhw{Ygttj=o-Np^v>)
zHzQP(CwQ?>2220QCQjQW1=|y>J83=1v~&?DBKgL57Su^_g>3TvqRWf>vpTG4uk}fA
zT*R(1J~z|xC4;|s?R9{C^)~+e9D%;zC!NiKSd8tu=bAj&REVeOopDyB9=g%7u{j;^&M#)5P0)
zEVUG=&i`tWRk37Rm#mftkk3o()?fVNcLo|<$i#b{1oDN79LO|D^{`qnoEwDES!E7nIk~F*Vq4M2%PJ%ds){xJ2
zdL(8onw8;94G&H}5&xJd9lJJSecN~@4f_7$+^ll5A+CuF`>Z;8`+5W|cLWC!)Eto;
z3=U!H`nQ_244dL1lJk(XiU}F{kaS$tsomoUv|w_fsc(&=OG?L_R%>v(+L4Lkj`Ug
zrwW`O
zO`OqZ!F#5({LlkZTcOS+^j*N(#>Am`e=Rf#Px=)D}0A)d9n0fx5d7X5EsaU
zG)V!Tu~fX1X6_X^uU|y!Bs}E+G8Q}T5PO<2OEerpEB-Q}$c}?JvLBTbD?NF{9<=c`
zCd!bl$4%e9(lGwP+8EzdY}(YtkD;A-VRG4Urfedt>kG?aTiz0X`iqw1l`Ab)E@jGA
zo1@*Q$L`6sl^ztQuD
zdcw|pmsC%pd`X8|T+vjV;ENClD~SRYFa$4D>d8G+vz**6ggvJ4=`(V6
zmBmcsyVN0=aD|Ife3zPev=1%F=dpDK25D?{3HJnW=$-2dd>Qbk_7osm7kUjj&@HaG
zpySipS4i=AuUNFmk*ToNu!wod^%F6l-{P|t%48qWF6}FGG?7A7Z0WvzUYT~IP3r5e
zLBnQ{yyZ*EHa!PFf4Z5T<3JN)zk@FYRQ;LeRt-0!#t+)qa#iQuXJCpp4cS8WPbs6z
zgazgdyr1Ptri4LiQ8DGz~5PVtdl!qZPsHj&|Zew1iUU|knfXrGAB;&Q@CmzaL#ul5TdKg3!EakX9WH7wN{sJSqL${eUIsyU*X8@
zt)y=v?uM_#W2dJNPwn^)X}i{nuY{>}Na69hv))pxYPYhF!mIKS%lfO&oA4bX(sD+)!K;CtFKml~(*+c3
zF3Ujw52lW|B`oxCcoNu$sU^lwv;@N>1-f4_Ro{L!DfX_de~o
za0-p4PY9l1DxNikhgG~{!Shg(IB^5^9H#=@TF
z1Aq4g?DDM`z$L($dXQC{IlJSHzw_*^KF*t}f-wL7N_}5~&!^49CHg;WfDwn|&Qx36;4&MJ>PkPfy-5T=WzEj`Nc~9_u8KME
zpyZ;`+5;$pvZ{P0mQ(cYUhQ-$MHhhajoRbxgspEs{1-%RT&_G?ir9H~g7kM*d5c>9
zMphJv1%s=SU*MY++GOvv?f#Y3K*xQEuYURwOcjv$z?73>uAExIgA*QC4?Ly^q-H#G
zTZNo|Qs2JCd`u0QU%AWbrXGJlS;jPU-dG1J-xuz}PTvN0bh#XduBkm5@uBA&cT7#4
zRc{A9vcYKJt^-$QmiGN37uiOCqVxrxBA*CojyvD$dl@X|bl%B6t80awi@sb2Me<%s
zsq${QBgBKc9(&Q}dPKkeI{7$;dyap#ff@7C>;oi?TQX=+hp(Z!<0$YuzvV9E3u0*7
z8U{53_-5g5H4M(bE8j5+ycX!dxf9#9Fs$2lOyzY`3W~c3@K$xE@3_QuHe9@-IW0f@
z7NuqPXDWw2*)#&V;2oZ)R|@76_u8aIO;|%li79u@ex*#UK6N+bQKe9zx^q3W=2K|d
zCsUE25NU5O*UO*~g9eahE$*+C$m9P78)WeCT?bE08PM}q+Mk-QYc=}ok~nVw`u;s5
zedv6??yJ}PYBF9NNp^2`3VLaPk(3Te{2Wz6ZaD3`3)?Hue^Xz~9@X`5VfQ~Eun<3p
z0yc50UAGK=qDpZE*YtOQ;SMyz1{1ZSP1MOrYgK%lXwGX(iGjy~0SqB{TT~-QBha3!
zSM$zAizs`#;HSN!t~72uvIGe!q`KmR+_AJOaE9jc
zuiu#M{Ip5U4$t)OmZP*e=6zJAw>AAD`X8XqCNS;e{$Jrqvy|S>yaMW%l0GDZOnh61
zo1E}vm4cQ4*TB0Zo6f4Uxpj3?c!mJLk`93YX82d^CiF=B-
zrB4j`PvCbMZl}=6Z$dItp2bxRKo1a})N-o$tcUrRxShi!M%*^tgBd9BtWe2cL4KO
zfoKMt4h>*=U%h$TLQO*RC;0Lk<0GwlAH8h{2kbXS089-LqVQ|hQhk7s>~+ts{;*LS
z&D6^ZY>M>5I=h(Iz0{h=5f!97pyzF7T2z3&ee0jaB-olH(`Yjvggl}f5)4*Anc0~m
zXjXyi8~;I_XTaIs+F;8Hg_W_}`2vMc%-9@z?)r!M(AT%r>}zNq{m35YF=!M6SW2mp
z^(@U$5Ve!Qg#AoGnHQ4*)9i&hrsOsjRp!OGz}4k#5B=SVf=4M3u5CbETeyXy@S_{R
z^cNq2#o#+b3TV{Ba&*x1Mclv8pz+|{1a8Ql9RoF1oY3?3J_I6^%A;VjW_ZwdKLquo
zwr@x#O`l%RG=B*l6vbVd|QB*{Sfcho!T?s^N<|)`vW{6pcVGhR=0`p_X9g13q$54LkXv|Mlbb|y24Vw
zzaAg?=9SsqR>=&}lP3K~f_p(?5q)Wwjw$sG@so7#<6hT)3OjWUu_&kSQdAAv5;N5u
zTEzhaT-crF-Bx|DD;jqZBzDrt9DsEv{K
zH^ZUJwF#a@$q!$vWw!lk$9xf}LvEM@iBn>eE<1~P+UL7B#x%=YU9qnXLVlWYSN$}C
z#`s=F=nqrW4+TXxeW~w$A655t#Kn4ip10M9AM-byz8J=N8xDzmbsD$P(r}jI1JVkH
ztN#HRHc9GOCzrlMH{_Wulu(0wrP#$0gtUxRW~*RU@=0$fIP*i885NqAkE}`#k#qBK
zY{OaQ{S4J$YxlhG$U@}jFCgL9t<0-?0{hPM1O$1%Yu#IT|HxJ89z6RP@L4_VpNh};
zQA$HF8+X@uxb26IggXE71Ws#$brA9ej9xX6WivHCcFU-+TXMbITA`?L2Dz5zm2Z@Q
zP1)3qQCwc^AFWk-n~Gp3u>>_E9Dlg3i@mLLr#yJd@_ixfrbz{mqL3R(XLl-sn>cI&s$S(R}X)szV)FZY42J
z%>j_DAFnqbP7Aj1L#Iw+pj>?1y9xtP=gUX2`yT}0+@Cqs(;*YQa&`1KE#d_QrzZET
z+m~E%9xD9hlR1jAiM~+rn)&!DvBjuJ#9t9SKJtDDjrY@k8)DuwuYz&Pl!}okYZ9Wu
zni*Z|DK*&Rfytby>;s~??tw|u&oWdNEsdFvtOqz_{w9Q)X|>H
zDmc$KqA7=iER=0#{f**@=%?i%KczObpMUKkPM!y=!i@OMZQ-
zPl@%R#5$Jj!<2hBfQ9Se*Qd0b8Ex~>L$nBrEoo=?Lp}5A)R+A=@m@QdCPvIQx5&}(
zE8L*&%Vw}TTV*tZlSD6ww7kiasoZY>2xMI7qbGZ0z8YFqG6oqF>NMG}}HUGtQP(vYA&cTk4Ce6oQ
z@~2h@5F0q!|jyIfOmC-Voa8O
z4&naOY}AcuZ0UvdmCM7ffsqdHuW*sZyEPr@Ywso9TPp%{4=!H#DS0LE-ZpLmVYT=27p3!ue%tF(oWMB{fjO9-|c94ZfD72w^q^2@@cP*8*xUdt)3H+op+-@0%wUr@msKYs{_}{t`a@-Ld)OO~
zfeonKLmQX7XKY{O4i;enWFwDqG$=>zw*W6zC#Y60f?_OK+9nXLK>%OLH3yastUUE^
z!-K_r={>*2pkwvUV~Uc_WPvX`7A1gul^0`goydXeo6-2bnZdG3_P4L9M?_~YK;U{6a&`=mry>?h@#b$#LIr>d%%6Kb|}jh${{a?4q8^Zdy9
zChMoI%O@3tSU*p?%F8D&%|m3**`CFRtJ~4n`o@GOw?nH5pKAO+%{d>mm+ogC3i}&f
z-c=m+k6YX6QpaUut=5p8o8N29F5fX@Z52C)CWE*^*d~U~V=+*B^LclfZjDB)(&!m;
zk2&&Vs(Vi98>Xk?Mx@bUSqp%d9cLjO5_ww5k3-;3*XEvvU#`d#^+;(OOGiV3XHkUiU=5X2zJ6-N6gi5m1DlDrQ#2+cv=(wzRH#R9v(*yp1iLl0s`>=4
zI*;!x!FL}CTaWCGoE{F#xcC|Crh$g*8!4v7^h%yq4>*>LB&LF0t<+?O=
z;u#I^7dOWC2n7a=IEeJ@eoKhRQSB)2=O(NB1AN>>g+MB~(7XJ@KPHN~RrgYh5FaS<
z&>r6wt19Ho?S|Ci^4Fvh`T&D6FeeoNXVM7IPTKjZ64TN*}4Z_)vvm}
zFc?vT=`7$35khzG)WwBQN96u1>&)6(xdlYi9<9)hc!#Y#ckrVxR*s$+oW3ArLUu(J
z{IOJ*2~yaUw23z2LRY6_s2NPGAeAe?#+3-kFTr|J7LK8>9dElg_Ph)Ld(?muWmB(|
zS|NSs;h#*wceGu;rz$2yKQvF;AKUG=Rq5zxtW*>n0#&
z=0N7FQD3j|@Rd%R;l$DRm_1MoN}Q?n5itvhYcVQ!?k7EL!ybR7AeCI&xVDx3l~_eq
zC&&up?XnB3>Kvsh{I0*24tHV0Z(u{_MR70Bj7oBibjUm@A;0z#C5)i~5&w=KD7u{c
zbCLk=@}u0RgYN!zE~|nf_h{J}s>KUB8Yp?*k5^j`B&{69&XQGB*@^s0%;3MN11t(~
zoTgwmE)6dquT{~4N(iW|R2Ft`y5YZmRuc@aKvao
zn4(C}j~p)@z{gGPe0!>$KULBqG65QXifu!@iJ9v`zFVSWKk}k~+2*U5cunvPTyg4s
zrp8)vf;T)GNRJH2#pinME_?){=NU?TIeJ;s(%8PramDN~sM4`vzRbQ5K`|=0DZaAr6sC7|K6Z!islm#p
zaJ)r-@{sxea_DKCdlWt#ZiD4Cj7(_3@wHLpsPXTpcjZYZ!p7EJW$h`9lj{Zg`_hKk
zwK$07gH&uY&B3n+DIW4wfXd%sd@ETRYj;tjDUWbhV{F;t^D!cI9QjGNyo!JSNjjbT
zxRZMJV3n6=`A;D@;B7rZlU^}t6T|#XX328{MJvGmBpPz|^az*N4)!>kJZs_O_`s&B
zx*UrfmHE}z&bTJ~J!CfxF0#iF-^0|w9Z?C5q09FcV5_G%yP1vA8M)v%%sd;UR~bM~
zh{cpW*>vhr*D~bv0w>?8)&G9eXZZGcGqf6YkJ7lNd@49u5o&lK)TAt!f&C`$zrr1y
z8V=?qu9?t3yt#iQf@?_4H57hN2`Lpm?*hV3eX2}q
zM*wXWlz2esV`1(lSLSmfXq2b9BhQnWI>g;2sA}n
zqZ>K+`0DujO;rp9MO3pr
zGZgI|ke3-f$~qtthRgukGYbKYp{_osRaY)SBqDEX3%WBAZ%*&(r35g56u*Rf{gry;
zqQ=xl)T80bky6xZON#gv2N0J|(_xQo>%?+4(sS^>WO&4-wZE3cilHycDAi(k8pagy
z{9~(=Hv||fI?t^tb4?yT<9CaBZ4NyG%y>ubcaT^
zf4C~2oOlTjTI7`pYo!&rU&d+z@GZGS%zg6`vr3|BU299d0~mkqB6*P$mc3l)a>1ka
z0;;VgQa{#TzPi`qFkyE!E?Nf96TelOGNQ&Ty>>gO6=!zAL0nkS)^TP^9@_OtkNEfv
zI=TRodUH|3#5F7FKo|AKrkO+=E$=GT@sz(>ZTX+v#=W^E*@p0VUaM_uKShx6DT>wo
zBiE)svV%?!u#kJQ6DNCw_wrv?3i2Qh<)TNN-3EO!*8PYW>99T)Em1V`-KBr8CR
zVS%!|!CkSJfVz_qmKRpQWHb+1YLFkvBJSrUn>BnHwfoP-8bc=nU)~tseoWc@suzzu
z7u(K3tG{JKQ=gj!C!n!1+Vp;`O{aeG7_&u6~#Y`gPM2q;h{@5wPD?^DOXDNa6W6;Vfas?&+Z
zS87(>S~TlPTtu!>&wNN7S53>#Tvwtxt%KARR^&L#*QJHmQE36m0rcTLRKl^=5;s(~
z?#c3-RNfY-)7frAMF_!EpNvurdpwdk=alIv`B#B+LwJ`VeejwS&ckpe3NiZHz-KNe;QsY(G4a@_BF+!!`h3SYUyH|kEy+(j&4ZnTf=MR7%?kD-I<(shIcIga{&otu3igJ$C#B##H<%5NH0NWP(*MdB
z!b}W?K6yf`L@#X9N!v8W0d|zco@2rwy<<(vHM=*HKB*iNMg18MoRd$2c#2s4t$(y$
zBL0&W(1j&1JshZbrm!CVZqP7UY3&8TDrl$`dNF`RtX)Ul6PJ5=cmq}xOkQ|y_20kghbd)nTh
z?@Tj?koHP$U*Rlg;QuYhRAK_ZUT3Ae_ppRJ`sx|NLNnDl06?cA8-Dz)Ygpt?Kt>-%
zHm4?CPGe;etfG?K;EWqe32w`4j10}3N+MVnB}g_b;POxiwK9$TC#iSSN8cSc?|*Bm
zK3liE_Y0k^cAG>J`u9L#e2jR(yGU({(fP9nq*jw)BsTKm?;n@SL!-7i{HF;*hK}Cp
zWb|hEY91BNJnn)ObM%rJzA!(RoWW&5pjrNXvWR?AIrS>2#nDz?;u-z
zYmLmml;hK|#<-l^b?gQo>yc$D^F1+*UZ@u`Tqxqhlg8eEn0Ik5JoW<*MpqXl
zRHcMo#~uok+0c)mC3=VWe5|fe$T7kJvNBSp%Xw2
zer=Fv;Hpx&t!CD$QvMNAD*(JCC}9LEcX#2Djyr3(r1zckb~#eNFHB>%@%cuaVr1Y=
z#tN=9*F^_scXMNFuT;HcBx@SLtaZ2`8L8{J-+u)BAob!Q*HEqz^YD=c6OU<>?=6xh
zKb{r<$x%f+FV4W9K%8_c2}T#Fz*g^#Uk~`lnoi0dCtFSEzIFw=XLrUBLUfC?(Kh{@
zaE&on=8=?y>eKj>dKM}^NBUY+s`66uL=7C2Va1yX^db4!8aztgv3P6EMK5j(r;pX1Ma%oLCP^r_1yDvQb0QjHAuNT9p*IIJIHHD+{IYh-V
zYo(hfxXb484K~W)7rhxNpvST_v#GuFv1wOaT5gsRFt}8|CQY|{N3)K
z;QEtx#5m}ocmHIFIYHqHT3Tpz;QX6&f4Lanv_HFPDVqBp8H?b!rA-L+ro+GLp=4`>pcdRCG4YhYRHx+HfM*Mq@t&0GtYX2auV(lNa}R9xhI#
zH2l6f={8fhV0-oZvTu?b-Y+1t5*6OmL2oHTzK?(CSjGLCJ5Y7nA}z*~C;XN9-dZ_r
zK%w|eetfX4fV^*fI1exRKD_YLIvj5yi<;ihpAoF5Vc_b)HM&J{TYD=A{D5b!Tl7AJ
zl4d83xW;b;&BwIF$KCM$LW_mz|DOd|i`^VE8fTgh#+kaoT~^JWA^XVU>2P^;EYTK<
zZ>gPGUoL}l`|O?WDuGUT^-PV{nT;d#W!oEH_L&c7wK1}lI{q*udFNfwcuOmZXo+|_
zoRrJlW8?oc{414(S}d7SO8xcS?s-45cJQ(=Qfgol5gn(E`-@jv2G9mHLW0ILjXo
zjJ!$5m&c1FBRDOiCTz_kU^O-=1JfYbo<8+3-kf_8t|R{C@jqG8H)V(F{SScQ2~!;m
zTzh4s6-T;w`q3^qpMTYKA1}6o_^qvf$zeb$0qa3}uMU(K0FVTFeZnVl*hTZ@z~4?6U3Pf2vYE64G>
zXG%s1ko%4MxZ8(U;fVZ&Ru|Eky`z~`6ijWvtMLw?ncBHht9yUYFA(@wKnvQq=dn7}
z4h!JA_S#3bn-Kbqpxds#c^^609kC4{lKzLLv;J%H```FLkWT3ypp;1YreV@x5YnP_
zDJk8fH#(%07%56fO2a_9L6nA3GP+^F*!JD$hwp!|-H&tM=bYL@X&>n+aqq}
zQ^4R+(gZLI6K>gTw*2A5(7do{$F~_H^>TDw}SIoz1j<
zM?yF&TX7XixbVH%@FbVvjy%1ZeMRo85up5FlC~ah+08txsM~|ocQ|qU4Fr4N-rJ}A
zwq*uaLd5tmZH{m5tp4a-(l)%SN_u;NPUeM|s$gqW{ryDGsNA|qBHS>uXc_eeR@K`p
zh7GdTNfBR=9jcsUfyuuuv^gxlGR?g;Gl-UAlwfVeox{_~Ub?Y}I_5Z#@TSm8Lx)4G
z?IR1KxAh4wP~ke;7P6r5Zs*Bc&Bj`?U7b-nkLBlf`jU=+I8VCFdn^yW@ezn{^ajY&
zfMlF+{r=FXVS3(l=je6ozy5_3!DrXL*gQgi>zCazWT>b99YpH8e%h@z)JOM2;6&L+
z2Nb<#Y^k*%;lVdQQv>|>L4+Q9NNCQXdhkP&{K_FC>1iCxlnOsf6}*C#MS@V0(YBxR
zuS$rc*G{cYHDF?)LDZy3CgN!#(H=gbUTc0vm*pZATtOhY)~ge6&D!7;^v3i<~NFa
z0zP8J!!zF`LzRegg<>bD7_-AXzXzbL;D<;`5!?Mj*gU}L0CQMKr-}?;O3>JuIQnh*
z)V{rGukd9I(QfI_F1fl3)^=1Y@Q-Z)4e(bR{=6t6m~hG1_kz+Ao{Wi8LR6$?9-Fu^
zj_SSE91Hs@xa@!djw%1=14R`xKKnseIoW6jD9Pu!Y&*H#_S&Mgh=pjoeZ|fF1Tg^$
zx&^-Kw%P1IPxEi)Etv~SKP)rQ`tr4oP?j0=)Lep{hTsEP+LC_cp|CxSLv5l@7%@lA
z(XrdRa?Lf|+B4Kq`@=IqNSA>Im+v}obHqvCT`r^Y7oP@5=c6DpI-Ft-
zKdjdIV){|HI9LfEgw(h$fXnOw3+i$CP%Tb%lta74(#I{U`2<(#Nj%BRvnSv6bD_gSzlICM^*KrN
zz=uAR+Wk^(@UnZ
zPT}eDB)X}T<^j#V@qe=U)WlItqo3PKBP=8HC{YI3+C|W>$fecsD0@7^5HzOr64k+Y
zx)w}J(*>;v6I-*B$Tvcf%t}=G|0v@7kK)28(P4qw{B&RXj&=@gC0ZMQbWE7e#M9iF`+
z?@FepXKMGpz8{$ybpNz@iH_!TX^xU?`+R_#-RTA>q%Hsn>N2eA3ikcDe^PynQSMmc
z>UYeU=uwO1(s+Im7V>rfNr#U?qvkY+xY`AK$hwkq#EHA@vX7`Gh25
zxW)ul^CiOB>reW16`|~(T`v++yQ_vh^czBRj}vcJtX%WGA1ebSK6!%%;kV|0>m_~_l#)+kr=SA|r|R=}>x(zn4M
zQb7s6vI9Hkb!Vi%Z=!}vBsu^7bJAXzoTn>+^&P>-5$ji8d-`QZwb74hcdR_sEsX8q0LNhOv+}+3&gfu?*5G*=Q}|b)O-6Hc%rZeLLFOH2GuRlQd$4o$W)7WC=Apv0lELOe_M1bQ8+G7
ztFgh)^IK`rdner6TtcYIdsc33R5!y-d|{m&!!bf3g!YuSuUiVpP@Gxn@1311)2LbZ
zUan~4v67OHDY0+LYJWD4zLVf)w}M_~FP^ujb%k==ERG|>$WEt;OK(bS=fD){#0qJ+
zk$A@0w*TDwOyhDfva$5CU9nR$kJrobDk%rCSW$GkhLHyxrNUwJ>?7kwKZ<8*gXip(
zXon<10mKxA|HS8su(j)XoK+v-KO?LN*hWd-<|06
zg!c5C17Roem}`1>(HN7Y1WBrg$s=42P#T*V;w@nk5x4%8_^ic3`U>6{J3hQ
zw7N@5JN#WjMhi1-wP^eub{_RJv2-4tnI7?9B4uXvP?0AojTHS=)6n=RTbb&8H9GVyWF#~!5+)SVfOcYb;Wo2)
zdxOo~7zTyZo1xa)HfGb}@nP-TVHMm}$25*fJzF6)%7vzQE+4zn^yH
zQ)M8HW)80;?iBmO-Z$HvHFKW|PyqCJ%;B^PIBBQfs}i(%tF2mhL0rF
z!$UzEFlIb6m}WPJrVY%jJ^^dP%0Y3*&(4CP(4l?Rr?eY~4|;-PX-9UM4O};s`;JXZ
z)-ExE;&(-3XzqQzgj42!TtM7%M2H@WFLW2Wq#(lkxk?=TPE>a+#a@CP-NEs{JmMEB
z3KJUO7cqfs^JTGq%OTN}Up8bTLJY(Fylh2G|H>|P4`sz0^ylwMl|YFh8K(J?~#
zErs1wcFS*VHqg=~H9ZWkXq)iyjRqwjs;SP;db3RbeesR(oNZ(zh?6+Y8-GcB6Y?Y^
z%suA(O>~A)C1Dd54!kQGM>~kZch2@vGhAWAc*r?|=3Ly8DOntDNA2lmCcV
ze=Z%OA3%>*HK!i7({aBHMVM?o=R_&}Rq+sa*q>HfiDYP1+i|DSC@>Y~w|0%OIzoEq
zXUqB60*Mq-U4t2VzJQWzuF&L3o!<>toAV_zdL{ZUN8IEh9{H8>zuZ#&Lki@evTfwB
z-tp&)j=_p83`;fOxJ#!~E@C^Ou-tne03I|sby`(}^SZ
zx_zwWwQp&ZW<6Xux&m(%dFrM_!h|`MAe!XOyGagIK4h9xIYC&id|GKCQi~26V;u??a4ox5dwp@}-q&yi
zZ11ZG8`RJI{8OInQfEIxCVnel&bykVU>xypTRG+W1gKa)Vu`vj-)hla;A>bpRyo^A
zMRzG(hxP8CDydlH%McrUrN-Gm2?kz3%=Bgtq15-&@@@(0%>_=$2&;KN^etL7!MvCK
z!^j_|!sFxZ3)F50xcYiu?|}SDufblo_q-Ri{?!3irZ0!MR%1iDxAk6JGRF|C8M{C3
zF=a{l{dT|tFpq`Pa6`E$w>`@7em7DP<=`~e#`sB2sMfJcToT&Z)g{|vm8zt#a1%9tQ%y%O{X$j;&xbd}yxrK3!?P+-dbqyi054!lHd
z;-Sj4G>BGJWMTI9K`ZQ-Xfq#Z+F9-4Im6eHQATeSC^#rbD0
zolhp^BdKR&g70I6U?OT2y7EV=9(SZWR??yc(v>)u(ef*6H={{VzBS&Tw7Y;B7?THF
zI?;5Spliow04xvgTCcrHSr>)j!ehP|F>W|m|4wKw#HEx5y{75QbCQ7X_|k*R)UW
z)dI_SY?Z~fY4xLsJk_=vH|<#~&tM+_B0KOiy4AQ{s9AYoqJ$e^C34sCfwm=Ib0joT
zr~Bu0LO`!q$dvzQb`uo``DDy1Qg%18hlbaE>3{s2);1p+jr-h}%jSO8)Ju)xWa`k?
zSRSs!9s0muqXuaoHx)fwl2(kaSP&jPA+VkiI8wChlH7bYK#HVXf^7@lz`?3N_~l`xW}qp^-|x27ilX@
zfL%@dM+OaI{@JIw#?TPc#&8$?1I*ILKGvyCU=sGx=!`$OOMx~vX
zSCx>18_3r_qVQBv*XV)BW<19SdWdlso1$hOlQc8Lt$tBue-a?DY9kMweAb8x<*?a+
zM=*TB&+J0`Xw{(o^94+DsF`h86x2cHbypQIM2?-;&!{yOvvan<(&O|s_8b|#T%`)C
zrf&ZxaFR)dUQsyqha({MF1;AVL`i%VxKxW)s^K2*dxEtbfSMq_OgF{B6TfjN?yUyX
z6vtd1VX95z#z6?BV1gBROu$2@|KoMciW2ALvJ8*);h!U6bzDdXCF-u4Q`o0h1bOrTUH2qpj{ijkqyc%eFj1_^gq&F_*acb>30yuE6%qSp%Q8
zzf_4mi_o2yU3j~{7C@2N3_up6II{bs`@QPIYB
zLCS@$KZtk5Xw{)3EhcRj^;Z9`PY!bej#T}fNH)eT3;-Y4&&m$9x_UFnk3FjfdY@Z}
zJG1R-kMp>_;u2M@cjnk_pUn>7u>mc;pAYlnQ@Z6U_2B+xid&7nUeZ(qPw2paud1{n
zmfQs8y6MZ@%v1*+`#+l1!doZ~E~THJEv{j^@L-=u7K@_Fe$pW`y?{)7T{}_yW6FnPk<8!`;pg
z0bh(0E~dUc-l7~@pyp`l+aUr~5zC~BSc<`;L?7HZ>O-hBfH^rt;q4?OAaAUL4wd>PHDdjH%#}58)fWFh1a0TI&LAf5gmP6s_W-OY*?HX$
z{FAUVUm+&iUB@o;)kf1smvk_Xpf=;ikm$qw`KAKH9a|(T2(ojqk5^J7MLz3w5O5rU
zrI1z%YS3uHV4>HAGXaxZ6fw*!JP8`#Brx`
z?q@DwhLx-;u}pdIZD)X$lrp7G-xbe6M4mTQ>jVAQ9La~jBl~8#_X{V>j$`a-@&;Rr%pj<
zpPuU7uq~sud%Hds`T$vDZmBM7oPWu4>;1q$W-n)al96JPZ*XpN=za5Cwa8`2QXF=l
zWm~V-rpY%`+EC~s>-;8Zeju$>tXD%H#)5>%WrB#OUCetKjflP2;}oRr;27Ss(@r@Mpt2GC%Vh=eFmFoUmd_a;
z3}d*)5Tzf_d}CaXI#OcdeTQK^LkyaQR;_FpX3g6}U(f(s<#(^n4eWz6>;Q6C<>WY5
zCV({TMP^olZ+=Y?Y`zvnwgl}Tv+4(Zmb{;~YA@&?yFp(NR}I>w7_)956E&>m08Fgh
z6Z^W0;`j{|Bss-fkTx5ouH`5J;H*gQRd0GZZ6%PmZdfvg#=3Z`sAXYPt1heB(Yu;f8`{zGR4UK*B?$1$^nf*#tG8LL
zj?0{ex2u!JI47UKpy2R^eV1*V{!4aiXaJM3yQ@aq)>Cp)D^1-$?>8J
zsIf^4?o^19y}q{44OJEZKOrI2q6OCqTUR>g^zji>^4xN%>+U>!%Y7h<3VCIYW2v{2
z;py@cQ0B2#(l)$ko+pC($s@!8v%+BL3O5CB5-(R^?h@`&@LK~bvAb!zRKbHPFwu0}
zv@UlS%!h@gsgB}d&s%jJITM2xiUn0eGBoRb7Qf=c!iW6TnipIQ*sEVyFp<@y=&Kq*lAFuFB
zTDev09k%gC8_!P**!eF+q1_vrO-<`zRXPPf#pVmz?C=*ue2)%(*|N@<((ob9vsZ!>
zc@XF2r^BE1iauZ|jzYcpE#^L2w$g9(#-F_Ji-J8Pj!tO_MTGBcWGv0BLT~KmKAnZM
zfVTA{U@ydyPIKqaD@MWWi+qlH7NG;cf^>Md6KR}mf8%`Kwy}H0ht&pD0@Xv>kXCrxQP
zQZ6rBwgw#E)W|>WmqIE?+d-?vO(@0=229Oe)ki8WiC4Axt}wE%-No8E-y{(2JW>>8
zS3+*#32iinvBne~nmryHz%NxatCfP&|DJ7iXwt0X*{OF{ndEUC!FG3kfay7#5RYG%
z&@0N~5XD}U=>klCR#L!A$ye|~8Y~BJ-DI`zaMjKOHT_a_$yca#MWaD6
z7o1VO4Sh+%v=-8_29I!`hR8nBq+5`r*&*qFtBr>zu6xuWU2d0%x2lw(d4EaLl0VYP
zRp|0KEr?g|ra6%8CsCsHNhGihebq>^=C9QO_t5oAHTmuobUXPH~xX+Fk34i5*c6clN2etLCATc7!>E5Qz${di-0$5QB+{Wp%EoNzh9wWjNL
zg9JfJ1sS+?qB;MleRo-H$OI3#ama3|V?CXsf`Vgii+(cX^z}k%*6($1qoiQJp7cfG
zmtH?z$2o%M)Q|&TNW7m4+VZpCJT8_Xb;G8bOu9TdC6n>p0r_6f4A32%%?#s%89})R&bJ-V=V$KGF5E!O_5Uab-(>9G%oCFva||u8_un&%;9q5goAUebn5)R
zSgN(QOF=)`MB}eI9R#Owc_rSAHGgRR_Ud6w-7nn@jA-3i=bo@V?#=&u0d8WI606s0
z^Q<{H5tRx6*W28OW0b%zLTb+h@PgHQO2X`X>H$UXPV0j^KeO)-*B#f`@4P{)fox%e
z)k8V*i8+Wl{hF~FUV(G23_SXhgP`olfV^)XK)}Kgo3QL~}_a~=v{}}8QK2)Q=j2deBVl^Yze}b$ytINcsL^vnBgLkSW_ApK00K`^X
zw}2D7A(o{tfw=v!E|L{@|8*>@+nj-Ud6PDm1F(B+A`d%Urarqjc7-(Qh~U##GC`PH(3e3O#ZYWLdrWE1n`
z{CUhBCm>1J@!@ZSxstiI6hlafEo7#LN}4uBCX;8{lucu|K4f(-yW)_A_G1Y{a_6*O
ztFM47XFz)tr{8%O0;sbe{+5FC@k*J^U&!&LWh0vOa*3LMMl_uHzAqJdknD9R2aTM$
zE`3u4#OPKcbZM%enrAhTxlQZS5zZEP_L}E%QAhbpry-rSBdz^{CIH{8W6o
z3HveR#Gle?*v@UL>a|A<8h0Q8&Kf*@MuR&Hr)wr$g=JVxq
zw88#YQ1Kd7#?+-1ko%vGImgzpAB{F!B>Lk<~IS3@eyI5jJn@D
zJB8=rE#Y?>dd1xchi05_RnL|$a~JO5O*7KvG_!m&Am6&X8r>{-{p5Fofd0vCyZiFL
z2^8sXDKGvvbDY*LzDnP*GA^wCTs^1UnkZ`tWx!izr9PtY!%$I6J3*=Zr?=PDg<{Ct
z%4HOtIuf7fc8oGQqS;Q-2>D)V?M1*9wzArPQCsWwL4c94JO7%iW!zHMDc0`b&X~q}
zp6;3R%g?rNALTjGDeh5x3&B+mNu0=}Zus_dPAQ&U=Ip-A!KXJX(>4crgq{Eie3{6?
z4K_GBjUksX2`yg%Uh7eHs`nE1vd44NF$`bd?a)JD9$v7_q_a@N4;*Oa?-2Q7tzG{$ZO9uN~(pjb0#JJ$o$UhtjGfzzjkZf07btnnbl+S;rlQ`rM
zg=@#JPtLVlEm9aVVLWBWTpQQwBW;!T-~K7O?2C0iAX`>JotvO;HpUR(67P0aD_0p}
zd52QRXZ{-^;Wg`@7VoD~f;m_#g!bRhVV(~DFz&gUnipvPBpa4a-;G}e(Y>oPLB&2B
zz<$kB@eHBc*AwB+Rd?e*VVqmpVuww*{2j{!t%-ArA)q(i?gQp!_zTIJBE{RZ2X4fx
zI?{+xX+zCR8~$F@M&LS-A6a=plvLKr)g0?0$chw9+F`w)&?Mw_BtB2)?UxlEAdpUB
zO81Impw|(U?EEMT97en4k%;v`|AzQ@s+HD0H+E@exGJ3-274`O`5wS;)E}#qE`R7F
z435%%#KwO?j`H5g`?(i<9#}fU_o7%XGLjNs$~O}gpl#KjQr+e9{Fk}HuAR`8M^y*K
zqzi@WbJ@i70KYW@@)7iVAKPKC5@^AJR8$O?rld`|!r~Cru3IzDcP~a|&0~qG%X;zs;fFRBpgEHA*kWM4K=aJ76Tc2bM*(9|GnNjRimM>j^&FRY!Y
zbI4jDCbBCy?b(|sh*?8CENr^rY?D~z;WyrJA
zDj~qns^*D8st90F>t8&{fP5nh+cFBH#?UAJEiltf8$TJow%Wu}U~`ITYL9&6@vC}f
zp|%p4n;)N9{H$z67z~5Ow?eWl{~$I~1h2VXUlnLEN+5bgMDiPTK@MTB-9@GnnHD7g
zt^`pOM^=>;W{`kgxvj>De9WxtGUaP@P42z6nfy^U^~pJX4K#D=Zw!D~%HI3;!Nil<<{Dn_dkC8N<(JySHBP;*N~$M<+%Jhir98ObgJ_C6|qDE8AZWmTTT
z{+%`ik#G$6VVIsK+p1-K2*%Bxv1rAqQ=F>gmo-vHgfvLR=F#XCzr>zvA9qAX%2Ip?
z((+cV@BWMh-D#Wi#!Goz$Cw2vUpY;fk|E~>4lGN`U;z~c@;j;t^O$Z
zWlBf+sKWz-K2n3GC?@)B2=!ShN2gXw(@hSlg_gYA@*NXgg3HZ%V84k2Li!F-eu@{~
zfuP`J*3bE_o=Fd&Oxq>F@115L5VDmhNN^{`?leixXTXVjAF^7wd;z_E;n8UEOAG(n
zY))Y3gs!;_2vLMv*@`L78;az8VKl}B+qK5Mp&V*WvkihmTboA>e1dC@7x$4$pU{RR
zp!ZHU^$&KNAyc96qI~cjmQ3YmBEeQsd59#!$fcF}2tE5oKrOL|N&7Lknxsovu%E2#
z5~`t-DcNp_THeGTN~j7=(ZlO*OITyhNeCx)#whOkUk*j3k8+zmnE_n+wJMj@Nh{q*4KJZtUjg4^l|$;!uFR!{|3?@fh%k!Oj)A`2
znGIr+$X7_KZF=^((`Dik(r7QvGoT;4a%=$8M~_u$C?JTG*hdT)a{w5L4w|FraV^ILT3f59-Gr5#8i=oA&gje0=)`j_A~`TTYauNC6VOzh5EITcTYj
zAIqS#?^aJoHouJFHsl%gIs%W7Ql&G~Hezb<@DBmnl~87(A0m8nc210|QI_sc)NDDE
z>r!2WO4wN?n}KBu=_avh>)w