From ee664b673314547ad7a86559fb1669f1785ecdf1 Mon Sep 17 00:00:00 2001 From: Kevin Thomas Date: Sat, 9 May 2026 11:42:33 -0400 Subject: [PATCH] Updated WEEK04 --- .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables-a.c | 2 +- .../CMakeLists.txt | 18 +- .../pico_sdk_import.cmake | 0 .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables-b.c | 2 +- .../CMakeLists.txt | 18 +- .../pico_sdk_import.cmake | 0 .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables-c.c | 2 +- .../CMakeLists.txt | 18 +- .../pico_sdk_import.cmake | 0 .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables-d.c | 2 +- .../CMakeLists.txt | 57 + .../pico_sdk_import.cmake | 0 .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables-e.c | 2 +- .../CMakeLists.txt | 57 + .../pico_sdk_import.cmake | 0 .../.gitignore | 0 .../.vscode/c_cpp_properties.json | 0 .../.vscode/cmake-kits.json | 0 .../.vscode/extensions.json | 0 .../.vscode/launch.json | 0 .../.vscode/settings.json | 0 .../.vscode/tasks.json | 0 .../0x0008_uninitialized-variables.c | 2 +- .../CMakeLists.txt | 18 +- .../pico_sdk_import.cmake | 0 0x0008_unitialized-variables-e/CMakeLists.txt | 57 - 0x0008_unitialized-variables/CMakeLists.txt | 57 - README.md | 150 -- WEEK01/WEEK01-01-S.md | 41 - WEEK01/WEEK01-01.md | 122 -- WEEK01/WEEK01-02-S.md | 56 - WEEK01/WEEK01-02.md | 162 -- WEEK01/WEEK01-03-S.md | 60 - WEEK01/WEEK01-03.md | 190 -- WEEK01/WEEK01-04-S.md | 72 - WEEK01/WEEK01-04.md | 360 ---- WEEK01/WEEK01.md | 185 +- WEEK02/WEEK02-01-S.md | 41 - WEEK02/WEEK02-01.md | 104 - WEEK02/WEEK02-02-S.md | 38 - WEEK02/WEEK02-02.md | 91 - WEEK02/WEEK02-03-S.md | 54 - WEEK02/WEEK02-03.md | 82 - WEEK02/WEEK02-04-S.md | 58 - WEEK02/WEEK02-04.md | 71 - WEEK02/WEEK02.md | 156 +- WEEK03/WEEK03-01-S.md | 47 - WEEK03/WEEK03-01.md | 130 -- WEEK03/WEEK03-02-S.md | 76 - WEEK03/WEEK03-02.md | 167 -- WEEK03/WEEK03-03-S.md | 78 - WEEK03/WEEK03-03.md | 209 -- WEEK03/WEEK03-04-S.md | 94 - WEEK03/WEEK03-04.md | 238 --- WEEK03/WEEK03.md | 436 ++-- WEEK04/WEEK04-01-S.md | 63 - WEEK04/WEEK04-01.md | 241 --- WEEK04/WEEK04-02-S.md | 53 - WEEK04/WEEK04-02.md | 220 -- WEEK04/WEEK04-03-S.md | 97 - WEEK04/WEEK04-03.md | 270 --- WEEK04/WEEK04-04-S.md | 102 - WEEK04/WEEK04-04.md | 345 --- WEEK04/WEEK04-SLIDES.pdf | Bin 565359 -> 565375 bytes WEEK04/WEEK04.md | 1860 ++++++++--------- WEEK04/slides/WEEK04-IMG00.svg | 79 + WEEK04/slides/WEEK04-IMG01.svg | 96 + WEEK04/slides/WEEK04-IMG02.svg | 86 + WEEK04/slides/WEEK04-IMG03.svg | 63 + WEEK04/slides/WEEK04-IMG04.svg | 79 + WEEK04/slides/WEEK04-IMG05.svg | 79 + WEEK04/slides/WEEK04-IMG06.svg | 77 + WEEK04/slides/WEEK04-IMG07.svg | 86 + WEEK04/slides/WEEK04-IMG08.svg | 99 + WEEK04/slides/WEEK04-IMG09.svg | 78 + WEEK04/slides/WEEK04-IMG10.svg | 119 ++ WEEK05/WEEK05-01-S.md | 63 - WEEK05/WEEK05-01.md | 271 --- WEEK05/WEEK05-02-S.md | 73 - WEEK05/WEEK05-02.md | 173 -- WEEK05/WEEK05-03-S.md | 70 - WEEK05/WEEK05-03.md | 277 --- WEEK05/WEEK05-04-S.md | 70 - WEEK05/WEEK05-04.md | 217 -- WEEK05/WEEK05.md | 426 ++-- WEEK06/WEEK06-01-S.md | 53 - WEEK06/WEEK06-01.md | 157 -- WEEK06/WEEK06-02-S.md | 63 - WEEK06/WEEK06-02.md | 187 -- WEEK06/WEEK06-03-S.md | 57 - WEEK06/WEEK06-03.md | 183 -- WEEK06/WEEK06-04-S.md | 60 - WEEK06/WEEK06-04.md | 193 -- WEEK06/WEEK06.md | 451 ++-- WEEK07/WEEK07-01-S.md | 91 - WEEK07/WEEK07-01.md | 205 -- WEEK07/WEEK07-02-S.md | 68 - WEEK07/WEEK07-02.md | 157 -- WEEK07/WEEK07-03-S.md | 91 - WEEK07/WEEK07-03.md | 206 -- WEEK07/WEEK07-04-S.md | 96 - WEEK07/WEEK07-04.md | 148 -- WEEK07/WEEK07.md | 549 +++-- WEEK09/WEEK09-01-S.md | 66 - WEEK09/WEEK09-01.md | 141 -- WEEK09/WEEK09-02-S.md | 66 - WEEK09/WEEK09-02.md | 136 -- WEEK09/WEEK09-03-S.md | 74 - WEEK09/WEEK09-03.md | 152 -- WEEK09/WEEK09-04-S.md | 72 - WEEK09/WEEK09-04.md | 140 -- WEEK09/WEEK09.md | 613 +++--- WEEK10/WEEK10-01-S.md | 57 - WEEK10/WEEK10-01.md | 155 -- WEEK10/WEEK10-02-S.md | 64 - WEEK10/WEEK10-02.md | 159 -- WEEK10/WEEK10-03-S.md | 49 - WEEK10/WEEK10-03.md | 141 -- WEEK10/WEEK10-04-S.md | 56 - WEEK10/WEEK10-04.md | 144 -- WEEK10/WEEK10.md | 651 +++--- WEEK11/WEEK11-01-S.md | 66 - WEEK11/WEEK11-01.md | 156 -- WEEK11/WEEK11-02-S.md | 62 - WEEK11/WEEK11-02.md | 144 -- WEEK11/WEEK11-03-S.md | 70 - WEEK11/WEEK11-03.md | 150 -- WEEK11/WEEK11-04-S.md | 60 - WEEK11/WEEK11-04.md | 146 -- WEEK11/WEEK11.md | 743 ++++--- 165 files changed, 3952 insertions(+), 13308 deletions(-) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.gitignore (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables-a/0x0008_unitialized-variables-a.c => 0x0008_uninitialized-variables-a/0x0008_uninitialized-variables-a.c (97%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/CMakeLists.txt (67%) rename {0x0008_unitialized-variables-a => 0x0008_uninitialized-variables-a}/pico_sdk_import.cmake (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.gitignore (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables-b/0x0008_unitialized-variables-b.c => 0x0008_uninitialized-variables-b/0x0008_uninitialized-variables-b.c (98%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-b}/CMakeLists.txt (67%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-b}/pico_sdk_import.cmake (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.gitignore (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables-c/0x0008_unitialized-variables-c.c => 0x0008_uninitialized-variables-c/0x0008_uninitialized-variables-c.c (98%) rename {0x0008_unitialized-variables-b => 0x0008_uninitialized-variables-c}/CMakeLists.txt (67%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables-c}/pico_sdk_import.cmake (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.gitignore (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables-d/0x0008_unitialized-variables-d.c => 0x0008_uninitialized-variables-d/0x0008_uninitialized-variables-d.c (99%) create mode 100644 0x0008_uninitialized-variables-d/CMakeLists.txt rename {0x0008_unitialized-variables-d => 0x0008_uninitialized-variables-d}/pico_sdk_import.cmake (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.gitignore (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables-e/0x0008_unitialized-variables-e.c => 0x0008_uninitialized-variables-e/0x0008_uninitialized-variables-e.c (99%) create mode 100644 0x0008_uninitialized-variables-e/CMakeLists.txt rename {0x0008_unitialized-variables-e => 0x0008_uninitialized-variables-e}/pico_sdk_import.cmake (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.gitignore (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/c_cpp_properties.json (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/cmake-kits.json (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/extensions.json (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/launch.json (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/settings.json (100%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/.vscode/tasks.json (100%) rename 0x0008_unitialized-variables/0x0008_unitialized-variables.c => 0x0008_uninitialized-variables/0x0008_uninitialized-variables.c (98%) rename {0x0008_unitialized-variables-c => 0x0008_uninitialized-variables}/CMakeLists.txt (68%) rename {0x0008_unitialized-variables => 0x0008_uninitialized-variables}/pico_sdk_import.cmake (100%) delete mode 100644 0x0008_unitialized-variables-e/CMakeLists.txt delete mode 100644 0x0008_unitialized-variables/CMakeLists.txt delete mode 100644 WEEK01/WEEK01-01-S.md delete mode 100644 WEEK01/WEEK01-01.md delete mode 100644 WEEK01/WEEK01-02-S.md delete mode 100644 WEEK01/WEEK01-02.md delete mode 100644 WEEK01/WEEK01-03-S.md delete mode 100644 WEEK01/WEEK01-03.md delete mode 100644 WEEK01/WEEK01-04-S.md delete mode 100644 WEEK01/WEEK01-04.md delete mode 100644 WEEK02/WEEK02-01-S.md delete mode 100644 WEEK02/WEEK02-01.md delete mode 100644 WEEK02/WEEK02-02-S.md delete mode 100644 WEEK02/WEEK02-02.md delete mode 100644 WEEK02/WEEK02-03-S.md delete mode 100644 WEEK02/WEEK02-03.md delete mode 100644 WEEK02/WEEK02-04-S.md delete mode 100644 WEEK02/WEEK02-04.md delete mode 100644 WEEK03/WEEK03-01-S.md delete mode 100644 WEEK03/WEEK03-01.md delete mode 100644 WEEK03/WEEK03-02-S.md delete mode 100644 WEEK03/WEEK03-02.md delete mode 100644 WEEK03/WEEK03-03-S.md delete mode 100644 WEEK03/WEEK03-03.md delete mode 100644 WEEK03/WEEK03-04-S.md delete mode 100644 WEEK03/WEEK03-04.md delete mode 100644 WEEK04/WEEK04-01-S.md delete mode 100644 WEEK04/WEEK04-01.md delete mode 100644 WEEK04/WEEK04-02-S.md delete mode 100644 WEEK04/WEEK04-02.md delete mode 100644 WEEK04/WEEK04-03-S.md delete mode 100644 WEEK04/WEEK04-03.md delete mode 100644 WEEK04/WEEK04-04-S.md delete mode 100644 WEEK04/WEEK04-04.md create mode 100644 WEEK04/slides/WEEK04-IMG00.svg create mode 100644 WEEK04/slides/WEEK04-IMG01.svg create mode 100644 WEEK04/slides/WEEK04-IMG02.svg create mode 100644 WEEK04/slides/WEEK04-IMG03.svg create mode 100644 WEEK04/slides/WEEK04-IMG04.svg create mode 100644 WEEK04/slides/WEEK04-IMG05.svg create mode 100644 WEEK04/slides/WEEK04-IMG06.svg create mode 100644 WEEK04/slides/WEEK04-IMG07.svg create mode 100644 WEEK04/slides/WEEK04-IMG08.svg create mode 100644 WEEK04/slides/WEEK04-IMG09.svg create mode 100644 WEEK04/slides/WEEK04-IMG10.svg delete mode 100644 WEEK05/WEEK05-01-S.md delete mode 100644 WEEK05/WEEK05-01.md delete mode 100644 WEEK05/WEEK05-02-S.md delete mode 100644 WEEK05/WEEK05-02.md delete mode 100644 WEEK05/WEEK05-03-S.md delete mode 100644 WEEK05/WEEK05-03.md delete mode 100644 WEEK05/WEEK05-04-S.md delete mode 100644 WEEK05/WEEK05-04.md delete mode 100644 WEEK06/WEEK06-01-S.md delete mode 100644 WEEK06/WEEK06-01.md delete mode 100644 WEEK06/WEEK06-02-S.md delete mode 100644 WEEK06/WEEK06-02.md delete mode 100644 WEEK06/WEEK06-03-S.md delete mode 100644 WEEK06/WEEK06-03.md delete mode 100644 WEEK06/WEEK06-04-S.md delete mode 100644 WEEK06/WEEK06-04.md delete mode 100644 WEEK07/WEEK07-01-S.md delete mode 100644 WEEK07/WEEK07-01.md delete mode 100644 WEEK07/WEEK07-02-S.md delete mode 100644 WEEK07/WEEK07-02.md delete mode 100644 WEEK07/WEEK07-03-S.md delete mode 100644 WEEK07/WEEK07-03.md delete mode 100644 WEEK07/WEEK07-04-S.md delete mode 100644 WEEK07/WEEK07-04.md delete mode 100644 WEEK09/WEEK09-01-S.md delete mode 100644 WEEK09/WEEK09-01.md delete mode 100644 WEEK09/WEEK09-02-S.md delete mode 100644 WEEK09/WEEK09-02.md delete mode 100644 WEEK09/WEEK09-03-S.md delete mode 100644 WEEK09/WEEK09-03.md delete mode 100644 WEEK09/WEEK09-04-S.md delete mode 100644 WEEK09/WEEK09-04.md delete mode 100644 WEEK10/WEEK10-01-S.md delete mode 100644 WEEK10/WEEK10-01.md delete mode 100644 WEEK10/WEEK10-02-S.md delete mode 100644 WEEK10/WEEK10-02.md delete mode 100644 WEEK10/WEEK10-03-S.md delete mode 100644 WEEK10/WEEK10-03.md delete mode 100644 WEEK10/WEEK10-04-S.md delete mode 100644 WEEK10/WEEK10-04.md delete mode 100644 WEEK11/WEEK11-01-S.md delete mode 100644 WEEK11/WEEK11-01.md delete mode 100644 WEEK11/WEEK11-02-S.md delete mode 100644 WEEK11/WEEK11-02.md delete mode 100644 WEEK11/WEEK11-03-S.md delete mode 100644 WEEK11/WEEK11-03.md delete mode 100644 WEEK11/WEEK11-04-S.md delete mode 100644 WEEK11/WEEK11-04.md diff --git a/0x0008_unitialized-variables-a/.gitignore b/0x0008_uninitialized-variables-a/.gitignore similarity index 100% rename from 0x0008_unitialized-variables-a/.gitignore rename to 0x0008_uninitialized-variables-a/.gitignore diff --git a/0x0008_unitialized-variables-a/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables-a/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables-a/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables-a/.vscode/cmake-kits.json b/0x0008_uninitialized-variables-a/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables-a/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables-a/.vscode/extensions.json b/0x0008_uninitialized-variables-a/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/extensions.json rename to 0x0008_uninitialized-variables-a/.vscode/extensions.json diff --git a/0x0008_unitialized-variables-a/.vscode/launch.json b/0x0008_uninitialized-variables-a/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/launch.json rename to 0x0008_uninitialized-variables-a/.vscode/launch.json diff --git a/0x0008_unitialized-variables-a/.vscode/settings.json b/0x0008_uninitialized-variables-a/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/settings.json rename to 0x0008_uninitialized-variables-a/.vscode/settings.json diff --git a/0x0008_unitialized-variables-a/.vscode/tasks.json b/0x0008_uninitialized-variables-a/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables-a/.vscode/tasks.json rename to 0x0008_uninitialized-variables-a/.vscode/tasks.json diff --git a/0x0008_unitialized-variables-a/0x0008_unitialized-variables-a.c b/0x0008_uninitialized-variables-a/0x0008_uninitialized-variables-a.c similarity index 97% rename from 0x0008_unitialized-variables-a/0x0008_unitialized-variables-a.c rename to 0x0008_uninitialized-variables-a/0x0008_uninitialized-variables-a.c index ba02410..9d2ddb3 100644 --- a/0x0008_unitialized-variables-a/0x0008_unitialized-variables-a.c +++ b/0x0008_uninitialized-variables-a/0x0008_uninitialized-variables-a.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables-a.c + * @file 0x0008_uninitialized-variables-a.c * @brief Blink LED using SDK gpio functions (no UART) * @author Kevin Thomas * @date 2025 diff --git a/0x0008_unitialized-variables-a/CMakeLists.txt b/0x0008_uninitialized-variables-a/CMakeLists.txt similarity index 67% rename from 0x0008_unitialized-variables-a/CMakeLists.txt rename to 0x0008_uninitialized-variables-a/CMakeLists.txt index 9512bd9..347375d 100644 --- a/0x0008_unitialized-variables-a/CMakeLists.txt +++ b/0x0008_uninitialized-variables-a/CMakeLists.txt @@ -28,30 +28,30 @@ set(PICO_BOARD pico2 CACHE STRING "Board type") # Pull in Raspberry Pi Pico SDK (must be before project) include(pico_sdk_import.cmake) -project(0x0008_unitialized-variables-a C CXX ASM) +project(0x0008_uninitialized-variables-a C CXX ASM) # Initialise the Raspberry Pi Pico SDK pico_sdk_init() # Add executable. Default name is the project name, version 0.1 -add_executable(0x0008_unitialized-variables-a 0x0008_unitialized-variables-a.c ) +add_executable(0x0008_uninitialized-variables-a 0x0008_uninitialized-variables-a.c ) -pico_set_program_name(0x0008_unitialized-variables-a "0x0008_unitialized-variables-a") -pico_set_program_version(0x0008_unitialized-variables-a "0.1") +pico_set_program_name(0x0008_uninitialized-variables-a "0x0008_uninitialized-variables-a") +pico_set_program_version(0x0008_uninitialized-variables-a "0.1") # Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables-a 0) -pico_enable_stdio_usb(0x0008_unitialized-variables-a 0) +pico_enable_stdio_uart(0x0008_uninitialized-variables-a 0) +pico_enable_stdio_usb(0x0008_uninitialized-variables-a 0) # Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables-a +target_link_libraries(0x0008_uninitialized-variables-a pico_stdlib) # Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables-a PRIVATE +target_include_directories(0x0008_uninitialized-variables-a PRIVATE ${CMAKE_CURRENT_LIST_DIR} ) -pico_add_extra_outputs(0x0008_unitialized-variables-a) +pico_add_extra_outputs(0x0008_uninitialized-variables-a) diff --git a/0x0008_unitialized-variables-a/pico_sdk_import.cmake b/0x0008_uninitialized-variables-a/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables-a/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables-a/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables-b/.gitignore b/0x0008_uninitialized-variables-b/.gitignore similarity index 100% rename from 0x0008_unitialized-variables-b/.gitignore rename to 0x0008_uninitialized-variables-b/.gitignore diff --git a/0x0008_unitialized-variables-b/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables-b/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables-b/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables-b/.vscode/cmake-kits.json b/0x0008_uninitialized-variables-b/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables-b/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables-b/.vscode/extensions.json b/0x0008_uninitialized-variables-b/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/extensions.json rename to 0x0008_uninitialized-variables-b/.vscode/extensions.json diff --git a/0x0008_unitialized-variables-b/.vscode/launch.json b/0x0008_uninitialized-variables-b/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/launch.json rename to 0x0008_uninitialized-variables-b/.vscode/launch.json diff --git a/0x0008_unitialized-variables-b/.vscode/settings.json b/0x0008_uninitialized-variables-b/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/settings.json rename to 0x0008_uninitialized-variables-b/.vscode/settings.json diff --git a/0x0008_unitialized-variables-b/.vscode/tasks.json b/0x0008_uninitialized-variables-b/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables-b/.vscode/tasks.json rename to 0x0008_uninitialized-variables-b/.vscode/tasks.json diff --git a/0x0008_unitialized-variables-b/0x0008_unitialized-variables-b.c b/0x0008_uninitialized-variables-b/0x0008_uninitialized-variables-b.c similarity index 98% rename from 0x0008_unitialized-variables-b/0x0008_unitialized-variables-b.c rename to 0x0008_uninitialized-variables-b/0x0008_uninitialized-variables-b.c index ba676e4..b42c544 100644 --- a/0x0008_unitialized-variables-b/0x0008_unitialized-variables-b.c +++ b/0x0008_uninitialized-variables-b/0x0008_uninitialized-variables-b.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables-b.c + * @file 0x0008_uninitialized-variables-b.c * @brief Blink LED using gpioc coprocessor bit-level functions * @author Kevin Thomas * @date 2025 diff --git a/0x0008_unitialized-variables-d/CMakeLists.txt b/0x0008_uninitialized-variables-b/CMakeLists.txt similarity index 67% rename from 0x0008_unitialized-variables-d/CMakeLists.txt rename to 0x0008_uninitialized-variables-b/CMakeLists.txt index fa38995..24d559f 100644 --- a/0x0008_unitialized-variables-d/CMakeLists.txt +++ b/0x0008_uninitialized-variables-b/CMakeLists.txt @@ -28,30 +28,30 @@ set(PICO_BOARD pico2 CACHE STRING "Board type") # Pull in Raspberry Pi Pico SDK (must be before project) include(pico_sdk_import.cmake) -project(0x0008_unitialized-variables-d C CXX ASM) +project(0x0008_uninitialized-variables-b C CXX ASM) # Initialise the Raspberry Pi Pico SDK pico_sdk_init() # Add executable. Default name is the project name, version 0.1 -add_executable(0x0008_unitialized-variables-d 0x0008_unitialized-variables-d.c ) +add_executable(0x0008_uninitialized-variables-b 0x0008_uninitialized-variables-b.c ) -pico_set_program_name(0x0008_unitialized-variables-d "0x0008_unitialized-variables-d") -pico_set_program_version(0x0008_unitialized-variables-d "0.1") +pico_set_program_name(0x0008_uninitialized-variables-b "0x0008_uninitialized-variables-b") +pico_set_program_version(0x0008_uninitialized-variables-b "0.1") # Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables-d 0) -pico_enable_stdio_usb(0x0008_unitialized-variables-d 0) +pico_enable_stdio_uart(0x0008_uninitialized-variables-b 0) +pico_enable_stdio_usb(0x0008_uninitialized-variables-b 0) # Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables-d +target_link_libraries(0x0008_uninitialized-variables-b pico_stdlib) # Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables-d PRIVATE +target_include_directories(0x0008_uninitialized-variables-b PRIVATE ${CMAKE_CURRENT_LIST_DIR} ) -pico_add_extra_outputs(0x0008_unitialized-variables-d) +pico_add_extra_outputs(0x0008_uninitialized-variables-b) diff --git a/0x0008_unitialized-variables-b/pico_sdk_import.cmake b/0x0008_uninitialized-variables-b/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables-b/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables-b/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables-c/.gitignore b/0x0008_uninitialized-variables-c/.gitignore similarity index 100% rename from 0x0008_unitialized-variables-c/.gitignore rename to 0x0008_uninitialized-variables-c/.gitignore diff --git a/0x0008_unitialized-variables-c/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables-c/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables-c/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables-c/.vscode/cmake-kits.json b/0x0008_uninitialized-variables-c/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables-c/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables-c/.vscode/extensions.json b/0x0008_uninitialized-variables-c/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/extensions.json rename to 0x0008_uninitialized-variables-c/.vscode/extensions.json diff --git a/0x0008_unitialized-variables-c/.vscode/launch.json b/0x0008_uninitialized-variables-c/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/launch.json rename to 0x0008_uninitialized-variables-c/.vscode/launch.json diff --git a/0x0008_unitialized-variables-c/.vscode/settings.json b/0x0008_uninitialized-variables-c/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/settings.json rename to 0x0008_uninitialized-variables-c/.vscode/settings.json diff --git a/0x0008_unitialized-variables-c/.vscode/tasks.json b/0x0008_uninitialized-variables-c/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables-c/.vscode/tasks.json rename to 0x0008_uninitialized-variables-c/.vscode/tasks.json diff --git a/0x0008_unitialized-variables-c/0x0008_unitialized-variables-c.c b/0x0008_uninitialized-variables-c/0x0008_uninitialized-variables-c.c similarity index 98% rename from 0x0008_unitialized-variables-c/0x0008_unitialized-variables-c.c rename to 0x0008_uninitialized-variables-c/0x0008_uninitialized-variables-c.c index 4c71b5b..40771de 100644 --- a/0x0008_unitialized-variables-c/0x0008_unitialized-variables-c.c +++ b/0x0008_uninitialized-variables-c/0x0008_uninitialized-variables-c.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables-c.c + * @file 0x0008_uninitialized-variables-c.c * @brief Blink LED using direct register-level pad and IO bank configuration * @author Kevin Thomas * @date 2025 diff --git a/0x0008_unitialized-variables-b/CMakeLists.txt b/0x0008_uninitialized-variables-c/CMakeLists.txt similarity index 67% rename from 0x0008_unitialized-variables-b/CMakeLists.txt rename to 0x0008_uninitialized-variables-c/CMakeLists.txt index 51897ba..b7e1991 100644 --- a/0x0008_unitialized-variables-b/CMakeLists.txt +++ b/0x0008_uninitialized-variables-c/CMakeLists.txt @@ -28,30 +28,30 @@ set(PICO_BOARD pico2 CACHE STRING "Board type") # Pull in Raspberry Pi Pico SDK (must be before project) include(pico_sdk_import.cmake) -project(0x0008_unitialized-variables-b C CXX ASM) +project(0x0008_uninitialized-variables-c C CXX ASM) # Initialise the Raspberry Pi Pico SDK pico_sdk_init() # Add executable. Default name is the project name, version 0.1 -add_executable(0x0008_unitialized-variables-b 0x0008_unitialized-variables-b.c ) +add_executable(0x0008_uninitialized-variables-c 0x0008_uninitialized-variables-c.c ) -pico_set_program_name(0x0008_unitialized-variables-b "0x0008_unitialized-variables-b") -pico_set_program_version(0x0008_unitialized-variables-b "0.1") +pico_set_program_name(0x0008_uninitialized-variables-c "0x0008_uninitialized-variables-c") +pico_set_program_version(0x0008_uninitialized-variables-c "0.1") # Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables-b 0) -pico_enable_stdio_usb(0x0008_unitialized-variables-b 0) +pico_enable_stdio_uart(0x0008_uninitialized-variables-c 0) +pico_enable_stdio_usb(0x0008_uninitialized-variables-c 0) # Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables-b +target_link_libraries(0x0008_uninitialized-variables-c pico_stdlib) # Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables-b PRIVATE +target_include_directories(0x0008_uninitialized-variables-c PRIVATE ${CMAKE_CURRENT_LIST_DIR} ) -pico_add_extra_outputs(0x0008_unitialized-variables-b) +pico_add_extra_outputs(0x0008_uninitialized-variables-c) diff --git a/0x0008_unitialized-variables-c/pico_sdk_import.cmake b/0x0008_uninitialized-variables-c/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables-c/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables-c/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables-d/.gitignore b/0x0008_uninitialized-variables-d/.gitignore similarity index 100% rename from 0x0008_unitialized-variables-d/.gitignore rename to 0x0008_uninitialized-variables-d/.gitignore diff --git a/0x0008_unitialized-variables-d/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables-d/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables-d/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables-d/.vscode/cmake-kits.json b/0x0008_uninitialized-variables-d/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables-d/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables-d/.vscode/extensions.json b/0x0008_uninitialized-variables-d/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/extensions.json rename to 0x0008_uninitialized-variables-d/.vscode/extensions.json diff --git a/0x0008_unitialized-variables-d/.vscode/launch.json b/0x0008_uninitialized-variables-d/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/launch.json rename to 0x0008_uninitialized-variables-d/.vscode/launch.json diff --git a/0x0008_unitialized-variables-d/.vscode/settings.json b/0x0008_uninitialized-variables-d/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/settings.json rename to 0x0008_uninitialized-variables-d/.vscode/settings.json diff --git a/0x0008_unitialized-variables-d/.vscode/tasks.json b/0x0008_uninitialized-variables-d/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables-d/.vscode/tasks.json rename to 0x0008_uninitialized-variables-d/.vscode/tasks.json diff --git a/0x0008_unitialized-variables-d/0x0008_unitialized-variables-d.c b/0x0008_uninitialized-variables-d/0x0008_uninitialized-variables-d.c similarity index 99% rename from 0x0008_unitialized-variables-d/0x0008_unitialized-variables-d.c rename to 0x0008_uninitialized-variables-d/0x0008_uninitialized-variables-d.c index 2b7efe6..b834115 100644 --- a/0x0008_unitialized-variables-d/0x0008_unitialized-variables-d.c +++ b/0x0008_uninitialized-variables-d/0x0008_uninitialized-variables-d.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables-d.c + * @file 0x0008_uninitialized-variables-d.c * @brief Blink LED using pico_default_asm_volatile coprocessor instructions * @author Kevin Thomas * @date 2025 diff --git a/0x0008_uninitialized-variables-d/CMakeLists.txt b/0x0008_uninitialized-variables-d/CMakeLists.txt new file mode 100644 index 0000000..9e88754 --- /dev/null +++ b/0x0008_uninitialized-variables-d/CMakeLists.txt @@ -0,0 +1,57 @@ +# Generated Cmake Pico project file + +cmake_minimum_required(VERSION 3.13) + +set(CMAKE_C_STANDARD 11) +set(CMAKE_CXX_STANDARD 17) +set(CMAKE_EXPORT_COMPILE_COMMANDS ON) + +# Initialise pico_sdk from installed location +# (note this can come from environment, CMake cache etc) + +# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == +if(WIN32) + set(USERHOME $ENV{USERPROFILE}) +else() + set(USERHOME $ENV{HOME}) +endif() +set(sdkVersion 2.2.0) +set(toolchainVersion 14_2_Rel1) +set(picotoolVersion 2.2.0) +set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) +if (EXISTS ${picoVscode}) + include(${picoVscode}) +endif() +# ==================================================================================== +set(PICO_BOARD pico2 CACHE STRING "Board type") + +# Pull in Raspberry Pi Pico SDK (must be before project) +include(pico_sdk_import.cmake) + +project(0x0008_uninitialized-variables-d C CXX ASM) + +# Initialise the Raspberry Pi Pico SDK +pico_sdk_init() + +# Add executable. Default name is the project name, version 0.1 + +add_executable(0x0008_uninitialized-variables-d 0x0008_uninitialized-variables-d.c ) + +pico_set_program_name(0x0008_uninitialized-variables-d "0x0008_uninitialized-variables-d") +pico_set_program_version(0x0008_uninitialized-variables-d "0.1") + +# Modify the below lines to enable/disable output over UART/USB +pico_enable_stdio_uart(0x0008_uninitialized-variables-d 0) +pico_enable_stdio_usb(0x0008_uninitialized-variables-d 0) + +# Add the standard library to the build +target_link_libraries(0x0008_uninitialized-variables-d + pico_stdlib) + +# Add the standard include files to the build +target_include_directories(0x0008_uninitialized-variables-d PRIVATE + ${CMAKE_CURRENT_LIST_DIR} +) + +pico_add_extra_outputs(0x0008_uninitialized-variables-d) + diff --git a/0x0008_unitialized-variables-d/pico_sdk_import.cmake b/0x0008_uninitialized-variables-d/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables-d/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables-d/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables-e/.gitignore b/0x0008_uninitialized-variables-e/.gitignore similarity index 100% rename from 0x0008_unitialized-variables-e/.gitignore rename to 0x0008_uninitialized-variables-e/.gitignore diff --git a/0x0008_unitialized-variables-e/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables-e/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables-e/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables-e/.vscode/cmake-kits.json b/0x0008_uninitialized-variables-e/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables-e/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables-e/.vscode/extensions.json b/0x0008_uninitialized-variables-e/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/extensions.json rename to 0x0008_uninitialized-variables-e/.vscode/extensions.json diff --git a/0x0008_unitialized-variables-e/.vscode/launch.json b/0x0008_uninitialized-variables-e/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/launch.json rename to 0x0008_uninitialized-variables-e/.vscode/launch.json diff --git a/0x0008_unitialized-variables-e/.vscode/settings.json b/0x0008_uninitialized-variables-e/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/settings.json rename to 0x0008_uninitialized-variables-e/.vscode/settings.json diff --git a/0x0008_unitialized-variables-e/.vscode/tasks.json b/0x0008_uninitialized-variables-e/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables-e/.vscode/tasks.json rename to 0x0008_uninitialized-variables-e/.vscode/tasks.json diff --git a/0x0008_unitialized-variables-e/0x0008_unitialized-variables-e.c b/0x0008_uninitialized-variables-e/0x0008_uninitialized-variables-e.c similarity index 99% rename from 0x0008_unitialized-variables-e/0x0008_unitialized-variables-e.c rename to 0x0008_uninitialized-variables-e/0x0008_uninitialized-variables-e.c index 42799c7..ac572c8 100644 --- a/0x0008_unitialized-variables-e/0x0008_unitialized-variables-e.c +++ b/0x0008_uninitialized-variables-e/0x0008_uninitialized-variables-e.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables-e.c + * @file 0x0008_uninitialized-variables-e.c * @brief Blink LED using pure inline ARM assembly with direct register addresses * @author Kevin Thomas * @date 2025 diff --git a/0x0008_uninitialized-variables-e/CMakeLists.txt b/0x0008_uninitialized-variables-e/CMakeLists.txt new file mode 100644 index 0000000..bfc1c28 --- /dev/null +++ b/0x0008_uninitialized-variables-e/CMakeLists.txt @@ -0,0 +1,57 @@ +# Generated Cmake Pico project file + +cmake_minimum_required(VERSION 3.13) + +set(CMAKE_C_STANDARD 11) +set(CMAKE_CXX_STANDARD 17) +set(CMAKE_EXPORT_COMPILE_COMMANDS ON) + +# Initialise pico_sdk from installed location +# (note this can come from environment, CMake cache etc) + +# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == +if(WIN32) + set(USERHOME $ENV{USERPROFILE}) +else() + set(USERHOME $ENV{HOME}) +endif() +set(sdkVersion 2.2.0) +set(toolchainVersion 14_2_Rel1) +set(picotoolVersion 2.2.0) +set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) +if (EXISTS ${picoVscode}) + include(${picoVscode}) +endif() +# ==================================================================================== +set(PICO_BOARD pico2 CACHE STRING "Board type") + +# Pull in Raspberry Pi Pico SDK (must be before project) +include(pico_sdk_import.cmake) + +project(0x0008_uninitialized-variables-e C CXX ASM) + +# Initialise the Raspberry Pi Pico SDK +pico_sdk_init() + +# Add executable. Default name is the project name, version 0.1 + +add_executable(0x0008_uninitialized-variables-e 0x0008_uninitialized-variables-e.c ) + +pico_set_program_name(0x0008_uninitialized-variables-e "0x0008_uninitialized-variables-e") +pico_set_program_version(0x0008_uninitialized-variables-e "0.1") + +# Modify the below lines to enable/disable output over UART/USB +pico_enable_stdio_uart(0x0008_uninitialized-variables-e 0) +pico_enable_stdio_usb(0x0008_uninitialized-variables-e 0) + +# Add the standard library to the build +target_link_libraries(0x0008_uninitialized-variables-e + pico_stdlib) + +# Add the standard include files to the build +target_include_directories(0x0008_uninitialized-variables-e PRIVATE + ${CMAKE_CURRENT_LIST_DIR} +) + +pico_add_extra_outputs(0x0008_uninitialized-variables-e) + diff --git a/0x0008_unitialized-variables-e/pico_sdk_import.cmake b/0x0008_uninitialized-variables-e/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables-e/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables-e/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables/.gitignore b/0x0008_uninitialized-variables/.gitignore similarity index 100% rename from 0x0008_unitialized-variables/.gitignore rename to 0x0008_uninitialized-variables/.gitignore diff --git a/0x0008_unitialized-variables/.vscode/c_cpp_properties.json b/0x0008_uninitialized-variables/.vscode/c_cpp_properties.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/c_cpp_properties.json rename to 0x0008_uninitialized-variables/.vscode/c_cpp_properties.json diff --git a/0x0008_unitialized-variables/.vscode/cmake-kits.json b/0x0008_uninitialized-variables/.vscode/cmake-kits.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/cmake-kits.json rename to 0x0008_uninitialized-variables/.vscode/cmake-kits.json diff --git a/0x0008_unitialized-variables/.vscode/extensions.json b/0x0008_uninitialized-variables/.vscode/extensions.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/extensions.json rename to 0x0008_uninitialized-variables/.vscode/extensions.json diff --git a/0x0008_unitialized-variables/.vscode/launch.json b/0x0008_uninitialized-variables/.vscode/launch.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/launch.json rename to 0x0008_uninitialized-variables/.vscode/launch.json diff --git a/0x0008_unitialized-variables/.vscode/settings.json b/0x0008_uninitialized-variables/.vscode/settings.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/settings.json rename to 0x0008_uninitialized-variables/.vscode/settings.json diff --git a/0x0008_unitialized-variables/.vscode/tasks.json b/0x0008_uninitialized-variables/.vscode/tasks.json similarity index 100% rename from 0x0008_unitialized-variables/.vscode/tasks.json rename to 0x0008_uninitialized-variables/.vscode/tasks.json diff --git a/0x0008_unitialized-variables/0x0008_unitialized-variables.c b/0x0008_uninitialized-variables/0x0008_uninitialized-variables.c similarity index 98% rename from 0x0008_unitialized-variables/0x0008_unitialized-variables.c rename to 0x0008_uninitialized-variables/0x0008_uninitialized-variables.c index 26bf440..8e9dc42 100644 --- a/0x0008_unitialized-variables/0x0008_unitialized-variables.c +++ b/0x0008_uninitialized-variables/0x0008_uninitialized-variables.c @@ -1,5 +1,5 @@ /** - * @file 0x0008_unitialized-variables.c + * @file 0x0008_uninitialized-variables.c * @brief Uninitialized variables: demonstrate undefined behavior with printf * @author Kevin Thomas * @date 2025 diff --git a/0x0008_unitialized-variables-c/CMakeLists.txt b/0x0008_uninitialized-variables/CMakeLists.txt similarity index 68% rename from 0x0008_unitialized-variables-c/CMakeLists.txt rename to 0x0008_uninitialized-variables/CMakeLists.txt index f5c50e3..c2ac591 100644 --- a/0x0008_unitialized-variables-c/CMakeLists.txt +++ b/0x0008_uninitialized-variables/CMakeLists.txt @@ -28,30 +28,30 @@ set(PICO_BOARD pico2 CACHE STRING "Board type") # Pull in Raspberry Pi Pico SDK (must be before project) include(pico_sdk_import.cmake) -project(0x0008_unitialized-variables-c C CXX ASM) +project(0x0008_uninitialized-variables C CXX ASM) # Initialise the Raspberry Pi Pico SDK pico_sdk_init() # Add executable. Default name is the project name, version 0.1 -add_executable(0x0008_unitialized-variables-c 0x0008_unitialized-variables-c.c ) +add_executable(0x0008_uninitialized-variables 0x0008_uninitialized-variables.c ) -pico_set_program_name(0x0008_unitialized-variables-c "0x0008_unitialized-variables-c") -pico_set_program_version(0x0008_unitialized-variables-c "0.1") +pico_set_program_name(0x0008_uninitialized-variables "0x0008_uninitialized-variables") +pico_set_program_version(0x0008_uninitialized-variables "0.1") # Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables-c 0) -pico_enable_stdio_usb(0x0008_unitialized-variables-c 0) +pico_enable_stdio_uart(0x0008_uninitialized-variables 1) +pico_enable_stdio_usb(0x0008_uninitialized-variables 0) # Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables-c +target_link_libraries(0x0008_uninitialized-variables pico_stdlib) # Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables-c PRIVATE +target_include_directories(0x0008_uninitialized-variables PRIVATE ${CMAKE_CURRENT_LIST_DIR} ) -pico_add_extra_outputs(0x0008_unitialized-variables-c) +pico_add_extra_outputs(0x0008_uninitialized-variables) diff --git a/0x0008_unitialized-variables/pico_sdk_import.cmake b/0x0008_uninitialized-variables/pico_sdk_import.cmake similarity index 100% rename from 0x0008_unitialized-variables/pico_sdk_import.cmake rename to 0x0008_uninitialized-variables/pico_sdk_import.cmake diff --git a/0x0008_unitialized-variables-e/CMakeLists.txt b/0x0008_unitialized-variables-e/CMakeLists.txt deleted file mode 100644 index 7fa7d3a..0000000 --- a/0x0008_unitialized-variables-e/CMakeLists.txt +++ /dev/null @@ -1,57 +0,0 @@ -# Generated Cmake Pico project file - -cmake_minimum_required(VERSION 3.13) - -set(CMAKE_C_STANDARD 11) -set(CMAKE_CXX_STANDARD 17) -set(CMAKE_EXPORT_COMPILE_COMMANDS ON) - -# Initialise pico_sdk from installed location -# (note this can come from environment, CMake cache etc) - -# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == -if(WIN32) - set(USERHOME $ENV{USERPROFILE}) -else() - set(USERHOME $ENV{HOME}) -endif() -set(sdkVersion 2.2.0) -set(toolchainVersion 14_2_Rel1) -set(picotoolVersion 2.2.0) -set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) -if (EXISTS ${picoVscode}) - include(${picoVscode}) -endif() -# ==================================================================================== -set(PICO_BOARD pico2 CACHE STRING "Board type") - -# Pull in Raspberry Pi Pico SDK (must be before project) -include(pico_sdk_import.cmake) - -project(0x0008_unitialized-variables-e C CXX ASM) - -# Initialise the Raspberry Pi Pico SDK -pico_sdk_init() - -# Add executable. Default name is the project name, version 0.1 - -add_executable(0x0008_unitialized-variables-e 0x0008_unitialized-variables-e.c ) - -pico_set_program_name(0x0008_unitialized-variables-e "0x0008_unitialized-variables-e") -pico_set_program_version(0x0008_unitialized-variables-e "0.1") - -# Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables-e 0) -pico_enable_stdio_usb(0x0008_unitialized-variables-e 0) - -# Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables-e - pico_stdlib) - -# Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables-e PRIVATE - ${CMAKE_CURRENT_LIST_DIR} -) - -pico_add_extra_outputs(0x0008_unitialized-variables-e) - diff --git a/0x0008_unitialized-variables/CMakeLists.txt b/0x0008_unitialized-variables/CMakeLists.txt deleted file mode 100644 index 518d1cf..0000000 --- a/0x0008_unitialized-variables/CMakeLists.txt +++ /dev/null @@ -1,57 +0,0 @@ -# Generated Cmake Pico project file - -cmake_minimum_required(VERSION 3.13) - -set(CMAKE_C_STANDARD 11) -set(CMAKE_CXX_STANDARD 17) -set(CMAKE_EXPORT_COMPILE_COMMANDS ON) - -# Initialise pico_sdk from installed location -# (note this can come from environment, CMake cache etc) - -# == DO NOT EDIT THE FOLLOWING LINES for the Raspberry Pi Pico VS Code Extension to work == -if(WIN32) - set(USERHOME $ENV{USERPROFILE}) -else() - set(USERHOME $ENV{HOME}) -endif() -set(sdkVersion 2.2.0) -set(toolchainVersion 14_2_Rel1) -set(picotoolVersion 2.2.0) -set(picoVscode ${USERHOME}/.pico-sdk/cmake/pico-vscode.cmake) -if (EXISTS ${picoVscode}) - include(${picoVscode}) -endif() -# ==================================================================================== -set(PICO_BOARD pico2 CACHE STRING "Board type") - -# Pull in Raspberry Pi Pico SDK (must be before project) -include(pico_sdk_import.cmake) - -project(0x0008_unitialized-variables C CXX ASM) - -# Initialise the Raspberry Pi Pico SDK -pico_sdk_init() - -# Add executable. Default name is the project name, version 0.1 - -add_executable(0x0008_unitialized-variables 0x0008_unitialized-variables.c ) - -pico_set_program_name(0x0008_unitialized-variables "0x0008_unitialized-variables") -pico_set_program_version(0x0008_unitialized-variables "0.1") - -# Modify the below lines to enable/disable output over UART/USB -pico_enable_stdio_uart(0x0008_unitialized-variables 1) -pico_enable_stdio_usb(0x0008_unitialized-variables 0) - -# Add the standard library to the build -target_link_libraries(0x0008_unitialized-variables - pico_stdlib) - -# Add the standard include files to the build -target_include_directories(0x0008_unitialized-variables PRIVATE - ${CMAKE_CURRENT_LIST_DIR} -) - -pico_add_extra_outputs(0x0008_unitialized-variables) - diff --git a/README.md b/README.md index a2bcffa..d9ede99 100644 --- a/README.md +++ b/README.md @@ -64,21 +64,6 @@ Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and ### Week 1 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01.md) -#### Non-Credit Practice Exercise 1: Explore in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Explore in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-01-S.md) - -#### Non-Credit Practice Exercise 2: Find Strings in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Find Strings in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-02-S.md) - -#### Non-Credit Practice Exercise 3: Find Cross-References in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Find Cross-References in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-03-S.md) - -#### Non-Credit Practice Exercise 4: Connect GDB & Basic Exploration [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Connect GDB & Basic Exploration [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK01/WEEK01-04-S.md) ### Chapter 1: hello, world This chapter covers the basics of setting up a dev environment and basic template firmware for the Pico 2 MCU in addition to printing hello, world. @@ -97,21 +82,6 @@ Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Progr ### Week 2 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02.md) -#### Non-Credit Practice Exercise 1: Change the Message [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Change the Message [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-01-S.md) - -#### Non-Credit Practice Exercise 2: Use a Different SRAM Address [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Use a Different SRAM Address [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-02-S.md) - -#### Non-Credit Practice Exercise 3: Examine Memory Around Your String [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Examine Memory Around Your String [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-03-S.md) - -#### Non-Credit Practice Exercise 4: Automate the Hack [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Automate the Hack [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK02/WEEK02-04-S.md) ### Chapter 3: Hacking hello, world This chapter covers the hacking of our firmware for the Pico 2 MCU hello, world program. @@ -125,21 +95,6 @@ Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive ### Week 3 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03.md) -#### Non-Credit Practice Exercise 1: Trace a Reset [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Trace a Reset [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-01-S.md) - -#### Non-Credit Practice Exercise 2: Find the Stack Size [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Find the Stack Size [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-02-S.md) - -#### Non-Credit Practice Exercise 3: Examine All Vectors [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Examine All Vectors [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-03-S.md) - -#### Non-Credit Practice Exercise 4: Find Your Main Function and Trace Back [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Find Your Main Function and Trace Back [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK03/WEEK03-04-S.md) ### Chapter 4: Embedded System Analysis This chapter covers a comprehensive embedded system analysis reviewing parts of the RP2350 datasheet and helpful firmware analysis tools. @@ -153,21 +108,6 @@ Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Ba ### Week 4 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04.md) -#### Non-Credit Practice Exercise 1: Analyze Variable Storage in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Analyze Variable Storage in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-01-S.md) - -#### Non-Credit Practice Exercise 2: Patch Binary to Change Variable Value [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Patch Binary to Change Variable Value [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-02-S.md) - -#### Non-Credit Practice Exercise 3: Analyze and Understand GPIO Control [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Analyze and Understand GPIO Control [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-03-S.md) - -#### Non-Credit Practice Exercise 4: Patch GPIO Binary to Change LED Pin [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Patch GPIO Binary to Change LED Pin [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK04/WEEK04-04-S.md) ### Chapter 5: Intro To Variables This chapter covers an introduction to variables as it relates to embedded development on the Pico 2. @@ -206,21 +146,6 @@ Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floa ### Week 5 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05.md) -#### Non-Credit Practice Exercise 1: Analyze the Float Binary in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Analyze the Float Binary in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-01-S.md) - -#### Non-Credit Practice Exercise 2: Patch the Float Binary — Changing 42.5 to 99.0 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Patch the Float Binary — Changing 42.5 to 99.0 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-02-S.md) - -#### Non-Credit Practice Exercise 3: Analyze the Double Binary in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Analyze the Double Binary in Ghidra [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-03-S.md) - -#### Non-Credit Practice Exercise 4: Patch the Double Binary — Changing 42.52525 to 99.99 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Patch the Double Binary — Changing 42.52525 to 99.99 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK05/WEEK05-04-S.md) ### Chapter 11: Integer Data Type This chapter covers the integer data type in addition to a deeper assembler dive into GPIO outputs as it relates to embedded development on the Pico 2. @@ -274,21 +199,6 @@ Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ ### Week 6 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06.md) -#### Non-Credit Practice Exercise 1: Change the Static Variable Initial Value from 42 to 100 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Change the Static Variable Initial Value from 42 to 100 [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-01-S.md) - -#### Non-Credit Practice Exercise 2: Reverse Engineer gpio_set_pulls with GDB [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Reverse Engineer gpio_set_pulls with GDB [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-02-S.md) - -#### Non-Credit Practice Exercise 3: Make the Overflow Happen Faster [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Make the Overflow Happen Faster [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-03-S.md) - -#### Non-Credit Practice Exercise 4: Invert the Button Logic with XOR [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Invert the Button Logic with XOR [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK06/WEEK06-04-S.md) ### Chapter 20: Static Variables This chapter covers static variables as well as an intro to GPIO inputs as we work with push buttons as it relates to embedded development on the Pico 2. @@ -312,21 +222,6 @@ Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C B ### Week 7 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07.md) -#### Non-Credit Practice Exercise 1: Change Both LCD Lines [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Change Both LCD Lines [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-01-S.md) - -#### Non-Credit Practice Exercise 2: Find All String Literals in the Binary [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Find All String Literals in the Binary [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-02-S.md) - -#### Non-Credit Practice Exercise 3: Trace the I²C Struct Pointer Chain [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Trace the I²C Struct Pointer Chain [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-03-S.md) - -#### Non-Credit Practice Exercise 4: Display Your Own Custom Message on the LCD [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Display Your Own Custom Message on the LCD [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK07/WEEK07-04-S.md) ### Chapter 23: Constants This chapter covers constants as well as an intro to I2C as we work a 1602 LCD as it relates to embedded development on the Pico 2. @@ -353,21 +248,6 @@ Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperat ### Week 9 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09.md) -#### Non-Credit Practice Exercise 1: Change the Sleep Duration [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Change the Sleep Duration [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-01-S.md) - -#### Non-Credit Practice Exercise 2: Invert the Temperature Reading [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Invert the Temperature Reading [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-02-S.md) - -#### Non-Credit Practice Exercise 3: Add a Fixed Temperature Offset [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Add a Fixed Temperature Offset [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-03-S.md) - -#### Non-Credit Practice Exercise 4: Find All printf Format Strings [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Find All printf Format Strings [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK09/WEEK09-04-S.md) ### Chapter 26: Operators This chapter covers operators as well as an intro to single-wire protocol as we work a DHT11 temperature and humidity sensor as it relates to embedded development on the Pico 2. @@ -391,21 +271,6 @@ Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditi ### Week 10 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10.md) -#### Non-Credit Practice Exercise 1: Change Servo Angle Range [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Change Servo Angle Range [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-01-S.md) - -#### Non-Credit Practice Exercise 2: Add a Third Command [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Add a Third Command [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-02-S.md) - -#### Non-Credit Practice Exercise 3: Reverse the Servo Direction [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Reverse the Servo Direction [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-03-S.md) - -#### Non-Credit Practice Exercise 4: Speed Profile [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Speed Profile [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK10/WEEK10-04-S.md) ### Chapter 29: Static Conditionals This chapter covers static conditionals as well as an intro to PWM as we work a SG90 servo motor as it relates to embedded development on the Pico 2. @@ -444,21 +309,6 @@ Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote ### Week 11 Notebook [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11.md) -#### Non-Credit Practice Exercise 1: Add a Fourth LED [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-01.md) - -#### Non-Credit Practice Exercise 1 Solution: Add a Fourth LED [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-01-S.md) - -#### Non-Credit Practice Exercise 2: Change Blink Count [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-02.md) - -#### Non-Credit Practice Exercise 2 Solution: Change Blink Count [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-02-S.md) - -#### Non-Credit Practice Exercise 3: Swap All Three LEDs [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-03.md) - -#### Non-Credit Practice Exercise 3 Solution: Swap All Three LEDs [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-03-S.md) - -#### Non-Credit Practice Exercise 4: Change Blink Speed [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-04.md) - -#### Non-Credit Practice Exercise 4 Solution: Change Blink Speed [HERE](https://github.com/mytechnotalent/Embedded-Hacking/blob/main/WEEK11/WEEK11-04-S.md) ### Chapter 35: Structures This chapter covers structures as well as an intro to infrared basics as we work a infrared receiver and infrared remote controller as it relates to embedded development on the Pico 2. diff --git a/WEEK01/WEEK01-01-S.md b/WEEK01/WEEK01-01-S.md deleted file mode 100644 index bcdb19c..0000000 --- a/WEEK01/WEEK01-01-S.md +++ /dev/null @@ -1,41 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 1 Solution: Explore in Ghidra - -#### Answers - -##### Question 1: What does the function return? -`stdio_init_all()` returns `_Bool`. The function signature is `_Bool stdio_init_all(void)`. - -##### Question 2: What parameters does it take? -None. The signature uses `(void)`, which means zero parameters. - -##### Question 3: What functions does it call? -In this build, it calls `stdio_uart_init()` to initialize serial output. - -##### Question 4: What's the purpose? -Its purpose is to initialize standard I/O so `printf()`/`puts()` output can be transmitted over UART. - -##### Expected Output - -``` -stdio_init_all() returns: _Bool -It takes 0 parameters -It calls the following functions: UART init -Based on these calls, I believe it initializes: Standard I/O for UART serial communication -``` - -#### Reflection Answers - -1. **Why would we need to initialize standard I/O before using `printf()`?** - Without initialization, there is no configured output path. `printf()` needs a destination (UART in this exercise) to transmit characters. - -2. **Can you find other functions in the Symbol Tree that might be related to I/O?** - Yes - `stdio_uart_init`, `__wrap_puts`, and related low-level serial/output helpers are I/O-related. - -3. **How does this function support the `printf("hello, world\r\n")` call in main?** - It configures the UART output path so when `printf()` (optimized to `__wrap_puts`) runs, the string is sent over serial. diff --git a/WEEK01/WEEK01-01.md b/WEEK01/WEEK01-01.md deleted file mode 100644 index abf913d..0000000 --- a/WEEK01/WEEK01-01.md +++ /dev/null @@ -1,122 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 1: Explore in Ghidra - -#### Objective -Learn how to navigate Ghidra's Symbol Tree to find and analyze functions, specifically examining the `stdio_init_all` function. - -#### Prerequisites -- Ghidra installed and running -- `0x0001_hello-world` project already created and imported in Ghidra -- The `0x0001_hello-world.elf` file already imported and analyzed - -#### Task Description - -Your goal is to explore the `stdio_init_all` function in Ghidra and understand what it does based on: -1. Its decompiled code -2. The functions it calls -3. The variables it accesses - -#### Step-by-Step Instructions - -##### Step 1: Open Your Ghidra Project - -1. Launch **Ghidra** on your computer -2. In the Ghidra Project Manager window, you should see your `0x0001_hello-world` project -3. If you don't see it, create a new project or open an existing one -4. **Double-click** on the project to open it - -##### Step 2: Access the Symbol Tree - -In the CodeBrowser window that opens: -- Look at the left side panel - you should see several tabs -- Find and click on the **Symbol Tree** tab (it might be labeled "Symbol Tree" or showing a tree icon) -- If you don't see it, go to **Window → Symbol Tree** in the menu - -##### Step 3: Expand the Functions List - -1. In the Symbol Tree, look for a folder or section labeled **Functions** -2. **Click the arrow/triangle** next to "Functions" to expand it -3. This will show you a list of all the functions that Ghidra identified in the binary - -##### Step 4: Find the stdio_init_all Function - -1. In the expanded Functions list, scroll through to find `stdio_init_all` -2. **Alternative method**: If the list is long, you can use **Search → For Address or Label** from the menu and type `stdio_init_all` to jump directly to it -3. Once you find it, **click on it** to navigate to that function in the CodeBrowser - -##### Step 5: Examine the Decompiled Code - -Once you've navigated to `stdio_init_all`: -- On the **right side** of the window, you should see the **Decompile** view -- This shows the C-like code that Ghidra has reconstructed from the assembly -- Read through the decompiled code carefully - -##### Step 6: Answer These Questions - -Based on what you see in the decompiled code, answer the following: - -###### Question 1: What does the function return? -Look at the return type at the top of the function. Is it `void`, `int`, `_Bool`, or something else? - -###### Question 2: What parameters does it take? -Look at the function signature. Does it take any parameters? (Hint: Look for anything inside the parentheses) - -###### Question 3: What functions does it call? -Look for function calls within `stdio_init_all`. What other functions does it call? List them: -- Function 1: ________________ -- Function 2: ________________ -- Function 3: ________________ -(There may be more or fewer) - -###### Question 4: What's the purpose? -Based on the functions it calls and the overall structure, what do you think `stdio_init_all()` is setting up? Think about what "stdio" stands for: -- **std** = Standard -- **io** = Input/Output - -What types of I/O might be getting initialized? - -##### Step 7: Explore Called Functions (Optional Challenge) - -If you want to go deeper: - -1. In the Decompile view, **click on one of the functions** that `stdio_init_all` calls -2. Ghidra will navigate to that function -3. Look at what **that** function does -4. Can you build a picture of what's being initialized? - -#### Expected Output - -You should be able to write a brief summary like: - -``` -stdio_init_all() returns: [your answer] -It takes [number] parameters -It calls the following functions: [list them] -Based on these calls, I believe it initializes: [your analysis] -``` - -#### Questions for Reflection - -1. Why would we need to initialize standard I/O before using `printf()`? -2. Can you find other functions in the Symbol Tree that might be related to I/O? -3. How does this function support the `printf("hello, world\r\n")` call in main? - -#### Tips and Hints - -- If you see a function name you don't recognize, you can right-click on it to see more options -- The Decompile view is your best friend - it shows you what code is doing in an almost-C format -- Don't worry if some variable names are automatic (like `local_4` or `param_1`) - that's normal when symbols aren't available -- You can collapse/expand sections in the Decompile view by clicking the arrows next to braces `{}` - -#### Next Steps - -After completing this exercise, you'll have a better understanding of: -- How to navigate Ghidra's interface -- How to find functions using the Symbol Tree -- How to read decompiled code -- How initialization functions work in embedded systems diff --git a/WEEK01/WEEK01-02-S.md b/WEEK01/WEEK01-02-S.md deleted file mode 100644 index 90b2593..0000000 --- a/WEEK01/WEEK01-02-S.md +++ /dev/null @@ -1,56 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 2 Solution: Find Strings in Ghidra - -#### Answers - -##### String Location - -| Item | Answer | -|------|--------| -| **String Address** | `0x100019CC` | -| **Actual String Content** | `"hello, world\r\n"` | -| **String Length** | 14 bytes | -| **Located In** | Flash memory (XIP region, starts with `0x10000...`) | - -##### Question 1: What is the address and is it Flash or RAM? -The string `"hello, world\r\n"` is located at address **`0x100019CC`** in **Flash memory**. We know it is Flash because the address begins with `0x10000...` (the XIP/Execute-In-Place region starts at `0x10000000`). RAM addresses start at `0x20000000`. - -##### Question 2: How many bytes does the string take? -**14 bytes** total: -- 12 printable characters: `h`, `e`, `l`, `l`, `o`, `,`, ` `, `w`, `o`, `r`, `l`, `d` -- 2 special characters: `\r` (carriage return, 0x0D) and `\n` (newline, 0x0A) - -##### Question 3: How many times is it referenced, and by which function(s)? -The string is referenced **1 time**, only in the **`main()`** function. The `ldr` instruction at `0x1000023a` loads the string address into register `r0`, which is then passed to `__wrap_puts`. - -##### Question 4: How is the string encoded? -The string is encoded in **ASCII**. Each character occupies exactly one byte: -- `\r` = `0x0D` (carriage return) -- `\n` = `0x0A` (newline/line feed) - -##### Expected Output - -``` -String Found: "hello, world\r\n" -Address: 0x100019CC -Located in: Flash (XIP region) -Total Size: 14 bytes -Referenced by: main() -Used in: printf() argument (optimized to __wrap_puts) to print the string in an infinite loop -``` - -#### Reflection Answers - -1. **Why is the string stored in Flash instead of RAM?** - String literals are constants that never change. Storing them in Flash (read-only) saves precious RAM for variables and the stack. The XIP feature allows the processor to read directly from Flash. - -2. **What would happen if you tried to modify this string at runtime?** - Flash memory is read-only at runtime. Attempting to write to a Flash address would cause a fault. To modify printed output, you must write your new string to SRAM (`0x20000000+`) and redirect the pointer. - -3. **How does the Listing view help you understand string storage?** - The Listing view shows the raw hex bytes alongside their ASCII interpretation, letting you see exactly how each character maps to memory and where the string boundaries are. diff --git a/WEEK01/WEEK01-02.md b/WEEK01/WEEK01-02.md deleted file mode 100644 index 88828a7..0000000 --- a/WEEK01/WEEK01-02.md +++ /dev/null @@ -1,162 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 2: Find Strings in Ghidra - -#### Objective -Learn how to locate and analyze strings in a binary, understanding where they are stored in memory and how they're used. - -#### Prerequisites -- Ghidra installed with `0x0001_hello-world` project open -- Basic familiarity with Ghidra's interface (from Exercise 1) -- CodeBrowser window open with the binary loaded - -#### Task Description - -In this exercise, you'll find the "hello, world" string in the binary and determine: -1. **Where** it's located in memory (its address) -2. **How** it's used by the program -3. **What** format it's stored in - -#### Step-by-Step Instructions - -##### Step 1: Open the Defined Strings Window - -1. In the CodeBrowser menu, go to **Window** (top menu bar) -2. Look for and click on **Defined Strings** -3. A new window should appear showing all strings Ghidra found in the binary - -##### Step 2: Understand the Strings Window - -The Defined Strings window shows: -- **Address**: The memory location where the string starts -- **String**: The actual text content -- **Length**: How many bytes the string uses -- **Defined**: Whether Ghidra has marked it as data - -##### Step 3: Search for "hello, world" - -1. In the Defined Strings window, look through the list to find `"hello, world"` -2. **Search method**: If the window has a search box at the top, you can type to filter. Otherwise, use **Ctrl+F** to open the search function -3. Once you find it, **click on it** to highlight the entry - -##### Step 4: Record the Address - -When you find `"hello, world"`, note down: - -**String Address**: ________________ - -**Actual String Content**: ________________ - -**String Length**: ________________ bytes - -##### Step 5: Double-Click to Navigate - -1. **Double-click** on the `"hello, world"` entry in the Defined Strings window -2. Ghidra will automatically navigate you to that address in the CodeBrowser -3. You should see the string displayed in the **Listing** view (center panel) - -##### Step 6: Examine the Listing View - -Now that you're at the string's location: - -1. Look at the **Listing view** (center panel) where the string is shown -2. You'll see the string in **hex/ASCII** format -3. Notice how it appears in memory - each character takes one byte -4. Look for the string content: `hello, world\r\n` -5. What comes after the string? (Ghidra may show other data nearby) - -##### Step 7: Look at the Cross-References - -To see where this string is **used**: - -1. In the Listing view where the string is displayed, **right-click** on the string -2. Select **References** ? **Show References to** -3. A dialog should appear showing which functions/instructions reference this string -4. This tells you which parts of the code use this string - -##### Step 8: Answer These Questions - -Based on what you found: - -###### Question 1: What is the address, and is it Flash or RAM? -- What is the address of the "hello, world" string? __________ -- Is it in Flash memory (starts with `0x100...`) or RAM (starts with `0x200...`)? __________ - -###### Question 2: How many bytes does the string take? -- How many bytes does the string take in memory? __________ -- Can you count the characters? (h-e-l-l-o-,-space-w-o-r-l-d-\r-\n) - -###### Question 3: How many times is it referenced, and by which function(s)? -- How many times is this string referenced in the code? __________ -- Which function(s) reference it? (Hint: Look at the cross-references) - -###### Question 4: How is the string encoded? -- How is the string encoded in memory? -- Is each character one byte or more? __________ -- What does `\r` and `\n` represent? (Hint: `\r` = carriage return, `\n` = newline) - -#### Expected Output - -You should be able to fill in a summary like: - -``` -String Found: "hello, world\r\n" -Address: 0x________ -Located in: [Flash / RAM] -Total Size: ________ bytes -Referenced by: [Function names] -Used in: [How the program uses it] -``` - -#### Deeper Exploration (Optional Challenge) - -##### Challenge 1: Follow the String Usage -1. From the cross-references you found, click on the instruction that uses the string -2. You should navigate to the `ldr` (load) instruction that loads the string's address into register `r0` -3. This is how the `printf` function gets the pointer to the string! - -##### Challenge 2: Find Other Strings -1. Go back to the Defined Strings window -2. Look for other strings in the binary -3. Are there any other text strings besides "hello, world"? -4. If yes, where are they and what are they used for? - -##### Challenge 3: Understand Little-Endian -1. When Ghidra shows the string address in the `ldr` instruction, it's showing a number -2. Look at the raw bytes of that address value -3. Notice how the bytes are stored in "backwards" order? That's little-endian! -4. Can you convert the hex bytes to the actual address? - -#### Questions for Reflection - -1. **Why is the string stored in Flash instead of RAM?** -2. **What would happen if you tried to modify this string at runtime?** -3. **How does the Listing view help you understand string storage?** - -#### Tips and Hints - -- Strings in compiled binaries are often stored in read-only memory (Flash) to save RAM -- The `\r` and `\n` characters are special: they're single bytes (0x0D and 0x0A in hex) -- When you see a string in Ghidra's listing, the ASCII representation is shown on the right side -- You can scroll left/right in the Listing view to see different representations (hex, ASCII, disassembly) - -#### Real-World Application - -Understanding where strings are stored is crucial for: -- **Firmware modification**: Finding text messages to modify -- **Reverse engineering**: Understanding what a program does by finding its strings -- **Vulnerability analysis**: Finding format string bugs or hardcoded credentials -- **Localization**: Finding where text needs to be translated - -#### Summary - -By completing this exercise, you've learned: -1. How to find strings in a binary using Ghidra's Defined Strings window -2. How to determine the memory address of a string -3. How to follow cross-references to see where strings are used -4. How strings are stored in memory and referenced in code -5. The relationship between C code (`printf()`) and assembly (`ldr`) diff --git a/WEEK01/WEEK01-03-S.md b/WEEK01/WEEK01-03-S.md deleted file mode 100644 index bffaac3..0000000 --- a/WEEK01/WEEK01-03-S.md +++ /dev/null @@ -1,60 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 3 Solution: Find Cross-References in Ghidra - -#### Answers - -##### Fill-in-the-Blank Items - -| Item | Answer | -|------|--------| -| **Data reference address** | `0x10000244` (DAT_10000244) | -| **Number of references** | 1 | -| **Reference type** | Read (`ldr` instruction) | -| **Function using it** | `main()` | -| **Next instruction after ldr** | `bl __wrap_puts` at `0x100015fc` | - -##### Question 1: What is the address of the data reference? -The data reference is at **`0x10000244`** (labeled `DAT_10000244` in Ghidra). This location stores the pointer value `0x100019CC`, which is the address of the `"hello, world"` string. - -##### Question 2: How many places reference this data? -**1 place** - it is only referenced in the `main()` function via the `ldr` instruction. - -##### Question 3: Is it a read or write operation? Why? -It is a **READ** operation. The `ldr` (Load Register) instruction reads the pointer value from `DAT_10000244` into register `r0`. The program needs to read this pointer to pass the string address as an argument to `__wrap_puts`. - -##### Question 4: What happens next after the `ldr`? -After the `ldr r0, [DAT_10000244]` instruction loads the string address into `r0`, the next instruction is **`bl 0x100015fc <__wrap_puts>`** which calls the `puts` function with `r0` as its argument (the string pointer). - -##### Complete the Data Flow Chain - -``` -String "hello, world\r\n" stored at 0x100019CC (Flash) - | - v -Pointer to string stored at DAT_10000244 (0x10000244) - | - v -main() executes: ldr r0, [DAT_10000244] -> r0 = 0x100019CC - | - v -main() executes: bl __wrap_puts -> prints the string - | - v -main() executes: b.n main+6 -> loops back (infinite loop) -``` - -#### Reflection Answers - -1. **Why does the compiler use a pointer (indirect reference) instead of embedding the string address directly in the instruction?** - ARM Thumb instructions have limited immediate value sizes. The `ldr` instruction uses a PC-relative offset to reach a nearby literal pool entry (`DAT_10000244`) that holds the full 32-bit address. This pattern allows addressing any location in the 4 GB address space. - -2. **What is a literal pool?** - A literal pool is a region of constant data placed near the code that uses it. The compiler stores full 32-bit values here that cannot fit as immediates in Thumb instructions. The `ldr` instruction loads from the literal pool using a small PC-relative offset. - -3. **How does cross-referencing help in reverse engineering?** - Cross-references let you trace data flow through a program. Starting from a known string, you can find which functions use it, how data moves between functions, and understand the program's control flow without having source code. diff --git a/WEEK01/WEEK01-03.md b/WEEK01/WEEK01-03.md deleted file mode 100644 index 4c7389f..0000000 --- a/WEEK01/WEEK01-03.md +++ /dev/null @@ -1,190 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 3: Find Cross-References in Ghidra - -#### Objective -Learn how to use Ghidra's cross-reference feature to trace how data flows through code, understanding where specific data is read, written, or referenced. - -#### Prerequisites -- Ghidra installed with `0x0001_hello-world` project open -- Completed Exercise 2 (Find Strings) - you should know where the "hello, world" string is located -- CodeBrowser window open with the binary loaded - -#### Task Description - -In this exercise, you'll: -1. Navigate to a specific data reference in the `main` function -2. Find where a particular data item (`DAT_...`) is used -3. Trace back to see which functions access this data -4. Understand how data flows from memory to the CPU and then to functions - -#### Background: What are Cross-References? - -A **cross-reference** is a link between different parts of the code: -- **Code ? Data**: An instruction reads or writes data -- **Code ? Code**: A function calls another function -- **Data ? Data**: One data item references another - -In this exercise, we're tracking **code ? data** references to understand where and how the program uses the "hello, world" string. - -#### Step-by-Step Instructions - -##### Step 1: Navigate to the main Function - -1. In Ghidra's CodeBrowser, use **Search ? For Address or Label** (or press **Ctrl+G**) -2. Type `main` and press Enter -3. Ghidra will navigate to the `main` function -4. You should see the disassembly in the Listing view (center panel) - -##### Step 2: Locate the `ldr` Instruction - -In the main function's disassembly, look for an `ldr` (load register) instruction. It should look something like: - -``` -ldr r0, [DAT_10000244] -``` - -or similar. This instruction: -- **`ldr`** = load register (read data from memory) -- **`r0`** = put the data into register `r0` -- **`[DAT_10000244]`** = read from the address stored at location `DAT_10000244` - -##### Step 3: Understand the Notation - -In Ghidra's decompiler notation: -- **`DAT_10000244`** = a data item (not code) at address `0x10000244` -- **`[...]`** = the address of; accessing memory at that location -- The actual value is the address of the "hello, world" string in Flash memory - -##### Step 4: Right-Click on the Data Reference - -1. In the Listing view, find the `ldr` instruction that loads the string address -2. **Right-click** on the `DAT_...` part (the data reference) -3. A context menu should appear - -##### Step 5: Select "References" Option - -In the context menu: -1. Look for an option that says **References** -2. Click on it to see a submenu -3. Select **Show References to** (this shows "where is this data used?") - -##### Step 6: Review the References Window - -A new window should appear showing all the locations where `DAT_10000244` (or whatever the address is) is referenced: - -**Expected output might look like:** -``` -DAT_10000244 (1 xref): - main:10000236 (read) -``` - -This means: -- The data at `DAT_10000244` is used in 1 place -- That place is in the `main` function at instruction `10000236` -- It's a **read** operation (the code is reading this data) - -##### Step 7: Answer These Questions - -###### Question 1: What is the address of the data reference? -- What is the address of the data reference you found? (e.g., `DAT_10000244`) -- __________ - -###### Question 2: How many places reference this data? -- How many places reference this data? -- __________ -- Which function(s) use it? -- __________ - -###### Question 3: Is it a read or write operation? Why? -- Is it a read or write operation? -- __________ -- Why? (What's the program doing with this data?) -- __________ - -###### Question 4: What happens next after the `ldr`? -- The `ldr` instruction loads an address into `r0` -- What happens next? (Hint: Look at the next instruction after the `ldr`) -- __________ -- Is there a function call? If so, which one? -- __________ - -###### Complete the Data Flow Chain -- **`DAT_10000244`** contains the address of the "hello, world" string -- The `ldr` loads that address into `r0` -- Then a function (probably `printf` or `puts`) is called with `r0` as the argument -- Can you trace this complete flow? - -#### Deeper Analysis (Optional Challenge) - -##### Challenge 1: Find the Actual String Address -1. Navigate to the `DAT_10000244` location -2. Look at the value stored there -3. Can you decode the hex bytes and find the actual address of "hello, world"? -4. Hint: The RP2350 uses little-endian encoding, so the bytes are "backwards" - -**Example:** -If you see bytes: `CC 19 00 10` -Read backwards: `10 00 19 CC` = `0x100019CC` - -##### Challenge 2: Understand the Indirection -1. In C, if we want to load an address, we do: `char *ptr = &some_string;` -2. Then to use it: `printf(ptr);` -3. In assembly, this becomes: - - Load the pointer: `ldr r0, [DAT_...]` - - Call the function: `bl printf` -4. Can you see this pattern in the assembly? - -##### Challenge 3: Follow Multiple References -1. Try this with different data items in the binary -2. Find a data reference that has **multiple** cross-references -3. What data is used in more than one place? - -#### Questions for Reflection - -1. **Why does the compiler use an indirect pointer reference here?** -2. **What is a literal pool?** -3. **How does cross-referencing help in reverse engineering?** - -#### Tips and Hints - -- If you right-click and don't see "References", try right-clicking directly on the instruction address instead -- You can also use **Search ? For Cross References** from the menu for a more advanced search -- In the Decompile view (right side), cross-references may be shown in a different format or with different colors -- Multi-level references: You can right-click on a data item and then follow the chain to another data item - -#### Real-World Applications - -Understanding cross-references is crucial for: -- **Vulnerability hunting**: Finding where user input flows through the code -- **Firmware patching**: Changing constants, strings, or data values -- **Malware analysis**: Tracking command-and-control server addresses or encryption keys -- **Reverse engineering**: Understanding program logic by following data dependencies - -#### Summary - -By completing this exercise, you've learned: -1. How to find and interpret cross-references in Ghidra -2. How to trace data from its definition to where it's used -3. How the `ldr` (load) instruction works to pass data to functions -4. The relationship between high-level C code and assembly-level data flow -5. How addresses are indirectly referenced in position-independent code - -#### Expected Final Understanding - -You should now understand this flow: -``` -String "hello, world" is stored at address 0x100019CC in Flash - ? -A pointer to this address is stored at DAT_10000244 in Flash - ? -The main() function loads this pointer: ldr r0, [DAT_10000244] - ? -main() calls printf with r0 (the string address) as the argument - ? -printf() reads the bytes at that address and prints them -``` diff --git a/WEEK01/WEEK01-04-S.md b/WEEK01/WEEK01-04-S.md deleted file mode 100644 index b9814a7..0000000 --- a/WEEK01/WEEK01-04-S.md +++ /dev/null @@ -1,72 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 4 Solution: Connect GDB & Basic Exploration - -#### Answers - -##### Step 3: Answer Exactly - -- **Was GDB able to connect to OpenOCD?** - - Yes, via `target extended-remote localhost:3333`. -- **Did the program stop at the `main` breakpoint?** - - Yes, at `Breakpoint 1, main () at ../0x0001_hello-world.c:4`. -- **What is the address of `main`'s first instruction, and is it Flash or RAM?** - - `0x10000234`, and it is in **Flash** (`0x100...` XIP region). -- **What is the `sp` value at `main`, and is it Flash or RAM?** - - `0x20082000`, and it is in **RAM** (`0x200...` SRAM region). -- **What is the first instruction in `main`, and what does it do?** - - `push {r3, lr}`; it saves `r3` and `lr` on the stack and keeps 8-byte stack alignment for ABI-compliant calls. -- **Does GDB match what Ghidra shows?** - - Yes. The disassembly and flow match the Ghidra listing. - -##### Step 4: Capture Register Values (`pc`, `sp`, `lr`, `r0-r3`) - -| Register | Value | Description | -|----------|-------|-------------| -| **pc** | `0x10000234` | Program Counter - at start of main (Flash) | -| **sp** | `0x20082000` | Stack Pointer - top of stack (RAM) | -| **lr** | `0x1000018f` | Link Register - return address after main | -| **r0** | `0x0` | General Purpose - will hold function arguments | -| **r1** | `0x10000235` | General Purpose | -| **r2** | `0x80808080` | General Purpose | -| **r3** | `0xe000ed08` | General Purpose | - -##### Reference Disassembly (for verification) - -``` -0x10000234 <+0>: push {r3, lr} # Save registers to stack -0x10000236 <+2>: bl 0x1000156c # Initialize I/O -0x1000023a <+6>: ldr r0, [pc, #8] # Load string pointer -0x1000023c <+8>: bl 0x100015fc <__wrap_puts> # Print string -0x10000240 <+12>: b.n 0x1000023a # Infinite loop -0x10000242 <+14>: nop -0x10000244 <+16>: (data: pointer to string) -``` - -##### GDB Connection Sequence - -``` -Terminal 1: openocd -s "..." -f interface/cmsis-dap.cfg -f target/rp2350.cfg -Terminal 2: arm-none-eabi-gdb build/0x0001_hello-world.elf -(gdb) target extended-remote localhost:3333 -(gdb) monitor reset halt -(gdb) b main -(gdb) c -(gdb) disas main -(gdb) i r -``` - -#### Step 5: Reflection Answers - -1. **Why does the stack pointer start at `0x20082000`?** - The initial stack pointer value comes from the first entry in the vector table at `0x10000000`. The linker script sets `__StackTop` to `0x20082000`, which is the top of the SCRATCH_Y region in SRAM. The stack grows downward from this address. - -2. **Why does `push {r3, lr}` save `r3` even though it doesn't seem to be used?** - ARM requires 8-byte stack alignment. Pushing `lr` alone would only move SP by 4 bytes. Including `r3` ensures the stack remains 8-byte aligned, which is required by the ARM Architecture Procedure Call Standard (AAPCS). - -3. **How does the infinite loop work?** - The instruction at `0x10000240` is `b.n 0x1000023a` - an unconditional branch back to `main+6`, which reloads the string pointer and calls `__wrap_puts` again. The function never returns. diff --git a/WEEK01/WEEK01-04.md b/WEEK01/WEEK01-04.md deleted file mode 100644 index 894e924..0000000 --- a/WEEK01/WEEK01-04.md +++ /dev/null @@ -1,360 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 1 -Introduction and Overview of Embedded Reverse Engineering: Ethics, Scoping, and Basic Concepts - -### Non-Credit Practice Exercise 4: Connect GDB & Basic Exploration - -#### Objective -Set up GDB (GNU Debugger) to dynamically analyze the "hello, world" program running on your Pico 2, verifying that your debugging setup works correctly. - -#### Prerequisites -- Raspberry Pi Pico 2 with "hello-world" binary already flashed -- OpenOCD installed and working -- GDB (arm-none-eabi-gdb) installed -- Your Pico 2 connected to your computer via USB CMSIS-DAP interface -- CMake build artifacts available (`.elf` file from compilation) - -#### Task Description - -In this exercise, you'll: -1. Start OpenOCD to provide a debug server -2. Connect GDB to the Pico 2 via OpenOCD -3. Set a breakpoint at the main function -4. Examine registers and memory while the program is running -5. Verify that your dynamic debugging setup works - -#### Important Setup Notes - -Before you start, make sure: -- Your Pico 2 is **powered on** and connected to your computer -- You have **OpenOCD** installed for ARM debugging -- You have **GDB** (specifically `arm-none-eabi-gdb`) installed -- Your binary file (`0x0001_hello-world.elf`) is available in the `build/` directory - -#### Step-by-Step Instructions - -##### Step 1: Start OpenOCD in Terminal 1 - -Open a **new terminal window** (PowerShell, Command Prompt, or WSL): - -**On Windows (PowerShell/Command Prompt):** -``` -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Expected Output:** -``` -Open On-Chip Debugger 0.12.0+dev -... -Info : CMSIS-DAP: SWD detected -Info : RP2350 (dual core) detected -Info : Using JTAG interface -... -Info : accepting 'gdb' connection on tcp/3333 -``` - -##### Step 2: Start GDB in Terminal 2 - -Open a **second terminal window** and navigate to your project directory: - -``` -arm-none-eabi-gdb build\0x0001_hello-world.elf -``` - -**Expected Output:** -``` -Reading symbols from build\0x0001_hello-world.elf... -(gdb) -``` - -##### Step 3: Connect GDB to OpenOCD - -At the GDB prompt `(gdb)`, type: - -```gdb -target extended-remote localhost:3333 -``` - -**Expected Output:** -``` -Remote debugging using localhost:3333 -(gdb) -``` - -(The warning is normal - you already loaded the .elf file, so it doesn't matter) - -##### Step 4: Reset and Halt the Target - -To reset the Pico 2 and prepare for debugging, type: - -```gdb -monitor reset halt -``` - -**Expected Output:** -``` -(gdb) -``` - -(This resets the processor and halts it, preventing execution until you tell it to run) - -##### Step 5: Set a Breakpoint at main - -To stop execution at the beginning of the `main` function: - -```gdb -b main -``` - -**Expected Output:** -``` -Breakpoint 1 at 0x10000234: file ../0x0001_hello-world.c, line 4. -(gdb) -``` - -**What this means:** -- Breakpoint 1 is set at address `0x10000234` -- That's in the file `../0x0001_hello-world.c` at line 4 -- The breakpoint is at the `main` function - -##### Step 6: Continue Execution to the Breakpoint - -Now let the program run until it hits your breakpoint: - -```gdb -c -``` - -**Expected Output:** -``` -Continuing. - -Breakpoint 1, main () at ../0x0001_hello-world.c:4 -4 stdio_init_all(); -(gdb) -``` - -**Great!** Your program is now halted at the beginning of `main()`. - -##### Step 7: Examine the Assembly with `disas` - -To see the assembly language of the current function: - -```gdb -disas -``` - -**Expected Output:** -``` -Dump of assembler code for function main: -=> 0x10000234 <+0>: push {r3, lr} - 0x10000236 <+2>: bl 0x1000156c - 0x1000023a <+6>: ldr r0, [pc, #8] @ (0x10000244 ) - 0x1000023c <+8>: bl 0x100015fc <__wrap_puts> - 0x10000240 <+12>: b.n 0x1000023a - 0x10000242 <+14>: nop - 0x10000244 <+16>: adds r4, r1, r7 - 0x10000246 <+18>: asrs r0, r0, #32 -End of assembler dump. -(gdb) -``` - -**Interpretation:** -- The `=>` arrow shows where we're currently stopped (at `0x10000234`) -- We can see the `push`, `bl` (branch and link), `ldr`, and `b.n` (branch) instructions -- This is the exact code you analyzed in the Ghidra exercises! - -##### Step 8: View All Registers with `i r` - -To see the current state of all CPU registers: - -```gdb -i r -``` - -**Expected Output:** -``` -r0 0x0 0 -r1 0x10000235 268436021 -r2 0x80808080 -2139062144 -r3 0xe000ed08 -536810232 -r4 0x100001d0 268435920 -r5 0x88526891 -2007865199 -r6 0x4f54710 83183376 -r7 0x400e0014 1074659348 -r8 0x43280035 1126694965 -r9 0x0 0 -r10 0x10000000 268435456 -r11 0x62707361 1651536737 -r12 0xed07f600 -318245376 -sp 0x20082000 0x20082000 -lr 0x1000018f 268435855 -pc 0x10000234 0x10000234
-xpsr 0x69000000 1761607680 -``` - -**Key Registers to Understand:** -| Register | Value | Meaning | -| -------- | ------------ | ------------------------------------------------- | -| `pc` | `0x10000234` | Program Counter - we're at the start of `main` | -| `sp` | `0x20082000` | Stack Pointer - top of our stack in RAM | -| `lr` | `0x1000018f` | Link Register - where we return from `main` | -| `r0-r3` | Various | Will hold function arguments and return values | - -##### Step 9: Step Into the First Instruction - -To execute one assembly instruction: - -```gdb -si -``` - -**Expected Output:** -``` -0x10000236 in main () at ../0x0001_hello-world.c:5 -5 stdio_init_all(); -(gdb) -``` - -The `pc` should now be at `0x10000236`, which is the next instruction. - -##### Step 10: Answer These Questions - -Based on what you've observed: - -###### Question 1: Was GDB able to connect to OpenOCD? -- Was GDB able to connect to OpenOCD? (Yes/No) -- Did the program stop at your breakpoint? (Yes/No) -- __________ - -###### Question 2: What is the address of `main`'s first instruction, and is it Flash or RAM? -- What is the memory address of the `main` function's first instruction? -- __________ -- Is this in Flash memory (0x100...) or RAM (0x200...)? -- __________ - -###### Question 3: What is the `sp` value at `main`, and is it Flash or RAM? -- What is the value of the Stack Pointer (sp) when you're at `main`? -- __________ -- Is this in Flash or RAM? -- __________ - -###### Question 4: What is the first instruction in `main`, and what does it do? -- What is the first instruction in `main`? -- __________ -- What does it do? (Hint: `push` = save to stack) -- __________ - -###### Question 5: Does GDB match what Ghidra shows? -- Look at the disassembly from GDB (Step 7) -- Compare it to the disassembly from Ghidra (Exercise 1) -- Are they the same? -- __________ - -#### Deeper Exploration (Optional Challenge) - -##### Challenge 1: Step Through stdio_init_all -1. Continue stepping: `si` (step into) or `ni` (next instruction) -2. Eventually, you'll reach `bl 0x1000156c ` -3. Use `si` to step **into** that function -4. What instructions do you see? -5. What registers are being modified? - -##### Challenge 2: View Specific Registers -Instead of viewing all registers, you can view just a few: -```gdb -i r pc sp lr r0 r1 r2 -``` -This shows only the registers you care about. - -##### Challenge 3: Examine Memory -To examine memory at a specific address (e.g., where the string is): -```gdb -x/16b 0x100019cc -``` -This displays 16 bytes (`b` = byte) starting at address `0x100019cc`. Can you see the "hello, world" string? - -##### Challenge 4: Set a Conditional Breakpoint -Set a breakpoint that only triggers after a certain condition: -```gdb -b *0x1000023a if $r0 != 0 -``` -This is useful when you want to break on a condition rather than every time. - -#### Questions for Reflection - -1. **Why does the stack pointer start where it does?** -2. **Why does `push {r3, lr}` include `r3`?** -3. **How does the infinite loop work in assembly?** - -#### Important GDB Commands Reference - -| Command | Short Form | What It Does | -| ---------------------- | ---------- | ------------------------------------ | -| `target extended-remote localhost:3333` | | Connect to OpenOCD | -| `monitor reset halt` | | Reset and halt the processor | -| `break main` | `b main` | Set a breakpoint at main function | -| `continue` | `c` | Continue until breakpoint | -| `step instruction` | `si` | Step one instruction (into calls) | -| `next instruction` | `ni` | Step one instruction (over calls) | -| `disassemble` | `disas` | Show assembly for current function | -| `info registers` | `i r` | Show all register values | -| `x/Nxy ADDRESS` | `x` | Examine memory (N=count, x=format, y=size) | -| `quit` | `q` | Exit GDB | - -**Examples for `x` command:** -- `x/10i $pc` - examine 10 instructions at program counter -- `x/16b 0x20000000` - examine 16 bytes starting at RAM address -- `x/4w 0x10000000` - examine 4 words (4-byte values) starting at Flash address - -#### Troubleshooting - -##### Problem: "OpenOCD not found" -**Solution:** Make sure OpenOCD is in your PATH or use the full path to the executable - -##### Problem: "Target not responding" -**Solution:** -- Check that your Pico 2 is properly connected -- Make sure OpenOCD is running and shows "accepting 'gdb' connection" -- Restart both OpenOCD and GDB - -##### Problem: "Cannot find breakpoint at main" -**Solution:** -- Make sure you compiled with debug symbols -- The .elf file must include symbol information -- Try breaking at an address instead: `b *0x10000234` - -##### Problem: GDB shows "No source available" -**Solution:** -- This happens with stripped binaries -- You can still see assembly with `disas` -- You can still examine memory and registers - -#### Summary - -By completing this exercise, you've: -1. ? Set up OpenOCD as a debug server -2. ? Connected GDB to a Pico 2 board -3. ? Set a breakpoint and halted execution -4. ? Examined assembly language in a live debugger -5. ? Viewed CPU registers and their values -6. ? Verified your dynamic debugging setup works - -You're now ready for Week 2, where you'll: -- Step through code line by line -- Watch variables and memory change -- Understand program flow in detail -- Use this knowledge to modify running code - -#### Next Steps - -1. **Close GDB**: Type `quit` or `q` to exit -2. **Close OpenOCD**: Type `Ctrl+C` in the OpenOCD terminal -3. **Review**: Go back to the Ghidra exercises and compare static vs. dynamic analysis -4. **Prepare**: Read through Week 2 materials to understand what's coming next diff --git a/WEEK01/WEEK01.md b/WEEK01/WEEK01.md index 839fdfc..c827cfc 100644 --- a/WEEK01/WEEK01.md +++ b/WEEK01/WEEK01.md @@ -13,7 +13,7 @@ By the end of this week, you will be able to: --- -## 📚 Part 1: Understanding the Basics +## Part 1: Understanding the Basics ### What is a Microcontroller? @@ -32,7 +32,7 @@ Reverse engineering is like being a detective for code. Instead of writing code --- -## 📚 Part 2: Understanding Processor Registers +## Part 2: Understanding Processor Registers ### What is a Register? @@ -70,13 +70,13 @@ The two Arm ABI documents we verified give the formal proof for these rules. In ``` Higher Memory Address (0x20082000) -┌──────────────────┐ -│ │ ← Stack starts here (empty) -├──────────────────┤ -│ Pushed Item 1 │ ← SP points here after 1 push -├──────────────────┤ -│ Pushed Item 2 │ ← SP points here after 2 pushes -└──────────────────┘ ++------------------+ +| | ← Stack starts here (empty) ++------------------+ +| Pushed Item 1 | ← SP points here after 1 push ++------------------+ +| Pushed Item 2 | ← SP points here after 2 pushes ++------------------+ Lower Memory Address (0x20081FF8) ``` @@ -103,7 +103,7 @@ The Program Counter always points to the **next instruction** the processor will --- -## 📚 Part 3: Understanding Memory Layout +## Part 3: Understanding Memory Layout ### XIP - Execute In Place @@ -116,15 +116,15 @@ This is where your program code starts in flash memory. Remember this address - ### Memory Map Overview ``` -┌─────────────────────────────────────┐ -│ Flash Memory (XIP) │ -│ Starts at: 0x10000000 │ -│ Contains: Your program code │ -├─────────────────────────────────────┤ -│ RAM │ -│ Starts at: 0x20000000 │ -│ Contains: Stack, Heap, Variables │ -└─────────────────────────────────────┘ ++-------------------------------------+ +| Flash Memory (XIP) | +| Starts at: 0x10000000 | +| Contains: Your program code | ++-------------------------------------+ +| RAM | +| Starts at: 0x20000000 | +| Contains: Stack, Heap, Variables | ++-------------------------------------+ ``` ### Stack vs Heap @@ -139,7 +139,7 @@ This is where your program code starts in flash memory. Remember this address - --- -## 📚 Part 3.5: Reviewing Our Hello World Code +## Part 3.5: Reviewing Our Hello World Code Before we start debugging, let's understand the code we'll be working with. Here's our `0x0001_hello-world.c` program: @@ -197,7 +197,7 @@ while (true) - **`while (true)`** - This creates an infinite loop. The program will keep running forever (or until you reset/power off the Pico). - **`printf("hello, world\r\n")`** - This prints the text "hello, world" followed by a carriage return (`\r`) and newline (`\n`). -> 💡 **Why `\r\n` instead of just `\n`?** +> Tip: **Why `\r\n` instead of just `\n`?** > > In embedded systems, we often use both carriage return (`\r`) and newline (`\n`) together. The `\r` moves the cursor back to the beginning of the line, and `\n` moves to the next line. This ensures proper display across different terminal programs. @@ -239,7 +239,7 @@ To flash new code to your Pico 2, you need to put it into **BOOTSEL mode**: When done correctly, your Pico 2 will appear as a USB mass storage device (like a flash drive) on your computer. This means it's ready to receive new firmware! -> 💡 **Tip:** You'll see a drive called "RP2350" appear in your file explorer when the Pico 2 is in flash loading mode. +> Tip: **Tip:** You'll see a drive called "RP2350" appear in your file explorer when the Pico 2 is in flash loading mode. ##### Step 3: Flash and Run @@ -251,7 +251,7 @@ Once flashed, your Pico 2 will immediately start executing the hello-world progr --- -## 📚 Part 4: Dynamic Analysis with GDB +## Part 4: Dynamic Analysis with GDB ### Prerequisites @@ -267,7 +267,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -318,10 +318,6 @@ Breakpoint 1, main () at ../0x0001_hello-world.c:5 The program has stopped right at the beginning of `main`! - - - - ##### Disassembling with `disas` The `disas` (disassemble) command shows us the assembly instructions for the current function: @@ -352,9 +348,9 @@ To see how the ELF is laid out in memory, use: ```gdb (gdb) info files -Symbols from "C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0001_hello-world\build\0x0001_hello-world.elf". +Symbols from "C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0001_hello-world\build\0x0001_hello-world.elf". Extended remote target using gdb-specific protocol: - `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. + `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. Entry point: 0x1000014c 0x10000000 - 0x100019cc is .text 0x100019cc - 0x10001b18 is .rodata @@ -370,7 +366,7 @@ Extended remote target using gdb-specific protocol: 0x10001ce8 - 0x10001cfc is .flash_end While running this, GDB does not access memory from... Local exec file: - `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. + `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. Entry point: 0x1000014c 0x10000000 - 0x100019cc is .text 0x100019cc - 0x10001b18 is .rodata @@ -385,7 +381,7 @@ Local exec file: 0x20081000 - 0x20081800 is .stack_dummy 0x10001ce8 - 0x10001cfc is .flash_end (gdb) maintenance info sections -Exec file: `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. +Exec file: `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0001_hello-world\build\0x0001_hello-world.elf', file type elf32-littlearm. [0] 0x10000000->0x100019cc at 0x00001000: .text ALLOC LOAD READONLY CODE HAS_CONTENTS [1] 0x100019cc->0x10001b18 at 0x000029cc: .rodata ALLOC LOAD READONLY DATA HAS_CONTENTS [2] 0x10001b18->0x10001b20 at 0x00002b18: .ARM.exidx ALLOC LOAD READONLY DATA HAS_CONTENTS @@ -445,7 +441,7 @@ Exec file: `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0001_hello-world\b | `.debug_loclists` | Variable location lists (where variables live over PC ranges). | | `.debug_line_str` | Extra string pool used by `.debug_line` data. | -> 💡 **Practical rule:** For reverse engineering runtime behavior, focus first on `.text`, `.rodata`, `.data`, `.bss`, heap/stack regions, and the vector table. Debug sections are for source-level mapping and symbol intelligence. +> Tip: **Practical rule:** For reverse engineering runtime behavior, focus first on `.text`, `.rodata`, `.data`, `.bss`, heap/stack regions, and the vector table. Debug sections are for source-level mapping and symbol intelligence. **Fast interpretation checklist (use this every time):** @@ -493,7 +489,7 @@ xpsr 0x69000000 1761607680 | `lr` | `0x100002d5` | Link Register - where we return after `main` | | `r0-r3` | Various | Will hold function arguments and return values | -> 💡 **Tip:** You can also use `i r pc sp lr` to show only specific registers you care about. +> Tip: **Tip:** You can also use `i r pc sp lr` to show only specific registers you care about. ### Quick Reference: Essential GDB Commands @@ -528,7 +524,7 @@ Notice the difference between inspecting memory at `$sp` and inspecting `$lr`. 0x1000018f : 0x00478849 ``` -> 💡 **What's Next?** In Week 2, we'll put these GDB commands to work with hands-on debugging exercises! We'll step through code, examine the stack, watch registers change, and ultimately use these skills to modify a running program. The commands you learned here are the foundation for everything that follows. +> Tip: **What's Next?** In Week 2, we'll put these GDB commands to work with hands-on debugging exercises! We'll step through code, examine the stack, watch registers change, and ultimately use these skills to modify a running program. The commands you learned here are the foundation for everything that follows. --- @@ -541,7 +537,7 @@ Before we dive into GDB debugging, let's set up Ghidra to analyze our hello-worl ##### Step 1: Create a New Project 1. Launch Ghidra -2. A window will appear - select **File → New Project** +2. A window will appear - select **File -> New Project** 3. Choose **Non-Shared Project** and click **Next** 4. Enter the Project Name: `0x0001_hello-world` 5. Click **Finish** @@ -555,7 +551,7 @@ Before we dive into GDB debugging, let's set up Ghidra to analyze our hello-worl In the small window that appears, you will see the file identified as an **ELF** (Executable and Linkable Format). -> 💡 **What is an ELF file?** +> Tip: **What is an ELF file?** > > ELF stands for **Executable and Linkable Format**. This format includes **symbols** - human-readable names for functions and variables. These symbols make reverse engineering much easier because you can see function names like `main` and `printf` instead of just memory addresses. > @@ -575,7 +571,7 @@ Ghidra will now process the binary, identifying functions, strings, and cross-re Once analysis is complete, let's find our `main` function: 1. In the **Symbol Tree** panel on the left, expand **Functions** -2. Look for `main` in the list (you can also use **Search → For Address or Label** and type "main") +2. Look for `main` in the list (you can also use **Search -> For Address or Label** and type "main") 3. Click on `main` to navigate to it ##### What You'll See @@ -677,104 +673,27 @@ In future weeks, we'll work with `.bin` files that have been stripped of symbols ### The Program Flow ``` -┌─────────────────────────────────────────────────────┐ -│ 1. push {r3, lr} │ -│ Save registers to stack │ -├─────────────────────────────────────────────────────┤ -│ 2. bl stdio_init_all │ -│ Initialize standard I/O │ -├─────────────────────────────────────────────────────┤ -│ 3. ldr r0, [pc, #8] ────────────────┐ │ -│ Load address of "hello, world" into r0│ │ -├─────────────────────────────────────────────────────┤ -│ 4. bl __wrap_puts │ │ -│ Print the string │ │ -├─────────────────────────────────────────────────────┤ -│ 5. b.n (back to step 3) ────────────────┘ │ -│ Infinite loop! │ -└─────────────────────────────────────────────────────┘ ++-----------------------------------------------------+ +| 1. push {r3, lr} | +| Save registers to stack | ++-----------------------------------------------------+ +| 2. bl stdio_init_all | +| Initialize standard I/O | ++-----------------------------------------------------+ +| 3. ldr r0, [pc, #8] ----------------+ | +| Load address of "hello, world" into r0| | ++-----------------------------------------------------+ +| 4. bl __wrap_puts | | +| Print the string | | ++-----------------------------------------------------+ +| 5. b.n (back to step 3) ----------------+ | +| Infinite loop! | ++-----------------------------------------------------+ ``` --- -## ✅ Practice Exercises - -Try these on your own to reinforce what you learned: - -These prompts are intentionally aligned 1:1 with the four Week 1 solution files: -- `WEEK01-01-S.md` -- `WEEK01-02-S.md` -- `WEEK01-03-S.md` -- `WEEK01-04-S.md` - -### Exercise 1: Analyze `stdio_init_all` in Ghidra -1. Open your `0x0001_hello-world` project in Ghidra. -2. Find `stdio_init_all` in the Symbol Tree. -3. Answer exactly: - - What does the function return? - - What parameters does it take? - - What functions does it call? - - What is its purpose? -4. Reflection: - - Why would we need to initialize standard I/O before using `printf()`? - - Can you find other functions in the Symbol Tree that might be related to I/O? - - How does this function support the `printf("hello, world\r\n")` call in `main`? - -### Exercise 2: Locate and Characterize the String -1. In Ghidra, go to **Window → Defined Strings**. -2. Find `"hello, world\r\n"` and record its address. -3. Answer exactly: - - What is the address, and is it Flash or RAM? - - How many bytes does the string take? - - How many times is it referenced, and by which function(s)? - - How is the string encoded? -4. Reflection: - - Why is the string stored in Flash instead of RAM? - - What would happen if you tried to modify this string at runtime? - - How does the Listing view help you understand string storage? - -### Exercise 3: Trace Cross-References and Data Flow -1. In `main`, locate `DAT_10000244` and open its references. -2. Fill in: - - Data reference address - - Number of references - - Reference type (read or write) - - Function using it - - Next instruction after `ldr` -3. Answer exactly: - - What is the address of the data reference? - - How many places reference this data? - - Is it a read or write operation? Why? - - What happens next after the `ldr`? -4. Complete the data flow chain from string storage to print call. -5. Reflection: - - Why does the compiler use an indirect pointer reference here? - - What is a literal pool? - - How does cross-referencing help in reverse engineering? - -### Exercise 4: Verify Runtime View in GDB -1. Start OpenOCD and connect GDB as shown in Part 4. -2. Break at `main` and continue to the breakpoint. -3. Answer exactly: - - Was GDB able to connect to OpenOCD? - - Did the program stop at the `main` breakpoint? - - What is the address of `main`'s first instruction, and is it Flash or RAM? - - What is the `sp` value at `main`, and is it Flash or RAM? - - What is the first instruction in `main`, and what does it do? - - Does GDB match what Ghidra shows? -4. Capture register values for `pc`, `sp`, `lr`, and `r0-r3`. -5. Reflection: - - Why does the stack pointer start where it does? - - Why does `push {r3, lr}` include `r3`? - - How does the infinite loop work in assembly? - -Use these solution keys after attempting the exercises: -- `WEEK01-01-S.md` -- `WEEK01-02-S.md` -- `WEEK01-03-S.md` -- `WEEK01-04-S.md` - -> 💡 **Note:** The detailed hands-on GDB debugging (stepping through code, watching the stack, examining memory) will be covered in Week 2! +> **Note:** The detailed hands-on GDB debugging (stepping through code, watching the stack, examining memory) will be covered in Week 2! --- @@ -807,3 +726,5 @@ Use these solution keys after attempting the exercises: | **Stack** | Memory region for temporary storage during function calls | | **Stack Pointer** | Register that points to the top of the stack | | **XIP** | Execute In Place - running code directly from flash | + + diff --git a/WEEK02/WEEK02-01-S.md b/WEEK02/WEEK02-01-S.md deleted file mode 100644 index 4145a50..0000000 --- a/WEEK02/WEEK02-01-S.md +++ /dev/null @@ -1,41 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 1 Solution: Change the Message - -#### Answers - -##### Attack Summary -The goal is to write a custom message into SRAM at `0x20040000` and redirect `r0` to print it instead of the original `"hello, world"` string, without changing the source code. - -##### GDB Commands - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -(gdb) b *0x1000023c # Breakpoint before __wrap_puts -(gdb) c # Continue to breakpoint -(gdb) set {char[12]} 0x20040000 = {'Y','o','u','r',' ','N','a','m','e','!','\r','\0'} -(gdb) set $r0 = 0x20040000 # Redirect r0 to injected message -(gdb) c # Resume - serial shows custom message -``` - -##### Verification -```gdb -(gdb) x/s 0x20040000 # Should show your injected message -(gdb) x/s 0x100019cc # Original string still in Flash -``` - -#### Reflection Answers - -1. **Why does the string have to live in SRAM instead of flash during runtime?** - Flash memory is read-only at runtime. The original string at `0x100019cc` cannot be modified. SRAM is read-write, so we place our replacement string at the safe runtime address `0x20040000`. - -2. **What would happen if you forgot the null terminator in your injected string?** - `puts()` reads characters until it encounters `\0`. Without it, `puts()` would continue reading past the intended string, printing garbage characters from adjacent memory until a null byte happens to appear. This could crash the program or leak sensitive data. - -3. **How does changing `r0` alter the behavior of `puts()` without touching source code?** - In the ARM calling convention, the first function argument is passed in `r0`. When `bl __wrap_puts` executes at `0x1000023c`, it reads the string address from `r0`. By changing `r0` from `0x100019cc` (original Flash string) to `0x20040000` (our SRAM string), we redirect what `puts()` prints. diff --git a/WEEK02/WEEK02-01.md b/WEEK02/WEEK02-01.md deleted file mode 100644 index 1896f43..0000000 --- a/WEEK02/WEEK02-01.md +++ /dev/null @@ -1,104 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 1: Change the Message - -#### Objective -Write your own message into SRAM and redirect `r0` so the running program prints it without changing the source code. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD and `arm-none-eabi-gdb` available in your PATH -- Serial monitor (PuTTY/minicom/screen) set to 115200 baud -- `build\0x0001_hello-world.elf` present and flashed to the board -- Week 2 setup steps (0a�0e) completed: OpenOCD, serial monitor, and GDB ready - -#### Task Description -You will create a custom string in SRAM at `0x20040000`, point `r0` at it just before `puts()` runs, and watch the live output change to your message. - -#### Step-by-Step Instructions - -##### Step 1: Start OpenOCD - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -##### Step 2: Start the Serial Monitor -- Open PuTTY (Serial), choose the correct COM port, set speed to `115200`, then click **Open**. - -##### Step 3: Launch GDB - -```powershell -arm-none-eabi-gdb build\0x0001_hello-world.elf -``` - -##### Step 4: Connect and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 5: Break Before `puts()` - -```gdb -(gdb) b *0x1000023c -``` - -##### Step 6: Run to the Breakpoint - -```gdb -(gdb) c -``` - -##### Step 7: Inject Your Message into SRAM -Replace the characters with your name as needed. - -```gdb -(gdb) set {char[12]} 0x20040000 = {'Y','o','u','r',' ','N','a','m','e','!','\r','\0'} -``` - -##### Step 8: Point `r0` to Your Message - -```gdb -(gdb) set $r0 = 0x20040000 -``` - -##### Step 9: Resume and Observe - -```gdb -(gdb) c -``` - -Check PuTTY for your custom string replacing "hello, world". - -#### Expected Output -- GDB stops at `0x1000023c` before `__wrap_puts`. -- `x/s 0x20040000` shows your injected message. -- PuTTY displays your custom message after you continue execution. - -#### Questions for Reflection - -###### Question 1: Why does the string have to live in SRAM instead of flash during runtime? - -###### Question 2: What would happen if you forgot the null terminator in your injected string? - -###### Question 3: How does changing `r0` alter the behavior of `puts()` without touching source code? - -#### Tips and Hints -- Match the array length to your payload exactly (characters + `\0`). The example uses `char[12]`. -- If you miss the breakpoint, confirm OpenOCD is running and the address matches `Week 2` disassembly. -- Use `x/s $r0` to confirm the register points to the intended address before continuing. - -#### Next Steps -- Repeat the exercise with different messages to verify repeatability. -- Try smaller or larger buffers (still within SRAM) to see how size affects safety. -- Move on to Exercise 2 to practice using alternate SRAM addresses. diff --git a/WEEK02/WEEK02-02-S.md b/WEEK02/WEEK02-02-S.md deleted file mode 100644 index ffc051d..0000000 --- a/WEEK02/WEEK02-02-S.md +++ /dev/null @@ -1,38 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 2 Solution: Use a Different SRAM Address - -#### Answers - -##### Attack Summary -Write the payload to `0x20041000` instead of `0x20040000` to demonstrate that multiple safe SRAM locations can be used for injection. - -##### GDB Commands - -```gdb -(gdb) b *0x1000023c -(gdb) c -(gdb) set {char[14]} 0x20041000 = {'h','a','c','k','e','d','!','!','!','\r','\0'} -(gdb) set $r0 = 0x20041000 -(gdb) c -``` - -##### Verification -```gdb -(gdb) x/s 0x20041000 # Shows "hacked!!!\r" -``` - -#### Reflection Answers - -1. **How can you ensure `0x20041000` does not collide with stack usage?** - The stack pointer was observed at `0x20082000` (top of stack) and grows downward. Since `0x20041000` is well below the stack region, there is substantial separation. Use `info registers sp` in GDB to verify the current stack pointer is above your injection address. - -2. **What symptoms would indicate you overwrote an active stack frame?** - The program would crash when attempting to return from a function. Symptoms include: unexpected address exceptions, invalid memory access faults, or the program jumping to random addresses. The Link Register return path gets corrupted. - -3. **How would you pick a safe SRAM offset in a larger program with dynamic allocations?** - Choose a region with clear separation from vectors, stack growth, and active data. In this simple program, `0x20040000` and `0x20041000` are practical safe offsets. In larger programs, inspect linker sections (`.data`, `.bss`, heap) and validate with runtime `sp` checks. diff --git a/WEEK02/WEEK02-02.md b/WEEK02/WEEK02-02.md deleted file mode 100644 index 806d683..0000000 --- a/WEEK02/WEEK02-02.md +++ /dev/null @@ -1,91 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 2: Use a Different SRAM Address - -#### Objective -Practice writing to an alternate SRAM location and redirecting `r0` so your message prints from `0x20041000` instead of `0x20040000`. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD, `arm-none-eabi-gdb`, and a serial monitor ready (Week 2 steps 0a�0e complete) -- `build\0x0001_hello-world.elf` flashed and running -- Comfortable setting breakpoints at `0x1000023c` - -#### Task Description -You will inject a short string into `0x20041000`, point `r0` there, and verify the live output changes, demonstrating that any safe SRAM slot can host your payload. - -#### Step-by-Step Instructions - -##### Step 1: Start OpenOCD - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -##### Step 2: Start the Serial Monitor -- Open PuTTY (Serial) on the correct COM port at `115200` baud. - -##### Step 3: Launch GDB and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 4: Break Before `puts()` - -```gdb -(gdb) b *0x1000023c -(gdb) c -``` - -##### Step 5: Write a Payload at `0x20041000` - -```gdb -(gdb) set {char[14]} 0x20041000 = {'h','a','c','k','e','d','!','!','!','\r','\0'} -``` - -##### Step 6: Redirect `r0` - -```gdb -(gdb) set $r0 = 0x20041000 -``` - -##### Step 7: Continue and Verify - -```gdb -(gdb) c -``` - -Check PuTTY for the new output sourced from the alternate address. - -#### Expected Output -- `x/s 0x20041000` shows `"hacked!!!\r"` (or your variant). -- PuTTY prints the injected message instead of the original string. -- The program continues looping with your modified output. - -#### Questions for Reflection - -###### Question 1: How can you ensure `0x20041000` does not collide with stack usage? - -###### Question 2: What symptoms would indicate you overwrote an active stack frame? - -###### Question 3: How would you pick a safe SRAM offset in a larger program with dynamic allocations? - -#### Tips and Hints -- Keep payloads short; avoid overrunning the allocated bytes. -- If you see crashes, choose a lower SRAM address away from the stack top (stack grows downward). -- Use `info registers sp` and compare with your chosen address to gauge separation. - -#### Next Steps -- Try other safe addresses (e.g., `0x20002000`) and verify stability. -- Map out stack usage by stepping deeper and watching `sp` move. -- Proceed to Exercise 3 to inspect memory around your payload. diff --git a/WEEK02/WEEK02-03-S.md b/WEEK02/WEEK02-03-S.md deleted file mode 100644 index 22fccc6..0000000 --- a/WEEK02/WEEK02-03-S.md +++ /dev/null @@ -1,54 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 3 Solution: Examine Memory Around Your String - -#### Answers - -##### GDB Commands - -```gdb -(gdb) set {char[14]} 0x20040000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'} -(gdb) x/20b 0x20040000 -``` - -##### Byte Dump Output - -``` -0x20040000: 0x68 0x61 0x63 0x6b 0x79 0x2c 0x20 0x77 -0x20040008: 0x6f 0x72 0x6c 0x64 0x0d 0x00 0x00 0x00 -0x20040010: 0x00 0x00 0x00 0x00 -``` - -##### ASCII Mapping - -| Offset | Hex Value | Character | -|--------|-----------|-----------| -| 0x00 | `0x68` | h | -| 0x01 | `0x61` | a | -| 0x02 | `0x63` | c | -| 0x03 | `0x6b` | k | -| 0x04 | `0x79` | y | -| 0x05 | `0x2c` | , (comma) | -| 0x06 | `0x20` | (space) | -| 0x07 | `0x77` | w | -| 0x08 | `0x6f` | o | -| 0x09 | `0x72` | r | -| 0x0a | `0x6c` | l | -| 0x0b | `0x64` | d | -| 0x0c | `0x0d` | \r (carriage return) | -| 0x0d | `0x00` | \0 (null terminator) | - -#### Reflection Answers - -1. **Which bytes mark the end of the printable string, and why are they needed?** - The last two meaningful bytes are `0x0d` (carriage return `\r`) and `0x00` (null terminator `\0`). The null terminator signals the end of the string to `puts()`. Without it, `puts()` would read past the intended string and print garbage memory until a null byte is encountered. - -2. **How would misaligned writes show up in the byte view?** - If you write to an incorrect address or use wrong character offsets, the byte dump would show unexpected values at wrong positions. Characters would appear shifted, and adjacent data structures could be corrupted. - -3. **What risks arise if you overwrite bytes immediately after your string?** - Overwriting adjacent bytes could corrupt other data structures in SRAM, such as variables, linked lists, or runtime metadata. This could cause unpredictable crashes or silent data corruption depending on what occupies those memory locations. diff --git a/WEEK02/WEEK02-03.md b/WEEK02/WEEK02-03.md deleted file mode 100644 index e3a9996..0000000 --- a/WEEK02/WEEK02-03.md +++ /dev/null @@ -1,82 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 3: Examine Memory Around Your String - -#### Objective -Inspect the byte-level layout of your injected string in SRAM and correlate bytes to characters. - -#### Prerequisites -- Pico 2 connected with OpenOCD, GDB, and a serial monitor ready -- `build\0x0001_hello-world.elf` flashed and running -- Ability to break before `__wrap_puts` at `0x1000023c` -- A payload already written to SRAM (e.g., at `0x20040000` from Exercise 1) - -#### Task Description -You will use `x/20b` to view the bytes surrounding your injected string, decode the characters, and confirm the presence of control characters and the null terminator. - -#### Step-by-Step Instructions - -##### Step 1: Connect and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Break Before `puts()` and Run - -```gdb -(gdb) b *0x1000023c -(gdb) c -``` - -##### Step 3: Ensure a String Exists in SRAM -If needed, re-inject a payload: - -```gdb -(gdb) set {char[14]} 0x20040000 = {'h','a','c','k','y',',',' ','w','o','r','l','d','\r','\0'} -(gdb) set $r0 = 0x20040000 -``` - -##### Step 4: Examine Bytes Around the String - -```gdb -(gdb) x/20b 0x20040000 -``` - -##### Step 5: Decode the Output -- Map each byte to ASCII: e.g., `0x68` ? `h`, `0x0d` ? `\r`, `0x00` ? `\0`. -- Note any bytes before/after the string to ensure you did not overwrite adjacent data. - -##### Step 6: Resume Execution - -```gdb -(gdb) c -``` - -#### Expected Output -- A byte dump where the sequence matches your string (`68 61 63 6b 79 2c 20 77 6f 72 6c 64 0d 00`). -- Confirmation of the carriage return (`0x0d`) and null terminator (`0x00`). -- Stable program output in PuTTY after resuming. - -#### Questions for Reflection - -###### Question 1: Which bytes mark the end of the printable string, and why are they needed? - -###### Question 2: How would misaligned writes show up in the byte view? - -###### Question 3: What risks arise if you overwrite bytes immediately after your string? - -#### Tips and Hints -- Use `x/20bx` if you prefer hex with ASCII side-by-side. -- Keep the dump length modest (20 bytes) to avoid clutter while still seeing context. -- If the bytes look incorrect, re-run the injection command to reset the buffer. - -#### Next Steps -- Try viewing a different address (e.g., `0x20041000`) to compare layouts. -- Experiment with longer strings and observe how the byte dump grows. -- Move on to Exercise 4 to automate the hack workflow. diff --git a/WEEK02/WEEK02-04-S.md b/WEEK02/WEEK02-04-S.md deleted file mode 100644 index 30b2c7e..0000000 --- a/WEEK02/WEEK02-04-S.md +++ /dev/null @@ -1,58 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 4 Solution: Automate the Hack - -#### Answers - -##### GDB Command Definition - -```gdb -(gdb) define hack -> set {char[13]} 0x20040000 = "hacky, world" -> set $r0 = 0x20040000 -> c -> end -``` - -##### Usage - -```gdb -(gdb) b *0x1000023c -(gdb) c -(gdb) hack # Executes all three commands at once -``` - -##### Expected Serial Output - -``` -hello, world -hello, world -hello, world -hacky, world <-- HACKED! (after hack command executed) -hacky, world -``` - -#### Reflection Answers - -1. **How could you parameterize the command to accept different strings or addresses?** - Standard GDB `define` blocks do not support function parameters directly. However, you can use GDB convenience variables (`set $myaddr = 0x20040000`) and reference them in the macro, or create multiple specific commands like `hack_addr1`, `hack_addr2`. For advanced parameterization, use GDB Python scripting. - -2. **What happens if you define `hack` before setting the breakpoint - will it still work as expected?** - The `define` command only creates a macro; it does not execute immediately. The breakpoint must be set and hit before invoking `hack`. The sequence matters: set breakpoint -> run/continue to hit breakpoint -> then call `hack`. Defining the macro before or after the breakpoint does not matter as long as you invoke it at the right time. - -3. **How would you adapt this pattern for multi-step routines (e.g., patch, dump, continue)?** - Extend the `define` block with additional commands: - ```gdb - (gdb) define hack_verbose - > set {char[13]} 0x20040000 = "hacky, world" - > x/20b 0x20040000 - > set $r0 = 0x20040000 - > info registers r0 - > c - > end - ``` - This dumps memory and registers before continuing, providing verification at each step. diff --git a/WEEK02/WEEK02-04.md b/WEEK02/WEEK02-04.md deleted file mode 100644 index 4e2a8d6..0000000 --- a/WEEK02/WEEK02-04.md +++ /dev/null @@ -1,71 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 2 -Hello, World - Debugging and Hacking Basics: Debugging and Hacking a Basic Program for the Pico 2 - -### Non-Credit Practice Exercise 4: Automate the Hack - -#### Objective -Create a reusable GDB command that injects a string into SRAM, repoints `r0`, and resumes execution with a single call. - -#### Prerequisites -- Pico 2 connected with OpenOCD, GDB, and serial monitor ready -- `build\0x0001_hello-world.elf` available -- Familiarity with breaking at `0x1000023c` and injecting strings from prior exercises - -#### Task Description -You will define a custom GDB command `hack` that writes a payload to `0x20040000`, repoints `r0`, and continues execution automatically. - -#### Step-by-Step Instructions - -##### Step 1: Connect, Halt, and Break - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -(gdb) b *0x1000023c -(gdb) c -``` - -##### Step 2: Define the `hack` Command - -```gdb -(gdb) define hack -> set {char[13]} 0x20040000 = "hacky, world" -> set $r0 = 0x20040000 -> c -> end -``` - -##### Step 3: Invoke the Command - -```gdb -(gdb) hack -``` - -##### Step 4: Observe Output -- PuTTY should immediately show your injected string after the command runs. -- The breakpoint will be re-hit on the next loop iteration; rerun `hack` if you want to reapply after changes. - -#### Expected Output -- `hack` executes without errors, writes the payload, updates `r0`, and resumes execution. -- Serial output reflects the injected message. - -#### Questions for Reflection - -###### Question 1: How could you parameterize the command to accept different strings or addresses? - -###### Question 2: What happens if you define `hack` before setting the breakpoint�will it still work as expected? - -###### Question 3: How would you adapt this pattern for multi-step routines (e.g., patch, dump, continue)? - -#### Tips and Hints -- Redefine `hack` any time you want a different payload; GDB will overwrite the prior definition. -- Keep the payload length aligned with the buffer size to avoid stray bytes. -- If the target keeps running past the breakpoint, ensure hardware breakpoints are available and set correctly. - -#### Next Steps -- Create additional helper commands (e.g., `dumpstr`, `retarget`) to streamline experiments. -- Explore GDB scripting files (`.gdbinit`) to auto-load your helpers on startup. -- Try combining `hack` with watchpoints to observe memory changes live. diff --git a/WEEK02/WEEK02.md b/WEEK02/WEEK02.md index 1dc20d4..626cd36 100644 --- a/WEEK02/WEEK02.md +++ b/WEEK02/WEEK02.md @@ -23,7 +23,7 @@ This week builds directly on Week 1 concepts. You should already be comfortable --- -## 📚 Part 1: Understanding Live Hacking +## Part 1: Understanding Live Hacking #### What is Live Hacking? @@ -52,7 +52,7 @@ The techniques you'll learn today are *exactly* how this would be done. Understa --- -## 📚 Part 2: Review - Memory Layout (from Week 1) +## Part 2: Review - Memory Layout (from Week 1) > 🔄 **REVIEW:** In Week 1, we learned about the RP2350's memory layout. This knowledge is essential for our hack! @@ -84,17 +84,17 @@ Our goal: **Make it print something else WITHOUT changing the source code!** #### Memory Map ``` -┌─────────────────────────────────────────────────────┐ -│ Flash Memory (XIP) - READ ONLY │ -│ Starts at: 0x10000000 │ -│ Contains: Program code, constant strings │ -│ NOTE: We CANNOT write to flash during runtime! │ -├─────────────────────────────────────────────────────┤ -│ SRAM - READ/WRITE │ -│ Starts at: 0x20000000 │ -│ Contains: Stack, Heap, Variables │ -│ NOTE: We CAN write to SRAM during runtime! │ -└─────────────────────────────────────────────────────┘ ++-----------------------------------------------------+ +| Flash Memory (XIP) - READ ONLY | +| Starts at: 0x10000000 | +| Contains: Program code, constant strings | +| NOTE: We CANNOT write to flash during runtime! | ++-----------------------------------------------------+ +| SRAM - READ/WRITE | +| Starts at: 0x20000000 | +| Contains: Stack, Heap, Variables | +| NOTE: We CAN write to SRAM during runtime! | ++-----------------------------------------------------+ ``` > 🔄 **REVIEW:** In Week 1, we saw SP values in the `0x20081xxx` range (for example `0x20081fc8`) - that's in the SRAM region. In this run you may see values like `0x20081ff8` depending on where execution is paused. The stack "grows downward" from the top of SRAM. @@ -107,32 +107,32 @@ But SRAM (starting at `0x20000000`) is **read-write**! This is where we'll creat --- -## 📚 Part 3: The Attack Plan +## Part 3: The Attack Plan Here's our step-by-step attack strategy: ``` -┌─────────────────────────────────────────────────────┐ -│ STEP 1: Start the debug server (OpenOCD) │ -├─────────────────────────────────────────────────────┤ -│ STEP 2: Connect with GDB and halt the program │ -├─────────────────────────────────────────────────────┤ -│ STEP 3: Set a breakpoint right before puts() │ -├─────────────────────────────────────────────────────┤ -│ STEP 4: When we hit the breakpoint, r0 contains │ -│ the address of "hello, world" │ -├─────────────────────────────────────────────────────┤ -│ STEP 5: Create our malicious string in SRAM │ -├─────────────────────────────────────────────────────┤ -│ STEP 6: Change r0 to point to OUR string │ -├─────────────────────────────────────────────────────┤ -│ STEP 7: Continue execution - HACKED! │ -└─────────────────────────────────────────────────────┘ ++-----------------------------------------------------+ +| STEP 1: Start the debug server (OpenOCD) | ++-----------------------------------------------------+ +| STEP 2: Connect with GDB and halt the program | ++-----------------------------------------------------+ +| STEP 3: Set a breakpoint right before puts() | ++-----------------------------------------------------+ +| STEP 4: When we hit the breakpoint, r0 contains | +| the address of "hello, world" | ++-----------------------------------------------------+ +| STEP 5: Create our malicious string in SRAM | ++-----------------------------------------------------+ +| STEP 6: Change r0 to point to OUR string | ++-----------------------------------------------------+ +| STEP 7: Continue execution - HACKED! | ++-----------------------------------------------------+ ``` --- -## 📚 Part 4: Setting Up Your Environment +## Part 4: Setting Up Your Environment #### Prerequisites @@ -166,7 +166,7 @@ OpenOCD is the bridge between your computer and the Pico 2's debug interface. It ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -204,7 +204,7 @@ PuTTY will show us the output from our Pico 2. When we hack the program, we'll s - **Speed**: Enter `115200` 3. Click **Open** -> 💡 **Finding your COM port:** Open Device Manager → Ports (COM & LPT) → Look for "USB Serial Device" or "Pico" - note the COM number. +> Tip: **Finding your COM port:** Open Device Manager -> Ports (COM & LPT) -> Look for "USB Serial Device" or "Pico" - note the COM number. **You should see:** @@ -257,7 +257,7 @@ Now we need to connect GDB to OpenOCD. OpenOCD is listening on port `3333`. ``` Remote debugging using :3333 main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c:5 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c:5 5 stdio_init_all(); ``` @@ -531,7 +531,7 @@ Now let's see what the push instruction did to our stack: **What changed:** - The stack pointer moved from `0x20082000` to `0x20081ff8` -- That's 8 bytes lower (2 × 4-byte values) +- That's 8 bytes lower (2 * 4-byte values) - Two new values appeared: `0xe000ed08` and `0x1000018f` ##### Step 9: Verify What Was Pushed @@ -604,7 +604,7 @@ This is the value from `lr` (the return address), pushed second. Before push {r3, lr}: After push {r3, lr}: Address Value Address Value -───────────────────── ───────────────────── +--------------------- --------------------- 0x20082000 (empty) ← SP 0x20082000 (old SP location) 0x20081ffc 0x1000018f (lr) 0x20081ff8 0xe000ed08 (r3) ← SP @@ -868,7 +868,7 @@ We want to stop the program RIGHT BEFORE it calls `puts()`. That's at address `0 **You should see:** ``` -Breakpoint 2 at 0x1000023c: file C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c, line 8 +Breakpoint 2 at 0x1000023c: file C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c, line 8 ``` **What does "hardware breakpoints" mean?** @@ -894,7 +894,7 @@ Now let's run the program until it hits our breakpoint: Continuing. Thread 1 "rp2350.cm0" hit Breakpoint 2, 0x1000023c in main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c:8 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c:8 8 printf("hello, world\r\n"); ``` @@ -1170,7 +1170,7 @@ This is the moment of truth! Let's continue the program and watch our hack take Continuing. Thread 1 "rp2350.cm0" hit Breakpoint 2, 0x1000023c in main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c:8 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c:8 8 printf("hello, world\r\n"); ``` @@ -1204,7 +1204,7 @@ Now that we've performed the hack dynamically with GDB, let's use Ghidra to unde If you haven't already set up the Ghidra project from Week 1: 1. Launch Ghidra -2. Select **File → New Project** → **Non-Shared Project** +2. Select **File -> New Project** -> **Non-Shared Project** 3. Name it `0x0001_hello-world` 4. Drag and drop `0x0001_hello-world.elf` into the project 5. Double-click to open in CodeBrowser @@ -1333,7 +1333,7 @@ Ghidra's cross-reference feature shows everywhere a value is used: 1. Navigate back to `main` (press **G**, type `main`, press Enter) 2. Click on `__wrap_puts` at address `0x1000023c` -3. Right-click and select **References → Show References to __wrap_puts** +3. Right-click and select **References -> Show References to __wrap_puts** This shows every place that calls `puts()`. In a larger program, you could find ALL the print statements and potentially modify any of them! @@ -1430,9 +1430,9 @@ This step helps you understand the mechanics of modifying binary data. Once you' | Task | GDB (Dynamic) | Ghidra (Static) | | ---- | ------------- | --------------- | -| Find main address | `x/1000i 0x10000000` + search | Symbol Tree → Functions → main | +| Find main address | `x/1000i 0x10000000` + search | Symbol Tree -> Functions -> main | | Find string address | Step through `ldr`, examine `$r0` | Click on `ldr` - shows `= 100019CCh` | -| See string content | `x/s $r0` | Double-click address → see `ds "hello, world"` | +| See string content | `x/s $r0` | Double-click address -> see `ds "hello, world"` | | Identify attack point | Set breakpoints, step, observe | Read decompiled code, find function calls | | Verify memory type | Know address ranges | Check address prefix (`0x10...` vs `0x20...`) | @@ -1448,7 +1448,7 @@ This step helps you understand the mechanics of modifying binary data. Once you' 2. **Follow Cross-References** - Find all places a function or variable is used 3. **Check Address Ranges** - Quickly identify Flash vs SRAM locations 4. **Add Comments** - Press `;` to annotate what you discover for later -5. **Rename Variables** - Right-click → Rename to give meaningful names +5. **Rename Variables** - Right-click -> Rename to give meaningful names --- @@ -1481,19 +1481,18 @@ We successfully performed a **live memory injection attack**: ``` BEFORE OUR HACK: -┌─────────────────┐ ┌──────────────────────────────┐ -│ r0 = 0x100019cc│ ───> │ Flash: "hello, world\r" │ -└─────────────────┘ └──────────────────────────────┘ - │ ++-----------------+ +------------------------------+ +| r0 = 0x100019cc| ---> | Flash: "hello, world\r" | ++-----------------+ +------------------------------+ + | ▼ puts() prints "hello, world" - AFTER OUR HACK: -┌─────────────────┐ ┌──────────────────────────────┐ -│ r0 = 0x20040000│ ───> │ SRAM: "hacky, world" │ -└─────────────────┘ └──────────────────────────────┘ - │ ++-----------------+ +------------------------------+ +| r0 = 0x20040000| ---> | SRAM: "hacky, world" | ++-----------------+ +------------------------------+ + | ▼ puts() prints "hacky, world" ``` @@ -1523,55 +1522,6 @@ AFTER OUR HACK: --- -## ✅ Practice Exercises - -These prompts are intentionally aligned 1:1 with the Week 2 exercise and solution files: -- `WEEK02-01.md` and `WEEK02-01-S.md` -- `WEEK02-02.md` and `WEEK02-02-S.md` -- `WEEK02-03.md` and `WEEK02-03-S.md` -- `WEEK02-04.md` and `WEEK02-04-S.md` - -#### Exercise 1: Change the Message -Try creating a different message! Write your name to SRAM and make the program print it: - -```gdb -(gdb) set {char[12]} 0x20040000 = {'Y','o','u','r',' ','N','a','m','e','!','\r','\0'} -(gdb) set $r0 = 0x20040000 -(gdb) c -``` - -#### Exercise 2: Use a Different SRAM Address -The SRAM region is large. Try writing your string to a different address: - -```gdb -(gdb) set {char[14]} 0x20041000 = {'h','a','c','k','e','d','!','!','!','\r','\0'} -(gdb) set $r0 = 0x20041000 -(gdb) c -``` - -#### Exercise 3: Examine Memory Around Your String -Look at the bytes around your injected string: - -```gdb -(gdb) x/20b 0x20040000 -``` - -What do you see? Can you identify each character? - -#### Exercise 4: Automate the Hack -Create a GDB command sequence that does the full hack. You can use GDB's command feature: - -```gdb -(gdb) define hack -> set {char[13]} 0x20040000 = "hacky, world" -> set $r0 = 0x20040000 -> c -> end -(gdb) hack -``` - -Now you can just type `hack` each time! - --- ## 🎓 Key Takeaways @@ -1646,3 +1596,5 @@ Imagine an attacker with physical access to an industrial control system: | **Stack Pointer** | Register that points to the top of the stack | Part 2 - Memory layout | | **XIP** | Execute In Place - running code directly from flash | Part 2 - Why we can't write to flash | | **Little-Endian** | Storing the least significant byte at the lowest address | Part 10 - String storage | + + diff --git a/WEEK03/WEEK03-01-S.md b/WEEK03/WEEK03-01-S.md deleted file mode 100644 index 9a5c66b..0000000 --- a/WEEK03/WEEK03-01-S.md +++ /dev/null @@ -1,47 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 1 Solution: Trace a Reset - -#### Answers - -##### Instruction Trace (First 10 Instructions from 0x1000015c) - -| # | Address | Instruction | What It Does | Key Register Change | -|---|-------------|----------------------------------------|------------------------------------------------------|---------------------| -| 1 | 0x1000015c | `mov.w r0, #0xd0000000` | Loads SIO base address into r0 | r0 = 0xd0000000 | -| 2 | 0x10000160 | `ldr r0, [r0, #0]` | Reads CPUID register at SIO base + 0 | r0 = 0 (Core 0) | -| 3 | 0x10000162 | `cbz r0, 0x1000016a` | If CPUID == 0 (Core 0), branch to data copy section | PC = 0x1000016a | -| 4 | 0x1000016a | `ldr r0, [pc, #...]` | Loads source address for data copy (flash) | r0 = flash addr | -| 5 | 0x1000016c | `ldr r1, [pc, #...]` | Loads destination address for data copy (RAM) | r1 = RAM addr | -| 6 | 0x1000016e | `ldr r2, [pc, #...]` | Loads end address for data copy | r2 = end addr | -| 7 | 0x10000170 | `cmp r1, r2` | Checks if all data has been copied | Flags updated | -| 8 | 0x10000172 | `bhs 0x10000178` | If done (dest >= end), skip to BSS clear | PC conditional | -| 9 | 0x10000174 | `ldm r0!, {r3}` | Loads 4 bytes from flash source, auto-increments r0 | r3 = data, r0 += 4 | -| 10| 0x10000176 | `stm r1!, {r3}` | Stores 4 bytes to RAM destination, auto-increments r1| r1 += 4 | - -##### GDB Session - -```gdb -(gdb) b *0x1000015c -(gdb) monitor reset halt -(gdb) c -Breakpoint 1, 0x1000015c in _reset_handler () -(gdb) si -(gdb) disas $pc,+2 -(gdb) info registers r0 -``` - -#### Reflection Answers - -1. **Why does the reset handler check the CPUID before doing anything else?** - The RP2350 has two Cortex-M33 cores that share the same reset handler entry point. The CPUID check at SIO base `0xd0000000` returns 0 for Core 0 and 1 for Core 1. Only Core 0 should perform the one-time initialization (data copy, BSS clear, calling `main()`). Without this check, both cores would simultaneously try to initialize RAM, causing data corruption and race conditions. - -2. **What would happen if Core 1 tried to run the same initialization code as Core 0?** - Both cores would simultaneously write to the same RAM locations during the data copy and BSS clear phases. This would cause data corruption due to race conditions—values could be partially written or overwritten unpredictably. The `cbz` instruction at `0x10000162` prevents this: if CPUID != 0, the code branches to `hold_non_core0_in_bootrom`, which sends Core 1 back to the bootrom to wait until Core 0 explicitly launches it later. - -3. **Which registers are used in the first 10 instructions, and why those specific ones?** - The first 10 instructions use `r0`, `r1`, `r2`, and `r3`. These are the ARM "caller-saved" scratch registers (r0–r3) that don't need to be preserved across function calls. Since the reset handler is the very first code to run (no caller to preserve state for), using these low registers is both efficient (16-bit Thumb encodings) and safe. `r0` handles CPUID check and source pointer, `r1` is the destination pointer, `r2` is the end marker, and `r3` is the data transfer register. diff --git a/WEEK03/WEEK03-01.md b/WEEK03/WEEK03-01.md deleted file mode 100644 index 0a04ff6..0000000 --- a/WEEK03/WEEK03-01.md +++ /dev/null @@ -1,130 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 1: Trace a Reset - -#### Objective -Single-step through the first 10 instructions of the reset handler to understand exactly what happens when the RP2350 powers on or resets. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD and `arm-none-eabi-gdb` available in your PATH -- `build\0x0001_hello-world.elf` present and flashed to the board -- Week 3 environment setup completed (OpenOCD running, GDB connected) - -#### Task Description -You will set a breakpoint at the reset handler (`0x1000015c`), trigger a reset, and step through each instruction one at a time while documenting what each instruction does. - -#### Step-by-Step Instructions - -##### Step 1: Start OpenOCD - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -##### Step 2: Launch GDB - -```powershell -arm-none-eabi-gdb build\0x0001_hello-world.elf -``` - -##### Step 3: Connect to Target - -```gdb -(gdb) target extended-remote :3333 -``` - -##### Step 4: Set Breakpoint at Reset Handler - -```gdb -(gdb) b *0x1000015c -``` - -**What this does:** Places a breakpoint at the very first instruction of the reset handler (the entry point after bootrom). - -##### Step 5: Reset and Break - -```gdb -(gdb) monitor reset halt -(gdb) c -``` - -**What this does:** -- `monitor reset halt` resets the chip and immediately halts it -- `c` continues execution until the breakpoint at the reset handler is hit - -##### Step 6: Single-Step Through Instructions - -Now step through the first 10 instructions, one at a time: - -```gdb -(gdb) si -(gdb) disas $pc,+2 -(gdb) info registers r0 -``` - -Repeat `si` nine more times, examining each instruction. - -**Example of what you'll see:** - -**Instruction 1:** -``` -0x1000015c <_reset_handler>: mov.w r0, #3489660928 @ 0xd0000000 -``` -**What it does:** Loads the SIO base address (0xd0000000) into r0 - -**Instruction 2:** -``` -0x10000160 <_reset_handler+4>: ldr r0, [r0, #0] -``` -**What it does:** Reads the CPUID register to determine which core is running - -**Instruction 3:** -``` -0x10000162 <_reset_handler+6>: cbz r0, 0x1000016a -``` -**What it does:** If CPUID is 0 (Core 0), branch ahead to continue boot; otherwise handle Core 1 - -##### Step 7: Document Your Observations - -For each of the 10 instructions: -1. Write down the address -2. Write down the assembly instruction -3. Explain what it does -4. Note any register changes using `info registers` - -#### Expected Output -- You should see the reset handler check which core is running -- If you're on Core 0, you'll see it jump to the data copy section -- Register `r0` will contain CPUID value (should be 0) -- PC (program counter) advances with each `si` command - -#### Questions for Reflection - -###### Question 1: Why does the reset handler check the CPUID before doing anything else? - -###### Question 2: What would happen if Core 1 tried to run the same initialization code as Core 0? - -###### Question 3: Which registers are used in the first 10 instructions, and why those specific ones? - -#### Tips and Hints -- Use `disas $pc,+20` to see upcoming instructions without stepping through them -- Use `info registers` to see all register values at any point -- If you step past where you wanted to stop, just `monitor reset halt` and start over -- Keep notes as you gothis is detective work! - -#### Next Steps -- Try stepping all the way through to the data copy loop -- Set a breakpoint at `0x1000016c` (the data copy loop) and continue there directly -- Move on to Exercise 2 to calculate the stack size from the vector table - -#### Additional Challenge -Set a breakpoint at `0x10000178` (the BSS clear phase) and continue execution to see how the reset handler transitions from data copying to BSS clearing. diff --git a/WEEK03/WEEK03-02-S.md b/WEEK03/WEEK03-02-S.md deleted file mode 100644 index 4bf4e4e..0000000 --- a/WEEK03/WEEK03-02-S.md +++ /dev/null @@ -1,76 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 2 Solution: Find the Stack Size - -#### Answers - -##### Initial Stack Pointer - -```gdb -(gdb) x/x 0x10000000 -0x10000000 <__vectors>: 0x20082000 -``` - -The initial stack pointer is **0x20082000**, stored as the first entry in the vector table. - -##### Stack Limit - -The stack limit is **0x20078000**, defined by the linker script. - -```gdb -(gdb) info symbol __StackLimit -__StackLimit in section .stack -``` - -##### Stack Size Calculation - -| Value | Hex | Decimal | -|-----------------|-------------|---------------| -| Stack Top | 0x20082000 | 537,108,480 | -| Stack Limit | 0x20078000 | 537,067,520 | -| **Stack Size** | 0x0000A000 | **40,960 bytes** | - -``` -Stack Size = 0x20082000 - 0x20078000 = 0xA000 = 40,960 bytes -40,960 ÷ 1,024 = 40 KB -``` - -##### Memory Region Verification - -| Region | Start | End | Size | -|-----------|-------------|-------------|--------| -| RAM | 0x20000000 | 0x20080000 | 512 KB | -| SCRATCH_X | 0x20080000 | 0x20081000 | 4 KB | -| SCRATCH_Y | 0x20081000 | 0x20082000 | 4 KB | -| **Stack** | 0x20078000 | 0x20082000 | **40 KB** | - -The stack spans from the upper portion of main RAM through SCRATCH_X and into SCRATCH_Y. - -##### Runtime Stack Usage at main() - -```gdb -(gdb) b main -(gdb) c -(gdb) info registers sp -sp 0x20081fc8 0x20081fc8 -``` - -Stack used at `main()` entry: `0x20082000 - 0x20081fc8 = 0x38 = 56 bytes` - -#### Reflection Answers - -1. **Why is the stack 40 KB instead of just fitting in the 4 KB SCRATCH_Y region?** - The stack pointer is initialized at the top of SCRATCH_Y (`0x20082000`), but the stack grows **downward**. As functions are called and local variables are allocated, the stack pointer decreases past the SCRATCH_Y boundary (`0x20081000`), through SCRATCH_X, and into the upper portion of main RAM. The linker sets the stack limit at `0x20078000` to give the stack 40 KB of room, which is sufficient for typical embedded applications with nested function calls. - -2. **What happens if the stack grows beyond 0x20078000?** - A **stack overflow** occurs. The stack would collide with the heap or global data stored in the lower portion of RAM. This can corrupt variables, overwrite heap metadata, or cause a HardFault if memory protection is enabled. On the RP2350 with Cortex-M33 MPU support, a MemManage fault could be triggered if stack guard regions are configured. - -3. **How would you detect a stack overflow during runtime?** - Several methods exist: (a) Write a known "canary" pattern (e.g., `0xDEADBEEF`) at the stack limit and periodically check if it's been overwritten. (b) Use the Cortex-M33 MPU to set a guard region at `0x20078000` that triggers a MemManage fault on access. (c) In GDB, use a watchpoint: `watch *(int*)0x20078000` to break if the stack reaches the limit. (d) Use the `stackusage` GDB macro from the exercise to monitor usage. - -4. **Why does the stack grow downward instead of upward?** - This is an ARM architecture convention inherited from early processor designs. Growing downward allows the stack and heap to grow toward each other from opposite ends of RAM, maximizing memory utilization without needing to know each region's size in advance. The stack starts at the highest address and grows down, while the heap starts at a lower address and grows up. If they meet, memory is exhausted—but this layout gives both regions the maximum possible space. diff --git a/WEEK03/WEEK03-02.md b/WEEK03/WEEK03-02.md deleted file mode 100644 index e2e837e..0000000 --- a/WEEK03/WEEK03-02.md +++ /dev/null @@ -1,167 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 2: Find the Stack Size - -#### Objective -Calculate the size of the stack by examining the vector table, understanding the linker script's memory layout, and performing manual calculations. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD and `arm-none-eabi-gdb` available -- `build\0x0001_hello-world.elf` flashed to the board -- Understanding of memory regions from Week 3 Part 5 (Linker Script) - -#### Task Description -You will examine the initial stack pointer value from the vector table, identify the stack limit, calculate the total stack size in bytes and kilobytes, and verify your calculations. - -#### Background Information - -From the Week 3 lesson, we learned: -- The initial stack pointer is stored at `0x10000000` (first entry in vector table) -- The linker script defines: `SCRATCH_Y: ORIGIN = 0x20081000, LENGTH = 4k` -- Stack top is calculated as: `ORIGIN + LENGTH = 0x20082000` -- The stack grows downward from high addresses to low addresses - -#### Step-by-Step Instructions - -##### Step 1: Connect and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Examine the Initial Stack Pointer - -```gdb -(gdb) x/x 0x10000000 -``` - -**Expected output:** -``` -0x10000000 <__vectors>: 0x20082000 -``` - -This is the **top of the stack** (where the stack starts before growing downward). - -##### Step 3: Find the Stack Limit - -The stack limit is defined in the linker script and can be found by examining stack-related symbols or calculating from memory regions. - -From the Week 3 lesson, the stack limit is `0x20078000`. - -You can verify this in GDB: - -```gdb -(gdb) info symbol __StackLimit -``` - -or check registers after boot: - -```gdb -(gdb) info registers -``` - -Look for stack limit values or calculate: The main RAM starts at `0x20000000`, and SCRATCH_Y starts at `0x20081000`. - -##### Step 4: Calculate Stack Size in Bytes - -**Formula:** -``` -Stack Size = Stack Top - Stack Limit -Stack Size = 0x20082000 - 0x20078000 -``` - -Let's convert to decimal: -- `0x20082000` = 537,108,480 decimal -- `0x20078000` = 537,067,520 decimal -- Difference = 40,960 bytes - -**Alternative hex calculation:** -``` -0x20082000 -- 0x20078000 ------------ -0x0000A000 = 40,960 bytes -``` - -##### Step 5: Convert to Kilobytes - -``` -Bytes to KB = 40,960 1,024 = 40 KB -``` - -So the stack is **40 KB** in size. - -##### Step 6: Verify Using Memory Regions - -Cross-check with the memory layout: -- **RAM**: `0x20000000` - `0x20080000` (512 KB) -- **SCRATCH_X**: `0x20080000` - `0x20081000` (4 KB) -- **SCRATCH_Y**: `0x20081000` - `0x20082000` (4 KB) ? Stack lives here -- **Stack range**: `0x20078000` - `0x20082000` (40 KB) - -The stack extends from SCRATCH_Y down into the upper portion of main RAM. - -##### Step 7: Examine Stack Usage at Runtime - -You can see the current stack pointer value: - -```gdb -(gdb) b main -(gdb) c -(gdb) info registers sp -``` - -**Expected output:** -``` -sp 0x20081fc8 0x20081fc8 -``` - -This shows the stack has used: -``` -0x20082000 - 0x20081fc8 = 0x38 = 56 bytes -``` - -#### Expected Output -- Initial stack pointer: `0x20082000` -- Stack limit: `0x20078000` -- Stack size: **40,960 bytes** or **40 KB** -- Current stack usage (at main): approximately 56 bytes - -#### Questions for Reflection - -###### Question 1: Why is the stack 40 KB instead of just fitting in the 4 KB SCRATCH_Y region? - -###### Question 2: What happens if the stack grows beyond 0x20078000? - -###### Question 3: How would you detect a stack overflow during runtime? - -###### Question 4: Why does the stack grow downward instead of upward? - -#### Tips and Hints -- Use Windows Calculator in Programmer mode to convert hex to decimal -- Remember: 1 KB = 1,024 bytes (not 1,000) -- The stack pointer (SP) decreases as the stack grows (push operations) -- Use `bt` (backtrace) in GDB to see how much stack is currently in use - -#### Next Steps -- Monitor the stack pointer as you step through functions to see it change -- Calculate stack usage for specific function calls -- Move on to Exercise 3 to examine all vector table entries - -#### Additional Challenge -Write a GDB command to automatically calculate and display stack usage: - -```gdb -(gdb) define stackusage -> set $used = 0x20082000 - $sp -> printf "Stack used: %d bytes (%d KB)\n", $used, $used/1024 -> end - -(gdb) stackusage -``` diff --git a/WEEK03/WEEK03-03-S.md b/WEEK03/WEEK03-03-S.md deleted file mode 100644 index 3b496c2..0000000 --- a/WEEK03/WEEK03-03-S.md +++ /dev/null @@ -1,78 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 3 Solution: Examine All Vectors - -#### Answers - -##### Vector Table Dump - -```gdb -(gdb) x/16x 0x10000000 -0x10000000 <__vectors>: 0x20082000 0x1000015d 0x1000011b 0x1000011d -0x10000010 <__vectors+16>: 0x1000011f 0x10000121 0x10000123 0x00000000 -0x10000020 <__vectors+32>: 0x00000000 0x00000000 0x00000000 0x10000125 -0x10000030 <__vectors+48>: 0x00000000 0x00000000 0x10000127 0x10000129 -``` - -##### Complete Vector Table Map - -| Offset | Vector # | Raw Value | Address Type | Actual Addr | Handler Name | -|--------|----------|-------------|---------------|-------------|------------------| -| 0x00 | — | 0x20082000 | Stack Pointer | N/A | __StackTop | -| 0x04 | 1 | 0x1000015d | Code (Thumb) | 0x1000015c | _reset_handler | -| 0x08 | 2 | 0x1000011b | Code (Thumb) | 0x1000011a | isr_nmi | -| 0x0C | 3 | 0x1000011d | Code (Thumb) | 0x1000011c | isr_hardfault | -| 0x10 | 4 | 0x1000011f | Code (Thumb) | 0x1000011e | isr_memmanage | -| 0x14 | 5 | 0x10000121 | Code (Thumb) | 0x10000120 | isr_busfault | -| 0x18 | 6 | 0x10000123 | Code (Thumb) | 0x10000122 | isr_usagefault | -| 0x1C | 7 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x20 | 8 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x24 | 9 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x28 | 10 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x2C | 11 | 0x10000125 | Code (Thumb) | 0x10000124 | isr_svcall | -| 0x30 | 12 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x34 | 13 | 0x00000000 | Reserved | N/A | (Reserved) | -| 0x38 | 14 | 0x10000127 | Code (Thumb) | 0x10000126 | isr_pendsv | -| 0x3C | 15 | 0x10000129 | Code (Thumb) | 0x10000128 | isr_systick | - -##### Handler Verification - -```gdb -(gdb) info symbol 0x1000015c -_reset_handler in section .text -(gdb) info symbol 0x1000011a -isr_nmi in section .text -(gdb) x/3i 0x1000011a -0x1000011a : bkpt 0x0000 -0x1000011c : bkpt 0x0000 -0x1000011e : bkpt 0x0000 -``` - -Most default handlers are single `bkpt` instructions—they halt the processor if triggered unexpectedly. - -##### Summary Statistics - -| Category | Count | -|---------------------|-------| -| Stack Pointer entry | 1 | -| Valid code entries | 10 | -| Reserved (0x0) | 5 | -| **Total entries** | **16** | - -#### Reflection Answers - -1. **Why do all the code addresses end in odd numbers (LSB = 1)?** - ARM Cortex-M processors exclusively execute in Thumb mode. The least significant bit (LSB) of vector table entries indicates the instruction set: LSB = 1 means Thumb mode. Since Cortex-M33 only supports Thumb/Thumb-2, all code addresses must have bit 0 set to 1. The actual instruction address is the value with bit 0 cleared (e.g., `0x1000015d` → instruction at `0x1000015c`). This is a hardware requirement—loading an even address into the PC on Cortex-M would cause a HardFault. - -2. **What happens if an exception occurs for a reserved/null vector entry?** - If the processor attempts to invoke a handler through a vector entry containing `0x00000000`, it tries to fetch instructions from address `0x00000000` (in the bootrom region). This would either execute bootrom code unexpectedly or trigger a HardFault because the address lacks the Thumb bit (LSB = 0). In practice, a HardFault would occur, and if the HardFault handler itself is invalid, the processor enters a lockup state. - -3. **Why do most exception handlers just contain `bkpt` instructions?** - The Pico SDK provides these as **default weak handlers**. They are intentionally minimal—a `bkpt` (breakpoint) instruction halts the processor immediately so a debugger can catch the event. This is a safety mechanism: rather than letting an unhandled exception corrupt state or silently continue, the default handlers stop execution so the developer can diagnose the problem. Application code can override any handler by defining a function with the matching name (the weak linkage gets replaced). - -4. **How would you replace a default handler with your own custom handler?** - Define a C function with the exact handler name (e.g., `void isr_hardfault(void)`) in your application code. Because the SDK declares these handlers as `__attribute__((weak))`, the linker will use your strong definition instead of the default `bkpt` stub. The new function's address (with Thumb bit set) will automatically appear in the vector table at the correct offset. No linker script modification is needed. diff --git a/WEEK03/WEEK03-03.md b/WEEK03/WEEK03-03.md deleted file mode 100644 index c47c460..0000000 --- a/WEEK03/WEEK03-03.md +++ /dev/null @@ -1,209 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 3: Examine All Vectors - -#### Objective -Examine the first 16 entries of the vector table to understand the exception handler layout, identify valid code addresses, and recognize the Thumb mode addressing convention. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD and `arm-none-eabi-gdb` available -- `build\0x0001_hello-world.elf` loaded -- Understanding of the vector table from Week 3 Part 4 -- Knowledge of Thumb mode addressing (LSB = 1 indicates Thumb code) - -#### Task Description -You will examine 16 consecutive 32-bit values from the vector table, decode each entry, determine if it's a valid code address, and identify which exception handler it points to. - -#### Background Information - -The ARM Cortex-M vector table structure: - -| Offset | Vector # | Handler Name | Purpose | -|--------|----------|---------------------|---------| -| 0x00 | - | Initial SP | Stack pointer initialization | -| 0x04 | 1 | Reset | Power-on/reset entry point | -| 0x08 | 2 | NMI | Non-Maskable Interrupt | -| 0x0C | 3 | HardFault | Serious errors | -| 0x10 | 4 | MemManage | Memory protection fault | -| 0x14 | 5 | BusFault | Bus error | -| 0x18 | 6 | UsageFault | Undefined instruction, etc. | -| 0x1C-0x28 | 7-10 | Reserved | Not used | -| 0x2C | 11 | SVCall | Supervisor call | -| 0x30 | 12 | Debug Monitor | Debug events | -| 0x34 | 13 | Reserved | Not used | -| 0x38 | 14 | PendSV | Pendable service call | -| 0x3C | 15 | SysTick | System tick timer | - -#### Step-by-Step Instructions - -##### Step 1: Connect and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Examine 16 Vector Table Entries - -```gdb -(gdb) x/16x 0x10000000 -``` - -**Expected output (example):** -``` -0x10000000 <__vectors>: 0x20082000 0x1000015d 0x1000011b 0x1000011d -0x10000010 <__vectors+16>: 0x1000011f 0x10000121 0x10000123 0x00000000 -0x10000020 <__vectors+32>: 0x00000000 0x00000000 0x00000000 0x10000125 -0x10000030 <__vectors+48>: 0x00000000 0x00000000 0x10000127 0x10000129 -``` - -##### Step 3: Analyze Each Entry - -Create a table documenting each entry: - -**Entry 1 (Offset 0x00):** -``` -Address: 0x10000000 -Value: 0x20082000 -Valid Code Address? NO - This is the stack pointer (in RAM region 0x2xxxxxxx) -Handler: Initial Stack Pointer -``` - -**Entry 2 (Offset 0x04):** -``` -Address: 0x10000004 -Value: 0x1000015d -Valid Code Address? YES (starts with 0x1000...) -Thumb Mode? YES (LSB = 1, so actual address is 0x1000015c) -Handler: Reset Handler (_reset_handler) -``` - -**Entry 3 (Offset 0x08):** -``` -Address: 0x10000008 -Value: 0x1000011b -Valid Code Address? YES -Thumb Mode? YES (actual address: 0x1000011a) -Handler: NMI Handler (isr_nmi) -``` - -Continue this analysis for all 16 entries... - -##### Step 4: Verify Handlers with Symbols - -For each code address, check what function it points to: - -```gdb -(gdb) info symbol 0x1000015c -``` - -**Expected output:** -``` -_reset_handler in section .text -``` - -Repeat for other addresses: - -```gdb -(gdb) info symbol 0x1000011a -(gdb) info symbol 0x1000011c -(gdb) info symbol 0x1000011e -``` - -##### Step 5: Examine Handler Code - -Look at the actual code at each handler: - -```gdb -(gdb) x/3i 0x1000011a -``` - -**Expected output for NMI handler:** -``` -0x1000011a : bkpt 0x0000 -0x1000011c : bkpt 0x0000 -0x1000011e : bkpt 0x0000 -``` - -##### Step 6: Identify Reserved Entries - -Note any entries with value `0x00000000`: - -``` -0x00000000 = Reserved/Unused vector -``` - -These slots are reserved by ARM and not used on Cortex-M33. - -##### Step 7: Create a Complete Map - -Document all 16 entries in this format: - -| Offset | Value | Address Type | Actual Addr | Handler Name | -|--------|------------|--------------|-------------|------------------| -| 0x00 | 0x20082000 | Stack Ptr | N/A | __StackTop | -| 0x04 | 0x1000015d | Code (Thumb) | 0x1000015c | _reset_handler | -| 0x08 | 0x1000011b | Code (Thumb) | 0x1000011a | isr_nmi | -| 0x0C | 0x1000011d | Code (Thumb) | 0x1000011c | isr_hardfault | -| ... | ... | ... | ... | ... | - -#### Expected Output -- First entry is the stack pointer in RAM (0x2xxxxxxx range) -- Entries 2-16 are mostly code addresses in flash (0x1000xxxx range) -- Code addresses have LSB = 1 (Thumb mode indicator) -- Reserved entries show 0x00000000 -- Most handlers point to simple `bkpt` instructions (default handlers) - -#### Questions for Reflection - -###### Question 1: Why do all the code addresses end in odd numbers (LSB = 1)? - -###### Question 2: What happens if an exception occurs for a reserved/null vector entry? - -###### Question 3: Why do most exception handlers just contain `bkpt` instructions? - -###### Question 4: How would you replace a default handler with your own custom handler? - -#### Tips and Hints -- Use `x/32x 0x10000000` to see even more vectors (up to 48) -- Remember to subtract 1 from addresses before disassembling (remove Thumb bit) -- Use `info functions` to see all available handler symbols -- Compare GDB output with Ghidra's vector table view - -#### Next Steps -- Set breakpoints at different exception handlers to see if they're ever called -- Trigger a fault intentionally to see which handler executes -- Move on to Exercise 4 to analyze your main function - -#### Additional Challenge -Write a GDB script to automatically decode and display all vector table entries: - -```gdb -(gdb) define vectors -> set $i = 0 -> while $i < 16 -> set $addr = 0x10000000 + ($i * 4) -> set $val = *(int*)$addr -> printf "[%2d] 0x%08x: 0x%08x", $i, $addr, $val -> if $i == 0 -> printf " (Stack Pointer)\n" -> else -> if $val != 0 -> if ($val & 0x10000000) == 0x10000000 -> printf " -> 0x%08x\n", $val & 0xFFFFFFFE -> else -> printf " (Invalid/Reserved)\n" -> end -> else -> printf " (Reserved)\n" -> end -> end -> set $i = $i + 1 -> end -> end -``` diff --git a/WEEK03/WEEK03-04-S.md b/WEEK03/WEEK03-04-S.md deleted file mode 100644 index 8645a21..0000000 --- a/WEEK03/WEEK03-04-S.md +++ /dev/null @@ -1,94 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 4 Solution: Find Your Main Function and Trace Back - -#### Answers - -##### Main Function Location - -```gdb -(gdb) info functions main -0x10000234 int main(void); -``` - -`main()` is at address **0x10000234**. - -##### Disassembly of main() - -```gdb -(gdb) x/10i 0x10000234 -0x10000234
: push {r7, lr} -0x10000236 : sub sp, #8 -0x10000238 : add r7, sp, #0 -0x1000023a : bl 0x100012c4 -0x1000023e : movw r0, #404 @ 0x194 -0x10000242 : movt r0, #4096 @ 0x1000 -0x10000246 : bl 0x1000023c <__wrap_puts> -0x1000024a : b.n 0x1000023e -``` - -##### First Function Call - -The first function call is at offset +6: -``` -0x1000023a : bl 0x100012c4 -``` - -`stdio_init_all()` initializes all standard I/O systems (USB CDC, UART) so `printf()` and `puts()` can output to the serial console. - -##### Link Register (Caller Identification) - -```gdb -(gdb) b main -(gdb) c -(gdb) info registers lr -lr 0x1000018b 268435851 -``` - -LR = **0x1000018b** (Thumb address), actual return address = **0x1000018a**. - -##### Caller Disassembly - -```gdb -(gdb) x/10i 0x10000186 -0x10000186 : ldr r1, [pc, #80] -0x10000188 : blx r1 → calls runtime_init() -0x1000018a : ldr r1, [pc, #80] → LR points here (return from main) -0x1000018c : blx r1 → THIS called main() -0x1000018e : ldr r1, [pc, #80] -0x10000190 : blx r1 → calls exit() -0x10000192 : bkpt 0x0000 -``` - -##### Complete Boot Chain - -``` -Power On - → Bootrom (0x00000000) - → Vector Table (0x10000000) - → _reset_handler (0x1000015c) - → Data Copy & BSS Clear - → platform_entry (0x10000186) - → runtime_init() (first blx) - → main() (second blx) ← 0x10000234 - → stdio_init_all() (first call in main) - → puts() loop (infinite) -``` - -#### Reflection Answers - -1. **Why does the link register point 4 bytes after the `blx` instruction that called main?** - The LR stores the **return address**—the instruction to execute after `main()` returns. The `blx r1` instruction at `0x10000188` (which calls `runtime_init`) is 2 bytes, and the `blx r1` at `0x1000018c` (which calls `main`) is also 2 bytes. The LR is set to the instruction immediately following the `blx` that called `main()`, which is `0x1000018a` (the `ldr` after `runtime_init`'s call). Actually, `platform_entry+4` at `0x1000018a` is where execution resumes, and the actual `blx` that calls main is at `+6` (`0x1000018c`), so LR = `0x1000018e` + Thumb bit. The key point: LR always points to the next instruction after the branch, so the caller can resume where it left off. - -2. **What would happen if `main()` tried to return (instead of looping forever)?** - Execution would return to `platform_entry` at the address stored in LR. Looking at the disassembly, `platform_entry` would proceed to execute the third `blx r1` at offset +10, which calls `exit()`. The `exit()` function would perform cleanup and ultimately halt the processor. After `exit()`, there's a `bkpt` instruction as a safety net. In practice on bare-metal embedded systems, returning from `main()` is generally avoided because there's no OS to return to. - -3. **How can you tell from the disassembly that main contains an infinite loop?** - The instruction at `0x1000024a` is `b.n 0x1000023e `, which is an **unconditional branch** back to the `movw r0, #404` instruction that loads the string address. This is a `b` (branch) with no condition code, meaning it always jumps backward. There is no path that reaches the end of the function or a `pop {r7, pc}` (return). The `push {r7, lr}` at the start saves the return address but it's never restored—the function loops forever. - -4. **Why is `stdio_init_all()` called before the printf loop?** - `stdio_init_all()` configures the hardware interfaces (USB CDC and/or UART) that `printf()`/`puts()` uses for output. Without this initialization, the serial output drivers are not set up—writes to stdout would go nowhere or cause a fault. It must be called exactly once before any I/O operation. Calling it inside the loop would repeatedly reinitialize the hardware, wasting time and potentially disrupting active connections. diff --git a/WEEK03/WEEK03-04.md b/WEEK03/WEEK03-04.md deleted file mode 100644 index 4d0d8d6..0000000 --- a/WEEK03/WEEK03-04.md +++ /dev/null @@ -1,238 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 3 -Embedded System Analysis: Understanding the RP2350 Architecture w/ Comprehensive Firmware Analysis - -### Non-Credit Practice Exercise 4: Find Your Main Function and Trace Back - -#### Objective -Locate the `main()` function, examine its first instructions, identify the first function call, and trace backward to discover where `main()` was called from. - -#### Prerequisites -- Raspberry Pi Pico 2 with debug probe connected -- OpenOCD and `arm-none-eabi-gdb` available -- `build\0x0001_hello-world.elf` loaded -- Understanding of function calls and the link register (LR) from previous weeks - -#### Task Description -You will use GDB to find `main()`, examine its disassembly, identify the initial function call (`stdio_init_all`), and use the link register to trace backward through the boot sequence. - -#### Background Information - -Key concepts: -- **Link Register (LR)**: Stores the return address when a function is called -- **Program Counter (PC)**: Points to the currently executing instruction -- **Function prologue**: The setup code at the start of every function -- **bl instruction**: "Branch with Link" - calls a function and stores return address in LR - -#### Step-by-Step Instructions - -##### Step 1: Connect and Halt - -```gdb -(gdb) target extended-remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the Main Function - -```gdb -(gdb) info functions main -``` - -**Expected output:** -``` -All functions matching regular expression "main": - -File 0x0001_hello-world.c: -0x10000234 int main(void); - -Non-debugging symbols: -0x10000186 platform_entry_arm_a -... -``` - -Note the address of `main`: **`0x10000234`** - -##### Step 3: Examine Instructions at Main - -```gdb -(gdb) x/10i 0x10000234 -``` - -**Expected output:** -``` -0x10000234
: push {r7, lr} -0x10000236 : sub sp, #8 -0x10000238 : add r7, sp, #0 -0x1000023a : bl 0x100012c4 -0x1000023e : movw r0, #404 @ 0x194 -0x10000242 : movt r0, #4096 @ 0x1000 -0x10000246 : bl 0x1000023c <__wrap_puts> -0x1000024a : b.n 0x1000023e -0x1000024c : push {r3, r4, r5, r6, r7, lr} -``` - -##### Step 4: Identify the First Function Call - -The first function call in `main()` is: -``` -0x1000023a : bl 0x100012c4 -``` - -**What does this function do?** - -```gdb -(gdb) info functions stdio_init_all -``` - -**Answer:** `stdio_init_all()` initializes all standard I/O systems (USB, UART, etc.) so `printf()` works. - -##### Step 5: Set a Breakpoint at Main - -```gdb -(gdb) b main -(gdb) c -``` - -**Expected output:** -``` -Breakpoint 1, main () at 0x0001_hello-world.c:5 -5 stdio_init_all(); -``` - -##### Step 6: Examine the Link Register - -When stopped at `main()`, check what's in the link register: - -```gdb -(gdb) info registers lr -``` - -**Expected output:** -``` -lr 0x1000018b 268435851 -``` - -The LR contains the return address - where execution will go when `main()` returns. - -##### Step 7: Disassemble the Caller - -Subtract 1 to remove the Thumb bit and disassemble: - -```gdb -(gdb) x/10i 0x1000018a -``` - -**Expected output:** -``` -0x10000186 : ldr r1, [pc, #80] -0x10000188 : blx r1 -0x1000018a : ldr r1, [pc, #80] ? LR points here -0x1000018c : blx r1 ? This called main -0x1000018e : ldr r1, [pc, #80] -0x10000190 : blx r1 -0x10000192 : bkpt 0x0000 -``` - -##### Step 8: Understand the Call Chain - -Working backward from `main()`: - -``` -platform_entry (0x10000186) - ? calls (blx at +2) -runtime_init() (0x1000024c) - ? calls (blx at +6) -main() (0x10000234) ? We are here - ? will call (blx at +6) -stdio_init_all() (0x100012c4) -``` - -##### Step 9: Verify Platform Entry Calls Main - -Look at what `platform_entry` loads before the `blx`: - -```gdb -(gdb) x/x 0x100001dc -``` - -This is the address loaded into r1 before calling `blx`. It should point to `main()`. - -**Expected output:** -``` -0x100001dc : 0x10000235 -``` - -Note: `0x10000235` = `0x10000234` + 1 (Thumb bit), which is the address of `main()`! - -##### Step 10: Complete the Boot Trace - -You've now traced the complete path: - -``` -1. Reset (Power-on) - ? -2. Bootrom (0x00000000) - ? -3. Vector Table (0x10000000) - ? -4. _reset_handler (0x1000015c) - ? -5. Data Copy & BSS Clear - ? -6. platform_entry (0x10000186) - ? -7. runtime_init() (first call) - ? -8. main() (second call) ? Exercise focus - ? -9. stdio_init_all() (first line of main) -``` - -#### Expected Output -- `main()` is at address `0x10000234` -- First function call is `stdio_init_all()` at offset +6 -- Link register points to `platform_entry+4` (0x1000018a) -- `platform_entry` makes three function calls: runtime_init, main, and exit - -#### Questions for Reflection - -###### Question 1: Why does the link register point 4 bytes after the `blx` instruction that called main? - -###### Question 2: What would happen if `main()` tried to return (instead of looping forever)? - -###### Question 3: How can you tell from the disassembly that main contains an infinite loop? - -###### Question 4: Why is `stdio_init_all()` called before the printf loop? - -#### Tips and Hints -- Use `bt` (backtrace) to see the call stack -- Remember to account for Thumb mode when reading addresses from LR -- Use `info frame` to see detailed information about the current stack frame -- The `push {r7, lr}` at the start of main saves the return address - -#### Next Steps -- Set a breakpoint at `stdio_init_all()` and step through its initialization -- Examine what happens after `main()` by looking at `exit()` function -- Try Exercise 5 in Ghidra for static analysis of the boot sequence - -#### Additional Challenge - -Create a GDB command to automatically trace the call chain: - -```gdb -(gdb) define calltrace -> set $depth = 0 -> set $addr = $pc -> while $depth < 10 -> printf "%d: ", $depth -> info symbol $addr -> set $addr = *(int*)($lr - 4) -> set $depth = $depth + 1 -> end -> end -``` - -Then try stepping through functions and running `calltrace` at each level to build a complete call graph. diff --git a/WEEK03/WEEK03.md b/WEEK03/WEEK03.md index 55634fe..d176951 100644 --- a/WEEK03/WEEK03.md +++ b/WEEK03/WEEK03.md @@ -22,7 +22,7 @@ This week builds on your GDB and Ghidra skills from previous weeks: --- -## 📚 The Code We're Analyzing +## The Code We're Analyzing Throughout this week, we'll continue working with our `0x0001_hello-world.c` program: @@ -42,7 +42,7 @@ But this week, we're going **deeper** - we'll understand everything that happens --- -## 📚 Part 1: Understanding the Boot Process +## Part 1: Understanding the Boot Process ### What Happens When You Power On? @@ -60,49 +60,49 @@ Each of these steps has a corresponding piece of code. Let's explore them all! ### The RP2350 Boot Sequence Overview ``` -┌─────────────────────────────────────────────────────────────────┐ -│ STEP 1: Power On │ -│ - The Cortex-M33 core wakes up │ -│ - Execution begins at address 0x00000000 (Bootrom) │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| STEP 1: Power On | +| - The Cortex-M33 core wakes up | +| - Execution begins at address 0x00000000 (Bootrom) | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ STEP 2: Bootrom Executes (32KB on-chip ROM) │ -│ - This code is burned into the chip - can't be changed! │ -│ - It looks for valid firmware in flash memory │ -│ - It scans the first 4 kB of the image for a valid IMAGE_DEF │ -│ (Datasheet §4.1, p. 338: 32KB ROM; §5.9.5, p. 429: IMAGE_DEF) │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| STEP 2: Bootrom Executes (32KB on-chip ROM) | +| - This code is burned into the chip - can't be changed! | +| - It looks for valid firmware in flash memory | +| - It scans the first 4 kB of the image for a valid IMAGE_DEF | +| (Datasheet §4.1, p. 338: 32KB ROM; §5.9.5, p. 429: IMAGE_DEF) | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ STEP 3: Flash XIP Setup (bootrom-managed) │ -│ - The bootrom configures the flash interface automatically │ -│ - Sets up XIP (Execute In Place) mode │ -│ - NOTE: Unlike RP2040, there is NO separate boot2 in flash! │ -│ (Datasheet §5.2, p. 375: "removal of a boot2 in the first │ -│ 256 bytes of the image") │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| STEP 3: Flash XIP Setup (bootrom-managed) | +| - The bootrom configures the flash interface automatically | +| - Sets up XIP (Execute In Place) mode | +| - NOTE: Unlike RP2040, there is NO separate boot2 in flash! | +| (Datasheet §5.2, p. 375: "removal of a boot2 in the first | +| 256 bytes of the image") | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ STEP 4: Vector Table & Reset Handler │ -│ - Bootrom reads the vector table at 0x10000000 │ -│ - Gets the initial stack pointer from offset 0x00 │ -│ - Gets the reset handler address from offset 0x04 │ -│ - Jumps to the reset handler! │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| STEP 4: Vector Table & Reset Handler | +| - Bootrom reads the vector table at 0x10000000 | +| - Gets the initial stack pointer from offset 0x00 | +| - Gets the reset handler address from offset 0x04 | +| - Jumps to the reset handler! | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ STEP 5: C Runtime Startup (crt0.S) │ -│ - Copies initialized data from flash to RAM │ -│ - Zeros out the BSS section │ -│ - Calls runtime_init() │ -│ - Finally calls main()! │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| STEP 5: C Runtime Startup (crt0.S) | +| - Copies initialized data from flash to RAM | +| - Zeros out the BSS section | +| - Calls runtime_init() | +| - Finally calls main()! | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 2: The Bootrom - Where It All Begins +## Part 2: The Bootrom - Where It All Begins ### What is the Bootrom? @@ -200,7 +200,7 @@ assuming a fixed address. --- -## 📚 Part 3: Understanding XIP (Execute In Place) +## Part 3: Understanding XIP (Execute In Place) > 🔄 **REVIEW:** In Week 1, we learned that our code lives at `0x10000000` in flash memory. We used `x/1000i 0x10000000` to find our `main` function. Now we'll understand WHY code is at this address! @@ -225,29 +225,29 @@ Think of it like reading a book: The XIP flash region starts at address `0x10000000`. This is where your compiled code lives! ``` -┌─────────────────────────────────────────────────────┐ -│ Address: 0x10000000 (XIP Base) │ -│ ┌─────────────────────────────────────────────────┐│ -│ │ Vector Table (first thing here!) ││ -│ │ - Stack Pointer at offset 0x00 ││ -│ │ - Reset Handler at offset 0x04 ││ -│ │ - Other exception handlers... ││ -│ ├─────────────────────────────────────────────────┤│ -│ │ Your Code ││ -│ │ - Reset handler ││ -│ │ - main() function ││ -│ │ - Other functions ││ -│ ├─────────────────────────────────────────────────┤│ -│ │ Read-Only Data ││ -│ │ - Strings like "hello, world" ││ -│ │ - Constant values ││ -│ └─────────────────────────────────────────────────┘│ -└─────────────────────────────────────────────────────┘ ++-----------------------------------------------------+ +| Address: 0x10000000 (XIP Base) | +| +-------------------------------------------------+| +| | Vector Table (first thing here!) || +| | - Stack Pointer at offset 0x00 || +| | - Reset Handler at offset 0x04 || +| | - Other exception handlers... || +| +-------------------------------------------------+| +| | Your Code || +| | - Reset handler || +| | - main() function || +| | - Other functions || +| +-------------------------------------------------+| +| | Read-Only Data || +| | - Strings like "hello, world" || +| | - Constant values || +| +-------------------------------------------------+| ++-----------------------------------------------------+ ``` --- -## 📚 Part 4: The Vector Table - The CPU's Instruction Manual +## Part 4: The Vector Table - The CPU's Instruction Manual ### What is the Vector Table? @@ -293,7 +293,7 @@ So `0x1000015d` means: --- -## 📚 Part 5: The Linker Script - Memory Mapping +## Part 5: The Linker Script - Memory Mapping ### What is a Linker Script? @@ -344,7 +344,7 @@ This value (`0x20082000`) is what we see at offset `0x00` in the vector table! --- -## 📚 Part 6: Setting Up Your Environment (GDB - Dynamic Analysis) +## Part 6: Setting Up Your Environment (GDB - Dynamic Analysis) > 🔄 **REVIEW:** This setup is identical to Weeks 1-2. If you need a refresher on OpenOCD and GDB connection, refer back to Week 1 Part 4 or Week 2 Part 5. @@ -363,7 +363,7 @@ Before we start, make sure you have: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -500,8 +500,8 @@ This is "Compare and Branch if Zero". If `r0` is `0` (meaning we're on Core 0), The RP2350 has **two cores**, but only **Core 0** should run the startup code! If both cores tried to initialize the same memory and peripherals, chaos would ensue. So the reset handler checks: -- **Core 0?** → Continue with startup -- **Core 1?** → Go back to the bootrom and wait +- **Core 0?** -> Continue with startup +- **Core 1?** -> Go back to the bootrom and wait --- @@ -557,31 +557,31 @@ Let's look at more instructions to see the full picture: The reset handler performs several phases: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ PHASE 1: Core Check (0x1000015c - 0x10000168) │ -│ - Check CPUID to see which core we're on │ -│ - If not Core 0, go back to bootrom │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PHASE 1: Core Check (0x1000015c - 0x10000168) | +| - Check CPUID to see which core we're on | +| - If not Core 0, go back to bootrom | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ PHASE 2: Data Copy Setup & Loop (0x1000016a - 0x10000176) │ -│ - Set up the data_cpy_table pointer and load each copy triplet │ -│ - Copy initialized variables from flash to RAM │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PHASE 2: Data Copy Setup & Loop (0x1000016a - 0x10000176) | +| - Set up the data_cpy_table pointer and load each copy triplet | +| - Copy initialized variables from flash to RAM | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ PHASE 3: BSS Setup & Clear (0x10000178 - 0x10000184) │ -│ - Load the BSS start/end addresses into r1 and r2 │ -│ - GDB labels those literals as `data_cpy_table+48/+52` │ -│ - Zero out all uninitialized global variables │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PHASE 3: BSS Setup & Clear (0x10000178 - 0x10000184) | +| - Load the BSS start/end addresses into r1 and r2 | +| - GDB labels those literals as `data_cpy_table+48/+52` | +| - Zero out all uninitialized global variables | ++-----------------------------------------------------------------+ ↓ -┌─────────────────────────────────────────────────────────────────┐ -│ PHASE 4: Platform Entry Begins (0x10000186 - 0x10000188 shown) │ -│ - Load the runtime_init() pointer from the table │ -│ - Branch to runtime_init() with `blx r1` │ -│ - `main()` and `exit()` appear a few instructions later │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PHASE 4: Platform Entry Begins (0x10000186 - 0x10000188 shown) | +| - Load the runtime_init() pointer from the table | +| - Branch to runtime_init() with `blx r1` | +| - `main()` and `exit()` appear a few instructions later | ++-----------------------------------------------------------------+ ``` --- @@ -634,12 +634,12 @@ The table ends with an entry where the source address is `0x00000000` (which sig The data copy loop works like this: ``` -┌─────────────────────────────────────────────┐ -│ 1. Load source, dest, end from table │ -│ 2. If source == 0, we're done │ -│ 3. Otherwise, copy word by word │ -│ 4. Go back to step 1 for next entry │ -└─────────────────────────────────────────────┘ ++---------------------------------------------+ +| 1. Load source, dest, end from table | +| 2. If source == 0, we're done | +| 3. Otherwise, copy word by word | +| 4. Go back to step 1 for next entry | ++---------------------------------------------+ ``` The actual code (starting at **`0x1000016c`** in the reset handler): @@ -655,7 +655,7 @@ bl 0x1000019a b.n 0x1000016c ``` -> 💡 **Note:** You can see this code in **Step 6** earlier where we examined the reset handler with `x/20i 0x1000015c`. +> Tip: **Note:** You can see this code in **Step 6** earlier where we examined the reset handler with `x/20i 0x1000015c`. --- @@ -699,16 +699,16 @@ The first two `ldr` instructions are still part of the **BSS clear setup**, even ### Understanding the Loop ``` -┌─────────────────────────────────────────────┐ -│ r1 = start of BSS section │ -│ r2 = end of BSS section │ -│ r0 = 0 │ -│ │ -│ LOOP: │ -│ Store 0 at address r1 │ -│ Increment r1 by 4 bytes │ -│ If r1 != r2, repeat │ -└─────────────────────────────────────────────┘ ++---------------------------------------------+ +| r1 = start of BSS section | +| r2 = end of BSS section | +| r0 = 0 | +| | +| LOOP: | +| Store 0 at address r1 | +| Increment r1 by 4 bytes | +| If r1 != r2, repeat | ++---------------------------------------------+ ``` --- @@ -817,7 +817,7 @@ Let's verify we understand the boot process by setting a breakpoint at main: **You should see:** ``` -Breakpoint 1 at 0x10000234: file C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c, line 5. +Breakpoint 1 at 0x10000234: file C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c, line 5. Note: automatically using hardware breakpoints for read-only addresses. ``` @@ -833,7 +833,7 @@ Note: automatically using hardware breakpoints for read-only addresses. Continuing. Thread 1 "rp2350.cm0" hit Breakpoint 1, main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0001_hello-world/0x0001_hello-world.c:5 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0001_hello-world/0x0001_hello-world.c:5 5 stdio_init_all(); (gdb) ``` @@ -945,7 +945,7 @@ While GDB is excellent for dynamic analysis (watching code execute), Ghidra exce ... ``` -> 💡 **Notice:** Ghidra shows the vector table data as individual bytes by default. You can see it has labeled the start as `__vectors`, `__flash_binary_start`, `__VECTOR_TABLE`, and `__logical_binary_start`. The arrows (like `? -> 1000015d`) show that Ghidra recognizes these bytes as pointers to code addresses! To see the data formatted as 32-bit addresses instead of bytes, you can right-click and retype the data. +> Tip: **Notice:** Ghidra shows the vector table data as individual bytes by default. You can see it has labeled the start as `__vectors`, `__flash_binary_start`, `__VECTOR_TABLE`, and `__logical_binary_start`. The arrows (like `? -> 1000015d`) show that Ghidra recognizes these bytes as pointers to code addresses! To see the data formatted as 32-bit addresses instead of bytes, you can right-click and retype the data. ### Step 17: Navigate to the Reset Handler @@ -1005,7 +1005,7 @@ void _reset_handler(void) Let's find how the boot code eventually calls `main()`: 1. In the Symbol Tree, find the `main` function -2. Right-click on `main` and select **References → Show References to main** +2. Right-click on `main` and select **References -> Show References to main** 3. This shows everywhere `main` is called from! **You should see:** @@ -1048,7 +1048,7 @@ In Ghidra, look at `platform_entry`: Ghidra can visualize the call flow: -1. With `_reset_handler` selected, go to **Window → Function Call Graph** +1. With `_reset_handler` selected, go to **Window -> Function Call Graph** 2. This shows a visual graph of all function calls from the reset handler 3. You will see `_reset_handler` at the top with arrows going down to its four direct callees: `data_cpy`, `runtime_init`, `main`, and `exit` @@ -1076,32 +1076,32 @@ Ghidra can visualize the call flow: ### The Complete Boot Sequence ``` -┌─────────────────────────────────────────────────────────────────┐ -│ 1. POWER ON │ -│ Cortex-M33 begins at 0x00000000 (bootrom) │ -├─────────────────────────────────────────────────────────────────┤ -│ 2. BOOTROM │ -│ - Initializes hardware │ -│ - Configures flash XIP (no separate boot2 on RP2350) │ -│ - Finds IMAGE_DEF within first 4 kB of flash image │ -├─────────────────────────────────────────────────────────────────┤ -│ 3. VECTOR TABLE (0x10000000) │ -│ - Reads SP from offset 0x00 → 0x20082000 │ -│ - Reads Reset Handler from offset 0x04 → 0x1000015d │ -├─────────────────────────────────────────────────────────────────┤ -│ 4. RESET HANDLER (0x1000015c) │ -│ - Checks CPUID (Core 0 continues, Core 1 waits) │ -│ - Copies .data from flash to RAM │ -│ - Zeros .bss section │ -├─────────────────────────────────────────────────────────────────┤ -│ 5. PLATFORM ENTRY (0x10000186) │ -│ - Calls runtime_init() │ -│ - Calls main() │ -│ - Calls exit() when main returns │ -├─────────────────────────────────────────────────────────────────┤ -│ 6. YOUR CODE RUNS! │ -│ main() at 0x10000234 │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| 1. POWER ON | +| Cortex-M33 begins at 0x00000000 (bootrom) | ++-----------------------------------------------------------------+ +| 2. BOOTROM | +| - Initializes hardware | +| - Configures flash XIP (no separate boot2 on RP2350) | +| - Finds IMAGE_DEF within first 4 kB of flash image | ++-----------------------------------------------------------------+ +| 3. VECTOR TABLE (0x10000000) | +| - Reads SP from offset 0x00 -> 0x20082000 | +| - Reads Reset Handler from offset 0x04 -> 0x1000015d | ++-----------------------------------------------------------------+ +| 4. RESET HANDLER (0x1000015c) | +| - Checks CPUID (Core 0 continues, Core 1 waits) | +| - Copies .data from flash to RAM | +| - Zeros .bss section | ++-----------------------------------------------------------------+ +| 5. PLATFORM ENTRY (0x10000186) | +| - Calls runtime_init() | +| - Calls main() | +| - Calls exit() when main returns | ++-----------------------------------------------------------------+ +| 6. YOUR CODE RUNS! | +| main() at 0x10000234 | ++-----------------------------------------------------------------+ ``` ### Key Addresses to Remember @@ -1157,56 +1157,14 @@ Ghidra can visualize the call flow: | Action | How to Access | Purpose | | ------ | ------------- | ------- | -| Go To Address | Navigation → Go To... | Jump to specific memory address | -| Show References | Right-click → References → Show References to | Find all callers of a function | -| Function Call Graph | Window → Function Call Graph | Visualize call flow | +| Go To Address | Navigation -> Go To... | Jump to specific memory address | +| Show References | Right-click -> References -> Show References to | Find all callers of a function | +| Function Call Graph | Window -> Function Call Graph | Visualize call flow | | Add Comment | Press `;` | Document your analysis | -| Rename Symbol | Right-click → Rename | Give meaningful names to functions | +| Rename Symbol | Right-click -> Rename | Give meaningful names to functions | --- -## ✅ Practice Exercises - -### Exercise 1: Trace a Reset - -1. Set a breakpoint at the reset handler: `b *0x1000015c` -2. Type `monitor reset halt` then `c` -3. Single-step through the first 10 instructions with `si` -4. For each instruction, explain what it does - -### Exercise 2: Find the Stack Size - -1. The stack starts at `0x20082000` -2. The stack limit is `0x20078000` (from register assignments) -3. Calculate: How many bytes is the stack? -4. How many kilobytes is that? - -### Exercise 3: Examine All Vectors - -1. Use `x/16x 0x10000000` to see the first 16 vector table entries -2. For each entry, determine: - - Is it a valid code address (starts with `0x1000...`)? - - What handler does it point to? - -### Exercise 4: Find Your Main Function and Trace Back - -1. Use `info functions main` to find main -2. Examine 10 instructions at that address -3. Identify the first function call in main -4. What does that function do? -5. When stopped at main, examine `$lr` (link register) -6. What address is stored there? -7. Disassemble that address - what function is it? -8. This shows you where main was called from! - -### Exercise 5: Ghidra Boot Analysis - -1. In Ghidra, navigate to `_reset_handler` -2. Use **Window → Function Call Graph** to visualize the call tree -3. Identify the path from `_reset_handler` to `main` -4. How many functions are called before `main` starts? -5. Add a comment in Ghidra explaining what each function does - --- ## 🎓 Key Takeaways @@ -1270,18 +1228,18 @@ Understanding the boot process is critical for both attackers and defenders. Kno #### 1. Secure Boot Implementation ``` -┌─────────────────────────────────────────────────────┐ -│ SECURE BOOT FLOW │ -├─────────────────────────────────────────────────────┤ -│ Bootrom (immutable) │ -│ ↓ │ -│ Verify IMAGE_DEF signature │ -│ ↓ │ -│ Verify application image signature │ -│ ↓ │ -│ If all valid: Jump to reset handler │ -│ If any invalid: Refuse to boot │ -└─────────────────────────────────────────────────────┘ ++-----------------------------------------------------+ +| SECURE BOOT FLOW | ++-----------------------------------------------------+ +| Bootrom (immutable) | +| ↓ | +| Verify IMAGE_DEF signature | +| ↓ | +| Verify application image signature | +| ↓ | +| If all valid: Jump to reset handler | +| If any invalid: Refuse to boot | ++-----------------------------------------------------+ ``` **Implementation:** Use cryptographic signatures to verify each boot stage before execution. @@ -1386,7 +1344,7 @@ Understanding how an attacker would analyze and exploit the boot sequence is ess --- -## 📚 Additional Resources +## Additional Resources ### RP2350 Datasheet @@ -1411,7 +1369,7 @@ https://github.com/raspberrypi/pico-bootrom-rp2350 ## 🔬 Part 17: Proving the Boot Sequence with objdump -Everything we have learned about the boot sequence can be proven directly from the compiled ELF binary using `arm-none-eabi-objdump`. The bootrom is not in your ELF (it is mask ROM burned into the chip at `0x00000000`), but everything your firmware provides — the vector table, the IMAGE_DEF, and the reset handler — lives in your ELF starting at `0x10000000`. +Everything we have learned about the boot sequence can be proven directly from the compiled ELF binary using `arm-none-eabi-objdump`. The bootrom is not in your ELF (it is mask ROM burned into the chip at `0x00000000`), but everything your firmware provides - the vector table, the IMAGE_DEF, and the reset handler - lives in your ELF starting at `0x10000000`. ### Step 1: List All Sections @@ -1429,9 +1387,9 @@ Idx Name Size VMA LMA 6 .data 0000019c 20000110 10001b4c ``` -> 💡 The Pico SDK merges `.vectors`, `.embedded_block`, and `.reset` all into `.text` at `0x10000000`. They are not separate named ELF sections — they are sub-regions inside `.text`. +> Tip: The Pico SDK merges `.vectors`, `.embedded_block`, and `.reset` all into `.text` at `0x10000000`. They are not separate named ELF sections - they are sub-regions inside `.text`. -### Step 2: Dump the First 0x150 Bytes of Flash — One Command, Zero Skips +### Step 2: Dump the First 0x150 Bytes of Flash - One Command, Zero Skips ```bash arm-none-eabi-objdump -s --start-address=0x10000000 --stop-address=0x10000150 build/0x0001_hello-world.elf @@ -1465,30 +1423,30 @@ Raw output from that command: Every address annotated, no skips: -#### 0x10000000 — Vector Table, Mandatory Entries +#### 0x10000000 - Vector Table, Mandatory Entries | Address | Raw Bytes (LE) | Decoded | What it is | |---------|----------------|---------|------------| -| `0x10000000` | `00 20 08 20` | `0x20082000` | **Initial SP** — top of SCRATCH_Y RAM. Bootrom loads MSP from here before doing anything else. | -| `0x10000004` | `5d 01 00 10` | `0x1000015d` | **Reset_Handler** address with Thumb bit set. Strip bit 0 → real address `0x1000015c`. Bootrom jumps here. | -| `0x10000008` | `1b 01 00 10` | `0x1000011b` | **NMI** handler address (Thumb, → `0x1000011a`). | -| `0x1000000c` | `1d 01 00 10` | `0x1000011d` | **HardFault** handler address (Thumb, → `0x1000011c`). | +| `0x10000000` | `00 20 08 20` | `0x20082000` | **Initial SP** - top of SCRATCH_Y RAM. Bootrom loads MSP from here before doing anything else. | +| `0x10000004` | `5d 01 00 10` | `0x1000015d` | **Reset_Handler** address with Thumb bit set. Strip bit 0 -> real address `0x1000015c`. Bootrom jumps here. | +| `0x10000008` | `1b 01 00 10` | `0x1000011b` | **NMI** handler address (Thumb, -> `0x1000011a`). | +| `0x1000000c` | `1d 01 00 10` | `0x1000011d` | **HardFault** handler address (Thumb, -> `0x1000011c`). | -#### 0x10000010–0x1000010f — Vector Table, IRQ Slots (all 52 external IRQs) +#### 0x10000010-0x1000010f - Vector Table, IRQ Slots (all 52 external IRQs) ``` 10000010 11010010 11010010 ...(repeats through 0x1000010f)... ``` Every 4-byte word here is `11 01 00 10` = pointer `0x10000111`. -That is the **default IRQ handler** address with Thumb bit set (→ `0x10000110`). -The RP2350 Cortex-M33 has 16 system vectors (offsets 0x00–0x3f) plus up to 52 -external IRQ vectors (offsets 0x40–0xff = addresses `0x10000040`–`0x1000010f`). +That is the **default IRQ handler** address with Thumb bit set (-> `0x10000110`). +The RP2350 Cortex-M33 has 16 system vectors (offsets 0x00-0x3f) plus up to 52 +external IRQ vectors (offsets 0x40-0xff = addresses `0x10000040`-`0x1000010f`). Every IRQ the application does not register gets this default handler pointer. This block is 240 bytes (`0x10000010` to `0x1000010f`) of nothing but that one repeated pointer. -#### 0x10000110–0x10000127 — Default IRQ Handler Code +#### 0x10000110-0x10000127 - Default IRQ Handler Code ``` 10000110 eff30580 103800be 00be00be 00be00be @@ -1498,14 +1456,14 @@ repeated pointer. | Address | Bytes | ARM Thumb-2 Instruction | What it does | |---------|-------|-------------------------|--------------| | `0x10000110` | `ef f3 05 80` | `MRS r0, IPSR` | Read the Interrupt Program Status Register into r0. The low 9 bits = the active vector number. | -| `0x10000114` | `10 38` | `SUBS r0, #16` | Vector 16 = IRQ0, so subtract 16 to convert vector number → IRQ index. | +| `0x10000114` | `10 38` | `SUBS r0, #16` | Vector 16 = IRQ0, so subtract 16 to convert vector number -> IRQ index. | | `0x10000116` | `00 be` | `BKPT #0` | Software breakpoint. If a debugger is attached, it stops here and you can inspect r0 to see which IRQ fired. If no debugger is attached, the CPU enters a fault loop and the chip hangs. | -| `0x10000118`–`0x10000127` | `00 be` ×12 | `BKPT #0` repeating | Alignment padding to the next 4-byte boundary. | +| `0x10000118`-`0x10000127` | `00 be` *12 | `BKPT #0` repeating | Alignment padding to the next 4-byte boundary. | This is the **entire** default IRQ handler. It is intentionally minimal: if your code triggers an IRQ you did not register, it crashes visibly instead of silently. -#### 0x10000128–0x1000013b — Binary Info Pointer Table +#### 0x10000128-0x1000013b - Binary Info Pointer Table ``` 10000120 201b0010 4c1b0010 @@ -1517,12 +1475,12 @@ code triggers an IRQ you did not register, it crashes visibly instead of silentl | `0x10000128` | `20 1b 00 10` | `0x10001b20` | Pointer to **start** of `.binary_info` data section in flash. | | `0x1000012c` | `4c 1b 00 10` | `0x10001b4c` | Pointer to **end** of `.binary_info` data section in flash. | | `0x10000130` | `a0 01 00 10` | `0x100001a0` | Pointer to `binary_info_callback` function. | -| `0x10000134` | `90 a3 1a e7` | (magic marker) | `BINARY_INFO_MARKER_END` — marks the end of this pointer table. | +| `0x10000134` | `90 a3 1a e7` | (magic marker) | `BINARY_INFO_MARKER_END` - marks the end of this pointer table. | `picotool` reads this table to extract the program name, version string, URL, and GPIO pin map from any compiled binary without running it. -#### 0x10000138–0x1000014c — IMAGE_DEF Block (this build) +#### 0x10000138-0x1000014c - IMAGE_DEF Block (this build) ``` 10000130 a0010010 90a31ae7 d3deffff 42012110 @@ -1531,49 +1489,49 @@ and GPIO pin map from any compiled binary without running it. | Address | Bytes | What it is | |---------|-------|------------| -| `0x10000138` | `d3 de ff ff` | `PICOBIN_BLOCK_MARKER_START` — the bootrom scans flash for this exact 4-byte sequence to locate the IMAGE_DEF. | +| `0x10000138` | `d3 de ff ff` | `PICOBIN_BLOCK_MARKER_START` - the bootrom scans flash for this exact 4-byte sequence to locate the IMAGE_DEF. | | `0x1000013c` | `42 01 21 10` | IMAGE_DEF content (image type, flags, version). | | `0x10000140` | `ff 01 00 00` | IMAGE_DEF content (continuation). | | `0x10000144` | `b0 1b 00 00` | IMAGE_DEF content (continuation). | -| `0x10000148` | `79 35 12 ab` | `PICOBIN_BLOCK_MARKER_END` — bootrom stops scanning here. | +| `0x10000148` | `79 35 12 ab` | `PICOBIN_BLOCK_MARKER_END` - bootrom stops scanning here. | -The IMAGE_DEF sits at `0x10000138`–`0x1000014b` in this build, +The IMAGE_DEF sits at `0x10000138`-`0x1000014b` in this build, well within the 4 KB scan window the bootrom uses (Datasheet §5.9.5, p. 429). -#### Full Flash Map: 0x10000000–0x1000015c +#### Full Flash Map: 0x10000000-0x1000015c ``` - 0x10000000–0x1000000f Vector Table: mandatory entries (SP, Reset, NMI, HardFault) - 0x10000010–0x1000010f Vector Table: 52 external IRQ slots → all point to default handler - 0x10000110–0x10000127 Default IRQ handler code (MRS / SUBS / BKPT) - 0x10000128–0x10000137 Binary info pointer table (start / end / callback / magic end) - 0x10000138–0x1000014b IMAGE_DEF block (d3 de ff ff ... 79 35 12 ab) - 0x10000150–0x1000015b (padding / alignment) + 0x10000000-0x1000000f Vector Table: mandatory entries (SP, Reset, NMI, HardFault) + 0x10000010-0x1000010f Vector Table: 52 external IRQ slots -> all point to default handler + 0x10000110-0x10000127 Default IRQ handler code (MRS / SUBS / BKPT) + 0x10000128-0x10000137 Binary info pointer table (start / end / callback / magic end) + 0x10000138-0x1000014b IMAGE_DEF block (d3 de ff ff ... 79 35 12 ab) + 0x10000150-0x1000015b (padding / alignment) 0x1000015c Reset_Handler (_reset_handler in crt0.S) ← bootrom jumps here ``` ### Step 4: Confirmed Boot Sequence (proven from ELF) ``` -┌─────────────────────────────────────────────────────────────────┐ -│ PROVEN BOOT SEQUENCE (0x0001_hello-world) │ -├─────────────────────────────────────────────────────────────────┤ -│ 1. Bootrom reads 0x10000000 │ -│ → SP = 0x20082000 (offset +0x00 of vector table) │ -│ → RST = 0x1000015d (offset +0x04, Thumb → 0x1000015c) │ -├─────────────────────────────────────────────────────────────────┤ -│ 2. Bootrom scans first 4 kB for IMAGE_DEF │ -│ → Found at 0x10000138 (this build) │ -│ → Start marker: d3 de ff ff │ -│ → End marker: 79 35 12 ab │ -├─────────────────────────────────────────────────────────────────┤ -│ 3. Bootrom jumps to reset handler at 0x1000015c │ -│ → _reset_handler (crt0.S) runs │ -│ → Checks CPUID — Core 1 sent back to bootrom │ -│ → Core 0: .data copied, .bss zeroed, platform_entry called │ -├─────────────────────────────────────────────────────────────────┤ -│ 4. platform_entry calls runtime_init → main → exit │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PROVEN BOOT SEQUENCE (0x0001_hello-world) | ++-----------------------------------------------------------------+ +| 1. Bootrom reads 0x10000000 | +| -> SP = 0x20082000 (offset +0x00 of vector table) | +| -> RST = 0x1000015d (offset +0x04, Thumb -> 0x1000015c) | ++-----------------------------------------------------------------+ +| 2. Bootrom scans first 4 kB for IMAGE_DEF | +| -> Found at 0x10000138 (this build) | +| -> Start marker: d3 de ff ff | +| -> End marker: 79 35 12 ab | ++-----------------------------------------------------------------+ +| 3. Bootrom jumps to reset handler at 0x1000015c | +| -> _reset_handler (crt0.S) runs | +| -> Checks CPUID - Core 1 sent back to bootrom | +| -> Core 0: .data copied, .bss zeroed, platform_entry called | ++-----------------------------------------------------------------+ +| 4. platform_entry calls runtime_init -> main -> exit | ++-----------------------------------------------------------------+ ``` > 📖 **Datasheet References:** @@ -1586,3 +1544,5 @@ well within the 4 KB scan window the bootrom uses (Datasheet §5.9.5, p. 429). **Remember:** Understanding the boot process is fundamental to embedded systems work. Whether you're debugging a system that won't start, reverse engineering firmware, or building secure boot chains, this knowledge is essential! Happy exploring! 🔍 + + diff --git a/WEEK04/WEEK04-01-S.md b/WEEK04/WEEK04-01-S.md deleted file mode 100644 index 9241b72..0000000 --- a/WEEK04/WEEK04-01-S.md +++ /dev/null @@ -1,63 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 1 Solution: Analyze Variable Storage in Ghidra - -#### Answers - -##### Main Function Analysis - -| Item | Value/Location | Notes | -|-----------------------|---------------|---------------------------------| -| Main function address | 0x10000234 | Entry point of program | -| Age value (hex) | 0x2b | Optimized constant | -| Age value (decimal) | 43 | Original variable value | -| Variable in memory? | No | Compiler optimized it away | -| printf address | 0x10003100 | Standard library function | -| stdio_init_all addr | 0x100030cc | I/O initialization | -| Format string | "age: %d\r\n" | Located in .rodata section | - -##### Decompiled main() After Renaming - -```c -int main(void) -{ - stdio_init_all(); - do { - printf("age: %d\r\n", 0x2b); - } while (true); -} -``` - -##### Hex-to-Decimal Conversion - -``` -0x2b = (2 × 16) + 11 = 32 + 11 = 43 -``` - -The compiler replaced both `age = 42` and `age = 43` with the final constant value `0x2b` (43) as an immediate operand in `movs r1, #0x2b`. - -##### Assembly Listing - -```assembly -movs r1, #0x2b ; Load 43 directly into r1 (printf argument) -ldr r0, [pc, #...] ; Load format string address -bl printf ; Call printf -``` - -#### Reflection Answers - -1. **Why did the compiler optimize away the `age` variable?** - The compiler performs **dead store elimination** and **constant propagation**. The initial assignment `age = 42` is immediately overwritten by `age = 43` with no intervening reads of the value 42. Since the only value ever observed is 43, the compiler replaces all references to `age` with the constant `0x2b` (43) as an immediate operand. No memory allocation is needed—the value lives entirely in the instruction encoding (`movs r1, #0x2b`). - -2. **In what memory section would `age` have been stored if it wasn't optimized away?** - As a local variable declared inside `main()`, `age` would have been stored on the **stack** (in RAM at `0x2000xxxx`). The compiler would allocate space by subtracting from SP, store the value with a `str` instruction, and load it back with `ldr` before passing it to `printf`. If `age` were declared as a global initialized variable, it would be placed in the **`.data`** section (RAM, initialized from flash at boot). If declared as `static` or global but uninitialized, it would go in the **`.bss`** section (RAM, zeroed at boot). - -3. **Where is the string "age: %d\r\n" stored, and why can't it be in RAM?** - The format string is stored in the **`.rodata`** (read-only data) section in flash memory at `0x1000xxxx`. It cannot be in RAM because: (a) string literals are constants that never change, so storing them in limited RAM would waste space; (b) flash is non-volatile—the string persists across power cycles without needing to be copied from anywhere; (c) the XIP (Execute In Place) mechanism allows the CPU to read directly from flash, so `.rodata` access is efficient. - -4. **What would happen if we had used `age` in a calculation before reassigning it to 43?** - The compiler would be forced to preserve the value 42 because it's actually read before being overwritten. For example, `printf("before: %d\n", age); age = 43;` would require the compiler to generate both `movs r1, #0x2a` (42) for the first print and `movs r1, #0x2b` (43) for subsequent uses. Alternatively, a calculation like `age = age + 1` would allow the compiler to constant-fold `42 + 1 = 43` at compile time and still emit just `#0x2b`. Only if the value depends on runtime input would the variable require actual memory allocation. diff --git a/WEEK04/WEEK04-01.md b/WEEK04/WEEK04-01.md deleted file mode 100644 index 3bb7c46..0000000 --- a/WEEK04/WEEK04-01.md +++ /dev/null @@ -1,241 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 1: Analyze Variable Storage in Ghidra - -#### Objective -Import and analyze the `0x0005_intro-to-variables.bin` binary in Ghidra to understand where variables are stored, identify memory sections, and trace how the compiler optimizes variable usage. - -#### Prerequisites -- Ghidra installed and configured -- `0x0005_intro-to-variables.bin` binary available in your build directory -- Understanding of memory sections (`.data`, `.bss`, `.rodata`) from Week 4 Part 2 -- Basic Ghidra navigation skills from Week 3 - -#### Task Description -You will import the binary into Ghidra, configure it for ARM Cortex-M33, analyze the code structure, resolve function names, and locate where the `age` variable is used in the compiled binary. - -#### Step-by-Step Instructions - -##### Step 1: Start Ghidra and Create New Project - -```powershell -ghidraRun -``` - -1. Click **File** ? **New Project** -2. Select **Non-Shared Project** -3. Click **Next** -4. Enter Project Name: `week04-ex01-intro-to-variables` -5. Choose a project directory -6. Click **Finish** - -##### Step 2: Import the Binary - -1. Navigate to your file explorer -2. Find `Embedded-Hacking\0x0005_intro-to-variables\build\0x0005_intro-to-variables.bin` -3. **Drag and drop** the `.bin` file into Ghidra's project window - -##### Step 3: Configure Import Settings - -When the import dialog appears: - -1. Click the three dots (****) next to **Language** -2. Search for: `Cortex` -3. Select: **ARM Cortex 32 little endian default** -4. Click **OK** - -Now click **Options** button: -1. Change **Block Name** to: `.text` -2. Change **Base Address** to: `10000000` (XIP flash base) -3. Click **OK** - -Then click **OK** on the main import dialog. - -##### Step 4: Analyze the Binary - -1. Double-click the imported file in the project window -2. When prompted "Analyze now?" click **Yes** -3. Leave all default analysis options selected -4. Click **Analyze** -5. Wait for analysis to complete (watch bottom-right progress bar) - -##### Step 5: Navigate to the Symbol Tree - -Look at the left panel for the **Symbol Tree**. Expand **Functions** to see the auto-detected functions: - -You should see function names like: -- `FUN_1000019a` -- `FUN_10000210` -- `FUN_10000234` -- Many more... - -These are auto-generated names because we're analyzing a raw binary without debug symbols. - -##### Step 6: Identify the Main Function - -From Week 3, we know the typical boot sequence: -1. Reset handler copies data -2. `frame_dummy` runs -3. `main()` is called - -Click on `FUN_10000234` - this should be our `main()` function. - -**Look at the Decompile window:** - -```c -void FUN_10000234(void) -{ - FUN_100030cc(); - do { - FUN_10003100("age: %d\r\n", 0x2b); - } while (true); -} -``` - -**Observations:** -- `FUN_100030cc()` is likely `stdio_init_all()` -- `FUN_10003100()` is likely `printf()` -- The magic value `0x2b` appears (what is this?) - -##### Step 7: Convert 0x2b to Decimal - -Let's figure out what `0x2b` means: - -**Manual calculation:** -- `0x2b` in hexadecimal -- `2 16 + 11 = 32 + 11 = 43` in decimal - -**In GDB (alternative method):** -```gdb -(gdb) p/d 0x2b -$1 = 43 -``` - -So `0x2b = 43`! This matches our `age = 43` from the source code! - -##### Step 8: Rename Functions for Clarity - -Let's rename the functions to their actual names: - -**Rename FUN_10000234 to main:** -1. Right-click on `FUN_10000234` in the Symbol Tree -2. Select **Rename Function** -3. Enter: `main` -4. Press **Enter** - -**Update main's signature:** -1. In the Decompile window, right-click on `main` -2. Select **Edit Function Signature** -3. Change to: `int main(void)` -4. Click **OK** - -**Rename FUN_100030cc to stdio_init_all:** -1. Click on `FUN_100030cc` in the decompile window -2. Right-click ? **Edit Function Signature** -3. Change name to: `stdio_init_all` -4. Change signature to: `bool stdio_init_all(void)` -5. Click **OK** - -**Rename FUN_10003100 to printf:** -1. Click on `FUN_10003100` -2. Right-click ? **Edit Function Signature** -3. Change name to: `printf` -4. Check the **Varargs** checkbox (printf accepts variable arguments) -5. Click **OK** - -##### Step 9: Examine the Optimized Code - -After renaming, the decompiled main should now look like: - -```c -int main(void) -{ - stdio_init_all(); - do { - printf("age: %d\r\n", 0x2b); - } while (true); -} -``` - -**Critical observation:** Where did our `age` variable go? - -Original source code: -```c -uint8_t age = 42; -age = 43; -``` - -The compiler **optimized it completely away**! - -**Why?** -1. `age = 42` is immediately overwritten -2. The value `42` is never used -3. The compiler replaces `age` with the constant `43` (`0x2b`) -4. No variable allocation in memory is needed! - -##### Step 10: Examine the Assembly Listing - -Click on the **Listing** window (shows assembly code): - -Find the instruction that loads `0x2b`: - -```assembly -10000xxx movs r1, #0x2b -10000xxx ... -10000xxx bl printf -``` - -**What this does:** -- `movs r1, #0x2b` - Moves the immediate value 0x2b (43) into register r1 -- `bl printf` - Branches to printf, which expects format args in r1+ - -##### Step 11: Document Your Findings - -Create a table of your observations: - -| Item | Value/Location | Notes | -| --------------------- | -------------- | ------------------------------- | -| Main function address | `0x10000234` | Entry point of program | -| Age value (hex) | `0x2b` | Optimized constant | -| Age value (decimal) | `43` | Original variable value | -| Variable in memory? | No | Compiler optimized it away | -| Printf address | `0x10003100` | Standard library function | -| Format string | "age: %d\r\n" | Located in .rodata section | - -#### Expected Output - -After completing this exercise, you should be able to: -- Successfully import and configure ARM binaries in Ghidra -- Navigate the Symbol Tree and identify functions -- Understand how compiler optimization removes unnecessary variables -- Convert hexadecimal values to decimal -- Rename functions for better code readability - -#### Questions for Reflection - -###### Question 1: Why did the compiler optimize away the `age` variable? - -###### Question 2: In what memory section would `age` have been stored if it wasn't optimized away? - -###### Question 3: Where is the string "age: %d\r\n" stored, and why can't it be in RAM? - -###### Question 4: What would happen if we had used `age` in a calculation before reassigning it to 43? - -#### Tips and Hints -- Use **CTRL+F** in Ghidra to search for specific values or strings -- The **Data Type Manager** window shows all recognized data types -- If Ghidra's decompiler output looks wrong, try re-analyzing with different options -- Remember: optimized code often looks very different from source code -- The **Display** ? **Function Graph** shows control flow visually - -#### Next Steps -- Proceed to Exercise 2 to learn binary patching -- Try analyzing `0x0008_uninitialized-variables.bin` to see how uninitialized variables behave -- Explore the `.rodata` section to find string literals - -#### Additional Challenge -Find the format string "age: %d\r\n" in Ghidra. What address is it stored at? How does the program reference this string in the assembly code? (Hint: Look for an `ldr` instruction that loads the string address into a register.) diff --git a/WEEK04/WEEK04-02-S.md b/WEEK04/WEEK04-02-S.md deleted file mode 100644 index 8b15db9..0000000 --- a/WEEK04/WEEK04-02-S.md +++ /dev/null @@ -1,53 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 2 Solution: Patch Binary to Change Variable Value - -#### Answers - -##### Patch Details - -| Item | Original | Patched | -|--------------------|-------------- |---------------| -| Instruction | movs r1, #0x2b | movs r1, #0x46 | -| Hex bytes | 21 2b | 21 46 | -| Decimal value | 43 | 70 | -| Output | age: 43 | age: 70 | - -##### Patching Steps - -1. Located `movs r1, #0x2b` in Ghidra Listing view -2. Right-click → **Patch Instruction** → changed `#0x2b` to `#0x46` -3. Verified in Decompile window: `printf("age: %d\r\n", 0x46)` -4. Exported: **File → Export Program → Binary** → `0x0005_intro-to-variables-h.bin` -5. Converted to UF2: - ```powershell - python ..\uf2conv.py build\0x0005_intro-to-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 - ``` -6. Flashed via BOOTSEL → RPI-RP2 drive - -##### Serial Output - -``` -age: 70 -age: 70 -age: 70 -... -``` - -#### Reflection Answers - -1. **Why do we need to convert to UF2 format instead of flashing the raw .bin file?** - The RP2350 bootloader (accessed via BOOTSEL) expects **UF2 (USB Flashing Format)** files. UF2 is a container format that includes metadata: the target flash address for each 256-byte block, a family ID (`0xe48bff59` for RP2350), and checksums. A raw `.bin` file contains only code bytes with no addressing information—the bootloader wouldn't know where in flash to write the data. UF2 also supports partial updates and is self-describing, making it safer for USB mass storage flashing. - -2. **What is the significance of the base address 0x10000000 in the conversion command?** - `0x10000000` is the **XIP (Execute In Place) flash base address** on the RP2350. This tells the UF2 converter that byte 0 of the binary should be written to flash address `0x10000000`. The CPU fetches instructions directly from this address range via the XIP controller. If the base address were wrong (e.g., `0x20000000` for RAM), the code would be written to the wrong location and the processor would fail to boot because the vector table wouldn't be found at the expected address. - -3. **What would happen if you patched the wrong instruction by mistake?** - The consequences depend on what was changed: (a) Patching a different `movs` might corrupt an unrelated function parameter, causing incorrect behavior or a crash. (b) Patching opcode bytes (not just the immediate) could create an invalid instruction, triggering a HardFault or UsageFault. (c) Patching inside a multi-byte instruction could split it into two unintended instructions, corrupting the entire subsequent instruction stream. The program would likely crash, output garbage, or hang—requiring reflashing with the original UF2 to recover. - -4. **How can you verify a patch was applied correctly before exporting?** - Multiple verification methods: (a) Check the **Decompile window**—it should reflect the new value (e.g., `printf("age: %d\r\n", 0x46)`). (b) Inspect the **Listing window** bytes—confirm the instruction bytes changed from `21 2b` to `21 46`. (c) Use **right-click → Highlight → Highlight Difference** to see patched bytes highlighted. (d) Compare the patched instruction against the ARM Thumb encoding reference to verify the encoding is valid. (e) Check surrounding instructions are unchanged—patches should not accidentally modify adjacent code. diff --git a/WEEK04/WEEK04-02.md b/WEEK04/WEEK04-02.md deleted file mode 100644 index a820d55..0000000 --- a/WEEK04/WEEK04-02.md +++ /dev/null @@ -1,220 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 2: Patch Binary to Change Variable Value - -#### Objective -Use Ghidra's patching capabilities to modify the compiled binary, changing the value printed by the program from 43 to a different value of your choice, then convert and flash the modified binary to the Pico 2. - -#### Prerequisites -- Completed Exercise 1 (binary imported and analyzed in Ghidra) -- Python installed for UF2 conversion -- `uf2conv.py` script available in your project directory -- Raspberry Pi Pico 2 connected via USB -- Serial monitor software (PuTTY, minicom, or screen) - -#### Task Description -You will locate the instruction that loads the value 43 into a register, patch it to use a different value (70 in this example), export the modified binary, convert it to UF2 format, and flash it to verify the change. - -#### Step-by-Step Instructions - -##### Step 1: Open Your Ghidra Project - -If you closed Ghidra from Exercise 1: -1. Launch `ghidraRun` -2. Open the project: `week04-ex01-intro-to-variables` -3. Double-click the binary file to open it - -##### Step 2: Navigate to the Value Load Instruction - -In Exercise 1, we found that `main()` calls `printf("age: %d\r\n", 0x2b)`. - -**Find the assembly instruction:** -1. Click on the `main` function in the Symbol Tree -2. Look at the **Listing** window (assembly view) -3. Find the line with `movs r1, #0x2b` - -The instruction should look like: -```assembly -10000xxx 21 2b movs r1, #0x2b -``` - -**What this instruction means:** -- Opcode: `21 2b` (encoded instruction bytes) -- Mnemonic: `movs r1, #0x2b` -- Operation: Move the immediate value 0x2b into register r1 -- Register r1 will be used as the argument to printf - -##### Step 3: Choose Your New Value - -Let's change the value from `43` (0x2b) to `70` (0x46). - -**Convert 70 to hexadecimal:** -- 70 ÷ 16 = 4 remainder 6 -- Therefore: 70 decimal = 0x46 hexadecimal - -You can verify this in Python: -```python ->>> hex(70) -'0x46' ->>> 0x46 -70 -``` - -##### Step 4: Patch the Instruction - -Now we'll modify the binary: - -1. **Right-click** on the instruction `movs r1, #0x2b` -2. Select **Patch Instruction** -3. A dialog appears showing the current instruction -4. Change `#0x2b` to `#0x46` -5. Press **Enter** or click **OK** - -The instruction now reads: -```assembly -10000xxx 21 46 movs r1, #0x46 -``` - -**Visual confirmation:** -- The patched instruction should be highlighted (usually in red or orange) -- The bytes should change from `21 2b` to `21 46` -- The decompiled view should update to show `printf("age: %d\r\n", 0x46);` - -##### Step 5: Verify the Patch in Decompile Window - -Click on the `main` function again and check the **Decompile** window: - -```c -int main(void) -{ - stdio_init_all(); - do { - printf("age: %d\r\n", 0x46); // Changed from 0x2b! - } while (true); -} -``` - -Perfect! The decompiler recognized our patch. - -##### Step 6: Export the Patched Binary - -Now we need to save the modified binary: - -1. Click **File** → **Export Program** -2. Set **Format** to: **Binary** -3. Navigate to your build directory: - - `Embedded-Hacking\0x0005_intro-to-variables\build\` -4. Set **Filename** to: `0x0005_intro-to-variables-h.bin` - - The `-h` suffix means "hacked" -5. Click **OK** - -**Important:** Make sure you're exporting to the correct location! - -##### Step 7: Convert to UF2 Format - -The Pico 2 requires UF2 format. Open a terminal and run: - -**Navigate to the project directory:** -```powershell -cd C:\path\to\Embedded-Hacking\0x0005_intro-to-variables -``` - -**Run the conversion:** -```powershell -python ..\uf2conv.py build\0x0005_intro-to-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -**Command breakdown:** -- `uf2conv.py` - The conversion script -- `--base 0x10000000` - XIP flash base address (where code runs from) -- `--family 0xe48bff59` - RP2350 family ID -- `--output build\hacked.uf2` - Output filename - -**Expected output:** -``` -Converting to uf2, output size: 57856, start address: 0x10000000 -Wrote 57856 bytes to build\hacked.uf2 -``` - -##### Step 8: Flash the Hacked Binary - -**Enter bootloader mode:** -1. Disconnect your Pico 2 from USB -2. Hold down the **BOOTSEL** button -3. While holding BOOTSEL, plug in the USB cable -4. Release BOOTSEL -5. A drive called **RPI-RP2** appears - -**Flash the binary:** -1. Open the RPI-RP2 drive -2. Drag and drop `build\hacked.uf2` onto the drive -3. The Pico will automatically reboot - -##### Step 9: Verify the Changes - -**Open your serial monitor:** - -For PuTTY: -1. Select **Serial** connection type -2. Set the COM port (check Device Manager) -3. Set speed to **115200** -4. Click **Open** - -For PowerShell: -```powershell -# Find the COM port -Get-PnpDevice -Class Ports | Where-Object {$_.FriendlyName -like "*USB Serial*"} - -# Connect (replace COM3 with your port) -$port = new-Object System.IO.Ports.SerialPort COM3,115200,None,8,one -$port.Open() -while($true) { $port.ReadLine() } -``` - -**Expected output:** -``` -age: 70 -age: 70 -age: 70 -age: 70 -... -``` - -🎉 **Success!** You've successfully patched a binary and changed its behavior! - -#### Expected Output - -After completing this exercise, you should: -- See `age: 70` printing instead of `age: 43` -- Have a patched binary file (`0x0005_intro-to-variables-h.bin`) -- Have a UF2 file (`hacked.uf2`) -- Understand the complete patching workflow - -#### Questions for Reflection - -###### Question 1: Why do we need to convert to UF2 format instead of flashing the raw .bin file? - -###### Question 2: What is the significance of the base address 0x10000000 in the conversion command? - -###### Question 3: What would happen if you patched the wrong instruction by mistake? - -###### Question 4: How can you verify a patch was applied correctly before exporting? - -#### Tips and Hints -- Always make a backup of the original binary before patching -- Use descriptive names like `-h` (hacked) or `-patch` for modified binaries -- Test your patches on hardware to ensure they work as expected -- If something goes wrong, you can always flash the original UF2 file -- Use `File → Export Program → Original File` to revert all patches - -#### Next Steps -- Try patching to different values (100, 255, etc.) -- Proceed to Exercise 3 to learn about GPIO control -- Experiment with patching multiple values in the same binary - -#### Additional Challenge -Instead of changing the value to 70, change it to 255 (0xFF) - the maximum value for a `uint8_t`. What do you observe? Now try changing it to 256 (0x100). What happens and why? (Hint: Think about the size limits of the instruction encoding.) diff --git a/WEEK04/WEEK04-03-S.md b/WEEK04/WEEK04-03-S.md deleted file mode 100644 index 1315c78..0000000 --- a/WEEK04/WEEK04-03-S.md +++ /dev/null @@ -1,97 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 3 Solution: Analyze and Understand GPIO Control - -#### Answers - -##### Main Function Decompiled (After Renaming) - -```c -int main(void) -{ - stdio_init_all(); - gpio_init(0x10); // Initialize GPIO 16 - gpio_set_dir(0x10, 1); // Set as output (GPIO_OUT = 1) - - while (true) { - printf("age: %d\r\n", 0); // Uninitialized variable = 0 - gpio_put(0x10, 1); // LED ON - sleep_ms(0x1f4); // Wait 500ms - gpio_put(0x10, 0); // LED OFF - sleep_ms(0x1f4); // Wait 500ms - } -} -``` - -##### GPIO Function Identification Table - -| Auto-Generated Name | Actual Function | Parameters | Identification Method | -|---------------------|-----------------|--------------------------------|--------------------------------------| -| FUN_100030cc | stdio_init_all | (void) | Called first, no parameters | -| FUN_xxxxxxxx | gpio_init | (uint gpio) | Single parameter = pin number (0x10) | -| FUN_xxxxxxxx | gpio_set_dir | (uint gpio, bool out) | Two params: pin + direction (1=out) | -| FUN_xxxxxxxx | gpio_put | (uint gpio, bool value) | Two params: pin + value (0 or 1) | -| FUN_xxxxxxxx | sleep_ms | (uint32_t ms) | Single param = delay (0x1f4 = 500) | -| FUN_10003100 | printf | (const char *fmt, ...) | Format string + varargs | - -##### Key Value Conversions - -| Hex | Decimal | Binary | Purpose | -|--------|---------|-------------|------------------------| -| 0x10 | 16 | 0000 1000 | GPIO pin number (red LED) | -| 0x1f4 | 500 | — | Sleep duration (ms) | -| 0x01 | 1 | 0000 0001 | GPIO_OUT / LED ON | -| 0x00 | 0 | 0000 0000 | GPIO_IN / LED OFF | - -``` -0x10 = (1 × 16) + 0 = 16 -0x1f4 = (1 × 256) + (15 × 16) + 4 = 256 + 240 + 4 = 500 -``` - -##### GPIO Memory Map - -| Address | Register | Purpose | -|-------------|-------------|------------------------------| -| 0x40028000 | IO_BANK0 | GPIO function selection | -| 0x40038000 | PADS_BANK0 | GPIO pad configuration | -| 0xd0000000 | SIO | Single-cycle I/O | - -GPIO 16 specific: -- Pad control: `0x40038000 + (16 × 4) = 0x40038040` -- Function select: `0x40028000 + (16 × 4) = 0x40028040` - -##### gpio_put Coprocessor Instruction - -```assembly -mcrr p0, #4, r4, r5, c0 -``` - -- `mcrr` = Move to Coprocessor from two ARM Registers -- `p0` = Coprocessor 0 (GPIO coprocessor on RP2350) -- `r4` = GPIO pin number, `r5` = value (0 or 1) -- Single-cycle GPIO operation - -##### Blink Timing Analysis - -- ON duration: `sleep_ms(0x1f4)` = 500ms -- OFF duration: `sleep_ms(0x1f4)` = 500ms -- Total cycle: 1000ms = 1 second -- Blink rate: **1 Hz** - -#### Reflection Answers - -1. **Why does gpio_init() need to configure both PADS_BANK0 and IO_BANK0 registers?** - These registers control different aspects of GPIO operation. **PADS_BANK0** (`0x40038000`) configures the physical pad properties: input enable (IE), output disable (OD), pull-up/pull-down resistors, drive strength, and slew rate. **IO_BANK0** (`0x40028000`) configures the function multiplexer (FUNCSEL), selecting which internal peripheral drives the pin—SIO (function 5) for software control, UART, SPI, I2C, PWM, etc. Both must be configured: PADS sets the electrical characteristics of the physical pin, while IO_BANK0 routes the correct internal signal to it. - -2. **What is the advantage of using the GPIO coprocessor instruction (`mcrr`) instead of writing to memory-mapped registers?** - The `mcrr` coprocessor instruction completes in a **single CPU cycle**, whereas writing to memory-mapped GPIO registers requires multiple cycles: an address load, a data load, and a store instruction (plus potential bus wait states). On the RP2350, the SIO coprocessor provides deterministic, single-cycle access to GPIO outputs, which is critical for bit-banging protocols (like SPI or custom serial) where precise timing is required. The coprocessor path bypasses the AHB/APB bus entirely. - -3. **If you wanted to blink the LED at 10 Hz instead of 1 Hz, what value should `sleep_ms()` use?** - At 10 Hz, each full on/off cycle is 100ms. Since the loop has two `sleep_ms()` calls (one for ON, one for OFF), each should be `100 / 2 = 50ms`. In hex: `50 = 0x32`. So both `sleep_ms()` calls should use `sleep_ms(0x32)`. - -4. **What would happen if you called `gpio_put()` on a pin that hasn't been initialized with `gpio_init()` first?** - The GPIO pin's function would still be set to its reset default (typically NULL/function 0), not SIO (function 5). The `gpio_put()` coprocessor instruction would update the SIO output register internally, but since the pin's function multiplexer isn't routing SIO to the physical pad, the electrical state of the pin wouldn't change. The LED would remain off. Additionally, without pad configuration, input enable and output disable bits may not be set correctly, further preventing any observable output. diff --git a/WEEK04/WEEK04-03.md b/WEEK04/WEEK04-03.md deleted file mode 100644 index 3ec9408..0000000 --- a/WEEK04/WEEK04-03.md +++ /dev/null @@ -1,270 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 3: Analyze and Understand GPIO Control - -#### Objective -Import the `0x0008_uninitialized-variables.bin` binary, analyze the GPIO initialization and control sequences, understand how `gpio_init()`, `gpio_set_dir()`, and `gpio_put()` work at the assembly level. - -#### Prerequisites -- Completed Exercises 1 and 2 -- Understanding of GPIO basics from Week 4 Part 3 -- Raspberry Pi Pico 2 with an LED connected to GPIO 16 -- Basic knowledge of ARM Thumb-2 instruction set - -#### Task Description -You will import a new binary that controls GPIO pins, identify the GPIO-related function calls, trace the initialization sequence, and understand how the Pico SDK controls hardware at the low level. - -#### Step-by-Step Instructions - -##### Step 1: Flash the Original Binary - -Before analysis, let's see what the program does: - -1. Hold **BOOTSEL** and plug in your Pico 2 -2. Flash `0x0008_uninitialized-variables.uf2` to the RPI-RP2 drive -3. Open your serial monitor - -**Expected output:** -``` -age: 0 -age: 0 -age: 0 -... -``` - -**Expected behavior:** -- The red LED on GPIO 16 blinks on/off every 500ms -- The value `0` is printed (uninitialized variable) - -##### Step 2: Create a New Ghidra Project - -1. Launch Ghidra: `ghidraRun` -2. Click **File** → **New Project** -3. Select **Non-Shared Project** -4. Project Name: `week04-ex03-gpio-analysis` -5. Click **Finish** - -##### Step 3: Import the GPIO Binary - -1. Drag and drop `0x0008_uninitialized-variables.bin` into Ghidra -2. Set Language: **ARM Cortex 32 little endian default** -3. Click **Options…** - - Block Name: `.text` - - Base Address: `10000000` -4. Click **OK** on all dialogs -5. Double-click the file and click **Yes** to analyze - -##### Step 4: Identify the Main Function - -Look for the main function (likely `FUN_10000234` or similar): - -**In the Symbol Tree:** -1. Expand **Functions** -2. Look for a function that appears to be an entry point -3. Click on potential `main` candidates - -**Look for these patterns in the decompile:** -- Call to `stdio_init_all()` -- Call to `gpio_init()` -- Infinite while loop with `gpio_put()` and `sleep_ms()` - -##### Step 5: Rename the Main Function - -Once you identify `main`: - -1. Right-click on the function name -2. Select **Edit Function Signature** -3. Change to: `int main(void)` -4. Click **OK** - -**Expected decompiled code structure:** -```c -int main(void) -{ - // Some initial value - stdio_init_all(); - gpio_init(0x10); // GPIO 16 - // ... more GPIO setup - - while (true) { - printf(...); - gpio_put(0x10, 1); - sleep_ms(0x1f4); - gpio_put(0x10, 0); - sleep_ms(0x1f4); - } -} -``` - -##### Step 6: Identify GPIO Function Calls - -Look in the decompiled main for function calls. You should see several undefined functions. - -**Find and rename these GPIO functions:** - -| Auto-Generated Name | Actual Function | How to Identify | -| ------------------- | ----------------- | ------------------------------------------ | -| `FUN_xxxxx` | `gpio_init` | Takes one parameter (pin number) | -| `FUN_xxxxx` | `gpio_set_dir` | Takes two parameters (pin, direction) | -| `FUN_xxxxx` | `gpio_put` | Takes two parameters (pin, value) | -| `FUN_xxxxx` | `sleep_ms` | Takes one parameter (milliseconds) | -| `FUN_xxxxx` | `stdio_init_all` | Takes no parameters, called first | -| `FUN_xxxxx` | `printf` | Takes variable args, has format string | - -**Example renaming gpio_init:** -1. Click on the function call in the decompile window -2. Right-click → **Edit Function Signature** -3. Change name to: `gpio_init` -4. Set signature to: `void gpio_init(uint gpio)` -5. Click **OK** - -##### Step 7: Analyze GPIO Initialization Sequence - -After renaming, your decompiled main should look clearer: - -```c -int main(void) -{ - stdio_init_all(); - - gpio_init(0x10); // Initialize GPIO 16 - gpio_set_dir(0x10, 1); // Set as output (1 = GPIO_OUT) - - while (true) { - printf("age: %d\r\n", 0); - gpio_put(0x10, 1); // LED ON - sleep_ms(0x1f4); // Wait 500ms (0x1f4 = 500) - gpio_put(0x10, 0); // LED OFF - sleep_ms(0x1f4); // Wait 500ms - } -} -``` - -**Key observations:** -- `0x10` is hexadecimal for 16 (GPIO 16 - red LED) -- `0x1f4` is hexadecimal for 500 (milliseconds) -- `1` means GPIO_OUT (output direction) -- The LED is controlled by toggling between 1 (on) and 0 (off) - -##### Step 8: Examine gpio_init Assembly - -Double-click on `gpio_init` to jump to its implementation. - -**Look for these key operations in the assembly:** - -```assembly -; Load GPIO pin number into register -movs r4, r0 ; Save pin number - -; Calculate pad register address -; Base address: 0x40038000 (PADS_BANK0) -; Offset: pin * 4 -ldr r3, =0x40038000 -lsls r5, r4, #2 ; pin * 4 -add r3, r5 ; Calculate address - -; Configure pad (clear OD bit, set IE bit) -ldr r2, [r3] ; Read current config -bic r2, #0x80 ; Clear output disable -orr r2, #0x40 ; Set input enable -str r2, [r3] ; Write back - -; Set GPIO function to SIO (0x05) -ldr r3, =0x40028000 ; IO_BANK0 base -add r3, r5 ; Add offset -movs r2, #5 ; FUNCSEL = SIO -str r2, [r3] ; Set function -``` - -**What this does:** -1. Configures the GPIO pad registers (physical pin properties) -2. Sets the GPIO function to SIO (Software I/O) -3. Prepares the pin for software control - -##### Step 9: Examine gpio_put Assembly - -Find the `gpio_put` function and examine its implementation. - -**Look for the GPIO coprocessor instruction:** - -```assembly -gpio_put: - movs r4, r0 ; GPIO pin number - movs r5, r1 ; Value (0 or 1) - - ; Use ARM coprocessor to control GPIO - mcrr p0, #4, r4, r5, c0 - - bx lr ; Return -``` - -**Critical instruction: `mcrr p0, #4, r4, r5, c0`** -- `mcrr` = Move to Coprocessor from two ARM Registers -- `p0` = Coprocessor 0 (GPIO coprocessor in RP2350) -- `#4` = Operation code -- `r4, r5` = Source registers (pin number, value) -- `c0` = Coprocessor register (GPIO output control) - -This is a **single-cycle GPIO operation** - extremely fast! - -##### Step 10: Document the GPIO Memory Map - -Create a reference table of the addresses you found: - -| Address | Register | Purpose | -| ------------ | ------------- | ------------------------------- | -| `0x40028000` | IO_BANK0 | GPIO function selection | -| `0x40038000` | PADS_BANK0 | GPIO pad configuration | -| `0xd0000000` | SIO | Single-cycle I/O (coprocessor) | - -**GPIO 16 specific addresses:** -- Pad control: `0x40038000 + (16 * 4) = 0x40038040` -- Function select: `0x40028000 + (16 * 4) = 0x40028040` - -##### Step 11: Trace the Blink Timing - -Calculate the actual timing: - -**sleep_ms(0x1f4):** -- Convert: 0x1f4 = (1 × 256) + (15 × 16) + 4 = 256 + 240 + 4 = 500 decimal -- So the LED is on for 500ms, off for 500ms -- Total cycle time: 1000ms = 1 second -- Blink rate: 1 Hz - -#### Expected Output - -After completing this exercise, you should understand: -- How GPIO initialization configures hardware registers -- The role of the GPIO coprocessor in the RP2350 -- How `gpio_put()` uses a single ARM instruction for fast I/O -- The memory-mapped addresses for GPIO control -- How timing delays are implemented with `sleep_ms()` - -#### Questions for Reflection - -###### Question 1: Why does gpio_init() need to configure both PADS_BANK0 and IO_BANK0 registers? - -###### Question 2: What is the advantage of using the GPIO coprocessor instruction (`mcrr`) instead of writing to memory-mapped registers? - -###### Question 3: If you wanted to blink the LED at 10 Hz instead of 1 Hz, what value should `sleep_ms()` use? - -###### Question 4: What would happen if you called `gpio_put()` on a pin that hasn't been initialized with `gpio_init()` first? - -#### Tips and Hints -- Use Ghidra's **References** feature (right-click → Find References) to see where functions are called -- The **Display** → **Memory Map** shows all memory regions -- Look for bit manipulation instructions (`bic`, `orr`) to understand register configuration -- The ARM Architecture Reference Manual has complete documentation on coprocessor instructions -- Use hex-to-decimal converters online if you're unsure about conversions - -#### Next Steps -- Proceed to Exercise 4 to patch the GPIO binary -- Try to identify other SDK functions like `gpio_get()` if they appear -- Explore the full GPIO initialization in the SDK source code - -#### Additional Challenge -Find the `gpio_set_dir()` function in Ghidra. Does it also use a GPIO coprocessor instruction? What coprocessor register does it use (c0, c4, or something else)? Compare its implementation to `gpio_put()` and document the differences. diff --git a/WEEK04/WEEK04-04-S.md b/WEEK04/WEEK04-04-S.md deleted file mode 100644 index 818e3bd..0000000 --- a/WEEK04/WEEK04-04-S.md +++ /dev/null @@ -1,102 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 4 Solution: Patch GPIO Binary to Change LED Pin - -#### Answers - -##### Patch Summary - -| Item | Original | Patched | Hex Change | -|---------------|-----------------|-----------------|---------------| -| LED pin | GPIO 16 | GPIO 17 | 0x10 → 0x11 | -| Printed value | 0 (uninitialized)| 66 | 0x00 → 0x42 | -| Blink timing | 500ms | 100ms | 0x1f4 → 0x64 | - -##### Detailed Patch Locations - -**1. gpio_init parameter:** -```assembly -; Before: movs r0, #0x10 (bytes: 10 20) -; After: movs r0, #0x11 (bytes: 11 20) -``` - -**2. gpio_set_dir parameter:** -```assembly -; Before: movs r3, #0x10 (bytes: 10 23) -; After: movs r3, #0x11 (bytes: 11 23) -``` - -**3. gpio_put (LED ON) parameter:** -```assembly -; Before: movs r4, #0x10 (bytes: 10 24) -; After: movs r4, #0x11 (bytes: 11 24) -``` - -**4. gpio_put (LED OFF) parameter:** -```assembly -; Before: movs r4, #0x10 (bytes: 10 24) -; After: movs r4, #0x11 (bytes: 11 24) -``` - -**5. printf value:** -```assembly -; Before: movs r1, #0x00 (bytes: 00 21) -; After: movs r1, #0x42 (bytes: 42 21) -``` - -**6. sleep_ms (both calls):** -```assembly -; Before: loads 0x1f4 (500ms) -; After: movs r0, #0x64 (100ms) -``` - -##### Hex Conversions - -``` -GPIO 17: 17 = 0x11 = 0001 0001 binary -Value 66: 66 = 0x42 = 0100 0010 binary -100ms: 100 = 0x64 = 0110 0100 binary -``` - -##### Decompiled Result After All Patches - -```c -int main(void) -{ - stdio_init_all(); - gpio_init(0x11); // GPIO 17 (green LED) - gpio_set_dir(0x11, 1); // Output - - while (true) { - printf("age: %d\r\n", 0x42); // Prints 66 - gpio_put(0x11, 1); // Green LED ON - sleep_ms(0x64); // 100ms - gpio_put(0x11, 0); // Green LED OFF - sleep_ms(0x64); // 100ms - } -} -``` - -##### Hardware Verification - -- GREEN LED (GPIO 17) blinks at 10 Hz (100ms on, 100ms off) -- RED LED (GPIO 16) remains off -- Serial output: `age: 66` repeating - -#### Reflection Answers - -1. **Why did we need to patch GPIO 16 in multiple places (gpio_init, gpio_set_dir, gpio_put)?** - Each function takes the GPIO pin number as a separate parameter. `gpio_init(16)` configures the pad and function mux for pin 16. `gpio_set_dir(16, 1)` sets pin 16's direction to output. `gpio_put(16, value)` toggles pin 16's output state. These are independent function calls with independent immediate values in the instruction stream—the compiler doesn't share or reuse a single "pin number variable." Each `movs rN, #0x10` loads the pin number fresh for its respective function call. Missing any one patch would result in a mismatch: e.g., initializing pin 17 but toggling pin 16. - -2. **What would happen if you forgot to patch one of the gpio_put calls?** - You would get asymmetric behavior. For example, if you patched the "LED ON" `gpio_put` to pin 17 but left the "LED OFF" at pin 16: GPIO 17 (green) would turn on but never turn off (staying permanently lit), while GPIO 16 (red) would receive the "off" command for a pin that was never initialized—which would have no visible effect. The result: green LED stuck on, no blinking. - -3. **How does the instruction encoding differ for immediate values less than 256 vs. greater than 255?** - In 16-bit Thumb encoding, `movs Rd, #imm8` can only encode immediate values 0–255 in a single 2-byte instruction. For values > 255 (like 500 = 0x1f4), the compiler must use either: (a) a 32-bit Thumb-2 `movw Rd, #imm16` instruction (4 bytes, can encode 0–65535), (b) a multi-instruction sequence that constructs the value (e.g., `movs` + `lsls` + `add`), or (c) an `ldr Rd, [pc, #offset]` that loads the constant from a literal pool in flash. This is why patching `sleep_ms(500)` may be more complex than patching `gpio_put(16, 1)`. - -4. **If you wanted to make the LED blink at exactly 5 Hz, what sleep_ms value would you use?** - At 5 Hz, each complete cycle is `1000 / 5 = 200ms`. With two `sleep_ms()` calls per cycle (ON and OFF), each call should be `200 / 2 = 100ms`. In hex: `100 = 0x64`. So `sleep_ms(0x64)` for each call—which is exactly the value used in this exercise's patch. For a different duty cycle (e.g., 150ms on, 50ms off), you'd use different values for each call while keeping the total at 200ms. diff --git a/WEEK04/WEEK04-04.md b/WEEK04/WEEK04-04.md deleted file mode 100644 index 296c680..0000000 --- a/WEEK04/WEEK04-04.md +++ /dev/null @@ -1,345 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 4 -Variables in Embedded Systems: Debugging and Hacking Variables w/ GPIO Output Basics - -### Non-Credit Practice Exercise 4: Patch GPIO Binary to Change LED Pin - -#### Objective -Patch the `0x0008_uninitialized-variables.bin` binary to change which LED blinks, modify the printed value, and change the blink timing, then verify all changes work correctly on hardware. - -#### Prerequisites -- Completed Exercise 3 (GPIO binary analyzed in Ghidra) -- Understanding of how GPIO pin numbers are encoded -- Knowledge of hexadecimal-to-decimal conversion -- Pico 2 with ability to test multiple GPIO pins - -#### Task Description -You will locate all instances where GPIO 16 is used, patch them to GPIO 17 (changing from red LED to green LED), modify the printed value from 0 to 66, and adjust the blink timing from 500ms to 100ms for faster blinking. - -#### Step-by-Step Instructions - -##### Step 1: Plan Your Patches - -Before we start patching, let's identify what needs to change: - -| Current Value | New Value | Description | Hex Conversion | -| ------------- | --------- | --------------------- | ------------------- | -| GPIO 16 | GPIO 17 | Change LED pin | 0x10 → 0x11 | -| age = 0 | age = 66 | Change printed value | 0x00 → 0x42 | -| 500ms | 100ms | Change blink timing | 0x1f4 → 0x64 | - -**Verify the hex conversions:** -- 17 decimal = 0x11 hex ✓ -- 66 decimal = 0x42 hex ✓ -- 100 decimal = 0x64 hex ✓ - -##### Step 2: Open the GPIO Project in Ghidra - -1. Launch Ghidra and open `week04-ex03-gpio-analysis` -2. Double-click the binary to open the CodeBrowser -3. Navigate to the `main` function - -**Review the decompiled code:** -```c -int main(void) -{ - stdio_init_all(); - gpio_init(0x10); - gpio_set_dir(0x10, 1); - - while (true) { - printf("age: %d\r\n", 0); - gpio_put(0x10, 1); - sleep_ms(0x1f4); - gpio_put(0x10, 0); - sleep_ms(0x1f4); - } -} -``` - -##### Step 3: Find and Patch gpio_init Parameter - -Look at the **Listing** window (assembly view) for the main function. - -**Find the gpio_init call:** -```assembly -1000023a 10 20 movs r0, #0x10 -1000023c xx xx bl gpio_init -``` - -**Patch instruction:** -1. Right-click on `movs r0, #0x10` -2. Select **Patch Instruction** -3. Change `#0x10` to `#0x11` -4. Press **Enter** - -**Result:** -```assembly -1000023a 11 20 movs r0, #0x11 -``` - -The instruction bytes change from `10 20` to `11 20`. - -##### Step 4: Find and Patch gpio_set_dir Parameter - -Continue down the assembly listing: - -```assembly -10000240 10 23 movs r3, #0x10 -10000242 01 22 movs r2, #1 -10000244 xx xx bl gpio_set_dir -``` - -**Patch the r3 load:** -1. Right-click on `movs r3, #0x10` -2. Select **Patch Instruction** -3. Change to `#0x11` -4. Press **Enter** - -**Why r3 instead of r0?** The SDK might pass GPIO pin as the first parameter differently, or this could be due to register allocation. Trust the analysis! - -##### Step 5: Find All gpio_put Calls - -Inside the while loop, there are two `gpio_put` calls: - -**First gpio_put (LED ON):** -```assembly -10000252 10 24 movs r4, #0x10 -10000254 01 25 movs r5, #1 -10000256 xx xx bl gpio_put -``` - -**Patch:** -1. Right-click on `movs r4, #0x10` -2. Change to `#0x11` - -**Second gpio_put (LED OFF):** -```assembly -1000025e 10 24 movs r4, #0x10 -10000260 00 25 movs r5, #0 -10000262 xx xx bl gpio_put -``` - -**Patch:** -1. Right-click on `movs r4, #0x10` -2. Change to `#0x11` - -**Note:** The exact addresses will vary, but the pattern is consistent. - -##### Step 6: Patch the Printed Value - -Find the printf call in the loop: - -```assembly -1000024a 00 21 movs r1, #0x0 -1000024c xx xx ldr r0, [pc, #offset] -1000024e xx xx bl printf -``` - -**Patch the value:** -1. Right-click on `movs r1, #0x0` -2. Select **Patch Instruction** -3. Change to `#0x42` (66 in decimal) -4. Press **Enter** - -**Result:** -```assembly -1000024a 42 21 movs r1, #0x42 -``` - -##### Step 7: Patch the Sleep Timing (First) - -Find the first `sleep_ms(0x1f4)` call: - -```assembly -10000258 f4 21 movs r1, #0xf4 -1000025a 01 20 movs r0, #1 -1000025c 00 04 lsls r0, r0, #16 -1000025e 08 44 add r0, r1 -10000260 xx xx bl sleep_ms -``` - -**Wait, this looks complex!** The value 0x1f4 (500) is being constructed: -- Load 1 into r0 -- Shift left 16 bits: 1 << 16 = 0x10000 -- Load 0xf4 into r1 -- Add them: 0x10000 + 0xf4 = 0x1f4 - -**Alternative pattern (simpler):** -```assembly -10000xxx f4 20 movs r0, #0xf4 -10000xxx 01 20 movs r1, #0x01 -10000xxx ... -``` - -**For 100ms (0x64):** -Simply find where 0x1f4 is loaded and change it to 0x64. - -**If the instruction is:** -```assembly -movs r0, #0x1f4 -``` - -**Change to:** -```assembly -movs r0, #0x64 -``` - -**Note:** The exact encoding depends on the instruction. For immediate values > 255, Thumb-2 uses different encodings. - -##### Step 8: Handle Large Immediate Values - -If `sleep_ms(500)` uses a multi-instruction sequence to load 0x1f4, you have two options: - -**Option A: Patch both instructions** -If it's loading 0x1f4 as (0x100 + 0xf4): -1. Find where 0xf4 is loaded -2. Change it to 0x64 -3. Find where 0x1 is loaded for the high byte -4. Change it to 0x0 - -**Option B: Simplify to single instruction** -Since 0x64 (100) fits in an 8-bit immediate, you can replace the multi-instruction sequence with: -```assembly -movs r0, #0x64 -nop -nop -``` - -##### Step 9: Verify All Patches - -Check the **Decompile** window to confirm changes: - -```c -int main(void) -{ - stdio_init_all(); - gpio_init(0x11); // Changed from 0x10! - gpio_set_dir(0x11, 1); - - while (true) { - printf("age: %d\r\n", 0x42); // Changed from 0! - gpio_put(0x11, 1); // Changed from 0x10! - sleep_ms(0x64); // Changed from 0x1f4! - gpio_put(0x11, 0); // Changed from 0x10! - sleep_ms(0x64); // Changed from 0x1f4! - } -} -``` - -Perfect! All changes are reflected. - -##### Step 10: Export the Patched Binary - -1. Click **File** → **Export Program** -2. Set Format: **Binary** -3. Navigate to: `Embedded-Hacking\0x0008_uninitialized-variables\build\` -4. Filename: `0x0008_uninitialized-variables-h.bin` -5. Click **OK** - -##### Step 11: Convert to UF2 - -Open PowerShell and navigate to the project: - -```powershell -cd C:\path\to\Embedded-Hacking\0x0008_uninitialized-variables -``` - -**Run conversion:** -```powershell -python ..\uf2conv.py build\0x0008_uninitialized-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -**Expected output:** -``` -Converting to uf2, output size: 61952, start address: 0x10000000 -Wrote 61952 bytes to build\hacked.uf2 -``` - -##### Step 12: Flash and Test - -**Enter bootloader:** -1. Hold **BOOTSEL** button -2. Plug in USB -3. Release BOOTSEL - -**Flash:** -1. Drag `build\hacked.uf2` to RPI-RP2 drive -2. Pico reboots automatically - -**Test with serial monitor:** -``` -age: 66 -age: 66 -age: 66 -... -``` - -**Hardware verification:** -- ✅ GREEN LED (GPIO 17) should be blinking -- ✅ RED LED (GPIO 16) should be off -- ✅ Blink rate should be much faster (10 Hz instead of 1 Hz) -- ✅ Serial output shows 66 instead of 0 - -🎉 **Triple success!** You've patched three different aspects of the program! - -#### Expected Output - -After completing this exercise, you should: -- See `age: 66` printing continuously -- Observe the green LED (GPIO 17) blinking rapidly -- Understand how to find and patch all instances of a value -- Know how to handle different immediate value encoding schemes - -#### Questions for Reflection - -###### Question 1: Why did we need to patch GPIO 16 in multiple places (gpio_init, gpio_set_dir, gpio_put)? - -###### Question 2: What would happen if you forgot to patch one of the gpio_put calls? - -###### Question 3: How does the instruction encoding differ for immediate values less than 256 vs. greater than 255? - -###### Question 4: If you wanted to make the LED blink at exactly 5 Hz, what sleep_ms value would you use? - -#### Tips and Hints -- Use Ghidra's **Search** → **For Scalars** to find all instances of a hex value -- Right-click in Listing → **Highlight** → **Highlight Instruction** helps track your patches -- Make notes of addresses you've patched to avoid confusion -- Test incrementally - patch one thing at a time if you're unsure -- Keep the original UF2 to revert if needed - -#### Next Steps -- Try patching to use GPIO 18 (blue LED) instead -- Change the printf format string to display in hexadecimal -- Experiment with different timing patterns (e.g., 200ms on, 800ms off) - -#### Additional Challenge - -**Advanced Multi-LED Pattern:** - -Patch the binary to create an alternating pattern: -- GPIO 16 (red) blinks for 100ms -- GPIO 17 (green) blinks for 100ms -- GPIO 18 (blue) blinks for 100ms -- Repeat - -This requires: -1. Adding new gpio_init and gpio_set_dir calls for GPIO 18 -2. Restructuring the while loop to have three gpio_put sequences -3. Finding space in the binary or replacing existing code - -**Hint:** You might need to NOP out some instructions and carefully insert new ones. This is advanced patching! - -#### Verification Checklist - -Before moving on, confirm: -- [ ] GPIO 17 LED blinks (not GPIO 16) -- [ ] Blink rate is approximately 10 Hz (100ms on/off) -- [ ] Serial output shows "age: 66" -- [ ] You can explain each patch you made -- [ ] You understand why each patch was necessary -- [ ] You successfully converted and flashed the UF2 - -**Congratulations!** You've completed all Week 4 exercises and mastered variable analysis, binary patching, and GPIO manipulation! diff --git a/WEEK04/WEEK04-SLIDES.pdf b/WEEK04/WEEK04-SLIDES.pdf index f1a6bdd1bbf57ca71b4b7eb708a49277f00d65a2..984625983fc239974c76665429fae0180971dd4f 100644 GIT binary patch delta 464199 zcmV)XK&`*;z#{*^BCu`*e>Ms}J_>Vma%Ev{3V59Cy?K1oMgBkjoSAphq)D20?yI?) zCTW|r=}ikQc|$33h=6jmK&1r{P!wwMzzfv%DkzA@x}w6a$9f^5fCf;(71y&XUU)C) z;<0Ge^@FUgw(pvtV_K+e~I`o;MjT}u#y7Ql}H#QBSsoq5w)YwrLmHvm)jEST4E#^JzUeg%*v z0BRR3nAef}D9s1Rf5`v}7o4;7qEFt;-wd!Nyv?G;b32Y~GMWLp6~GhcbX>GVB^Yx7 zq6ZK-x8t07(u*@51%v|t6PGORS~?KLRDi^J{gU(ME!ni&F$=Jd0dk)Kz@Py|A&4x4 zf%iol`xVAw4b-3zkw7cJ4&^=r0Tc|%F%ZHO5T*5r2LaR%fA;?d5PIbtd4}-AKed^u zP}KiZb!*?9IkSxo-)giPrQ)9OcTAbk6o7;PHVU5(T+W}6&X@QL%K)1rtmQoe8vvR; z)0*uGD+JsQf1m&XeP?%>_4yW)*G?w?y0#cXXim!IF=JUd$hS38D8tde;*U zp%*){=_f)jJ{Ed$Q0T?OLNA^Xda+OF#U7!Tn1x=v{?ola6?%z9=q3O1PC_qCLNBHZ zy;v^vf8uVT7cD|B*8lWuD}-L0&F}HE_Reg&K;S8mv0lCU|4CY}D&dWagMCA_WV#?8bos14FQ=WDy0$7B_ zid>kB0On#bmSCCk7MXhmj=n)Tst`crXlV%I%5!vJ5td*90vLl1oU2@8F3!%j9f!qO zp!E6}oR2e<-pjlf?~8@XyDa*b&vT~Ie;)yi#6rx$B8A$a^u~$rn7Pj4?3)IZyKr92 zRo-`yV;3rX;*|4oF3!mEY3Wg(jKvhCcNQw=ovZZkFy;JtN{e|o2XmC(K10Dk_K61D z1{8XiGETTGUV3!I4Za7jUy2Sa#3FQ|OloSGIz>tjZ)_Mgw7zagO?6deMR}sEe>5H| zDK3ge!iAxNV8HM5=6l>Or^9ZuTFfTVm}k)IaVw+T;U1=6Lv8B`zNS*n!mQtprbhITA0}W^>jR%@TfmH9P zP#{faOl}DUQa6kWwFXjsN`8Wpe_x~I4WmM>!C+}T5NLKT7!^p7_CRxL^aTsLo7+c~ z#>r+~Zd0gfUT$d|n{#zdp(b5v94SX=$!6jhPLvFFG!NZOp)r)kn^W%4sOFR_G>Sh# ziiMjy&PYv~+|oSC6AZSN##5weZfH&lp^+(LOlg89w~l zUX>Oxr#+@WBXmZ`td|7Y&#qREF z1E~#@TaK>{a%^pNmc~otDH+DW&FbFkC6ul*TVe(}kfWVjxWyHV0Ce z)RH0{twR&e(s(e)8N4zrVNPj0m|8KpB~uPyj;9AwBG#Is?Yw69V2y1muURozbM*A~ zP_Q(57-E91nln|lgr_AW?f6hIjZggmLdw2KfP+)X- zdv`}#UNI*W5JTPDS%gKpmo&Ezax^XPSm{ZPUe%fs+ZT|brSZ)aBR7Z0b(1$smpl0v1N%89%X;025)<4|Acaw7>8bJIemMjC7_U~XEIp{>ZYF3PsnU~XFEH9J5F zpj2iKE;X8_v>ZPklu4!t4B9j$MM9}dLKg)$gEpnk3oTPJ-KjueR!cA#OwG-2?d}eA z2f9OP5p$=tWH2Q}Qe-Aa<)3oF&9w;Sw|auDT*#+Zf6NKYYU!TUJtGth1ykPq*6s`` z$cuUTt;!WT((>*3pdS$Ld+-(FsK)|% z046NQe*n1*_YevSBkJ%v=3xzOU@_ry5R{N|_At2;rD(tu+y)0;AuTA8bJ2h;)Jq#c zF$FKN*_yaqE`LLI3opoX@H^5#_X&^UW%Q8(0RvabE9G_aoj+Nthnctk8M#6}2U9Q= z?KmHoVmVgeZuF8?+DLcF*TaMs%)@d#j+aPGe}K>qGfu@+{0g^YJD$QTcpD!RLX4z{ ztRSzGH&p1~Gq6V^l+@scnZL1(ZTY$JQC|1SdvWFJhJf(vjFF2QQ7 z!NYh9@8CVcXfB;Xr?QRkpb;}L2RGqn+>HnE0`?OPsU|~-M6Mx^&+Xnuoti5E&L4wgb^2sk*Q=Bxr|&*ZX~ym`^Y2YQSv!e(YG06R|tO; zJ|Ea8=gN1;55fZv@_(`*ixEd1PR2Rt#UWBeN=Td}$!j!5MH`l&OX1iy?8LJ; zh`-`nLWr99Nf8-C#*?Y!cJc_>PkyAJ8hSZ>gvzXutzj<+F5&ipQwGi%xP4%Ye_Sn3 z00DyvE>xo$L(zb#Xhj#U#7(#d58+{K!OPf(FNu@*NI4lxrjZuXP8N{GWC`gcmyk=z z)#O34mFy(@$a~~VDo{1G(HM=;uEE6tPLB-T|&C5SJemtjte@_1${m%@P4U8H%dtl|j(*yekK9Y6vF8O1qQH}<* zVm`WX8J6Q3+=%sf5D#G=KE$W^9Dl<%_?9rDC2ry)euZyMWGtCLrjhBSm7Gb=Bn!w{ zBCnD6$ybz68!e+{bQo=X2Gg&&}C42Fq|#I227%i9ip$%267qwf&89&$(>SdGIB-%uWfs&mVgL7cbS*H%F zgVYK!r=4Ge{)U#a=|Y6*f3ftZ`35?JUPIe)KY0Q_&@tpxaslh58|ZAdPFO1pCvRan zeOdrDkRup@5o9=dki3pgx{sE!O~Rk}6;&Gcqv{-LkgpX!RZ;dDAT$!nUL-R}ADKk$ z6s9ifzHJnv=t55OU$&4 zT#jm-gO#KkanetA<7IjiYRNqI)Q_(IB1(SjBb(V6Y$iVlF9!PE{Z3Ev5BUlwi zU7cRslxExpFTCBoNxDEH?Rr(NJ&w}(i`YgSG zF2uWdmp#WMe=-ek2-geCaT*FSnOLw8L(l*}R$-O=I%c349%3ZbSkA}2{JFeOexUyq z+>iUQ7Hicb@wvJQMVLsA2yUXmb}8s6+G1$l(a`%l^l^^ zyRn4r#wNBKudv+^Fq`eh@+^hH&vqlpb}Q7?O8o}5e-kOT6T8_?>}5L@$_}L14(w(- zu$S$CfFw(Uu*cbBJ%xTL&9-iF6;^&V!p*ioW?MknO>8BC@Uzpi>FjK}nyo|${A^7& zy@9Rl8Rj>R(6W^v_=>HB%vOTRyV;#RCrzx}u4INZD4BJGlyzH%G*tRWxY(UYu{*Jw z-HE;Ie@+PaironUKU;?sTZi3j9rm(y3Vj`ja;ac(_EOo*ojpc-mSVJ5j>u)LY#J)z zXD!)uI-Ay0>EAV?olOP7CIvSz9*JJwp2SA?jPjR{Si(kQHf!cK6XWzzNU%{zvQZEe%4#+W8`vo9S17aDC@g2A z@Cq9RrnDq%6dT2wSQ8t;M!?9VpN5Zw1e3s+#3YtvNj97fhmkdcutwGhi8Uzi*nk9U ze?XEoU?OY4Y}SC?tO0vj19DgcYe0b2pq$k}Vl|k=YS7MVpn{RbkzjGGW^phUXQe2F zp9SeESm9@ZZ0e^g;e(&~=*k|SUmBsMTQP}lMLXS!C3GuR(5*cxvvGu#t^{wJper$v zuEcD*63c(0t^bL(iLQhO$xMx;qe+@%e-r6MCP-;kyrrR`Qc0_7Gikmzlj_}-#u4YS zVk~FHSkH>VU}VKeuwo>Smi(+36q{HSyI2&juqgJksM6t4O#G=dn?iZGiMVfjz_O{@qi>}N&F5Q{4Hf0I}d zRTTe0SmGq3$Ot5 zGe7e&A6-M&(A9J`y^-EXZ=g5Oe^qo9T}f9;)=jZpF*>_uan16Y)ivvDHr4E^$=OLe zXa{Yl?NTo6b^vCR#yvu$0%pNL{-NMT1Fk6e}a_?7AWW? z(|ZiiK0#(8s3Gu^=+@vB{*Qxcf%N#V3Z^xr$A4v}G&7S7c!mu|3QW_;1ig8F;*myerw2@?dYWG}>pA$$OIW3eXxszw4 zRH2b1Wgd_5Q${*dLt^98Ir6Egy4d)XcGAq2&4k?8nyQPX=yhp=DJ^LtbJEow9!%Q~ zLgH87;K`<~t^Ayp%>udMhE~`wNIH||;imf0qkaL}vlu&eIAg~be^NtY-qda5Pisj% zSf)+z zxHdTl5LDU(a}NAde;eO_&?fwgZI0{Bc_U;0<{;ZKj_ljqbTJQHwuhSMwTGJ9Q!6i6 z;N*dWz;-l|ec701q`XSp^+(5Xe6A?3r96C9M#p8&HRV| zy7;m5^sdvDe^mL`wey?T`=2Dw=b+s;q!qu+x z!LPTJ!?DXB&7HrrtBZ6UKMc_I^Mj9#7&70k^U-xaiN(Mho}V2!T_i?gU8D>AA+uLe z*1s9yhl(*m34v4fg>E;#)5y?3Ee}8ot=x}X1$EHLfBn!yFZaU$z5FBcV32==Q9%)T z@{cgVDE|Pnf)g61{0*uRlfOX?V)EZmi@5wZ z3_+>h^hC4Y$#sFuIPNYuz* zqDjF~sFnNBj3II#Mx##d!%3)@`!ELe@)sD3f1&ah7>8l<7Z{IW^5-}i4f5xhpx`MO zE`N@RNXmyWNx{jGpg`2dz;mV5x`qfI`53lzK%r_1|s5!&VbScVRHKQ6``c|R_}T=~zq6lchP#$}i% z{~4EKp8Nrp<4pMjtiXKv16-ltl~^FZe~+sa{1wiU-^bNBTYewc;B5IlT#H5Wd$i@@;g|K^W=B123_(yxCveI+gOXG^4qvs z!CP>?{1$G-1@c?CO~GH|BKa-cj%D&b{6@h$aH+fx>lC~bm&tG9E?h3ZiMthCe~;zz z8`yv=*W{lJT}NL-~|O=#Bb#n@DhF}KaZCc?8UwE z^Y|0)lb^>cxKDl#dvU+~99~uMHT+)wBVNY?@*nYrf^XtM`H$F#hvjGSf0lx8;}Q8; zyrbZ|*eLJ8dw5jdgZCBu0Gs4z@MrYM&tN~c$j{&aw#v`oLu`}(fR7aX3m%jIfP)Ht zjK}4t@d?uM)A&@u&#+zIjlW{2yc>rU{2WinyYU5{kawXEPs+RSC7zOZ;VT8d#xD6O z{0+P1r|=D)mY>4^;1BYXe>kk*w|GW=5=XE{eiDDj9{CA;hiBy{@I9WFpTIv9`~fe> zJMp7}{diH{i2=MM?|`h}@iIMEk?Fbrzm(}k|CQHjZe`tARf>Hn4K|3}I6 z|1a6;qyCpNef)oA`oERwo&S~T|FzTqtxVtXf0Rt8d~H^kui~+pe;kb7tjk# z5_pCoSFK7D{bP(#w>F2<9wTsRCSKx>JitDUJmTYCYyNPE5JdhKoGH`@Ei zgWAXN7U~oIxW$q$@ANoZa8LY)1*hrB{MZoCKzFFnbKtE<|mvn z@o-yz-{HQ4NbpDKY-=M#9V&>_R1YDwwN;gNo0T2tpJnoxe_Xlr9-TGMqb2Mz z>TRkA9CJNo>EQm2(A1LisZwH%72Gl{yS{) z-yh4*)8=XN=nnZii1If*-n>$NMv4556e?Eb=lSyr%;#u)`DT=nsLD_f$_qA{0+Z{v=Cy8Ip88e|zJkp0`QtT7^%=PsqbG?Z}eMNcGGHC`a z6C+NS!)15bTvnG#o$v8_d>+3?P)8$0k>W^6L{RJWxq7W$qtDT+)GSh9DwGhgxFr%( zhb5E>35kS^L5X-=L5W24aS3HKE-3*4ptWF=tWzm{l9-dwU1|cK4;jYJzJUr*-WmBF`7BZJ4(F!rsP^D>QIm_x20_ z)L7suB*EQ$VdfyfJ`=u!2b+7$8c$mOPBNO*f6!<>l4p{6l1I=QchCo+C+j4wsMj0C zr?eW%DJrr~G82`GlBYD;&E+{}k97xq3nn`Maj3K!y^C6R(kozsgZ@d%#e9>A%!f$C zC+QO8-)OE+IEnb};XNl5D$3EOaM={( zfAd5g3i5eVTNN~^vQwyb2wg)0KDXP~zlb9V418(T8eO>>m+;*Wvm6$)(`mLigz{-> zm&s_*@L!NT46wIUD#XZ;&9o)fB8kNYQ&=d-^?0m}1uC5i+sRDiBGLbHRkE)t!Jo0b z!m}NA`Oi|^Q&>I5cyZn}(QAsXDZanxfBxc~`mH5egE`k;qpvFwibEy7m^JDv3hAvn zK44sj%zgHMnEUNQk*27`>>N2Yrr==bzW;c(Z&go{gU~`p3?O9YR;@Ny?@p8NxAJGg zPBIfZP%?9?=0j6sc!Ys2MkyR*CVa#I9X$tea?{{M6^|U|^Yn0^*oS0aU$Q~$e?KVp zk!;U`_biFUD$3EcOv?8cnw|D=AYuzTC0Ifxi8%aLiI@wm63I@wE3U|}p{}kDouo6? zIwZ)sP-(Z>f;ELhhSQqrNT@)aqt3~2B`em{>Kx?s)2p2pv-8I{2)^l@;(zp#b02c4 zwR+LySh&68u8$%!FBo`x$CM!Ff8F_)e)8qw1rv)F-G6zTGbh&}mfw5&yWK-Ox|R;S z|633|BYz|il?rvlv}I8pL0bMss;aE4F%2yoTR1MQj>v+%df#VCyKOAzx#LwGiE$|dpo6_>1rF>6eb+N{%ixrtzeNn6!8;tePV*xceoFnA^iu<^@%={xt<%loTcn&YTR7m}Tk3-=-IRR%UdFqIKQIwa<1u*5-4&Tw^+KzT?vAYvZCx zXL3$ocE|dc=g^0%x6S$Wr?bjMv*+?6KQenqDOti7Ict*XxJTN8lsA9rRoT z$xKNHLWrwC5N!J2f9@c!!AS~_vZHfC|B<%NhK2^Qzd<|*v7wJ=zHAWt8pMVMk&{jJ zs%y()mx+6v;B)8OHyQ?0V?}u<3D%G*Q>F_;p}|a6JXM)YA;MVy>*V!Kqy28Tf3$)F z&vU#hJ}{lk?qJa$U*>%`@a>?CBD3lK{vZhU@Nq7Dia7o(e--FF+WZ1-v1_PPRa$&< z@$BMri*GM}!S$Z=bEn3|2eF+GVvDD++7k$AtYV;UPi0*=4@rh2P(}u~~H5X(<;&pu{YHe|af4D5Ttf(uoqltc&E5 z@&ql53q_jZoLGs`V6bab6$fT;_6$e=}k# z91jEqi)b_%%|@oy8*~P$jteCc30Ml!{9kS?@`{rG< zfA^{1pYvpGQ?h)+o0m?hbJ|S?b8+J{1G`+2dloNQzhPd-j0S4yI(PrQw|#%j%8jqx zeci(K^9qbEvm@6!u=&&AtB>8eY1LJaoHhgmuge2$pYSPcSg~2lxb9YycBzD_)r>x+ z)f)`+ZLr#GuxUZ`4xLR8CK5VdmuoVLf4PFF*XkL2^%Y8{L(=L%$=|oBLwSvW(mpq!rfEwERU+e#n=WKjTFy=ZI6GS@lVq(`QcFe>ly?X*Nzf z!C`1Us=sThYljSqLc7hHqaLEDZJU*kZOd_aW?6XlfejlDoPE};lA&+j_Uku>78`zh z{?gyBzu?04jz?Ckcx2=9 zL!Pg)T3_I+tgf_I#iMZ>x5SJyD?T=VANrq?!)2;nAQfCn^0U&M>Gpyh@*z~ppGl>@ z%4)TBTg9G=*DHk6HHJb&^7K(%k+wvm&&ktA4G~2041%$+xG`77f908!n`mS#H`r)5 zM0Suu80h^{ZegR*UE}^Rr!oE{eE`+RM3;ED|KKU&kqLc=KSpLW986}s43pxoW(8L? zT2>GeY=%629#xw}vuF{mqM%lVOSEwbMY@PYqLBhyA(vDZQYLU0R8uUGXkM{ILSisY z9@&Ocb>gV(I!<_@e=WuZRwp?s!(yG8Nt)%VL*c7pEFY)yP*WX^9Aod0TDEJ%meZ%- z)4prNc~4X~)kkigb@_EO>fKJ0-Vv>OlT=!3?pk>E?|ygYu&$~g{bSeCGoC){j{Y03 z-S~0O1(R+|Bnw2R$)U55s!vPae(C0|H(b9(l478wSN@0*e>Mk(pFF_|No(w}>oh%3 zn|BgBTo8zTn@;C)<)5>i_>c|8h#5yB$>SG;CXX^wEhm)d)WW(+lZTuLY|f-1!%pGf z{?!xfhMvN|pfCZ#E@3T7P(~h;Vzs7vbG>JHd`Rg@=CSUR~sw5IAF7bv+;##JV z)aoilOnbGo)MZgfcKbB5-EJ{^U1n23J|~Uw!@t76#?SWpiNDz6_vd@O1s=CMUQ*)o zxUC+K+iWuVXsMOb(!x+ESE~W>#f)YCGFn!qb(O{=e{M^}?V|1-qy=#@T(Xu#Jd#nH zgozkEe$N5V*B-%>Ch^D0X~a|-G4CM5VUl-mG36#rX?eFK8nsEIiNG|`^p#0A38plO zZ%H&Sa;CGcb0>+#xKEeK_A5R#w_CaNYg2+`4PwK!D#d8Mw#*s3_Od-rXpZ{Re{1VZ z9Nu$0f8l>sRL;&38yfhxqMWpmAp4owOR~;Jko>HIu@GaI^uOKtTds}<{>X6z>H1Fb z*ndy%7@?4#(n?Lh^NUj~|9W;yCA&14{_~8#n&E#w8-2S_GTyZ)evh1 znbMP+N*<2=G51;BTe+&$CEc;R0_(!-V~>W_f0q<44|m1RFI}Cx+PboEbyzc1oF^{N zT_P?qEio^#RdH5*S7HQIzLkRSAfJtdw*$XF87 zEEAt7d@jL82gZgk2wW5BF26N!Utn866W8S1T`|CGry5m^5U-{@kjFwrd6j{vw>V;t zJw`M>udkxA(ypO)O(<;C`}GNZQa@2YTfbPJqfe8oq~g*rOrnVzO>0cMO?yoTOkbPS zCUSzFzTY1-qJBmij0ir6LIUJhbNhA zW_#?^-i0$yA9MQkl~;dy?Owq@jI-pgez(&zWkhStUwX>y(JePWG4T26vu$>hBQdKj zEZ9&?kad^4B)wzq|c6;GUP%B=tmd%xgI|8Mwk~5c?G1fA;jh3old1zH zxwbr`!KgRtjDk86j)sfE#bH5hFUXCq{! z^Mv`qL%N)AImaZSGAp>Ik18|6dy*mo_nftqx~}+uK})BMVne z9(W}?DO&1gpEY6Of6^jiteXRzx|ZP)=BZPAZP)Egs>Jh#4NdI`xmR1tC>lc z7c-l^x`KRvO(^8eXIgby-o3@>OY&5T8(m5DG)lc%tJ@K?SiJ7)GCsg*MXaXATNW+l z9wRM@MIzo(f0`_k8r+mbbfLnCy9SZ4574=(PE!yu=991Tf8~6dKY~S|C6lxpw0pG& zv|npg+L}nD45eZzElrc*l06(Q1o3H4wIs}6nZGtOv#WO8VrQ0fef>NhbC_!~v8}W3 za9d|qn)PP_GW=g35&Iy1+xAAo(M(pNDaBZ9u;M74hmeVBFkWdo8lf5Fl4;P9I@Tsj zAyer!yxV{5HsBoTRAdg_dbs2LfbDefwcWRhM#4@kblpEJ2S!k0nZ>0j5;5?i+6ngWhXM>1be}d z`^ziZMgVJSyQdn;b;_>Lp8ePOc^R@Z>9}XIMpU@wr7S=^40xy{2~3nx5kp#9=Ymb3kx5AS@QvqKW)L(wl#4e>AbhzAGVQ zTm_vWmh}+a0mbqcy~G;}dcA?5*B!4^NJx-GaaAHwS>=s4jN~NInDi%UGS-w#j%@Na zWc&!7I+k^RBQj2e&R(4LA!1?WI>sVW6e}z$3Kx1~!)iFG33a3{R$W(DQ|%oVD)502 zt*bH;kH-QLcQ_J@WqgK)VZ(BBwVEnlVYRQYNy_(EuW#DaL{~TMZ=y|Ux>NErn|;Bc z$yZJ#x`wiebT6ewI-4%0j6OkkVif;D4V1O!woa~p^7u54H7I@?pRo>3nmZQXD-wj3F7dft{_i=ZdiG!&mwySZ9q^s#awvlQ zWU_UCF#n@{upWf}bv^c1VJ-Z4ODatWWvY-qUeagZN;$t4`T2f$T^Uf1`LQXR;M{Ttxo6T(U zI{gusIpT6s8qpXdTCIjVp{9u<5nX{*`<+LBZ6MC|KCzE;z3)F^#heBBmWj94nO=@XC3QIE`6PVuv=J*I$9?sKk|O!qoXmdZa4Pgb@F!ptKK6x zLXLQI!-#sLzDV6k`P1_s@NM_Kfj7t--b3Uwuc5_9h~8u#ITdO7z&4)ID}7{H&n-lM zzmXb?Ek>i+;??_=St+7mQUNU}juaGxBVK<(nU}iCs@lrRnp$r{r&7wADnX-B30|GY zmbsXd7@dA6brxHlPMg*1DJ#l|irAzWjTJ{@v7)HAEG@5;^1TFse6QC>sFiT^)d4=Q z&+7I1kfvTq=L<*texEPj8zHACYmCv=(Y?_F(XXSbXqtW~*}Q%-o6yzd75>vF zAwOTBRPd(hGRbZUFu^MLCR$#x?6-Vn5iG9yKV;3V30$kYU1FcpRG-NFYwL8A&Nv8v z#H}oVaVppSiqco?uZAQy3Y0>hLhBRzc*Nn_%l2HWDRahDmx+5~&VMZxI{%-Emd?X_ z_g1<9REayllng?0wJ?Z_ma=! z_OCPZ^|+r8aP zQubZW9WKpAX7K4W^`xpO;AwOL=-RX$u(4!!168c{t%Ae2Xh-$flI1qAjV%Y8y>X%P$ z{(?NZIUU>h|z+0r5|8?IjfG|^7ix5ijwd54s zf+xoZzr|zrhdni(X3zG2SZ;|qnwGzm#Pi+1a?_}$M02zIRzDroHL;%3niU7 zStx0Z$wEnI3RW`pH*@>)e(pr(HCB?%llKxkvq!uok5lLVmj) zL3xjKN+38qW_37+ K;`|Dh6B}AFu40C}rDADdY5by^8*1(=d8p!*$eaGx1N$Ry zmVOm686(Jop*G@jnIleG3SXj(cY7J{@v<_Fvp5tfDdF~ke+Ru7rF4U20EQ5sSQXAk zghbM$ZQJtv)%i3(O^PJ`#|9=9Y$(`U@O6Puz?GEIB#9({A$~1V(N#BY(TVZKw$6iX z2iru&Lsa$yDw;rvLn9XB%&`2~~b#%x~U8l(W4abd`AMbkW>N{twxIyBj zC3il&c;MTAkI&sQ`N3raFVWnAaVHL(=PsMEzGnEH-zfWF98c9unY5^G%IzT7F7Fqt z!bXh3M^Z^+)ybZTRc%!l+OM%+>%QKzs{S`4bH@fokDz==JUHTkk#9OaaeV8@@$i?l zIBWT)j@dD(xN(@?R!n1vgebnb3Z4FBmkx)b$vAB47@#^CB#hZ#%#jfVNb`bw@>-`7&`ounE zI%ngU*+6DY>^CXse9Gmq`hi<3A5lX4bKMlt;j_YxILF*4ZVn>{5L+ za&+T=2fI0AD4HEab-dlEZ`V5Ny}mIe z4A19G+UMhO%WGD5RGwPpH|2Yy-KVd4>H2bB^%)Oo&ieJ;i$>1(+1#NqW3K+yQ~Xa> zWM_AbTp~qtkmD@J$KQ!7_1Ib@3a{5ERNrjYt-b54Nj{e&*CI?nSWFghHGtly-l0JAMNbW@ntUC z*U0;YX>0|GP)p`WlOM{t*Z)u%i{ym;!-S=l3*8rZR#>lgueILlemG}?^7$Z6oCt=) z1;K(Mvwzp(D6S2nwwSOgy*6H(CI_S$UvZC&wqE{j!(I=(s&ng>YiaDDDTG5f4H}}p->wA`Pnf>grUyXfy{wWupch1ha%kKEi z;(v=DGm6(WpIM*lG@Ejb?vlIa_P?P><=>gaiNj7kdBODAocE>jeqp-sDe_T73O5@p zoL4$AVHHJ-wZM>X=Vgm4VRO0cwt{?L4kNliMBk=Mleya>L2V#N(qyhw!tw!@qt$tX zM)iI*Rl7?f3Lhuibx-&ni|$dqq+pFJ*Se)qd;*S^cY z!l(VO|8d~kKkOO!`j7W1+p>o%dxM`}|G@|A*MIN<-EgvJKad9V!{mSQ1$UT)PDR5U#I{z)u^gu&+@1@QC9cV zn{L_phkXytdFfP}XmZTE=lPcgejvJ+o@R!8K1-hRyB(gBRvh~EJ#UPeWObNgBhM!6 zxtI8Vy+U!hykB^j{~cbG;D5u%#+EE7q1*s{RLX;js1k||TA=YcIZ5;+93GF;QQ*t9 z7ZhpRa?@n)mZG5E&Zk45AZYbLue0XxKLX|OYXd9zU#KO-9S;Xrh(t`2Ra;^uD+c#6 zbY}a98;}jkqG^NJcTns*c$m+Fe;pL4C?B7)XD7jyJdIhyMa;2zv40&U@)tb;Yn1=$ zB_e;iC8Q~I9hFf>ZNyNG`ly1bbPNvV<2P3cG$Ufxet6!i%a*;`_5N*2dCA+i{$HJ4 zdz2K_nZLIl-Cfm>dRKS#v%0E#x_f$_J>B!5hUtQV(TFl?xI{u| zKTv=Q-ZZbF<*gEy!{%cbVpm`Xumi%Y%6t5K%KM>z3mlLANq_b#;WT|?bSBRe?#8xl z+qP|MW80i;tc`8kww-LO4L95*8*7tygPY&~-g~B|`st^;&Y3g)p=YYQsyAJT?Gy4b z_<7pNJzO0ePrEmWiu@%EMhr^klV^Y2<=+Gahyb(!wC65;vrt-CqLWewK{RN;xAS8| z#=n641yNIfxh^+UL32V&c4}|a5Mw9AgjJ5(cPL>j-b*v#Pn}Le+Rqgu&a$$HHlNaJ zDPJN+H_>WW=jL)gHUiEy|Be;xMP;p9%dr@c|Vf4z}H>3>~u zFs7}?X!?8TOrgnB_Vs1fBhz0ikO4qEBe-y9VO40UvJ%;q zI9lHtmPsy$Q)Wt)0LCt4$~|-$fv_p|AgCXx#(`7i7;8rs(zs z#0;#OlIaX1nB=ZIz2xpJ}`9xutp$D=XZfVO^m#Q;@_PzRol<%I^`N>K4!rRQFKT>gn`FSiW>nSJ#?gu8rp;lQW0`svq~D&awlTcB00QcRU7{bi5zu0=F=cpV%SKzw^6@HLe)$8tEI2t=O$Jj3Pbsp<2tl%Cux+xnFYbV=JA#lxCPcG;N9Be?vZ(A#wAe&76$IZk{?0SGV*@+`rR4{OXR8d-d~SdP;0DO;RcMW!ifAPfM&9 zWq-fT#LH@hFo`_9uV=DI*f06XAIMw!yu1)3i=MnWEin7;%ORZ^`{%V~%*Lhs85s&U zz%_G6aEgY_D(wesP|NF^E!j@NS0Z&%52N?e-hkv@Z;IfrEMLN810cZ*=Vu#Iol^T5 z_7RWu#+&iOyCyAB?U;p09rt;ezR=raU+h==#T(&wt|K*HWlAVwoun zGvqOh@bEdqr_{|E`V_gF`b4KVxV8Ogd$>O(iwS!*xlZZH3}Gvz?SZqsm6OY^PKa9H5D07~ z@cN6{)AOTPd+#)AjdP`f!W711tvw6+)OBV2_G@mji?xBhJv-f^alv`U58WcUs|>c6 z*lbx%rPacJ+3)zZC$Y>6mDoM1A#mMKoh53412L~WrB7dO) zK@Ks;s!+kG;q8Zu@oiZ0ygtDtr=9699&5VQxO+kD&iemu4cC(g-L|d&FaYqJ2VCc< z>a6tyn`Cf0I1Tw4Cb};i>l<>m9GOU3?DW>C`rW3!Bl!Da_?E}c%ry34zHQm zYpy3bHO8N+ZFa6!Mvmr#Tn7_n9Q!9Gux-=ccj>bge(8PTZJN*nO%%!;(ATmTZM1KA ztdBKJg7miXZ3mkmM1W0@&;Y;~`9jIccz$q6_$|o{o%)eB8B>*0c-f|_up3Ls)APHM z{y%{+`C8_%>Rb&X8g83*If4{YX03c)PI2L{#4u-RyQ}BzJw?~ ztX}`NKtg`~^=(?M7~>j%arzZ$opaf%I9Y5mjxr>1)zP$1Ft*H)2HFye8V- zaDBnPcipunoZ*d`E}p{`-djUig;4iZqRi%p@BmkiaaALPC^qM}nJ>ul8`2zu6GYTz zG}*#{Yn^$)VWatm>$DiZ{LO}H;Zv2IwBW3j%*4Mn3ha~7Do75%M%n+HAs&R8r2`EE zNb)0pnvGO59?7@F(1SkWO2P@Vs_iUYidz$Nagc07>}#=9$E0K|b9OX#p3N`Sd-X7H zoV?;3mhMH;*xUgH$xu>uazC?yDGsxwav_JsaA-tpvpkn#Mc%qI7*l!--{pskmKH(K z!TTLe;@$^2W_kd?%X&iwf++|p3V?U}XB=$!vLfB8pgKo1pFJ=)+GksNBm7%H0>@q zEB`cg5byc{N0VzLL_<1GeHLR%k&iSX**`nq?;Vo32~zXco$h%|AZt^+CAPwBA%ib)R@r??sI=btvHM^a z>s@ZSBfJPI0ZNw z37zwC05wy(T=*M2`0t-$Pqfts+I*Mo-q+82*nj(%zJ^E%be=z5qDvOcM$+^;dPZ6$ zBF$@Jj5iht_PZ?R#fbic6l!P{>PFeM2=`s5h*)nRmZIptn+#RZhJhNRI~}rANxxrP zyU8U1{OivVP;}xCEPF{9g9mu7v19jraRFvszn2YgktYD@tNy#^y7S40 zGVT;0_<>-``0*03%fxHZ9GgvoL8*5R|6@RAD|v6GGXox{!(_RCytC~M`OyDzk0Xd4 zIpzT+&WP;-T!*`4oioQ>;C|@Kp}TxOa^gI|btWmnaCrZVbC7Q=Q-Eh~tmh1!@nUop zdP6k?C2K!>&4&bQi_Y(dNTAp3!U62}B1N7^u9X-D{w@&WucwV37qbZ{<=BXbG{B7NIqKhy%en_?|?J_DK4q;k!tTo`Gf5dynU? zX_-M2J~(VmWn`~t$Fk`uGNmg-m3?Au2CD+B=r$eY>{K0Q{9+yEc8WiQU(1Tgn$=yw z*e4JqQ49=8yR*!2-w36fi2bnn$k330(! zS-k*GT86x;r+9}V4kD|t;Glm$*M*z(F#?B9H5LoWxkj^NI+%60H!4pWu6msSh-uXz zT|Rl-Q4}#EUJGjF$U+`WL{pI>??sj+=S2$67o|O;ey09{7vxUh((Bo%@(>Up{e@J1 zL=Ib_5LzoMM>yivD@&iR2q*01rbdzEf{zLwNmJiB))S5X8cw&i+C|$&9rPvaXCuBb z&Mpr12-U^2s*pVV#ym)xUo9OF<`&bECS)VHcvt@jr;_Ub8s*g!s)@Kjrh-`bt8&wJ z1%`$*7sGlajw^hMu)Q0~1x3&X@8BtCorQ0K+V5wu&fENBPKSYFgUq7UFNP$ygpd1m z?eu;6#D;z=XYn8cE5*VfCztZU&)pS&Ot2 z_ZLy|+m9_fTFuoPUs5eV8NAC4@g~h&Yh|7OpsYObZEd$zX-9eG=4#XHhWq{xx1G!5 z!FoY!`@ROlQSar%&WzJ|@tT!Gx62Rrr?T(eMM5?Wno%&fX{6s-xV=k{Q$LtrGwxL0 zs2nh?+q zNeRy%M#Q()J8rUbW_o;o_9`6|om2i!!%RXP{JWdDG5`3zVf*4Pl7UQ$|D{pdEreK9 zaRK6Dvp6A-kvT>k5DZU0U!x+Gt%T$FRv@ke5zT|~+${-!n`8W@*j-)oAWxFFzvaB) zT_9l3P$#JThssD);z#$Y0WYj{SrT6iC97s27vq+g9Z9)D>X#iWiJvA*S!q*^z7aAN z)TYTdF)IgIA44ftnM^C6oCz(8L~BM`_!V`e2>&MbTQJE8z!p`L%qX86cNsb|h~f+m z#v50N%Ik0r*$FHDN*j>jmBi3(k>+KGvk{ z1!)v#P^*h$H%dhSu7RVG*Y)#4Cp0cF@Xx?#>9c#Ra*9JtRjswoW?3h!*R?H?JNPOq7T>ZL$?RB)j8 zqb#2@Ww36tp-f3g=c)~i43-xqFaB4V1#Eid$$ zKQidIB1T)4ijO@xNhDslOsWG|anCQRp?S67QRF>6+qI?ute^ZqU=r7uM^c$@-=uWl zJ2}DQw3K#EK*l3?gemS;*~J04G4-B$b%5ZhWwr9ycu^h7nmV7AdT-C9)J{MX6j8K$ zd=86S>&5kfP5kwFKF)D0D$Ab`RCidpLkrHNd8?cl zB_JZ3*TdnI=2BsBQ4bTrZ zJ7HO@L({#Qwr=^UIIa(#IDc!XESjgW^`mlq%cf1)mUAMq)ds+n?yy^|EDz@t+KQW2 z2auGsKjk(9YwxN4_)IxG0`5`Vc0x^G^^EA z%Fw&DYwX3DE6%ek|KLyD(+89Pg8Jg#O?^WMSx-Bq5xf?sD$5xnwpPd%T22U8(*ASO z%07_PF9_2BhbTT@98T>$03AG;O3RIi4^Ye}Cn{Z1@0nnKc&ZWz{PPnd@DGi)7UR(V5Uh*(}XG^e&q$T5V%b$O9 z-?hUP_hEV63um4YB%t69ygG}a0@aXegvIk>5P2uUN_3*^C5ES?QY*EK3%rhkW%%?l zuhnzB+16`vUkjMpp*;+*BcRQt7*s||fdggmo(}=c{O3Oz`AfbqY zNw)Ckl{GG`2lHiN=9ZoT;TAqjAelF)UNeg*=fBzzPJhf6*vd;S8( z2UYCNX1yl`M`vpF{U1WU>|{&fe5ASp&cJwkCuM!~s%^J_XHn31aV z$osDx)4I&a`%bQ~-UkK1xfWpviYVbp3o*qw1Sdkn=rE*qn7JuD5%KqMD9&HQy1HRu zQ%#M~UOwigOub*u7rwXYhFj{!Y4M`Oy3%E{!UU}p6U;1zXW5Lu2zqi|hcb{A5lU5x z{uDV*H+w1LxML4ob6zijiB)^qJ4sB8%+igJ(hYa2mF8g{#y=_mO* zs$ow~@WZUW373KQ!1K1(=+$t3C9N}n>zZt4!Mz$w#RNtHFbP#=9C53aMk5V^juH{? ze#UDK3r8eb+26Q6Y^w3~JKvxc{R@s8^Hw||g-hOrdr&}fh=VK65aB}MM9G5+ld=14 zf;DW$mFNoc8(1JJDk+l>_zO+j-=WBRSDveJHpHPgorOrU$Lq?mEt?aNuMd=W2{ubg zjSaPDh?(pI@XN6{#sszH26Zh-_ztCrXno%a(KN2VQhCC`FrnZaewAiFJOrx~z2h** zjP&QZyeCO(BRR?Axx_iMhZ$5mxp)vAXS7aL4jX}cBf7}2Myc!tstM8C{YINz2MC68 z-%3ysJvuhzbD?og0-9QU9K4sf&yPI%rR030V5M#W7>>lBl_qhTxO_(PI=r@k_ceI1 zW0lsd0Cj_e4_NUKTyW5$MB^xP6sZz4a&F3Rm?jEsGrvP^*EC`KLni!!a~KmtC%3eK z&lBG|ReE3sCA&oWr1?B<(1LCl!O-Nu)Fu(xBL$V;Mc+j^&iwYP*+l)_UXMzUA9-;c zb-#TFp4q%^TXrMW#G^!+$#;(E?=YIf5t9;5XT)24;-AC)lKhA^jT$!APiJtk0$IX4<2gX^mr01wwCIgnl zw37)Ye;lFRp}!=@cz^}!-@x|`9}i;<8x5l^QW!J$m+0}VaeGZ{AahmLYd7dPtA9)b z)~U#fq7d1xWa*|3#lx^^c;Vt2|IZ7_Z1{u{n2UH8VNPcr96?D7jDlo>G`&o{O!{M4 z2Zl`&0g?gg5Z~nt>iiF%`!NRa`>Y>;em4Gek+t&isx!L?exq15OQz)&c^q^X9VF9v0^f5GjhIB1*>GJBm6rEH;As3*VNbC*IYqqVwwSR zG<350q~DXIFHAp`cB%ZQg6?qKa^uj_{A`2Mm!TfW{h$ICK48q@?&xek0TEN!wX}kk~*T!{ub*ZuoEG22!kum{H|QF zKaWdpq9G6wMz$2{JgIZUO*rb{v7pIF1`JBNVPu6IbCNjKl1b=J*@>1!NxFlHX0Tph zT^9po-btaE(meO>{b?R%2vZXpxa2s$bUbt!aSA3N6~hs14~#sxSCfIqPGpfXa^j+f zLOg@Tkoz0lD`|%IU-~Pe(!^_p@w4D$CMiCdlRpYOQGa%3DGnX_>0n9&y!qjPXQ(i0g({aw-X`JReaazi#Z z1apM#Fv90kpnHqq*@X`bTjQ!5xDwTmsL!sh*fcLhD|ZtP#BUY9sT!0qt)c%o&Sw7M z@B>jP&nl!`H>Ke-juk(YT1=4kU2dDHpH!IkU9{Jb5nW@9a$jO!$+X6$!6kNqX%^F> zNcILkD?~P7abR)&jO5JUBT-oTpDeDbh^lwh-)behHhwWBJOTnhfc($Z^!$t3&--bzp3kN zh{!=a)P{P4JF5$P!SmiXv@i#wMU!Qo8k_ME4;0Oe&1p(QNtZdzk;MPU=O&j}OBrne z{jNxT*znAdKde#mcVA7gIuKHzQQ{wNyv;RE{2}wjAXBTcIXZ*|W=U(#cDXUD7g+ru z)&|)-lsnk*cDnEHdB=PXe{GFJU!>*Zsa35MdIoA`T7)zp9TNsZ>RsGKEXcTiJ>_uD zOKz@qHtvBla>q)ktu#|fTB2E)j*ZM1r(!hY&(NliE%KA@O8FD>!UR{-k{C@1aoJO=AeFbNxei!y&?x;R4tqPx=0m@%Q1dweR>C}llMJRi|mXWCKSV;eJ(ZKtMQ>H33B z^Ni5MMbo$@((P{WrDo@=oQVqU3$Jv8(=goI_(d9O?1N5#!cH zwiOnHiFHp0R&92^8Im=hI49c?v@p3y|07_gg({CNdd*xA9NQxAP!k3rW$xBx<2M2h zW@8YV4$fLLL+0$E<@>NF8voH1n>-r7CQJC@3i{_5r-AhhEF7EF`6);ai33Fp+afho z_!*6?fnVeY*YV4V7%g1{sXUn#&PY`F()va&?{I|2{?e1(C*YI3!XHiDhQ6Djz5N9Bxa{%dD1PO-qfa z@mgeb1zm8q_nSr@jl)BjlAyyQBCp~FqT+V@3#KLH9v_4k_;~flJ0aq${XGyyL@W@e z)r}FAhcFSz8m%3qp&;XD%|PILQFA-%2xss6*o_-Ee$J4U!+Pi3x^aTnVle!@-=)Oa zE4Jq``*hMnswL0$8DS(O1Ghru4ySu01V@n4cPDxMlEtG%na=Zbl&wcbJvwT*imQnb zwS1u#kP}9ec|5{wBLxI2f`Kx>G7s-eFCT-l_{N2OmfZ9F%_h?k%??gaiHV50sLg=| zCcGU2FIerN?xKo*^MFL@mAsD9$co)fd~PpBs~t8-QKRIUVpg+Gc!m7+1^p6WAi%eJ5=yY2R(#O1 z+ZAu9820;goSKBOlPuU+aTKnS+IX83W6WuB^LwS2v7$kw6dHxXPdNE6`M5&5f7ZA< za`{Gm|FnW$3?+g^H;T|8KXbDg-CG`z_Agc~h*iXs6W^ZGq9+!{lcPnS(smJxr8)L^0fgh_S8(!>=n zE;W&A!Gw<_H?I1y2_Tf`eXRj;vwn z_*YPx@bk_K8le$ZMNFBntAJsCWfrLnkc?r(*f~j4{_>1#66kZ5Lw|%YoI2CeE$>gL zacu$#gLp3|sLua&LeH!QK7&=Pn}v6ytecjBi0gkpKzr0&?@K>a`@3RP@R+A{;{XJW z+B>lZjoN`Y9cFnTW~Y&|^PXoiX05#;X~XjVP$k`l{?IMgu5K8SVXSlF?V+>0PW7G8 z9+xx_chKzFPN#k#!QVoaH;Aj_2jPbrU{K`-;*se!b@`ub9SHj!VZF-Pl%rn5+Z>@@ z$NLa$yYOm!-X#=79TcCl%5zJ~4OBWGkZl*g6QdkzKmPTB?5G-;D9II$AgPvkhT^W4 z@X1}KX_O0u7#O`gC-6yLHrYph^bB*Y0P(lG@dx*;tT!QfS2gU@z3K)csT?{zayd-w zoY(k3|E+8w5Ak2sX@dA$)zgR}qUOD?_o}%Q{`>u?4V)iQM4>)>Dg<~On)%-8mUCoX|+6oi%j&34g?-!G&K>Yq^0BS(2 zNTtdl@6)G({8Xlx*PjaUx>`kS%-D1519ds&11IxyIeh0+Km&sw>mL}3EC-pyzy2q$ z9c+Q*6A#gZ%M85bI&O*$N14LW=69ri9`xhSJPDWo@RqCWX9^#S zWCHIbiXR_B8z_&BM`2Pg-!BzgTmtFDkFEf9JO(?_Mk9guCApY!y za2eq}^z38k;o~a^V13&ge8BmT$$UTmFi_m%pV!l1LWh(LDU{s^#UlU4h|U=Uc}Xrd zF?EweGcrOxB$m_&b86O2AQkeX2@?s(4T%XZB&Thhps^H_`Zu+AQ?(&2HfAL@hAlQm zCKe7I!`jZo)-|ffp@b_TiYt-88u4QoSF*JLO<g89cJT%n^>SAlo)V9G~LI2LYUAMf}KD`l}5vi7sHnB(w>+y z%uyaU!IWn6VgG%V=|zrN&lZDhiaEfa#SjpIz06BVDACJLOGuFUaF|RaSjclbnBH-P24{HJJ!{UciZ1}LhGwj2*s)mg~+{y{=?SG4zPR93=i&P6& zZ!_VI}V~WaI*mvef>K*}9Ng0XLWtu}}>+IQVUtm=OKxruk`*_5%1uc_F5{0U@<9GQ&@V z5%vNhp20!>YE>BDWa8}Z$%n)>CQg(qP6RGa#2>~l%xo{lO1okH*t!ie^`YRt_iZvyWMQ`a&D3kxBW?+kgqr*AR6Z9pYR#Yg;*m9Rdq0=71T3h!JK8 z8D{8!>E_D_0|t=65QG!LimOhFA?J$MCx$MiWaLwH>KPJYer8mMxt>@Gp20xCOiLAH z={z-5JfN?4d|a02w?hv{e1OF(oWxpc(vgMHf(d{4c7UGG6!`VLRrl*!ZZdw#*OHm8 zI!!-FWnL%*p^yOH@KjuHWQ$dP??n7f_Jw0frS3$?l0*PfPF7r1HiVqA=o3UHh7ps& zz0oZ5_y1aCx-&sFvo0 zhl1}YqNsz4pT>C4SEe_;96P*9v=8G_4mS_G54p!}E$9)xx2mC*G13`Kr@@!m;+v;0 zTF!Ex0Qd;sms>BnW=^R{Z7KlBBA|4Ke=s@-1O`jljRGmwjRL>p-7Mm@5O}&@6x5B9 z<70!c6UmB#w32s$M zSK*RBdB1YX{uM9sUzGeSUh04LnE^o!#7zER1oX=6g^TW$Wkdz1^mCxH^V&!g62OZF#OVenR~U#b%CJZP zBt{9sete))EYwAr^}>XDDH5YdVL!Tzhr)!X;)Hr}5~CkfGmA1hpG}e^mnX?(rzJBB zGAz<0eURkcXKA{#jvmW13rg!HImYo$P9-_@VmwB%PTj~m+tNIjVmy~pJVxRF@ys$j zM&F#e(f{L(Vw}1WcOJ|<+z9}r2YFP^g_#A>^^$MK@zBOW5JsWU-PlMTMEE{0NUbnP ztvE;?SpQ)UKKxU7&V@9aU&lNPWj2MMHZ0N*ECb0ICUPtiR7MH%eth)4FKHe~^k@2- zOP-ZS$2v>Inx7e~mbCtdk1IG1ENo0Q$4B$|Gp-ZP8%kh%ZJ7 zU-}5aoJd92KZRU$ooo;Z(gp>*6$h*v{y#c{LR5!TREK0|hq4PaD8E z&eS-F#3*Fu?65Oe7!EAZ0}W(@13EQ(Sd8`Y69C!3fNW?$r{c_AUjjYAKsE%R({Mv} zl)zS~z*ek458;eiF%m~&M3?ij(B-+71qTr%JVA9 zW0n^9WVaTT1s0SA7UwQoml2e~SHWACxm(=@ER>lYV4-{6FqLL}Or?xrO`x(6dDiqC3I=IBxT2iyTA_f(Q9K*1nL^#TnP!`iYJQ zc0o~=G3;(+Am>cqW05OUM#miAD4c&YmVPso^fIELUXsk{n_)L0u^(LX*_g|sW#Xy2 z#Uj;_sUMnLNvvz{xKhszlTjGVsklQ?-iD&Ug47mUf^n2>E0U)NSoJ9s?9$84vNq-t z_R*5>&BA?>((hrZ9I{2e7>Yj=dmenw@8vUH=Q+&Qz%`H2+<|jL8(OdIp-ww zbmtlv8qL|(Gh3(C%;0%=^0^xsDJRs-WCgM-xq0%n7#b<-{`|*gm7-kLv}l(dMtwSU zpX+q=5SeQ{eb$w$eAueq#C2BSyyR@N~Y> zw!H%pHIE4OYdnT^4So71?rr@Cc7ZReputrTesq9bbs>$&;lo7k?i_8rI|!-bA75YM zGQBdDa*OP0F!3##o5i5kWnAJ2M7^|iSR7&}Hb2Et6PV8A3!yJ=eF}pNjjzj~XAy^Z zknpeU&wf-8_3YMRhMd3Xy`*I?gKOsS$N(;tu8=urBeW!1=-)E+T5}?u__?M!;rC$F z1TIb|a?x{I%mwaEHG@B~u;yc%`N!J@YK#&D-qhqwHQ9NngsFlw!Y)+h54qo%oit>& z%fD_@n{1bdbSmw3D)G7I>d`*>paAHr832=XRD|1 zxvuolx#tJtPW1Qe{>3$#&&A#3>fIZVxAJd`SVmCFsc*35$iP&zM)V2dl4UO8Ge?J~ z(berw>vjV2_CETIg1lvIT!KS96aad~9J0#857-GFqtEj`5=q)4Xh6dc<*;Jz3SpIs z9)bM+56&>KuEu}?|Ka&#M_c=Fw{rW;$y9kvl}3N0$7tpCgQ*CSMSIQ~gWMd=VeX^r z+!AkvK>U>TtX>19qaVAIM&Ne&Qm2wykr2o0A)dSbu$`5CCna_!8rl@0Eg&|7Ouu{% zq7yi^7}q!O;%!&$3gS)?Xjilqs)IpE`%`fd9LrV@gR&g@yWpYu%%VJFMpu(1=Z|GU zS%+tKP0+MI`&@d9XS+)t6B`j(^&!6mjU~CE;Y1qytpNYej|k~%6oLpIE5I2b^Dawj=ITt*_tAMe&kBHAAW69XmDw+~!TAWMz8*E_LGgF}P9 z@s7=oCrvT?fZDIM@c`Uf?NgDHSZwl2(w5o=o6_mzxy#~ejX~CpFYa@7WL?AL`D&d7 zQh+deO*U7}1cUA4xh`rgFYDB2O)j-bqt;-d83VN*T5m^QyFu^I{mUBp^uTXil_)o9 zod&%gzaLeD`XoSTW*=9R786=VoiTOD-jyE3O9mH8gNYO`few@9@1xijMf_t# zb_jgTW=yy@hx9ZBQXXAQHf&C32?L!84lWvw60KNoB8ytjTv=hY&o(+yr+wG{FP@0d z{4*UmSW8_9kU85PLy%&P{oi>@3|@ zE_>Ftc=wU9FVVjTp#WModu#6C)@1>qVD0RH=%@DuKzbRa73Vt2i(Z$Fb_jcf=3C0k zOW|On-;k;?buRam*>`4KH*qGX)cP;6mqF}^R6{_76SAY@EN5jr-Zbj%V&x~NFP zE1&1IWG`DC-rdsITFYp`%+!>9DBfl4?Ul>TwQAOqo~}sCg3(uS*>`vAFS6r5b|~@^ zXrLzpY?ZDdNaP_ai;C2y%`C3(4blEYvvy)xvO-b*{*!n)hQ zIsbR2n^Vb3Uq2{YpoP4SOlitt-Z00@`a~iN*y7mxp*T0iI2XXA!J5O-yu2iV7t_H= zA<)EFLZ(L2%^oV7H8jhx6gH}8CT)0;2OE<2APm9)X-E}t5lumtOy!!%wQbI&#t%pr z#m35YSSxvNaIkYwJg8GmC0V)hE-kUwJJo4VQIRMfad&R?cv0(Ys|dib6a+6{li?(4N9? zrC+1APiWig9_!x1pD$hk5ju)vUyY1_@v!hW-@F%nAM~MLiQj{X|Y~5NE3V4#1*!J{3>Lpn&|_k!cmpU zL=G$k^w_{oCMKcLXD?^H>;tAl_^C5#J|#H?lrl>i>PVj&s?6feam~37eEK=b#I;@S z)}}8I+}_dy&h@!Px_3v2RP*H40qlD$)(<+CQ+RI}?4Q&SWy0@6+04YM(jGwKEbcj= zuC#+G#<9=Q0*kGwsLJzmn}00Q&%4i8r-LWQhPEG{J=Ltvq3484V4HXxQNGwQh0|v4 z&oxCOTzm76!CD9OhJ_{d9`iE+K|?t}wjXc#TjO7svEze#+KPEPI_QRF0Ym1@q{Ph9 zgs05g-Q;90qbW`FR7o-+3Jzd~uB&;6Z(e3OF&x@cRjwHwP%G>#ZLRGkqq`zN0o!BpLxoxSQ5=I5y3%`NLGnQX$~}#<>MZfJ?Hz7 z35#pf!%4-I)J`_=PQT7CY5S;28l+h?Xc9B(Oy^7sOmm&w!8SS4@DZbkl0O8DC8KjX zvn_u=!THg;s5l!B*V1rU*4;;Q%o1`eq39Y9FZ$orR^7_==QL-s?D#a8tnH5F{qz*Mrei{Tt*Nb= z37Mrmn$$?geGKF5%?(GOm90YL(lgsrk{G4gv-of*7SSJ?&>w)$`%@OtXW{&`L-NxK zt*K5e_x=*r*-%j95Fk*kX)ZrEvUZh#eV-ccGsv3J#EDpy?qfxSuI2bL3 z*2`j+bJ&LctH?-SjXM)G{j2sy2e<4FzT#Vez>^n`0-=9a6~a#}DJd)qhjkBMw-GAy zYp$O$#}O=l0Ecg8Ta2hHl_aqPXdn55H+3#HQ1iO9ReN+B{|6&gglMe-r zFSn%3STonnMI?C=LpW$iA8SZf0(<#~9Sw zn#$GSlgc1c5{S9lGkHOR4Ef|@on)*~Gfl-?jOhszpoD;gp}qD@YBZlJJW5Cvog9@W zY#JdHw$aWDzxgOQSql%I))tS9Zvoc^#RCQzdL@_})deS;q7+2uT`wk^fGWnOYhzlE z>pa(NY4!8sNi?jTKH2~k+EE;ami+veS14at>y$6cf;J_2!E#vTMwTc#`O#qedD=Rg zh4Z}@AQd>!;JrGVL~p+O3@J+dGHOu|%X(8&jc;jM&=B${d2s*O?#jz)t4Hv8sIG9) zww77jSay0xEzkOlkf8hR>`2CUZ)oJa1FDYR75@*UnKcuS)soTGfWN7)h99HwfO0m~ zPHNEo_RMdF8I$e6t?Uln*py?W<^)52Zgz8VfYkbU_s=z<->ss|>AxC} zDxm&&dZu2eUd2$xaP#>9vTM#W&%VRHpw_bqDH1e1oycb}RfDKysRMO2-_LVXQb?Wn zX81H$ZC&#hlJjTGE+q>Js(btl$IHMC#(IN1r<|7Ds$5F=1$bY7yA&KW_(m1-@X(ia z>6bs5y%c$TmJ4GEpE;B$0v`}Fm33fDwE>u1wJj;r|QLs+PsI;uOtF^|RP${zo01SEH-JS*f5a$OTQJ zP0zF}Ps^no9D4FgPO1S?C^{)Mdu>xx<6Th<#St)8sa=@~l@_&t=!wIY?`sHjnuSKl zh5Cc`&oW9q3u-^=F|r;*#Bn|Do_hCUrlIHR%;L{I zWQ&^6Ep(1&Efh+tu)!0p*(%q)ZV2Yb5yx6)pE6vH<7x!QDL2n{rmW~E2lq~&C2nnv zxC#2$t}gU(y)vL_s_@&42;oA`oQHZ{>5p}V&46w7XiyP)fkR45nnliR4g30ja$pRd z*b|5Pq%7%HDycO?ZezB!G0P;P(qt4qC$Da=i5xfYk;9tT&)GI;iu1^M%8JRK;Zt;b zkI8j6O?Vdnho`duilgbmH7>#37I$}d5AN;`!QEL1?he6S5?lho-Q8Ulhu{!c2!y-e zU-#asuHG~6>{QL{RCmqxIrF@(MkETXqJgjWLMX&LE;x7hzgUUsb!%9&hGu~3yxH5k z{i2|nDigY#etTF0wvA(is9bNWyett>Zy3*H;Y?3@-#HqPIQN);)Weag5C8YZV;cmf ziD4?>@j6O+@8&4abx(zFEKbC`e1-s%STZ(fsLFzW^Lqh%&L?SFtUvuvlg*ZaHU?dJ}=PUq^viXPu8c?Ce6%GJ5Rq7*9p5Tz*%WC>wxZd@NOFYo%L<(0llK>aQwjgleEv_!9l!IJ$rA( zQPRO*#SqiC_%z@6=S-T*ruT(^VTbPrAne34iV5{C%lPUWCIoz;NMJ6)VUE5KdMGM% z+2ZmyVKrS;%WDAygtpS<#J(@BY{~WG&{wyy)s{g!$olId6M~EtEDDD(XRov!dIAop7uIY3=?`q9`VCqTK$0SMA z+VzB(h1jm0?nkyOOLH=! z)h%C=qmQ@x0+7Bk`m3U408+jT{gsnm722h-<&=7T*Nmu6o9DjU%DCi+4s|$|@R(?y z3OZ9r9;#evsYpD)T1l6~GMN%$38ieQpuoa7L6yCZGsBf3(*m%La6Cg}S?FIz&AKUS zP2X+P=@trd9`@p+%dtd~`HUNJp!@-6@HNk`jNvgE0qF0c@&eZZqPCj zYtEZRf=3BprQ9C>EsdAu=&Nf>%H32Fq{qs_NFfe(1P;HplNw^Il%2ER+Mi=1iO6x<~xZ3e(o-NP4jX@B^8s%w|* z2TO7{@nJb!RJfI(l-^t^4ExWqpnO9izjg;QX6$4VotW#a->SA?X-l%p6yh}b>5sYx zKa@TmLIxU^GhZqkY(mKIT4*7aQkW*P_y}=8eQtcb^Glphq&O&~l)|jHFYCA7W0St} z%SA5COvrbB4z#Cn6)vjPdp$ev%|>n*ye~pQ?_vW48i+-?S|@+y8KjJGmE`5rs+FXlO76aV=D+ks`k^#(L>><7Q;4;mg?FB&9dEGkqarx2q$nr|Le!@{00f;{w6 za=3x9mP%Pl_fARkC)k>$p9@o3fHdk-N>q=;w3K`563Z}}9D;0?FcUWLico6DJXvDzmn*$G0m$$v$VM0eZI8udAHq zJ@qlu(#=(&6J7P3!1xe&28N|rXH~h{r}WgxRh1s;`u(nr;<1~`Y7_or%SwJdUTay z!e*6$Ti)PHMukjHq<>ZZQFH#kqvq~^M_g(^4+9sVM^3wVhZA97BrqH-(%wW&FTADgvK)g*Cs8ZTqzWb#D|F^Au}#<=&Jay%;oH~0sS ze^B1`wI63EQ=&yUIB5mFMckIVN1!-hB&)xc$4Zhxd{2hkV+8E9){^lq%?KIaoaIsDYa>30((+m` z2jO=-rV0vZBS2E^)n=D7#~NarmLw*h@YuRSbiJ2R*9f=EDTVZEHr1*XjXJH#v}!(+ z!*R*V{YgrP&IG_`9%{seKqq+Af19%&>rUx2Fup!mtlYA9z&Y+-OLHTZW1PvUSp+%A z6$}hK$=AD9=ZN?tEIiN-_Ds!n2+a*xq$<#%Aj%g7TU^@jV7M5`|7L!d#X*McT^PgP z=BuCsViyn?F@c#4NZ;@>Z$cAYkwM_tYF#C$RV9*^L3M6 zQF8w#ZUI~YDH)QU<~e-we5*bUsY}j;;bzOKA{%Zx#Jfo?!gX_@1rVS6Gsel@opoQ%qQvgdHgbe2t3p;qIKK05X%MM+Xv?J^kY<)- zeDnIyQh43O$H*IL4$jK;^Tt$I*m0xz5kBwvTrYSGe4DZBe7>7`0?g$s-jRBR6*diw zwL@>vnWvpR?%9ki7ER>VZ-?W?<7zCm=P;&HeHrEcZklX8bLY2iD<}11B`x>M&;H+u za;#a)+VKj-8S*o9@f%KxAbv7-jma5C{1(9xE3~7OeC;o3>t@Q8-&l9GzojzyX}z)z z-zx;^0vRYXa){J=$S^8ovL9GpXf-KQ%*33tCbbm4L;!YlE$B{=1YZ-dRNj(Dd>7Bh zY1^Gd?Vkl9YfG2Z&eYBh=plCVA)`r9dD!2;qAFr0d_Q%xzfC&_?E><+fzdBPy*z)< zUmlj!54fee+lTFLceyZ&+(%IZy7$^;eUVw5fIIu`6O2w@oj^F&?FOnE+qN51NEYxN zGhD}Yu1Z;=k!?r%(?7CBH*|wpY!%W(H?n9prrM0xo27{Qkljv_d~U$gqB>W5whvRN z97Jk~JMiZ8Z>W0*&s#@YTl>xt?@9*-zh5#k7Bezh>{!0$vH63RreGyI!oIERcUw=w z0&kphJdnw=MiDw_8n3N{yuGU2)Qz&pYmXfNEM$)tjc&IJ@lkowU#NbQSojgbuuCoS zHAtCaMbRKE3NAjTa@+8lEgQwU$XNf%EH%i+qgzff^Ln+XJXmM5>|G|X)fh29EO>#< zX(HD}5gA{39HE1<=!ifWi8e>DAF;VS1;|;#7{-MBj?6Q#V)~gFMZvC-+f+}}rJOUWAMVl31WFw>>7NncpDtl1c zo7U*Xn4!;2kq@xR*`wnm#QO-^7_S@{UDvGi9=5ATdaNftH^Fl*f%A6D1NP=)0v&TA z*57j&)Q*G9gYcFo105sprtS)-_)0ee6kPLaST3HV1uJOz_<++%JDKe4Me1ZdKe6(n zKP}{~z3qCxzzqm`o_1io7Y>u!cXc=Y{kk>Pa?i{nhsaj19fj`opYx=pdPw z&blPjNi&X@M@)=TVZA<3_BrQz%Wpv;QDGKP#xGG(E|CN=lK3k-fP96lFtc#l*rj7? z`h15VD6jAt_3oP}C1*x`%*MH*=~umHb{B<1T(3kWQiG*GX<~EpYDicuDZnf2LsVq{ z`Un|%M|G5ggl^u=Z-?g&mfpNc^A`KlKo9TTY|}Re0N*>S-ej9GXozb3o9eN33tdM7=41| z?_4eWs4 z=I5s^NlpV&eDUNz(PXqKDUg(5`KRdgSk8r?);k z&vP7S-5Tyf-k;Dr<t*UG~F|c9-0{kC!RKvu0+vMi$lq>FUvjSS=qhkB>pWe zS+);PcLnEKbuMrB+UfL-bnX8<)37TG4 zwk<=_mQ=8DW?ft-Y!oszTXu-EN6zWKuiiM`+==QZVKbnF)xiKqT^%d(7j`Xw26j^M z19AgyF6TzYX#H<^cKE~F+l4o`+dq`8g#G~>chcTq(!gCi!~ZRifa7PsTp4=nckBDX z<&0B`YhY8I#2n{5?p4GGv?20~QZp~hW*dc6?bHO%-4`BmUqMenkBOgQU5QWAv+M~Z zcc2|_Iv9R2wFMg3_6b~Bp2}VepWB|&J>$$G?(7L+b06|ZSt_dHgM7nKn52b5*2Ypv zFV?PB7o>$sAuPD16BgPQmUvnsu8I`Scm{)a11~E`W&yKH6Jg}i)=1w*ooh0m0)gj1 z1&IkMgGL$&(*(8czsBa6f5t^;D{DUn#in9CyDSRSISGo&zLTV#D8Sh)`i#BQEts8# zbfwP17}qroF}sn{!tJ5VIJi|dBa=lwVH2|;9X)-R5t){>Tt4O2feUi(aY7RqBt(7jA0pPjj8@XZq>A18T61s>)_kN#M1PLVk!)!r!^&U0#RnYT{g!SbF9js5#q zw~ZSJa-^<5yHD{=7O3;dG!!Olh7DoQX=!v>nqUCx)KGMDAA}*B+$6DN)^gdu88%^2gBAF@@-YF_XO$vS-pK zaz@o@8>>FQZT6!ldYa~)lMvaW6vAfa>o+gjl=CE?NM)&NiZ8A1o#2Q&$(zYsmnQ!i zd`ClyB}4mh-;P5!LE6nwX6}WQ%bpAYDz9A$m@V<#s$V#KV;@ZaM!@`sBZc4r@cSL` zE4LWt9wGa1RVH7K@bvPVBBd|6>UWJV*_{<+3J;|+G!O$~+QSr%SBEYC%k#3clO_8V z`pfUA9Tzx)ojcY^vtna+l!+kN-f#?fS%VGujYw5o8$2P9=dp0?9ue3s2noN+4z~(% z+md7GH{H2|9Z1?k)wG^|uWn-Mt}_;h*wo71UsC(Htf*Y$oh%%lcHhiBaG;!kIV(7f z1^RlrN@^aK%x)}n+!oai85j<(1-^N2Q_RkPqo9CgzcQa%agKeR$l$g4QX1l+C1UX#Tj(E9J(c#) z<-1C-mvitdd+=O7W=z#Tu&;4$3a_Yy&F1Hg3p+Bnw!M5~N)#E1DBYrrV*jk!aQKW_ z5{m5DZQAlm#jN6rAu4@9&I37MPm?E!>;wa#J>k*dTAtXDu0Z0LqwTxVxBXNG8XES? z(AhfUkxLdEzSXtbYcg*)Uaj2D)587@lPA?b@RMH2wskFgHVV*DZMl@%|B??;>u+T7#6 zZ@BkyictJ({)7rCCvkP)Vg1rKcYNu4)Vv{6I-oO`{>gKQvTyEe za$%me{5Xih==+G*(;sblaQPhD3llh>@<*y0-E>4)KeBWhUOmJ!5>QC*Ag7mvP(EX* zTE!3_(I=@wIW|KVU$XQ!&zJ9S=WiWB zJ4N;*a>Bx^G=I9AKF^&b_WpAUv4k3btErzop|6J~1A5u;xo+#vp1{I({`{u@5lYb+ z@bV+v_tgC#gO)7pAn@h>3vqG~vO;wZI@uzsnP_4i#w#xOXuVnbGH<9U@3_-6i#e84kG>Qz6|+WWbekZCvT4|$g)ITdd1rf9qayLclRKz#sX)=#n#sy zIHjVbY(ZE)eoRbs3|E94@e&4zjj@gJji^Ktx!8)GnT=@N@Sh?`kmMNpz@M)Kau-%< z=nCd2R`lW9u8CJwO2TdqUL!XGXRl)=r0fka=~k^|P&@xEX1q&ok;$mz zyw){6A!)hid%Q<}NC<7X{kXH<51;?5Qgmy^NdWjm4?{1Nz;h+KYvF#b>S@O!0N zjvBzur0A|lan^|V#wno01>?E&FTo#ntW(ly=Omz!2?e{AQ6R< zf?JhZI3V%`=KJ`Zu`kWE?KU_2^hvEZ#RgBPI zk#4Un%QVuzHk7gAuGzZgv{%-eQxMy=*~NO_u{U4WE1b8Qu2RJzb+0YXW2Wx|7-l2U z*Y804sUdRU>A?9|TkzBT4D%@Zc1y?{S;T@|#HBEl(%>_Btod64tdf_4GMpz{2@S{J zh+rxlzRS1TgC-X_Y5Y8DL9(_`ojGMEi=y}I(5e2Y1`Bm)?{%#?MN68T**Lj9bzPp) z*xGT#^N6(bQk-o`ow8#K!IY7@?yj$R)RRE@t65!nj(sVoh?&N+%K)DQZ;=U0zV#$5 zY+AwtOH_^20ei1tFP4iKgiR*GkCU$KiP9`&JN`@u^=7Yt%_BAy$EZ9#RKEsBr>d}0 z8Msk8j-c+Obx1vn%qP-isfl|5o$@J|T4*Xl=v62zWi+q+JNzFx73kRS;u`885GgRY zy_OgMrz3OORbPJp3=h>N^b_=_+pRXW41(;=X43fjjbBZ#t9W5pgZ66`jDZ7fh-jRy zgo3IbM=)vZzDBl=wst2k%TwR^wW@yknp6qRc@%jSJ_qICo2(n09_5R&<`h1v|2EHc zj#}V6p(_@n=tRMq9z87^sS6)ZmAeC;WElr=i1KW7)I7j+MtqR^DtNo(MJokzg|uI4 z5D$f!%Nc^J1C37RuKOxqT6%y+ew5DfVE4)m*WarC#^bx!PD!sKVW{bG)}75n9Ay1> zS|$eBIswYD1yd~cu4)Y%TT4oT7)kZxowaFC*>cnW7GwPXU>XNcv#63>hZzIuj@>s- zOAe%dlc^IMyP5h}44k-kFip#qeN&joQJ%yvxIrc0ClF`f{On#n9ufb`ei&z?bRnI& z(6F_7|CXf0dKK7*Ng7|6w5hJ0%(b8;xz=5M$%k1!6g;(Q(ToXk+XE?B^xby48M+}2 zSe!CXdsmb2a{oqa|G|RdE8hv^rnm}!VA=MJ+<-SM6-ii`C6pdW9H9joWz%0ubH;;-}QsR;h?th9oOXDrt?Z? z@`l}t^lusGS1Pof;795;@m`kHsUGl39NzIwk7#Sfe&W3|O2qivFw996=vGAI=`Y;k za)#f^NFr&(E5QpF?Zw*rl-QLf0mcipBJ#P;QBD36a7jDI=* zl4~Hou7p96)a}E{34o+ESX0#j+XUVk3!?b_VWIg>&LdWZOJt+cdz+DhY8;vNeCaMK z8YC&GIjhy(rex{QQw>v9$DYkfDb%eNQuXPu6IO(Wfac~)sW4SwV5H5U_|}xAYwl!k zYVYF#k^U(=egrp92rdn~Rl9=^GIPw`D&zQcVUzvUe(s2PD-m(?)+YA6xr&7{-*Vd> zWNyvO3My|A@_x8G^eSXpFgTa2<{GPMf8v)x{2KX$Pb+#q_zqS%6ZsS@KLdGxhWtoj z%LjMp20#aM&xH-7d6(Y~dLoUWW&dNI^xF(CJ{10S?p9i*cnl%hPDe~{*Z{ys&|=RL z^~D{(aSFiKV!6KbCwD_EaN@F_$PqcvfOHgz0dt7;Q*(@EDJFL^t@+iyuZ$)G;gP^< z7?a=4R2ogE8~lx^Q^KcHIJs&L)ge4A`Z)#tTp3P*5&cu(h^ajRRT?~o za82no54~kb9>UQXLx{MK5_jNzN$;FTx)BviUE@NV{6jcH zhzmMVINij63)*9)ph?Cj;VtGZA0W$~jx%hbXX6dQT~BsT71)r@Qc|Hn)4rt{0%4Uuj?lK?Gi(z4^7V3i-p2bF0WBR&>`t&v4M#TuvKMmOZ%oincNXeM0bnu`4 z`Zq4!qZb;30A#4SsBW0Db?}a*LQY5s7TCEJnLWycW2PNg_bH6^yf@Z)I+ITw^~-Cy zal!+9f3LJWm&p`#u#l1qR8>CHF;7P$R51aYe=vzqx|LI~P*YJj6-4XL+&nbZE|t)N zk2t#tzE5*U6(g;XEFcUQPn;sr>5$#iJ%9TOZ`0yo*u;ouy9Syeq)xc20n;-?dc75X z=OZp+OEyDQ|MHgLRye3v8UA7?%Cch5+V(G(ZkMqUzAaQGX6m3dQwb=3h5?KEUatdO zG$wlDAxo9+#H8+d+kQ`MY-tMa?v6E8u7-{B);{PF%7N1I)bgT}@RCZTC82Hnu8Dp= z?DjlsAR=idpBkZZb!D$Ls99+AD{qY?&+}|pSKkmt=I-U9#l)cJQBh$n`|Y=JUw!s2 z;cB4AN?S!DQIGZ&Y(vo2gf;-hP;;4(yrvE;xNcYN~<6N?z?H&e$ z(}MA<6b^{2Z!Ehi{#Mi3PLNeeKz!zswQG+QOwt)fha6GPj`@|6E`^i_i6%uh9m*h) zq}n~6n=WaK&>P!s)H#0veRw_A)>>{X7R5@Ad-N<}m@`Rel13=j2h?fA3}Y z`QxqVG_bcLTdeA0`Mc1wZh?^Z#r75&5|n5FMKQ3&rLE6?B(<^*${$x^s(WIIM3MM{ z52}qf^lny`*--c=`|&c2Hp+f~skb9QyzlaaiK3Tmo{sg}xViLg?wJ;*5?{j6aIv!! z=X(sS+ow>AiF>qo#QMG~=3*+?U-lo1PpfT*&X0njUND4RUJikdLE?4rmt&*+uiC4*mmk zCqCL7Zvz7_hjObxZmmBO+cy%JzLoGAfZ{nR__{AOKL{yuG+0_KIeEWpYnLUJY0Jts zA^!Sjoa$MrC%7LvWT8tWf6~ZYu4L^q^oin4A}H$*swR~BE_tZnDvoW;8RC98EEP5o zB!Q*KL59PDMX5ZhtvrM}Js8AeMI_XOuV>!nmN+zR7zGOr$H_KoGSE?Fg?~~)RHvV$ zqc1*L*Ztv|AFt{x{+51o{_ye2@Y+5rhFu=;gFrXV-?GrJ{Q^5gtU5sbPwWNGpOuT6 zp9=0o?udu3WTH6tIQQNS=ce4lL`tQ=s`IR~oFL%jfop-d;)})?-%XXQ6z^KrjO!_e zDVY=Jx3{XHOYo$B%WuIo&+95tz0+?VrgQ$H>;r)ft_mS%AKa&!?odi{!o~nFP*7@5 zXc$_A34Nc_9g5lNC2$1VDWL*5Jvn=yCT#WCO&B5?m$^0qT^m5n=4>5fy6DWRr@9XtBp3vWsbC-CL0rWGuL!}QxYsbOr&LQJu3F+{m5|nOz+UMm z2TaR}F)f50+Yfn74~Up{5>L&CWxAQOd{U1~b6xQnz7U@MJ_QzTL?D@u^~rc|=LHak zpZ|{ohh8g(h;M~Hx?fpz*gT}3bg>R}KL z9HOlSQIV z1X{~qm|Xa4e(X3OXQQ9A!T>dl0evU`nLu17t1)GR)rJH3^zwV0w_C)W2#Z3x>p<9_jHc3QF9epFPz#_b(>R^pNN; zL^CTWy6zYkREDAwY*%yiQ}S>EcMPUGn2uaqO<@KE8H`20+CC1pJ_V@F{bcWM&=}Cb!wc5HZum}-}yMa^)RHDOm%kC zI;SC)=~2ZuBw>ZHb*f&Tw}0b*6r=Bjup!w4I^I4Vq7_f*Cs_guPe zx}YIvbu?QG=*^~x*L#mG~N$)%G^enJa_)5yBe_w3kU}eKONnJw-uFC{R6C}e%S4!+TA45MMy+ha^C_|%rKs7=mLzn*hEYhn06ZaxA z9zqji9h4q~cJBobe|9?}pG2DspKSSG4K*f1f*U3I5(kOrd?<4hR{LRn{%7UqI<~T5Jvc8*DQGXVRM!4VQ=ZcU|I4t??l# z&vJj!yg)1}qXE zz5?U<95{%CLjy*u1SAh)l4w$uu_>Ur3YDoc%fo6Z#VMZCiqiYiFeb7gAUH)YmIBG_ z`MmS+NBCESV6|`5Z<>C(e$sx@%6L`ro+J2oSa-;H+H!wnu4?Ep3IaU9V?##rXP~{&a{b)*mgPs6G527w{`saROo^YfN825PdPy_npg>Jg4U!e37a!J`mO@b(z`hq6P0yRK zW~uUbvqFn~nPW1b`4JD@8L?q{$M)(QKp+@L+?id1;dcI@2`gW%KH2(E-6 zo$ZewctXvXu8iDwT#S?mAQR(I-|@P$A$Y&M@&hrO4(#D*LUrOMERrT%PaV7;EUl%P zY-6rGTPrs|rdA@q082ZiRw{EVaw~smCTijRxYt(A)Tz)LiI*Sgi}^cZ7B5cFfYX49 zGK|Zq;iu=PvQD|pyv^i=v=o`5PH}_;fxz`ueiV~0i7&O=iw7t8q;nK^mtAUI>s(~U zP72WaTU#Fuk3UeWB|s{1*T$WxMX3v@S%=v3Um=Sss#gMkfS50qVAf;FWB#M#R0s^O zR)&l+H^#0JFEaKxLORoM6rYt15GUuM%f+Bf5+r= zsImR^kNtqiAHcE&t%n=Z+E{B7DV@mI-<12D-x{GPw1h-1Zk``<( zu~#$@EFabwaC|OB3C5aMfnw=aEGMGx@Mb->V94l>flNpI>&|*z2rB(D1`@qHfzP3? zVI5ao2v>r|resL9v4{s}{cz?wYe;BEXpqIwo4@DjbRlm`uZ!H(@_czLq~t|$ESVV@ zp8yZx4gN)JB9EVre=PmVN09Uhf`IeNTS?2xwN&K;5~01)m{>{$U34L z3JeOeT5yg955T{$+_-p0cpA=8wnmWFCEaE`_zx!G&z=YrX+d-XV7yk6$E2M=?0`nn zeNa)^<`oi#vX3y;QE3jEi##|weJ3&L7E?{_)PXbF&I_`oYS%jls%~Q`xI{|Fm-qIY z1a?;B{V<|C{X3o%0cP^m2@LAR5I(^9v8{vrA{Mc@fpF;X}CrUrd$ zJH2K|_u1M9*{ELXV^e}WF%rm#{!MuP=C|~ zv0caq{L24MVc9>3&)77xv)Wlq$xnpYWdyh`3^+6sOMM)!HS)Gg&-xvsa( z$WkH&3HVk7o>wXv8IoFTRdU!myFG0>-MbufIISe9coJ{Vx-snRtP2TRMHA)O0-euV zCeeSt(7yDNB3QNZ`_i0S#mek-#6EG`h>UC)eA%q!-ceY`>!^x4&T6zurA{zFyXN?l zU{@S0!pBNnbZsq9J@Kr9(mvxy{SomipQWCZ5-m0d6<_6*G*6n-3K!D2SB$o2gZ5O( zT$PX=J!jv}(Y{ZtC`}F0{OMzGNzPKsyDH>+C`FL}Q<WA_xz2YSvJF} z7GK`3W`vE~n699x$j$U$_mt8$jdC6izUNu1Ac6BHF7RK)T*_c)6}a*Gt`3r%ZMO~O*A_zJ>M z_l5QP+4|N0?U{uaepL7m>L$ZSd0a6L*GFzaFmOI0!O}_rj?{VnmukS{oGnbq8lezxw*>ZTZ{aLuV4ePPk6z45hRD3T49O2(-#W1~&$yR&4Ykr%Ei7Q; z8{P+NZEG3wIp-euC<8Z^o4@mxKC*ZTqh70YMQT%eYuR~EozWyR1iGkTsJ%#9t4r!sdI%tpfioVdB$&hrI2ot|L=$XGic`9uh0DLt-=~%ZCBdM-kL!rZ zLs@0aX~b|&+A&BK-V?=vbi|}F(>zdVZyCopvWDEpfqF@nBA+tK7>*lJLyj5fiq&5b zCk69ksE*0MMOfM(QD!hmr*P^LNx_dY7L}$AF(v4UjaX+e6_pZKOwxb*%5{vhZ2t8g znN6bO-dA}<<`{y4ra8X(7Nsyb_6w8p*h)FNHYkAzuv#MZg7l|aTWnAn-L6FO1+zsk zKm5zFG;mrr@t%MB&`pd@{oiPi!Lh6TFwZfpaRf>xh8t%kGr2i*CA0i|1kogx@mHZ^ zq+E@L?qvLF?Ol0hTgDqJ%IJ6wqZj5)4tYo?Xq?b78L0o&AJR>NxOf<%-5H59hkhjt z9sl|)n1J_7pJ-SSUAR$#NQOQ)!xsXOJ2nB6Yodpsbpg+!NG}P#v@DkAVVO z8G)n6_Im#k&;X`kBa_0vu$3}=-SDFIta9%8>IW(&x6V!)5wjUx4-HxL&_P1z4P&2< zG5IVj?(tprZ{@rgTtReRjEL^s(e37$9+-KJx`HuAO}hR#;{8I$DsPy-Gx^;~R+)jo zL0jYcH)Nwm$rl`#F}z9WHzYkKL^s4}-vg#&sO!O%Ns?cALxFCI_Xr^gF2~;6Qy|?( zhK55ixc}1(tk<&!&_{B z@BT^(csgJ^#(M;@9ot+E?@UhleR^hKw<5UKFdbY1H{D}X{nGPC?rPH6h!*{&wh?XT z*4KaPH_YN=sy-{Y2EL6`C_eO76Y7Bh? zzx^~{(02E4p#~Mj|3!#Zkh^;LVX86Cfmkm!3x_Dt_ePf{J^c`|j@Q84(ZB(h<265m zz>FTkqg#$bji&?AOP#_IpqXG0d7p0K2-YL>+yU&HoIe6^$TidMmabd2a4mbzUwx8=jHXwU*wjL)wn$G`geeLHxkWV|O&Zw^Rxl9CVSbNe~lKwHTHKFI+e$pKEuuush#i`gmK)(zEIa{B~w^Nb1R zc^oiUGp9$8r@Rw=mo5$%=l~6Pp9Q7}89cstCIFt!r6>ys7YTJx!3&AL$wVM>Xpk}H z7G;lOSe#yiJ}4ajpI|IL2)7VN)w0hGdn_V7M(;JU;njAQO-i=omKSvpxRw&xpurxL zs0wm?L^7jh2}&FqT&pFIXaEsJLBMiyp9xQlS*skK1q*^Khn>*Qqolis&ToT?jVl;{8u+}j{>L;`Djn7$9@w!_*@|b&uMn(weVYkV~c=EJ|`vg~K+ME%v zUk6O$xAfCP{osjmO#qQt`q`keCxZMrMTDd1M{b7+*^)t}5bv`D3pLa(%XO?FpCs|$ z1t#4URBB*UIM%_jGh8vb5R>$9SqP zHjt7Kxu*r>hqdb7@d6RLK2v*rA}^5#$F%=l@Xuf!lwW5HifFvWdW}qOGy_-j&mL8$ zL?$93kqo%?02{HW3?u5!aNA1d*W*|Rbz}O^GbGnPMK|I>TQFN&FkeL0slyIR5=Mj< z3$S#DSq+k0>bQW=2qXCSF?S^-{9v1J5wuT_;XwYI34H63MN5^td|iE1N@ud4&twbc zQJ|wEVFl;_`_81Hk^)fCZcxx5C~FXu>u)DjOtuR=;N~S3sJ%xA^}TX#!*)#%_mfT| ziq0*Hjy={7aCa@7WS@HMkQ8koywoarD53f=`)w)voxY}^^rghlNU_b?46$2VwWOd)A|Y*zN12S{ zHERUD0#{q$`KOrQzn1ZDO#WG4`29GH4KFJj2v1)SkDNcUp=YACteHw-U92?@C0n18 z6fPxHy~tkvjE{f!<-AAhi)Cz1OFUD86tT&yO~pJ;;}F}obL67|Hkz@<9{!re-aPI3 zs9io`ro~7Z!U!3G2pPBtnQKjdR0$BcXy(xPnn&g5$*|zas=-qEDVcheHQoa*4(S1YlB$es1?D zlt0glndiU555|EBPB*24@p-MpLW|7KfvM9ls4}A$U zk2WImX0|mfJBT0W#xdoX{{%i)1izqx&o#m4T;TJH+lMDa|G(jn9;l0GgynkXDedB)*UVGu zM<`69C3pW(Tn$rP4N{my{ui4hNp`}7d(k354)9_`IOjrLRN@@px~WuhgAWGi&C^p9 z=dl5$_?;o7HV8j&dMa;0#b{o|XhDU*V{+uI5@lW`Z(fBRl<{&_iFQ_*cveZ^KI!DO zBzRWoxu9}-S7P>6>HN_C)I;cu%4?p_Yu?ApO^~#eh_n@+v=xukSQW8{kkkuW$R0=N zS3bHBIcY02X)D%$dO;$(5F)7;8$<`%cEZg(avIB!pQhVj=PLz!zaJEM+Vg!$&P+gjrgLKpJWv%Ygq8;GKo##H4C#al*@P3% z230+Ps?cti9m%=vevl-{y3h&%X^l(mFU7}K5ilVLx0Tr4?1Z^UbJ4>(?U|hU~$1rfiR{Y$l#nrcM!!h6a z$-^#Bbl<7vRA}px%r0-oyK@@k)M6*Nb@^EZ-kj^paU73ODqSg=P;>Us3}AN@6oAft z)EG6yC0J+L-fr6d-E>W(!LfdgclCGW^6$wD@3|B#V_4D`_1SJY-!S_h6Npg@v3rw(7hJ=&B?6~f_vIfgMi31h!&9LdA83HpYeQw zNkB;-P=IrV<*a?2`i^N&#?tk~N2zEfix;11Bh5kpw%3WLkAA((_+v9ZBJ z@yVxZZ5N+*F1eH`%4dUKh`jw&p0Ss~#>K=6JgO$Ls?aj2MLbiprc!SEJ&5zf} zgU6_u*XS~rHHWxmwVc;Jy)|~zuTHmSHO}xyfyJhjJUD*i8Y#BOUqk=6p2lK{M>$W6 zv93)S#mG(#WvV7Bqo0a5U5-pkGyQj@=2rHS5;i6b#T0|tX9Sa(E(-56lJ$W~s z#86|yZtHd$f2y9v=+^C%8_)8=LqpY*cf-jL=Yxmw!SgLX7oEiTav6&9xj3KeJiZ+@ z&g#iKoX%068qQO5KF{{^dA4(&?J*u9%HuqTCwV-aoX43w{yRLbe}gCYdwHaPb+lLh z%c64+vKzC=;EoCF*jt({?&|gycXdnn)^$rQ;hu#Kf5&c2AcL_NICEMSE?UZPYkPzY zy4xp*C%7j&cFbD$-SY4{Ry@l+c?Z^2&uQ4PPHvyvJ4>Eb?QWgi*jKkCwER4Aw~UJ0 z5nA#+jV)n~g_x|m<=<1hoE6tGS<9KMzF~(Jm5o&kqPUMH#G9%b zTGE}3f0e0*&PjXeysjCj(>*}qvdNX)ypQI`^P7>v_@LJMp`Yc zJ=4${i8YMXF~XYF5~>z7$cZhvExwi-p(U%ue@R!bZe+y0(DPjn+h38@s~gE0ND_&4 z&6?GtowRy&ED6>e7-h|x)g+48B~~qH*aHaHfUIsLtJkcRBxx<8_3itlDW;TBI3<ZsMsOH5JE$t zp~Aqlu)cnSJeE3AJxLx@PI`{oWA~&ae^?|W>kJafP+28p2~LTm#hWE!)SD$@(_~6; z&`b&30-WuxYe|Zkx?MT6q$Fr6E=o0Ng1I?vmqwkEVopmfE*dwsM9lf{;8l;``?rHv zK7QXHno3%lCNy3WY+W#+k$(N&zL6iTAfBJU_j}T@eB_;n9=W>u!qvZc@6oFme*$6O z=oWKTe%SEjZrGH5*uo}c&10jsh;pnq)f$W_{c>U|(ZSHvo`Nb)o0#@%It>PZE`$+; zE|lYp^@c5m?FPZ{EUiU4?jVO?e~}DdG?fn-h73m#Dh~}wlGIcxNreGOT}=`(78j+a znAL8lE2ktlwz$}+QM-9^9DVJz+EA!=_$~%td)k+pTk5S+`A`0&v>?BfeT4ae#7X&i zeiI1$u8wF{`QagxceCKLTv1c9!O`vR&c4bcdJ^*7Qg%)DjoB~8zmTAre-=L%%h8^_ z(6bp|cr+%L!EMMkc=o&YyZ2}B_h{q2218{7BFf))vV<<8^!H5)1sRt0WhL93{kr`+ zp(mcGi4Y-2`iLNq2>EoU+MSKG2u;{&sL4{rv09ZiL5?q+&2jIXlDG(+zKftnqfON9 zp-bQ-NxM4LL~YA8N9YncM$Yz`7IJPy5V7hUPn{hED~*qfvuihNsn(jahuldni7Ias zQ(8%q49A%UH%&i2#OKWik|c$OhK!}9#4tRu)Ng^|gy98~E#f$T$ZtGO|F}~ZQSa)q z>sPFtnv<4PnC+d|@u#bQ`&G?Nmkwl2nzrx|dFlG9@@cDOSCu!rd`$Vy<)1t<_x7H4 zP_SS6FsYJYLndvKZQYrhGatwl$}{F!>oXQxcUx6stt3+}E6I!~J$=&LP$ugQ^Oz_e zV`jKVo^w%tNNZDnW!h|cHg{&Jt=1-IHfOH2-I@7N=B~^)Gn2A23o~EN6ilWJmn}V* zA?K82xDrY-Y7=z9t1^fqGmv?uO-RTjCTL<4;Oq=w^McJ2Q?fZFHSJvL=vQmBnizFg z)>Nw{BQrBX*UO1ko7rl$*)mftndwY#jE3}3dKSsjSklseG;(@QQ1fd#3#rhOhmnK~ zdb6y9P1GkPTI(!f3$;8$XCf6My-|+W5{*Wio|cx1XXrv?KuZ_OwhW{?QUj@SYJF;F zYESC+)cvV(EK5_LrS-_d9b7vMUvx#MUU}?1!qkOL!}1}+aQTSDXhXwNIWd|_OK&QW z#H$T2z*NeAT+XPH?9A}S8G?`+3j?Hz`FWX2e_weP9|1XTTt+BUHYc*&yM4CwAj7+I zN^EjY31>)3H-v1mEj?&+B_sv;sKpzj+=dj6cj!ycT~!*pn$W}&Y_W4^^hk3<8M1jy zC_^4&4rLsMbw z-l7&;)IDmdw)x02bO~JStBG=)%iwmn18%|1>L=TEeqE1li%tyaWL=9+&{?HDBt&kG z8jP-{>BqTR%wYO4edtINLc>Qw<-?LBl^ceChr61Fj!1=pstvLw)h23fqD3O9T8l)i zs&t8@X;P%9gK_P(q^pUfj4duQrI^)DS1#|S}vOP{KCM6n; zn)uGR{x}+EOVL8psp;1U8msw^-DhnoTeOU&euP5h(}%mN7BuW6vaN)T>(e%Oh_HcU zdRJ~JHm~)jC(ToN$H5{NZc2yFXFU~V;a4eNkWY_Nlvu|lYB<5V~$i?5NSC`%B!h=a}&MW z?%wPc+-`qnjalWd(dcZ?(o2v=l8{3$=@V?l4wg5PB>3nheF@g0vmVm)A-=jW#Jryr>r=SakE%9KcYYNkZ; zd?$cgDzidmh@G)tXgW?GhfPFlF7uCD#9 zjT;ZN*VR=|Iri+c$Ett0zJ2lf^^4orTW(#l_l{m?$MzqYj zpk~(03oe*7@;p(E3}&QT-5NSlHlwbrv~I@m=OdCo%cx5QMILd8j|d&mAsrKTY4f4U z2Z_)jIW;9IKUJTfnvwv2E3w)#MUypSLnP|YGVO)Gd^)rJU$Cjp^fG!C(a9*BmlLy2 z-N~k(u$;kj()6dJ&eq5^;|mH(OA89dgW`4NeKALT2X;t!NH&RC<}5l0ay1Avf?k)L z7NK80ZA(6-tFZ|}gbqEOSLII7=a8HT$=c~~tNy^wotd_Ly@7GWry-T3T7BKSqFyB58cZKz%2z&QIAS=_h0yTdLc>Q4M~tRYQ)wxh zx<;KFjq+x1!syb~6q|}AV`GLX#XOpiDwS}~DACu{ ziF=U;AH7GuOp^6kp&V(Pv_!f_+AO^!sofHJ)cCUR5Z)vQ4R0FXvc6^e(EFt|e!g`H zU1nTtT}>|cuJhewyw18&y1{p^_imp~Wz<>Yyei*#<2b8-Oe$!VuEKDEaUN|j>bw?x zR>;VNm?O%&a#DIm(BMkX2pSo%GGj14JtLTA&7(O+uhnDo!DMh{W9{XGiA)0D(ht(J^QWYbKR`ymzvXUHtX5TkbFjo z(g?jwjyD+127}Qm<>j%g!)7(xY*wSs8njT8*9DW$1wA2z^^2bn5~0I#LY&L#jE|4g zS_g~~+9=0~(i(|Mk|B@f;$bt`vTe;a(e@1e3IIX>p}=(D1DT22&?F>~A-T|^|Q(GacU zjn?tT>Ud*yysi|4@|XuFd3B@HKx*oW z+S#UIChq1Fr{=uvR~m^;0u?DrJI_%{phD|NQc)4J3?rY`hAJ;4l{c~sd4~M>g0zB3 zoEoYvy78fhN$u59t5Hx!1y^Z7K`A+9G&sjb4GF0wcaL1kA_D1vc#pUj4tNnH*ORpC zNG(QAl)OHzAhz}G6p(lEMASXf_o=TJx48g>R(*Kl`DeNWz zJ(E!E83K+=lWXi`0dtek>=u7G*tk;~IUFo$ZFSpnitp?gez-OyPaS%1L;cvr9U~{m z!mEpOw{98vY#^!*13#=6(^6kkoun>cpnsdqgY!AX~cKvw=L-YmX@ zad<;^UOtZ4nR!}{Wuz^)E$`BCSCaK9YjQ6ix7)faGr{kAh5!;kCdvo84DM}IUq-Tqt3Gcgn<_>EPJ|y6R!QC%oiP%hGO^A_C^W=$pLKW= z3(48X#HHwx5|a{=;*&&mjwjbc)h1)I(QFjdPM5<))nnqay~Lj4_7YE0o|m|cSzbhU zEncse4}Sxi#u=ktrK%`3EsL_zVEr9cbrlgbEs|G zNLy_vM09UoF=^&3PucA&-Wm{Gq%^;vl+>0=ci(y0!s}k@&hnQQsjsWrBkdSVM|Ty#N|6ZINP%vOT@ z`*pr+NUeMUw#v5Hm3((0j?bFPR@6AH*7yva$9{^I&fA4%(oZPg>Bgn%Ld530`yXuZ zzL1)@yZY;ij!p4cWyYBRF4cuA$$fTECFNY5MPxuqPuCk)qqQ;`jT^owj@W)Lm@lSV6 z4Gg;8_G=8TjL_ASZVdcj(p`lQOn9JNo8nw9zu-LJJmNgzRL2#@hpL<#o%@}KLTV>_ zR9WpS3z}T=n6hBGtK9#9>t6ql0xG}jS%24_@@FO<@T*+1&KO$mC#GztXVOn_pYzEg zRbqMK#KcL0%d68>Hpl_LAA6$1BPXU&{zEQf*)O@AH=oWbf`LAI&Y&_+%B1uoS?PyS z>4#qF?@f|*tU-g)-8@%(6?AaeOXgw9>z@6(=mBo$$yt$ z;P(eA%;)LOxnc}aF-VGvloKPvdg#p?i51eb&@~ z?1#$_$ThQrynB<1#|9x!s0l)z)5Zdxm&u!)F0+&Ms#8u%4wX2kI2)apIlG;=Iv;R8 z?tI1hj`I`eNoS(onSOd{f6Xa6oqw*04sThooPh}pOmu{*gXIiNU|^y=r6yR;zyt;+ z%F|{C%Ndx!KxkrlkthdT6U1VY7qkY)jIq$N2@~Stv|2>S7qSk{dS{Pwi&NA%i8G>v zd#9DKg}S$lp`P9lM}0H+4fV@O#`us^)}@A=a-uo9q9&dAO>s2tfOZg4(4%u(bRODg~6JJB!e^rqp8$C8fxoWH57GPL*<4eM~KmsR+@HR zEbb<;AQnNBq??kMdub{y9e;foeUl-n{OT7*_gXHczb_$!-*s<7Mi4Ce#v=S(O);P5 z-9FYAyi*J*q4G=8l0p+*X-SN9pwH^$MSZNN7>;!o3l$bI%sP#Q4E3D;Zm;f4*pK_c zq)F-`O%j(>q`WJ~C8dR2a#C7|cV({C8IojUd?=p*9|L}uF+SvyIe%b1FURXb0VZf% zMpU5Q%JMyOlHM9}v9WV8FDwvI-hDbLIpp#sC7*i%qY+4n#TmPrnn=ojZS34e5?y!F zVqvk=)U;R)H}eE?$?dh=&3=hFQ4a22k#P*xlI0FdsP>Pwp-|PxmL*S38OJuCd*llz zbxbGW_rJ$bj_fC;X@6rf{bgi)L4MiDuP1!o$2ji2wQGqTM0pz!hsC`p65f3Z7K4Ra z_)fzYEQ%-}?J6rNw3L+;MU-9gJyw0FP`2tr^NaQsy;UTr(h{sGY3WwcmX>1mrg^NQ zDZmUP7znUOMPMKx+Z;hKpa-$&0|tx3B3t%bG@G$GaBJbMMSt6{EpTt)y+u#piNG%l ze_8Y#o(mkd9J3hO3ok9Yq43tCI|{cJ{jBg8MQ;`!DvCdl_GimG*0&1>i&R!`qQ0^r zEuy?B>sjiI)zqK2dmJ@@%mSWyq$S76@p6)^7js8#VBop)EMQX9LVkCpWKE9RIfMRO z>gX?UIUS?axPPpv)<9uRAt_|riZMmOLe{szvM3JC4i-k}J937_YPMLcX(+m&h!i=- z6a|aqU|Fz84$Tf0F@_>bn%QDWvla%5(nvs_U9v4e0$>;fX@x~vy~S>!7K=75m>RSN zt+cQxLO+)ih)+8vH?o>_qA5{S&VNx~WmS-2dEEHYplC5$+AMck zc3O^Dj$1TlOSWZ>Wg{oNU^!sXW?O=mIh=!KH5Q9L;OEa~5~H&&&Xf@H`$K-}XV%H= z=yC3MQaBAxhcn<5opN4@GeSO+4M8~A?%bRhBC;tV#BG_?pqDGFgL>KP3vSjEyWX#- zdTa4Z4}V8ZTbIOqLrG#GTB)h4e7H%H%B`kS|Ee?A3YOS*eE5s<(DCC(SiHzoT52j? zC6%s{2v4%79n1>Gw$HI-%)E`-HH*?O>k`s~0XZQ(2oBg(AAL|Zx|`;v$D;K2xu=9I z+;BK6LIK%X5ds4iZuj!jLIF8HEd&Olq%r1DfPX#M00Wko<>5t{iL5A*6(yQOMV16p z2y%ic6kvdJ==hTZJ!2b<2z=Wjk*=myygQ_(Z#!Ty&o_;bs1ec_zh$xnH_3@wp?}tf zCRL0b7pi@aq!H8mwW0AP{6Wd*Q$wMt(?01H0>clSwLGfv-hxsxd=I^pj4$wxSDkuy z^ncL_T{L_QAnaGd#b1ki;U(|v=8jN}K8xK+R!C#5gKQN%@LEeyW);(6w$ibdQg5YY zx_6eP$-CIH%sV(HZj79oTG_xLJ$K&kJ$DYXr`)5VsWExq3QZYe4pee1G!>oi>hGWL zXMam?l$w?`RW`^*Ihh#|)!AR&JI7nLz<=v?l$Chd3{JCJ%vP(#LcDp_%^TFPpJ8KQHFfiDOej$jYXMBQLLIOy`)MF~S&mLV0kE z&G$X?$EMdCEK?&_CHXW(9!c_*=1+0g=FfA_ zm)hN{-4FS8`F`)ycl&Ph(E=^oBGKrtEoQsj_V4%E&tFOOOtX^y#Y*zseO6-DRJ%X_ zdOMk8Cw4aQE>F-NQ6hcCWenfH%U=|HAzCEMRkMTkEAxMqzc*jVm#a$h9e*_?`4Y)z zGb!Ka=Q9dEe*rTO1qE8mIG=SqkBfRGi7A;o*1kKU+}~GF6y*8hGLB_))$Cx8dzbqK zx8NSAms+GANsuB+|IXPZ(m#U{+8~=-GCDJQGPY#&XQ(p1EE``?0G#WJmd+Y~e(cNe zMbpr*)HTFy=BTb688QrUr+>73h()*f(z5TUJqVVKG&YwFR?D zAS;+nO47$=lj2N&HnQwIqD7)XmR0;UhW}>UsYy*sO^d}j-845hy5$e%xZUKA?|NYS z4;}67s;DiPF~gcasdnwxKYwL=RYvmXhOQZ}qT<{kQC0;@JoQQj~tkeEX>$ z-5k0`wUTWQS&VaMynmc3r$irN%W3D>#c!F|I1>G>QFC&#>Fi4oGBFs9JU9orWGm*l^fz%%E`?h=I8xIqc31&nNd3 zmFSa0$=%7Dlb=gInye&i{K+KQ!Ag^#cSIkj7nO)GBZwY^p?^YzPVIBENWGN>lWarm zT_XmVYrr==MiYN_8S@0r2GMPnb8Q^XJVc6FHx|8<2su}eG-@|-li1VmQ6HZ!CV76Y zH_5f3Kw8bn#lIU_a6wuiR7+Br(;graeIaJS#yJe9jKWcaef(&6gRuXTA$}n4MUG&V zZSCaJ92~@c)BY4;5DKWt zpX@Y;k^|;u+8|tNLTywZ;Z zr5`$O5LIW)rRiLQ7}Z91cDCnS>gW?Afu6en$IA(_PEL{&RcC+l_M8V*KSr|I5mD0n zOq4hxO2*SEIUYx9w#UO2GbPoWl9FmhPEIsyHm9VRjY901lF4W`nT*L`kBcso$C{GO zCR4H})qkH&vQwzh!G0z_*<{X1fe9%>PI8Z#n2*F|1>=L6nQ=77|4OwsLr&{8I3M8Bh5{tyEUWHWo%hj+mda?PG)j(f*lf@YcA9z zZ9^a-ZR~UlEVPX&x7`vpl$J|i+t4l$p!|PA0znCE6P7mJmbTDs1BCwIw3{`d)SEnQ zl7E&G%ln)&BVPji&%(nwbJ0jx=X|&Kd%sT!QP{v1-mfD-R}G$q?*1*B^p|5Oq4A zC3RkJo7X#A$J-LbwLcuYxqu{3KmvLFqJQrleRL5<7a`xLw-#>rJ+XM=pzV~SoG#A6 z@;C7ce5aNm=34UE*y%bi064jOVuxL;tp^^EG(656bmbsm!WyfBhitn*8g#(9M!DGzi+N~o_qQk7^?znP zqi5&lzQBHkrR*_Z>_OKnj-SSU<2d0s*X{yfs`GPQG$grK@D`gp;sD;6hUw;xl3S$F z3Kry8iKho>!k|ZJf>zgLVSg58vuVl5wU(r7L|&DhX?mmtODf5DK$TeWoVq3sSY2_V?7hty>VMStTbTW_iE+!LMBLr+VO>XQO@rf&+-jXi4hdi9 z&5UPI0&L6p@D_9B>B+%O|WGt#=E@5SC?I=y@2t?x)J`8i2XS3ax-cwgx8?X}f7k+nHEx3MWIs&iTa zG5NvdDEWY005WKX_ZlsBf}&`*ZNKY?>pj=sC{iJKx02+w0ugf;k}>TA?Stm?j`Oj} zq$g=m9F`h`qBuQi&`b%R1%GL#6fwwn#Au>5*QZbu!IVmz0r7ico+fStLP*LWu98lU zZc=GRK?^DYC-1CtF&ulG@VFB?@n;LP?hI!^imehW3@Koe4qx++`cL^M{mz|!=&!%b zAIg0GD|jDdhE4bpZw16JLm4xDTo)?Cf>`OC(n%haQiT{YGy@3i=6{9L%`w$Zsdhzy zX-ZLG%n?^$v#Ut~b=KLfp!f2>H+Zd)acl0T1lh=>62R?&e0K(9>UR@K!j>fB346kp zN&o^*-Nkwi4uWAQpe+G>5=g|gMqlCr9}&)=7QuB(AL%~|n`&e4UHZ_H)5t4K;C*4c zV(+aZdmp{;zVF$ET7RjfrS|sgKdGH6S4D2E{5c-8EBN6joC}P1xBP%AvlmZ&rlme1MT!9)lL%>W4N;fm^W~M1Y zrrk;cGJo`J`HHEMFXoFU?5dNH*u~r7=;s(l=e9ffpk#iHhhTeC2@s3O1 ztBt{?qXQ2w#qyOf#p|2jw+kP=gruo8-3*zZybiUNmPwRuot7>FESMZ6H`;cAC`iIb z47w^-r57SUiI5%?O7u3!rFFz6=_igi9dAi*g@4|2oRm(6{!E;8{8>CN{Z;ue!L>V< zI0$irv>~`Lyir-7_%^Xqxi|5Q@>t?;Atvgy+ZbX!JwF&xWxTj~Is{v$E@8-Ifm0=kkF0(zo4`J250_S;q=MUWYUsvk?f zCHUm@-tY(fK9dXKBsZLYA@(nKZ~52da=KG)s{L&Hx!N(Pzy8%NPkC! z+@V2&vC;iT`rsDgTCN#FKy@;1BVy@gyHARUv$~ zuHrMx&Ya-8$1P&gvJ)q;7U|~4_2F*5djcJdkJtTlz#}cw-BJWw24S7jeIc;YW-=)K zmZC=j?z3J>TmzHSN&cHZhsMwS^w1TfdS}|JZT;N(Ww0A3{twmII+_Cign!26cRs6h zW(!@;(A?Z|>@*W#LG5z#W!uw;DGl#2Dr_UsLO9(4w<@-X3&g5YRsUW2clE=@4_g>M zqNHMxLh1qc8RaAOZ;c;i&g9OvFpWs7x70nX#u1u9nVAv8Lo=nIkw{03LNs9tc@#pz zM%o=t7e&|CPnCP6fF?@*aDO4{&vI!s;RH7m&{0sM4999W!cdi1v6lvTRTA`0YBzO= zdW|9x?ff`pQ>X&fPuZw&+km)MB*Y_G?1(9`{@9w>=GaioekcZGq1N7O>&kv&Y!LJH zO+am;`vhXe=-nrD6GF4#jJoCzBh3#!rum!ma=ba7RX|?ODj=h#6@Qph3KwerVoRi< zB~nO`#Re?_BjH(^pG`J3rqT&}Q&LO76tM2iQ2XV&+7}RiyS_16+siY}z%1hSMW?Z@ zzv`tMPNIX~Uwz%8d-{G=8-w9rEx$+K_2n<`LjT$N=c2`*@NfFw-yzk%e)+m=76yLt zOBl%2dWWBQVtC8rkAEX(NEiU}8M^>F!5@v#C=n zsa*gz&;VXJfPcDw?PEOi2qacM#xrk#f(XSSEHKC``DUw63>W!{=^rtgxd`OcPaVz3 zyc7tX=qC_Xv;x>ro{X*NHfRG44v(9*zeubA5+H~bd*MwacD#JPm{gS3N;WAJUH#Zp zLEXd|i@~H1XT}FJR%#=YfxblfQ(tr{LrshmZ4k@93r2l4wwD36#q19i5dqU0vP(O6;61%Jn=R$IfSG-ov=KV6mQfoC~zq ze@{!1KjF39bPmyQi}w0YapiLd&6k>Mv|zr0et)g2yUV(|SMKEw5Ic#7jRrZ_T!zjC zVU=!H$s1|s0!O)2N~L_Xhvlloisu7xfqN8}gh|J?19Y;(EV({iNux!qbKz z$CRQ%C}^b>wB|~cSh2rR)Qr|L1`Lu~S;KFjjcTW~NsU~q4QV6Vy&9>ZXEgMTR)wec zf`42dS*&ip3r9Lyd1n{ox*qKs?K<9dy376=KCt1N+0{9{%b2T|x{Ub?N?juh5uNIy zrKPTsixHD*;PO(Jan)d{E3{CzoKNc?l%ijH>B@bZyI|J=q6QZ7X9ic{_~je|A59qW zdCl;9F!r&}A2l%$&+446A^M4CSYc&mRev{5TAo7>_|XIS>k9azx*xsJk6!3Uf1!UG za$JQ!qI;ryN`>l3%mp0LR(cjKMGY`^5<7eLG<|lF+5Z7Sql42WC5QJh5eu`3)RUgm z8LD8^_7dk!QH)Hm%xRLPphcQ;A~0Tx;Pbsw#0FU0b~~}yKL3- z&N`nywGy_LZD?-2q?}vXT>e63%aW^&dGq>Si6`RGR2d&863N9ahOYM=K)G8)3$SgQ z(~`<&vzfUAU$2!>?w`1;kQ75bwII)%C;3!vp?PfTLUaTmXafLapk>%}82VAM8B zjVhNx^8*!stYKbHE}t)a%$nDK5RYI*0BU+{~g)daLOgl$GD%>Fh1)KMLexv}E0xX2uXPftK?A=XiW^;Rv zpBbN(bBFbvXKuWfB1A-HbDd|bu(gDrZ1<;@_QB47yZZNUyc{hXUcY4F>Lu4-S~vQ| zV86MbJ;mbi>icT9P1WAj30t7^A#@*LCNbJj8f0$e#cO5S4I1vt`}h1)}PB zgFeQ-Egto~5j+}tJMvb;d+c9`4;`K(p(7DO9QU5^jfFmlkZ%XyXn3D^&oM@Sz`id! z*9A9!Hau?MMLoeh?Rk=OZXnh>uA#4IH;U{04oP)8!z#(}$YrKc>NEz90}{MQoCPun z5LdjQxQebJm(6v6I18dE@r?enx;ntYL7e6=m`I$XbP)|cOfRGm+2Y;39HmdE7$g*) zCatP>(rtG6BR7Y`p%BpiR4nAN z;}H@7j~tHIEXc~a6G2vG3mLY6;qEcaO+8_TGt01>HLmMtPVnRWAF*tJ|WeKwGHlGDK zp=kC7s>;HFuxV8ri zV=iB@;cggDsygRxS%rcX{z|H|kr&-7y%sgT_3_P9hLmMfG5 zWB!toV5q5*z=pB;Dz;*Cips8k(7ay?m0+4>sxWG(EDD$$;Sdd6F;~$w;9Bb%ayjmG zL032f0T4vAuW7#=U%*NQ|;9Y0tx`ZgOj6Vw`~_#LcDC0 zDbZ05iT?8X;+@3@ijU==%fFI;gZd5qM#~uWUdtKxxq?7Lr`<_8+nb8*g(d051y>U7 zjvF*(w9@t|fQl%cFz1;K0 z+_~M3fDy@+0ypvMka}FT0aaHC^^Gvys7j0h5Li2Zc?Ky>0Wn(c<@fN1`QyBU5BEA> zB(4B$AW5t>7&*FsTxpB76%mymVNhzK)E2s^f4c?NqGB`N?B_CmW*me2E zgxWGZsE?zj1E^gG-pXP{oXy@x-nL+-X~aNf7-vY)W(@;GcVCEx#c1e3!y+`qG3VZ+ zC#^YV&8nFP@#sb5X5(Zs%J~=KTuAp|!x_>O7GFPZ&2|2NehlkOT0kEt=u6PB7!5r$ zdUssNT1AjD0*bY%6fOGKZz;`2tB~93G-0+*Dw#!e*t@a(U6gFX57-v9ezE(;#Y%H* z^Unu1Z29cn@2+}K=i*|qQpu-U*~0Bt-m^SaE?%Pt%I+RvBV*6mf<=1xA=k?JJ= zSy37VDd6XSxrT<+eV2T(?|Mb{uzFulpPp`QN@xASrf^sc_w`=?#ol$12A0+PS{DW} z6%KrRa+Ews{t{%tGkZfWwF>tdO3DvZEtQHosIzueV1`046q0i3G#qjtcN1>>)y^rq z!}(Ow4CJ+_>;n=)Cuvat9%V<$80E?rzh{F6aL{ zGbmIFh+j7d^kt~U2S#;IU^B{#UV^k~qzI#c@Y)gw5coBQXBpJp+i_t^}j@>{hBrk-{MYkj(QKPkCh#Aa<37E({^dL ziy!wOQkx+eUPCklBVYuL1|w>4?wKa*%{q*v%IT29Nvp`!r>V2D>SkQ=xQbFN92kPT z;c;j~$@FkWeUYF*7(|eBF9;(dR75C-nrAzI_hZ=CF{zLM19y72IBj{JqYQ?tw<S#Nz2dz-f+9GZBNZYPn?LoS_aW&R@s{|1 zrtgi^ABdCUd%m$0|1f-jc)+_u+L3xdbBKqjI>0m z1V-do35+z9!AQ6)8R4?m2$y{*k+lSq*YJ$lK66Ym8=7a4+inZ3DWPQ9h&W<>lv4q` z$otlS0dc^$6QKWZs+mZoDnxs#msp&C`iyXy|Lfju(rfT%#81T^d4Db)@%=b;So;u8 z3K9h!1eJ1VAt)0<%CB|7HmwgX(yoMGhV1Kb)cd+LibNysD|^u&pcxHj@0W(MUk=SF z3DwEpBmP^eI{ACde}O%_hMSxrrET%V+Li?+Ayna(`;7TF{8<3wIx$clIFAdfsJVNiqIyQ zoHhw~c`xDh5|mVh8x3BTqfwfs945Jq_8%nP1_JT6p&DQS3}MRUac~+qQ6z?_ZTEsb z=w}t08h?2J{v!xxLP!S<51u%GF@x8JLjZieTMU?n3Ij2Cnx?jWm7hs%`zrsV3utXo zi`EvkXl+rG)&^(s+Hkn%53&K>8}tZ>()Kfh;$+?1KGiP+(cR*?fC(H4=q(Yi4V8R} zL7fPS!5QXi6`~h!8J=agz~B^vjSZL#Ha1`~*jO)Su%Q{Bdj#{`BbeuZQj>WuHO*qY zp&83a&U(LGz&z(d<~bKKU+)c>ulHK#V$eJngZO+eQ$eTCG8g&>mc89F2)0a9=`6Kx zQt2#GYugl+?z(?^`I*j&-gl@^Pe%HeZ{0sKaB;Ax_r2VwceFqGLwIxTPU4WQlEK{{ zV!_&ra9M31?6EQf=?Xc2F(28+3;^UV+cr=k{_X$}CQll|!ZH`r%eJ7bl_F^9s7{_l zL4jJGJZW^uTFIaNx9li)G)rC-S)4s;KT02S9}|yCM?-HnyxmRHFPYnd-ZaqI=RQF=;ey*(y|k{+$NZ7ZPjlzlGyIv%M>*GhneXJDVt4T`vHSSvGB4(S&c4F`DD!I0 zEo9`Jn#t$dGTpg_nTvCGv$ykiX1oXg3JJ<(#I=}{bDHF-{ zv5R>}&b73hD=sPXt~q7iwXn>`mX<5IC{KplGp$R@N(QojBpK)0;bc2(ZznOXwX{qc zajn!(LY~}19wu!h=IDtf()0`?C6erl$HSO5I#Avo-WlEZsLZ6Ig!8MiOsHi0jHad&bghsXf{4Od2QkniN~knfM$ zxe;{nfm~~e8$l(P55!ZYA?{n;_qhY$IqnGOK#iI1Vjp0CBHIfv&!+hYqTiMullMno z1xKP|GA-@|FvhiT^SMj8P26tqf4EcN6h|evGPf0MGJA-~L&v%D7VW*2iS zxYhiB3i*1lfxT9~8Qjc11)kzQ0Ds^<1VV)O$_W@}JGsT&BKa+FRHnoj6{BNJ%pLO- z#DcdV6?{}d&;?!8y}G3P`n~;f9O_0#$x%s`qb$dvvnZ;K;CKM7*8!In@cUgZr$bAz zxr6X2AQKN6e3Y+U1+E7Kxa(04ay1sYqs&kg^3ko)<563*N<6rKD}(?-_!4{suN{e|)@{)h0PUyTjO?!x=k_B~B?NSp zIA>5mc2TtRCZE3wRfFdkp6O>cGuxSand6L;IY|5q08lj~n)cqLQwB9a*+wZyg#uf* z*GZozy7}=lgP2{?JwApVwXunRZn0845rlfdK+4(S{>UuR3H2+yv|l>&R5RgPBhex zV3xjZ;1`vO-naj0!Y84^)ZaacBAZv>J9e6Q8vUMvK{<04TmK;Z9rS`8DZ2i$iH~vh zzy8tBFjv35SDy#pspD+me*idXAiI}wfdUh^i5vms0RuNVIG1o90Th2X{;8_ldnbK+ z-}j_DNq6>z1OjOYK^BokmIMeSAOa2uF`(iG=qR!Yf;uWLjEbY8(ge^3R8Vn66vqYE z0UcaMjWP}}I+EO6y7*7kXbK?C3<0CC3bg%@7AP_Y&$+W?HaZRYgW3yuZ;`g?%P z15h<{=JZzWZIjxt^QwRnv zK=c3t7q`xto_KY_a%ub+3x^m&{2*e3zD!GQL801RqSf0*qgr|T*}?I>B-Ovx2tTP~05qrWAPD=(8YrMv+^HxB zh&P?GR$NF;3I$a$4W$Yy2tU8ob!R?u%<%dE5(uzsgfF_U;XR}?68wcFfK3(F@{xfR z0F}oBuw+KU0s$L19T0#30YT&=h6>c64+dcfhGPWAp$UJpFb@l{fnCGzhyd~sLy6p~ zKZf93jKF9#p%uTwCFxeuU;pDd?c|2v7~9`IdS%X=&j5}0a_?hL)UY5Pg@FYLQgT@Cby|7%%L{B4I!75%!}|*pGY9e8w61#ln6#GWnTj;Q2LwJB0mME$qknKlfEUqi))N zA|!t=VLu8p?{H1#83%>^xLVkcvBG{looTmQ*pFSpeprS5nEi9VZ|2u!>NepGti?q1 zK{cl1R{7Q{OyC?XXaMTN?U_7*4cBJ!6xo=c$ulHSk;w~Zv{AqTPbRN~2S7dMVgW9} zEKJ8GI1kf*aT!M9d<@4JjFWNgn1#8x7y(qF2sNn0aJf7e^RW=~Fde;rahE{mK71Ap z$1F_4C76qL%*BP6k9>^Abj-j4%tk9N`8U@-i~!0|f-+PgfH9bf=?MJl$pQK5OE6D{ zt(c$bYY_tIkJ*@w07hdLW?&}fqg^gdN4xx_OEDdP7sxHMpp`#^F&$HJNv7{3sereUruKQ1}-tiY)^C_y;_h@2|*LR{`gD`sOJW+H&W zXvM|yJ*MGznYKeQ7c=EiAB+XKKpwsHd-1WDCBMt;f7_o6ugC3wayslbtHo?GiiYegy-ur9tCR|XQG$3w zcu-3q8EHuhk?`Qbg}fYY4J0G2XCPXVf!08B(AjO0ffl)0;Ov%()XYhv#h}_I^apP9P%l3wsjN?` zz?S%)y)bn(7;u zo>}W=%NrcC0=&3<`O-jg!>GnHYl9p%H8~37h4CcK9n`XXP%_cFa&TdM*!h7;jY)ca zQ)7}`-&7b6@HgRam43hJ;RcRrxhRm-ga?FYF2AUyHIQ^IPh#}KV28_<*dZN%hN~g4 zd`x3Fn5=V$n_35Ywpg%y^un#qM8J7=O<{bCXiN|6mTW^Nqt7}sGyPPZoRgdL+_2H7 zMwaj%g@+^)Ey=*NKoX-H!%3Q3&B63)ET2~G4)UXk6vl@oFBsL>Fe|C4Z&@z(=6HU6 zQjsf$1Iv#iNm|04-<*wU&0v&&x#Dr~Ea#I`td=CLJ^5rTmMkdXETXDUD)}4qlgpKb z@k>*5R(PHmNYPmhfh0yYCP`~k?_x(`JQ(BzUXe;*YGFK>Ts*2VT@GNXy90^hSW}X= z@R~h6HP*4bW^qr=smoi!!NT}9SuwIE)sa(w2GM42nAtl?Z2zHpdb)mp*!kgMqb4*4 z8kVQi-@T+&?M$lNrOqi!bGCQbE|PBrF*MtxGqO$xb6nW-;Gsnnwy z(-;yMloVSAr(u&e82lezl#-6}tK{VLWtna!d&kZ$_c^P4R`>MF*|0H5Awq|ZnXr7h z_N=-=;Xy6Smk$aD1}$%YS>BqG7EcWa#PISREW#qo=QXtSP&6g&T;Wa*TG^BoTV|5p zh4C#E1Ga?8jia_C$c^VuXxt$Jfg8s(c2Gj=TLv_3$ssq6YTOY35;B%@EJyM}fEO@~ z3>)3pLDh15_l^XxSgsXhgj}AMB9L+F9vs266iwsA^n)VugA$;Bn3fXKHHn_q0;Z+Z zY24y;>%2^BHKwIRUb7RF0CHve;8LT0OyimSAWt$`V9@$8NfJ(88NNKY1++eSNqC{0 zS)L38CN&0w!Q?bg)AHqk<$>kll!$5L8q+W-M3Q78hw`6%!!1<^dz#$ACNAWYi>C%A zH7=jDd_p)F4ko>So~Gq#RFD_5Jx%f*T2s>Po^Y@b5WWC}wQvhxz{jS-2S|r9pHI1^ z!|S`dB#9p6W>DsnKE_}SZk6E}GCZB)0=$hmxEX)I7*bAN$HPd#@N>=EU<9NQwOEJC z@D9dGf5#XEaX-F895t9Jb;F27=q6X=enLTEKsDaNbgZF&wJaul4T1tv!Zwj>QHWZM z!ELbP4bq4LNsC%+rCwSKiZR&7rl{jmiS#|$BfKI_#eJlfzAHSA*U(8q0=lo0R!Hlm zyMESIk1=o8^HQla2V*c6Em(l7un3EB5B8HL+L!K@mcfWdOvfTTiG3s{KxlypqcIl0 z$L-jGXYdAp-os~v5Ch30i^*H$Z3VjacJGyjNK>V`Xux?GiN(Y~yd;OO^iqL!?FEAXD{3%U9{roK9`|D-He)Xi;7uHV#NW|P7;%yq8A~RStI74`CUOhe zNFF7Rldq|QzQ-6_BD^Sk-TkhlmF|=th8u2pe%2uK5l1!7#T@L%S0s-VkT|I$f2J`S zXGG9v-BZ_MD#XvM*IL2ct7UDYW!i(6C{dgUpI|9msZo+w1d9QVr;)KUU;T!P=Vg4#aJ|dp&i%aX55cQunAl78s5dX#6f(dgbX3$ zNF!+>Gs#>skF=31$yMZf@-W#(c9D0&_s^jf-(ZlinYyYvVHJD)YO zHg+Xj$F{Kp>`Oru;zEfqTxby%3RftgU`m_%wUhRfbGoK>-P!egcTxAi?%#E<=zg|; z``zwOC7rZe`V2~xpcYM-fp%PtMYsVs;a)t9NANB_!58=%f5-PYP8iV;7x59lOt*S6 zgbXL+$avC3E+iL{ndBm}fGj4PNC$a}>>R0Pmj|dS%k$|87pV~SPN@^V@uhMY#sXp`-pueP{Asc3g-)pgqIXdae?AC z#d^hF#mkDXl%jHCMn;S|(`IF_(PxEzY&JGvBxUR?`e#~8uBJbcKT$7vmL8{GHj<5` z^|TKt*@eNF1B+_CGN=qv3q(~5zX!d87P9d|gy}K==lKRYf!;t{@E~~#KheQ|WHh;y z?WY^)6t-SiEA%4=v4}n^fM$^s=#T!SA9Pj&*@M^U&8Q;N*)u1dU3rw8>?B**U~C~j39ksR zPys)YXQ`Kz5H(5Q6WovW7>gGXWDz`!YA9$N49#f4xiHe>~CZv?T-FhP>WVH4dfd?eY4o&@oxR6>SyZzr`RM+%TO zNk>NE22AEYL1Be(y|6%kxC)Sd!j-rIYjG!@!#j8YK15N2b1?>!Fcq^&%~qfQezqo)u3{@X`uGj~HEab4zGEvOu@#`w9(Gs9IU~w;$eCWXa%O!GX8qP) zwPpVPPIecP>@MtKci{lL3j)4lcY(mq)+5Q*V-H)818lv2j9(8T-zu1&xm6}}SBJrt z!5D01{k5!#jYApytTB_0XX84`{JZ2P+AoSw^u!T~=U z#u{LPpABVygXHoM)_{TVv%zeToSwr5bqw^E^qCkTI*- zKx|+GaY)8YVFR&<4a6I4Aeh{euz_qKt7rABKkE+zOZ?0}2^6yg7)!7Ot7CPnAL|DL z>kGpAvc5>LTKOGoQOs&l$7(Tx)nW>(#U56R1FRN*Dpt#C5nz=lVUZdE}FBC!J;_CqVj-8 zG2-Xa6c)v57R9|RDz{R~?Y?7CNGuA5xj*L?{i2ORzS{qDsrZb$aBLomSstdaJS_S- zznSGhfkP}$X0fPTKa%BPHOs^9OkGH3=8()(oFR;0p`UwO%tCUBGfD`47V4lHLyE5G zAiWL!>*z|1peuPLU4>%03Uzc97bTQWVuK8eGx?P$rYq5N#p<8So9Rj@*$%dY<+FSi zWl@&L@>qz4ld%>Qe@*lzx{9u%E9pwQg04tdHph0y=#xpH@q2f4`A5k@3jFGcp_?!!j9$ zWauU1JF=j8icCaMP2eZdZNVk}&w?p|boj3erqrave{H%nF`e|`$S3?I!5RK|8WTw; zIl-p|0zbx*N1-CIL|pZXYKkhMs!`RyU01cHH)2SC+83aG0g1)H8!pH&PCJQ_SUYJ4?_}mK za{QYSekd3tln^)+-{|(>2ekw>lu|b|f6z!>(8^E;ozw+A^imhHpqEY}8(Gpx7-T3S zTRI6N4AM_9$3fu;K>8jPh)Lh05;5uTs6t%& zJ9?o|`a7y+Sc4+zD0<7V4~nIus70xC6n#-DeTRN1lfFY8%BAm+K)LiS`lCYn76VWz zeT#Y-4n&pIi3aqNIxz^Cxu})C#&8*) zhknx67=b$JD~y!kC?uq>FdF@(uW&y4OMk-{43PeYu`(Qo2I)(T$2roMXp~_S21{RJ z0)|LmV4@5sVW{*4nq@c{!=%qK1?NhiqXomI&(VtWq|Y!FBc#tTO@f28yorel>DbQlZJEFH$BGQ13vr9-$JEz%(@M5}ZNS754i2v=g7^cP%(3#7l` zYD|~@f@?5c`WTCFq4Y5pe`AL9F_y^iTFjI_!gVtIJuZ?y!u9x_^bu~r@1zg06tkrd zaU!aV7H+=MpieXPbM()(D0cIkcGjCScgti^ok zJ*<=AEm$BO#I3kgI*8k3_y=4r9mMTeD7}k2WOyg8lHSF78Qz7ff2DVDH?EQ1!96m( z7mK8~u>nh@xA8|A-iK?Yw{btNlitDuGTeyYOK;&p8U6{^OMk{gxIy|e9>!AX&v*nk zN^fElmPv2oQ5iml< zK8N+vK0J@RqUg;IQj1AH&ctwV<;*ZiR*oXV1m+_hm z_u~QSWxS4!(#v=Q8>N?U01rwp;Y}I-8Gn*q#9MesdJ%8SfAAeVEWL<#u}OLX2W9vk z9+h6e`!f6hk4by+As(0Z;v*S;jLp*X_zOCu=Wz&IrRQ-N+ob353ARhm;Zqs@6;DXd z;fM@B!;{jp_#7$eS$rYGFR??~gTG;yvNx><9J?r8Yi$~C z293EvV{nFmlL5BpWI}8A<>jPPSb!tk!{GaXf{v=E7TzDr1vCllr@ zxOBG1f5m=8+t2$rnFtk8Jw=BgfNpXg95L}kbLWvG;*le$tLqdyiP2PJG}V-rkT$}U z%5W$WWs%B?s`4_M)xu<`42MG;MW2jNyU}E)xwJSOE}9;V_3c-{fv~n~Lcrw;&<7p5 zP*G7>ds5vu7O(AFP*@8P+T4ATZ5Fa$Hw)y0!1U#xPPvh}$SCCK;fgp$!=ox`ZrzuKL8U}Jac6}{Hz zf7FG@&~6Y?*nN^N%Jep0Lp3fZb-D!JV~t5^w}}d+SutFzwf5uvHNX!Fm-m64WOz@1 zPw@U8sTDir?w-|K3#BThJea+zOqCThnjUGp&19pCezUiKZ||169}DT7My>u8GWdaw zWbmtctv_w1gNfa<`2^nGwo^ z#x#Q%gK7StH#^KGNB2sf%jF~Ud7jMYdFt<;B;y{io6UA|AJ2DB=6U{op3kIDf7zD` zzB{OxJhs(Dwc(x8_h8bojzV>Qe~t7#@}y&kO8|kG0ysyHfP-MCKB1K<&qBN&(wzK4q zJBbnw5|`O)c&B)x6LocBr`Tz#f8mqCSd*q${ldfqS|mmsPP^0Qv^p(Lh0^2px_xfH zTTn(Ld6E1`K}1mM^jf_}uhy&d3MGq#j5!Ge%&r89DRUDj6p9lhYzQWZ+Zjxdh(4Y` z5sfEgXEKppy9EUW1+gWl&K#ur%%gr%W5R0mnVoeOpV3}t^8ftyv$U|zFac>&Y{;8e|Z}W_9fHr9CmGyZ=h%!Q(xfBt2t-YhWeNzuV(Pd4fMkU z-G9I5sy>y$wSC96A0Q&nht}4PTXfm}zF}v$`|zF}m%ZLMNxG@@Q_5TDVgDaRqTDRNM zH>A)hu!Bs57R6n!mDhEa7xO-rl)87oCjBK5cjr_LHe8W?L-dBc8}c8_doX{Oep`Vi z%cQkc>Z=Qc{BVIUW{LXp!g`C2GmP^qQ>X1;rY@V1r_L)de>nz>jmfZQa6fu7Gq#GS z$q{IvBUvD1;x>&&t9PZykK1^ku!~HD4wOvXrvAj(H@ANlor^-)$wc@_7IbtD;^gL@ zi7K8r#^>p=PA*qFJL_u2t|MY6$&4)c$dXvBv;_4F6CQt#$zjV4M65wa0_LzWLF|4@ zf|znF36hy~e@m96$xvNgjW*I2Yw8uuta{d9Wlpbtw6Y=+4k=a2jKHo+uQE!d3aT!8 zJ(qDO-zNCJZH)i%D=&V;snqC2qkYzn*1JEAOuV%Fy`5u%oOTPY`uy9uGe_jje(;)R zhe~S~OCFf~!Sdd%?en`o`XdOQmp&DULV;>x+&a6Oe;_4&pC~UYt2Fk`8Im(Jx4!xk zC>I59sJ>NLS9x3Y#>xk)cbIqD_nG%u_S-)+e{BE8{4cvyY~hGmxRZi zQ<1MW=wf+BRvh%X98iQkaQXsyk+?HOCT?DiRv_M@QUp9sxIdY!(xv8djxY&8D6PzGj zM@%)vokmj)7oze+FxhL2X;JE_sLaVVTLeXJML0ps3TuMoR7MiSBA60@OqL}-A0!s5 zZf>habsMpz7xT!eWwN}isw>f{uRelv%f4d*hSH@{;{<$ zv_8@7b2*)Z+t%HA)%dk>(Wo;z#xK0{-q)tmO%>ax{^5&BC89}m7}}qlH*C%Me1?(b z6DO~!t*~h9VqV{|yMI6CHc$?XwV->k%><-CMbfwEMJOD>_9eB^!pC4*TZLm4F)o?!)9eE zdR@Xm6xlPpUOx;z0w3}1q!%MdCMI+sgg8TjVAcO|C;2lRBmtrfd! zMZSi2^31pLs$R<%@~&EAjbdq0>}qkZTLXOV9DlpECpDCow2@#XDL3}0d_9?rcq%s< z!-TP}x5!(Y2l-tt{~#H5zs%v?@$T_tN-K+=e2tG?_wgPXMW)b0T|rP{mOd5i3I%de zPDUmQRcfI?6+_V@mwQ10BQqxq6H7lc{TTj7!LcI6ZjjQH^p~yts+9CqN7NSDDSd@9 z>B~f+udG68*l0Pq_|xn2@uG4M%ikeo zmdd+l{qDZ|F6`4@9;7d}&%b}**^BP%x@qZSpLJY1^0wl-kmxYlb!JljMZtUf)@@t0 zY-=JB10~f`0Rx+gEI81ZFz(4dko}%`IQwtn(d-{ZmED{ok8CY55JQT%5*l>}4F3?H zwFxO=OJwOPvj1$b5!(k&DCg`TJ~(2iBjT~6fq+MBE93rVd78aQoed-A8}jf;&axPn6Jzu`puV zN&3Mk?b&M7))`aMo`h)7)ESHf#u3KvjFM3>rbv8ial>p!Dx>POkywnc!Rc(5tn+X= zV>HziH_HZWtysHMAq$zMMUL3gtM@vfKBfQsy}7OU*xoY{|Er>WwMwk5BuIzfR?T@k*@*;=*N&647hV>_MXMY*}5*KG1)_v*!ge>je-y_D@ zSKMa#>A6#4Z7H4BbvL*9#{)u>uofOfQARFIJiWPKQ|v|U3%Y|^#p;6PvAYB7bMK8k zo~yhvXHjl@Y(e2_?P|-4oYlGNvEp=bk#?Rq&p6LC&#XZj8W$3F5YtsiwHLiyM(?T_B?ppS|SBqL&dy0UdwR)|Q~HnY6XFH8(dm=Nfy6 zEF1o^nsAEH=3rT`Dp@fI8iQq3X@wz3&?XzC;@vN7yzYvT8(X_%WAz1+KV?MUfwx@N zy_GyX>hgX~_pIpt^O!Wbw_kDRl;XQ4k6AI5lblwCJs0&Fas5f#;EQS!m-pj4m!(6( zxx!?}Q`oGwarWt!3v9EB=2_Zp^Bmjk+FqWjlA*StRTJ$KD=)Io zti0ZHN3piN)DUoo2$(wCX75!N2>T3KU?yF7Tg;T(OSeMs<;Hq3fyOl15p_#25^?o* zM+~L@(&Ey(QlZpYv-Aui4DaMCQ&$%se%Y2ykG_ArG-Z4y_8PuQ)s&WCSW4t z35`48k-q6LTCh|4243l#?KYd;c_gWZl?mwLo4^GCml- z>J+ic$_i6ec^P|;kE7jev{S{n`M0!=OGE}lJw)6#d(%jx)nto}-al*NE`j9t|ENXJMIC5 zONF)YB2M&);7!_Px*JW)%*!k*t*ia31IvS}qRaDF7wC0)BpS%~1o_rZ%^lJ0L0Yf2 zd%3*Tx$@z1dEvFIDKA$l@@2!tt2P!H{62r1&FizPV?K?B`qVThVlWVcAz+{eS5e&O zBm9>HD4d16NDWb+awjyOo($YlsTDhAz@0$<$tbK}n5YO8Xsy|XEQ8*lGYHB^ZZtP9 zH$PWUnoSlHRR(hlv^hm2U=0_MTtlpggiQXTjN;5)2pNlpw4F6SxCzebraCPNB5?0Tn~O%|doQ_u+O^%a9J8L3UbLgxnKK|~<*4pAGLxdQddfw^XU$*o z{e%I0RxE#Z^6lsKZ5kOL0)j?BC>GYDl9&>%DgL?2MM`GWWyee=uP)^ASBAr057Q`9 z(w?mbUmZ^qaf7o?IgV1V#^SQa%w~VDtD=ZAI4zA;R(gw~g(wgUXhAFz@fP}1WOky~ zMM*>#&WX4x5y|xdIv3TcLlJ|AeCLro)YG3updlkQ8#D(rhc!nv3Qc7sQiMXWkQSy$ zzl1F}HwVP08Eq~$eP=pqVkT$R(7BEbHW>^VOK;%AezKKQq)nD# ztes=J9wdd1^m62&mEC@M9qZn9dbR34#4-E3hfR@dzU6QV2>;C#VZN{y75IB%a*Ki( zH2Rn*dNo0}uQC+!y2}dZg&q23_2gXn-6@~)n^moEPWwM``aV{;lEYG{wA!29|seK#X^xHtPf-b zECFk=r`Xp|QLZnslvwLLb-wcy_4t?8RNh{54^P)EMS;jmh~?xH-|f^ygbz7aaZ@E z%o=giqT*;(q_|k8(+lQ^ULA>6S9^UvZ?7s}G=VpWKRP8kH@Z2xJF18#qWKlkgsIXH zT^&6TJsdq6RYX(tlZ4glCsPPrP2S)eqy>*hpj7at=)#1}9AJV)@QpCPVLoL3&McUn zHP2-P|8RdUUtCVH(_ySBPX9HxImOQASgg$LN!>akaQN<~U<+G@mt7n%n+|Q|i~3aZe|?q^%ikBuswostNZPL*(Cj zbHenVmhPv;^|EAomBVu?IeeY;BQ>vcE2tvv;MsrYbG!WOP27|7%W2sar*F%v(;0YB z%#;oZGlj>H1t&R~kX|vo;H0L{ZJ#@S6n``wvmJ9PU$VU~zHfThcF^%R@oy%TOLUp6 zHk(6u$@DM72{XG}bF2OV`mo|*%>(*Zm9MJR*U^=VRqDn1W#(npTj+X)x|gz-x?EGM z?=63po62py9qIxa(-(`mrd(UGqYqU*W!Notm^#cI)}(E>W2aO7nBj48qv<~L{niI; zn;nlh)#J^hY|V~)#aqqmY34b}$RP{+B>35E&cXp=hM(c4gE?q#iUoM#v+ zHki~prB>}$y4CrHs5xp?DXmT-sLh5f0V;ocuAnjIYFTzJH<1D;!3HRBnI%`{-0G^o z!jXGxO^!Mn4{c;y z+;ujG&0FW-K$DUVZ#6i1)mJ=Kq@;IGm31awevYS_Olsz7ma)#tuS=)L64`pO&KiHn zGW9e2vP}I*O8RoE*;$vBNhwc7Yn?umI=Ck;%V_RLvW@0``Vi0kc7%uriNNEX%5Vrq z5#?nzld6L9un@NwOv20?zgxDidmpLXx9rOSUi`~(0V&#RU3rd+P z*1L3Q=>%6}>HNU__~n(WDmNB9Qu;>Z9sgT_Ly>n1zl#_R5lv}>e^Bu9`1Stf@tghk z`8UO14!jclJeK9#CH(*m4Dvb~%dE3K>uUK~>uMisEVHi0{egm5P#G$Why8y=sERn9 zrig@cO$ZEMAr1rFnO4 zn%jN+vx~QmdU#>?KC0~=dbVVG>FNphR`$E=d)bq3f2MNG$l29nZU=wC4(X6!5gx-p ze3~feTYj#4M0s=hWwsk^OI^#{D{Jl;pdAtz)Sq&ec)0&V1KzQJZa;2Ux%o?)9aTKG zG9{MC@7u@aFeoe_y|T+n!mOx*+wDf3Gg4byVa%=91vHugV|6Qpq7~7K++aNuXjC1P zjrd-l2Io4+|Fg9c(|Zci zmVL&wkBMDIInrX6-OlnBgS4$*TEYX#gv*m(n(b--ua9z@Ftbm>no)8yuH#IEB`TjX zlC4YYD<(Tp-2eL(4-}o-a^a@_Pv3qPx`|>vj@!ZSzY15gRlSnGyH3{fKV%} zMHn|F3Je;3B{xh$9)A@#9jRJT$!!s{(^h3Nd7WXC&+Vcbwc42?bDt1JqYoe{GB*(r zJ;k0D&l?`W;HiJ}jPOkH%=4`FZ1x=Ts6Btn4y%#=;0e3+|mz;&}Hr;%FjJt`G2IxmB-yb_z2MJF94= z)^exS>Tr5Z1tn=Et&kMvqp+|9-U6dm7GzoZnyf6X#%s(E^YS^7@(^bZZ+=OnpdcK{ z&v!&j+K9zaU^eO z;#}LD+1h`Uwk3KtnEbCb9$5;tHOs=KIrry#*hW?5FO+lE_06B=J$}VG zK3BHhN2+As#xvKRzifuA{G<^=zpepWj!u2)a{7#Hy2+wNK52EM2JN4W06Qf%o~b9Cx;Onb5+Ek@~h^mm`asT zRVqfkI!c00UOB|;Eq8dmPKP(>uv;l1KAY8IvsoQ6z-M<@>~@FURuBm}BSA|<&my`| zFsOgm>nMnte-|-Q;uz^jI*vL72RGbxb{Z+RPO;6h)Gl8lJSV zug)xU`*Ru~%oNt5jNG*YA?b^)c0b=i^F^Z4?5uktL^NSdnKSGxn-!i_rkr4!Y@6bp z5ERtG3qrSqHim?M27d@sWl$5g2AyG{$C$6oC>gE*FK2mUL9aIu^tytfSZRtruvLF7 zB1I|sTtZh?R8(5#jg_HC9jVNyBTn;9`T%Ua&8dJ=K@M+I9*u>g(VVciARG!2F=PaD zYRbaq(nu^P5-SKq3S2>xNsbw5)ar0#WEm+-(cRkt5;2M?x;tSAMqnCYTFo70Zo5Mn}e3-G<*%J9?r*J=zBOC4#OyCA^*f54u;E@zNI@oKJd_^3hyWf6j|#RO}vj zDh~7%E$R^t-BI%XXsyDs7F)}_#Y`^5mm0gk1*eSnd^U2_hQTS zuCe4Zp?$WJjisKAot15 zi?eusAH6=$a+etNs(3{f0)c;EBFk212$JGpU2sHjO7Py`=HTw&p`beGsshrS>^0eQEH4ezuXO# zrX$xacS9xpfC}j-Dy5@vO2@XE)J5t{Bm&KCnXrXr)P%-e@JUBumiB+}nzm-r9IVXj z)8TrIye;I^PRn#~qK79~M6S!k!CB*z2mbKL;e)+z9I<%u)GYyxXxC;>yKCgV9rHNJ zU+DAuAy3XY@3Kqg?3%Xl&O7E_@q|IVvEjlRt;1y08e9c;PwRSH)-mrhiX-}rK6mE$ zDV+9&(jj5I@C7``BRPLtvdo-TIr!Oe z_DE0@2$B?;mMCBzfT=V(Z_uDTq@+q$L3j-G0jq_FbPbldmO~b1apq6H=}dBPA{>!5 zMp<91b&5wEonoi+h~r3llS0jZ+L|^jsm~B2G3Fu-DbbbWoRfbyF7JZ8heI24o+LYT zPx+pR?p5qlzb$;EKBD+aZL|rcq)gFQS5HRhhWN&jv5IC@v+e?Np<=df0liXtrEj5s znQy26>CpCE8%aq=J9J`RO8RPx&z9bN)lAx&h_R}?3|0%cN*ex!u|O(LZ(JY+w;xOq zW%oa~f3)s}GkkyI_k6H+?FalLe9`sRi`~bc+uMEg#f|bdxqh-^?&W(w{`lT|KmM5S zm6Hw$!`NaJ;OO?CR%hU*@QFlRXQ+G0`cdxt(Zl}3!LM__imGy~QQN@4@Z90iv4Q5? z3DJuT7ddC;E_3Q_+z@UzTbj({tiQ{>FnYqJP`aF=)s=rQ=9_X|%f2~X_{kdo9zXTF;+9~96L~{~ z7$W}2nh1+HV|&k_a~p}t0l((9;m6V&;yUX(k7UAqr$c>ddw^?Bq)j%+dMpCvnHGWV z%m`jMgvx&kl$Ws=xL2FV(L3elTXsG7?juw8jkbzL`}F%?-q-yT(d~PdWqJ54dB*Ru zyU$tt)gSJEd+1wly!PxAA}J5C{b=KInB875@PiyI&Jn%zqt{ z5LY}mxL71&imcokD_GpKSD`I4KHMCxm4l+SV&@UD^T;ti5B|O4Sz0nIY0FH4t=Vdm znv0mz^I``Iq;EO`mMB-wBhnXJ!|EL8DH(NY=?PaVPbnj1_8wL?pTWukO^cYdpIq|h z!i9ftwtsY+T%Pydt+&1R-fg$OCw%eK94=e_^zy>PmtB77ikHa;X-?ko(MKCNCsQnz z4hh9m zHj6SP9o^=(_bs<_-eF1mO!* zU|%9Pp&zMOthi3Uq;!M6L%%KdTBINK;XSQc{|t!V^HKh^iGSl1R7+ z38{1PLdb2-4|)Mpz*$u2P-@iLP>O%7OlYeRCjr+RGHc$N$SSrbtn;h~tb)~9xnKu* zEfeY*E{7Xy#m{9us+K!yx{k=J<=HzXnt!o%BD)~w_7r&He#G4Qe!^AwB}@KojH{}= zJhK_B=Nl575v@Jpm|`N!(XP21?t6m6Cmy}&vZdu#hed7v!_12>BgTCnsFHsuNuD=A0$Q!8*`P^km_fsh)6JSUGzyKYvM9JXye7OM zoD2)Q!*7HShmVGZu(P6|^(mijhg>R`+Gv;Mw!z}JP|GBT#bS4ajQPc~ z!V{lV5|0;`g#N$Mt_4bp>P+8TkA74?>RsK{&+4k~neOR%_SDSuP|b9~z-T04(8vOj zNpJ!Rs0UC?vg!uh?25+3M+k{%++~kR+zkYffwci$Tt$t$Zg78B%pQ`Bj2uMwgi(^i z8h3HJckiv92ZNBDvz#;cR^6@{X8PX$|G)eF-+w#DF^<0vz`$}$Jm{Q*UwxV7b^KZ^ zpnIdMt)r`}(4iM05^PYpY?kM_BB0zHx>BP9H=^BaTGVCaly(_wf-Etwcg!(KBs8C5PY(iD?fe1FpOhT*v&`Y?c&sj;!l;v`>)=@TB7v1L>5jbB)D)%<^l2giRuX}{zRceQ9=9X~r+ zQGlTmAkb%-Pzuch62!nJyGd6Is;yq9ep%h9{)Orm1Kd(c(gQBPcPUNlekG=ElVv?d zzD!i$cmF=-3iufS4?{#15pdKFQWUMpgA$a~__dp+(#+gAo~2Uxqp=w&S1>(iFB@Ir zCE4Wq8$f?Na?d7s4f?ys!3! zPGZ@mk1Z#c8_A?@=rIGdbYgpHZyzw*+dECY#q8pJ_y+~sm|)Py=sZfy?zTlID;wU9 z)3SP05}O;)_*J>w@=Pw*kkOkn=}bDUb(vCEG<{=mW=+?1Y}>YN+nSgYOf<25#kME5 zZQGf6V*841eYu~n-a1`fYp?2G{iFNT?!DJavyv$wvF?ipVewx{Nwow&)nuU3Q`HJu z+yGcLH*s*I3(4;Uj0QrG=PMSuXM@I!vY!kagzX^32Nb&f>~3GB;Aq^`H%_E#81;yQ z@dx2F?{;rY+v&<^-R#8mHc8XE5JJd>D0BLG$k9yFAXikwE39dO!XmCs9Y+Q6BY%rg z{dW&>HW~F&Y#fCgO@ylt#nS%0b^nPtV;f+b`q!k=r4{bRx5V-sW4{;N<3!iOp=bD? znE{{A#L-RB8ubhZ1QS~qibO8TtUvpTsJt+#+>Ybw()?Mmq%mu&zKPU96U%?sq+{tt zWRnmb`nT?nvCj>@-H`SZqOGlyBC@B}Y=rr@={cS|Ki&%8GRmb^ z5F>``jh`HB3cXFEFWs&Xjn%dJQ+}@Ew_6Ht+~-8ER$}hYyLDIhU6TQs!Wyj72NsHEzEe z#b|OlhR}6Q!8`0%Hbgjl=AqY`oQMmYM79%pOnuFAy)+h-2N$%#FW*&qI97RI2Iq?~ zECc7zz4{NWUMIJwQ1}(#OPK%%A&xxRxSD5<8k0u@bo-^2MpV+ARHPSbe^k)SPf92d z-pFO8DWl~mE{7q}#DDg0S#HiB<%x3%fv8`A@6>#twORK<)IA@(Q?nW6c0Gc2C=cYkO{1u&2A4!i#)#!0vLeT3hKp0%dxu{RP1EIwyGzs`M9 z-fYMno5RI|!`MOk>x$VyNwy7NdQLv1hVh*8os#CeZVshw(hJfT9-z+= zw}*Eokvj;BjwJq0g761mh*AgyHsV_x7AcH@^JEvnv#VyKCkB$h1c5)49pv#LnYAIX zg0De#KoMAK)kQLSz{G+f`mJK^(@tbhnnMOybVXzFmWyFRVjzKcNw2v#p$aHGd4L-tU+r{M3in>zx!b14UY-8_wb0<% zJ`|LT`{e+)&Dh!b#XJh&Hw^#*6VUy(AQ+qKgBH8C?xdkfCJVv1<$TV#V%*cZuidnN z(Qj>Az8<18!E6SMG=}Qnx1|_SZeiSx(IzT-%H}R#D1%lVXiT;thdS6pAJlY%IOP#m zfl!p8=$+TaJFUtb|ArPnbgdz;F|AQu=Ec6K==(vwTav3p=AJ$i7lUjolIK}K^hQ?x zYMl3P8ob=iPna6Acs75HmSjmO1_I5;#9Ep&I0?MWa;+2~qu<1kA1V!zJ4Q7j6rq?b zh>%IssXAC_vedRi-$|LP@|Z7`@T`&>jHhZsc|WA8_p_L7@VUJKniFE2O5Q>2i0#E5 zSK|B-LYy`Gm{w!dP(b$s1Wwv0cyG_$?c4*}w_lK1eMa+K*(7)LOo zZU1z+{=pm|0&P=2NrgxJf!lIQeU#lX%lS)=E|<4d+{mp4Du-WE%+%d zhMI4>ZR?i+-KxUY#V1yK_J(9fG7gtcGhIC)sc|kmfw0)&CInG#feJVjC zh9pu;v5x{1WUHE8d=pzuD8^Ypj*JC6j5REm5Y87s&Bq`svNGi4o;}p<`>xl9wa*u} zh4%f`KkgDpb7n8?l!V2=4Qq)qdKkpjUYW~*5?I9SI!B|mf!$%0wg{&4@JOO-ps9onNt~II$|=nAeJUu zd&0hBc3?#R`G5;ortF!gk;(wEt#l{23WQp`={zp{fq}vwc~!gBNU~?5U)oQ++`F+& zAhPm}BV>d5{L{Eh;2ur=({1Y#Xr$ZoJ;PdW}JM4|hNCg!Rh34Z3atHEI&(?g5O<~~xU8m<~ckJ58 z@CrQ+GI@7RMFCDQVzQjd(E-!uB(szagrolLwI}(*6#}tmhF6sp&(0Kj6L16 zn!V*}=tyL3;lyv{Eb*lP3dd^dTy{LZ^HoZAH1i<4)ou8{Vx6MRZjGYC;~zDe zy=@j%2FSkjXj`<`la=`eL;o#g8<(v{$uO;g+CRfw{UMj{)m^cpUWw&>1gFbDZZ78Q zgr+^WMR7jom86nRPaU9!L@i3Q!R@Wtl^i@5u0coDnIw`iXu1*-Shw&m#GeO1r1baG zPoC}1igWXmNSPbf-^%RGW$FiYYYSeDmnqTs8G>2rj)5c0n zdT7*X$E5B8%D2vko{4dcqq8%{8t=1>G%&Jde~x1NQQn&hD0Sdy7w(l4e`kEcb|2B? z;o;9ecyPN>%im?ao3kW97da$HH^By z8b@0%sqSuMC|+d93d)K{Oze9qlVj>lR@#nF^>Pf0<@;s!N+ZJQTB+72-KX?cmP-Cq z%D38y@h4yXQ&PivAe==oY+S%DU_ptIh#+QzPRIVk{bvE;BW1_8-?pC^0Bv;hF>nm$ znTPL*0=H#1Nfhbi?J_27_{W0RFy3-8x3aI)M##8$!46(*=eATm*F{((0AL|MHAPgr z6z>H&)RvB=N6e2_Xo|VFnSj+qyCa0h7bAOem)e20T9^BLNDgwbqvh3ZibLGZ569}LR zB9Iyp{H)Ezz5E9Tgoyrk+~Y|-7YgNwiQq+SUzS~znlPA$I?HcYg# zeRT8IO_c3Auhat^@LDTp4Y|}4!7G7oa^WjJiBU18Wc(E%MTOAe`cJc^a(P4GyOH$HP0EQX03C_uI|Jy~3uF+2qywLu2Q~41ZPs zX~l$An3E$9Sv3hce}^#!g;!Qup^(hZuWRPVX)8tX{|Whp|nn(f>Y|w zs%(X_tR9aWUb~LwFPc4>-O;kl?`T1X(ra|px}@1Q36Wt%n6kF^C{@TuJ3S z5X%CJhyn^Y6c*PCh6x=6D^|laV_D3$rN@Zi#gViZL4k4Nz~2Ed-EMtYKRfG`R!F-@ zRR-=HkYxrD6nH6c$aP@p2P(Jc{*w>rFgYcQEOS1Bsej5p zT>u2iV(3S_07y94>lS(cl?US-4V!^z@#n+#POK^_u+R_d#=J7|A~YO`dE0ARA#6&2 zO1!9+i4mwjh6(uZgey)AP7oauCnw2i+?kuNByhU#cO|*Ur|;eC2l`ZzKCE=&J}J-K?^p?SXF0 zqk{=ri{%~Da0PA@nTaR~Zlu+TB${>0Ugf2|&%!@>#Ca$efC3-vO1llQtKY2TqIO*I<66saJR}x5 zIlE$1#B__@VhrMG)sieD=gnjjf6>DGV`&yUXj77iiZK!-4(y_cqQ(C+lT7>-!UHBP z3S$Rh%oAzJ%wvs@(MBY8>lJC$q=qVwUhO}53n=AaM7i!<3Ne1B#4ITK1-??Tc41JF zJ(XFJZN;I%pTnY|7n5Ewbz5S+O5ecZjU$8zgA$0mM*54@*!?~O!Yfu}29;|xQvy=R z7TVG_1mQ4^!n)FIE?m>Z}xMiiL|CVBmsoJoN{ zj%&@SdX6!SYkKfeiL9x4HLVD@Y`4nQ0BE?q)*TAX5$)rJk63xO;+YDyCo8&X9NJ&F z@W2H5r|X1skG@^sO8HVG0wd`Mt1K~>BUE1N-wJ!Cb{38K!Q7wLmJ2Ve+-=uo=rQM0 zpZnm?;-Nq-3JUkpHEZwC(O>*`8cg92WDq(JA{GSDPjP69T8f{Wt-mq@gFd#hj zXEDQ6q>DBry)CZhf_~-pX@kOK!`s{Bu*oV5o}M25!<6Qd^OXi=`afi4f+;HqE83) zQs_Tlo4kYsN}P@ddFZSBE?sc4?E(EyE#+lM2va-h6WOuRA?*v6D2V^wU|^h0O=X$^ zszKA6{V-Z(ALw%WFb_i^D&-e=2@Oj9aX<4uG4|AguWd=rJa@ zAF0UyX)Lz+V+v9DmohM)Ee(d|ms0LK)4MIhWCM~9PhS{#)v8W;cQ13_5-1=z$+@pr z+u|bm0@LT0&@TE!cFG#<8(yx;5iaGwQTDFcWnpU4WK!!_ZxbKff|6e9iInePZrmA# zla{LH;g5~}8NG~kQ=Irpw|^fWbzv{u(?`nM9IBF-!kH?6pRBJ`MAEBTS-XuWD%kz3 z>VwjxwSLq1)n#yXh*4{47k@ca&2q&-wVaxStNRg+k+4a?lRTz8@>Y| zdFVZy{WCpaq3KigR>BDmsmnnw5;LfaB1Txrhu;I73DvfVbV(Tj5Vh`%(0fa^nYU_* z4|1`QPilc*HP8=rY1y4CeT;p(bih8+%wcg5ILH9za3mHv2r%2EaGDBgF6y5qojEc< zFLmztGLNUvCAY2*ghh>EuO1RFLJcfMdv^{ULl`o&Sh@U16olr8{CJ8})O!D-;m(V7 zJpA>#7HxYrmwFYzEP??WLN+!8q6jPunLngBHY5?4av)Y0jId;3B4&gGmN?0Ka!UqZ zl}`^X3|bW0(Cd)p9>LmsMwBItW$Y60;hx4f)@{z(VuAD=$U5obWeM(XZaGL1$BHPr zSZuE+P|b7GI()OP<+Kc7sK{tLG#9#fbf8p*RgzuU9deX*Ofv{%cXFoPTRJtcCPRzI ztYX;$N$Wdf+41AX-7Q+WY25BRLtp+U!i@_954svf_)KyW-S`(Q@@-%ey$b_m2LKwq zSL*uzWm8+6L9>VfBJ%55TV+jR@EDc}YgoEWa7~9uhPqdg9Xp%Dn~?5WbBl{AC_nx+ z8!kaM(^uB?U0SQ&w5)}=f=b%V#QiCPIsFuRd-Ln9y%O#fr1s2d7hs>^WuNIf{=-WR z3YsU$4B@gkb$iHY^vsVfLIgU?SL&o|Dr&k3MN*DByWQ;o@YGB5NHKxQqXX&0t}(EE zdpP9Q0-+Pmi`4tq?BRK{O%x94lHxy6*Ji7M9jyZXjOA~4(|{QD+2m=#h5`~VY#}SH z_ZH#yDj?DUqM+SSRLJP%p9L~D3^Jd_VATCdmFa~_q7NJ2JjsXMVk-yy137B}`flgB z{>t<~tRM^tkYNB>k8C+4Jp8bw5)lA}DK^Ni)QmIVi37Q*d#_0$G`O<+8kQ6}!WIbx z^#{SEX(DMr0IgzV!Zeg*CT5jfN-d>3C*M3pwwqSfZL$VgxWfg5~H)grdW!=uhpRtYDX6X2k>l$+%(D4CJxmw z(>((K|D39Zpr|MT&%#;ofFfJK``Fv3EYruFbND4D-zu$C)ZAXCup6D7R_f;)`>E2R z_vubt4&cWZqZi=*GyS(oO~fWfr>t}D(I=1A^FNKV%~uNqBfK7hr>Ee&dOB59p`Zv2qMI6t%!pu!z)?jAD?x_}X-~)z#XTyh&gW`vV`V%@ zHGQ;7Umg5kpca`i7x#D{sVt` z;MIh*ce}nvH;l`0Ae2)(;88}nT4m|G6e^~7W ztUCD0M#GH3q%Wt=n!Ikr3;@oxI*iFWxK;mWSduN+#%EZD0WhwSgZ#0lpt(vw9nuu8A2ig!tI^mJCqGzh`p&JVnaqj;DJdXQq*SXp$#8G_g=(5j$_Z!EGI<> zf%|AjXd`R^Cm6Ig4?5^pST(kFw(oFsA9EwjsY{`zp!^?Pr085kYdC|S62gGEw!GI^ zZ!ngA+#5@{>T8z(Cc7iJU&-y5avvn@q$A~J-%P}J8z=q2pvpkFg8DcBdHiiQ^l&8t z<)vDM*^ttHP~qg$V3(LHrKThC`t5N$QEM5@}$C5-k(8;{Z_%IacB)lmHkB>G?5? zTO37R41^T9TBeM6QL*6Ty4RU8Wnlo6|Ye`yE^` zvP1^51YNc$0jVtt`+4;a(Kc%gl^jChKV>4AOj7KrrtFu)LVk;3tYR>zV`THPHDt)~ z7iRHY%0^gtLs3IBhmyAsKU;tMqq>>pL14Yx*AAz`US8Upp@FR6MddMTCTEynrHlC6QJ-_O5H#&I$dvR%?Xztn|aE9Yi`tnG4k ziM^6kSUY?h(Vf=-`fpLbdVJ=e;p$0I;|Sm4fQgs~Qs0V+qK0HfDhbo2%CJoNdMh;g zq#NW}7}vmwpear6$9UJi^k zqloWagzh`7D>0=v2vCj?MmrR$=!g;I}u>+l323(R}YUnZk0}@^_Au@|GnuPMG zS0DsmE>nTltTfR1o|2Dl2*$jhv@O^qUmS>4gJy?DghhnCh4D%2Lpc($FOkNhbB=O_ zL5yyMf*fUmu^4F;=_=QK%XN4J)CR3r(P#Lg+GRbe*IN%|1>+!E^< z5K@bc8yj0qnPO~%T;BPSD0wswcgspN!aOeFMC}<5*96`g4{9?SG_Zd_=tXEJ4zl`8 z0E*HPY?hR11&6hZ)B#Vtr;9)a{#CU2j1qJ}pAjr-9PhIG`XEycduXU!IlSp|uaD1(s(;=(#;ctiB+?uE=7YTXfIbZ1+HxGqcOW*V;_NPQB| zBkF^M&I;*95%o0tM_ra{$Ll>haz)fg6x^)W8QQXIWypD&rz|3*6ojtxB6NAlln zlAeeo?Yskg`H-ncbTmvM&Jczt^Ov8TvjYJ9vi}3*H6eC;Ot}AQ49ufGQ)1u3gBTm0 zdI&;9h^d6G!i=v2B(!Veq}HAtON4 zawPtDjfiM8<`()E%6GFprX40hQ;{F|T2dJQJ><3>P2?Y;OogXy9xmtg{Zkcf^{b01K@<9LN%xgfsHy z0bN^29Jhm2B~E`tgRc^X>9EUE6Qykmjj$4MMzW)d!$J(Y5fqgW`jRI>f=dC;yzlrT zYRqL9@!ZW1#2?~%r8kQwXb2pN*Y%N+yK#Rf?5y`TqbKSopCANE_ui^zsRKUsd4jxW z-@r9QQYP8}ZGjvQ&+@yUnfhnuZ;l-KIK zB~5FAHA{IwCw-TMv|&Qq7C>I*MOW}rUiB1KmQ%jM?9#-r4Yr(|ZOcx`4~I z+-jui`NK*DLCen1;z2C3J97>`oBnlrLdBLH7G&jpqHpF(Xr(Y>O&raFjRaUZiz!`0|0Q2`U*?x5V`#a zb;u;b6b;d&!bAfx6$j1cX6Q2u4o!`Wi$|(jY8g5#J}ih`8f5EDeF#i_MHL;?=sjy2 z`PGXZ&2^=jzLIq@J_bwI(H8!-^&@VmkQS;E@hc=MKDwX?{5UFK><6#F(8!U@=^0M= z%!)VG&X{JC#F?}D`bmpcw4QP# zX-s*m?!Q>-{1b%oTn0;P=I~VZa3)7k-bPLh|CotIolS?y9ZW)mt7os}cD%ve_G;;Cyj+0A3tyJ!lPIh+!-C{m+RRLAZzGbva_ z713mOB>faMCpbo6kXaiU5N+j8PZ>TZs~{^gb61(zhcuj7Lm_l=Ik6$-)BXit(8DUT zmJ#VAYZ$jV?FD#PiVub~j1yepFJvWXH4bP;PMq1qD5_?#_{l(R%r$vJILWKkwP^h0 z<#yMd8k{%bdRe%LJF3A*3x~G!=yocoiwh#IAkN!y@z&_zanb-6>mU3lqttyUt?2Py&Q!_U+)uIYX$(77bx9bA;OW z@W^VM!Qo!Fg&%3=BW%fgB={8!H0SQIZQ)+Uv+WP9qU!ACIcdA{aID+9cz`g?673%^ z3tTQfR0j;wD>^`-XUj@xz1un(M=+m^IZ|O=n4LCfRb+`~vzHwk7dFlmS!m@QcOV|q zkU#fh*1^wWe$6cB9p*|{%pNEN)@VO4k}VJ1kjf0i7;Udu+x<2nkMqTtUX2l@v^V4r znv?M!cEsfSgwqJ~bIRyuXHxwkd@PA)Xk}ABL=@4>=1T1@=akVS?AOs@SpLP%AK0|GX!aWs zuG(-0V>Ee5F|&ln<_A}^oi+S;H#`AXw&{=FpBT}Z9TmExP*yTq-j%#Ohb<*}HLkF< zw_e{V&EzYW_)LrQf?W;+?Sv@$M3H(HicsewRx4C^@d^iB zdu=Zt3EhwoQo_kqcsY<9Tp{f%O%9G6;UR$M6^CbgEvX2}xe5$eelUsbjpSdD9?fwT zQOYPa~35&cSDIsvdrdwQ`yrh|*1TMGS;bDfK zP_S8e#_`JJs5iG(6pq$nf$yA&#>u^*xDmI@GP@j@vbS1weG~vl`cf{6$Xze)6U+A7=$zKsZX5(MM#C9({a61WcreLM$yD4$TXbp#^GzU#ELN7Q}$gs)h<uQJbVUic_1WH>x?SM!fT# zyGlCjo!e%|g&b=fFpR0q0Qkbxa`M7VodEPNwkdqVd+}ThAKn@{Af}FoIWm?m8@K!5 zESrY-z;HWwk@Fpjx4~}Sif;TpVbrE29-^vBK;F}=O4#nV)u!(aTCZ2~gBI@Rdzo2@ zez?u8hr~Y+-bb=Y-X6(r6Z6A&cl6?}`3?lzHAHam|A!XjpNW&LJ z0sr5J!n+n(p9IU}fB|NQ?ssaN!H3)LA3eldP=Rp#L-1!xyX5V@T8F52D8CrRTYL|g z)(ODSV4LD6x!aE0OPojWg7gi#CrWR>xhG1T<10_gSnYmmo46mLvcoIIWulQdiu+`( zF?FeLo3tNdr$Zdzoz89F@I^x)uKHH!d>H&zNFXS8 z{Oy{-kMwHLd4=i=w0F?$1=%BK0aSpdHxT<;{spsZ>_q;#`Q5uKI_zM3|0$~{Fzj%9 zA9;neH`+Jra+Lgb(gQPYf_axy$!OI6AdMw_^bq?-T4@{5XaB2({3-aI>@%490Q;IM zC)ub^FRLdePrzT;G)=(YokuXd^x#|1&ii{xU+CSjdhvY6Bz<2 zMR4?jm>HYd^%bBNjzZ@7KJL(S)Q*$BCoM4Fbi8wX4xhjxOepVD zY{ftAV3Zo|`gcJa?JM6BWsT$>lwKolCFc&{b}zDN#O3 zH+;8e5$t0%*h@DYVeO7K_2M19hl@SIBv_#5Ez$bKUigYS`RX0L@A)!$za0w(NX#XN07|BG>RUfPE1nDAxgQ%foGUOU$0(y8&DRl3l+&cG>UYaz#bDuU8>y^@3;W44x50ci9mDFuA+_*SP<_TS`c7 z{b?G`(0U4-S@AVJMR=yqIN?V<{Px&Rq?58G*sAKhd|uVz03%b{T1y!eIyGn;lCxzh^ zF?jW_5XQ>Z?WfQbJoaD9&p~(bqv9u9W$;!)Kgi(SKG`WB_o;^ z4;G2g9~}e;#8oFk`Rm*6*_GaIFXu|ZVybEQ$55tdvaJTf3r$ly#KQ~iPaWJo*~Xd$ zZR=wa+uF*qo#Y>#@DQc&5XErGSQL2KaLI0zC{0o<12G1#nIn7N%-#=JCjl!<)fuN8q7>yYV!#t#qVz4q+JW{zK2)iLAln7z>@6xBwGt1TZH7O zAV|9KMgrk5=BBevRR1WX<%KgzqIM%l>IcNpU(Y>U&mmsV#auf=3U%NKbwCMqUL3v602A^97wUiz>c9~4!u9F;1dtkjp%}!Gc7TezkcWDFh`Vrx z0`U;$nsN3Xkmr~X=IjvWQvQd3;S@}=N@)EIUlx`~`x(wOjM9xD-t|e;frEcyx+0V7 z?@!c$BG^PI*aR-8NT~~L1juB-c|~Jc|q*B01(1e5Wyoz5+6)o+TSn`Bs&fOVk_l;1~c0Z zGb;sQiT)oyE#}WfB4R<_=lTpZF>@po>Oc`%Ln6NLk2|}b!+N%)_h~{Dsu`4K4v3o$ zi{ly`{a&a4Y)S6Z1p6Ot(Jzg^Q`oq>&ld_bc@H_m;ajH{xA6W2w5dgKB>X>=eUU<1 zV+ynZ)FOPt{Kjs!A=m#yE-hN2ZL$Ax68J1GEy|(kNM4kl>4u_-CsJAY_}7RAanL7x zHl@GoV`@bC4Px3|Fe^^v)MxE57MKoZl{`-1Jb+GSv%ehXCljQYgR+@IVweI#n5d8! zBq{#5?I`>SYT3u{KtY~|{C3M&uZw9Z$Zq+`)Qz#&gp27S6nR29mVdWXtav>uWj5RH zFwZMf*l1jeSU0DWIPP?{e6gh0W7k^q-m$s%;o8ahbmsQ^@tZ`EO@%wZSYm&4J9G2y zY+l>4V{B>FbN;3fygL`I>|0B+ry5t+tFgR0F{Q{sf($8BDCg1e08w6+W6oK2NB7iO zHT(A_N|n5fiD+k>GmF2u7Ju`daWXz+lz2@gdnu}RAK|h^R_2rD%9LyUzHHZZ-e1gk z(fVy&vy^O9P1~va!=u@JU=eS7F@p{NB@jbg+;9A(J8P?-X4>JEvs9X=J9)uG$u>(@ z#xWP_6oq%yg1J6)3=kpYoy{o``gRUqMS5$QyJ_#6DuD2|no^kZ-ZA4>&MD!yXpw7$ zm@w@72=+Ui;k5BsSG=fe#?Tlsp<(lp;Eek*UWTIj!S_w>Eb|fX_pG6%Z+!8CPU}q- z&Y4{2`kL`fLrYlFai|WYsdp9S<7m~ELnL(;n|GF1mY00^JwX0NRqqp}xtP;hUg;l} z`@htxGRB%R#uHV&DpftT!aWVB6eY~kNDawKb-H3XbyZCD8`78X1LNNFD6LbRACb|K z0#$|4^Vi55fwKLA7eOyV)uTi zB@WiMZ`=Ia<}-MqsK`=-NCAmZ{5n9JA}pp${_kTm;T~WRe^RqeGOU{$-k>R|b5~du zOOtBI|2qhy^Dv@}QA1Vlwy-4_JxML-X=&OTVWM2Ize^^Miy~2{@1H z&VB8|lnt<`U-ByU=K_1e=9q1roJ~x7#4qP>n{1sk?pvFzaQwFbpBbB<`pCysZ0s!{ z)AdvIl{E?BBC9L4yLk1q?9|d#y&1~hpp$}jrL)icY}AYm!!uxEvE%11+Q>SenAzBz zDsI+!S<^*U`(xNke=~!3Nud+r3WWl+G{El1jVPI5TF`Rab>&wvykt3mVjmjs_a?tH4V8jdC&1AH(k~+mfaQh?p_e z=H5TrRhKm;!urg-=NFH<$=-IIqdRGF&c1WD1cw5XdPj_=I%FQ21m2L`i774*W}TkQ zo)mz@V&`P&hgc^F>d(63O1iI^+{%~wQ(>M@blK>`TBQnIUC+-jWa}sEr;5c(jZ4mB zI^7F%Oj8XC;|Dr!x+8A6`fA+joF(i0#d+(}N=?rCq2s*6N}`q?vhN^a(V7J3iNkr7T+3gEYe zJO-{-z$G-RBY}loJ#r`Eq5t7=pTw$+9XUtp`7@16C@=OpJzjw1m*qYIqdI)B5pW7cjA~6Es*_fFj!LYINOR`n5RFq=rm24) zjx?QXJ)=B3b!@p(gmLYqA!8$$ zk~1O=(&LZZ6A};n;f>KdkIqFiRPm#8HSk@g)0dwKOb*1uQ{zM!iC1Cq|8Q8%7g3o< zZ%$ddB}Ke=o|nQ-(EL*8*-3+M1*Hb;brq|rDfxAbbCR=it2DBXXX>y$l?yZIAFv90 zE3Qe_xQJ`k3)(ByP|ocoQ7zYGZE2oTKMCeHWBtOMpQNlV9@DdI9L9SE%(papoJOD1 z=g#4~Q0gGn@~#)gz?$(LMPo3~Gqn2GZM#I_!VxFln0=e}fXZ4lK%*sLQ`Q3HvCtB; z$2oW@h_Bc)-v36L#7Gp!#zrg-S-HM;yU_dke=5vtm+W;C8$}mWX_uUO@5y$l8=x>3 z^M2eUGS3hblTGFZid9D{z7tl5Amzd5LFdC$H1`;`O12tM19OTwS@xNnaAfT^%a8Vq zH|s8Gz=i{iTh}-Bfo{h~eVc&IbE;PdaK7^{gAG;wWQkNAHegi9cDW#0625uD8M(@oW?C;TXq0rwqc{c1^mr z8n&9MDdWv)8;VSl9uxpf<%N39#cZ6M8vaFriy;>2!nh4P_n#ixM%pqix?= z4K-a!O|P5hz0FCXZPvHgEhLl;3IK^59I@PW6-FTy%Utca7S)8EZpPl^LvKuPhNZe{ zB452_xmALDkcs%f>%b*ivu<(h9eMRyMq-lK4>c;uVOdr@fWE$uYqC`4@2TSU_RCXQ zxXP5~?F0iPYJ0%wrmVT}NEoo#H;J11vN%mF9-5+=sh=4Jv^SUZoXDVyn3ZB=`F#56 zNly^(M*Z0CpS_;#0&0YYu$h6C~ErCsM&(EQ~b4k_x zGiR;p4sS0LeK9A^n|J)DugiV8*Y$ZLSB5M5@^QM`Sw%ZOHWJ&V!5i_^_D3tMDc#~ZuR zkLzQ}>Fodt48r-#C_jxirN8mVmVa4iBGOTnt8{6$sK3lJXhMTWG)s>gL|h zBwKfrb?a7-|76S%*>j@}<9zIP!FwYuNM0#ES+tq6S%%;o<&?8@;z*R5P4DuSrCi0} z+P*xpA}2nPifw=;VR1_4yu7a4Qc2GYx-_5PR7eMOCi4;7n2${ z>BEsou+=(~bu~@`dylR1j6mY7j*p8UB5W{Cm$3F)L)t1aw>XU~VW?k{d6SajcwJjx zd2c5_?J|<}aC1>vci@7{Ha*UL#AEUV-ggSHIT+&OXGV28JypI!^3vUIUfEA0RhbQ! z_A6^DCOO!QdtB3VV@$PUW5`;@6}^#lQL$@Ih}%grH&gM?@jDxrV?!*@%!C29LICW| z1OmY0()5Gnva8NP-oRiq|Ew0!Sy)qJJ#k}^D`@EY))6atw#0au5g+I2!J?wFj7}-horjr@rO_o_A*~Y&@U#CYgIZ)(+F+e0cXe&dg;Q8Erfn$BDza zqX5GaU6iZK$`nf+wmv^`QxhMfAOB8L8Hz4ZR!wUQ*KapbbB?4vB7kmy&?a!~v%v)e zu_3Le9V$@^6caU1qTq)Xhnt67M;-t}wEH>viYjE0hOLu-^wXdD*Mjva95cv~&*$*o zmk1Kk$#O3kCzRhoY;HACkb>7-q>7E_z2nx`}w-Zcuk*Z4jY6?Al- zfZiM(9L#4>TZ2VJ1XM{}1;1`;Z8<#AYl;Wh>RV}QPAA`>TSrA)FX*)<1$(pOx)p)# z9qu{Hh+=J}CB9v}nLc#}^F9LFak+m7)8U{eDU2Us_-9=yM8BYI^P<^}s~=a|bEPTZW{GnfDr9n4TI^v$tk z7xWs)K8-asv96#vl>db>>LpkxG^s4%S9K3wMg%?#1_y!(pW%(pOvr(A9<*M}V0-F1 z;c-K+wZ^n8Lx4%#rNtDpoAX6oYWrEL$dHF@or|gc0QNjxPGakK_Kxn+|9!+lm3~z2 zSYIot$r4-|Fp8S#kCFwb(=s~fd|&L^N7_Q;A9Py0tnPAl;+I)nA)b*#O%XZPGx{^G zIrv>qN**3!y|%fGeA9%-5fjcGn>k`v7}7EBv8FYhgY^?P@fLB%$V9er$J9g_)rksf zY=~cj-&cUg|f3(ZOmI_V-mX_?Q}nsWi+xMOTbreUqWw@-YJJce#CvHf1| zm7U9sZL9afm3@E@W0u*411@gZ)_}3A%vYe##57g zn9nW8nuy5J9ohX(!^*!DG8XAXOvj^#1^gKy|-n&FNpiw!LY} zrDa#H`<%QnI(p8ZPAkmLE+hxHw*I`Nu&Ho^&N|6kNUoVaXil%sC}RJ{)gyl(&J_QO zDdbO2WhA9L{mzj5f2kDbaQaD-!|BhJOxgf~lHc29(gsRG@_UjiHa?J?78@VvOkWt-VC_l2&vbwB zp8WmVSMm>O-^u^DQU<@wEFQdE#+ zD=Oe31^V<5DUoai8FnGyt@E~cJH4B|LtdrNOS~_-s1#iv-5M=KhltQ8sK8{S^%<3F zYq~F;riaL|l$0kW#s%`mCz|}*@<^U!bNa1$zC4;2qSr{#nc6HOXOXPZ1ZHNMR;f$s zm9|KtlzdSfe>2gJA!Nji(oLXTOF zTd1Wp3d$Vi8%ja>RrO>2Bqy?_I?>!ctQ+ngUg>tbx#vH8qPe?xxZAzb?H=yt>*?X< zz;JhSVE8CoNk=yOSdgv0+|6vU>vof7p6(30_u)z1f0$_Gb57WW&8FwCb|dpsWO_=7 zHzpcIBcGQXX)ZF^Y)|qP7W&e2ljBnFZoH*&(u9)nw?6WC`>Eg8-86Chcs5VDQjA7@ z>gtO-uPMk+Ba8z5JQRu2LYLl&v+neut*O8tPn7Xwl zkf>i|e{}g5PjXeq$CcLnV)^}-tj}bA!OXMxxn6t@4l-G?OD-u{N|cf$lN2YZrD!Qe zij_1mKV0*UvrLs-OhPcHq*|;tdzu4fDd#Y-Mjn7m9$@QfB+3Iwk_TXt2M{L@u(!6@ zDibmC0Al3&cosRGR>tHO;VySUJe{W!5XJANYNHZr>wMvz2l49fhrjR`F zv{4fKGjRg{kFH2N0p~0sDN|-MlseS@s_Fj zaXDEN(?D*_B$-(g{jmnN6DRpBHoq>qKAK9=z0ow<-r^y39^&z2#!KEje|(2QXSYOU zM)&%O-!8^z5TbK;+gs8|8Y`?e#01ik3lne33DMb-A&Mc0HOdy16D35MCI$9He|(#1 zBg~(4^GOGR;qE|Sm~EtLb&_{pK*y{^$E?Kdb~g>X*%EZ+aQ8}g#eBYyAK2xc7YJ_} zTEbjsj_?G|`@%)t?xsRRVWGZI_XXh_YK3f}z}B$c&Gv%G3ZE^pB8%0?ia+9ejv0u+ z^Ah6uGIye2owoPlhyF;SK5gDuf7f}*9TO~>h4JZy7ym+f{w)XVwc}STxoX}dbKcyV zXQt+4WKb-NI;p6y^(?82N6Mx1Lt%_GW=mbNDezBn=VbSJDz;xrQR7ia~xSE&6`F~9lK#SN&kHIox);AVCwZX zrAdZPbIxzBU4Lt`Zdz$pWyvKAZ}{Y|#A;(BsazfsFB5hk73t&weQ!M^=x-9+=%7e;7@rO*GC_jz=)buZUQu!~#xA9+FPdl^|l+{XVSQ@`H>9XX@ ztcx6X({0u*j>oOPc6?)sNsUqnG2_xLM8%9UtH`h7m}W}z_o@!4=y4TMg^2MfgGEX$ z;O(zXwfS`xB3XJZe{{2jSVAO8Du85g1R&W9Af*&oLA0pD8xUl+HjLH!0nyF|ik%G< zyWJQi+I2CO5N++lx|opMyUQ^pzVdocE0%8;k#F?q+aY95E2m%!f0T-N-jlg88IoEX$mJ-g z)&??qqhtKJA-Px5M927(BuA!M@})Y$rjSYq6-0$He@dl}9s^{%Womq)%Mfo&_N5v< z+DyA63L7a=`s}GO+BnxbVhYi@ebLN&pDQ_{x2d00Kd*j6Eq18~)JN0;d!kXN7Szf4 z^@dghHN4_sgE-!5tFyJ(I&EDx#q%~|Gv!TPd~Pf1SGp)pH^;yq7ion!{ z4U#S=*PN1T_Bq6y6qkdTlZmd_jj`Og^zj+aOow88y30YFh~)8&nP$?AZc-3|VuzmX z$wbx$Y#)q+c*Gzs*o?X8IKyJcCC{$?lm$Mxe{@OZ?KOWI{g@>GY5MJf9c$L?U|*rG zgdy>WaoK~b*~)d%^mdPjBo6+OBzi}uc0c@Z_sWMJVrbC|h_wnm1f<}le)hKXt{6=z zWnGyNqbaRd6GNjdL^Y$Q9-1lzY83jzhexj%DI4>9$d}wHA@X~G zf(VbGT)0g#4r$55%EwY4^E{KXzZW2v~gu|=jXvF4?r&uz#tDm$7HpNv48Edmj}!N z7k^$RvHt`so*YT-vrN_Y(`|IClw$E_6_BX%WP5a$U0fF(Rjw@X`<>2&Xic0pMCU%0 zXq55_jO@nDt^%WEDe}Kz95Nm=%0{u(*k$ZBZZV1mV~8A=^cI^n$4aeId~Cof8Dav~ z5S_ax!{Czg3S6v$bXS3kSKu0Q9dpSpv47RoL9GLgaWKyx9y}iglA& zu_RZ)w#h_0dHdv{$www1pR9O;2Lzt!ndc2mmP!Kt$x>Ole{yd{wSTg7QLTS+@5QtH zlco9w|77WsX8&YUMIbVnM2?l+&Fich)S&CEF2e1GC% zPQQ!0^r@Unnt9%Ui!FRzQp9m^H!)Yfx%d<-U}Ob&b0r#614brjWP(O^hemdXVf9U1 zMe#^+@z|b5fDH~k_gM<7Dr?zmHrwd7s^Ivx%J5qzY{Rm7?Df%wYJ6>NbA)Y z1G$W(Nm@f`E+YZ%$Qnu`mk)Q?{bkpoF$VamM`H{`vF(I-GmrPho5PM3x=Axhm=IpZ z@@F&&`Y{BJJeRp3{#`VT0QxW^S$Q)Gyp34}%L`XlUn-TB*1VMFNK17V@PDAgkv=6? z3IuBUYXYTZYu^oOy5tubi?X^qCjz4YL@k>|=7pPA+MW@r1J zJ0F4>1dRRdo?7*Ttnku^jeq#_>q2C3`?4d*+-I3;36V!7JvnK%i%|v243|r%(?%y6 z*}zq)rPKoU=ue5MI?izCi7f2E?B&%y90u^0Cnd@g89Z zT=0`al5fO%B5fpd#Csy=gkPyNN4w}A`z!WCnFqa}W`68dTFp9_&unvv1~2m@bC@TY z6dmKYNU3hKlz*4*QT^N9Y&Em$=>K>(JJ~YTl!P18-S*Vvlcx2lQAx@?dwR556_>$U z*^y(DZ1pw)Hl598J7N=qHeySjVBVOVY%;<1WsWbKyQC&PbT(a%?hW0L?wC&2MQvmI z%LNOsjQE=z>x(}wX6Ah~?08P&&dG2faN?+LSoZ}7$A5^s3FdAlf8X7-b4TUJ#WnEK#+-sbiB^-@{2 zUoY96etldrpT2VP_;k9<;^KTyyva{8<6=T2RkFv~#i&eWvMCxWn<__DuWD6wsgzq( zM3w9&fZo6?PM-$5&7Nbgx3}86>`J>SD@4f7E5Cc5QLHPTuKRdpGk1Zf@ki}$w>wP3 zi+`K%!Rt5%uemv4^U&(3prdgPg;vlzpwm-A_yo=ksJWXNh!n459*3S09rHN!j6@)$ z`y4j&4Mh&e_J8AZ7hiKvS^K3@iQCm+cR$uk(!YBhXd{2dA>7v6Tw0Uo_mo_`Y}x2* z-*dx3aGyLR77II2{r~iJ{jqIab^N_M$A9*{v+v!V&vxwe&ORr0;<)xXiJkU>yLUK6$;bJ6JBq!=_UxeHZ=<7QjK>66JSGTW=x^Nw z?#m7WuK`-yI?BeNv3;uRRM#D_3O{W{aud%6I3rMu@=8E$PQ>Cxx$h|dOz|)L-wa{V ze82CG!6u`y*cN4b3IPN>IbWL|34g?jOd(n9E){7AP|r%CyM){vpfkR&jGSb*_L@#> zuW7fQ8Qxh!ZnoQNb*H^ncY1H9z0W&o-r~2Gi-iF4w1aA&dk&f{F5X`1tFQrtW|{p~ zwOCM!#R98u@+GPh)tgloSL;9XYyaN@L=r_?-B<_?9>?dd2vV?*j8M=mBlaV-~NeI}$y~o?;K% zW3vT%YpEx8fBl3@zEGK6Tyj;8rHWm<4vsA3NQFwk<5c6IM#014Wk-0E%{9Se?Q2|e zh&VZF9<(`6I#}btLP4^XhJQgCsx)k)fpWKJP>{5_Iq7EI{`*jn6e-NM>0vG^5F>?S zRQ#GdgJZ-NB$4F)4$1CAbJAWjkwi}@k?k}L(om)0bKR@EA*F~Y@sn92UFmm2aA{vJ z+pMWJj(xy28AThu0=omdt@}XbyMu|&8snnR|)At=VmdvDZQC_F_CDOlxRf68#bh$fABzUUqTBCq*kqwYUG z`?yJ$_^}v_#gu$D3xCG~^8qGcU)sKMAYMqfITTMu)xtob`}$$!F=b47U3p8HS3XjZ zs3h$dCY2_I+KV78H|#}~ic@8Gi2ursNTxwG+Yvw>SYDv0a=9Wd*kx3dLyU*bcx0#o zCe)+?hpT~-&2q12+cM>~`sG?+!tN5rlv+CXzjU-m?f62nYk%d&*DqeQ*QuJlD%s_X zxwx`-AgphVS8^SyQUBQ?c!@TiqiyFL_5f(BH#|RLkAp1qTPc(hLWHw~5J5s*7)7JW z+sUS^uvvIIa|6DIKfvCGr}KXd7g!szRCu>8-3#$kK`UZ~EyW61vL)Gq*#=9saA1AO zy51mPbS)e6`hSp4p+4e1*7N}HPo;E9nPM;oUxV|IorDm^bNU5_198wo!M!9+$}k~A zIo5eExL>rfjw7!Fis}ie$agExSAAk36>9XJ}jjEAbdC2n%_BhD1 zVe7~M-VeTok6{m{N)Mo6m--#;7(S}~KyAX4^u_6XcL`6X(j_pRN|(m)_wg(E95{=w zU@tY=O$pP&@3kfa7KE%gt)A3g)n?Q`f-CBxhUA|Bn8aPUAAbq&$FG53@M3z0zs;97iW#*c4B|)dm&Hf4ePC4hhV~SAN;nNp<9~t=@f{$wh#{>N zri9IS5O34o1Mg~_oaB-y$tMHJpdlL}LovdfArXnlBt#Svu7~Q1zb@6~dU%htN8S_K zqwER$)g*@o9u;X-2-2T0765?xyyz&A(C6Z80e}D3#xVe0Kai?wje#g>LzZY^ChhD* zH|D|rbqf7P8>0BjITPDJ<|6J#_uwy~;ZYIUyZ=*u-Pq4-s)z;X^JT<*o?7BLO;t2a z6)>hpDu4>WB7pAufIkzBMEriAHI zPJgKLDyz;ir)DM~1Q5dC!52UQ5P03u=MOH899)jw8fjh{SrBbguCt4!o_2pB*K}CC zJXL6ROIFl$AD;4w{))ficyXPL**T!DesCt5pwhuRZnpUib#`^`w@M2UQ`i({SLfcq zZpGVuaD(_5}I_F@Isy z5@Fs&i-;NEtC1_<54`8E;6t8~BSIiZ$@w`e#Rp3~bqKeE3~J>c0=pu6`MnX}=a|%j zS`FO&Jc6|WS>q!B*sL<*6@+*mpa>V>wa6@Udxi>i5TIG+w#5O>&mrHTaAX$hmWX+g zuk%mxC-~?1dEUpLXMPF*)GY;}(0?JqS==zk-ryh?i%y(q2#E_7ap~5Gtvpng7DYN} z7MClsX+qPSD&(dPUv72=hrEoAfdUh^E879f0RcCc_uK)5f8fNe0C@yJ>p2Z0o65RI z#(;pw9qg#_YDs<|-x{wE)or2wv1SyIpu~;*)^#Fu?e^ zb2{hs#xNcr1ycRoi`(a}-{F`HIGX_NivSqZpvVRhMKDNhv61~AXJ7@Cpx{xAW`KRI zeGwce804cjf^i_S^r;5{l#lk@1#r7Wl{k?*`cE<&e`SvHujNn9npHZ*So@P&qn0b~ z&l%GurC+=^p`WPw#|rMKIu1Z{{0bbmi>!bGYQ^1(a)9{KDQm;|)T~fY71L0vpd7ad zeb1Rb#*M5GLO?KRimtq0dVqMTGT@gVPpyasJShQg}X5-?MrNlq~#%G#1?ZAEi zqHX{6(eF1u({VK(#>3GgzE^Os?kzJYdzuqK?_D)#A?LuMZ9j^MdO%`SN zf4}2)VLZ1B&z>f4<91;dw+pvO=Vf@(xx2YtSjp|eqztb*liv0}d7l3s|JlLq5`O@o z!bAz-I1NDkxHFR{u;ZFco+1nLGI<686`4GDl8gdQcr$q=ya4Jk2lH_;W}+Pz<1Dn} zQjEq}jKnycBl9{j6LWA8f~b;$z7TR#}zd83&1W|?(l%WbijKd7HBlu5u4$5a=jJYyx!@SJ179og1 zn1xvg;%v;sbj-j!bjqc6bjo+S1noFamNY;se}|zRQ*m+T*+@?-e}$1|=v*5YgkMekhQiqYbk#7c&sVFtp(!`5M!3 zVMca1=3s{0>ccP}=gF;?elMvlX3Fm}>)$@l`Eq*%F&Hy36|-b+o7@_wzGM12b24ul zlq= zroqe;^~nZhey40F(&#+zxW)Cohg3fgZJ3E!=tPlF-!y)lkQi83JD`6}b-&7r^0LyB z;-bQWcz#}PESi%Y35S9Kzt8J&yPOWY&1x~5cw?49uhVMODy4#Bl%Sw7e=?*sn2fe2 zxoBkAutKREX$vN!Z6`5WlfkxNa>%JN$zZE27Cco_XbUFKKTT3dOA5y&2_LLQZDB#M zF%nGfYKR0=Wa5~nNHDpqA<`U7cFXyZa(;!JH#9_=L!rWgV6f3Sqam0it-;3RkV|GP zZftEREFc?n+WJU+ySA_Ze;c&A`bfR5umDL%WbOvy7)ay{bu{+hK%q7i7BnW^k%q>k zE7Bl6L6YS(ww;$8J*KI#!4nEK7ZxN*{j|u`BqD>8#<(nkdigd=V zb6bOVgB6RI>Wb}rUGwsLgM3FO+ zLTfTOEttgFO_3zcsg_84H5N~+_JpLPnG_a`NS-&Qsc~jfQ{TFn?=SJC^OK4kJ`!B~ z6OyDg(*5nJoVE-{nZy4CDJ$8@aZ^i@w!VBa9#7`yOD3YKe@`l!QNzs{+ zxqL81XEp|t7~Pa4ZO#3QorMLVkfh)xDFIUp3qr|7W17H z8!y!?>Z>_^dTS(9Sg=WUlx<0M^!T5Vw_6%#^iLA|Z&bIZ>qm@@j2JVqDcHEUHPf~u z#+_11*H<5}f6L^Omii{lUz=c%TdZkeO^kX9@CWOkl>Ic z-#RQ!o3)|Pe|S<#JS?3hCnrwJJZ7?g{M7P*Q_812o_;YKF)qnP>4J)A(7ya#jT6mQsSbiksu#gyoE(sbn)EA);^7auCA7YEaPx+2a^sk$EkQt#xm4mxOsNo*3K&5~oZZw# z)v~;2ivTQ=YdM)Am#3u&WS+W@M=&i#(>y+Xqo{l%0Tk0xT)IZ+ljbljrB3q}rKNK- z(rQdgfALbyR!{=SmFYu5jrws-C))6Qv1(GL)(PP0N%G0WR5U!g4}-sz2m3IXmAf55GThdTs6n+iW5?$3Nbmu9|FeQ%E_ z()Xlkaps#o#$g<8lj%4zGM(Z)?8R){f;%vdl#@5{CU8I@T(e2_*Frf+UScs?bI*D`OT4Bc77?0oMPHe$* z*p2t`1tG*pa>*j{4%w?f&(7YR;u+#pe{l{PaTZ2n5it@U$svR2L^hGFWAF9+x%YtR zhY90w2`VY$>ewBI&w3)l{`qEe;`ki zZ>WO4<O!dzt&Dcb}*g?-n102OfBT^&s<5fNGqH+1Q1zNiNAJ1tdY9D5#oVMW3J|t79wJtDK9wv-hmt z*}Zr6ZWJrTksx4Dz=aA_pg(Fc9?j^)HMj-$<1svrjd%n5@EvgyKPe$+e~@!X6KN$g z$Q&}4bdW2^mE=0|DA`1|k$vPN@*U-|{elF_7 z?cx_uq6D>Q#&mSzcUXw)e{nO`;88q=efSKA@C|;zkNAl&q9JbLCjnV+_2djPlAJ>( zkY;i|IiJiR7m)d65qX?+k!Q#b@;rH!yiVRGACvDXp*C7Xi|7DaN5|9i={59j`Z!I} z59kNLbt7pQw+GW}|669RNzU zVHjq^s#>iKDMQo>UezjHgWg38*#s`i^qBW+e*>LJucxheh&+R%bQn3CT*7wIwR8$w z&8_4HlJ~HXKF@&~f5^`mgh6B=d6c|^4!VyPvi01X(iIhIc1$sw8pIp8Lkh~?2Dmyx z*=uAX=_aG8ojgwl(3=q<6A4ec5g})w1|MJ~wvY*^<_@r>bU6J8HJF7}9D0!S@)APYG1D%Gw zv>CP7L(H^@T!jkE#uBm^1*C`Uz#H@yRFQV}+%Z>AE+xmh$p$tI8^}@aRqj>F;V5~Y z`bY^;69J#$eyqlLyo?Zw;!#vXK?}gpf>xXf6a9%?NoQduxs&~cJV*y&6xvxQ9YSvJ z{fQgI$}tFAe~F9KD{ItH)GB;j1!v<9VIZbU@h;^IZolFhDbLuEI6A0ZVZUZpTA-i#|rz zun@hGzCdN_H=P zBkmI)f9ctchwuM<#f6Klf& z&Xyn_0k$HOE@Ml&1_X?QG;9e7zGq7yvL&G64t7u1&{1VuIkUQtvwCB{+OohP z7rO^Zb`N&2d$5Py0}kJ_dq5CitC3`@v4gF~9=2NMuLhAX70Sz8DwDaV%V^JVjP|lY ze_Gbe&OsRhtSOUDVCQs|1-1`rW#d7xUZ!iAv_7$1rc-1(N~R0t+J$m{j+~z(=M!>1 zk;zN6_#_&TsZpZrY&I5o2(U41xSWn=jmSZOjbg*)^elFUoQ`Be<@8K898Lt-2-XNQ z0&F-NBA3r#jc7oC4P!&(bSN9r)etBde>9g3!4%dg`AkgWH=vj`Ai)~I$(-e^0c%+U z_RE|ptN{yI19r0pFjo+hJ^&kp=rDn98d5;qscEEiK)E*AcpU(a%(z2%VT*g#$qg&<+3mf zvk(ihAPcep3ot+P(-m|DT~3$No9WGT8C^z~(xr3>T_RZ5$G6Anl*&1k3oDmbuBlvK zxxG@gjkeJ?+DcmmE$nsxe`b@~J&30qCc{AfA=7m-y;!D#OdW!IvfKim!;r~_;>m^-nJPHqhL7Tg6>-BkaYI$yP#HIr#|?RL!yprBCKF)5b21$) z(=wTcW$Ggnx(v`fLna}lCJ2z&rqI=aFG4AfbOo*rrPQP=a80^2e<_^|keE*eNi;qaD#Iuvt@exVQ=t)f*2)VgASshQ(8&d@1no>lR zSl4-^VA>WCQgGcePbO_{md#Iknqj{r;Y^qZnrenL{0q{Wq45)kGk$U**)Q%( z-acY%Q}QuibFxgzh`#0#DUL|7w=J}qRy8(kq5Y(!xoL}be-W*2JX_*x7d14WkVBAG zH#TfRNJ?Zm1SL5HPm}Z0ev({{l%(bSvYh`Exeaxp#)b`{P@hblEK_%?%=A-brpq$Z zGcqhK6FNyobpRn*CZsy>Pcr`hKqlv3%AC}i?StdLagZ$-PWEl6zg!AjwniG;TO*CF z$t9P}a7uxLf8Z9>lYN<(X0&zcv>8&`)}A8!BJB;y`ba}?!|==hxjuQhR6RV>umP7h zj%(U*xzOIwHC!0p7-?&0-Z-=^f88m!yQ%MX8}i%!#l_mBi{(rA8oKUZRIih&hf4Qa zC*5nEbg!YpQ2Ac6)sJr4pvK_l`pM~ZBh_im^-Zmwe^B#aJ3n`zY|R5g&Z|6IIcXn< zF5aBfM+PSik->6R;h@4nQWXceDoct_XR4f64G4L*l1DOCd}MIa6d4R>N@feIU z<&h;Gg9%3QD9kdofESO#3X^ygHkibJzz(zce-Aid5&r=vtm5C{f?fPO+%omRA^sg+ zIK*GzgH!wkez?S65RhpQ9`SDo$utbF_%}r06MsgwOmk!!g9T+7Nz20)S*=T9s^M(evbso#qS}YT>K7$P$7PY z!Kf6!L%mEJP$hPw5>&3_-QnjiIO!yDh{l#xF90SB}F#-d`Z*V4R#cwcD zre|TG_zgxOA%2a~G93d!{2FItkoYyme`1jM7mUMT@h=!J({s=$euW7bDt?6~nKomX z_!TDN4Dk>q$#gP?i-*u6({nLG{1Q`eruZdVF;e^zZ8%H(0#h+c`~uTtdLBlLU!Wah z#Dh3rrqgk@cn~vWIuql>KjQ+77ypb4WjYJzh@WFNCWxQoBAL!XllVF2qDlM=e;sHR zKf}eCBz}fYOcD=Z9wv(iFdr@A0bC-}OL4BaAD5w3+>Zrl6ZhkCOcnRz3QQ9}#g#Zu z{1m@KyZ9-tLc9107UF#I6D-1X@e^Dv(`zt8{215D^!KZmK92bipUd;_G-` zrY~T%_&Q$1J>u)wiF?J@fAA9S6JNv2SR=lMKVgmdDqg`_@m0Jk)7S6^@m0KzKZ>v5 z4Vmu31L7-q6Ay~7U^gBV|AakwNc;`8_tDe-w6lId62BJRLnuua^7uVwlTo)LH8TRbCfM>n1ox8plJCvM00 zGChp#;&b=`JH+SkBc2zZ!(Z`&_$-dd^e4P1K8v5RQ+yVG!%p!T{DPOnXYhBtB0htE z$n+>)6}RD-OndN}f4B|3cwO8IQKlzjx>m+??f)+^J@>zu{$EW0FQ)%L!1O!+i|PNx z^#7wU{r^jTdc*$^(?|Rl(|;4wJN}F5|Mk;<6Vtc;ABE{uTASsjE2P+r3PUz1RVkw1 zLBiZSZes3hJ~1TOWcE1dDO_#?F=duq?(e}AqW$@kPEQQK21eM?Kq zO(9cG$P}8+;aHIEI3_4?6hUqW2#NRZrEifUXizRVU%=ZqfWzSM6i5C_pU2xqRX{~m z&yYKz#cbk(GtU3qa@CC(`7K9wBhg)2l2cx0w^@}D`2niv`0VP@WBN(thf&r2&yv2N_(J@g zeWj3gj1-e~8_iT3*(&}BCLZZ3ROb!Sh(97%Jc5|`e>d30zriN{?I~}TCQF?~w~D`j z7k}*XWfe+iUBWKqd{$RTy2!VJ z!xc&xt&V_nRvU9Wp;<%?y##WqOoW! z8VOUI&1!ep9rp4vb0z!g>h`;bUt8pBG&-(szk9?rMg9ifKCV9Bm0L4(+1mQJGq+~g zf6}$|qdmPp+;`=G%FxQXb2|4BUdo48)}FKQ(p_~CSETpAjxCqISr>L?lh6*yf)4`h zEAAI~u%XMW_N2sL1fxj_wZ@_IE`^DeH41KTF~%%y^()Tqoxu^K~@W9qEJxs zoI10)TxIrHx6=1uqSK#-LZjBZsC65?e;Ot@=$nET(@iEa9X#QmrE}rMAIO_&3*vun z>8|B_y7?pBNYo~}yNSu{r~%(oXRaxB68@(nJ5MQ;mY_w}vMH4ABO$qul!r`;OntomFUZ3|+?n8Oo^qcZE2D8>)sjtrG@*?^ExHaa_jp(g9$zWVxo4f7*F!$KGTy<`~ z**SQ8T&8`E`|;D6wpBb!4nhMRe=&fNNt-kpt=^p?f8QiM6Sk2_(1DUko7A6~>T(7d z=o}QnK_6JNq6(F{PMdwGe+gkdg!Var%LPKOCC7)!^QpEI_LF%{09)cD1Ocng#y*Yv~gB7 zK}!5lC@(9kH1*FuBYSvGe|`1EP%aEzUws?5s`B>g2P+?{-eTG6c-`{4b(iBK%O{R+ zE&p(c#U|;z&DO9dyTX(bKNY;5?20_KQ5VlOvEq>5?SvxYh07nzjTX34WYWf9&|Hur z%Qi;q%Ck~r*=BQ{GE!HSA_hTgt7Beo4RiM|-bxJc(yO1=xoXN4e@er*TgjrdE|5qN z2{;cPJd6L*TvI%f?>^EENg+K4%{9f{CUcDhqH;$tJ8Dd6DD_rUX6IO}oFba}o;_>R1j%rkQ5WCzzB$$y^BVkEZWkocaR!F%+F3C#j>p5v1 zG0VKme@e~zs>tZze|hWbbt_+Ld#c6ncDaUith)Qk2`dYDlg{Lvu;A`BZ%n0+S8Seo z$Dzq3yqR|zJD;9AV#QdghmpmT&RtPkVbwVJ+`94Ge?RVaQ0$X>8FvUigz%PN07H=a zLkeHOYj>r{mrwb8&)JPObBeSI=B%veY{5`yI%QT$84U%3egX8R^K(l_ZEY>zQ_CL&U)wEZzN_WCYx&w*USgYS6gL#bf5-21Lh3s|?XB%g zjin_WBveVte@%TOcV8w0Pvs_4gfQ0g4tZz&kbv7A7$Vc&S0s9GLGJ`IrH#doy&<(- z?@xUgMW)dGJs}Y6l}BX^>-=?^Ulnhl6O(woq4aiK5~BJRJ$Z2 zwo68A@nlzcf)TZq4`$l~ZW8c?@GO~x90^JgA_oPHf3J??w20 z=5>v{(@qN|7y>0`@pI0tP#}U5@|d763R|-)!v45FXf7OPR__?r<<2bdIv#O(9RGn|>Zy8~k zWVyhyz;dJIy6kP1&DkI7J~V%0u;_?FtqLlmE@O5uC)6IC7FrNmklR^2w`5~@TmC-% z=h`pz=85WvF~pn9L5nqD^V@w67wWG_F{bgP$ftrmP-j)d>NE!DXUaO{^ZCL2l6)@zS-J~l$R^p)(}$i8*Og?EELZ6^ zQcbQt?&!6Ql!lLv3WdWBj zkf0@;B2Nf5M77xhaUUu|?`$*E9c zHzX8JM^-}Nv>Osc$`Pl`v+5Hzr{A2gNj#gxvq`*DCJfET$M4FDs(yV?Xt!Ba%6{^& zZL>F&jnLgt?E_HdEkMIE`H<@P+}23=Nt+J za!^i23xz5*m#>PW=&|gr*~+K{l92*yc14!cnq6VY@|RWU!~U|0GJAPJtiUFDV#Z0O zUzqBE@!)e^Lo0rL$6!((U1`;@2n>zeIfnP#8VbE$&`iiWhe%?(Qzd-Q9h0 zcc-|!yHnhqQrz9$;ph9`d-HZO$<3W)XOi9QWbd4ug9i8hwf8a9F^VPkoc1rI9B>g3vV&m-br} zj4{&aBwd$e(R3N{OwQU*9O6+?8_1_vSgnb$A#A)}gMDnV)$_V$!MJCeRZXmEcQA}z zwV2~J+`mjeetFmtNpt&+&jnA# zpY-{0TJe*v!=iv_;7{SE(bn&_^v_4$ z2WR*j=(X6cf^HR+D`Xe3d+wTd{_#-BY7@c6wU&$iUctg;~@r#78V^Dhd;@Y zIWYkN0o~WdSsX=3&&@*J)XmCxCFh2;wO*^X_#&IK;%^1b|N z&Ms1VCQo2DQPJtIN`0^;i;Zcs*1z?U_T2nF-0iAC8#9@@$y@Z4?KDi6PW_zNNWIgQ zyIFb~vmC0UK&t%{Mdalju{upFT*?r0O&QE72|jtEa6BSol27L!UTKtww{Edw@c;o{ z^hXeo1P3XmF64n!#23AI9;QXh=O!9o$EqMDy_=leov)F%r#|!M&U!+FP&h)H_g7X@ z1#2{>od$LC8k~!Lv8-RQAl3U4qicaXOf-+UfX#}{ixrwRlnqYSgjF+0s5=g`ctqe& zc48vp&Qhig)la~V&)U>feesIZaiFru)z}S)-D@JWh)-IaoAoIyA}#33Zd|2*clp+h z_a;y0Wfg12jGGjB?XEZI(2Z_RRNVcm>bR9~vxH4~)80$yM?dlI@x9V2p;cnzJn?Ci zi&SQIXxNz(*CZxI)fwU&iR!&=f=Z&A`lWApLxtM_dfNeaxEyG_FHUeqf0YQYhu{p5 z@u?5gyBGL)F_r8q-+>C6g=HW>ZS2jr2P$z!KBDUJ?A<~N^SKG8PY5wlP0=vW)6+a+ zEFh(5bTXkz%!qXI#bawz5RvD%#ub`pv1}8D#hnWRh$MPW|uk{zQzC{nOr|E z#imf`xA=!nGrK0o(xofp2fYJz@!e=En3IKSO^=;v`cL-dy(zMcmz&`;pL?P?hD&?y z*5uOSMWG$1%~W45i2e#UePm#R_|j|h<~=HBbehiw$*?<(Uz2x%`_F3_5D73mBy@Fu zF|_dsC+47Zjq*cVpouT-!M%EYQ_Go-MZbsT0_0dxu3o#kDdWfbyL9DU z_{Xdjk?E*oR7E2rUATD7!cP`wHC&peFCXtKZiXSwe)#`O`j`3d<=;aZ$&Y~>YQuoG zIc%-(tKYa$xbc+-lw9GV1(Z2Brp_Ptj%-QMf8$SO)hP3H))=Y?Y$o7aevtG@g)*s;p`~)CRkX^eW8|# z(}NB>1@u9?r}Zhk1<|S29k;is*4s@jx8cv~NN4~p8hzRv&+CPqO{Kwwr zkQB*X_umb(=f(Q#?jN&x$!I=_2xM$_V6`tN|}2>=fyT1C4LvYi^a=J zL|-w=!^$--)-5OEp6WN5>C&5&8|m|6R%s;Vl+{e{y2+{vx$ zc5?061PxKS(rgFTVkC?D{FA@FoXT%bZwr^-4JT2h3gSx{&E+=wI`=)SZvGxp-DpQY z+LHSx9;`ukbUfRR(%~%6lOkFj2V-_~Pd%pXX&883WW@l@BlI>F;jF5}bO|-HSc#Jp z@$=nH?@DNYcwU#AZaqzHNzT&w&gkJ&H+Wd>{$7k$c2eQD zdYtY(?9%{1$v>{H#T)cjzrH)o@xy~^)3uw{vAsxTKU(x{2qf=?C^Y3OIYQIX zdnGTQIf+jA#%5S9SgJ=%ctjk^`uY`);1iE{MRrwftm{r4$-0Ysl(-*yrg|-TJ$fx} z^z2EzOF7=g7?b$GdQe?A&VD-U`Mo7ZKX8IjFgpW-p*Q9In`AErm!vlnURevCYrTn8 zwU6IMT}O+$*heiOAdCjz*OJ$ylH#s@x);$=>@etnZqU#zdJO0VT@_^qjxluUL4U{r zN*{aAqMhhtR zTC=N=e&tVR9G@wJI_yT~AOzi;zVt`gM9!NhmR&$qGqhGODT`DiO$5=%tYxWU*RIN@C!knDj3LHyk4IDS+LZxG*mD)8_rBdAc^xWGN7Z$DTbaWh2J7vNCa@-q6?{r!-QD zYs7%dN0%LZX%C=EF8xCtJ!ATo(JV~<5de41NIlqZA1?m$_oC>DGeQv#9RYUyLNq~q zV@&$LMnvChM%o>uvf_f^#vp1IR20}OIXF=1ac_$f?snOIbIgMm(%W^FTYZCdAwE|A>B6F4sS}L-lC%qm&~(F z6aOAf^|)zH>v~}9#{TeK@N1aPWHN}jqsa)~@wEkWgVEhfI75VrETkdOv)=cJWV60n zDXJe-wRUPdYpz|YF%-dyI?;0eivQR+u@=IHNJPkdyGh5=r;eV&Vy1qiDVxh8#DVsi zF~x}b9W=`|+`c(hS>5Sm$M=gM0S#$v*N+Eoq5Uav>MP9dGULHWFjV?nMLv)ErF)Lk z*9y;CD59Rg%leqPcI!xp$e;Gkx}5Jd^r>Q9vg2~Edtr1hIJjh)m_PgoGPH+G0TcpI5U6jaytsWH>C;d*vgtMicobYIx# zwDPfW{RSaibCMEHkiEhYjM1LkE_B6*51ZTJ3SBOXzs{SXH0r*TK5fFhmz`^`^YGkW z$USelo!;CEy29QjlN32X<*(aOiaFfs)*QS)n8bvk?4gZZMtv!004ALC&_Iqg;h{GQ zHwp*J%a6m;H0o8%26hPXgQ%!z{OIUN)A)AE_JkkX2lCe@(|Zo8g_NV&Biy zDA(yX4yJZ*Cpa$#-z+~|4{a`>ZIIjV9wZj5ncFMBgB4FXdJtFu$RO;$g*>R&#pI6P z3rNvtO%N5>YY^iw{0TsD?Xfh36(vWl3I?zdMbt%pEnsYVBxG|-cpJNM!8nk0DXeB4 z@uh{U7GXhH&Ark{NfT`oADhRg7{3mA?2qnxbD1WE%N@IK zvGp?8G*Z^%UmeN-@XsH6Zagm)^S$0ZOs}N6_S*bbw{hB!PPs2Oxvd))4I+@c<7)Z4 z=--VQ235aSy~FXNXI$)bHWw)%#;2-W25u}Uh(34&=Bjb-CPllUe0JrY8B?ogg?wnK z+4%K#8QDtMrM3$*;@7|AE&WoRplYXKE%=Je{LPh))($Zx0*`i77~E z^*M%V!*t)Mmu*$Gx9h~u^msfkG6HFTbtW=AAD=vWJ$~Dzu|qqDSn8-yJ9kO+y8N8~ zitmjB#yjIbP^K&7znNU>)#%>reH$kmf77{CT~oD2HKe5Q&1;N>Poz|Intk+ zor$;J5B6w)FTs$f=~=Tk(G`E5>lEF8JXlxyaNk(DsrsNTPoZ@!w;sR^7OH|(e%dXX zBD#e6E#sX6s9I2#Mu*l?mn$LXO68NabrZn?mQ9_eRX@rM#G>~wtCr6GQnFr*<*vAIae-wfp2VJZL!mCeB%yTirs9 z?WOyEJf@ynG@#f1W?48ussnj~Mm0L0Dm@|OMvGDLoKn&cY=pDf2v&+oKRa=f&Wui0KvavYOk|dA)M-@vMZ<97XQNP6~vz#o|W?cL+>f8@_$9Tzox}ubSlmyAOp~tS+0yiEQFDVym|Q z#wB?e_v6ZQA~eP{7pF5-?9N&qkX`UC{0Qzqmn%h+LbbWDT8eCiqvdAx8;~4YA)(ZLf`fAK|@xfCX{0MA3fE zL%IpBUv;Y^F%Er~TdZ=n7{aF{oEW7Hq4x~;!N1tyFSd2o4XKWEYmk;Kx;~WO3=6og zI28?+QSZ@BLtF*=mFzz)Clq~>eG^M6{37G2g@(OK%8NY@%MLs+RLhy|3d(1>b&Dt! zA1e~+JON-180r0ZKZObbUYDcL#tB&yXAgJ}zz_OOkxVye)6zX8QkJbJ;8q>M9L)sN zkms*Z01o`CP^WUKxe3Sa%oJoQdIkn6By~hoGSk-&PbGdbMLhr5!OexQ3q?tD0(4`2i^lgDO76>)igq742S z5U}X;_g{s+_&x&F9&%9Ql)bllBd)pAG@Q6gtOE=Bt!dqd7|99o1FLR1Wj^2+g$rd- zt5Jc@g+hs2rOY(k!2zd^CU42i{+>e}h$5wqrnui8^$qwynH%(61^1j%PN&4$TmY)1 zeDOG9!iUX1xBU*_rVvgjMCA)Z(mfyAL)PV3nULMftDtL8*8wdhKWE~GEMtdmQ}=H# zJ@(8d^QaJ2*>m@A*?ywu>2ddiI@S~}E1SytGN80LlXvs>Sb39w3ym1xQ1JEta<w zaOhYmJ5^t{%Z(R`V1aLcFpxc&z&6hvjnG*VfUvK zVrvsTdaS7FxRv*r6w-o>axlMUr zF=>%AYYzXf)Fupn3?@T<*d>uZ`t%o>RoG7&=@P_@xz;Jt(CNGq|BgII3EZ`DC>5Gf zHAfIZX4zWcNhp(=fqlvPrv=+eu2)ZFD_Pi~Ntm8ueREJsE15SxC?1ZpJf7Kf{DsKl zr}z365OJ;+tDdJ;mTXymN4*BRqxd@al+Cc~l~d;eSxH9j+y2K$HbXtMbK&3IoRGD} zDd(uS+|bje-xI7XJ9|q^c{bT(g;v8zH^xAeC~{&{0oMp<@Q zS1;rEf-UD}UUP67Q=tJ@v=m`LC&{tYh((I99Asb>Gi+Z0M3uh8EFMG&XCZpwy%h0y zd|CmpR=rlmlgm@7LaDrW8$I>rGCXXH7VGxd=q%B1x@qgWJUd6=)_Asqsxe5K;ck_( zSf~1ik9mC?4b}4{tXX17thAuD;#l3FEHXaX} z{UujX%i_#S3|qH!L}-*6Fl5st56=o%HkSp=n>_jQQeaGm1n9zd8*TO{MSdGSKF?B2 zi&=Vg=>1!MC1ASr_SYB!nqAM$=29y+XT8$Wnx#Ki?4O=r`PP9;Ug!sD)R>Kmy$zak zaB6h4B26P%8LP@NT72Q5dCY!~!mMT*2G$8u^*uf9LNCQO;aC3?@X63RWT_q%-#kFI zLj$x!s3~cEFk4@$L;a$@+AwE)|33KqSW(K%cRz{PLZOv|1s7FVx6Z+DlDpTo#RMbN zd8HHO*I*e6c3eSJNR(y1Ybq8I%@O;H*mLpI!4pSL#n~QF_=2$2s}R|GQ~kI18t5+IBE#lBYn?4h5cJ{4Q528@=ow8ys;dB-gi9dKak)qk(U? zHQpT!Er-j~Dc!_wWt1~4QymW%U8gZ!)+aiNKc-iGt`Bstk9AGB_G}&O!3#eY zxNlR|z0}s~&AwFUx!L1&A~@<`|I#!__?sp@fZc-K${wsHKWeIMG_K;glcNDJL8JyX z!_CQjuoS2e(Ve!K4-(Ry@^A%?(+Nv%{SG=QsvmXk!D9lnwWilAXPKa3G)=I417+6W zJlmkUHR4t(1YhzC9VmbGo0*uo60)!GV<<_h1F|#Z{SJS3$#`7oZ zMX0sk)$Ay4jn(a%8xvk$EW_)|yzB@zFPd9bQo=fpuQ%X+v6&_Y@+IQHyG6eKV$ceL zx(T!|VB01TnKaACVZqCW;hVigUbNHDC3q_{$?@6jjfDb?I5n;pw~T-kQj8vipQp4^ z9frB4_PvG;t5BX$46vJOb(5tT`so_H4KD$psp@)cTg4|CP(0@6^_F(uYdHmmOLslu z&C3+jwYFVx8&rP!AX1M>k!UL>Gf95}Y_?rYa`@`rrmjmHO%fo(%j6?V?lTr@H`1w zM>4{dM#}|X339n3$Go{b6xgz|nQhmh?jFSo-}H2L?uXFy$BoWM-<~`}KeTB5b4_vQ zp98q|TRbL@z1dLS#1pQ(M;t_9F$kPmvir;^R6f}u)uN%E{O8_+dzH$? z@-zt_hFO@C!yI{E-?J+L+){QLR93I$frVfZe>B@xs1HGFoe1Lj#Ic|4Rljzp6Dxj-@ zp0Y^*Giim--D*HV*YnKgjXV|bZv`h zy=C6G)oov?nf*;}qNa|?>XTDOV6>0;6asKQ%dgwxn+B-52Xy0Te(Y_e%KKQXzMqQs zTy0##mj5&O-A4GU*ir>PId4Z`ak`j{_j96{x1{G{OmhCE$plwQzPiTM-rdQrM(2AK zp9{7bpwlid8PxcQPRoG;a&TANoz(P~>*VA=z;GwmZ87-kpsMWu;dK+FP7{J*0qQAP z?U?rYZ0DqYsoSdqsOk@~(K1M5ow>IU{KGNwD7i-^PmHBH|5^_}-r97mtiSgVI(9$3 zzn5akqy0qQ7_MQpn~7EE5CEk%AQ973h_4Y!lyw*Yr|?`B2{2k$so=n!wzkC*het{w z>}5TRZa(B}*7CEIYR&>dH~js551^$Pbo7sl7(v2lu>oPl7_QK6AzC@>P{baDgau3l z^EJusd~16!V6s}zJwiWfKwLJ~Lzu7)&8!$`xC_ZA;*!jnpyyEAnr`V>l2%OJF(@a0 z<^Hq_aK1I|fRhl&>PtAMFk@+@oHF7P*Y$c;crtM$>}G3!My^RPdI}551VVkA4Gw*c zEp3@4*bC`RY`$J7|9i?e2S^+Sw%J0h4r9H}a zrH`r)=vJ`hgo;LHCr7q$Y`i{!>IXkC?SmC|Eroxec(E_-cV7PBTX13AkgL}&ue2YwHzl+T!(CaAifg(I zqinbg(>LsWq~~7(`gK3S(lS!YGeT<8PNZ!YO7sC{%iek7>3^|Q3Le76vE!hD%IDpn zYgrWt$w0V2W*1SjXFr)wnpzX{H)`Q3 z?w39vd#@Fg;?rWr&|prVA(VrYV&9JY>kEVrm^)3E>|$Y(!VXmfT;u~7tI+qDs{@Yt z0tO`e%>pAX`MOeY*FT2*7hSIh%yqgovC%%B7r=aCTAOeycjT{W$Q(8eO^r^VW%rqkh0vFtIt;T6U#9BDViV^gxi5fn)h)+6#n z9=4e8#=1kU-a8*|$5>@Lxez6Nq0YG_E-fS6DTx~y@yDcWJ6EbEe*y&^QAn~jKNu4~zi2UtOzNDWWS{m}_{`3;u28YF zks;Tv=CtMv*Rf{Gsp*<`U622dsmHtcElK#@qU`LC1T9)gZTM%yv_!hK$iUvD@ON_` z+yzf^*+lZCB&iA>p4VuhJa#=wcMmt!4Io*HocnU@xs#@N{-+Dv~f66~{HMEl<{;I*BHxyTLb2!u3nGoqi44FPKDNhjm=)<;B z)A>QY?5VCq_|5dh2ww4tgreYY2-fiO_dWzXJBxpxN|i5CqOS}&hoT1iCzLcQ%hZ51 z&AP_A|E;{}p(;$D2^Yp_|Gr0ZV0Jq&Q!AsZXeMz2;nr)j*ZxFg2In}vcJ?^pBKJ>% zQR>?Bw>n3@rPhp{rsYt@te4%SnJP%{!SG1&ruZvp?B=~VFABSIV|?WU1F&>SYmzp@ zu+A++y$($`FXBpL{u=x7fu}}Ze)@mdfrQDy^u7V!T7!%1A6aeckyyXfBWR^{8#S8o zwNl8r9Syl%FPaF<>R?^bLjMsDeMK=y!?S_~{^5^(H~$8gR3t5=)hs0FAfy0>u1sm- zBnfZqA0WI8Zwn^dm+xFJ6$Sez5c9__EXhlC2>WcM#&3vIBtrtuCe*ERDV8n77(P@cB@-GuC* z!*e%KG8{iEli`T!-#P@Y0&fT?Kkl7tesL#+@`Dz}U3;my-FJ4~W6k@$J^HJ#fPi`` zU<;~XfN5wo!ZPHc;pIUF2Z3mUzE`WTh$z5p4TnL46KTJk1%j+VhhBmW_{T>s<{lgZ zoADOA=;!>y7#N+8Ev`oUiar6^EWT_d9ly7cA11RH9k1D0*!bn2z+uqj7KtLj?6oSx#7*SPAhY%*j;M;4_*IQvu>r`747DtK# zHWR+I2P=C|6shjJK5w+$4No5%&mRfNKhKvV)H)@nN_LOkw;vj&-urx+xLqxqfzL8L zE}tJsvDuQTzOOR6)<<%qEL?@1PtO`>td|50t4h;T3%^-?R;F!i>R8q(ko2#CBiS(U z&x3W}Qxxctit8KXFmQJT{N6G5kLu6-2^)v>w}#^ry^o$_waqtQF3+A&)A!3$;R=pi zUuq=%CJsNz9T3az!ObhW_scMFYzm~UP8Q>oNbpu+{9cvCKr>a=0P3q$k@O@I)xY%-JQo4vu$BQI79*)M1{^2GXm%wUBFLN8)Hi1Zzaw zRtmCX8qnRyU-$I91={C92qx+CXqykAIsdsQIH%Y3Wb@=W>s@(zNBjN@6p=*Qmi?1E=XLp*?Q-it+n{;8WWe} z!NEsj$bWA;!j2uY+5?G({y<)qtwEsQoF4T$-s!_?r-dL@?zzwo1UoEyIvc@Wei6^Z zWOc3^J`S!JQuUbKDFrZwVBG??pB#Tv2~v9yKW~tni_hvdym{J>R1JV zsrK6>l_F-HIe)WH5|7Ofsv43~zu>rTBn+E_(O~j zJg@J37(X;GI#P`gBS5Z61>TsL2V%ESFd1K!pm#TWqP0h#%SihHkacK%qK{~TNJfD# z?yu>bEp}`H8Yp|-YKkRP?vjlNXeK{t2Si(Nf7C7%6e2oz>}QH1jb9lf%+KR^|scM%O$S0*Kk9>NB(_5QBbckxOCJzETr?T^iz^qx`|H+JW4ReyA^v zTm%jFbiTz5Dun(37M$9a<61z@H_}lx^>XOkV2tNdY+j|Cyq3G6FGE{cR;9`NSNSP$TA@5H74zC@w+t9`MmPMPH zzEH~vAqLw&bWgkwTTaaBoj*L;u!+l+eSZ0Tc{+OWAuiAUCA_DON4rudJIAVmOKhdJUU7+Yuxf4 z@eS4u)^E`zc=afdmBfd{Sj~lP{6+)FpW77f{(ASI2;YPt>cgB9X-4F~z@-8kMbog8 zJFM5rF7cj-z`yg~2Elk9r9uS1XCuUG2|5`4+`=W!$TFfxnbT!_1*Y>(gW_h$G8we# ztuZe!bg>R2Vxxk@KJs)cHVXL4E>t&_LIn(je!iLaTC)~Frf%b|1?cUd@&x)k1-MHf z{*v?+uqEvw>miSgqZrj?7DBuuHt4jks8uG*C)uFq1NaSbpBE*Z_u@25n#(ETVj){` z*|*f*;2yUH&w5#~$&^Pqjen$z_ZgG7#jHtOP)sLGmr5MY4@1<{O0}xA%CzcmP#;93 zM%bDEjc$xy`b=t5 zE;p&bvRHOfaMExBdQWKI8!VKxt(_SGji$Q$FKmG` zdpn9ck=hQZKBb|@wKb-AhrM1&GyA`#tqDV}1mj8aH}8DkHmFb4jm{u0fXNYp%9EBr zZSyxZM77OZz5ed&2fDZI#D#Hb;O8v~*kGeTNg#KV=*1E4pqLWNDA%REL7MDAG2@I| z@bPF!?>J)CVwQD18lOmK>wL&fF!ycHIvmrU>2GS3+ zv{$XTH72hZ(#>j@A1_SIv6@=~Y~NT1e|tx387*P6h3^nw+c?BNabGX(AP-0nk}#>t zU~Zu5Vl>0L!Lq}y_aO*kMnKfWk%!$`y&%89zSFGBza9rRriy^v)7?Yf(>F<0DN&Rf ziHV8D#PD$6jEu;O+Y&y{j)cT#$6sAJQEc#CuY}uBT#yfkJXSoGPRFGJVllgXj`3Xb zyyCpY-xcUisw@{r`0B%x60{L^zs}-e+0(dgEonqzvI^wQhXtYH529=g>UIX`xP!3o z7zR0HH{(QWz%n3hojjSJ1>ijHTEe)am`;R7tvVppGZ7}ikj3t8bMjPfkWT!G{x=l8 z@B2dS5d8+{K_;P=KsM(GJdTjP5dgzTXV~3%$XlT2@Be~zR-heJUY)i%Y=`OBL{3?M zFbRY($#je&FW!nz4V$zgbPOOfLMu#Jq4f~ z*zr-jvMuJ{XfKcLMLP-1Q2J2SLur`zt<%G3CI+?5q^Sw2NAm3?shK4AlgQ$=lS}Wg z+D~|@M|zE8X`~J&t*={2_%qKeTtq|MJ)z_yb+egd9va)%KZH^%rkaiGX@vT!+eeaI zq<{Vmrg()PZ7v)DH05p7^LtQM(Go3rnT3R+ALV!WgfgG$|CYmCbt!b4x{1d#++0Am*fNlA>@-XGL zNwq{k$xwswZoPddO+q(Qz^~JFpX1{(`Y$x%sWx7Q7SBak=C;LoT4vj1Ky<@jyA~Sy z*JXTQ`{yWtZZ&B`HRMjRY;T%>iXL0i$|21*!L^tfq!VxEDFQ354X=YbVR>x=agKvJ}xSi5fdAIo8~fJl1MgQAFY&%iZ#FQVfS^1`PqE zbp0O(OFvPGVRNpXTTwW;f2}i%VvT1=Kd!yYdhB(8BqVoFGW8^+g*Fm%%ka3EzY%_u zdPlAex?NP|`u;sL1j~#KlsW_*wLr zJrfeamuGJS4L4>wx;J8Zd7LDk7Q(lk(RkmcyYHNQ;`i1hglt6;@tF3+l-xaKY;)L5 zVx}=9VGljEQFp0EK;jP?JF~ZKU7A`+CLyZ;TeqTf`z?Eu!qG#9D6)OAAZ;kNPI}T% zC|wInTQa&OvBI%$$@{9HtAF}sXqi&W*d0r!qb1rJ7*2cc~59 z0aA9;(*s5NS-3BD*7j2(`Q=-f9{eLRDw@?>af-c|I86i3!|dLaMYy@gZF@Ribc;G1 zpiX=(U%7G+@{2BBOs{a3y<%|QQ+0xQz0S}K|D!K#i+t`b{6k1yDZNs`M=c@IPsv`9{UJ0 zDfitWs_#ol(c94kiZ1~ zPvka(gP*}`j9$9q^sx5pGi!6=uvLgljke>&>=V|@`(WsDMNwm6w7Z5ltZ`o>@KKrG zXK|(Kg_^?P^gqNBgXNIrmm<}`E@JwPuDrJ&fv!Ls6~Pq4OigEKph8$+6DAo8L`$F6 zF;X*4*(!k9o1W=+X|1j~7Kh(%Slr)g2>S{A%R_|_g7ufZ{iVd;Jy$U!T!Tak3VXtc z7GH`)3M+ZSm=Ir??dRW*jub7S7AqVe$cywX>ck<9xNMjSD&Yl@ma%M;C|Q_h;$%r8 zQ1l)5C(^luYL5_C<%#-;!0#6ffSGe5K=vIC>E9y5_TEge^F8+3h(auJhA?vdLcxf? zFmHr5QkQ+1czme!JRYj;m2+2Ll7-yw`0B=w@rP`-IAca(+kpBUm z$S6k;5T)b-12(hmQZkEbon2^Tgh0Lk1y`GKf|Pv3`suR}ZJanhmDx2@Dz3SEa#bt0%evh6sbjBE%wr4C(} z&~H1T4m}(A^PZqmsN)4mjkK~mknKoeb4Zi+D-+cy?T!Xq@O7i)?rT~hbWZf@viqg$ zBz)jg4eDMn=?|~qXjL}{k~NCE!*!9^w}ifwdxG~*K;QiOE9!)J{j6%0)?=+WJCW8; ze6?d$Px#h)x1%+xF8al^3orU*TP4;bGwS5lBMEm5T^M|WA{W_fVN*-(^jZE^*ll5I zmv_ey?lJ@SE^A}kHm%w|1TDL8_iS%L{oM9NFSr*XH7{6egWK!>az7yX2ay-}cfZyn zzIp{P#9$x&VrKn^?c}@lVAIL>wZPK_-Y4>EWxc@~`+^s0-{|O*idHQ4GN8|=_1F8i zi(%wN{%ues!hzTY&^M@z1yG)W?f!q2-2t0BnD+n%Pv3SytEvwU>RNGklnwsFw(Gr# z_3-(L^gsWcQig4&wY=`2tX5$k)Yx6Qdr=XG)E5%hZQFauvmyCKtSboL;%+~RYxsLe zo?yBY!fS48)z7dJ&a+|OlUsMF9+jNoOHOah9<@)uL;IQ+=r{lVLx-HN67{iSdK(f+ z4;TPHadL-6E}z~pLDKtUw_wKP7rMB)E05nDu~}{{et~-b_{8#EG3SroRp|?Y?(UU~ z$bxUD|G6dqgJUalY?-_fziYYtE=Z`|j>El0XK?8Y_giv*OP%yP!NwokdnyD+cNF5CGr6jfzkjyGyC7>b8R& zs%IG6{!MRt`b5qAr ze|228R-)A=-|~U%-TwL+F3+&T$J^`U>GyiK)pI^S-YUip7!zNdpw5xygvT_DMTK4`5Y_hdHVcY zVwZ7RS&aq@Mk1&{b~XqXFMtV)D;nS$Pvp(~elmKOD`77|Hq(!hx=w~>9qzopSMji^205r3E6$1!R0|?$em}VGKlv!V~ z3zQP;h{I+$QWSl3Hhrure_G30$%U=BQiDqaSPB6m*x^|^{9(0i2qZWPA`&8R@N^)y zK=BF6;Da}&)*ehAez;DYBc{L4fvo(!Pkq&FieAvA=!%VO+lsPp$sDa)EcS}+CyX8` ziFb4$(6>}c5LAPT5`v1}9YTxXRCYD0lp%kRgBdal)bC}tI-{Y}Gey-hMv2R(L}U^V zk|DwCkqVw;bzfvWB_`L(%rP~QyH>mICio2DySF>;uK4m1yX73!QM(Bo^f9|@98)ny>iFE8ADwm&t&@wu zbKfBm417+m_!9(PkUUYY=rXN$R8`+_7z|;7-V?T0Q0yz(M75=8E0o|i zF5?=RHaM!mw(T8^n^B-W`%ic`VF*C3m~7j&HK+p>{UU^9E&9i{tvRRxA(;UoB@$fC zcI_3em#n%wV!{=!cApgtT#X>AZs0*>CJ~SH>MU%@mDS4MrDFsY?jXJqAwt|>J{S(l z&aWqb+F89s3|rGr-Wij7#f84@qPujQNi=c#jVnuW`_ZQffwy6O{g_n^3m#~)hiig? zX@Y@oTBElTm|fKy4|J+hupG60B;>*O7@R?EK| z?9O!1a-GMr59`jI$fIXp&gU%5(;5&aStr3qJHqq~n=5IOKP^?Jv080fUy;>}R;D;z zaanJd<%*Uu$&3F9mp{He=DObor=!f4AnYi;tdy-nDZALL&QOFEkel^^5%iJldJ0PM zbEZXLD<4__r4TxI1{|OmHcI<0fGls53tgLD(mV$qcBS$~PHgh?s?)g~KXFYMd5ee_ z#DCu7m!}{7;fl61e}FSTdOIQ5x;){QO87-!Br~@@qr{_N-s_CWqhR6d(Yp2lXgii- zJJ##5E{ronmjXoQU37Qc>@QxK&D_K5H<~+)7iORIZV|nFhB*N182%0t`}vXFSDhh0 zryC}@d*p!i1+4E5@@@vJHoe==_XUjAyo4dEv!&_|<0tQ|dhU!mN^y<-b82mPcTmZ( zv~@}m1Cc#5#clh_aU{`EQR=QzJ0g159opU8{Z}nNRTm1i%bCveSoEmqbVi!tAnE(v zoa#|g#jNy_Juv2YH-~XlL^CVh!D#~Pd8~9dXL3}8B_zV$g|DM6&fW#F?#$bMTy%86 z)qbq$JRdnDyOfu4dQ{ANR9rD5t6uP*Jw7X|o|{oE!oD;so0^+JFUqbHVq0C1t&0@k z=?Qys?71*6tvG#JQ(~nk&mhFB6Y8l8@SY3u>I4Ix?YQ@yAD->__s)<7 z3-d*#CF2TTJ+|)EXQUMbmkI)OBj9uaNS#PHPgLq7E|sen8gpdoBWjhI#nS&8?U&}# zCAqCR3)v4;e$CK6x}^s5&4(~SU8N6EE9&BY=XSR(GlfG|e} zz??C_oY}y%1^wv7{i+50szv-Z1^np0s-k}M!hTEqBd3Igsrqr%!$e)^ft??M?U;dg zBnWdZ*n9WLbKeo>RIv*ynEq=t&LpA!)oy^O28g5oL!=WS*pBekLAM<{buQGN$_E0> z^H}I^PVR1w{%%e*b2CO4SBwET7huror8+D~of2oT5oYM}Q$EN~ZO%1x z@$@33=U+*P^vk(AE75OWNMOGA8~6Cxyzq8bVs&POjcu;YypYbkuVNHTpLpQRIrQ|(Y)G! zUNhn1$+%fgnpv5?H&k)keUTaScNDS@NI6F6I%J|7W?^t3$QL{O9}6 zl7AQ@T4MUY*4C&l&K}qQ`fP@_M)`1zxsLYt_&jkWOHy|@bYks}$Xi2oqpF+_ zn?hZ8@Y+!xXCVJcan}Zi%u22@rRw^XH6k`S^HCo^!_0YH&8wl$VeZYgjT9XcXH5BL z{OlJsqj4RU?>=$fcv3BKx>wJdQq^T@<+`B{CNhqe;@$^+k^Po z{o5)?G)av=`jurvqGdxaeh7Od<~5Bn7L6)=Nnr;>ZAoE|h)exV4q2^X)pjc~_(%?U zp+RI*$1Sg6P13W#28xL7i}F@P`ACx)kY72`2;>xwm+3Dr6C}&(&T{w+t7aW&=7GouRWYnOYn)qirka zPJnA0d}bEY%^G&OiFrxG*n8YOVFCIOrPB~ul;l5r@{S~j_DNvD2I=%Cv`dCh`y^!h zr0)6w{{H}qKy|;}W~Xj*md>I#>m_}PK3Sir*Xy-ITcYYgrI7ui&!UwW(z0Jg zLgZ zRK(L8CbveW#?$?iTU#R&d<{{ZIxAA1%6t)eLzJMoB}!CAx;BHo z`nL;zggCGLVFttMwLffag>{{5lg*P%CrKI!|e4+^5#c$o9lF&$LTi5h_mqZF&Xz6GGof%<}&UvW#5s>{x@XuzE{Tgua2&o zf5|%YAiFS&3~rmaj=iNB_SAKSJ$2#8P3xA}A{!RCT)Qxl48~vJ^oAEKT*7ciSCkBY zdb%b@CVD2jw#{1iU4CR8W6$zT-iCE`%`My3DP5EMW+}7kJROr;w>K`9m!GBX#!+?K zo#%^S~mNQ+;nXX2qk?X2k%B-)cWt$!~t+n%Gcsor>G}pF- zGu*8;R;gzaH-U+6+m#u+MfQW|BwuTPB-v9FF?eb?%U|uUW-Jk$mBL=Zjk9c5PIPDN zCJ)3}lBXtO^3)(Q;kzweH~D}6T+5F&|Hkp}NMe+~)>gN4@|hoQ)V{U8HEVrqd>5Un zXswS`j5Tq>+BH7Z&TmnY!+GJt@Khn}2)pT;HLZ;J6pVb;!`4@1&6-xS7Cs+;i8syK zHKUERW=%W^Rvj2+?brvX(emcUgY!nEoawLu;#4(3|4o@{SvX#BVmt02spHfw$gCh#MTQ!9rGu)(y!lrVdTdvNbaxS{UhmKKJwPR_g_(W z&YIu6`@rQ4f#5+v%+myrjz@PPUF}ySyIW36UzC1vx{#Wln@-cC>ft`CJrq^@m1HZ? zCnP2%8&ZstX*a!_{*?YqF*v5<^p6fksi}_Xrd|uNC{s%ujZU7#eGnxxIrR!NYar1i+at>ge~KIvFn<&ZQay$`uk9`gBoZRI{+ zaS*;$Z9ZZeS7J@IXg%&&ACEKX;@v%gzWQptEY}a;&fu$$7h3bm3u-lib|MHQN%vT$&K2 zGj&>6zihxUsbRqZ^5WICl?`i@?An5y%CVI@ zmVbKxoLe?@fwJG@i)Kv<(vd~ml=R-LO<6zB5-Kx)&$BmWF0${kYsTA2mQqog6;(HE z_sx;BSZi3u#_(7R!yA<5d45@+uE|PI&rkPcm8aLID_QMX7p32pb#K#}qqDT|n)iyOdc3t)D^?8H3Al4?ym zlREl;Lmj;?PTlF4ZntG-Wku=5O0qrOVz;NKXIX7o8Eo8`qzpO3K^!_;TAEJD@P>51 zqqAUzp4^8NWYQZH1JXrfO0vDt7O_#=6Lco55b1SFqMqn<`i!(RE1sYWkO@6qprmKQ z>aqr{inYnwW8GlgYTaW^U|DK?k~YDCTlwgJkdCd2nOnR(s1R7kI{yP zeU-#yE-$~n$R}PQJqL3+3t(e|WJhK}f)s+UwKzy>S=5-N_HVCr@E%YSCS=N4iY1xl z-r1g>5n_0!w=`YxmU4lV3`tH`(lbKo*-0rO-fM}bn6#A2@it@mnR8U@sy4K-1e-d4 zJ((MPbL33LGFHx1##-de_viWL%ng+eIdj8=OgU3YG|8jo_*|QqrDS+Q84UP*tz=bO zZ1!B$MphG3%*~{p?QKfkrDTkW2)9;Gl9lR7a{b5<^EOSxuaQq{M)qk^PP|j@_gBoS z@W))vtcQfjC*C1njp#wiZEBtn7OqEs5>ipV3ljZIF(wO7Cup5oqJ13?CaZ=h-T4?& zNvhqtn>0{+++b%64;|sNTVSX-NY0qwh?~SR6NK=rX;Wv-oHlLN$g@Ns0U4OMQ}2h)4-%zAiZwOGZ#DX@sY$SZ6MK4= zXtrmrkH+RZ=8_SpoWaJ%F*ZVqgCyQ2Zr(z|Svk>h;x^VU!g2=BNYh`AI^&Tm%ZiH1 z%ZrN2K-qt0h$qCSkdH!ohjO7$F*;2R%rwESkZM|M zsFtRg&Z8|RLxIickWEa9C91xoq-11!hl4P>`^7C2Nm2S7Br`t`1_K=O53$kG@%!ZK=!rCQ3 z2#L~RB`G1>?M_Tg(Ax)pOi|jZB#6GXKI-#H`7D=+bSXV2y**t_e}aCFB2e1;xKElQ z{azBJDE)l9e{-45Cmm@UVqbH)J*lPFaCnSmEFgEu;2xWOC4 zV=Wx_87(p6ZIxnW3Swmn;$;frWeVbD3eGAczdv-nrpR~w70+FNUu0tlrt;XTTPIak z>MASa-pf~D81-JhwpB4-(bmSNIO5iw6?&wRxEX3lN!nRXB8dteBPk^%Y}Ai@Rxj6_ zLu#&L8S(_Vb6Q%_Bu0%p!^^sE}P=R8&q*m?Zc3n30fr@{^He0Ac?U zBMysCp+tD+G1w%38@2KKEDV)I)sJ^plos16N=u^ZPUQ}}Q7%^OMtN?@3nlwY1Wj6! zJvA-EE~clY+6&Th?V>rTjI9WPfglUgz(7z*cZI-!5yWN;N;a2GvF)+xHeplnrsA7Q zwqQ%}uHw5&9>F8Qhl?LBc^Xd#584jfq^{y+CD#_;RB~&7@!ciAD*jE$-r@r#iLa;q z)%KSC&EmlljlCe*SksagRre}JmcnQ-X*_G}+S4;Kvm8#B%Y8;LsU#?gN{V6>^Ty^E z_zL|+f#B0;8BPi_6eIm^B+9BBH4({pCUx|ev~JfZHNi369xR?(Op2rG!R=#9LdC3Y zLlrSB&khxTN9kKirp<1#+3aa3nN~tdTw_Z@B}%9wRHDeULnTb0#Fl2U+0yLA!ICr* zRA!fM36dZf20>bJiQZ^)+NjN@PYYQ?=^;BUE{W1Flq6E9ADfq#kf7JwqUyoEa4AQ# zW2h;Hro>PsN84*^Lkueu%F08c&0_1c-DcZid*60{#HO>@a%|1EYdGOK+v_%cjxA(s z<`OKcv)PQn0FR22LcDaLY(XHf{x})S{MGC>i ze1j!fCW<*pCQRBc8I_v4kWncp3~e$Jr!iopM*FxI?~6@at9-u78N)tbTcvc&*S4y1 zxXtH(tF)WT1FPdRtJtwVo1se1(l?X5IA6VKN_Nr+A{YXHno4dXNqiN!C;EJS`I4iY8edJco5=G zlY@#sO$Gxo(pZZeWFZ9@;HGD^$5>g(jFrrPSjiT-#Fk{1p(L5*AOl>&z$OdD$iznd z(YFp3daUNn;cNT$0>|X#D2leLazoCNKnX30(yNrjd}9Go3rNAF)F^FH3}K~zN7+9N%g;2ap(D$oAiM$uH z?4cvRAz!+Ec(~1WBz;I4j>pHtm6erprS$%hVV-5-tMB@hE1tVv!zMwNvYmQvWHcI$ zv6=8Oqmm?lg^F14o5Uhn7Rr{Dm6f5atgUuFV;dcEQ9NcYimI7P!aTohWGm$&KGP+d zWTV1CY9=T3rDn>fC#tr#wl+SAg2fI-hwNY#O7RN)tO~2qA*b*~1OqAAQh6X-Dwm?_ zJAG2QpRM7g@-yc?9$~W>n-D9X+T#0pdAc*R;|Pg=&x9r1`{>dpc=JvZv^qLO&a0}D z>pz+M2^(W<^9-YMLVd`uu!N@;`{cqZ|B95$QxY_;RM#E)XSFZ7Ue~^_JvLqsocbr1(NSt~OgD`Q z7EH(nxh|jN7fc8xo4IWU9IlX**px_>#0`lw(cNB18VgBbVZKH2mxL@`X36c)BY&?;GGiz~$_DgJq~#Je^gw6qTS%;kYqtA|#tjzv+4YX5fsJUKDm^&CqXah%HW z>Gc;2<4on!XMEqtTwcz$bK6#tRc-Fl_%312xRSK^#$kNda6)Y3a5NqgV%y(*_j~+* z1i?9D_c{0eiReCVyR@&lDdHOXEi-rzgw&aR=Wf>)N>z|k&%+G&x z*;Q{_ii;|83=@mey=hXa{oYL@^Y|L8+g6n~Hp}d;C;?SJRR_hNXiRXRfNWNZH8de1 zF_}s0BKS z_okw2(rF_)a!^NfT(>Dv)}g#)$Ut=csU;j zzEykxRPv#)s%-{;pdk;*rt(!Lb9vcll>L~2`4)1PZ>e3cq~{m7+?oWp#_1&a2~H<* zX|tWAKtI-r*kh`zuDS}-o7XFnH!msKn>^Md<|XBNkZd4Qr4PPQt|x~IIW*g&@d&vd zP;!dP7vY3C2ooC;NVUL|?afPn^^AtVqaGp@4^hUIj3=E9KW%)2j2-##qgi)OJzOs< z(>;7#2y^3DVdn3 zn`h*;n%}k@$obUrNscbvZb*hkJI0=2O*TjgQU=M068Da5T$-N}rQht3-1)kMD5+Nx zsMhMvPST$1i1NoWr9F;=4%+0{N2&Xq=1 zxA|tg&mTz1!|zM)OG9mc%;Zew^3h0;xo<_%D+a5a$Up)EY|ptbEkzz(jj%n?Z-sxO zO&d2$i%#p#W)2waIoo}?d4=WWMFm-@wxXF=-ty=J&u*9*JkL{5)wXfu*r988kepBF z{8(7*k*8l%Kgnk9&ItbI2bbKGF3p%!FuCgdh1Y)c7IC`Rv$;us>Y(^Z-2Qr$Kw^?U zMUyHVNg+~_Gu7#m3S3En)PT!X@Rs+j0&ab#Vb_Tqql?*F0Uz3lNg)@rMV_-I808FQ z46{CiM}Nj6t8c{*R`OjFv^l0HUZ=N?Vb(WBr%xQ~HYBB4tLbf?rPwM*T9Qjat!9gdW_vVl zi_=3=t>0%~abN43--YK~eS&-i18Xkfb= z(=#2RPP*LkN9{iCe#?IQN7|1qAKU*)k81yEK4JOF`L)M5UOQDw%}XsyZOhV^ITv|u zqg$MtJr6s7f9?6ko|L822uWjd97NBiq=Jf&o=3d)?9c}N9z8v*C;BL{K4x|(S*6_C zj9IRb5kpd=eZfaqq^q?=8XZnsq@ zx}_vXl!p6oaT0q9<(VRL+~8%nUrF}lgbpT=q;zk8&c!53!-{2$;wg2G=@~=EC@joP zH+FO;{s-Tdkt*ZvfW)FXs=lryn9^itp(#!FMAg^(Olf@9XO6(vM%=LlV%+e>(__P$ zW=)NMEe&?L?WY|xk>AQR8-V!tKXo@AIrS<9s+874I) z5XGRR(AdLhHjkdYt}t+0rlA-=J%Z95*w`#~241%cd02(4ZfEwXu#X4wz zB=>0_%6h2qiL70YCkh9$UM|#|SqQK_-NWZ-r7qPIGIu+>i+Y{CMVp+Pinchn6b(8D zixP|VPQ_}iXOORNC}yhgp?3MrLmRW#LB1W zmb3ln=>HNLQ>s(WXP()AtCW=T zATP&T>g5%92fc^9s#gqqd%PRGo4ul!mGQDN-Y7ZT2Y*qN&h4v|Ci22N7`EXoO6t=wPM?#k9ifVfyb-cty!_S)iBR5 zd)Wq?SBZxLzSc^^+p{$dQD3thHd`@I~*=sac#T}f?TH9civo{#5axnwhiqSl&m;sqD zRm_t{9}UO1iP?1+tTMX}hIMS)(vrdReU^+^sDxFdjiio`ZI_K7#~uX5_h&t(_*)QX zZunflP1+ao9)TY$}Qzdk0)nJu_DX$yVwRV+tL+o zt|-neEG+a@HT__uljODvd)>&wSf(h~UmHuuJP1pHU>v~Lt)-+y8K>1+wRdC* zg9(F9nsCY=)U+gU>yP;cwogPyS1fGFvhVa(41Xr$FDeRrCzKk0{ZrBe{dZWg#V@n? zGwVX!xKHif^f{(GqU1rvM2=>-MO~>j&+C;WV`7?>8LmD-$tq3Yk5=uaJqeE{983_5 z2_zwXf&pr zgtQ^v&u8>-ybJk%i&?B=(@v8oobK8?%C2wRxvZIW8}GlIzy(t;oYk0CEZ2WhF9&Un zu@0>Z23O7d@yOMuy#Cd-&ao3(N3J$HDj22AX^eLxD9%#{#mj{IVMHc=uUzmrjcWHM z9!Po9{6^|t+Z*;bGxleGl=3D0T5EXT{(J^C4~=<0^+WrAry1g#w!N93(2ukqCVrao ziCNcaTb6mR=Kh5Hl73@&z^GeF7iqf^FHBix?zCzx?qprMTTGHzWSa=EE$f32@dP~z z2h!-A$DR71zDFodE>?>$z$u@zWS}Vh`lwv4wd0zjx1Cz<+0dU&rp4o@~&YO)h^RWKyc9hD?e( zH)Kjl=ME)U!X4aphnM4>7JG=~rzAy5mf}uvi@JPmx;+tkmp-U((uegudhKRC(Wm}2zl|c28X%D% zk{Te9;5^jnt<^&9Ds+M9{|5z?zy0j+BcHYQWz!Gn*?`+IVvpFai*q-&}H)*`I?^=5?#+mp#RZ+*?9YqW*&SeczrmZ~fWoV7u}IXEhfW8cH2)O%iy^F*{yKEWVB=wEc7)mfJkJ4F z*4v@C@)48C$IZTiNdiw;=zL#+b23kVD$7ujvlAU1DA}U}B|7@*k)s99$#lG0v&XA7 z`|MG2_GLRQTY-Z`GtYCbPEZ+gu0gWpk9HP@$}G=ui_DZ&G4qOP=2?BOH&&Ug+^(>w zQmZhr3anVkRH0%G6e~CP?JIl2R(q}xeoWLG`m)Xf9qWvKGs<=9O27i7wS<#(C&wvF z;v{lG36GL6LPBMS2W__oOd2!NZl$+~PV#O_ZJj#>yDh!0lL&Tpy>So-p={_0?4iDs z<*$##y5nEIab$Alb5Fkesq+{mWV2Mtr}_lriHDvVPZf(l`}fhK^~Z02jDDva)P?Rr zF}^o7$owc4>y(smtBCgONj-D_$?A!i)*|3)rHV6sU74QNwytPYj#kG`oE&?keUBjE zYTv=Oe4ebubDK-9%dS6y9`LJIB0hZ)zGB5vtw2wwQmV)Qfm@dXjR=fHlw2kQ8~ifQ z@buOW75QjB)j_;y$E>t}s)c|;I;|thaiyWWtXxx;mG>1+RO0lDImN9+a+e{5Mc|Mt zF(*WYNp3R!VceY&28GAdOYm*< z9`ZE3*dOtnB5ll4;dWiR7jz|BtX3;zDOS*uEy)U7ZPp%3wGh9vWZi1E!@8Dyup3%6D&+#=6~ z(p~Fo7?p~x z+kkl?BQB`tv=_D4)HlH!>Z-=cKLId~deJcYB$`4mfnTHB;5PCnQ4!68S@aBg2M`7K zn)TH{u}4gQt7TyX9YdcMk7*~sr0^x}6gVYZ02k0dz~9jwAhnA@EeR9CAR0l3w70>Z zHNPD9$GLbQ&c|B}*$5hn5%L=nmavS2SizxMu%`HGQcbRfCZq{@A~>N;gnVk;&mDM} z=%H2%`Gk-F0L{Mro~)tk$K1RYpSAYs(=tVQUO!|5&?962YhK; z*7c-QLhdrW05sE|=qvlmwuio{ zsj8dry&8@Y!tO06(~gt)o`0vbV=;kB!cGq~aX)9L>ofFZa*Kp;41=l=#AuELD(E5& zgOv!vhz7^HgoyE4X~)P4ly;OLLj2Qyd?uSz1v4o}adp_MU@)=c(7W692-i2B>nq^u zl`6)E{`LL=jH|DY;ep~t_u)1ZS2u>qy1e0K7CnPqdD{YA5xYpf z1OWISGXNl`mvMmt6u0|-0`mcXmIR0d5CH`t1{d7G6G5w zMsVDh85jq5qv#;x3?%opZa1sWeCB!If1dYw=HB$Fs#A6Ety^{KTj!jr?tlO=U?~_D zjy}7j{DK3Mw*%xM0PPcpj%q3I8kGlxvS(QU z@f$$3>b!-s=TH6J^lU&I0F%$TWn_6;|#2U5)>jz&?5J zM}ARev&>Qctz!KjCP~u_@gLP1wVZK(?%3%({Pev^10>Zy*9b>{)KLJM<985*9y)I9AW}F@98I00{&F7UA>$t9cFS>;!*d31BmX zwY+6u1wfI$(voQj3j}lnh#>$0dIS+c0g6zHfv7_R8qth1FdCCE4Rf&&m*8@2z+(Xm zzcT`eARjT5oKpIKOpL=cOvgN2gvG~7OMm?j&Y9B8{rCM!oB#V`K<2#l*h$VO=ac8C zLq3Po8FU6su@8QE3ZBe)4L=q4EACg$Kx0|Ro%M7b%eZtmeuX4m456h?Iy2yQ#9QM1$v?(_D6lp7C_h7= zhOhbm&H0efgW1O#T9nv;x?U^#42|f7qKj~PZhxD9w z|JzTB8#CdOlX&Y-ihp`ie5ud_htPv!p$BtL;wPP~F2m>7?h$&hR_MW$ zpUVw8>6$x)9`ybv?eyQ{KR<*X>3aYwOy&qEXaMTNU70w64cBJk6xmpmi8CZnnTZQ0 zl~KR}PbRK}2S6hh;9^{axtN8Ea296aQjEdb7=`hFm?-l)F&7JPAp)pIF=|nTQF3|# z7GW_KVipFTc9%frJ^|!o6y{A{1a8W??oi#ym{NMgQX3hY>(IN>Pq# z1TY?RFbjcSJUJj=eGwMQbUGGg>ROBd8ZZy@5WqOh#ca&MB6P~BS?H9XbO~nRT)AWx zwDMwETn%G5+|o&ct*qmTS8R0nEb!%$DCSfSFi;g;*@VMfzER<8M%k z3VGf+mKq?>UE}2WW+CPvfZ>>q3*~#v#08nMBd`E-_x{V?$~?q{6(0K zxtNDe6ek*6CX7$i*A0#j8dzI1psKQ>ysWgOxF{AaEXdD` zwU|vt(U6^`*J(9sl~N%vN)T%bH@63pk@lnz2@fA$#M9yFfn;R*NsRVnV0s|gd}^6w zpj|E&IJIPAdLVh;X(bcsl8NIbi5Q3@UK9&7g#*c+q2WM^Odi`34kT|L8g30Fd*%2j zIle}YXAKRv27^VhK%mJnXJ{Zv+5=60$>vMutY~Tm2;h{Q}qRBBgz>_OhEDIzzjBPnNH^^ygtD`7Z6id?F z=JplM$;9+k!;4}g&kjs&NzxlyTax64)}mN|zX^Y<^!v>UH*rq;`GKS+JS044#rf^i z14-A4B*rZccDY=MZPI?YngT0-#Hn zlx@gF^jRlIW*yIyV{&mG8#(TH%MxCr@EOTOdonOHki@u_aFXWMa5Ad~D`wWXgZyYE zMX`~|bH}zc%}r_=+gFGKIiFvjROE``z=|J{B<+h&iS6HH&r0WyJUcvpa_r=mK+}r$Oxunee@ZHyUvoS!6HA&KTbP?>V${v#+@z^- z>hZ!n(V|ZZxk({cDGT+vDV2I`OPWIh%}KF+c$&6qgTepsqLg%yUnK`8F3VIiIWT%^ zdeAB9Q>v$5!A6cx3K2ST{NxoYw5Q}Xhnw41tY{7gnpd>1n4Xe(P|7eWg3uys9-Rw$C90i(;E7hHMIxo5pTRkekk)+_Fss0ym9s>7s--whw9D zltXSB+p;YHBxEk-T+ZZ)08d~f89A<{i>l@F?rjNRshlgw3^_eBMIiIk$9M!YQ#8#J z(+`Ts4@!VyW=cqZ=Om7m7BDlVPV<(gOXp`wt1&Yr@|^9U1dub+2S<&@@hvCIgFMJ& zz@UxelO&wHB79kJ6KG@dqVQrlvLYD>Ol=7UgUOkm))gxPD*`LRDG@U#wxnrNh$P7r zPUS!OhMTGp_O!Z#tsLZ&OJ@Y8wyc=CVsbbb4ko>x))i@gR*)yNJ+1N`rl+L4JmFvw zAbbu8YvC3?hmXyG50Lg{KA&*QnCJKRNfLdJo6VU|`WTP#xI?Dn$*6RQbMZFj<5v6z z<4Fa10}mqs!_PTygAtGx#Bm!g#XFcFeUI@7;(mOG7-}&`>W2|a&`++y{e*(TfEv7o zSy)5kEGm3|4T3^a$~KZ~QG__g<4)MIhqRzj(jtz{)Jx-_7?0g-nmQ(xN7kjkX_7>@~P$HlnvXWM8g?n4i0rGx2C zX*rB&!7MDnQ`k+S0)%#$Fb)%NJ?_FbJc~VeADq>>CI334NOlwKmRzFlAtU_~v4%dLMa*5Q6Uh$pZMd+{dT z!}sWaCyY2rluRH~$yMYAatpbgJV+iTkCU&dg1*lfyGD3P_`3gHNh{qWJq$P8@cgVn z79fTioQe79!B-@o6p|RJCx4_-8e>Gz_x1NzNW-Kh(u>l22qOuE4!YE9_3@pZV z*nyYOgC4wr&+vCb2qRizB3=?8VKR=KO)e&XkCMm8cchQnsF&8zd9;hZ&7!PFm?S*j zx250O-_`$Jza(vxlF|#(>vI2AqXvzbfHo{dr`%&tVh3Kt0ep!c2_Z`2C;4PJ8A&FP zyU3$tA2~`v)%0rmD3#b?wuZebIEB0V&+4Dwe^>uzsZtsR0tN+~s6-_OB8~}YMJKL* z#jUs>k6|qi*llbJ+snQXL?I@W3ZsN}VX<(z0t%+Isb4>8 zKRUl}M&CVsFZ37p5ADC8e`Wu3{qOdFeip%9+^YVCl`~YWFzS!Pm^x)9C?-O zCVwO!lkX^@R$5Gp=^#3oPN3(}Yw107BTdo|=m+#i`VSUiF;>nhSRHF;9c&qYyNTV# ze#1Uyp9)m43T49C!V=+S1yh`>xKpuCu}kra;wz=7oRYza@h97t>~;E_P{-zB1IAFs zzM_AmadH(sLjFL#y$xdkXj(B+W9@`-L!~J5+Y2G zML&->(8=^h+K%6or*VW1C*#O}C9H>TpwrkoVXaU{-oq05oB*0d4x<4Lq>emH-a-d` zmlm-ngg5vd6>4@=F`s5h%Y@Grl>HG91{2C&Ba=xl8AEO4IWmaef-sp(MAC~eIRmx$ z0Hd&tOhS#YpRJ-J=troVb(nyc5M&WNj2b9t3=C~( z$C)tFAIX(;9_Es}*q7vgLE3=Pn8iA2Gr6<>N1=gLpaI*7lQb%8)lkG0UZGO33ZJ76 zv$?-ZIY-#1xR%G+TkMe3Dh2zeDYE-N#^v|`!|@SWiOm>}4~dPOL&gdc9VtlCL~Nu_ z2p>y!q9;MTDV35l`ky3mk|PC3homE8aU;&*K4f8~aD#BMa3vsr9l;g25o>V|p2s_Q z06yfQ7H48SreX%>${yKrRG|iS7=od)mvsy#VlvusF3!V+=)h(8Egr=tBrp;aa1LhR zJe-dXbmCH6fva&XmSGic#hv&)-lUJv^(;tlqA$`*=v;h=582BsK_=pDVY#pbXCnt= zi5YV-0CD)S3ag}lw=fw6a1#Tm#1by|($~_v(nEcF@O%6oYq3^21Yau~k&n^ju;3z! z?HDh0v+k}56^Rt|xyyFpYI%NruDV zXWgi0-7(t6sAnk<_7vONmE%vO*p|)C zobvA)Tx>HWwi%S&%2px>KRYKAPRoR=*-8|`&(>tZo7u{)L4HGnhOGp_cWfmjwh~n8 zX7_dt8(qFljtq#)k#)y7>oyOFm!^>dI)4*U4nJ$jgp=6Bu5$m*hITdq1W(9x1LNx# zt7SS(rlV!LM9y6z#}~-)1#-Mzj@M`6oR*wK{W3Lh%Eqy?Q2;+1%SOoI7}kVb_}OSS zLJrSjXUO3wHcSrBWFz2!pN(WqFu~78ux2@Z25Z7l_}OsQEQiBbbJtLRX~RO+jDKmY ziR(;^^M|5@4Mja03PI+qW<#-o4aGj0GmQ$gKV1q%}U^W;D7MI^KjuI9}J&R*Bi(?v#qnpLCm&KuCaTZ5_ zRiTtsA;GFJhE<`RRY3s*i=l+Yuz#Axz*vkGAqRdIq^n?op9M0ZpRR-te&(YqyL|pc zgNAOw7`g@RbPE>JEm%sobSX@R1`AyYUbcj;#Avz_)96Yp`I)!=XWkQZCDf=-=OlEr zp4PL`bTktZDORvK9xs=}it2Re@uow)tK86V5i7tFR)F=a01O6JfD%@K`hVjoKPv#m z6D$uqSswPVJnUn6a)ak#^v|hjEDx($9@euwxs*~a_Z`cF#PYzf;OE$q)5<91tNlNx zN=~{9=jNk?g#DXly0xZD%%+GwxN7v9bbTwT~Z=tu)o9WGT z69n1;C$zBH0DqW_YFC3u1x!U2 z`KL@Dlj%h=O~}-qa81oRFg5FysabbV&AMZ1R?F0^v!-S>Pt7Wsnw26m6831;N71Y` z(X5Hltm1 zr@@p!y8PD#Q)<%XzkfEJnvxC%apqQkX>hhbmgYp#K~C@)fxwRm5ZM23~ zHx1oJ2k@Y^Wq+G?DXnQ5$NAc&Lt9UjLx9#a4c&$y59D$P@Nx*8R?bHU@N&64NSE`; z<$R}<+cY@XG;~uic&yA|xy;~G%gjEt%xt;L>`WP!E)zVdjA}oEa+#oN|1Zk;{(~~P zzgp&`)|@pY`fm=h4I{|An;I|Yj?4CN)2#MzQ+smdC4X}q+;I@thDP#k#-|x+pD}X| z52w#ck$1zhh9(=sLj#*eT>i`a+?AAJei)jUla# zQ`6yQs(;g(8e7`k!PX%*abcY-&4YrDtKHiLzRyD!ZB6RKLy}qHA#zqxLs0|I5+G+~ zbN_TE%W?IfpnE%cD3c|Iha`>RA#gO!9ojT^XlG|8@*n?_c|9}T}=_h#MkbZ&>PU$E3Wg386`a6O$ z4Z$P*9btH-!^n|ou1q8FNr#aKzw{&WWm#=AD~yrpSR|ycFn|=MXp+9bBn*?jK#NRUFTDn>}3qfMsgV5IaJ zrr}KKGqhur^ckk(Ea_9sz-Z}H%#`W57$bd(Sr{uFz{%P>#+2sdHA^bwY0zVsnh;D18tLjZ(8 zd%vud=_)LcKE%yfD1Cri&>?+*)woFd0Bg`GeSllhDZP)iSR}oV+hlq>E|%WI9k@h# z4|mG+H@HlC4|id)^e*m}={>kodKc?tdM~b$-obBiwe$||lj(Xak>17zTqC`W|B>nM zaIN$n`9v!jUy0r!7OyRi$u zm0rV(xKDZwFJZm(8eYbF=~cXf4brQ4Ri>}uf23Ej8^4oY!Rs>Z!2{AOcmoeguV4=z zlwQVO{9bw)Z_4zK_=EHk-oiuDOL$wR@8DtSCA^D`(u;UcrtjlX=|y}X(+}~Ov_b^7U>221y4%P;}ev@QU;_{wdQVcvXMeful0*!)wwG z^kcWQ9g<8>#&oTW>DvD*F+KmknEqc(|1YNhf57y+{)_4V#q|HJF#Z1|J$>l^BBqc0 zFQ)%nOz-$FrvFz@|F@XF{eLS=r+jTzn62Qx85Np0DOD+=-$Dr#0*^3gm5LP6Z)J?S zG%C*9O5jwFzQPebOFVxRAJrE>OFSGOCHBQpAMcCvPg!Y&F=)&U8iTV191XDUqX`9$ zARu&ulCPyt=qCyVjPPT0!tk!{Qyo>Sv=E7TkxNLCrxNBYxOBG1#X6#`^FB_dKt)tf z(=!l2KRFAIsCc-o_rL-1zyZ|P_lmv5XsR`uYRgJV2VqKOI23=$W09)L>WXrk)xu<| z42MIUMW2dLyU}E)xwIr4E}oSa9b8w)iLkbBa=_&Z(BC_Bq2l7O_NaPrG!`FRSQO{q z^XZrNv3`N?E@{Bw#K0?6S8A@TeT}>xPz)-ZSUNjAyW|Sh^>xb|9#;LX?u9ySPDw$c zs$^iIEiz%CGN*sEtSnsHKmbimd5WeIWmQ${%Brf$%gSrY!r`*A9B3?nrXh!v3Yu^& zD^wnj8d&j^yu3(?xVHFW2}8~fvKj#prbyUppskNFU1620F*rrPDIQZghkXCEBSms< z;QcbH_fRkI7u1jHt&bmaIeQ%?uHHj&vDav_*V=1II#_>J9L>H;+~t5;>>F&VEpZU> z`;tSumT~5;UCXk?U2)#7ZDu~n20VB-^$Z@Fyi74t@T@0=SN8j5O-&TMOgzai8#d-4~9!{dA|gC(!Du6CHu zQ$O4` z(QY<5sMd1Dgju&-4G`Maf0R8Td=59pB=QRMg(6khv&~wQO{r9fcAME+XI6~TXv`b3 za{v((PS0!Gi2@Gdl-sXuR3C3F@c`=M^>L%AmbZUcEf=yjQfV>`NWZ&ENv#%>U4G9{ zUW7(yTl|qceYVM|y6~KHE>t;9+4|gv66A+YLdm$W&SBK*U+Ygj@L+%HRlU~e)P=~1 zeh^aBf0QoC)V4rFH7+N0x&&ThjY(;@i3+7zF-oho*75op;0J}v`@nWG>R5db^ZFi$ zi@kqxbx*0Sg;G_z>jqStsw!z-y8G-llZ`I<)!KgF*)R1!7ScP7TK%hJ_yZ4;;jihn zMu#rczm?ZE+W$6vlN3XPiiG2N{1N+c5CXOe9iPrT^?d!X+C zN_yoA1xcnlq?;J~-*ZQtVMdDk-Y*Y3wR(TPFtwek1T$R%23JClZVH!zI)#}VIp7=+ zKSRkVej{tJN-!V&16^|2Wgz%Wn#8_R%!i2iiGdo8jW{)|2DO@Ia)xG#<^s(nWRf&y8g!ueRQiN{q2PPUO2}iIO;j7+F8u%|9qKAl7c^+3ACNB{LZ0+@*rdP1D*b({ zCtH)P&ZgU?pCC#35ib?DB&Qn3`B^Bdr@C6_KLlxS`MMc+O*U(E>29Q#bU(av^#B1 ztJC6CC_Qek+voPX1!Z0&KT;4Wj0j4dUaQyW)q0g)p=6PeF(-k5*_9wsWo~~0MM6n} zgbl$2aXW(v64A#JD5kN5yaYky1%blC!ouh^sL33p=H#PsYD>au^qHOY7N5~xZ{)=0 z^O@>HDd|We;WO3eSvKFkTT_)PW8XVTRdX-&F% z8;^M{&LF?ZHwn8lSZ}b{{rrC_e?8TT#yUGEoyX4X9;t}FI78SK~0x@Y9I#lE4UZG2;)GrxA& z%^Mn{j{Mr;t2WS&_V#~&-<5-^f@=p)?A%L49uKXJPh4_o&)~2#+`oUnd)uXN3=TPS zNU)o)+xAGGFv4aa3vQGpG=?slPTd8iX$P^v34z$2)ajf~&-`t~hs-q1dl~h;^;~XG znG?;Y&X5ywYQ~Hma4KOl#tayA7XS3E9$ho=EdBw(?Pw4#5Jtg>8xx_O$~W~t=$Tfd z$$`-VjT%NZj}r?tS`dHj6l01!vKi_rq(Mg>fu7z8EqNM7x)EyfGzi_8&|_PPk|>=f zjJd**BEcJ?aF!598jTP19_a0b^N^$0DIRk4E>ovxu4U?Cha8ci<@jJE8ITh$IJ(HD zGde>|d-U%ir%`94!}^tar_pI9Ns=@>jZQr%|MsJ>Q&@{a6qA3giDP}Riw!6m zW;(-lW~{krjA@K*nrm8YOwmt;hA0XPW5tBhBCVLB4nHvKx8Hy7aeG5y&a9FERgZQF`Vt+9$F4j1U zViA`);&M{gcG7|vsY_T2BkqJjQx79Cxc%<^?t^Z@og%TVr8HtJikP;OIvAzy%|>m# zF(q{;M1!W@U?eb(HhyQ6jDj&mVw+2v<~dRvKE%Uq9VCAmJ=81qrlWm__|(%Y_VKy0 zq)k=?<6?Z7qBzQXsn`)+cGanBMq5Y8pC{m6gw$I@gOo!R$WK5H$J_6cVSkD&(p5|b<9`O8Ym>dSwGGH30w#p%wG2MpK#M)mb^fR_=T zpIqllE6Zv9kE4EVSt&*)b!U%E=8T=(vJD>Tn=YdT+of;dmA-k>X0v-7whSblbIWZ{_kVrP zG^@>MFPYjFb`Rfp>!giW5_v1(dO%nttVJchPn^@PAO?*-DvDlB(Cw=Vg}m;HB15Ua zl$J&-E4@Wjt*9o%t2Q~UQKQl8jKokN7SMl!Xl|}I779n4mB`JB08UCG8Yk7LD|3r- zBZ!HyF)L`^R}nPIom5p7GzK%>c8o*rB>`E|-JEuG_*@2^kNwtRGCTUNB1Mk0 zggacGY*#ilkzFO4l4Wd`$^vh{aH9Q_ayiPTh z(~4@MP*CDkJ4`&CXRS6`ttO+_;g2{?5vPOFh}sa*Xw)1GjiW^(Is>crr5m0bs;K8G zeJ{tU-s4d6NBDn-x7$)c zXc5*Th{Vv7*F_^bw~Ol31`W};!XQ4g$r*ZZ z@k!?RXKkpjPfz(LBF+=1v=<_907AF07B#dcQU8C5_cI@D#)z73?8RH;eb1ZT!#GS1d$qa9^XB;?HN!lU zJP-M{`QFCcc|T7z};`H58Z)29w#V_vdoH zh|ri24HZN}q1=eqUs5FtOnF6hd3jZ}w?wCq)9MOAtyTzLo!gqenS*~A9DWCN6j&S% ztHtXs&X?z7M8`yFv>-1U&Cl}|r=*n$kC!0e@p^rPS_r4U8o=lES-f5!Qq-H!`EnzE zzt89KMhH)j@Oa!c11Pgb+_bnPuR2mvqSNUGb40I>>&>nGC)T}}4zZ8L($BTy=MQ*?2{ zW)3jHBKSs|_n7yYzcUMFXYKO~9GO`lF2-F>vDaa&ElK~ibvVV|wrI4&A%5oK)3way zC?vxV2Ou$C&*4c<^vb+mv6s)}%dSf6TZ*g1T~WtLW25bqkPYPyd`_=y=Cpse&+YQB zGm&X@-|54$FGkll*^zSblyq=FQa#auHPpQ>g^z)w(Ql+8#CA?H04wmE+^-P_V)q4Ens@ z95*E<;`6vI9*>*2VU9*}bA6GV9Gaq+Z*^NDZWr~W=;aA5(P_0r?e+Lbio_CbAeP9j zGQ>v5ro|S-R>$_mlrdK^Wj>Re7dM-xnHQK>n-7`=gPDJrokasLIIcT%w8cm935t6a zqVZAUXKCP!XMi&<|H=M^WyMi$r5T9Yl3!0OMo&Gli0*oBKDEl~-v2Vlw*3NfWsM^k zCjVL%PJ^tlKuy?6qXDdtG~ggL@v z$byp`O-O&Q8eVi#(`UBN9RCpiVLD_xo~<{R8x2#lxBh^sgyjQ>(9|s}wh@m+F_Bms@YA>lEq%$^q&MO@szkyR1puPRD_9|h7n?uNv%_A z)o!I*U0}#F=UG)stCI+7vmr}>%APA|jJaBtoy&b<0hD3`6u8uqt8#93HD2yWdky;9 z(uRLz#)ZiJAo9`14|KG(HBN1L(x&wo>rE-?@Me#(UQ9_pZ8kaTZ7J!eM7G6UZ*$nZ z^$t!nDQW*^gOg`{#Y06(diQu*XX5GSd8o;RW*%l4>#h8{ba*I{trzR9fh<#<*_UOi zBPr>N&1PqPRwkr86s`68Oz22SKP0k@<~o0pZ8X>ELp=8D_CA+ma1WX?9D-3qMY+wS zs-)b==X$P5m~+#2%XjzhCRMwaf4h9bx6f=kLR1ev^DS+DsQ)h;NGr)E2GX*j|C5J% zNOS+IAAi;V9%0px$SAt>!ioD~SxMJ;wm-IS{H$}TQrs_4M75oLdq zT`gsc0*hjoRoz_mVBsTWdm``n-wN!Dyi@dD#At|U%9{Mm!OLPd_*cYk_5aSlG4@K} z)!=8*EZ+|4Cum@hwW?@Ft2(AdRh*(l4YEcvT2#y*D2xV`p`uvWUySOA(`kx0Xc2rR z#R;9MzBr*X)E5`49R=Y?VIkMD{M&!&l( z;M?QJgf@ish7N{=5T6p#DgLgoi!uooiJL`%JG4=18t(LAYR~yywaH4s0(N`Lni1}3dJk)DszL4OrUw{ zplo~&$erd};G;fQvn4lC770fZ4GRjE6s#^-U+_eMqQKeo+wH`E+|hs7HtIlcuh^UR zQl~A_j7b_5`;4_E8N1Y;c3P)x)Us0U79<=`PB%Bxiw!=?oopG;yES9dRA&5f73I7K z^5j!yvfI+oZn6`_{nxL2p!m%8^ENh2YW?hmkFMjbo6gyB-+fOtHGXI#?{ly$5ns$jUI2_igVWNUS7(xzTn2`)Zg4UZ^&$))fFB-{D$kF+ z$bv*b^ptqoJ$pQY!Bg)U?V09T=vnP~!n4n#_I#PkH9YQlIV688Z0S{szSB*^Ul@wN z5aeU#;fV-c^Pz0N{GHPe`yb-1!yenr4A!iDtD%p>dX-qzARh zi<(?&+cL|WCo4ezFZ5d(g*w_~aH%2b29H#oFx8K#w0v*1th&1DG`)uPee;Kfk6%8_ z=gQXm(pt>AXRkeb`D|I$O*4eLz9E|q&UpDU`mAiI%gXGKmCv7f-%Ocv%svw{^G}pq zk;qd)u(`7@>%W zk@m>mh!BYsL?e;Hs5caaPIiGh7N`hcC0d|jDpdhhsTlR@Cv-K7)R1^ z&>=Xun?`4+krL}P>rN}Prbyjp$xiIs$#t;Ny_;jQH}l*ZqT->?+77k#a(_&lJd%zX zJ^U;wIcEC&iWBp6C#7uq{96XMabzo}qb(RFvIJCC%blEFI1Q7EU*pmTFYa$`uv@aS zEOt`sFlS|(?f*k=RFZ2pI4oIz*=7f+NrwrcPGi;Ut(r7FYGYrWoaWw!TtIk0Sc`mS z-lXI|Ly~Y<9n@x5C4cTk;)Tq99X+ENP}869ie(OhYDQ$zF1!I7TF5l|>ZI7H^it8qDKd zUrr!rVGc!(m@_7)J7;f>B4~AJx=0x5@({Y%9*IFu5>Ofsd6U5IhD>tB(KsLNf`2f{rS`Km*lU`U!T7x z|GRv3{tmhr6m}9z*lmfzDqEtY%Em9XC0tbo+jllG!dzyDZ02z5wJc(+W3!^ zk{AS1l(70Oq}xI)5m7;)7_C^X*rN~>&yW}j&_u?=ArFniZ5_RB9f!VkiU(X`U$n17 z{tDh_PO-1U<>-}vb>xn=15WXPL;M!U@iF6Ni;MBzKG}7k=BogTV#kTdiDiLk^wfoc zUvu^Ud&Y@TH8L4Fdt|b3?BtfG=u+ykyKJtEGB+~mI_~7A(l=dHZBI!DH`&Bv${zP@ zx3#qf!+d?cF%~Nrq}S(L?iGVx70<{* zAP`Js+3F2JQWC5Wjt))>t`9yD+!@>#R0mx(_SL0-K_$;$pj@xqsobX&l+FQ#J5Ef+ zBs!|^v$N7mO=(YVZ+&mCskWrIq^+0F%ZFr>;FtP$p^|<=rF0Ng z(m^<-Lz_+NVs&PP18p6d^{BIn6FU#bVNmZ$dq=8^sH4ZLae(xo#t1vH{vn?3X1G3&b)axr;v(Di3LHT$ef zFPgt&=Hh$qUU2zVgLqTZd9_-H$*48B3V%DZ?`_!z_?=N4J!ssSb0$sWR%DU1PnaZ^ z=(YkVFquzAf|@{(q{z%fA@cxCrO|nV2IW2_Rk{kpZa>BN?qb!#9ykP_(Jqbmx-u6!UZ!(<`)B_!j$@`?mX^2|bx>BPr=%mrl%2 zNndU9$%|LK^Ez6IvAUuhRtvbv5I)VABb8~xf_HxyDZJ~w6jAp7{mGASd+~(z#_s!Y z?b;9dNBF$&t(W?Le12E|!IvK73b9ZpyUAZ!|EE8#U;n2+fncMwPZ-ITq7Vn43~F@- z?y5MPi0KUVFIzv({UC3@e}C}n+^_OfIo3Se(7>qNQF#*rZMl>4&NrOzoSVDcskd=Q zMW=t+(rTV)y&(6zyu&Vq(&ZGbt^%>ZlwgVW-c*AJZ@ zd)k)6O~zn>O1D{1dVXgQhIQG4)U6x*WR1VuPyMc#B^cqIydgpi5r1S&ghiauT_^Q( z2Z_oHiESOD`1)=yA8Ne^GRuf3mJrkS8rOepNr!AOAG6q$CtGZ`lUD}AAyieOqMW_R z*O-XBDyV$o_8rf^`^b#l8>5J)>|=A?5Cl#}nC55JidX@d&AX4$czYC3b(e z+hGs+w6;*brcIk7GdJf4^)@~n0->PA2ffas;$M=t`!#{3{1?0kam8|jOGP54$g0iJ z!llR7!84;doUJygImDb87u!%MebW`N zlCw;vN_^GTvC&@{xX{mVsfE?)d*=f`)->4op# zap(K*-+9OT!skckb8Pv;D~tDEdfC3qUm+i+C3(ZgA8+82OtDnjCzPh$AXgEsKrwnaRRqfsoMMBJ}FMU?%2yJqF%kKW9+?e_p-vhX=7u{)8Q(2r3p zRa~dPrfh@0OTQ)heDv+8)~+^a^sk6wNK;viGE$bJ!d4(uOx21MNhE(q6^Zt6+6jUA&FFo>_Pvb%<}u zh>M@e22Pwi()td_vn5Vh7i>Fufv|CLBD*l^_7r+zeni~`e!@+xYp(g1E6&vw6`9?I z$M!^WL9`xQ94#R-j`n{o;B@y^PPaaK%caXItPYFX{F^x!UP_kBK%3P!?3k;8ZsYQ} z(al6-G~1hiUFvq6*8FoT9W51!EM(I_;os^Z|%@S5<3a560H z4DSi=4<8H*VP|FG^izaYMhm_++ZX3>(OZ9jLuz_q`c%YdJ8i1m0k?DrF6mHLp}IUJ z{nX`CBPAW`im87~c~GFQ;LIXh$q6TBM$ozDLaL50nORiXG_&2S!p=p%ilYdvsx(!U zp9~%Bn)KY4<5)O#l)T9Q{fJBRY|Gwx?8uSF-dVQ$=9^!8?dF?z(^u}15o6ohNY+%@F%%Nh z`l~K?YL~3N0wybZe?m79!9dy0(mkcLG)2DNTsv&~@!d}xWaJT*fqdCvVEmVW|8Ez$ zPR*D7y#gtJx#lGA_BJS`Lr(_ueoI>WX-)f4jq(=N6FTbgp_|rYRsYJ(O~#G6ZOV-0 zQ_t}`o&Nss`1Enkbr(-6YOZ&b##z?D5 zp!_%e1)IVM1`n1b3Pa9vXTmwoIn%kwdA(C*&JtUHES6A~Qm<)IC_;Lh$9ad<8uG9g zX^Pyw)uYVPYe9Ap?#iQNeTF{Jr}evT--!N4|KhFn;hs|Jb8HoP<;+vx8&)4nVL7pTmK+MCA-? zr}a92D>G>HEga*iTG7H0-Q=*|VKjyu(5ST_0i!667I%tFbUIJ2J+Jt`srA3C@vW!U z_Xl3zV^jS}odClBlZmjCEk!deOvDWX3^m!chJl8-VXz@#Xf!lwOc8yxev7*+CghQ7 zLMM1;sAhN;sTO$@)v9t&ld8!xL8T~F4;U;KkG_2a$-w5ifddEEg$7s+oaGCc$QYNo zzXCab+Sf=Lo9i1J6ZN5@5~VLvT$JziD2b|YKw=P@m4!j(3TiY=HK4jWH`l7o$`06V z34c|oZK;jgjz+w`KwgBWBTFMRaQE^3SDl2kmn}~ zrBiG7lYB*?pE&d`jtWr{72_NkuDJ$nZ5Ww!XW*fMe{J(y2-3GuNgqNfeF!4Gb!@I6 z9gX})k5s${t~zBZ9rBuV*<5w$ZP0CIYx)}?@>G8uP{J~joB)#W>Bw@r&Gp3v^BQJ< z1Zz46PN^Oyf9qr2Srx_SH8ji7(Pc%k!HqKe6M4;EjMRD@#uV4RMo}k@xB^gJP%0EJ@Q&GD zbU`}0_PWjeH}&SO$Nq2}Q#`(N+cm34E3;9_SMKWXuG2SNG4;XuY}CJI@%N@aoZ}#X z01p(8dh+Btz=9CG+{sCrM^i!?c@Q3C-z47lzC*vsQn%2%KJte*}f0opG@q=1in2p=6zZF>g5AZP+N0TN6Q8=SC|q#Pkqpd3C_7@_u3 zhp1!J8Olpdz!N*d^-s^#88DNXoEjKKDZZ@Lm_^uq0cgduKq;Qx8B};Bw7Yl$$i)*o zI9=4w*M9?Ol8v^t!)l0sprfEgL~w*G=ml00^n#BO^a70*5h)|8B(^{+tW;ppqA6mi zQ$dTY2nxF6Wk(W}0>cD?1s_@nQb^=snKUu;(+?5WQtqcJyVCshwv>$^SCc*;(Do<5^q@@xpLpwBIhRP=MxZuB7z5nU-h01oeHqeB~3k{gOz!?x(y}9_# zvuSI_=Gfv0icw2N9|pZXaZAm@zLsoTwe}C+n4a2m{NC5_mKv#mz#f0&k+H*v$9{B} z92~p;hLwj_?3yk@(TX4 z6fey|87O>^Nmbh*LotP5(nG6u%(Ub27$eYUXo8M50L4fN)>W383t^ZDTE z(q&z?EJC<{@>s&)f|w|~cYIcg$)^TPu;dxBWWHUp!fR5zoNY@Ms$@6NpVV9v#FI~4 zy5#PN%9DtD>jWJhKLtSx$qED zvy$sTH~i4qs1)Lh2n6eIS+g-J2Fn3;fWJ4vGvHcr5Yop{ZHWD?kP zUq`ZkS4UJ6QjcEN{6)*IQ=fkq~ciKuT6MwPz7Z56*2HnNe&vh#8 z6UEazOf4Tj-?Jm7#pnR8#B#;cj-S&Cw!&$J9E#52pjxn%pjzlg;ka7~1Pk2?D-`1B z{|FI$)AJ|^DQKw($6x?nOuC^eA+3TGXk(R~~+FoXk{3qlx?Vs20hma~+ws zd~IBi!`9l%Z+U9SRQRa=v>uJ9jftkh>h7Lw)@WUpzx6KEq5PnD)MF#wEjZ|;&cz@X zi^hm2nO)32<_+c~hpMLp9zDCUloO*C@J1Z zpl$*_;fT7OO3^lifC?ldtg_KF0e|i&^XB>dMon@*hzH|F{Py_XxHmpQytktPH3dk; ziXpVK7;3~ckf})*1V<56S`au99qso!5QIN#tRqQE7;@cmUp7G1=; zCiEPyFCO*ulY<})RVToBc4k9<@K2vZ(ayHge0?E@!blw0`Fm;)c zN+k_54K+bAk~T;)p|G9Mb;0LazNO1w zbU(Tn0kVOOzEOo71Qxv8$!~>QrEM~4Fa~QNp$u;bM(`3~!<=-9d^7QNaab9)w!^K` zFJ#F{K}n!^dP@0MkwpSRLlPB95)}&oLsk@7R%8hR2IX4Sj>UpDL)wg= zvTS7nE_Ya&u(M)8+%A&hZnzxC(C=`L1e>H0X^Zr_cDd<}bxP@@{j#`A3sC!+xQw&%!If2IpOaI|9B0pwuFXEwXERo#V1I zHjkP5Ivwg`rmmZRX3VrQ%@f4<&c-I3U_%bu(%9JCVrE)ozdI%KddJ)unI8hANf>v; zP*VtovRId3M&*|J6uNp_I-RxB>6B>c+I7VpyhPS*9pS29o+pGJq|XDN7;*KHV$% zk%z=$iXDvxZH7P|lCtZY?M$Yg2l`byal3v@KZDYH>s5$WCiYRP7Wlui>?DDGn*`C89y4aq9GUamdFUR7jItSmIPa zcC%jMS=Y^fIE_B{O1bhz9ybX9`93)aLf~%>!=uIw`gn%eQ~U^U#g734JSei$Su8#= z84deQx11GZIVhMK4+)7dI9}m6o(m8>)HosldBFf7iX;p+z`y~IEieUUgdv$|L>m|h zz(6FtYF&l!w8RQHIrBD{(ySQORvQ{K5Z5$B@$im+NDHFozqBLN;2xD)bo|qEe5jBq zD@b7JsRI=8XPqEIH)059pbE>%MmpIBlVvV2d1Pu6k;CJNDL|~4`p8X_OQsgC#9Fo` z#J&~i!vO$`9}JV{6kwx*C&K5OXTNb`HYMkYbL%nUy;_e(3BxUj{5_sf~c)?nNs)dSZ^zPXRgz;EhFV*I0gb#jQ1ff7%VG z;}`cVS>gM`195=f2dIrpI#%}}85#g*0O*%2U%&VR)w4GMRbK(k>ZM&BohLi#3jpZ> zP_}ewS4Yes83D*8031tKthwsVaS82!@B@GZmUl1e*!S#HHvv?AmVft(j;ne!FPZKK zNE`sm%8nIXllF9&0P!lyULm-^{;)4LnCr9rG#G&vyxlr-YcX;OV z6y@Jbx=tUyp%N(#cu4bW5NOVoAc{kDe;*W3E4C?0 z0FoKOLI)O8qe4MdN)4q7DvD>X>c$I2HqWTBzygbKox%`qW;LWsBzD0vYgcg}YZ)W~ zC_aCZx^w3?@-aJULiD^_ND@x4Q+!G>MX^(PH9w!f@Kn8_zC|-3=EFEqtJEsBPiddh z&(MFZ|Jvv@{v=^t!n(xQf0I-G$yt+JlTw&cnDR;Lu<4Vu-=%+){!vD6Mz8s&7PT$c zuC+hpIOI6wd?V*a<8sD*oG0=Nq`V)2#ApvDLPQ8a9xM{NgTqv;t=j*vF$OtvH11f5jpBeQ^jS;t=MFL-O$`Z8`46-N@oat1zEwiKqc+7G8;l36c?v zhAGr|A{rJ@kISNA5f)TM!wRG#I~rCZ8$b=ZaV1t^8M?3vGtq^0T*vY;3EfzZPRu|v z=5p$4EJHU|!h$jspd6*&%590}w_K2y@poel)}seqsQ4dqe^@XMGq4PcunOH+jczQ) z8swg%e}DcbVL>qpQH(NJ(2S+%g5^8XEj;%s^l;dLHPP!SfCbf9j^(hR3CpkqOR)y4 zd8`Yoxumt|LMP|cB8LB`q6-VLDq8;rE@35_&&j$39azt6y9O34M>ij{i(tVbbfX9B z`Bg+@SLH4=Wc({2zIxsdwQ?Fq^RncY{EOJ_zuT7W^E!XSt8Sg}JyF_u^{|!H8GThavfM zOv2k}f9Cw-@Cxq5B)m+nrJ2+WiXqX7w}~wNl^BIbv6l3azYFcygnKcBFnvLuh9=yE z2i0!*X=Fpf3S5Ib@et7wo4is!0wt1>i(2_n`2aew0y_{QzYrS5YvqU0gxOe$A7K|M z5Ch_?qaTHDl)L4(5Qp3F7>OlT3JOJ@JP#R|e*ixg;PuGW6N{KTDu@3l?|>36RHF%f zxD$8cS2&2z$z<}jn5{sV$Y%L<`S(zv3Jb862t*)yVk1+?Q#3_*Q}~A4pgJ^R0lKh+ z_t@ij96!en94B5%ybx!*c{gBzZ(4)5&b|6nTrhMKkGo zf8p9NpgcQ%a#4d?T!J>Nz!uzt1H9HpFiHp!$YRn>t|bqU?PQ32KwlP`#i`<7<;C(Q zu*)?f8CK+=618YXE1t$q?7<;`8|0A6b9IkkLj3=UuLx6YHY%t_z9lIi#Uugh@DI#E6EMyZt@fI z3-UDCN8TY}s-;f}Wx`#;Zjp$RxK(^5YzY4}910(oYvoq?405p$H{w>@g`eUvJc(U+ z5yPa8Tta4%`6NJAlAFnGm$&KyAz=#dkqhP3@=fxs@?W?IX~KBaqZyZB8CG(i;woH? zYtV-qun9Nu^A6mJUtkx0iRUncqxcM`h=yoMJjo=5q>xM?Rb&!rA#2DF$o=GJA+d6GOuo*^L;BKycb zGDv<+4w84sVRDrGiJT^3BGYW@p=ERdT}-d0Ptg7JB^nlDg>=C#WD7o_OXwA@6>bq8 z6MindC44UYLyQ*_#B6b**d_i*d`f&#JR+V})G1~t)+r6jA1Jp(EyvJ>UIMA5Ub>i4 zf6@wqIP~CI`U=fQ(>dP%o9AuhA2>iJ;ZJ1r?26_#+=lD%3CSb#Xbt%@9>Y(_c=99i z2o-1-ZX<)(jz@%_lXvKi_yPPVz+d49p-V{txs_&MG47;0@eyvo5OVN2t;0tcBLASN z7!rm^556K_kUMZ3O$g8=EFo`U0=bn;f5vi}3p>`3s86SmM54G9pi7wT6}QsA(5>V+ z>gdC~&Oaa>*iLe>3q#~mJVS@YGI2k~V+yQD6SvYPswC^N2@g^ckJDGsj2&pfOgxEu z(TeT35!LWx9M+(Q%mN|*AQ~9RZJ@XeHrz%g<0(8vMujkjFh$ zG9HkZ%U*npA-NTsun9{sM^UZFLI*nNa=fV8u6$qVQx++SVuPYn(WIEJs8Nhp6e)5Q zR)tBSQ^bhJ#XpJ%#plJJi8qKFf5ZYYNsJTT7v2x2*~fr2ju(ZM!8ZRFDHb<;Zxz4!cT`E2yYGlFuXC`6Ap~NeCCg5 z-afPA%%kMX(RbxX=TIQC$V@=2UhJ|vvRe^%_l?X*^55ItlRqqLjcAzvE46j$SF>=FNjIe>IY%e=XB znrAo7YHXNUKh0lN>6=(lK4E;Rx1_kJ&{L4_cID-c%gJ^+>^7^#oRyi8o@Po-Nlr>k zFdFo_cx_y4j7F_eDnx-2xNGfG0+wKQASh97Q+T+9=+ z1UQ@JVos^U5?uT(PAS4Eo#P~Wix0khx24u@2@XxRTS8?1tQNZ^c*kUWt0g$X!!vkT z%;pj8WP7XCn(ww)YEzd^wggGQQX8DIcIoEYz~p>4*%2F4W3TCo$#-K%Ol*z4CN|%V zV2ZtG2T7?SJU~-we=BxSsI~d-+F+V}a&6FLpUkQd6r8mkox#RgEwz)=t=86jcaYR9 zvM&t6J}IbkaTe5YF+pWbP{qYqma)sh?Uo(x!OcGi>9H{2itDs@b}VQK3LULXhQSp~ zu}==BY&e#BKAP_i8f#i^xsaMJY_3gRW?|9In{TlMx6f+1e~@Zru(dTc-<|IcQs7u)rYN2IQ(!@+9Oo1)NIJ&CL6<9-m&f!%RTEUQE2!e} z(tP*Y5FN7j=q({SRBH*Mu_Z`4S}Q!M`EIL~_3G^*e+dio-PYj7SuK&c1q;&$AbDJ^ zK^kC`!7)nG97fqVMmd)~V7KPGck!Kxq@X(c+)t-ZPN-d45hTg~g4`9MPoHg{K5Kr9 zrFL^5+P2f1FN#Iz6VB11pirI8}^Zd=5 zV=k`xOjj_@8Pqs~3TII3494?tf^#4_evZo$j1M^NmZ0t&WPs@Bv>Zyewpv;&!REYH ztJRl!!gInGY;@(jgR#z_;ABw2%hGYE<%K3We}gH`RHFBt@s(G4QjeZsY%xwIUdN%@ z8Pq$21|Cj!4wwwA1_mzMcn&gv@6>=*K=1pX>!9Pm6lVZ#K#{-Dwgl2UTG_~BKZSEnOHj$1*UHRjw7ufF2tEHrifx|W)DmoP1shyVE%w&yBO}uq z$#%h!?|%*o*+f5WV!qoR6tclXmTbEv+n(>XGo`cyf+XPFJR#j~Z4JqCfLT@E05ssV zF!JU=kOu6**?EkbZArHWX&}4R5(o-`eD@Ull)&cAQ|y*0n**CWLh{Cic8lJ=d5@4R zByaAi4U7%aki7Ty^x%{qvPXtg2=}-sw;GE=dPdm`N&rrb9ISV1np-X$;=FfS z^MARoAwVGPPzVB{gdkP%S?nObQp-?7EssJ2jXa7N#K@zFMXWrEIK;_kpye>0LmlGe z)6hdJpN0WC`815s%cqe5z5ERlVUWK;5{Jn!%3mV|iSpM-<)luyBdEcq0i9A?8JpF$37@=1*2Fc)_D zB=X>p{|*<2ZaC$?BOlrF7bxJ+gBsF44PI!u)RimC9)f59|V%6~yUs^q_5I;!MPaS8nLrh7rSdRVa@dUp@-TYPCclqfw9D^f z6$0}6Sd9+(k643+@*i;}7Ri6aS`OEtQ~m?4LYMpptmkk87R&G9YAli8!+$j#UW;Y& z?{OV2mw%5w4maWo`S-XU%jF}ufx{cILOy~`SSi1Yn>f4~-SWG*1-CI1fnSTFw$cVdHl2tUHr@*&*C;oZ1K zK7_5fR(>1zaCk4Sli$XD=zo*n!u=d>!$$cnJb)YI-{L_IAHt3DZ}DSnl7EYbu}MCN z?YK!kh(~a6yUw#9>z@73Nc$&j!aF_f#g1B3L9XmK2z*hNn?8H|2HGk~FJ@RXK7Wc}p zVK?rTU&SwRpZqF9xL5btn!7|+Tt z;9cyNU%(L#e~(|vFW^0dT}^YT6% z!=Stmf5MCMbNDlUB|nFc@sj);KEX@!UVMs|<-Pa|el73CUw`q6ya%7*H}W2g;DEdb zf5WTt9vsJOatJ5zx*Wpi9Dac}Be6P~MHN@LPE|zQ%9m zXYmc*lApzC9Fm{K861*#VHCfUcOi^-Artr)BW70OWdYcbDLhx zZTci`(`&d*ui-X*GPmiI|6|ktW7GeCZ_@|^Usq3<&hXX><#xv0XTWqrw@8@Ce_)&;O^< zAbf)W|DQ%cID;32(>N%c#tGpxV&p;LtDUoE7o*xId=0(uH6-C{Gzwp%NB9~Wg|875 zzQ$4EYt|0J*YF6VC=|YiUl`?FfwQ^#&&FR6Mt?DQHs`@8cPu2%F^YgNif7K|3SPj) zI8F#(Ln99gUk^;Yr+5z!Xbn7YYG;M7_+WLSaO&)}^>e5bPQfFbf?qg=2H_O8oQ*#t zoPrXPaB@Hs$Mc;WD6c54W|wplK9tBCg_D?#5*FV%tEt#roh6)vUpR>d;UpOGpl}ij zcz=YG2nZ+9FPsF+Dncim#1`Qs9u`jGI7^WSg)aumD!7y{24*%FSI=Z29O9*afw!Z0 zcNG65if@kMo1%DS6fce9xluejimRfyGKzgsTpYzkQS6LjTNGQO*v#?g1G7u|t8<0V zK@bo=MUU_)HVU6YK%?;KMJfHlr`RrhihrQ+DF%g4aZvaa8uW`Ih&(8YtX{%D=se7U zSsoNl@N(0I6TI9{&?9_;jlw6q+)pk_=@&l1cHt8Qg-(9XG3~n8!W;$6bjoQ3ER*pY=aUI4nr>-2E|d~Z6cfy z-e!-x3U5O%ybX)+HVTEeAqj6oaZyYVUZU;jgjx6*w$y%_Z6Ti#AGG8r9Nxp> zotIbw12})P0qbSv5c%nVwaFYJO9rf^<`7vtU@bC-$fN;ljX6ZBcUcR~-&jK;k#yz{ ztgFm#S?kR~Yq|LmmNsC1n3H17tE?__mo?Aa8A+ZOK{X8RHdk7oGUrE9+>w+y37P~= ze~9dnN>u&7QS}E@{e`N2m#RNc)t{~Ecc}W!s{VgWRifIc)~n;yaq1YgTCG%zYO01h zF(eqpCLSG} z+!}w(=D`rb!RVo$*rxy@viA1mE07Z;F=!PG+x@WgODG# z1}C_J^wtnTb4!TGEa|3n_UPXp5MsXRj&z3Qo9<|BMeMv3CM-o#rgZE6I-4c{DTZ6^X z!1RzvW?L4t?4f>ISvz?TtzxLPWshk)_18ABbkp|9t>^jRr2g8;dthaV^TEmZ;QSV! zjaD(f9EKu%HqK|eh;K)owRZ9jt96X0j`P%A%(MMsp6#4xdz43r@K`V4NtggD=dph# zO!y9u?cdz{<(%9tN)GT-{F767=2A@ z?Xt-i{`jDFt#Peh<67;y@?1e{T&!TMjwY;G?Ly6h7AY=}6L1IWgg{onN>{ILWr_Qt z1GWOXZ9z2-`n z%XK9p_ zrcsF}2u$kfSEssW>QDM+jQVEkzx2(}kNV*Ejr!QXsIbIfH8`yX>k<)XEW+R!NrBU_ zh=WYV23ZnkDy~Hn=8`gLm7&S#(rcQGMKS6oqgRC{V+F~amgdsWotA%A6f=8TnpZV- zT3Q9knqqe8=S(pd#WYVbdsTH)%oQZhm*dhG`*Mn6N_;t9)kI%T1xe94h~rb2-eAbg z%*x8kb4j{Hzbn5eMx&WKcg~#R;v(jj6nj-__3YWr%_SvX#^BAbAi&hAb#)Ub>MBUZ zryvJ^RV{($+-v=E&y#Td_M zS9nCfNW~C&aA(Wv;Z&FY%eIpzN533BrsoizHs8r!pMLBdb)64?`TfZ!dwsfZ9Yuwt zq&PV#QE9iU#sY#;rBvE&*`?m`2^U8gDk~`&KNd(R8(&t&v#EcCl7z9KO0cU+gsp}3 z{;GOO=U~X2O5$U@nYj~b>iwyr7+Y#_Poycu^?rYSwa!`Z_fIQL6&10imOLL#xi3{L zce{K<`1^gj`-BI|3-Zg4G7#Rb_NUq^3)ESpG5knrOqSEVqYKG{J54&jE<~S_4D1E< zLP!Xp2TGXC&3nlE;JVp1W7Kuh2fx3lkhBr+`12R8q)Ca!6y9>SoNRW|%nH~1>Z)wF zFLn8%MaxrtZfC~0N$vLW7=Yb#XcmX2PEFn_6;|^B0FE6ZHqUwBql^ILDG>7+8 zapd)X`usny*{)5GtSR&5W##N3W!oPnWjn@Y=J`@>SMON010dv)@Gpg_BoP|8Bt3!n zF39tsKf-@LsEBGW?MDoGe#Z~FmL40?kH9mk_Z1ZqD~VQymJwt4NLo&sQ$-R-4;9&x zbZKk^KOui8W-C0Dnmv`pH89c3o>i+gCfi+m zNIRltLqDP)i5Lzh*+1eRDJq;E)HSY`%BUsT8Sj5IW~XN>on~iJY^nM7 z304F$A_i$0;zWS*L{=2O-&^EF4GH=I%iLLbO4-SNXw1PN)_Q7vR_ww+2 zk3N5XZS5ti|LcP%u3-p-eJ4Q7QFxGsXZ9dX9+dPZt3M@eaoV~xAt}w7M$uIWfIcW`v!>zvi#}tiNmc#_v?SR>jnKjT90(xMUH^?r*A|*qCW<|&p+aF zx!THIuA)M?dfQyY5H%Urs68;KBE4NUp1%1e8{DH?8GQ4X?&O^Eyc&h)^pDv%Wq)B_ zVO&*yuEz+%-nJ7H6&^Ur6kyKq*y57=f?{i$^6rHiTc9)~hakJxFs)l-g(e=(03_o1jjm zj??a?OJF7OyL*&GnU<3nqDv%A+UI|2NIBJBM6+`|ZMGMT8l%ye)mzk5ZOYzD?k1N- z?Fv&`m&>I;Il@Qs$q_#D{mJEW`A0?!<>f>_T3PN%h5nTOW%RCcxppYo!{Mx*-r1$m zdt>y_m$+I9>lD)4hTb-p)5=X#lC>1$%SydmQ^$-#)M_bJO7b{)(P{OJKQn)y=B=){ zamC7M*(vcwj=ak5-(CBwuj+2Od?>4G`obgR)f;Pk(^pHjnmmVZoNw3izdkCf8o#C$~nLyti$} zNv_i~^2LI?Wzi-s#a{2V5qrGh-$6Q5)HS49+P7NU}QBMNEox z7fDeixgt*1_1BZ$Hj-3UQfy30R9bCOOPkCr!dSDjHaA!!gM{o|)wche(eUX%-#oK2 z&)$?Tb?&|O#wFc9w4}Nx($#FBh}9<@;qV)89iLZRom*L>O;~sJ`pr`fQVDHjV}{ww zcjXVoISLPd!}u3cm6(5(m{n(<6FW~g&%91|n|QDDac7LzLZ-ydBcYg(?m*0Ix_4rS z-N#~&yHCcBy5lrDlde9i-Yi=490<{wk|D275HyC=&ok-_3P+tro3oc*h9nZdQ#qow z?xiz$3#at(7TvB5YENjD(6W{lw5I&MWHQ-&u3bm}q#r%TE%1NnF@v$(GcsZ@mKPPG zw~aMbS+uFRCG{E|Y*va+n|7O0rA$aZ*K$hoSpChHJo3c{FFtbc^0!FFkFTxG_vNML zr<)eOHKSB%S<%(C;@X*2chG%RVm|^*%W)8Wn%>NWfMp7GtLJoUME|s~$12u_5{gsmOptg8{J#@iBnWOgw~=?HaWh zA7?PAVtO=#8mdW4QbX0F8dM1?Q{r8F&W~kgEDhxz`2D^aqrEi?T6PgBt(1+1U#8jp zgnN%JSF2C&GnAL#5?|oDMRD!Rscht0BjdBwnncE?Z=ru8>=Mh|1?9qq@UEm1hpSRA zR{Kh;>UR&Faa85{a+28{yC>xj`RrkW6GaG1l`2skqZy~n8<&&gs?%OEPJPw5b$Q#y z{U}eoMX^cqOwKc|V~S&%FBM;E)UD%M^R93Sb?SI2In5jIHt>;YNlx=3B^&X%bq#i+ zvzzT(?1F#Y?#Zl6RCwxC+O&Q2GNh1rWYf!b3TY)47B`T1xanm(V@<{9XXY6r+^R9e zb;3~YY3m&+FDC|Lxr_bzDD&nQrJIe(VvNSA$j(ZzxR8;Q<{|}Zw+n^JY!@*bGhHM- zInzb*V>~Vti5?d&oT9J4{`%{ginaBUWTsH8{rG<*lpP(BNr}oFu2o5iOv4f`2n)A0 zG<3bYY15&uhKAZHC-&_-QG3U_uEp!tE$&*Edi#UDHWg!yq%b6rxLeBOr=0!>rv znr2O%+7y0?D8j=T=_b31hAU<^RFpT&9Q`8f@?;sb$q@iYfT3Mde>h-!pbgmRb3PE5hZTf%Z z*!(%l7dLG7bj=tYb-6~2<(^)b3w}Ry2lXdiZM~~%*gln29^9!<@>|(()MfdtQj8%o z97kL(HVHG0jHqO#y*MT{F(D}-IUyxMR2DcL&SHI`LpbdYf|*$!fl&vpn!h7t$S zdlK9ZY0DXCW`TfXn#f~1649#IN_QHH`1GJw;HTt zp_eUeQlK<+)LYuoVNc60xx0Jxv3kEWZRCUXjb)3w!>7o?YfEyr^@l$n5^UuK1?59` z)T}M8cwphonv$%%Qobnqsxr5-Y}T3gof+P$t3V*hABwk%?_oUNmaJEeCuV<}F44an z%SdNVXYS?WuO{n~*5q6@evfH)W~|5d906Pasg$${Ii*6(uLPQ&|}p@fRwxYLx^D=At?-zPj*gN`55;sUD0WH z#!25uThw*;j~vsV^WSZ5Z(@I1fhXTXl}XN$>@;_39umDNc`$j>^N?JekVm3sfVFa) z3z1nSIq8Ds7#r-&Q|FHQ`DL4mGjNyQQBs^NJdu!}mS0|;pKCJ3sgiQ5gt&O zT+*h{Ud)&_gRC-vjvlRoF+*d9~U1R9}_Psvz<9ksx%rB42cFoX|-8w zR5?!L$Rp+?dmeGd=jIWcAuA6Nk0>uMk9Pyw#v3BGS5cgtl0{i>u=b9qx`OpXS!t=4 zb&dVO>MDOd`9z{j(cQ}(&MqajUiIG%bueX(nCa$bcxiR zBWjFUDVbR*si_{OQL)<*1Z_kBlr5;31d}-}+abK0V*ghOv{217>C#Qhy zO2@Q-D~EW+?JxB{bn~+Hi?4lxSex&ioSTzBp*-J_mY8lxzirNj`O@+i4&Jfmw@eer z@_N62i>wQeOds!YtUP?v-9wN3-ez-F)!$U_Pu49lX66?=L(A`e^r_OjxK2zcaFl_t z@0f~CaX-xXtCS+?q%_GSIi+k#qdad;s*M*7b(1{Ec0=Km2az2a`bcKOU#CiqS{jgl zKhJmVj45lHq?1fiTC^tTZO#}+Ox84$Hqt9 z*i>@k#7&iV+V1vjE4;hp@v2vCulbL9PI=<;Y!$`z#jV9x+13{;;n7r;dS=+B6%N~f ze(zD~Z5jS+t8Om*LDklxhbBJcQzu!MOD|gwS&vyyS(Tci7=Mj*ll7qWh+k=Ck7?Ap zE4)UVG_Jzyv-vy^+3xrJs8Hdt?X&ImJy&_iqp(R@gMYb)7#&t;)sOLj^_gNtoG-32 zu1c`wX|(rptqDJ%|K(5QfOaF%U0l zS%G?aa3Dj9+b0hqPaecLR(_^7_1r|Xm%hsi+L<*?;v2wmIyx>lkIzV+!s^6}bmu}b z`iL0BM?^|-8R`r5=ZWu`r}kf1XDQw!<3*I?mo=?W^1$W+q`KLEUf#U% zC1qYn6YIQ?nmgH6@fFf$t1Z#WTGcAWC-_UPQ>?AlE3AFi+pP~-pR&Ggeb4$=>uGD8 z&YFI9+5M(fv|4SImb?nDkAaB{R9gJCULOM!8K{(|)OmdjOk|)^nm*g>V_+f!{z_l5 zC>7c!iX|l1Yx0g8mr5%pPGs|cB|_v&NegSEb)&W4Dypo+8j^zp(@WVRdZ2=#jRSs; zcFyD%G$_RzV*FM~o9wqrafy-Dc7n-owVKou_mYR$+XPZfg2`WEV;-6jEt?guQo6FV4+|Us)+d1Z8^{yK6^I6&N(;quV491l5l=2H*uv^3emNgQNzxHL8 zyL{|HoLltqzH46|+k&^rgF9n0_*D+i77IQj_8D@M6hCju9Fx`Wk_<8ad&KWl@_gnp>k4_Q^k(r-aa4Alw{QgzO`EMm&;1@EFQA%LGqvHHm6)*4z zQjwQusVL2V3(@za6jN%V$&{K(@^VdEKrpqU6dO&%6p}+yT1BbJmY3>Hv3af56q=it z#|&zkhm!|)CdT-f?MeSO_6fVw|5y##le^@-&@J zFBO$|&3wTjC8T<{F#G3{u8iD)ak0%E{iw^;=8HOiB#{Wtn>;=D9(&7Oy=)iWSbj@^ z%XJI83Bisr!)B6?{xVkYg@pmv*xki8tZM6Zedn(4nC_&IZ)uUiP8LUo^xy0KRn>e% zkI*=tM6~t(D(Q8heDvRn%&x$F!ku>(qt=~#+XD0^l|YHk}M`VkV@knBtdO(5S`ZG zAW6y;2TUZzanX$kw)I8yU@o^o&sJ3sF1Xi!AU+m;^w`j&Z@ls7&@po9(1-n7KKyV? z|A+Ll@bU20d!HkDByZon;jQ7nJ$LHMy?alcWY0GN;*Z7su)#$Nq?CKIA9YgEEN0VO z^@R>o{6%9xcY&RXESMGl(<*x`)tWWUl3{Vd;kMb`Hb}8LKR{e=<^~hDMy<|a4Vh_w z$tcW_G8!`i89f;rGx{^OXK4B}1~X_zTE2@bs@(v+MPI0w^o{y}zDK{2KUomduOHMO z)C(4-wC)g@617vkV}|O>wl>xoz7hX1cC&~rhei#?a>CX-k)8RhwA`#rbEYLzQ0AuP zIEd4l;~?YG^Bg2Q)8QD~hvc_|{^fjsq>88Zoao&~J2}C9@9^XcW}bHs{yo=x=e^hb z>iL@=>RbC6+5Yyo=9!OvI=|6(<;0=&bEYnj?(cpj?ngc*P^GjmJF6^fO4i)0kBk0M zq#R!~rKq`RZtTc=!Bea*VRk~hQQZ|UaYZGnd>%UjFW>&+AL%gOaKhteI5ITef8 z3v%*@Vw3nDrjXx0o0IB)a7MRN>`pI9wL85AV=^lzrlyNY6H+aIHm5h8fmDm9*qa^! z6{V?`ivO>&Zvk(ky7N6}^qi3_jYi|q%hJqfq>*G<(#V#aIJPq<569S$*bve@_(W1j z0)e!#eYe0uDNZTLE`c?$r9gTwN%s~~p!X&<0hG|*WXqP8?Y7X;LQ)o-z3UsETJr5C zVJX_|3S8wPr9Qm<9?+Hi#+K=nd}R4rJ8mBob$4#`Hrk~BpGB)Jm; zf?#rrDHQ{MLxwozQdkH_r+{EJ7)d3r!p?{sEOc}f62-75`t5apxo%;5cY4ncez^Jk z&jxlcNT)GNrZx$JFZyR!?ATdui^I;RhHn0=e_ZpulEmqK_x9`RdR9az)uApEykT+O z{>op!tt3)<-`;*b;M*#wr5hHiy}V~}|KneI^qSj$G62AtgHw;$)ak9D0VGg^BL|&1 z2wY*WHRP$n;*Xxji+Peg4GIKf!GekTbgK37&-N1i%+@}A@zi5D9j)tS*3Z0SebjOQ zWWWO0jmph7sO6!pU1(R@^=3V*w{+*e;`zFVwn>fBBhHuXuSmbMPukD7I{}!zwsze= z^07XDpI>WU5C?Eq24j5>1rD^pmX-{Ua;+tP3&+Ya zM}`?K!IErsHGnF$_OQG$4&wwx;#_(>+!5HVRjDI%#h&0PXu~RW>F!oxEiiLB2 zGI&EO1gfNJ>X2$xLoL7lx-odeIM19Osbp798hGy1BsHWXC&o?~ zY-nsEcyt0DgBvpxe(<72T+cA)$ZbQ71~9MvWHQy#(UEVCHU{%oe&fM|KX_?>^h)hZ zN^^JR-s$rn-*XryK3wyVOHWs>sj?Dk%@Aa7huQJV_BGd~p$~-n0mR>LNkVclDnm zHq-2KH@nh`HRBc)=wcw-l?AhBC7ExO8smyh=0ycI3bSYNpjTi84A15g3R#7~7~DV| z$e%B1vUV$dNbf(h;<2mVojwiIzaQLtIaz1Q_|DPs{SQ6(H#XmAKgR2+HPZ}TKYtCX z#o`Pm*gxNU*P%mSAAazEK|q0}GZWUEEC)aoB;a=uQ{}4s3z45ktPL2m>}!gZHdEXA zpWENGpWsh~-nGBSzZd#9>YV-GxX<~27e7_J?e<bsE$!haPr4k#1C^j0S z#$qs5g+WvXh{GCExeQQKSp?7v2EePpGJ`cPZf^+ytBi=w2P0^*;IPW9D^{g8je}cV z7_d}U=%l?|#qDwARuZLCF6auYiCbZn+JtyNQp%!#$WQrEgSX@lCHuCM>5|3nc#=qt zve}iUx-FZAL6r7hGL;v0bJ+fCh?4 z&HN70zJM;a_yU*_{N1=OK)gJ51lbCdjWBO6eCyoY5CTG@5#SxxZJ)m&{r5d1KUo#a zER3b6|9o1F~EYUgZK_yKZDvL;htEhnyO!$9snb2k?a&sEl#zyn5)E1b3n4^wvzYg2$UOBdALSLBit9MGajszqLG#6{PTf)Zs}{Matn0 zxMi-$E#<0WRsMze3;EO3r$rYV5tCA+ko=DOtoWJy$JA%pv$=CcR|QyL?`h2BeMB z4rxfT9h0CGYVEsWR;YZsLe$?zc{tTIiB&3pde@|G6oe!s|3~U$dj2r>{NNJL-<*%d zo8v7a$j4elkd-qc%!!4IJ-=3rG!-KS#i})_3XFs=@cf=cI+e^Qwsb;OU=o<;=DGcH z-R=9ZuC+cfTHDL>!@vcC*2~TiUw_SyZ+QCSf@NZV#uOIl@*AC!+ zKg&Qjq4b6A-}^J{`nRsy+|mLAzxp){O}vEB1rZ(ZJ!{(ZWxE{Xc7b zCE&FB_XZx$?e~Ab@#(-5ImZ_Nkbex^8y_n^=(n@}Y;jR>BUt0#5Z_pIobrEAJmeW9_CNTe z$`S2V-WjjXoEq;fc3H`f zgXG{;%v8J);SZqvm@hH2j6yckK z6vv_Y3x7%Qf>|QX9LMTh!kV~E^b&Kg;;i6q6uCppr2-=_*7Cu*Z#$ZQukS#;Wi~J6 z_va7g&*W_&Kar>M_}`5$El=cOKCkT%_6ZY$WxsGpm=I10R#6xe4hl1ZRlu&RNi7SA zE(@r+r6iz^vM?Gd3&`bOx=s-IB@O1gtH1O5yN(h@+D|;4kDmK}rurN6#QJ0a(DH#2 zKR5Ja?}=lyW=`xPf*A&#pKPQL`>PN{Zp3SOfj2%JmwUlnwb#ba*~u&sVb^N-kDWT}>nK2+KxMOr4z;U`Jb$sxz_PkV)El0y>YpA)Uv(Y7<@t-jLCH0yudi z{g~O0n*FHRPn-R;*;mcJYW7oRKV|k6^QB3P$z1#v{9ay9;jvS&i4$W!4!0=o3FsPr zf&@B8~ilSx;XqYWV98tjbo&a#sqJ?-t*9ZUR{gRUi|<1$sG~xX7RJK z#=F_>^6DxUdZw{SVH3k9icJ$XaXdeYh#UzGdJ&sAMl_1p#IT8C(`0l*UOkFU6E-R~ zX>3y1e33r#|L14@NVWpZ8G|$NV!T1n$;zZLogH_xx`f3E0gn#whiB62q!}I_sesDJ z$nfy+EUPttmzVh#m|@u5I6b?Cn(Wd@!T)sz1GkC+ZtM>&?*9NEb$kj3NK*DuzaBpc z*GxY{5ZhZx9A3FI8!x8s-8xr#O)AwXNpdd(8MC4iM`}FPpp^Rk|%az;e<}<_!((WX(3rlw5P-&+EW6hvLPMp?D`3{ z??SA9q0R_*~m0_yj5!La{&RhmN6cI zA~;mV7L{HVCWMc10NW%C38TUTf|V1h@C@>Q#UxP^DG`sfh{s&4Qfr@2aVlyptM~~L zYFQ;upiZbCt23%~lRBi1st>4E6+cGBk5Q}e%s9y9aVFlyc9O(FE${1u-p>7<6P>3z z&ve>eB?lIAvSmX~??l~tsS_<(TIw8KhQ&vhU0&)Oy#niw2Cpu4qH8Lp&d@U5EUL|a zpON88_VTONJ-ee5b{?Uo!7}!2Wj%=%=d;;L#c=u0so1mNH~*{$kTYC}icGjH zyS|Ii-&nQ&oPZxdKCXZe)dhS<0pC%;|Dk~D>hiK~9Q%w)J<>RgNCW48MH-VHHh839)Y;IKbSEQpEDEAArz7MFL}An! zj#`2Z;V2~41Abkyv&{qnbo^;I2zq=J2P$mh$jdD*VxtrImRme4$T2`)haoM3ro_mB z2^u~^`r~}WfD^$m#5-6GVt`yFpwU;aH_Uy*7xd@4CiQPLu(|cha&BF7`70fNBfZz6 z#f$r2iYxJGvP=#YC9$H2{=)$t!72c}-NSOx)(4Q^*I;MP#d^ zY)`2w%X*oBfETWlM$s}!y0}nzh(3r*ST7Cf@PZf+NxGKLj~1XJ3<*dB(&mYLMs>8ZR1Qa|lZ*b6^AWV%Xf!KC*Cs_rUWvU5$s0 zj9;Q~ZST!j4Pb@$`~A8W954p7N7IHkJT!gxY>jmHGBLei{q)`5*rK{(+!#hcfiKNW zSnseL0AA1peu}PrfvVcyU`~4e!2Q1Qjo|M?e~6rDde`#_^{Kt#<RtP3=0nea`7Z5Hgj>~@4@ ztBb`@00RIf=S~4Dc#%2>Vjw`Rc|mk)&LOA8d4xI#qL?1Wf2I-yRw@;O#=9bMFRgRf zG!ii$jb%IUjC*Nw1yx`L@)&kYn7iw(f^l_-IvRV&-P2R|-!}t)cKyZ7p8KHXTfgf4 z^5c7s{`fEN{V{y*mbdTT`Ocr;QTvNMAKrQW>Y?$kZ8~rOP%|G-Uu}KZasa5H1W%yC zlz28im6^(&)y|ge_6Va=&&w~%Co*s5-picM*~JK}79x^r<#HHzArihI<0{2aG#f#! zi5BOd)CZW`DgLv6`hak(FBAm35?MJKJ{P(z>Im9f_@~on&1q;;7s^pa3nKf9 z)zntST1*xcpn?lf8m=WDY04$@k*s2CX(}k7j^Y>)J#n|1kyUFXz|dYjhqaS=Y;qVI z%VSdyFc{gXB>z-C)kYR7sI##p)nwD~Y=Sr5L6iXx&r2{b+k542Vfx@hFAVIZ_~rL+ zd~8Ga!JXfK{GY?qhsa{g_HzTBCBUkvuK;E#4kc}FVIH{*17K^z92Kbgjo&6 z`rHjp&L`yxB_CSSTk;_}S@LLkw_A zPR%*!+~gc`+8=O2XE+N1@Nsy?`Qkvv;O?NjNgk5za;SM8a%)mPtJu>c6#^KoB$qA7 znj3<%1{8Rad-Y@YTGWi`;bkccOL-KV*WyzE>!Tnf0h~;r$}lNWc@}3JK5R(F?Zd`& zA;YtOzL{*wA@2B3V8T?_&WD$5z7}<7)vM*~Gou&4z(h4-xo@4=c%f5&SpXJiRseeeD2a5ru%ghryZA`)Q!oSn zU12zz%i^XBZY|*A-O->J3Txb=dt7_8-@4u^cusfx)1prc7AXL=M8MLPcQe46btGiL z9nz@0q_vhbY}|MUdA_y8n629opfg58&bD_LXWKi-*=Gk=ml(4p=lchY^Zf(HqkHjx zqmLTRDdbvK*79z~ngTtG%-6szqQj}uqArV@VXD-2)T8BjP0L&41rD+2uAYy3EZ&}h z9!l(iJxEEGdQf}0=Z)^}E_(n)a;3m+tUM&2k}W{iWlDY{%%o)Ag#ad@maNKRr|C1q zafjIB>?zjHhWi{ZQfojPNKl)QD;8aUCALXz8Wz6ex>Z(6ZK2Bs#!M0lZ<}Uorf#H0 zNXy!AWipHRmytYLui=YK+{yl(A!Xt^xC^!JINSCa^fMRe7$!_Vo~&WA?{XP7E3oOo zW;r%-b5mo&Y$dam4Su&l*KnFmL=kkrqZi`d5SA0YGYf1OSOaP6YIlkFOvZ~K7nJr8!$g<>Q)i_H__r=$NzE6+%<5o_?cil&yIY`r-u_9|vb^=HUAL|f zo24E9Ft}~x%X{8g|A_95b6Q77KH2IieCtd1uS%B7Pkyp`b>$oX(0g~6U-mRFWTgek zh17o)#gvZ^2&}iMDf!TqU+uqtS&TJ!^!}cHJ=2=bvYf-{we@$D{YR zE(;RD8u<3ig!QQP*PsRba6IIct8g5NNdd@eG8whg=WMdiH57uO5TDCr;E?;2n{tzn zc2U_K&LWwoeQ4n_gxw?%<@;TxZM-K#m)Q7vCYTL70p zXur*IRi#Mt_WyQITQuD%6{jbzKX#1xsea;>?l4)ZElV5aW#O)DI$9Wb;x_maK6wP6 zJ7Qw(v6%_$W0w0s20BrkiF^Dye~m#Z#uN5zW41}>C0oX`(DMy-0-o@`=e5_bm37Gm zdIK?@i%S=#`0)lLphmr{mt%Y^I>M#iZ=L!XPuZkID2 zmoath1w-&4JOwSI5W;X)evzU<7({S#@AHjvP{ca@<_nYi(i2DJ2#F9Ru=Uuk!f1;|2hDI_W$K#;>;o?!Ep^=y3(ff&U``kk=*)nlB)&~K> z(_KE6_kp;NjT?QA^Ya{jkARDW!!+%*gDQOLFvs~AScOkLj|SN@EX7tS2Vx}O?lT5QVWO3p|Qi4 zlxJMWZl?ie?{?;cCX_udn*jC1b+%Z;UKxyfGajT)3k^&b%p*)7c>27=Vor z@6V~%D03bXkhJ4DFzTgsavicj&S?2GX=gD2SV{WLYgd^IR)Gqff3*^aU7>D#`>H^z z-VZ}~!o;VadSm*j9w^bJ`ulV(xcXE0vPWEGWExXTsAERf(Gm0hUm=#a|2_i_0t)&s z{H?0fdnbK*mlr_;B7Yf|85g7ppbe;?;)2MiYP(m&r{D<)eQ&$0~Ui}-k8%%D`roBCJ!Kg1kiTI(9z8mU8D1X;8?(T z%k(+z^AxvhJ_hKk0N$E@;rzfOxic*M0f1`x+4IhsGv)W~xqpDV3Q)dsPJ8D(#GnCi z1b}$X?1g8~w)b2JRO|;vcFmm8e%8UjU#|hkJODK_XU=HXK2AdbITb+O%sKNfKA`n4 z1=w1ETr+#_^!97k-01|U8oU0iB~20z|4W;88KeAr<@!Spoio)?e@LxS%N6%W#@->07(Sc6~Y(2SMVOv zbCP_(62PVjtNF~p3ZUPw{@sYr_#d&7Qc_B;r4P}E*i}M{(4tTu_jl&Wf6A!xXVo_K z1Dd~RFOmN~)qbjbKS!1Ge9rT^e>HT8B}Voue_>lZ?cef0 z$57{!u9w}ndFFq6=6eVFZuQss4+p*vy&ZZxFE=kY?}5ArA}s)@OjE#;rKSY}b^wSY z00DXgP>5obp%T>?fKzZP#$p1dVixA%A}qwExEyP-j$OfL2LTiyj#5;}t%u@NoQCn3 zigwJ#1t+$a{`w#MO_!!0S^Fz|^KUL;56(F*|NqgJwhDiHNb#{Ui3xkKHGA*p!XA8< z%|9ya!SmVt&R>5Psr?W7cCWAp&B7ks_e}RJ=mBn^Lw@k zd$3a2gVX=RdFV@5342hS9m5sb_r5Fa!R5jpOc3_q>ErI%ChUP#*n`=^9^Az5J8t~1 z345?w*n@w`zqA`5>_Kg|?$+%1`_fyuaKj|dQGy1bKHQPb6WDN7Hcyd@`Pn=}5>?r} za9kS&9PniGN_YS?U@jKm0?fh;T!7Os0~cW|PRD38;S3qqiCLJ7^ASJ|N>GPtjF!uD zF&_&t4>QpJq^AV3&*9uV8nZAR7ho&^9y4$b7GO5oalvog`!E8iKp84f zg8-T^6EhI_mp2FGyDz{z8Mb47wyz}!U@&H5HUb!rSvUtXF&~|BX$CswH(iJsI7@Ds z1FifSff<;F3$lG5BfsH%G#!1{sc6SSxwrEXz--LLIr8WNn2x!ahlTPeGVcl;9RXkK z0Yra~mio!EV7$DB=V2xS7=d=2FF#{C&datPiMg05&-w@~z*+L_WyZzlVwOCX*}vJJ zv*q~+UR2|V-{wk z6D7%p<_S&7#Grxo1Nzt1_N%U{tSB!lEh&!2iV6$zqmjIDC>ZejydJm9>9E_Z7PHAH z8gg^=I;}>nQYr*S3F3|6VQqm_v@In>!y`r%^K!U7kcze+hiFR$+5@R!C$>oi+T?#` zffHLM+XJbyPimRWv`ijtNyI=s>Wkxn#&96DXJ|N(CX>cBhXbhsU7RSj3owgy|Fhg4$#|EvgA>5!Vjw59c z&)Y!kgNU4=_Qw7jDAYN{@y3)ZJhXo?hq{Bomg0DdG)xaq zOCdZYWr)d5&>+7irEEy4LR zSSs1Rd_-}4)aijK%_(|qOLK}`+fp14@R9IQWyUun+{iI)=LS-m@R0D#rRTP_2U4!3 zDU4qj>~gu1Tcmw(H3pV8HHU+#gge~QKGd_pf~DgZZgeIC&J$~j;~PX{W@0zw8nPLE z&heQUN9*LA+??k|jXyfGg!g|ad`c?WmI_P{q%giYoT8Ch4rbJ1>GWE6kY6pNI6f+M z*0|=zSt(6J+fuPV$MgGBiij8vEIou2X$yCMb0Vfai%~|zL*QA?Cr4Q=McVuFsaPyk zRK!_C)sRy15e$;c)y44(({xsNo)}2eS&e}d#x|!&drSXPM{ztD zJgzxY4q%$Q3(3-0ONzGfnjL*L)(O03abL~R+uOpy;`k=n0I{aj(WCziqRremvww=% z{!R6aO#P_S!=uJcY7R6mZOhK>sHPK2nfltJb=h3X+|bP2G@GMtCfBA+4O5Ob=7nZ` zN{FO{h*DSU50jY1`8Fw6u6yI3R|XZedXtT{^F^t&gH< zY3nj~YS{9Yl-M?t^e>KYpct|tOl}yrAxUmHeNyul5eVGS)ZBkX32kT_(y}3s+%T?r zO8`j9Sjw>+$qNBqz$h|md~+97%kAA;lE7lQR*(^Ld3u^a#;N;o1k=+rgA+3^ipnoa zf?|4F$kZhJS__z-R%dXFGp!4yGpgQ5w$*;I90DwBR7JA_@*H2j{_(|3f&@hZAWNI>t^(lTj{boVdT>Oto1d0r}) z=Aa1^(1r!L42!TB_hJuep#$l5X$g#I#tbaNlh{pS0)#f0Fdh?d4er1eJcHNp9zG+4 z7)SwGOx`4KDbTaCcc*lUG);e+i$3{?3ww#0RFVE9NvF@8r+Wuu^v0|I^Mv$_#VB45hsa}31kYnoLoz8B)5k*u6EO`7aW%H#MeM;I{0X1qAA}G_w8TWbBtXJsJUN{#AdiuC1^6X-(oSgN0@&oJl?aZ*V^0F`(3XjJu0Q7=cQL=`qrQp4VZvd%tNP4vCY_q z7qB0H!y!V5lK4ph89_#o3FHp)7}-mXP*63!f<8tiHju4iy9B3jNAGF9b9(RS-6&N_ zqd~x+fD=`yLVwg_0$R|Ct8f$U$0K+Y8}TaM!MDUge58z=Le766&7_UYBy-6;(m^gI zmyv79!(tLV*i6WvMQq5B!w>8zP`uuIv^Y!iE(eJO}S zTqqMp3vI$e;SvQDOlecUdc=NYPS3QSyLz7QE$JQFdtUFd-e-H?>HSpFN!z8*phOw! z(Smc(iOaDF*WrIg+=qwp2;RXb_yS+!d;EYygb@vK5g+l(bZa1|kkRA}GLf{9v&q?H zCOMZZAdAVPq>DU7c93VuF0z~anS4aPql8*%2`!-m=s-Gwo=vZ!chN^_ioQ?Zr-$gz zEXv}nf>p9Xtc`WB>)8$LW_COKh9fKhHXCa(mNNDg{WGm6m(#=K57bMZrH81Ojb&qL104WLwqXS3z@l2C z3@U@v0#Vh*pF!`W#cZMwWqQp2Wxat;qSw(jJVc(tVLF10Cl|6kbS<6A)(ESGLF8R5 zqR$GTIplvw48~wGh&)W*L+^h+1JETTVyP4^fBNxS2f5UZvYGn{Fe&#}BAQ zFS&q>C3mxOTtPa}ggTr{Z$XI8qaj>|3HUp?idcW~E)J7NNgh2L0?VP(@fK}CJzgg! zT0*Ws73N?WS&BI6Av^FYy$LmB27Bg+v!{TPBi&>J8-Wevu&_(mMFkut&r&ZbBWjYw zC%7MLFaa+j$f9@{wNTJF7+TSWQ(>fs$YpdkW|2GC-^hb>Fveg8>!icTZM}zt!K@O4 zv6X)~NrSRZ4Mn}eD^v+q;R_7HIXq6IoGI*8T*dS3O?FUfk%GNb6}i11;S#)$5%`cS z!$yq22gF9sB;y2$juIs43_MEL3m-{#q9;MTA(fF+dN-4Lk|za7homFpa2?L%aYbR7 zaILUFxD1dE<5FCQ)wm1K;cYwsAM#O$Q_+8fDVT;?a*T^dt!gm{LohTO={f_G(1x>c zHqJ)}F2+503>%QdC``ban1-`)E;`VOi*PBfz*V>&%W)HK!$Ww3K0@zfL3#syfnG>w z;RAfYUSdgd2Hp~u2#at!@-U8=F$?`r4?mV;x%4I`p%89jAXQkz`Cj^3dPn+W&uf2p z2oGU3Rx5|#Yh?opFoygnxQJpanxq|UN7sbPWSZ^h>Mti7bMq<|^Hi53r(K%L#Nbl4 z1M}DptYJ&YzGo-hm2h**RN&UkYd}ggKfj>Y@3YPiWJ+59c(LJ zXImj4!O|e?N%llnoIT0D!zXk>|z@sv5lbYCbkSg_}Q7+bZRzT$(ErAezq!` zu3*c$2KWtwHEbCOzGKTEv1Opr4t96f@G%uz1kDW_vuBO>s#F>Iuqp2kj*)6s0WoSw=?!T~=U#TsFPpN(Y0RkS>P>eiq24e!2`k_?eF`>+<=NgEe#$#?nn_qnj{~Zo*=^sY_up47Si^;B8Ck zGK`_iFqJODqF-?L{eoLhmqCq0rY5PQ37TMI=ols>)2wh~eSL+TR@P)vk2jO*T@{AG z7qCJsVuiSm6@tOQ3Q>Q`3XwQk^0PuvtY`Vy&hqgZ%g0`pFHd+r#{5#6%JQ+2<>Nk< zFSk<4?Y?9AkXSw#=KhjfbW$6Ie7FCXQt5F|;n)I{vI0zH1z7Y;emyII0()73%wqX+ z{a99jm8<~UvvnbvnL{#jhA@VOe(7x~3&|zUC?WV+sEcY0X}W)`i}W`PPSE8TLznYP zx&ozi1rl@x7bTQ0VuK7zv-#yHrOVNG$I4&I>*;bR*%r2i6|zE>&+=ITD_|iOVnG&U z0Ty6>=4U?UqpRpDx{|J>H_{vF3c7+Wr_1Rwx-4l~AKM*7zFRETyeP8wZ>h0C4 zZM2=X(>B_c)WUye17I?$U4um`U^Nl$@8R1sNoHUu1w8wHjjODC~<(v`Asfp!O$8suTIfb#D!A8#;0myqf(l&lbbgXa$`%XHkP6{qzRgu(?sH^ zYu!AUwgrU5uU+BJrY$Y}p5_e#S+Sx8whI%EglUkmZrIRY0c}|rJ9ar@#}`ulV&2qk zqfT#5J>qRiRq%}DZ5fpo2#>vOp|!N8ap)G>k0*aE&0DmKX>H?pj@K?8+H$NN0<^Yq z=oSQdBDX_;w?p8hc0SsVw~O#3)6OTi^PSLc!@ywU&<(+0Uz>q)n}H{`Ip@SS=g4i& z$+lscHo@cCsP-W!w+X8D{Yx9)f6ylKt8I>(%^5>t|K=iFFp|8pq2Ur9xNHkI&S(oa zwxxfTT{zRh0|$XEXdv%oW17*nY13!&w0%aJyc3==G}RCu8rU%Ml7FpFUBatJhKFvz zC5=tZ8!k!C7}_;5IkGX_KD1@y@b;p0C%kS+-|IFMwg1Y)+WEtZ_`8O$`<3c-ym~l) z*E;^Lb^Kk!lf&hA$y`6Sd4n25S{kNg(v5#qr!_S+x4DBYLu}%_K{7WF2s*BCZx#67 zzb@92(uaqna>7I8s^Y=LgL#zzxhj{(r?XX#D+UDJTge}@RbqHZ$`~F3N8_xajkAV! zc4jmG;lECP%|EmAOgWYRb!Q ze8^PoTmb&O`5YX3{L$Qk`JJ7l^LREu=gAl6jTkbY&IRaPKw>fQh6}Qc(@A0^)=4_S zJDGioy#LGyzZ8rSN(dZ^Z*)8GlUjlrN~sqbXrvx!WvGKr>VY15sRudGOGl849O(!Q zG8B<39f1)B=`c((G((gQ!vdpp7*>B6rGLT(lk`v6VV3?02Q1RhaKa}243`YuuuDI~ z1H1GSyl_ZA!3U@G6Z|p^z%Bg)K^cbNk^X@&ywZ=zlVL=LQTU`Ekq^Ig2n8}ML{K_} zA_S#_h#@2$L>yu1Ac|#Jf;{Q(C`Cm2JIZ8Oj;Qo^R3Kma0hK6{en1ss(hq;AMoju1 zHHb^!qaTW;?@=qmI+REU&|iiFP%0fjJ<6p67>IJ|I}AdF^c@nYl)gg}mD0Buj4J6{ z3_-Q@EgEDv6g5&e8qrVc#xT@M-58EKsT(6uCw+rc&|mrnBQZew2BR=Q`WmOAUiuoN zWq29}Nnc|O64F-~E5mU}N?(6rJO)c&;dBg^{)Q$Dk^Y7WGCTu~(wCTs;nJ6AmSGD< zNMB+SPLaOAWEoDuNa+i-%J58#l0L^&oGN{eHjI`&M>|fFKEpJOkv_w88J>l)(r1`~ zangRAEyHs#UfPeDGMt4b>905!6QsZ5JQ>c$8PcbigNf3oIA4Zy(JX&`ig{?3K0yas zq)%`GCQF~76O*NVn2#yaJ}f}1v=0}`@FJWk?Zw4tllEdE+NHg?1kQ zCH)1LV}|q>T!9(V$5@23rH`=~=SUypN*P{-nbJqNT87u)T$#6O5N*`ba=1K44Ms!H;V22JDE2Ot^ zuMF?QBIzxx#g)=q_?--YkE^7&a6hh=-oyhkd=S@2Z{i^t{s9lyN`J;5ah>#MJdEq5 zKjW8vSpzf<;RzW&iJPQ9A&u42pRkv}Sp!gizms-hH-0a@j8|p22M6~v>!s)M7j#L_V=p#J&to4pNzdaGY?hwGr!xF2o{*lyei?p-C#7fcInvU9 zv-m=WUt){21AoIdX$QWN;n#Rd+JSHIl(Ze)cv{+yZ}E(@9pB0D0Jcld;Ct+lp1}`z zR(b}1$8*xtI4HwIcwTxMKVql!H2#5|(o^^eFGx?}XS^&ug@4NMFm_4Xa72bZctzTV zUhI~(LXzR}GF>anbnX9>GQHrxGX1}QGX1|Y{r`tdzvI6${l7B(|0tRMf0La)^nWPR zNBvi(|67^f@n4z#UpxKZ%Ji-ON6B=`_hyB26g)Pg!mtfWRhsBGQ38d)GYnd#B2Dy9 zFh*S(6~{e6;8c&f)Db&PJXk-vr~WkY$NJG?PdyU#J@x!kURG%g8Y4kt@EieuM*?ie zk)#5L5fFBO(AM4~Y`yRW+!&k8FVq)_RAJ9GYfUz#QX$%HX6qocVzfqMUYnZ-h@fzK zUfD_%a1iIU{Ee-ndk)r%-Qs>E>J#-wQ(Yb5puCK0u>`TAUwQ+58CXP&Qra+-4Wkv}HM51oXP@nN0AsMWvHn||QI-t;cL*67rQ z$jDw0QrvrlF3R?{P(w8?Cw006-eZkPX}5_ArCBjrtF;c|{WZW33YYhRtz>jxe}Clt z-Cr+u%iTSpw-!oO%5W%JUDdC~R9!{$qt#V4l@)fI$wn9bYHz>q?3H?d*M;;>qgKC* zjCkNdGU64z*67fMdY|CEjrG1o-ykK>pfc%r4u8fz9Dsl)1oC(KEdFdz`BhZ)6uARh z%pqPlV&adj`+N4Iv|H{_kYu|j;Etrq|fiAlEVi0^TO=Mpw=0L=pWPgpuMw}W}i#p9P za*AfM<~+@X>^cq6rOC^inQjm! zYtp1EsU?%uPnR;n-ZiGlwhd1?V&cKpp6-L)*|BuAwvwZRsmZW^1l!j$#ppIVwe)_S zCD-Uw3ia*+Oodz8!K9fFWUn=-%pHi}Jqls$6Tcsbsq=Q|>>cYVq=?4@@ z2azxR12*X&uuA`U!jr4XRp-*J(oYbjAG*A`#r%#U>4#*vP~pk-=Y~vk)IN_1B_v;w z6AI@B2b$so6()s$BF8llY5M9D<#_{hon^n7kw}Q$Vz;TT&S6DTAdcBLg{gP-9ES9EhzJ&1<}H2QB+Xs^jf_}uhy&d3MGq% zjCn}}%&sJfDI-Y~3#CaCHUyKz?F=SKR3A^GgvOI{aG1z{q1vLNqN3Q9sLfua_V}w| zN^{a`^qHLri_d6J7&)-{e5OPwEgeoKeWpad#bZq5TijwI-{LeR@-6nXDl1IY?8_@>+%@v*5^tlye&vk2 zMqO3n8!FnG8j73+b;DPzZHPGv>P9SIOFw+Q_xpP<8&DlwJ@Aaq*NMpUq1E+gEV^jV zz_2siyKl#qi~ck)Y(jy$pvdGHG9e~IHQh=dhJt+bBvB|Rc}A^x zn(T*v20D@hLMCt0Xta7)n*6+p_X*p`WavQ2+Vj}i#_|rZX)&!G}VWoTHK^!W2k4qGG;wFVtY zn8U^-vHLAaV#>25NtV^Fyb`ThzCs7-h_&>83(8W^X0-;Z^ZE^<)m71ONU2h0MP+s| zE0rp!dg!$dv&nJfErK69n*5Jndj2C$rA99r?X$MD-}7m7@`b(cZEXtrTrS^&%Rc{h z?#wX-vmd&m)uGbb#j*#^{9tMS_RjgeAN>vl&r6>QM4><}F>ah)OOTd+NLE%1b2*?0d*Jj13ZijmnoQmp2$~zjQ0ffrnmy`J~QSSE*3ue6y7-&d>sh1mWUh|Nhg&&rNlu zqs8un-QWc2*>9>V?KYa~xac69$xQY-V@7~@s;cuMW{aSRRE3kotgt3YUUf7{EP^Qs z$Yi&Et_q{reK3cVT+U;LVDHBbi!_fKU zyiu!8x0_84vUKv9tLm#P8oO99aKiR$nr;KZPEIZ13&io4WJu@MctV;&XMcyHxbW1% zsfFhk-ch*A`Jv-$huXk#y(K%8YrrWYAd}Kg>?4j2*^2+yfpdvNzqvx5wv}T$U8=egY`Z2Vs}q# zh6vm^Dedm*7C9kgwQuU9fy3cZXgms6k~lQ3BylUfN#a!7kIg@7Ni5cX+Chwc{LZbI zljc7h%B%@vFw=r88hOLOd*42=>7w&bOGX`{(R_Q?%{v}ieD&3V9FvWXkHU%+g^f6KNYJzTGbtvR@R~8$} z{AIK(R#oLKrfNkEAzrn~X^k0;US~9pLa~347RDkGZ#)!^I;#-Livmtcq8caFsH-By zktpI~d~BS>`FzLo^1>idF%*S6;HG2UYu&HA_qh+a74GrIfJh)N7FUS}L_u^`|G0&( zBbgK(^`m=QJG#XzJ-X|~dTtc=)E}e8$+M5+snGf>L?E098Od`Z3Htqe8r)3+@)Uo% z`)FX$`Pe;t;(IPXkqGuoK0|>V?XQyn1dFA;!nMLW)RSnkc6s2g04)_0;uw*gq92xb zhOSkAM&3iZhw`3MZq;jquss~r=ZB+tHF?S!)U85Y9lSNwrCeZD8Y)OdO-V&XX^FR5 ztM=!M#b)BOI|hLi*A)4^A`80fqcwk}(VDZXs|9l~lFQs_GAkLdSj@C2B4~VPmy{Iy z2!U%*e$=4$tEt*K@cOxqbe}XE-QDNnbFZ7*eBBAI(@OWty3Jm9)Cq4#~ zN@#U;m5FP?tSQ)Mnq&+RtJNY@R@C(CTVRTeu_%HvuE7c zdf}aK{1_-8{p@D5gV@bEHWhye&I5$G!fG^-=aPEU?`)5kZnSML6||zPW^!W2oE*{U z)w%+_oGW^XHx~4I13|AVULm7UN=geWOG_&%z47`X93>hO{sc|L8WM>i4c>YUlOLsw zQKgbmuf}PX%eF$3&1N=vow11g976#qh~*U&MDo0`0o5GUfLc-;tEzvkt*-J82#0(i zMB}W8#^bR-)D?-wVlH#k<)rlk257Y!b)_$_%9q!W^!TgpYgpevS2pZzpbcrdE$MDF z`GP^CuZ$+?D$2&t*C{p7sdO%7^eMUxL-}zr$liEs2UmG~8OQ2nXMwNS`b2%V$k8(7 zEX1Yk$*l6LrQa_6ySsl*eugXo8u+QcQfWt0W3VJ_NrNR(nwEAvnQKnilDXzYOm--P z#>!ul6E&56hKn)yFPM|=U|09NDU0jgkK|=v<#)OKKg$w?7SHp!oc^CVrfOfFB zt?BihAVTc2AU~CC>dPOo_0@y$-;-c}6IR2Icaz1XLWv@*59EIYECFk&r_?t{QK>Jp zlvxv=gzq#(gFb0VT1R=tc*ppx{A}+7Nu9n%)awnRSL5`{Wls$}9zVR!j4h;7)MRZT zhl!W-tu;og)nxQK{86VV>U2;VRU4ujjam)jGma67=nO31>o{ryajJKV-JI&({|PC7 zjanzk>tNr~&Z2+mO&QVLGh1H0f!=*QrMJk|?x16nb!;+a=?e(W!fFIDJ6UVgt-6|hgo~1n%g5Zs&jJ_!=ND=R~W=+HaSBNE<7#(`gto7iTcretjF}vzi6fM zGGYuGf6D^M8u4$_64|M3;{$m4WqDAa^$muc#+jt|%#(ixL{I_g^z)w(Ql z*&Z|7?H04wmFMH-P_WV)4Ens@JU1mK;`6vI9*>*2VU9&35nnVfkEZD*Pq-~nw~Knx z^pd2O=(K-YqV{@xBu(N;HxN%ostxfm@u~5-@s;ttab?_9LYdFx=FQEfsph%nmF5Fx z!C)q4XL0}Yj;f*#Zl8%6+d5W1TKqi2V)a=Ts~7vs?7HhqVmwY|AZklNf>?~61hI(j z1hl~*UMv9FlwN9y3yOn=#b)g~OoNrYrtxh7S&4wHSDtkoG7$aJi z8{xYG0hD1a6u8I|Q8_od8ZL2U;-=j7PIM=_<&cM+JDMHx)ygk)w6-=(Y2IwpdW;EE zTKaLL$Cwb)(oY*rj)W~O{glkLxDz&q&6{v=ph-*nHX59~>MNcq($YIe%Q_P;KgWMl zO*S?2G{=~*^7}IB!DOypOjrXsra@+3j%g4{OJ8m@I}Dl2RzRTbr7P75k4Ov20?zFV@pcQ>itz2w^^6TW?V z!(pO&@ab>qus`;GvX-=vTw);2YkPk`eRvNU*1PMYuX^7ljhweO0>WfrHNq&yfuuul z32v1SezV);kGQMdjqWWmZILNIEq$957r3r*(R_80`exUye%hx~Vp*N?>pG;|8q4aC zxU50K@I_39yhI+&%X4Vd>cWV@Lp-k1V&XH3&XOM&9$ox>PBr(bxew3^d4+%HC3U7m zUQ%O7R?@7rWw@B9;2^s7t8T@|TynVU|(c+m8F`Mh(_`59p~iqVh!ZVQ6a z&g5x<;Gmer?ie(=`t0%rt8;ye3GlVe12el{Nm~r)ejauQvO=>ZU38rz0tRe zzl$0TQB8THe^~J1__h9}@tgd=_dgncIj}4Ec`V1bP5KEM7=D#Tl_$_>z%d&614Xf* zGE^K7`%6$0bvjK^2Q7xLw1iK437_$j61Af+94#v1c7T5?y#&Q{Z8Coc=tq2FWyFIh ziKa>G=0%>B9_mSxf+YXS%-GP{(CeWCAt98e-lV~p6iKOgK%}CxcI511zDLFh+~2yt zRg^tJd1pkH_;Pp+u^1Z~imW7mJbCG)e4Vzb%%tU?;ik5nFInF$%`zxFteIdadt*WNv8@roob z&Aa>2xxI%zJAdQ2hZpwlrrO?-Co;}UmruH{deGfJ$gxrTGu2IFXV*5}0fH^kUcn-) z!%%#hEE-sOs(VajYvo0@>ulG%mbjPK-8n>iN?_Pv%30#!!GC`o^0xhR`yso^%?D|A z)bJ4L)L61`-~gAyps;}S%dIF2vyv)94wzBrjMmpz86yq4fJQT9f^L~mvMj$U5^P`s z%~uCCxlwgnzsOYITp#thhFK!X@@P1k96YyhQQ^wM`wG_=Dhi#A_iQEpV-d2^`@6fv z?#%vZ4-c?pw!44C?wHtPlw;T2t+Z$3rm~A!UdA`12$$oeZ;#+O=g(^KQ6A~aMoX<( z*S#vc6O@UW=0}f)QQ6HIm1?pR#r@YTd!XdhwzD4{JhA2T=Rdrf&u*q>+r9TbIjphl zjyI-Ed2?M#806tZddKH-xSOt9*Y1KGm<2ZtZ@{*liPTgPYbL<76`W6s;;qTVHP8V14X z(q7>*VKvG~Xd68I(3bR5mtXYo4O6%DQ!;dsd%yB?&sYAR=^^DI_fP)A0ga9dO5)b} zuXV3cDoqaA4~A8=QfsBtYIQihrlPWp@mfrZ3sHYuTn2BEQJe9y3pF`8T8-CO80O{S z(aI2K4sT&uw5TW?Ei80IP1>l*NWBq36AJnWnTwU628_W}zO7y1botckF`B8Gxtc|q zl^TV{S$>@T*(ygtIM=pjk31Z2c>ZrWtMYEOEL>_yX2PS@$3jwlo~6Ymi;$D-N!Iht zALbc7e#vm3D_8H!SdVL-x$5*K=d6(hOHIaYm+o={8Gm^Y=y^@p(;G$(ayF?Z6P-|6 zn%PS~!QB#WJ$%3X)K9GkrEbFMf?MV`R0pU z7rGZ)u63=p-0FH%wbt^0>+#afs;6={ST?z~_;%+WEVpWjlN1qlm+=-Cy|iR$$(oW! zavv>up@01C^3TfE1)(&3Jn4#*1|yMBFjQdjn(c)(LDUoyR;ky-Ytm$2auT_r0NTnR z(`kY{{x~nr;)MhB`U1<{V$iGN6*&k5g2^0P!Vn~-!9;LOaBA?r;QHY9;NGA*=&H4^ zEDI`m{aodJ%I(U%N65`y>0_?SI3V#fztH2xvsRHh22n zV}I}Kn#b4d3j?k><;inSyXb;B+omtP>(05CJYf)TXgs@4>o6I$23OHN(|g{MHP7#j z;+O&BPn|h&Dz{yVrM<#L;R|?BK=L-^m^rOrgJrRaev;@j$fI_7U-Z2BV(+2ncJ>~4@j)(zg+X%o;N|;1 z{`kK8KK_`WNs#smqu62;;lSpgR)1&Uj>(V7xXzGx$@)>`{rr9YeZj9IU*)UvtogQ~ zfzgrC`4a-IkxBXI8qRgjiY#&JZQL#CG+SECXIRgRoSpxpOQCc*MXRe&EHp)2OT{(f zZH`-A4_Y5|>TThu$!Ks|+yqRW>-5+&76fiE1`AcXje^qidwVdf%N?L@S%2#%tNc6s z)bEO0f>BQ7wNYY-`lG9&Eb5HyJdVyCBqm3pTRTP{%p5%EPIT|j#-1}9+;y2#GUa99 z@|1MQW?G+}pgi7AkXJ(AIk9jE)m5mhU@!0pKCzpPcB))|%eLpRoBz-<#TC+C;ZgpJSt!CM zPn=RTvxssd`|)Hh6hu)f+u0$t&%sfmyVUM>JM1B!))p$zv})62`o@Bw-o}?hAQZIt zpx0Sc{Oj6wzb3Gl|CSUXu6QK4SR`VaEZ-O_TAZ0A@yCwr{BR?gZ-0~|xRJbH?B0Kn zuY=!KN9ARsQnu_O*qEy}skw+bwl21yNcyHLV9DnyJ1Tv#F|5vW9+go?&4+MxMs>+i zd3zr#n~!5Q63sW8uO#IzPHiF3)@K*4y5D@3vdt6TUb+hs%~fyu5JVMHlbA zGVbVqWKl)2c{34AG!bP z_{{%LTaMFHyzLD-z{ZrhN{Bzy2{a3h`yYKYe>3dRPSYX@g*~xaAc6oOBl51qnrsl?JELC{|1)?p;q3W$)jw zT=w{5D|pQFU4KBBBz%D?>`q3K`mu_|imUZkmao-!={Lomi@g=o+SLY){$)`NX{t(4 zPRi3%cmfEOP_-gWl1UdKA$49s2$9yppcgO&oF&B$rADm{rOEQ7wgzz$aJ?q8=B>$` zQftyW&-%JmusW+3Y$2~^xAjKLTdVcr=dyuX&)v74{eQBy#0l}z*5d=G4GWXGMKQOh z$P@P?<}UOT{^jE|u$%(-WK#t$jh`QXnp7e zi`snq%=0fIOJqTt(=)u!z@=L_KQ21=ZkyU>GTE7ZcH<)X$OI@Z@4Z5}f-OcqDv2*y z-e{R;p?@C*-;8_{+#fj{Jea3EuW(NB^wQ~-m*iYl*ipH>aB<~5g*R0`TDZ1yt1p+T zxipw23kZ!uq1J>be6eyzK(q&pMlsiSb9peJjRkRYRHYt3l|)Gjya5u>YDLXjO-jQI z8g8<#*Sw}tXk67L!NuWK;kDsZSlAwZExa#$Ab%``omEBcCorolEqKhjr=E+8?!WZ}VQOm8hm66A)7Z7^p3ja)jc=gvS$wn|J{3G zj_?I)$py*cJ6(qZR3KJzmU4k|6}g43B@fUP*+{hyDj!m9QfyYesCrMe*QIi)jdodX z8!UbcwM=nXEOtl8SXe3>Jn<=I@px%js1#7tX5@Vi$(bU%BOx(kzv?1Wvi6sYdjm8a z^~Sp4?R`>TKBgeAsI17BVaC1QKw`8oJmW=nFIn{K`Mm@T8Gj^=%w}LBV{Mef(Pg^qOOuy6V@BNOe zk29}cFlBJ*?BjRW<&`ab(Q|m>@Wz#6dj4^A{j$lI6bCNq`KAw%F_l31uc8Y!g%J!M zEJ_xIoPQP0q;tG;x^uqs8mG#fBQ{$sp&X@N)2vX0^fr(4R;xASVK2}$x#bCuGDoik z*+#enNy)xst{^A^)-e`haeBusI<^@m_Q+JKPyE<@(#8;uKc8R?SDXK3&nr6tbk${x z$Vfi!9*6AWjXdOYyZj2{`|tOTJMzPElFDRuaDSP<4G=8C7jU38SvAetX}#LY3>tki zm+@4sXyy{#6n0rW5=71MhF2sy~hh zApHMX5Vo_$7)Fbd^@e_i+T1!re?z@tpdo2!Ff?jRQGJbmle;S}HL40vqpHy}L8T~D_Zuj$zPkZmmlrldVu*%@`9dMTFBGXM%OESoN?JLrw6e0SG*mMz$&oYmHjsv4 ziH3$`B2-+e^hHaG3%njBQ5E$|4!|&FQGbxRf*K7|^{c6gM6BAJ+<@Jd^jDYJ7Tc)p zNYv{K&K7j(D&&R(~`(x}BcgUhNB& zndU6FN~hNDCk2WkKYwxP zU0f=}NKCBHoGL|YD@LW<$But!rEeif-$EsQ0HyQ+i1cQkt{@%qM!kynz%@udGiGz~ zEtDNyHrJrcvF}#1RrY{otMiyZ2^%v9Qco-&Cs|JRxxPGa_TXv3+RpxyYlh2b;ntj1 zS#tK^VRCj%d2xJTgN*)E-l3DTY=7E>&c#A}kXXocvJNupGCC-iNx?l_T){zV;4 zY`(FjZA|TCnIArpH*~L>bNVG6$7`c3uPkaATIgGLO3!!4w0}{{r485ie18&yfZ`@; zuTakxLkBw_5OXw^HUqY=l_!24(jQlGOUXw1Nvgk|+9S1gx z(LTt+f!SiP@D@9hCW9rR)#}BBnghxV{(924MSApVA%8s9(&tYd@0Hf~c0aeX_giAx z`5ZA%_+;(cPxyzd-_d)37`O8;LLGSa-oNa<=k9%bd8DiN3VHQLP)>@IiE^!>E?;Y? zt1cc#CeYTLv&alOLwR1#d~#{g1tq%YmH(@;YY%R#I`ik;homd%O85QJ>*`+Fk|W!) zWf{v{6Mx+Z^C&5HN^uDdf;LNu6WU44!fqBwf$5ZlLZRIdHr{S$(kU%1Nu9Kb8-}~jk(!)vtNGo)xYLe_o-9eUDGo) zHQh7!p6l>Ul((J7>omMP0nv*uw^ArK%f!*)q<~4Nb7?WjZnp2_bP^DB614j=d-L?x z*iRfZ^N;BF)aBQ{s$f?*Xu)-bokKuG0rgX=C{2=yE*pT_OQf(F$2A)Xk&SgdP1hiD z#RX={4rr3M~ZF=3vzScy9ho09)a?&h26)z%KW?ce^(Q0 zRFE90B_$9)Y z%yJ&Fy2rFcvY+=RR9Lc}h@ ze0xK~yUS%B_7nbj z*#EmH+wAUF)Z@CRbW9e{relV0rekXIQg;rBZ>#941K`bN@6;esEL6=i6;QHIt zzczQ&d2thgB;MWpt^CtHeP7aNrH-Qun&bhyX<^BNOAH6lp+V8xI~S(B+MMn7!)(#; z5;bd9THD#uR2G~F@}|D5-8dD1X+x!jGH zeLFsaNA2;HwOBuyt`qZx%%ej_jzbn#NtL5rTr50tenyb~g8W?#VHtWO?U_L6+^++u z@(jIlI&*++(kvHN$DQ`eU#o1)(E1UJTDkX4ASX;xM-{T7wBlQBL+|C{usYHxid}U9 zh#IzBM_BdyJnbb93ntW$PRxv6u!BjuNB6bb2I!*mNc^Jqfy!MI$G3WN9YqrPlAw`vLU$$#Hpr;G3Ua zVt+W4;s_>OsZmX?RsU#TlaeyvOfNpqkKIVoWdNKD%Sp;xq1k$JeXUXw2{{fX_PlNb z2aDkC!XLzBNE0sOf_OZH9~{T4;MA|?afk8+%ZlLY=e~Ed-%UJVY`xEN=8Fzcf?b)|NiZ9 zN#Sx`4{lxup-lkX1Q;i!dBFEc?URw;nm7;2P%(SU{T>5FH2en60FSW zcIZ|K9Z$^(YwjQX#>;dS6DbZ*#fZlHVkH$v(`3j_3mKxZg>u3ZCA_j=$berulJ-25wi{^%>^RLKBPbpny5xs^5VpykH@QI)VNVQtwvbaTuvyk}&9~b~_hDTl_Y5gvHTi~{^{6Se!IO#4 zL3|bl-$yXmY0FCD@P29%l_a)5nkgJ1BB+FB!-Qr#K`3jaNo!!iB81sDWdijRJj2Sd zt%EwLe(uxqQDdow0-A2${L{ps_#iPkSuc>9<<^)lF-`I4_X)PpIh#={L*ZQia;G(_ z6^NP%O;Hq{L3NoCGU9YDZNFS?7Vhpe9JfSpH#Z}Fs52D+LfioczAt0d$p_@L|0GzP z!8Vc_Yh6JR{I~XpHRu)?BNA8O=4H6=WP{LB2ko(1J7_GU_7T{?e6Ly9_Bu2n-VUqWhdyvzH_fO$Yi=kzvRK7zw!QZ}l2^1yq97 z1qC`&+6Mi3AjAGpkc1&q)6dmkF5z8Thxc&a;r$f8=p8yc4ZVKSuF844U_C@+C@UuOWvQ}m2 zsxzg=JT{_Km$J#G41KMEtLY)0O&m8(Ua7J{nzg|sq`4!g+(8f$5i2i`(IHPU1%_J1 z;4^;%MPYc=H>4XFBH>7LHowUZ1~-w2qd(g07v-p9IA2yyB9 z235DO0B5V)#{K2ro!8T@Y13%7e=Zy?+vIiGf@@^)#owYTd-pDU6j zgKAiWYV8}Ce4%i`+nxr>h!U)giVOg+S6H`->rOIXdLKzc^s9e5Vq@bcn+SLB72&IP zFZFyQE$&8E!0e^EqMKmusYj8U!r%P z1xQee@*(5D+&V{a`$j!KjfC{p-6=To^^oH1Gx%o0aZ9w_I~iU@|9z*wsJ)5%_cfBh zy~8h&2W{-7;XwCmbT>F4N{p7YCCO-@nKElsy3UH%1=6QJ2ETioo)k)*9w|uULDDbH z1{t|U$d=|tZRn^xQ`t~=y7hOTx8=FIF92ONLx)fM^7@*^@TGLz&xub(Ex?!$8nTu; z$HTuvF47TF4_iM<-#AsGtZ3X8*@rj3r2)5-1~0zSS)tSUF3cQ?9#R6P+1{x1hZKhV zB2+kKFf*+{)S!R_l+0^FTj}b=iJr8$hf3O7nsBCY^ruD>5fM~gnMwe1aGa>z8^FHL zbp*4Q`p)04lXnokTa*?|yywl&s_I1Ko*E&h6eGsTv?ppwYw+W#D{eD53s|>_x<{%20=Im&(3=QKej^^fLsJ*UEy< zvk>822vTexyIgLYP(lem!wxOo<1X~5R1wT<;8Y>A4+jj$rkz}*z$N{x3zxwn7 z+pBj%NEt*@b>LF$8@Y>?UV}wH1Hp|oah4rj8OMoU?f>cg?C&leR;ueXZ6aj0!qYq6 z``2z{!bF@Nep9AE%N*l)7YF!u2wlgZnJOJwu8aQTF2Bnm3oU~lGF3hrmRcq|NuFRA>l!ZV zhx0KWxT!YPxN~fIcn;@_w>sC3(u>hy;e3F$ChEE#iI3^$^HhG<|Dx__z$^i_rSo~Z zbL?2P);BTJ0-fLY=hTiW{%jyy{^RDhGY@3i_j@6Vv(}fGe~of=z8sChqj5SNz5bkF zDTb|lz#oV$bwWspcd`2GF_UaaF=(7F%Oq$dTuAP0=Q3ypz`SPOW?}_`4Z}QR2SYnE zQo9YdIs>B%KNtJqHS=CVS!q(G4aZ0%C;>X@3!w}ou%)pq$wwUC7;fY3u%Mjz@VWo@ zOW)1O)12$IO5usXiSUWAU2x$^K_E5;grQT|wA!pQLTt!;_HXlB=MJbcsNNTl zhdkdtk|L*!KDXFA7;%sR5I>6W8cm#o_a=>MA#|XN6%ChL{QTF8Lh=w!vmhA32U$8_ z6s{WSN86Oqigz`@4unr03xKF+GR*4IdF;%Ah{VL06xz^h zAe|i{gE+7~`@*y-_|bcapB^gwCB+hgTpSjOC5BlF;v#-3GFu~xMLkRso{b1n$2AU; zk{;&v>snF>#%%E2r}))uNg!kk;F)o~>iNaj@7HgF<6UIB4l~{XgU_9Ph3;L1*^EPz z`Ewc7Z@?&;*`MUxxS~1$GSr_QEa{daQB+v%xHp_gh>1AM64>}^iIQS>MV<;I#yC48 zZ*U~#MU{?$MWoJJ^*s7&8`0tj*4Jhf1Tl;vTaj=ah!4*vol9ECkX>c8w)`;Lc|}77 zGmKi9c)#Z%qtsISy{Dzir2I;dGO+f;MAGiy3Xmtn<4c=)|Hc+@G48A{QhW0b%p1RX zdGDwBlhw{M`c*~d>^h-z`jXjfMeozmP|>>KG@VZkoH-f^u5dcueOgPece z7A`5aEB)~yBK4RoCn4pU@Juu=WtzDRF9|_-5RRqrBnP4vJ8IiP%!~b~rk6PjuQ_}O z6~M_l82gY6l`n{1Mu3qWHrre`VE}fj8S6s!`5679A+V(Pb~*{b;rTJ8bUAi_{27y6 zi+m8`URY^hDb_DcM*9^1*U#{hu4&Yd4DYQ)>v9aKg^Uj{puEWTm@dScq5&w(GQ)mL zrFfLWdK)~-9SLcV`&&(r>Mqgm*kTrP0WfQiJ-&D?d<3x;ll6#SW4Cn6wwQffItl5; z{iVl$(_nZ!oFz~d+my>^9R~o{*aoN`%hWH&j9bh^N#o6E9}itx$b5&-0j8bE+YkqC z4EYMBM8&qfIAw^Mm`MvbjKU;ku*(Pc1S~^w_XG{!FlPxGBCy4AH(KDBT5z280kLQH zV4a-M_1j{sEBz>4Whs$g_scr^aX$6ma7V`F5aT`=x_Gj710+mGcawhVC!@8OJPgcO zjMyuKHJOJM+pRu_La5{TW&AoYJAkeGydO?B^0_WonuojaEjRMN&OF^~hOM)@viRBx zHPwuwJ3XYyJc?C6%1G)6W@L2$ux!jv3h>07>`vH&q3RQU4kRh*hrW8YvPvMY{N8Ac z!kwB=8tFCBWtJ8aY%c7g{1hZ^gcZdZLOSW0*YEZhSwp({fu+wu$f7?ur60p&)!Sh| zh9%0G-U8RqyIXo?8QhZ5WwZXYVuyKy&I_m10x{+1gnW}2ze&JSC91?{l+RB7Q!6{aH!3nP#GS!avf8Bu!812M8mLOfQ2+&{5Hn^i}{J8n;qZx z&?P87gy0qnG|vVIRqRa)m=z;p+jr4Eknv!dDaBKNh)3&HwZ7xB#0W|3D35v7XV>W3}D*E ztWIunAh)$Zi4D4>u|*AsOOc`Ml6OrtQDAl*NTi87;o!sx`;&5Vph--R-IO)Z>AFv+ z2*2C)5G!`8hZ>v?CEr;ICrdqtX{WEsR6&8IJI4pIcO^+CImmpmLJ_3pS|_CM=~b{z zaX$vV=c%WMg4!(r9Aqugw-}^Sd`amL43t0H^LQ7GPJs`w`#yJu?uWM+pj#YBOa;=^ zac$0gVMSA_rUhn@X}1r7dZCG!m3kzRaTqQ0nC@02bnnU-yEFpkIOU>hBaIl1ki3|G zazFiYeEP`Tk<7hq^Dm+lBw`N^NSZh!pNy+_t1W6m4} zZx3!OZ1WDlBpd@=OFUs0r%hEFSN32)OvOE-^-rb_N@p1?1nSxCe3%J8UVzQ z9rCRu(%s>_-m!{~F_h90rAfEOBtMVyYpOCTKpOy5Ld36W&{Li!#*V%!R?C~T=crc2 zpRqiIyix`O`{|aElM&UBn~GlL)ZLu*mepOY~IL`#fIPa_OS32|=zoXvu^w zX@^HB0$PRCViW`9Wa1Y@ybr!j>`7<9R^ zztRC0<9|Nq3;#m+g8PEIu0TqomVywQQZ=zup8TFgLg|`Db!2jnDWDP+s|;LLia!ei z#h9v)RnE=hpEjqETO;@kGGrh+OIEoxxV7CD-{#!r-A3MaIc9#Cv!u1!ga>f90&sLjX*q8603FCQWE@3z`c0o% zG`uATfp~F5=#06R`l5wUtc;Shl&yqx+x~~w}yu#~1)q5uyj zdR94J7n+}bILT=g76gBD=x+{p)v5vLd7*eZs?~nU=>T(itTl#HI;R=8AchAaIA26BNa+?hU3RZ#Nwle?M49b!xtl{ zpJ6nVv`9AyO-S2AeM8QY-`Q0VkY2*H#<8SdS^g6L&G?8VtqAs_yP~uZ4>1xY-({Lh zp&Pe4)&PUSRZ(UHAwkboU|+O<_I^ulV{Z1RBU}K{->#Nelh)u_22QLno_;M1!h*=Bq_vmXd*iZijBVeI!D;A(NS%h5WP8Z-# z+@NtP!$vrS;Y=r%!A9JVqIc-{5JzT#MsBjm?s{GDy543xTb*wzM58ZS;uPdC(cK~w zDhUXk%fE5|em|Np>n-SUxz1ZRQjnSZDYR5sQAwT5dFs7Etzs$JYlvH=9Ro$6@W;*? zMsX%@8d`Nlz13Z)FFMrk}Sqy3{EfN)Sw3So}f^EM(bc4$sOM)c`9w(buMhw(PMj|qG_W4;yK^Z*o zT?XH`gN;Hk7Az#jGuIqlopX0F@C=D^QTmt)Y@5)koS*0YL{HtLQFT!H%yRN5oN72& zJ6iX$Son;=N2^Az;cBp6&ci=3TlHodbheyuk;C%)`-V+Zf7X#&@Q2`p_ZH=GK( zOCt=VzFn$hS2Net&I$6%#`5hzr9&J$yX9qr6Ht0H5n#P4qC$NQG*2{I4;PptILa~4 zi)MtEG}YWvm+H5r1#aLXcFc5We{I4Eg&znGWkjX4bO*DjpKc%cm_E@?|w=ZP3@9NuOLoEK{*` z1?Ga=LCYFEN{V3WKLheE@s(;o=OV%1i*R2*UFGUst5(c#;wqDcvhm7>%4&%sP>9Ox zqkd?CqiSDHatw+oIG6>8N~I?3Jibz^^0ZM90i^1&!JzpgdZ&c0^^X~4%omuck%bqh z7RM+h6a45gGo1eFfLNo5nm-l`3ZH|6Y?R(dbc(K#=mdux<@EOvzLM-yt0sFql+(_* z8-NukqPK}w3d2z_whN-bgq^Zq!+DI0R_)s|3Dx}6G9vA|g|FShsF?W)v~OG6NgVwE zB@9V!d0=@j8@owGTEE1bLUX4(G+NWCl1a=JfuR7^D!~Bd09|O2Y-fIW!XLhlKNyRd z-fk|6kBhkF){fXE^(qC!^-a1%5Yp{W=Ijw{+PPaZ$3&6F3Zk0Re47$$7W4r$?wEof zv3N#e-nvrVv$&0(Gmg!CruZhgo%WpoWY%OMX8u^0Nx$SxQoMq_jGqo&f>)$nKo!NW z^vaS+EQg$zoue_#(K))uU&N)*n3Q&~kd{(JgoTnT1RDq+*--_E8%mln?z`zW=%PBE za_zfRx3D%Au~PY1nvJ|4S^6YvQ$Q7EwA`)oRQLUxoI}`vd4iS5tQ5`U@A;*G)=gEH z+;x^zBU`hL`8w$Ou4TRlb;&x(%*1VhqpV!iK3(yHmW+{BdA#OUh|08@Hll#)xZidU zia%%z8SfEDO$jLW+-p<$!y++>5|?CP1$xL4ageDjxn+p<@mknR<3^q1Jd%^#>zdh1 ztr*_K5r1Hp;S+DyzD6Nu^OFGqvgl7dFbEMQND|~37zDUQbPxN)nJBp0_ZZ9SQ&KT< zy}}VN)ZKV^cv*eDpGS60{L>IW<-9MN|jehs_+shb`7L7JNnlu}VUbxSu|6%`v z{LCTy0Tnr(J|GUk`T`TTm!(#m18%t;ALBrKxp&WS(?@CwB01C`|A%TrqWaD3gLqPd z9-T6V(jNmW?pQ+Gy#5^^z$j2Z#Q)-{T_*iO!b6`b2A0m4EV95Fohq{6oIDz^M4}xB z$goTv4_Goz9;>+{hTT`?z$tv-ED6+0MZP227HfXMa0wJdGQL<%|7s@XxgX03SGYH0 z&j$PFF#n5uX}vd_kEywr>&D3*C)?*#P8S;r`YfceE2qc~JOIlRWTk{$N9Y(s$}iCE z=2`EMcy8SoZO2awaRD#E?e5(Oo<~p31fIuF%@N=V`;^@gT>FgOkxUX+aK-(1{iLZQ z$ojqJFTal=y^0k=;DPp8yMu}mN50KSEcZn%M94>CR;YNBfKfxVCds;Yx_YVn&*H=l z8gIh&(2+R{usg~_Vj5p@Z?qP}bksFJvQKNwFc5jstSlOJAoqCoh8*2xSrG(d)GR9+w%IHjf-UyL@I~bvLvO~F8p4^C@$v>7_3nf05>L%lxh`v?Yq8^Ad+t+>35&p(oh2#de*AexR^LMJ5gNGzq^D|8@ku7F{$6e~S}BOZH>wIWh=h z&iwnkkZ}B$`u;>=sK*Y(d(hH67+^6HR_y>#WaMSVbK^IAX1pH_1>n9(A3C}Ma z6Mc+-$LTZ4w)aHRA0~H%Kc75ybaDreW;OzFwf3QW>V6mgh#5ORxg{!0DFR=Rkjm;` zgNfH@p7vGHlFgHQ$>dt}c9N|~`XlL%|N0SQz8Jj6g2l@8Lhx?Pi{4S-_=E7(Cg%1; zgsH?5p9J0^<|fq+r5+~K4ylCc#3Bdw{9hP?67Y|zZV^pWp7ynR>2JVhcSinXqF{iM z2b<{F&5aaAO}cQf zgfn&n&?k~cu!NhighDWcbTEWS@x)ghO4Y82ux(`$iFwu6K>M zEEn+mMt+eL&k?SeI8pq1r%sK|cHp;2iU;6~Km8~WBGwayf*NHX5Zl)C=|0Diggw-y zJ{3IFC31Lk|KuTAb~0RJQepEUg*!1+)8@Q6TB6Gj+vJ8Mv5#{ep|uvk`ySzjq$oc$ zLF!F8=i6FUzHBy_=Y?fMpTUPn$3Yy)-23$x^FYNAbAhxvf2`m>wf+IcJ~hrQ5*;R% zs%5?#7IPg!gBz9+AToW8wP4sCkLn50>=7s1gTd@kx#>wy*$xNo_u|0t1xGJm6o3%S zH*%ZE(MuVXJ$$=GQ1}IW%ppt>HD$R*28QLhjM={==p1d1JY);7#doPApbCNvOSxqb zj8JP)c*cRUMJO`GX;XQ|5sFa5#1oY%x@AB^ERsxgE=8aOJjGJhW#94uqXnABgNG1J zU83B=vfmIt`!*{)M`XWE$Z%|aVyR~si+$_|#G<{FTZQBe^M;g&nOnsC!CMpyF6oGf zw|R=KXqBPhHQFtBOn#-ah&OZG>u|Mh^fWgzTZAVGLhAcZsZS ^WlOe@K8Ir*~H(WzW_R< zBTfQq2?AWQ8-A8H&|}n^W7h8B)?#4QK7;CEB#P8yeIpegRTI<^o754{oRsCOrK8mm zBiR+)1`*@cWlu^G@GN@w4!X77JdLryhcJ3-sWL{XEYEwmL2Hc9IjR^Q`?wx0I^)MB zBz}=3PPiWA2%;450?i0Ll4wYCyZ{lo=CVH746@S&S55QC4qk-WnUZRQQ1L0s zY8IcW&D8{*4>?RMedS@i5ABBPsT96L=QT`z5rT;_DJuwdxw?G%!v3cg%m*^z1!cMR9-yPt9SX5=B%wra8# z$gD>!$uL90rmfYaN2jKF81^vlaO1FZlp&0petAJqqCKx+eZ{zLQ&6FV>%s}-WYRd> zkYDc9sIS-rBf<3-8{sduGe8d#&#BZk{D)$4=nuJMiPEvz*)a@}C^S{)(y``5EumA6 z2!WqtJqCp;!u3Mg$?l}3W4Ej#aG_(rdmji)Mk@@?G@eg2N6Uk z;esC!r~_cQPBCL15c-mT3oGwRNA$;*J*Xf&s036X=${gcKsHoZ#sK;yPVR4+9&ld+ zKM&5}T+(v*v(KL(h9AMXUFYPlrxN22lS2Ii{l$*0Qh}zV_wDaKA#Pw@l8govP$Avy2_chsAJ#IUPchJ^6xb;JAD>+UWR(*#3H^^} z{cI5D69Bu>lVBKtir{!AxV-qMx`J4JYO1NCP6ME{TAbA=!@@R@!R3|A!W3ht1La#Uj`PKu{6oh69A~gj;nzH@?DCvQf zR(~k14o$)OIl%X}W1E7oK6$0=L8WZ4lHQLg;=Kx`Pus8f#8YH@$LRCk1jQE|;(X@c zvc<&ptiCl4LYTxuntniB{eZX{hA@f!51T|mf=HmfVB!2;puG^`PBl^Hnb?0!-IT_+ zgo?(YKDZ;CmLf067y%Y!Hs@vV?;dQu7BE2e$e>dwQcptAX^__ft=Gbo|Fp2z0-V=^ ztk;5)|Fo0WLV(wTz-g)H%RJjC?t@0VyTFwf#fAgZh6C|NPl3-yf)A0Tkh6qP_L3@_ zln^l4XCuOgwF)>ZCFCqFoE)l7f2)kK0pV=ApGM&QUba0Xwg!z*Z1_rX6yo9dpK5l?#|?YiLGMmOCrKm8~s@ zUzT(&&GH{8P3ru#k|d?tvYF~Kisc2oWp@Sd2hQb%m+CT=>ch12Q{m+Wxa9@e|9CF| z@43Cm`6Va_CB9GJq|Q6*TZh$GDN_iG z{s@b3Fb-7z(X+BCD^&6)6qgr*=2(+wmx=kV;Q+eKSH2L#g%D7NhViqHFb z0#?f3JLc^5BJFL5G~Gb>j|Q~uSNyqM6u9*ug!batIpBnwO`80%u0hBz#0YIX`afhR zXY*}};6LsY?Oj%*xDoyj6@1BrWVQN_n-4%K_>vAu8*VB^TCSJw1%j+P3wRH21pj?t zye$6O^7*hZnI!sq;nFT-R+j?l%f8$$0DSyTk-E=3juvg)=9yAen!Y8nMrN{x=CabF zFUn8@JNLaJft?3rUKH0=$j#xM=0d0?nY>n{eI)7j*tMrY84FW;W!Xbg#QT+~;}yU6 ziak?RPJYNMEvJ9Pd84o=)9(@QUMvXufSnhv9UmF0!T;B*6n?4P~NgacmAGs(%!?f#f3w zT*u!V0ahT%Qgq&vA*S4-B!Wlr5^=4q4Y$K$m z*j(SQ{nhvZiZ%ifIkI%jV5NXXHWW%Ry() zLFe&^v*)PuRP3g0>}D2jc0FgcS1q+pDWhqHCWB6CTy3#p()f*{%j3m>bwv^d%^NI@ zwCV+YIQQ$JxS}>r2Lj-#40~RJ&TFYsH(A$S5m+0CkrUtowzsYu!iaO+1g+*jv zS_G;VM@Ro+$0R?GQ=SNqaNw^BR7^pN-kN~gpN<_-Ds6tvO(2fTBkPFb&nkIA)7z?> zTh_JK1w}1xA^2xv;(kkGO)9^?u3y1dM}3jQ)+iUrkYxhW69CeZ5hctYR7}dYYGSUn zIzS)!u*V@f7eSWmyM+~%<|w)UqJ=!tR{h7 z%UH{EP1~wc>?UdQrY?3@1G|e6_hJri|JU=&sOEy71dn4eHJGW>owKf|6%v9am7we_ zuI07)uNxBKJb*U+UI#hvLw`|z`{qgzK5rC18A$?q65wE}@;HGlyM*41_hhO+rYSJ3 zp%S!dOT3>u>`!Yl-F9eM_@%&3E$0K?oZv9 zJ_UT!a{RV&@u%mGOO~0GzDgGBCd5crqwm86JMBLluK*){oEU+jON55aZirwOXG~6W z*E+Q1ELMM>q0bqpmwNjlAcW9dr}>DnRaf+Xs8C@x$AKl#N2& z&t^ECIk;;PWjDop{Kswb<^?76?-|Z!POKK@H zEWXw&{{(nv{H9^wvE9mPQL`3HQg!2r!oJG1NbF0a^Jf&sWmbSuQ?zW_8%;|f9^2%6 zOpUfu5Dc`@cWsjPyYvkNRlWlLna(un{2Tpq<7P=6+|gp|@F$Y2zuKhEq)zv{ZqG^q zlYK`#Zh}rr%+EUG>by^N$0!e}>v?JlYqa&#S{*D)8{|yQ=jr8+l?50Pcy@(j4J+x=jWh zuOuy_BLIWx5S|wO!5zJLu-`;|f{+9v&H*Cio#F_hMDf`<{~b)I0?!}Evag_P>-F}M z)-wR8X|nPxY7*m9V9RP3%B*Ck(s%8lbA)nMKeC@I4XVll_pP*ZpJJck?laGtTtx=3 zoIlR5BM)Q#8Hfn`3Ov`FP&F*xIFtE8uNCNw|cv7AcZN1YAqrkkD>xt&e*^3<*nYF^_^(=eP5+5zb* zQf54;s;j}cWf;~e(A&`}AoP3})k$BIxw95hUK(*i-?25a)wo&TC;+y-;jHk;0!oqcsX9C!IID~M-008dVpg{i68FNKWJ%c zpO6s+F-Uatu%0ksCz4ez2Wes8k%N+ue-)8W=L!4cy|JU4zkJ&XP<7i8Xd!i zWF*#URZ$&WD@r5Fd4O|y4}tM`$3z$}7104yk7}S#0VfTO087WbSZBAqS4hxNp4`pf zsnj~Mzh`85agr*B#BAv8(`38y1Hm^xZq>4|$Dlt$6x-Q|LjZ59=q5&<6SZ3&xYg#gD)Er`C@hBJq zL&*A)KQca)7jvri-sfUuEw!e#9!w^v4f3=zm~DihCel{Pjy?H%qX+)Rqjb_k281f>bk6&*8k4k>TM@SoO4Gr*!th>)Iw{9)buN zuR2c&@Xrq|!6I4xua3^_`a)iG;Z34vsxvGTb((%^|4ONMwTAkKgv~5_>=ITXhC-(3 zXqkH5QqD~u-4ttcwA*(!Y;GodMkxfbM%PRP(mh-z{Q(RgBN5#-cb?5C&H~6JMt7N1 zvndU27am?oQtQ!|(H>|5+IRkfCN|KN_h!Cal3*`ofA$~E z&}cL&PXM%Xrl05nzVK_D620fDHaA&c)wS*~sXtQyESP=X>mD41Sin$7 z2dB*dujsk4ez_lbEeDC$v_4GDgJrsXKT;H2jqJ@yxG>=rff148Lpu3IV<}^c;sl9e z-jFcnvn;{wH>}-==ZM%@1!9eBag>_ zu|7AQZjLAah)mQ(gA~3y zKk`e6(@VDWlJpRk4;re5DaG?fEaR5`f?r}p&2o^e&vPf(u*T|w3(FyCmif?)c31M8 z^sI7c85A(N{ASr140^Z9nYBhlES0#NgEEFust z_({6i$L{JDW}7m6Ol)ju3}>y_mLXjkxD<`zo50-8e=VylJ0m*@c8)8uGgQt#$IsPG z_4fa|&3Dnn=j^k6+Rt~x3h0t8S06`sK=4^XS+< zE$jacKzCCrJcthOs(bX^rT=jx|92vagc+7dP25su=169yOyanUUZE`hw>pkW)R&*j z!-)tjBPP~cOY%-Ek_zILg+f_)aZ05K*vj;WVOA^ldrqJ0Pmb{A~e6yw@lQPWOmHyfNF$UBNmF zsq!IVnz?NR>E7(SXqtcA3Lbri7sH?=Z-3ii$FBl&~!^W`zl#2L1$k@pv~LY5l+hLUqP$J(aJJv@6^N@a`nqgtOv%Qa-?4 z=jk+L)2{u!8$HrsDASayNW{u~Ng|0h1Ds4@3d@?I5q`Ourg)^bOHwapo2C%Fq4!1e zz#cuqh^7^SS1>%CG-lOXkAW}n-S#f`tQX~d@2q}Hnd~x~u8UC#*VsZudNzj(-m=&B6-=wcRE?mcV}vU(6VMTA8CaT^0?BWA5%`f9iJzn?1-?N&Q2w1FXC% z0YK&fIwb;4F=}zHvQTU2_KeacsTj8#XCe7X6RR~*7G#VjoFWO@``f~dov%VUe)9~|9WzsXGE~dtJTv2XbgZVi zRLH;ICzZL?IKD64Z@GUaSd$ys0c``J&U~kur_ZEWb3rJ6=D?-748&D7thAM)hi^#6pQNdGdi8V^6Dh% zo*ZE+#fc>Ir;Q$^I`s*lFG%(D_6m!l*b~(y6Zu7o@ysZ%+c$qC0aU$ViK7onOCgAf z-sTu5!#j@n8s3z)XZoWW23M}Y4IP8z3%wmBLBE*g&XTjquJBtGV(A7Vmb1FAL5GvD zt7Mm)flBux6~l%9%4V~&7?@6)x4Q{3vSa6pb3|DZ7X?{nLoEltrS=tCEX(63ajK=Z zmisYC#4t+P+7=1e0nEOZ$WN1ala1W^{7@^QEMgjtf*i55bgO8wWGyTomP8t3v~*?k+?ID%P$OOIPy{~ z1I>M_mS8e@m(tE=aE_GI3>tN?fg82g>d5B^1{5PFN|mKSfMjdN`(}j$X;J5lw1O2& zvleaPGJfrPb{skR4b!wkH;9OttRoFkFdFo>Y2AVa2!@fx~v{@{jU@&Pg=U2j9o&rl%6Ju}))rEvEY204&{G zg+WboX8JLI@mZ)@jF1IiO-{lY`hTNc3>b?q3`Dvg9j(c6_Dpy1b}ghFvU0C&M@lT0 z5ME()nEyM3%S=7r`don?TVhj65$luEkTwb%6M@e~O`=KG?pP`n%T zH04$Ki}9^jKA*3r6G?R7Ru>ZofT!3B`m3)SGmW)A)clK=wjI(XRdO1-B{APG$O2E5 zsP))?3cm(8<-+~j!zF%IB=EOCo_aKoWqroKyKQ{|4pO-|sb+A|jpkw>PWQz8-ZFN5 zy+&LD@MKzYoi(gJzgKsgQ~u4G$t=-Y_%A!`Y$?qy8kwjs9`64Eh(LG0n?%23lW2e0 z@R8^wstrcxP=)-y_`LWw%E+Zs)}@+7`7di;cD&*|qB@dv#Px2zIxZ>B;Z(k!FOG`H zpGfI;XP{U!QPZHmNA<93uV$|^PMv5>JeDFjBl0J^5|RQA#+HF*{k$=?QTPaOxSJD)e0FAB1qa~>dqC_26I}LIn8MF zvKf`I17Xk^2!S8wFvkb!<)fKDlz=fD#>f1jcoNV2p$RKCU*r$DI#*5`EYp9L4W9Rj z*trXzRAoaSaz~Z>s>H?45z*O1^!x}WpZPOmi*5eYvIKD}bAyUTW&xiZ;+40( z(E0P5maboP?Zd=Ye|PnmT+g@?PfmJrhCbugIU6pOmhC_E!_|M}dy-|fK^M7dcyQ`i zZ_bJ%H{Q{I|6AGFj`G?YYlDBO+Qo(}kKYklcE_(DExMi0iE;Tk#USjTUqy%b3@rFe zN|Urwx@3|Zl2cME&#RLP!$nKo6x--JVw+ucbh9fZYU7MCO#|}p=lQOlG4ai@NlK5^ zZWz&E7fRzP5jIO`$ zUwzSN+JE68FQ@61e7zk%^UgmlE~d$ums1Uh_lVEHhLcj76fdbq=DPB{r}Iz81?s4~ zf`sT%0W_>fl9VIb8l)orB7V(?d!rV<>)x2mwHK~1<#|_Ugu`NTT*cb-F$3Y-E3pfGxa5Sf}dAK5ht$SWjMc6`!?FkM!#ET(x!nbH@_)U&P{&_ze8QJ9}W%8L5$< z47daSi2TXk(xL)mX^}r7@0IR0X@dpK0h;GO;6LgY6ln>jl(c^glbD{CV#-T%m_&n5 z8eJLy13vcP01Wt~bZY<%XhDoxpU!ACO2$LRxUJagyRG0h|8{Km-CJ<4|8YF-d#vCw z|98`2{3 zo067M=Pb1LqSJq#5$kNVUGRW|4`q_16>~?A$%|U*iw$lPUp?PrrAO9_PJ3bO$p5w3 ztRt~%^AwY>U{V1oV8;NX{ec43w}H|q4$ck~MCjX6rqPsaG@8=jpX?`o>u7(#F9k{i zeknLR;AaeeV_LG&m}V;Q`O}C`nq9QrM|@xy1Zf3+mDYb~F;b&Zl@>@1qz6p2z#pMs zN(scR8l9WV%)c=rzuOZk;%Igh&4{9jQB=m!uF9$a!_wGsB>~ZxY-}~&Vcc!}(0I}q zmu$>2)*CnTh!>5Ajj9}Dz*x^YSTN3L)cTki*_E6aL@# z!RQj{w*C zPm--7=#y*}K`_7;m6YU33;HBaS`Z9GqedqOebVUUAQ<3FPiu-MWhJttM3$789P}F# z3_(Z2uX_`&FKG0XA5@XtmSIs z@3nuy@`~cI!P@so8ZmrO8yr`}cCW)wB_SWsUu*T2xONXs7U zp5&hAzQKK?=dR)hi+imHtno>%BzK(O;c|buOFR?pwVt{5d9F75D*Lb9d)>ctYrEV( za?^YjGjBBdABs74yXB&@g>#1Y;uX*R@}&RPFTdbG!s7MZU?KGuVqxQ!?Fd*Ra%5Lw zDZ@Y8>-7g-j3!A^)$D-fYR_*x&v*onR8{1$PAc-ah=*<3JZ^7vpXc`Gvti87R~diD zx=rKwd2^o2#g?x_2juEZC;&ijWu%M7Ci_-%+#AgoVkfMySIixVl zn*+0jpA?el;nhl){@w#5e>y8_^QTWYdCF_oeEY!fcQj7CyyBXxJ|nLV5C4;capb3|*iEm>f`Qx5kV~!){g4-PdVzfH~+#2!+ z#3n{$l5%BbR;Io@wQ_UDjrJ`Q?x>6}kH{w^U1CxoQsM8ZNf5i!cJtDuu-d~x( zo~k$#lY{BmiOIqCoQ1*lmad$;P4|@TEj*}wsqm=w&BDJ-_%`FK2}u)}ltPm>n9gKQ z7;nrFQ^pys*^WR414gUYAIOM;(jud^w1~45>2o4vf@CeqwFyB_ou}E;?%C=Y@F=|= z;(6XlrT7`~p?D!ae?o*FK?TMeug|SkTXMWPG$%p^C8J+TOA7i&r9RZ8q z>!>UOfJvuv=_wbJDp>_l+z!{A_3aImw9?;6rdqAD=<@)KMxW*RzOE)q2nj_8B! zs8f}imYNznht74f%>0P>Dw&puugxIr5C;WxCAW9YO`#}Sd-OZ*=)Ht+_nR9a-H zvdpm1e{GgS7Rt3`-RwXXTSP{?Ghk3zRi0qh)-18!e3_MIZb~rlt^e-CL}i0@gowpZ z9wX&4DpO(!W)2xmIZYe7GKp2;O?<*G@UtghT6!Q+N=pxz%$YMXLz&w$h3%On^Coj< zrrB&VTiEVLiWklsgl8@^2vTAqamL(3&xNOUL-Sl9!|1ic|yZ?WnP)@V2bo@7|e@R$uctH(lg z#z1ba$;ozWnfvG$Fw1?rb*6yX!(9YjiPrO~hkBT4@kGdqJ;WgCN(|gV(U_G8PSi!{^}F)NuZ^z0p|bze*q6Y^QJnc!_4FLwJ?d+EZguzc zT+(PxNi&khlHKh?Hj=R=P9MC%4%h}8CzhNI5FoJ#*FKIlkZ^BeHXAUI?AjP(#)hn& zuxmC;II_W9*;w9Pt$`3Neu?dbL!-A#_v~yprXHHk6mXej6v+Rd;YyzWN0?4mhU*TNI(cXhgR_ZK z%qcUihycr!jPzX?HI1lIqJCBnBc0TU8W}YaWIh%2i#(j7M-i44M@ zT@#PkleGi)Ft_Y&mTq4irmnr&zpDz z{bck=kUzU>@+kSRZ6`>9e@-~pD7DyOAqVXpzK&Rj-lC`V%-rl(*_&9(9`QyVa=q;M zMdU5VnB#PZ3xKIrzU$&IDSd*c(9#(N@b(l;wR9HUB8{eBUWpWWdXOdzdW0ruZA}Ia zWMC$fl8kIyQCctZn&M2+BSl!$NTvZ)i4}XbHBlI?2V>Dt*?&i&e@a|ph)yIosx#s& zIBm{gm%h)!ZkJ7rTYwJYX^#)0K*74!3X6!>x9(pdj zTBofH2W`m+Z2`6PES>=hzJxOWd!#+kHpXm+;c!JOS$wm2dz;^)PFegjD}z~|-Zqm+ ziFuSAoi=sZf%Bhue;qnMtlTiL<+A%alvG)Ym(Tx!aq!nMG-@Yqy!uifhu>2vPzL0|ncUod^; zO?V!p&BRv^f1V1%m1P)<)yH+AJS>Riu6k_zd;=mdAVAR6--r&f@S8>`)e_O{lx9~| zn4(k_MjTNUwz!&AD_eT=%{PO-i@#~`$tK2~bT`MyCMFRB?gq&Bq(QoVHWnvraUvSC z$83ohAmG$lOg4cPFboAWC4g4~NE>)#XG9Kg25%j%e_Q(4z!BJ7JO06i4=*`^Vucu< z7q(0G+&r@9@%!)p8@o^|wzk&ZfAf{vsg_h5ju5WHfZC(mcJIDv_`dr91Y0MMl6Tp5 zf;9NVSoWUqYw4Z%drcpS$ED-(kD5N0K9A8ZiHZ>&;(FmKalLm#^XF~{>C0uys zJJ;V8;+M^9Sv2>uD{uSYH&Bfr%{p&#l>Eq&zab+}GcMNdwVh-k&!}EC!nZ`2yf+_- zf3*B2`I{CjeZoZKi#QiS^45Z`aDh--K;e*exFaJkZ5sW3mk&PA$SZDFqBE4kqN2%0KbOc!VmGI{3rY*?>dOW z?R4LEJVHpaP#j|l8{ab}W&H1_M2tovf95+=!~(G<3!lG)q^T{{0-0Cdgvr*{Nknd#mM#J;f0!I4 zH`#Uq8N}gZ23-}a(hK2N!ej%&B>Nhb;yPlp^orvh$Gg(I!4DiCN*@OQNSt!~QT#&s zv-)X_>u@Y_5aLE@V_;Kgle!`HJz|G?Z|o=Pk7Az%8QE#KF`l>rao)ORPSIt$;L+lU z>rEGN!UbJb=zCsN47r4*jguoqe_nxxGNKUM6{u8Uz$gJjj3G#`1dPU#3Lpmtz#G6e ziTFist_T3B8JJ_mNxG)_oTSDxN|ji<2VBP>cQLkD$NkbI>JJ(2SiE?QflMeFzYbQ3 zwT9#|VkOlxCe<7}cVgxnQ zOO=|RZw#jLJ@pzP)6XO(-!dq{ud5lsk3zDy_6UB{)f}$CbOmZ= zxNHeNIXyR!b7lt0PIBWHFGT+KuB|^^uB5t@=Gwn(KV5qd>TiDQSMBHJBmbFyc;nR% z7vSZCSF}oVGR=*Nh0yovf4h)d+1~%v^VeOwa>a_30D=bqAirxDKs#J!XwI-d+!XE% zlaC}J!SP}{K-rjckUYIOF^@Au=2H&LO2G8dL+&Pw6?VaI2#r;PoD!8oUio7 zjou~2xUuY_V%#XrDaMf_7GK}2$v|9}Z3pYJnG7E&1dPC7U~OO|f8Yo>xOEgotaH&I zT{va0!rvKggoYDZsFa2RM2aL5;=R|qYdiwPx9~goUHn0w1pFX>kbi?G`CzdM;j?uW zpI&xyjPDt@Xn@Pc#;_JaS@z)`9))b<`uKP~jsQH;GCi#YuoaOl&JDMTNm25J^0F_(rL>q6+(1A_UXvM)Oi24-r1+j%Fj zuD|T1Yd=IA|8e=%i|*N}|(ff+@T_ywl zue}ca*;?Q5lTQwBec}m(Z-oFLe_|Iv7x=vq9HpSc;d3-OYzVC(On2EI2m}uh?@Z_3 zFiev#6k5+Rf!Z$QBACtx#=+t-4o63c>aGa+PG=} z5mG+t*INV2u{E{}wWZ0#d5>LN+cw2$;UWC`e?TN%T3H*Jam;jm(GpbvkW1|Xuz^PK z@_w|^+jC6AJOYW8muZ+cNI{eiC+aD9$$Rk3oVwxm5z{ZMnmGvM)N8F~Fc0#CP7Dw> z;sCJ%*XlH|W!(mCpwZFbrtL2hD}V$DV#OYKJ&7GJuQwtUq_vVw3d*a0G*uimanj-> zf9S*M@rns5Rgjc;W2G-mHW0f{LjE*Xa!XKq`U&LK*oF7rtKB#;f3{Ks5Znv^dA?l$ z0q|{uIR`=P+$3{6(ay42l+qUfl*`gLA%RE9P;3QEIPP(z{Dbu$Xp*eZ&-;H9E{NC8 z@oP*+Y&yUJaPlYsc4&JFEU?{e_(nPSf28Bb@{cnw%KMcUGq1_7W?Uj>_l06O-ZOf= zv7)#|-ICj;Zp&>~x94`KJ94AyXpU}msfN$DU?pmal^ovA;g-Wka=0Ds8r2CMeImsc zyD%h2u|?591zyFHNpI@z`6;nuwkX%%f5x%%*_r2XF^DjE2+`*eSj^qTHlaw#CNZc6n#~A!Vr{*T2KiU zjkJo!T&)r-_BDw~qpgGigLtx(f5ab<98G?boJ^8ylS9do~G_0^Py{ZRi@Da22c^|p~KQ6yd)_v$gAG*+oexc8( zGi=kV@K^Lq^h~Kx9f`SsBieHBqNQlDlO4p4-rdb#S!7aQ5vW|LW6e&ay}}k|fiwAa z(Amse24q)5W5S&XQ;G~^f5qhtGJYA#u8?dCG=yY`tt|RpRNQ;BUP}_wPq3 zew5U=-94u@k;!Dza|gduE1}FiaYsHb277B)nmf5fcA>d#>O!;yAZSPYEZa^{f^9}S zGT0Bvwoz(SC8#NVuwW&HrQg&I*qYbTF9d&0n_)BUlFjAvXIb<5%MU5nS*J`O6-oRo zlWqz36bEvT(x)JUe=fjNVU2W_98Jk2&vUfjhXmI}8FGoj%;jLoGVL4%sZgf^RBYaJ zxsg0n^DrOmm~GyBuy;45na$}resX*kodniro;mSQNniz7<2+-8tsy+O-JcrThq~?< z*th9oG;DbM;`z&$TytUF=obP5=79DV3d5`KuiY|bziwHme>Qins@=jVbLy;Ca~J^u zE}a}DZ?x?M9B2eTH!gpHs5;)J-(%kwk9gk>90|T3ez)-h_D{s8j)ud*!(l=k_l$Xu z2R{yz?+4y){D}C#ah(2`{YZ4K3v6n9!oHJwl6j`#DbBf(*x*=CU&C$^*ZCZh=5~fO zlHrldOap+Df5FE930@>l0R{MpOI}c21=oBPI(1NC_If@70jg1tiZ3M7B}8fo4DuhNpSmLPTqAlwB7pJ zlCS*Wt^+Uq?>k?D&tLo7TW&u3%^S!6@~)4+b>&4ve|x^McIQq&Ony?kn0&yt6C^9Elj&$zynk77~2|9|-?A*C-E0Jq1}njAV6yk2$&9Bo>hrd(_jddjgv#E1+=Y#_o% zB9UVee{y#OMnWCo8$zLA5G4Ol$mg)*5w!AuZ&;9(a|eQ~N)|F~0mD7VQ6$Nanc>Vb z>}HMY`pGeVoc}#mj#dx@P!JP3Gl)^zi_I-cER~EVTa+dhw#S-O*sP{iSk&6;q09`N zxX_wN7Lsi-vNe&9fh3p}&4`&?xG|f^h0`&6f2J`X1NCUfgtD-@Etn+@1#Dm_PS2u3 zh8$|LD2B|Trfy(R1XM|UnLpL;wIF9R`(I32SqO|VUwtFar9Ci>E}uB>(F^_+Ht)Ls zg@H#2Y0*7v9$7ti*UjJg`{CMdER5M)*@jm(Sln8u{b%*nTfdfrf0e#%)z=65E`01! ze*nQ|0Pt)}!Rud$K=`l&ir4{5gi18u&l9`&T>_yRBsMvg_4}k?5vEwC3S~oMQNZK~ z1!>@lxC*X8*IL(*%WM=`G&FR7MgpDWIn4Pl;F~AErkx-vNm0>hN42ee`hkzRFaSN!i zRLJm@ZpKMRtd73~J0W^*eqjE(%Z<6|S54?rrKV`t8=^)Ca96-KX;c z4V`u;5&grqaX}U^mHhK#=sZhw-f3!}g+Pkgy zlU^IwJJ3t0y|CAaC5pX9N2&MixpR9Qej}VM`mg7;A?=uE1DdW8+S?(zNs|}@Ah34+ z@-$MK!Vo{g-^=gj5Anx%2OsKlzDQgG+CiLHYcPtuTy2lE7us#@7=zMc#rEKN1KTaI z7L|7L;}%b89E1Dg!?>;Zn$=^{ zjh`0K7Yh0k)GS6#uT?~RF3u@}lo3#zoJ!H6|LT;frkTX6Dc+S?f3j*Vkm2u`QR9`g zEo%E(&vlE{mdKW04sP7~mAj6vdPwJ@Vxe5lCED2ht(V@jJW(n=`KOC6s(kyGOK$1$ zXlzRtAL&eV5r3_!O@ie2@mynL;{FT1)_;wvG_ZPqZ@->uYffc+f#y(14E6V2^R>Qp z;YOC#``Z=JV3qs3c1>W0f-o4AvZ)jt zavyUOZv1HHl-!|QB5nrqNm=m%2_Y1N(pqUq+ASTDj!7pZnwKK@z=&j*g4qKQ!V;+4 z*dEi$F6aL{T@lK8Tml31WfNn%iRzAFGs=q|g0v+`5z2t@f7oSUB7jh^))tyZ=aZ!~ z;N59Vw-|2O{QcY7<>u~4Yi;z(g9ovm>c?8?Mhnedzrd?44E3a&<@~@C*Ta|5$^Gcu zehUXtCP&FfYnZ2J;iph-%gIgcexKaM}0k_vxSaMBub^=ayqqPZDY zG^(K#3kQbaE_e*uP%=G~)?Oqi5CUQ3+zY~p2vt;%(K6e)KaPDJlOPK)aHsc()0Ss1 zWiXtzB0>dJkYSpcIzv-?Y6t}EEld^0lOg1#zr6DCfAiLVFRhwxgFb)W_KlXsn3#`T z^L%sjB}+RlfcTM5{9yjvRs;U9ZZ!Y^AQ%C=fgMzd$DfOB+a5><(ddOHDxttQKVBIR1@Wd?g^0s5 zleK2Av)0f?U}mreW>eEz3lM=7c;yews$n@re}@JN+zo%$I^@sld;k?Qphl=p9(|!6 zqs$<5VYlOXFv3wfUhB!9HG8QU_fr@EtRy_v`a+h##$XK2Tv5U4h!I!+_CkM~-VcLl z!bEFNzg>G;#yn_GpI!)D^eH^ds&hs1D;jqLTT{c81LmGHu# z98`Y|-)E1?N7Y}KU2iaOfLX(AXLd0Me;GT&u(+sXp4VT@=d-{A4bPxw#Phgkx5w`B z@F~OVFQ!r;4a6_=kbXZNS~t4dqK@h|K@@rTpD$bP||8RCm_9#y7kevzd-~3-`%-o_e`$Jkb_2VK-;myv zeT038r~Pbzm(t;EKf9QBWL-;3*}{?%@0wHMT?Y~^$o5w$z% zTW@u@HRTaMrEG)l<7BxdTP|n16IX3)YDZ2*s*IPcPS-9bpR(NzvNo@A>jG{w_&Rqx zM{+313s7^Ze64ajcboEne{APQ(7^|@ZAESb6}~+fO%#W??{Yun_Jh6LVa`D+l5z+8 zAp449&%+#>;vba1r~F9SC%*~~%f}U3+yP*OYvty17jm1qUEuGyPrxS}72`_WHn5Gm zpZho9K+9el-(X4^J}LLGi@6otYJP=s4cN$DrQ85+V4nt0b034>e{r7zAu%A z++uE#@-8@{P-29N&=Dr$jx^-OyeBW^y;NS%1zprVx}`8iSyB|4xRQRK&*gGDk_k3@06q;A;$efA`PyaR8bE+M9_JueW070I49Sp}x5>w3 zn_MLx+P4it03mz{J_d3?hwqqm3&Z1;;fdhMN?^P)#^YuBe=OtUpSC`^KzcS~I_>0L zJ+2;ebv_gB+7IN(51;d^h`{ld)nn9HMn*;o>wJ_ev(?F?&vI5Av1+)2mRmFz0phT6 zQgzVJdUS3CHFXmP#?WG=xUmY*xa#E5eNtHG45mE8u}4HOEVf(IX|Oc`XNadG=J7;l z3h0@uJ;9T;fA6;y_5K(8b$!tvPAt&%{-5>f9i>{!vOvMCy4U-E=_IO-u4a>2TT8)r zOk0&IlV4n6CMUCIHSn_lkXhT^zz5eE@eTB!Xu?Z}eZ&#^I87{IdVPn%FBtMY@H>VO zeXP3yCDM-?QKq5Dpfv-VK$4Cz7lTWE>zVaF=Q);}e?bd4n7JkdH&0E-e#U3|EgV`k zj%FA@`zSY~_^QO|eTW#IV|;5mk82AD0(cIIB@7~^CP5Pu5* z)C`HHJ=g1$K@C#2Q3_H)|F-RQ^4?evKYp@;Spq%d$9Xhqj!*QUwdHW#qFJbjCWo1G zF&JNfXOnbh1dS&m7+JkR(Spw4B}M8?31)=iP_pIdbEtk0Js4C-NaNe1vkM8$A>Ud_ zXdU&XA)#ghA*D{u3;ztSwv}6Q|F8-Ldpw0A8<3|at3 z0Ei0~FQ5PBEieBOsQ3nGId|c__OlKJ{&W>UmIA0*xNu&(?g^R)kkbH!7cN6A`P8IR(SIzarBp=);g_en^7vae zO=t)}LV#T+d^vC#Zy{YE@duUxHb+>;dj?hjL;mIGMjYTDVkMTk2kv#ve%(LAjEo%VOS4qZofx!$FB>7U}C9AAzv*P3h1eLMGU!}sD&W4*~} zGMe{VC!g@?v=?^TI_x9thaLAhM>!9=cDwg@>OJ+|1D6~J1R4Q}mp2CleSZgpUhEfo z@u<*?7lmGYAoOC_iPs=zPA~M5+JDm?qtJ_KnfyJO^xj|EwsP26_uh5H2gZJ+lG{jEYT`h;F`Yo5631?yg znlM$tbt%$$4g#n_3F=Ud2}-#G%di|vF%Lsex=J8(9WKKYun2Q;E`K`Eg$~TeG8Ezr z%)&p%20tC1ki+qn1{eW-8rC~eJ++NupP@XZRMkGBo<>a0yqPU zumB6O3|&fT9=en}osW4qOQFnxPWg_-Jj}tlnYK?k7 zdAb1Rq615@TzQK0y?+8npP&qt2q1d2Gz4*_9qm|*rC5jn#-bhPDA$;aUu9^=p#uw* zULT9|aF)`0>F45ou}FEA#s9WF^OgPxU=$W%4i+oecBMB?e8%*3Ix46Od2%Y6l-^mSoOh1Wzr&RC=P4BPuzv(|l-@o|fq_hm25AEd zzDtplMOb>2i^raW*Dpgm7GW{EP$D%nPic}8BZk)x8(LR8q`IoIqP(oMq&OZcDlEv4 zM#7=IV8HM5dfYCj!)~)$%qF8~$j#Ab>$I9IwMt-=Al?`n(-ufZ+mb>wGd&R9J-N0lYdhjZ%n#EqZ^aX&}iO*B#Sh* zpOu_6xw&z)I~Z&!jweaO+|ZmPLZgy~m_mXEt$R#TYF|CJI6nT&z|7_(y}G42Nv>`wjtBUY@TW>Y-@H&G z$F!XtNNPi)LJPakZfg%DUEN8Xu{_x0a!Fg|PvL3|bT>7Jg2{wC)Y3lMv(bX?GnQ|1 zN&)AIHO29bqA}gE8*>erj6Uc1%)Fy@N=_l?xqtCz9PL@cTNFAqDYYd7a|217(Hu(B zNG%8RYSBHn)*a+W3n`9|Po6coxp7fa+tAi64&``$eo_??LxJwYNRqZt-!~^>+A|n+ zL_7?h<#KXV)RLrqFrSRYl0`*aM6w!^YW@TxlyY@({QMMM6j~|_%qflslPf1Tr^^A%arZzfjkP3c8?V_pSYw^SYgP`{96h})6fBN! zR!k6UQWHJ;XAo`X#)U(Z#P%Pm=cVh%pBWlId3tl8vAZqPx8s{mD5dLbkJe>!NpnLp zbJI+Yx|vd&G&RgTO3Vw*`lJv^3K6v;)PHBCvNV&M(-;yMlN8&=reTXN82lfel#&nf zvy|l6X_;mwhsI7U4?CfJLi6<9Y2B+8PsuCi zgaTrydn=2wX!p{_wn2`jyhMu}W^=Je*RB7YFL zuBo|)657x{F60lOK6%>S0o|__2 zaGF6J!Q2#06T9hla zr{vo`p z9>%NKN0&qo1R({t@HY11mue3L8w-BO7`t3}S@_Gq2bYi!1RN5fF&bw?(Dx4vRLZBw zE995ty_dcZ1Q!8`m(~viBSDYFSg$Zmc%pyvfOVi};JX1?epF7%FUoHy{H;MP8ZZT| zSc)!%V_UEtFJV9ajKhQwHSv=IGM0=dQ^@V)F|v=BIuHamUK{uT-x3G$kuq{BnM#^T z8(By?$WqctE+&_dtI5M;Guci)ARm)&sX*1#N@Fxe=h7?a&2%%}ML(eX8Q7VunRT*@ z+0AS-dy9P~h(cT_6DA04!gApv6;w=Z)4Xw)&kzI_e|#|TxtuNUkPkqOGSs653($p2 zu>#lNM%;^s@d!S^XZR9-!T0z9hY2HE;vzocSNPUIP9+n_R5FdUkojajSxC+%=aH4< zQPM-6Av?+Q2GWte0+}v)OuKoiKvz#R~eo0GdO7 z#7K-JBgn(#U3Ah9Xfbmg5f9%iX0Xh;BF^_f8G32&^!@@{biILbwoTNcr zr-76Ej{WL$$;JiaKb60R1`e-kbN zC_=){G% z8;@ZlB#g%t%)%VZ$Jyva7cRiXxC~d|TCB!RxD5~DZTbkkmj&r{^d)*eU4)PD5qpJ6 zWGdbht`}C|OoTC+n6U^$P!B&=e`B@$E~cXpZek!+Si$99{)_y9{80ZMJctLe4(rsT z@E3Ih3NVrUD7c7f8=B;uY-i7uN-4#5_6${$O}XKUl|0SPQPLi5WnyG0+li%YC!S?ezp?{wo}2bQR+9a?MSli*vYozEw)|3Y(tW5!%nshe{ZpE5RhOg z5cV{CsweE1Qf%`kXSm|KkuJ6gGTQ{oZepttgrCjIq_Z>W8ny~W@Uyj<^ai%7XPDnG zQp;9>;5)VoGFt^I?__uNoHDUutCAT~uVmH_V%BdOQeWX8>11~y$?n2Vb{F1acR|2+ z>@E=a*?J_|dhBHD@fKUJf8f`HD3=NrW-gV<+|^^SWiSR?#Yi1%VN+27KWomU)7aFW z3jdCgZEOk%o>brl#$(%S6gXRf6BW2Zsa>JuJCuBfl20i4L?+K+>2c7nKm&*D40a|8 z;b)WCI3=CL8WDk?O=RPg^mKNrl1^Z!DCucz931eo@vIRh_}Mr%e?}>v${H~mem0hk zQPNY`n4Z!8vXM*K7|dpk+-71NKN_WMG!kqy1O>B(jm8Ex8v7K?Y&IGz*l6rwqrntP z!bY>vtbsMKk!&OkO!`H9B$P4jv3g{&e|lDr0INnBtA@m?F^N^9ja5Sh1B;`S#j%FP!C0IXBMd(a($%oQ z&jOj$PglVQKl9O5JwCrQQcE{u65Wh8x*1F9W~`)}dsHUFNDEyBPFqS>VIp0H*>n|F z{DQmp7u=I{6*NesYou(Npb0jSPGo|VVuhRP>noJBvL>B+f4u2b@2W72JeL(>1uMk8 ztPl(aR)|toh{Vy7pA~}QNtTZtEFXJVKK8MErNi?v@t4wUmX9?oANR6+g-Wf^eaG@4 zvwSdg{E}O75{*hZ+y6_c^th{VYynDH0cNuTtoSAWBrAXl`&fY@V);t_BvybmtN=SQ zb$N;~=PAOOe}{=I@0Zq=vOJ~41tkxDme)hIh7?`ZLxvhgCg^HRq^o%)y#b~41|;YW zT$NBhhz$xX&E!|3l&;3$8EbwiKS@_Z&9<_wtdJG5e3s7&SOLppc`V3+EWiTH&-~2C zd~_{cOV`jf^hSCky@B39SJTyW6a6Xwown09 z+9v5>vjH#}HLj5&6)+Pya?Q-yKQm|d%$z%B=G;0nr+H@1=`(Z2 z%*-jBnUf-OBzr99<5T#9+}A8~&f=E;A+3e1=PfR$Jv{{fdP@Cq!HKf#p>yb5Q_pWtfzO8x}b;8*g; zxE71$k8vHA$RFc+ERjD#H_nki!YT!>Mu+?nZopFc_qY+A^6#+*=gPmwT6D?3$4%&x zKg2pLlRw1G3cLm9$$N1t&X@P%HU<6~7s`8aJC@5I;0}KU-ib@(53pW=ci~d`ecX-9 z7qrEARl9e;x#E2d~N7F@V?Qm+~G2%YR z^+r=&9pRw7jI@#}lW9mzWrfXZ$x>6R#l-j5szZ7CQ5vPK^^fH1b4|{yb7svtC(CKd z)khwZ$PZnFk~2ct4x>*0+Cb|52L@8F>UBnEb{-iw078lfj?fjE))s21*5#y5m%v-B zHGiq?Hc_QEt0w4l))BnD2KYhY^4`CVOc-qMkG#G6>%~5$xhJ&NLTQ#dloze88d77b zuA=$T>Z+Q`3cJl@qbvSpYrpRrkOv;m(>ski{i|f`{ST0_ujzG0M|R%8Q@pjYf%oX! zqy$=2N{$!s4nD;}2zW{$f2Ggk9YdBsi+^T4LvDu-ONbYanD}Gs{{H*By0+7%A!hup;Et>G_huHku`v=?XBoBt3RgxKz|B%zc!L!hZ1!luqCmvIeUK z^O4`t6&GFzLVD%T8Nv6+fk)Dj9!<9JVYV}O$yVZnB0&@SkmxHfizsYUhm;1?(0?i6 z+DVg#aPa-a+M%cOFDMSkpR=!2d^b)hd3=+J0AN6$zv@EU(l+wT_C`O$)CVYDbJsI&Dty;iT$XX#aH7R@t; zB?QbaiNw?q3B^LGL_&t3MBL7xM56k*gc2H;l;AB z65nXi*3?ksET}u>h7AodM?u}#)f?!?Zw-8Z&n3gEgX@M*?RtxdJfF9&e(H(~dWVOc zp@C0#ZoS~m;d#z53GU<)ydPj+2|vM&jXfrfJ0<@l8H{RZv~I~g$u!9=Xbpec=)=&H z^^#W9>kZ;_S`FnG6HEq?YaUau{K!Z%R5W zFdE4Mh(vsrE`X7Olal(>R5nex7MJn;Z_4*)Eh# zRXdG_91Z_<&Z7X^t5P9GhHRwGv1Umu%rQoUJe}KZ8J?%gR$(id0Ub*F->6LVRhIHL zmX*7=!Y2Pwio3&AV+|MOUXy=K!8L^s7CczEUB9_Vn`6@1s`a%+LScWX$QQHZ`wBvO zOEwo6=hvn_+doYGHlaXMP-Jq9ni5msVCR1Fbf#}r&yxMnBAeuZkQtk`TAkjNB7fh^ z+l1|82C_lPjLn+QjKd=%b7%*OVJ9=-BRR;XOAseF4GvWC$3uLa9_r(|x34czFZS;j z`$(o|!F!g(V&!FMST28g{9%*B770YHL5Bo$$S4uJ-y#uH*dme4pu7C?G#hGbYtczM zV=Y61ioUj4t-kP)=HDjLdDXQ?wvy(T>qsnuD?>Zeyb%qGW?_XvLIZ1O*G@i~t; z)mpu1v@hD)e)s3m8RrjtxUDJ3d3W9=UwqrKaALvY2QO=NWa(n;V%hz(KI$IY-nDGt zliz^gMfr1qs8pyW#!ZWB2~zS8Qe{O&wQ*?p)bO}SL+!axuLxdKd#iAB^=-8eR6kg| z)x6FAy7_fWul-~5AMD?l|6!L)jr_bVmOOX3%9xV>D3_Ea1XvU9-+#LJg{iJ|g4lPc z51b+W`%RbsB?Nu}F_(TO1S<;ofR8faOL!5)+n2K@1Z*+~4iY}fj?M}FKel$(*Vl{v z_2Pbr^?f|^ZN1o6FV@$K9Br&qU0V{nRNUnNA3KNNtCvwH1Q~x_^6ryk{4SS&i~cd-&hn4E!TWCD@Su(&v+2J6AP9DGITyY}9DkJZvfWxwp0?0A)S)UaJgsnc z;W>r37ryHJ*zp&K#>s`)#)a7I4p+GYA&o^0gl&Eo@q2@Kmdrqes}cmseo5;cE(khA zBjyzOlcco|*SR-_i&-RV8@(EZbn%u5$bv{XMgH)#=q!#1x)@KtA)%Vwnef_Oz z@#O|+XI+)_PBazlA(Z8E6($%=8;4Zr98gPSin z=X5FR5RK+v_uRbm!If8D8OSl&=s2!HgmnY+{Qf^~+5J;>WJu6va++><^>;Tu-Y7b3 zw3w?QP-2!p7wjq(BB&&jq~a`%P?Qxz$s^%yVRbam60QoxE#azMhb3Hpm6PkMsM6>8 zDyk}MmGS(zm1`WsjPe7fzlZ)>bf`qN1Ef49|8WyPD=$aY4^45*l_MMRSk8~n`d5j-Sj$_!>G6CSH4dwEY)`}`qgiL zJAYVLWsttywd}0t&%U$&#%mux&~yHz+e#C8qQhv^szYDD6+3&^#6-gF2oz zMQSHb8WO3UIC&<~3>>gJjgEl&xTd}_m)$A^N&#}0C@Ta(0WFtmD+Edbx|g*p1cCvF zmpCj09RX*TRxAWC0qU2BECjj(GJa~8L@flM0cp48Ed(3^0c4i~F9eDKDVL2e1U3Oz zm&7jwL=!%KM(@D**~9Wr6Vb*swnf>)^*;skl@qQHAt@oPZ@@E%lW8MyM+FWtK8)!jtfw zu4>Rr7Rfr^Gk?)L(P!nqDY#$C*4HS(HLup`SIV9mcszc1ooS7it*XgrJco&w^Q|>T ztJP%mI{Zw125uJh6`y59#9TLhk!>y3Mf2-d9lj8g5u@fBZ z<_wzNbW+6aQ)Mc-Me)E!9I>5fCGf8@5&)rDScf1MOIx+Z?A&UT$(zkp5#V(*t@>k1 zy;_UQUTrpeT{N2QcF}B&K})o*5Qxuga^^j-{J4deFItgEq)ql?y5OHQM0pu82923f zexfQk`Z(l$TB3xg+V}(P-mN^;ftP_Y1fv0cmnAaL`h`~cVuF_)S zGm6fVAAgTon}g;Jw{G~H*$RaVVJX{`2uoT+A}nPa5}XN{HOl|FBH-a(ZovGT$#k%j zmAG#tV_SxTBzf{I>hh7V9{>21it&?%P969=(YM|={*fyN-Y1_9EIYB+-?)DA6_Hw( zx#`RcN6fv4_j@xSJSVI}F@})eY(-GsC7m7!j(><*?2ZvLs^^!VSI)9xL(9jNPj@w! zFAFS-Us!!Z^#etZl<$eY?|(P2FZzD*cTuAusx5Eyj|pBFzuMm&zsdhw|D*BUfmefH z#BzMw<)5I1;a~Eo@&q0YJH{h_pePnp=M~38{u0zgolaBKL5txlE#ci>!h5`=MB^w7 zMSqKmxUTkZqZgr=Zjf?-A;c$EMm&g;Xo|FMS>ajZp`H{ekoeE3Cgp9&dn@l?o{*QK zUddpTL{cgq6shQ}9k=*I52Lknf9w8MQL&tqRXJr;DxN1|G0tp0G>`W;{-=zu#rUKt zGk5p+^?_~jA--K`b4*`t^QYt=d#VEEDS!Fv!6kvr)Xi55{@u9D2#U>S9}HE{Xnv&f zsK`u7kI)UrNz9SE_g;P1^p!VAytMSLM>_@%A2?^zHr~CB_>cK26ZZG@iGO|Rwex=NIHs3c#lD!>Z&X$b>`HJi9dA`kvhp&% z7)n~XKRCE5bDXhcwfHFaIWkdJYsS>g1n4rc*8J$v@GHAHt@ccIqPp*@Rri;i);9mq zk<(hfc=6*adGDrcw%>El(_LB8 zS!-XvzKmCW<###UGk<;0;!z8HR##~3*sHI4j{g)B5b71JdZSci(CVwXdy?nz*Mve| z57nruxkqAl+GopdJc=?oQWgZs}Z(&)qs3;UIEObOox~R!Wy%9m17xWR* zfi<88OvG%y<)Omq@@X^^wX?My+7;S0T9wvWew>Zas(1}tYFjhgVU9Nr{`WI|tD=QE zTNUL}OVS-4tv=?$4Sz1XC=ukE>XYVt*8k1#mOgRODLz-O-j|-?*FSf~nb$8^uPBz9 zv}xBrYU9BS#buwP9*4Oe{a6xwTOjjh~1hK{j~w6~BMwr2Zv_J{1R(%rU??3MzD z);MYk6sStcUv1W!Moke?@>g4UCP#^-8pTN>5vwhtXtsEBEY@H?$NIv7@X|0vSPV}J z?+m{cR)yCVgnz^N1>Rr*^lF7fYtZ_&)S%s=-KYIdD{EESwJNPvt@7$sLcqmIEZ*5( z;;nXiy)LIW;B=uW^P8lW4 zXSG?ZRvV4lQ}lev=ZJz3W{omIlOGMb_+KDkj^?PNIe&Ueo>Sh}>maRg0;E-{*yALA zCvi$e)lR9ZrpmdpwAv|!!c|TwnqTFNN`?Y|!R&$+1#1fKE!b1=U4f=xJ6#S6JBdqn zn^aV7lS->?{8XFdsy5iZvr$`$G;gL-w3?>q@*Y*d`YdVXuZ<;f2&7oD`YmLqg;=7Z zia<3{wSPvnMed`qWyTtxjf2Z=J-7lPCf2YgQmtG-h z-R~6lJH&5sbcAHQwR*9>ufLCniZwh|tSWIF%Nz?H$6_ajkN;Ib_&*~`5AEU&DK8`A zlhHHBCyOReZ+@Dtq%OP5=E_XxccXj;f@;@(mDLo=N!p{;%o)<<8j=dv!tn|p+ z?2pHd#Yup$QdoxuS}EOXswP8&wV~<;Nk7pxv1DZJWc_SgYsuu=cKtcFb4uE4?yF-nL^uUC1!dYjElINE4X zm8ue|iK^KumCDsv5e=nC!Iu2_UQ;y4>va>ov%MW&=5>zVPNGVH)0)=4&IyMcec~bK zA%|i)I4A6PnCeQ6%Ab?7omVP2XI-h|D6%zUUMMC<-|>J8A$KBtqU5Ydh?2cHA%9Ai zf`pi7@+HLF99u%n)msvoEl=FJr{e=%;7-`nJ@NSIRcdzC{rd)2}v}eCcwI zO-XxByoAAEFeqAIxlX10y=2a{CyWN8Ct*}sIS{Q0l9IoY%tlWl=*YDv8aNOg221+- z21}wMC4cp_!ICiM+8sx?WGPFREq~JPS*_LYboTE#dOpQkd4HcUm90bp zYRDXE@*`RI`yVM`(X5Dnn6S)zf$MztO3T%*b(ULQk7jMK-0ym#bW7GVxf?B;U0Z#x z=N>Az>WGsR5q78X78kv^q`PE&$s@Usmb_H{e))lNO+j9YJ|VdxrNKxfFPK+g@|x|1 zH9^!A5>~0##%ogKQ)xQ6u73c!${@?u26?=AX`ICihw1eNmb=8DH;Y%~AP@*jIkto$ zNJ@i=;KbnU;Jv{ogFAxzf|{VK*1o1JsOI$@>U-5Y)ce$e+Bu|X`!NHA#3uBAae8_Y zE*%ByOY|wr;-#&9+!{HgI70Sg8x>C8XEr|R%&5E_$dZ3Tm3$D@@_#`%aaS~>`o5hWH?>N0EKtoiA; ze*MU&dxu^(aplT68v|O=uFIW!*Q9%UmU8iVY1mb#KE2@d3(j4#eeUu*@94PbDT8=j z=USl%a06TXB81th$Y8wO8E*Ekl%VH!u5Y@M4r^wtb(V#XEBq=giDq{ESH$rM#5j7Nq2_H~MVpZEdZj zvxOLIDl1^MfPXtmp_5!#Qgv+80x7zEZ;Ge~{G@|H&VP0;id^s1+xT{rF0-Y@Jk|QE z$o%{tT`IN9DOz2HVxcMG>K50Fw>fTgJz#ynskeoqCZoY=aT732uG3>rd$7397%a@n z-Xy3!zqJQL*}20sEgSq~t$(MV`dx8LFv^*{AxaEUe{^k>MV+x-$MLz7#FSNo*3Jos z(pwGt5`TUBGiwFuEp2t_9m3^h;PyP}RKf&FMROGoY&8=ibngq`*y!R@H5GN{dtz-;iKd^zsv4EW#!kuzVE%UlPq>) zY}Bs^d*yZh&mbr+llKXa^0#@S2%kN5YSF?X%724APe{2?5ml)Y=gHIf92_OOOYLsA z!=C5U+42gst-2JMyQv_kxAEZ+$O~G0&}Un+_^V{>er;eSf6pZ$u6QK4QY2!EtlktW zS~<8wpfl4yJV?VAwh}x@vtR7ne~6ERfA0>JmyJ)_GJ{}KuEwO{D(2X@*oq?go1TCr zpMSfIQTfYFAx+qMR7V|kUqjV{`*HYM%AhElj}v8qrd7z5LS)F5Gv~Zt_uDk~e(v$p$XTR9WLHWh>!C0B=c)bhbOJ zw1SSJXVAIyW%{!DHRngBkDQ;l|KvE}|9^)q$LT5ZRMA@BIQMD(neOTS4)m#ovu*S2V!KSQdS3OZH7^-mfdB|GdV}^XA!y9jH@Svw;Qt|nAVm&H_PoF_ zGHio|bXay+_E`2=1dB6R^w@DCI-yV5oYAMOY4r^*#GjyKdTbVTNGK`@U>CbH6tQ9|*NhinHPp7rKPbFSzR%MM@u;lMs(*!?EaO>@3~^Ud$M z$ldq7GNRJpG#bTedn zJ^IbD7h>T{;Z2o~7H+8A=6}nj8mPJ1hx~jUTyMMa6d!}c4-cvmf zs+lfkU{Fx-#R7pbI)WnVf$@>JJ{H{UipJw3K@!kpmp#6AMUl)vY(ST+qQ+Ouo`4&Z zU72u*nhhxN%o;a1-MjZzcTY1DO!h42aBo$04Ub#(efPWn@Aut4fm~|7!jAOKa1u3d z@j(zSO#-zvIo9OvEPs?fAB(y{p)@(x>~2S0qpu5HY?0cgrQ7n0jv^PBt-`FLD?lWs zx#6DfEb<~m*5JE3Yh4F@a9s69bx_<6Drn*!&7s7s<5o01Du9ihH zB(UfB{lncaTmUj+_YaNH$-)Se>3-Gt&eG9Lwa$(5HV2dide5}oL z=XCgAn)W*TBU^^rk2ZN64<`*+C{2uUssS>YmDnIzHSBOXQ(=b^gQ_cHnKdN7cO{k>D2G5_Din1twsC#)X8eCM!!w!qHk=WBnJmb5CNO4CSB=N zEaejAD&=P7Zxol{XIF@#?sxh;D;y5pCqJO()FRDg2aj`Oi+xNFIY)o+Oya3bXR!Yug#O=CG8Qxz z{Z}-s#vI&x?-eip;?o*W#S1d>`G)|Ywo)I0EK%4G8cRPKm;Cw0Lg`22q7V1hQr?@t zMtD*n4jZsZY)Z8@HW}$`UoxMX+n6`ji|Z5KtA7QU5V{2-BQ9-xFZG^rGIi28lR9I# z=cMKs>yzuVyTn}yXEK{e0Nasyt6nUEUi-Zu24gYwm-^Uz48x9ICLdd!h{g1T9!Y?f zE^IID?L$U;dzYcN7+KDX|DZq{9SC@7oeKx?8iJ8yG9k-5L|G1sdRP>i>(TXvjg6~Q zjem{xDZM$BOeK?A))2EXWeGq;hY_^5EDx-(2a&mYSRe#D%4r6q)ti)l2qMX?d^=+YAZFNH^9T|`2 z@&ZyZB0YAmblQEW1@~iOI&beawi0e}+Yt^k|M zRUCs*niyA;2HFjAoZ$=sIS7U`a4{NI{ib8cMCs(1=uV-+K%?|oErqjqPx8{mdw(t} z-}U);N-;FsQ;gzFU#6O9pPtz{I79XOBa+JtHOr+};Mxo}7e6wcD~kpA_gCUH;AwQ# zEPfY$t@zEF#nT^PGcq7_T>QAWvMQzA1RyvF03}i%0vQZj#z^p{;5ULK6 z?P}B^ax)krnyeht!}JFFm^n<2nafzrAhW>3*ZaDCd&6VRR0HgW#IneUYb0{B>*k1~ z+tnFa;93w_=5n;Vd*)*MJT?c;8S0-iXKugV6J*e(sK&#K_@D9<{Ar#7Jb%kuJjo9Q zc%BL9!Bh-Sl|W~8LLZ9idMv7^y4&rGU2GT8HPqJC)!wFe4_WBq+GB%oa40`GXyx^m zHfOZHwIy8_aY9#9k7a@(XH%S1;~o#`>gn!IrGm6SpoJtWmTi|dON8`AeO***s7L4Z zo9l`CFZw~7mhVSW4(LDB|9?(D*{>{YdRDGc4cN)yOs?A5S?ydEYN{kZ`95&&h#?$G{X|+7BYUxHX}CR(RJ6)8;SScG-p-!Ld=;yx}>Z1>Ul%>aA`+N^V~sv z`8eic@F6*}?4|`nLkr9czB08Bz0JgTt;-gyo%$I*{?_2~y2ds3$#gglAh;d?YB{+X z^ujGx&r#=5H*wf`*ndqt<{op7xye!2W*2dlYmIwNn0z$+gp;^EHV*d^WF)peMgT|= zMAXgOt8pe63lhO0oaEH`nNgiRB?UkL28PPBk{#8tAjPJL8KIp&J7kA;oo25S9)J@- zgI8HXU7T_?rqevn(H>e;k10?=6AFt1yocI%wiE3NiteU^hJSKwXTO|Nlc(~h{>;SY z|0A*!!x4wu<#xIWXT+h#VAx$}M|Vv)x(io{4G|Vf@Bbhy+OO9r2E~Vmhheb0y!4v& zcAWhd%?j|AuXteP6-#?p;rHQJ7^C{@8!o+Vv^Ksgzbl(o&Tov~cmC8T)A8NP+Xw%4 z>UT3<5I}%$m4A*=IdU`bf)G5<>g6R$5&g)#)a>QC*93XpPlsxVOA>3R3V0I6HENBN;01_04Etbs3off0y zomL=}-{3ste8)NAJneKi3-I{3-1KZUa)+7Bsj1;n6n`{VD&5b5Sq}oKGzrAgJNnP}dH8V;2S*YV!G zOZ4)2FKQ%_3-ybr5k!>ED3lIcJR|05+Q;VIs3AxumVGS_}sd5W9g4Ez4650y8Oe$I|qYWICNn>KSi9 z#9#F0aQUGC!~jbtQzpnb={y^!TtPF8LclQ1xPMN&2$$LdL@miAE=t%-=F1J&zuOH{(#@281BKi9tkicHzVNQ}ZvQU_ek+_XJ{tH! zm^3~g;Jt!Va`bx!VnR>~_J;@V)3+H18Sir8E4|nDt~YP%{VVg{-h0g_#4(Y6z}y!j zE_P=c6ZIX|+?=7xOu!ZN^#P-^Jwdg0Gk*aeNduBo%(-*pTzrr&!0cX9YlW=^_#G=! z-yM$w)3vNGzBG!kCo-xIbzGJ(8-sBRS*64%d28i{M%bt<7<7@&dOGgCysVVsWF)ke zD40P7ZdD2jJ!8zdapijHX$GoHrSo>RV{gv@uSHTqD%2m00W;hegFRYb4DtiP7=MuR zatwsz{<(ANaxoZI&0KG+I|jsg9G<$7Be$D!+7SEH%G2L#iUu8dq4XgLl}>{BrITa* zVo#xTa$J{kk!d9bMaSg?W^d`FTJ9{e@R=LW~|FyzX?UT-!2`aOn<~jgV(L( znK1N+)iCimy^ns0{uzCOc6=>xcVJuK$-t}LcfHP#8&x9j1{A!}3c4xE<<=o9dV(Co za=hqJe2oS8n8iiSWYT3q2%NsS;uY_q3h}zxTd>*&X*r^L|cz;PbbD4p}^Baj-cc{Nn}5zrWoodZnR%g+(6Ca&SG6|YS^ z2Y2yL3%nJB3E9J9T#Fr8Mqpfv9asi2uEh>4L$$NJt)L(HS$}_>Rh zUq08?h8U7E7&5Eo^-mPFo|{-g+C)4tOJ?Yrd4<^XK=G-+zzcB` zwf8|I1zT~2Bg`R{avABz)m-R-FSH}l%IdtgRH7axM?jifV(m#w4WYZqr==%C1!BLn zH{=EcOKg%Jl%A9RSvn>aCHGEZ5AhB`x+!;1rsQCnXn&;A!G=&T)f+sIIxo1KS}v{# zu25E_uZGuA>w?#Wu2HT@-%i~c+%A15^dzy1`p4kT&_3cIRS510J+C~UeqDMk^h@bT z=r_`dP{u2Tr3{ggGNCQXmh>~yLFrY;tKz>)AHk18pA%=K&qLg79FVKvfSip3?zRGK zHSKS+fPcHK=8Z`Rl3LPAlBdzp&g4&%SBAMKQ$w0kK2JW^RzlzaM67hjc zJ>(}I_#B1=NmQfb*?}QJy$lKNwz#^wHcSZWnj&w*gkWir)mb3~wJIT~)ewSO4I!wN z3Bf~f0)*hrK!y`YI)M{bf&!O8NM1(K4Q5<5HGjeMJ566))BJv)bAt@!mlcQ-U-e+C zVzp-#E1fYEE7f2qR$bIkEJZaGi{T8#w5~|Q^g;L(Mg#A&LeetA>gY2FbRU84BP^CP zhyr}d@;kIEf-v~9NNp8O2U?o9XHhra+h^d@jD4DFz^CJNQM+e3yH`})Tf7u999A&9 z$$#;ngFqx9;dl`q2aPp0_1W-nb?!ffXu)9w6J|1*DU1>hS5U&t7WSS7*OB; z12GJ!*)Sl61T`BHBur>BCTr4y$(wOgGt~~W(@dHPvuVH_G_$5*npOn_Y-nw5$bYYN z7zNn6R~vjJ&mw_4jDWy+T=MxGK!OMge1vgqa1aOuEWnBJ#3KznzAyer!%C*EtuxGP@!w3RIfFK3|5w3blW=~Yez;dqwc?K7V z8^@N`3hMX94Ak$LGV1r)IG;fMaeuTP=L@Cx$HKY(S+Jm$V7n1s*j&X6X+Du>qloE? zBF0d!{!|qZw8Mveoa|?eu0rXfF+WodAZ*>b%nly6JiIs0MZJ8!t57;_E%Netj+R3G z9L@3lgY%+%9-?NjC&J|+Y6g44Y#yR!5bX;GQ4^=@w0?uB)A~C_CEU-V*nhnf1?y}O z{jYF8SSTGHXGNse9k%?e*q_L;Vt*Vpe`H5EPz~r|r}U>_#PU8W=YSEN31TO_t6pT( zSn*S26!#VP7Z2houJ}n*WrTWoSMlkjz^JibqZw}v48yuL$b^24K25?`iVwOZe_2BB zE52syGk(bhN8x#H{0S1;KYxLoZB;(W{l5-)Tk)@`?c@mPgcH_08OXe>XZ-O{7G}An zek*iF_;20o5f%%J^mT9@cdKx#evfdEzMp$hIH13(|C=7rWe+p3EP-2qr>lS+4p|Jo z1R&qZbDe@67)Aa5wrWHa)}x!FFuFsJMs+=`Co&x?JIt7nS z_Bb3nY_7)x0jjLrZE>OY5Dc~9>PlS|I-8Q{>J1GIZHb14WI}IB=t5_wme9pSLg#p1 z15gCK0AOcA7kCZ=chtdqQ2Z1Qi>9iwCQYFDDQPx!n3+sd07Nf}5*wov(bH)0Yg~kA zan_+ZHaaF8ryWj*(tp)-06Th|@INs;%6>3BTGcUXBB(MxwZ+|vlSf-@zx`$I`p=E3 zDyQtsyIpQJ=gz@us1=8m&D_rU3eL#y#EI*Rw<%H8ACxfhItrJ=OGe8)EGxE7o%{xV zKXJ7Xbdi3U_Xj=LfiER~V83R5$#v!xyU@t48$Ja9`7t>HLVw^l79Bv+7jy?`;>FTu zz+d_t(11eg9#bD* zY1IFGED*|9+<%yS_C9>IC#due)pBKE5LWgkaK*DQUa8t5-<`UT=*0-d6d-P#`pjNL zE}oiuGp=1;OuTd>I(Q90xUD!v&Y?a89bo&uqx?~wa1~1LKOfCXdPFy(sIpCr=te?M zwsJg6GLGg|Rz3-n1w!5jH1{ftDG;(12bu~Rjh$(h9ql+*G78aN7@WQJWf=#`a;O>& zy-jG-l5*v?h$>8-XqyJ2yOR$Mbi`=Csw~Ye9O#NjQpA{d>t(X)_h_B-((u!Iy`{gn zqwjnN>3{L@La1}WRd8L;Vv3YRK_aQeJ#gLScgj5Pqe;i2p5pfWg#f~bi(im^c&v_E zLX!?})8EklQzxI+VWc_LV#tNk5i5{tG3xYGixERj2nTyDMi6cPm1?nfVT-3)j41j6 z3T+UAhn8_fFO)6>nroGnN83E%(ao%~&^TLl_J8P>hg7W&GNZ;+LVbbwA?Sh!;hXku zwdHZOyV--Qs4U)2vogTd7!nST-U#a}BU{~w%N}>TeAijo0Rv;oc-V>UU0i6OL-Y6* zd0f?7bbp$wnHb6jM<7{v7@{gVu z0rCid&bd=&w3fCut^>@ifZ@)C%e(r-2Q|M1=zah%E?m3D{_{(3t^qWDK$EzrZ}IZL zAMZ^7^iu$hadFq`KBOWRz$pOw#mm+$dT;*cu|N>OlG~Q_bafx^rq2PS4?x+HB|Tkn zgJc9C7XZj!vV6^d6>pCi@&VyCfGk?^vK z_f+rcvH;?7K&b5NUA<;37rz6Dho$$e>gjuL`+rRX@;?Vsi~s~^K%oOs6bN8-ak20U z0@#QcQ0U=B8=%>fVuT0^0sI(qVhDt5pMMY_=F!o60C8x4>~h7Yy8nARbGanuZzZmM zsV{cu0w*-F8lLd8IlWbk|LM@Y31gT4eU|F}*x!I4_Dl()I7IhB1&wN}sstbz5iWFL z5jCn*R2>sbsfvo?>8rZ#T$3#`YV5GXF05A>##-1J(#0~nV1?DIxR2EgQUDa6{gArv zeO8knktfN2leCOJCHz>dQ#};<#H`?-9Wgs%PO3ZDM{_K8EN)NyCEDb(AKh-1Mhtw+zvduLRZFAkyQ ztXz42LmWbyI0RW7LWVem%zts-X;J-m#3AJvE9aavmaktNLUUB-_y7I1C{IN5wuwW^ zXW|f6i9@IqhfpmJVM~--PuJ0gs9vo&gloki<$ZAoCE^g~ibKj5(X?f_8+WoZS585K zgdG6XxRCV{F&3bicqtktNJS_brqJM#XjnjhJuZ%hMc7dp4Xa>APBa{Y8~`=w#bsE9 zrRc#b%tQ|^M-yhF0M+QlGIV1G?{h45HI||mD_}<%3Q>;If5>f*=C_}dm+ALn4c4I# zJ*fC^bJ&rG8CZ&iScP7!MlTj&4f4;V|MUEh!j5A2P>eFz(SjxDf&F{d?L7A?^l{pM zg*DOZDTEzWScYY=qZv!F7)!7Qt9h&ktGT7M=s`Ev)FO`mrlAK5uqt}~joiWtw4AYZ z0lKh`pY0mhu?)Rf%&*Iih3G{e*72)|*s`Cw0v}3XN6wkp1bFy)bYU6#umpBYLl;)? zG8W>}sBS%av4pqGG+c&mUT=}>Vs){9lwZrTe|bKOczv)oSc(N$#-&}nHqO7sNIAXH zE46bgtSuJu>m6^a%hAPi*l`(FpgY=5YtFREbhPl=S<3UR;PpF+=kMVfJy?zfytcbJ zwMWlrT-VO!t9cJ$IJo9auN=P)mc9mESc+v>jY2^D7!ZGqH1T6(3Jdti8jk*dJ{()m z(^JMq0eT3)Q1ll$7Ga3wVu*k4!Y?p{HVok=+(d397B0O5kAmUd^|%uRI`l(;m$c%S z$Um)p7!u~>vaZpgG+{!$pV
  • zk5?mCPwZm;s517RvI8-YP=#jn<96JRU*iD2BvZ(nVvY)9M6oHaD(^sljY`bN79tRV z=t<N*<#o;dSBf9E0l6jQQxnV%}m8<6-;~JMabZlTtE;PND7eX1ayGAlxBdBd#AC zML(V*-nPY2lPduMVuyoex@u^t_QnZBU0f&E+(TEEoj5z*oi$D!Useo7Lr9uNRUh+ zKcE-TwSr%05-t+17B&kH3J1k`;^SlfvA-%eC=V$6l(&?3l@U-Fkc9#?U^ZINimPxv zZpTmYIG)ELd_|n3nyer{Aa|0Vl3$U>$v*NH8KYYIm{2C%A?y}^i71O(#FxelV?P@U zkA0!kDs9RsRA50e+j=TxNg>61c^ zuu`~ExJuX}oDf~&mEs>%YscEh?ikyn_>|Sk4a&{RU$`e}!35N!1s7u}R-g}SaRsiz z)#%3$a6N9|pC96XcKiyv@D!fL5RTw;oFK78OA<*2@ev=HNGeG+X(emOZR8&EbMhhi zn0!MC6{$qa=uEnp-b^2$FVZ*Z2SSVROJSezrtqeiD$Wq+h@IlY;^Qi)3^9{6ubn)6 z>WR^xjBXvHWBFt4idsoi(v>>p3FQUlu<}=A!VV86VkYK);%aQhFA>Hbyov)jfW!C` zKE@YBMfAi#vPlk^LFSWd$q&elso(88^V{uH)5ig zB<6^d#2)c~$Kqq+^WtIgq^eFeLv?wKA?CK2O;O|+I@enuwbV}+QA*lCkbpisNnfG` zXg;I+zxla^e1rX@8h;|Ar&l(&;1*nqPl%h$qc!BucnCiw6UdLr15}_rxP=U2J01{z zN#3H@;Wh+Oh|drNp-V_1xtXS85pJhD@ezK2A>`tJOInAIFhstgW()~Kqz~VcugDMa z1)9-GQ?Qu4fr;d1G6lLP$HX4orkp?{%U$QP)i+xR)(M!K+_ zaKI{Vq0Kagti$!VkBWGhzJwO+Kr3eAQQVC-Y{zw|LJ)aa zgBmh_3xs?_VqqY+fZ}3g;TAFlkKr*gDvV(WQXeoFsH-=>4~ zQQA*Jfby=gU%5wVQYI@Cl%%n-u@hr2j6FVf@7R{HAB}Ao>l^DFeeu+Lr`|lZL&=HM3Y^#Tvm*NJ_9>}SX&KC*(ulLmZ5D)ATm1-r0obSoagBQXzS z5B9`7iW4#S3n#G!dvGhQRT)Gt8O12=B|lUy8oLNr;VSGA|AaY!d_n8HxpP`(H_vKn zoLN6TSUEW`siJ)1gi?P=agonkSm2S|`FXiHu54$P!*0vWNKdm`%%;?oJu7I)NnJQn3|B9o3SrtmxEjFJ3NCMZwu?Opi@fdc6N8oZw(1uZOn#$K?<3iQ$nUI zkDAX$3p^oXP3ukPrltuSYt2jTEV^;yP4>|CS*_=$Iv8zhGZ%OYJR$0u+PQIRNbb6g z)uP#3;IXsQXO|MWs2*o6lXPBU55+pGol7=e(%EGXSvQ8zyv{LTwaR;xBe2%mH@37o z9id>Fv#o1N`i^95Y+kp2(<0j~=cg2ScIXX}+T4+-iv|+3=LUMtr120}XQ77XGu27h z89AqiiQBOtZ2+=YY75a$mNGb= zk}`*-Y#2{DlfBdFDDdp!`x7Z4P0pFGPM?}oyQCsSQvVOhJ(2W=+0KSp7q;4KH+Dwr zwxQ*`SR{SonY3tsD3nywDx}e9h^7fVHDs)re@2-_S`$K|DhvVPO6jqM0T%4WF7Cp^Sg>-&=(kxvCP#rzEZ7J^V?(XjHQXC3gyx7I1 z_!f6}D-Ok7i@Uo^DRO~}L-9iU_}_aonatVqC7H?WZj#-6IiJtmy;<-6&YKfE-L#C4_6{{#8SoGzbp8xFJ z67gxv5nZ9rf69*)(>@tlw9s2$(S@sW&l)PYd?T%GOqDXJdK;u2bTbb6on)!XHZweR zD!AM(?W;f5H&{{oJ|-wHC}@-aTVd=kKbt;vNs7nIS*g)pdi}9IZW)TXTD}`-FxiYe)Ewaim3Vu(|I1%0(3)=YZ_{c!lKL|qYHZ9yl8DR zP9h@HyhxON{<%Wvp4TSQ>#%uUL`K>s$fnZW{%9mlJMX@NL`1*~2unjl$@S`X-zTTi zRoq_F-xLy89Gv)Rv?#6Z?0^Cl$w-WbnMIF2AyaqzT}{T_;d38W<9GY@^)P+qy|S&E zjpt@O_|38+<|TQkHBq8EM(u?!_2I1(WCg^v`K=1@{8u_jDBk|&nO`S)_ql_^%!!kr zG~sUTR7AKagBAd-9Qi7K17~&A7{6@u@1hN2R@76&3D8HFtD&*}Pih2S>l(z{j41iNAT z+NPy&N|xt_V);U7lMD3!##<4l_R@qc>JX+~nn^d_kWB%(pAw7wQCPInoRi>FZrB!t zroS3K!DrPo?(~gRkm*4j1QW~r<5<=6#y+Z3l4MOFwF^!MnFs|LTQQ9$joOLlPPn!w z)x4l#my@@r_7=Vqn$TxFSc)-*uskM~`-f2w-v?2Wgh}VWIT%Ho-oC7*#}4= zA6Q3>-?Ci~rcY@!?XZp$SjH1jZsYHy{cgr3sFrZ$-I;Z$#Te%ke+;6~ApzCWKb)} z{w%cpRVD3<3tKu<#PtXDxz zdNQ@mg=B@MO9q;=IRjtpBr5EZ1om9)h+NL&4ZP8j$-l;WTw;zt^Sv#t%GrH}M`kiZ=0H z^eai)heswS9nk2kOU#XMV0_%fsW)aDbMK%`yV?^O`3OeZ&MuZZ#c)C@)eB4xkV+*w z0_A8h^g-(#IG=Fv&Rt}1iMU~wZrAp~6A>iq!-wde4dFxZ&IU{-SiG^nu+*6eT&5xxCh!5e2Dz&b=MQR+x6EI%3bptDgIoUP6UdEI8HcUv$nGI4!h@~@4bi6i6-PT zbL_6>_I%A}>Ftm4{`iCzI0#h%ycOR-Ohg(%L;hmMb>s~-sK0mu#XD_r^$G<7hq{|F zQFkq(ZaP|r+e-7$e&g^$p1?A@k0x3unjjz~7MaK$DPdO59oZ%*7Rr!zbj9z*GP}!J ze))?DBGeUAf5ZBB4C=R5EE@CBpzi}em`mQjIKlJyZkF-S6;(OKt|4Ge5pVHvJwjsF z2V(a^)T{SxWYk;AhdBQioHd8|aLfeg1+G`~evhZChLhAM-ey_gQzQ_y62OAhAnMe_g z3VF-ILMGT__b?{df!JL(YXV$SEw8_(7QTD`-YseimX*7yYP?dIb?*N|DkE@HefYoh zx|u1SWce%`4~38}vIv&xyQt<5afw}VaEgs_nH*+%D8^*jp_g+E{y+rUz!yZMo!!VQvMPjK5$`a~$IwemT=@>YBdBqX z#%Ml{JeRldQP6iUQL9?6XmxX3jocYLVTBkwQk)){YHmh<0ZwS`o|tF>-&J2!9$wJi z2i@_3sKwRREbTlO7|U!$+`L$sM+jh&(#aNQ$5$N=X`l4B8bG4%=U2B}JHImS!LwrQa27MH;<^ zOJNKd(EnhKw>6>vfyXGi>T@F|`prV`K#pdQ$OJ$P5s-gE)9j(1$dG;7V$3Ilq-lx^ zO?=PQuR~xv)oM!^d<=5i@B%w8Htl%)jTy$ty zO+AXyE>5d7eru7^S~Q`gAZ)h_BCbNHfUBx^ir58n7gF~X{nzJ_liE-eyP-7|*x^fONBbUZ@ZpJkPAeps`ViSS1*0!L&{gJ3& z>c|XR-}S7zhUKC++NZTSsKRr;uX=r07rtLM!_|oC z78YEOG=2+vV~&$tw8fuj=(s6UX?rT!hNf#L4Rb3Eb0!VrFAZZw^=8{gX>{b+PT)8W^g(YC8RK6jVD40VkuKQ` z<$&#s3zUMobIn#%u+bAPVl9$1G09tNBP^4hfbQs9m=!~$X&iB7{mR59zd1ato$5TR zcFW|K&My1idUBEJsz6IAj|%|ULZGCZxGx;-)&vt+gPLPL9-EKdUP1q^DPa^RMDWiI zu1(2oLd`?HZ4(`uL`l4j0eXr>QAvz_L^0H$Ngt4JCj0)%*{$Q_@n#})6Z3fU7K?p( zQKnv-AD!@SUM3Mr#XB#938m^xI~A4QknTiLIWAg`p0{|M0*?b-#q3k#nq}f!-RU!Clqp&)kU5(B<~zi+6Go-7v2n zWY5sF<8pl|SqYPnKwqL~=%?Go$&L~LG*L zSJ5xX*gP&(nN!Jls~ik+D*gsS3-EwX6NPS%w>eAM8O5d%zOd_jR?=Q3g@ zQNEqXcU>>Oov3#nLMKqZ7E`zPxP^b3M(W#GE8@w#4+JK^ze zxpn4RzW;*g&xz~IrF}1``uJa=$&XSQ#lf|baOc}pdOA!VNX*AtI&&%?`_a5R-g9)r zy!8U)OV_paHKR5N$N<4}n4oY7{3;E&T1dNE(7kf|0O~{qb&`TQVL*ZJL7lLmPF#>L zQdifDIp{BEH_V_1SvWL}@DPHr$VXU~VV+q#%*g>{-oJq%PLr_z3YmnPcajczz=iuf z4SFDjL$y#BRXC?6FUwkyo7e=WH^4Vo2&gCV5b14avp+%874Uu_`A9ET6F5_~? z<-g}OHs>`s4wHS3%WICy9goWi+{VGTi}<&TLdWIqK8qY9bhli$E+X9?RK9iszIGVC z9eJRQAkan>Xd?{dRGt9}1qoAhH)AN16Y4n_?iTwIFFmilz;xBt}z;;)7fwyKJHtjiMjs0e^7w2dRxH z%5&+&O~i#5%#z<&CFh84BvQf{QXA2fjxztz>xc{ZuuxLi4m1uERDrhLQk31&?W+ZH z?>FN7Ylhc=%8y?V{;peUZ>Ybwok-VKc*aafM(cpe=6|#YKhV_-2NFgAIay}1kBDrI zTtW4S#J8CT%Z;ovHwphAJ$h83x|96J{fF|M(#)MK{~zrx)^JZb{x7!?yu0YgJq4bt z8kf0cwkXx#qcw@>U3}AP>?YlWegYR~6z0_Si*^!wdf?d~E5q7S_%{;(a2{}?9zt$V z?)Kx-v7(GVsf+>j49XOCdW?CwA!R?8#tEe#*Izm@G3Mab)PK~+c@^b&nUQxBdNz~s zd5FW@Qa>JtF%~#p&FLL1__)k>j1{^6DqyQ$TyLcNUF-bAvCV(e(df>x%@NYJ-CFcU zgzb234h%78yv;idWZOXNdAyTRUhyWri^rz_8>}tfJaqHeY*a5_C);jSRcJ%2sCX9( zA7^Y`lwt>yT|hVM(iyc#;p!_?PT=xs)GiEczaYL?vb|Pv?zrH^Yqy!*tew-0r?yc( zPPihYBA(8(;?P#T`m-G*0(7?qcDMR=x7v5N`gga2yH|dI03&OL{FHai2j#gxhoR@O zd$i>{ZoZ+5F+ylA_D8%au<*^1Xel@!;>TM#g~Wf^HiwOmeYFf?Qza*Jd35|UCgYL| z651G>MIa^E95}G~5dYaIla<^hbz{J4{%i3VKK=5Ccw(bWopZNGFz_W*j`|c#A*i?h z(`9K>I^J#b1E9)pwmFir=U7FWTr;}c>ZvgFo4Pu@VY_uaeiRIc6~#cEm4cgt`$I_e zevIy9x>wivLdW^OLO|tY+Uf3)^zIOR_c_PcJzUt(a_N{aDjQZUSH3uEK9aaHh+e3g zG)e4iy61pU%#!QuTrpC#x;%DaECxumWjvYh$WWK30P?y*)Dh{B(3;J?`0NnT*kuP{ z{Eko8XE>vBJk1p$)$~-BABaCymM$NLCt7>S*xpy87!7*3*$$?{|JZiIFwFMxa8Wj5 zj6fKK)!vXEp05`zWz)ezbIx4AuZ#&tC~s~FqgO;TZ&@JCX5=sg;0~Uzsk#V*YN623{KS+ZGUO3}iA>kCQEmWS4bELd_#1rM}PYfkI%B4*aPvFFL zr%wzFYvlTy_RFoJ;KtsJpObkudeCUKkwYw#!p8f@>pcM#g zK+s*7fYo@wTVEp+Rm86>lwPQO?F(<+YoMQYY&}Nr>(ThNxu@9y9?=5pEf4Kx!t}O3*U0+192{lYDYfXe9 zTO1Ti3&eJJ#C9zn>si4oiq&S-@yILH=^uG|b=8lj&Tl=uN-JNmOL9|J>%hiTrAf+mOg%GphAf=URLpAEyJd5du2lnbyEkRoF=$#7up<8)(2 z5m~dttELuIU$6UO=lfJ&SA&S2f%$jALG$na;5{j$qK8bHyRhQBPOzhXOV$-c`XM+5 zHm(@kQ(fjeW3$krujA$=p$h;vH883#f^Vzl!PS&Ri#5rC7ak6pTW3(cUf&H52e|QE z`;=SvvW@7yPh}e~C!H0o$b0Aq%Fla}PMXF_l&f{$aK~yW=}q{@|LQD|0H{PnSy@hP zw5Q1-T2h+E;Ipj`_d{F)0$#^xCWvvANW(6}Z@55l zn6ty#=Jdq8spMbh>*Mu2P^XY^@+Ori=HhQHDe;#mZ6>_;@6p~q%ZE-tFxtPQM39e8 zXauU0fDlUPsT#|}QobZX1${xZw5FrO8Tp`OjWaRf&EN7dnU`D#Mcp&1epsKPx;n#i zJ@#pumTM+INg^uyk}Jl-zhavwDm(f#r2m;YuS%RS7i5pGdtK@UeEFIkXn{W|ru7vO z_!D)(FwhMNgM%m#5^dHZWjE0i*mEl_u6-zV&8qz>@KgD7o+f2pprgE3fnY!HJuEa= zk82&LoIftm8 z{Ez4-5lwZbRz#-%307g6{|&E5&T5*uR3AZPgp7J*fO_O=$S<>4I&%)qBb`}W(qYGSsbeJBa>^2ToeWOaMSh2a`B4kxv$FaGNlj$sUZ4~PlQIY(~MNx=XlT)ou zrX~tYO9L&H0M|;*^VwQL&M5v|yX`$cA@tI9PmcTyxY~8F=P-DU!65I*=EA(6>CUXW8Hi@M@2fr&)fezy}P7QgO7R==s^j0jZqtizN38HMbz&{Oal4_$H3Y zSQTyVa+2p1rAA}@Y*w3&m+{87wR}?g$^1}ey%aOwbbiUV)d=U;IXJiKLZx2AUK5Vv zhk4(UU353XE)6*OTbk!$MEGEuWZISt6|E$Ug$b`H!lJ<$EHZ6)&*lz>xm8n}4^|#1 z#dQ)8Kxvxo%j)+ohJP`4p7%J1PuR>TH{J4>_aoVv)i(ojWoPDXW(Sp>3!e9ZHo*Nd z`#fI$WoqMTqw`cC)5Wm2r_2^9tBl4y%qqSAxfV&&t$IM~PfyCzufHYl-)GRz)U4{a zQCGiM6QI}*PW+mgD9Cp;)Yt5s=K3yHfX6?S1Q1e(j?d@GVk&0(_ppp)p=oE1TrR9y zS6Ud>o(M}E5lkKW7nJhytJ<8=f7f=vZuWy(2rBMf^blfOPOG6W4!c#~sh}NfF-sJ! z3+0P%Vx$ujkT@)Y7e2<(*>H5E7?VP~&Z`%dlS?FKd|m#;?$h|+Kc>(s^(SG;_z2A> z0P5@y*@Y5?02YhB(n37p{a3!K@;0yGlUG;YW0eyA0phS~@aTlsIOLaE`X1wOXrq?I zWyQWE;cy3`C#p}T=%t%CLvCkcr@p>%oB!}FskVh?tDoB?MeWmFo2P&YcdFrf{Vz_R zr_OB2L3^R9kvy_7l(SFw>x1r2J98g`ft*wfIYY>>)mh5EB@*kc(M?=fV@!IvZ_EqA zb!}KB%Tz;IbZNRA+^No~RxP8ckPyEfPR_A{ULM zRx?RQK-0RZ;aQ|{5xRHRKAC%{0Llc3a@r-^adZ;~b2E;fXukww-o8bfp7`Yi1T<1y z)BfCKPxD5j1KE`fiD*$Pg}ZSC7Z3mRlBW%6*!tmC(lw?~a-W91p`WayN5M5yy@jZr zrL~^;`7S*tB?l)-?R$yM2^UPoygjZ{_wm4_g#SsM{*tPj&6;ROP^m~;+bnB)vz2s# zOOkM1h3(ymh|QZIarH&t3yEnUa6hYkT*nNoH2G^NbpIIO5fb8IZwOGo;{Kt@mij~N zJ+<%W1AWh_mhbx?zHL;-w*d>@D1(akmt69?)YW4J=Z!5Amf9n)MADQ2wWUk}N!AH+ zx}T|t+~n-!4c627V_K?NGKE8(=OO=o0BU^eks-I@PpI07PU&8HSfr z-kg?SMvRD})`{eZ>Z}muEq&AZrt{g4Qp;?HGs;#+9bWazas0wL_L-|N^QB@xDij{F zu5iLyL|UmTt1I#4v5*028pZL-Uu@LdG8cKc2X5Vj`YqI24XRgSb=>8NPX*uuK5??8 zSXEBbr+iYMyspYGomLDB2Sh_K;lkw!+fZH1h~D3M3OC7_!d#%+IQM3bMB z=-1mgP#nZ{5gr?>{N92yJ!40QF>3YLG_)a?&6Q@*Rlie2?=oTu&^w^v1Dj+OqF$g{ z-QXu$GL#_j92~&n`vK*A)3c8kxms1Z+7o!#i?>o$V71>yO?x=6UCVo@SdIb6MDZ?Y|pd~%up3c1#`@FwC`I{oJva+>7t-({js(ZbtNH=)7Y6fAjMx# z%u6xN`{eZ|I5_$+IvBBCK!RRX=uZ5}OLg$4jIQ{>?;JRGTyxcL)%bj_4L)2KU0cQ# z>V9_L4x_s!w~c-Wp5Z%dnNa+Zy}((}T%KR6(={En-?-TTwlb8Z^XN6zTb^;m;N#iv zb*d=JNNEpO`Glip?A)E)kk!itirEbzHQEj}e~yPalVlI(V!j}+V2i|%C{l~w?&V#l z?=|%d#$v_)h~?@vU;23AXey)ynjy}X3e!2LGGzFJ61@N((cxlWDV-QsZB$XzXizTs zxS#YZW;`hpn9ih1YFiXI27I#A6lw33M) zY4dRKo$SD8K7XE1G46T!SJcH?op%~GC_q1(j&CLj?u?y!Jg@hR>e_EAC!uBI53L-3 zb-z69$822Yu{t|-{wq$n$ZvV-Mq%&14JOI}2|q6b)u**NY+pR;#VSP7j0?5fk**b` zp2&}(M~&=K-t7D%_%asgd-JezBxOJHWs#K{N-pTomay|GKgY(C9tGxQbc7vwd)bJo z6*l>NGWlI?x0pQ&qO5G#z2%M3RvTsh%&(U!FhlxkuX^*DxVfTWjKS;LypZ5iiTQ$) z+WRFqfYMx;y1a}QzvKj2OMB0p3g02zwz;GZML|^TFt(2*vw!4d6+FcK!0Uz|k4Te>C57I(@xMpjvq;%b#3jfX z8n_;JrF6Ykx~A1z8fCCksuorim=GQ!YjoHLZiO54w`h?qGJDubT-f%6_n-IphoW3p zQp0P`ZhM{bxwt3HhAqg@NZB|9(lc<1D_-c;3JsOJdf+bFm2hmQ(CL1T?csS=|6Iy2nSx%~^**wE$R-g3quZ!QC)qO# z=qI%cZZ`PD;g}3cx5&lz8M=x-;`~V+aqCR4+fmTx} zELNo5Ms%y3yL?i}EjxDtna3VtASAU?NoF_$)>n4|iC5lYiCI~6a*yTO9x#R|YQra0 zqEZJ5&1_^gaik__d<>t0Hma{IG&z6E7x9z>slNIBu-RzH+z`?#58i4CsXHqIE2n7q zOcMEW=XxrQ%l2H}tbsgyolR!9R#FOx=68E^p`p<4q!c+2m!aWddsdlnPRA5WIlDMn zI;H$s3)lLSn)Ma*D%*hUz$odD8~3Rt`IY}#Kywk$3=tH54PKS!{d1Z#8`d`O&1sq` z(^&Sz()&Kde1Fji${ayaF!elOE$=O(9(qLQF5bug;W4!!;lNelroGr_YhLuimi)oT zCs;wjNefR|z~uLyTG;0iGsc9ohswL4ufmv-GttRLBH}FE&M_3{=UYm2=yyIb2slv# zQPH?LGdccy6?1&)22%uEmiem)RUDMd0*#11*)LYv74^v~A$P+9;*Xd>MK3*fBMQs+ zL|u@9fx0@;ZG7XH8N=N{ZG*~MtvWH~Pd4!nB3oA}6l1=g)OIU<7HTT9W6kSQe`i%# zgxou4b~%#nnEJ6-dg#8fO2j-G4qc9OJGo=#4IUo5fZb6=bly%f^9l=-4#pEkfLT35 zp}s;=ZhpMUqm_kvaq&JtXO>VP+3%%2|KY&nNcE#hq{S5moCEJ}394#Tal2Rydeo=; z1wF#7I^3LtOWu2;iuq56UV<-yOsYo{u0segDt5oM_fKOqe@YPkRpgOZptB40=}QhZ zOJvKq8!f$0tMVprk?s6S^VVAFB&u*xyo`~VZ1Ng)*mOh^l4~Q-Bsi0so0^=OZKaHD ziEOf7YthYN#K`%lQ3+(M&hJWpXoVsdo(wK}p!aD^BFWEJGv25M)1DMyC??|)=96x( zf>iX>IR$6socMC+X{yp~1r+xt!9e_?xl3#WsJY3joY#NIbYmIPe3-hmF7o^_;Nv&( zoBqzSM!9ZFhA|-6LD{X%iTsZn;{sWDpg~h>``%AD9tUOa?b0r7e-RaB_rIh(DPu$5z zy*I7rVEwv(CzZl<%#WAKci#CNE@Ik9q;js5=G5kF4>FYbiukbAnOCxvHoGE7^wqoK z5p`jA1fkJ0VILBj;U3x%@6#dR5ca7gdkXBb_W~qUJpGiWrE>Qz8$G!HUZIpSePV>b z;F$6j5e3|eP)M<){pvve1)hW%9)>;i;g)!kdVEzuK6WTVwfP1MHNL)QmRU5(k#YUT zLc2K%De5}PHOfLYo@G_eGB%u6rco-=)oQ)TRuu$p%~{jRb=p&&`jWybQ$~_hU$Jp}qiFa|@q@r5Slhj#b*%&BRC*GMP!-Kk%l42?u8f9A*esz-qkD$%w3g zWrnFv%xJEFrO{VvorF8gm`O`X@gF&t?;L;3P2wkxn&&PQS}@nE5&h8kT(|x_p+#@x z(cg$xv0=6juWeBemT{A=2ZwNp3;W%)l$B(}x7CSm^dvvjYw`nat5ePa3mNQ{uw}R@ zBRuUAd{NUFUgGYE66Q1i3|81Pjw@j)0FSeCdTq`6zrTr7+QxWMLjPbz4B1e|NF@KL z<>+u)xJz-K?Ogn^{KaN`Fpa~e8(VZwY*)?2Mi+OLpbgJ7sijsB{^#0+)@5upv}d>a zOP76sp6^xm1W7=ft`k!yu<-g`E!r~crD(rk|NDL@4Sg#kyTN|@PuD(ILBf4A41j#e zm-%IcRj6)&Vhq{)a<+5yk7fQuP78;F^DpQ)LU$#rp#viOZ*0rfLER_Q_SI|I24<>6 zPN71rF*k>n<(kIX(_xS`CO-d~YU)2WZK6M>Wxo^ers&<%zKOfdU|Nf}XcEaLb0dau zBj#}nCNer02KidMP@1T(m7{VyV*@_bFQ_#>TNQ3+rOr*kUZ2%7p1i=p@rRHfbQ)5H ztEW}U;uuIXe8mZwQWircxrwzxt8{(`Q%d=s`}sl-xe(cyv$Fkv{ArLimHb^pkF3Rj zMgl{SWNps*(Q=M~)?tKb#SBJAX^!I-h}qf0icZ9!M)+W;#H_-yvUu9H0w~^bt=bP9 zwT#y%yA&38&-I`^CbcWi>slo%8cgC_zo@-JAj}#Xv+}E7p)j+;rb&TRc>aAylR}uq zDlm2bpH0!lt-v5Pz%XS9JNdHh@%PPCv&BNmnn4`A`Ati8Sn+s6f5SReCD{;`p7aN_ z(kW|_?`GgZ$;75So+mf}Z6YeXy+CHA44%wQ+HI&!r4g14J?8TQ$W6je92Ea{snSSD zZWT6O=XLKJm4Wg05@a9+fY$xeGG6z~1XSx%_E%FAXOer8(deX=GBdwbd%g3DPjrRP z|8~r#J8hclDJI0&+D2iMqk4{dE8pj3HahxyLYF29qQY4q;R~b^#+JD)`iPhaM1{@2 zGAVU3C9(0wLLmDI>02clsK&qd9>cxUx!ZZf^Gxp~{W~eZ&N1(aM|BUkdwNrr;p%V$ zlsR1*n79OmCR4{`5x#sP6}4liVj3w<8>Xzybk(y1%cze+E-`G;j$m|1>@xI{y`qem z^?qhp;;8kr3IX%D2fA4fuCR3Lm;|hE4%LwYlb8fk$wKCQvzW7^sA`G{giD47{vo;F zn_!y^Hm$h~?!wX@@|9JQKl@;(^duxYp0%PHwlsF!&- zi`$X07B^?_=>AsxYtm*nS=Frh8*5We$X#z82E4-vKL-%#b^;3@=LbPy_OnTxQ?R+X zl>M6W;q1MZ)5PSJUSd=j9G>N@`m;U5V*AlbT8ty*gveJxX7Lb<-B$+lm7I#KIw7&Y zd-XTt7tssU?s9gn2J37)j`MIaYfHj)-oW+daPS1Kvl3USp==e?@E(5$Ytj7ZSFG5_ zH8u{;y%eCvOM-AdDAQBCd)+C08e!^0ZSCMk%kj#df#|bO z@tFx(cVcoGxH}&`9InaajA8)2+nBw!Xmo;6GTztums&_((XK_>a9%-`6JJw7H`O%3VzNM)>aqZ^s*C`+Pz0MlF$1?ILfc>^{v0-XTn!fb;rlmh!&%)G!DRpX zUyHJjV1BxsX?m5Ux;0tPi}1q5yhposdHquUDVv7!<3gH=g0Jy>@Qgf*$FwzT&)*(`?2ea?78aW{x0V#IdQ1*;fcDZhb>QCy>860U`TeLk0@JtdWUF z94G!(Av3>;s(u)pxwlKk36|v_K@dteeET%%=v=8w*(U!-Pu2kK60U4Y?RxnLyP>BH zPNP&hfB(9w^=G2b_6IE->xkQBC66tfyNBiH+f&J_$LnIS!}^%ltDX|1igqC63z zADOie3Sv4=K~a_B#KwZqAq1SYz9-~TNQz*vrmZi5O;1fEW#u0w2}#_KlcJz8mYL+g zShJ)N_wjc=rof7-2Ad97$=LrJ-5j3hON>fHM65vj_s%dl>lxh0fL zwfy>6{fN4Cur0QQRk_dJ%+B+@l~=kIk-eR*^m~1zonq@8w|mEr4bj1Eu+tX~ZVpe3 zqv6Bxii+i$*ai2|SDvGI^VW~VJ0(+-|02|s1D1l6qn)(mNBpKFC@yXO5drST_7l16 zr`934Lz1$d_Y%CLi~HQ=IlEq)EXvzp*c{eFtC(Rh{e}M|J*H|E<1jo*Lugt(xQ4OC zs$)7(JAG%DbKbu#C(fWMgW>n?PzRT|t+~wLxBQ)~)r>YOjjWyc!(wEAQ z;=VQ|5kAZ#U+_%}RfW7LM(d{C~PYeXuD&Y7D>sXbUaB(WGoRaAAbNk6;9qtqMDY4>Uuq<_Pvil z$r?TEdB`=sX&50|NEc>pJrWu2wXbM!gT_*PAGDzvCVj!n)z zh5)}x)euM2^PA7NQ&9ojE#3Q%>*Rj|{fvuJk2MK?(2i?^0M2DYQ_fW(jT6^eFY)8` z^QRhx)yt=(2z-017;tG45I5~5?D)^W#qBR?rKKhFwdqvh&d#mISgzA=d}A9LHhv3B z6Y)t%TUgrFOfvGw<>ooteJ`O>G9-IFa8nnqm)W~ak}=Ui8Rg8g6b_roj8N;>wfxEf zxii&=kpbyAz$bW=J86f+MFpD#G-LZTQ}4DjGhiW+kfGzk&agUl@9c8n)pLxSE2E}W z-YkVpdyhHvPk%k*>!_yjlm1=qHqVKlFT2`9u2{0XyAn^be8i6c8X}`;A^-Z2JTp{y zhV#{ZtLjl`-odP%!T1B$^-u=Pq7K20D?^qN~YK{==5;<+5MzgI^s7OW9v7NfudS6A1$et=`hVX5BS^LuTStM?#rY zX}X%5E$RPGe&a}pD-R#Ja?(uU9>O0y^nM_e_I6#uQ88vtBPNIOww3PLH8zrTvYT$h zzHgPJ0?^&vsL*5j?*+kV*87rroRuhO1+IiRn(So=(}}_n2WegOD-<-zN+0f-zc&!R ztPHmv?G~3KM0|d*PG`L?x4GNC-NmT`8#VkoSvT#3h&|f3_y#RM9a>iPE^2?$e5S7Q zC{ekJr|U%@K}gP9Euj4oC1IHH3BbVb+Y!&W1%`3LWUcp7)km@6j$`PM*LsG2R#1>F z4I17H75X}*^B&dy+HUak>k*5{*3A+uZgT4UINO;8L*%k-D{ivpkz;Vi!u#*;^OHs_Wz0UM=#ot10b2ljN zMK3rHoAcSHp88V_#tF?c{&pn-d*M9x-2y;tk|o%nBfTN@)RV zpAq+~zX(4&2Jet--YDzQ>|w@K*0T^^TdS0UMJWnoc0hmcAY_hWXb)nqA$&)sC%xs} zh3^Z0*>}^r76R=agJi=ijAy=|uSS5ELA)K7P@kHIpWC1pl{TtIzgiwhJEfK#x_8rsr!Tabx z7A8V>@X!$w;o$}@U z;4PG)v}1I$Fa^7h*6gZ?@=AM%m8_98B4qPjkx~@0XhJvN)()dCy%+H_CVg?jdlCXHqi|Y*qDRc4ZVHNbg zN)wvkflw`lF}AguVX$!f5Z92v1=6<{@r8mXUVR#0MYEGb8u8Bt~!Z%Yx_L z?|4jNs&+M?kc9E&V9NDs0hsDLA*A<&u~I2d`ZDs7E%jV645r76Za?3oBtVsax9NW7 zt{{jZo{aV5Uh^zoIAAnUxTh~xFPK}9y;DCU1eVJ5R)d8xS5Hapj#XuTA#>_Um;^mh zh>IxIj_{_VAhE7o2Hq0-I-hQU99JHT;f3f-q+21;QI;zTtea9afNjK^T);TIJCUtJ z%7%sGr+4IuQ+MqU-sUP13QwV6*rErB(=|F zf3fj!ObRIY{m_sfPVq{_n@pM%&Q{TpBdn5^(S%MOH%TwdY+E^3w@G#_FD_#F zVd)`TycHk?zD2GMYc?wm_lk|%y5_mzU5zPpAWLl%qn)6op1k1N(`R;_N}pGoUeuth z@^R8&N>`y4VO50`5>uzDNZ~NUAjH^ce?b*I6Ct~5{~&zj=bn0q$QuG{LX{3JTBS7U zVUANSFGU(}&<)l)H&2%EoX)rsRwOd#8GI#SCaH}B_{&^Nsp2_2mtdbdgk^!RgiCzJ zqTqOV;+z325~2nsWH2orT==;r9KR3=F3(Cd;g{|VK+|TqWU{7{#A2m{1?$6w@R(P* zWTh7$J_D;OHF480YZM{nuLE6G-5_gDSfOUxuL`gY-?MLr*z2u#dE1a`4R5{woz@rn z-kg^L39OG9?00J;c_O{M zx6{rrh~W(JhL=rX1SXeHrv9mZYW_Tdyie$WmM9Ux@RanZ8S55p6>Ga+2dUk!yQ_A5 z9CQ5ALA5i2mhhaE^X z{Y1uIj-SuDhP2PHhI3{>6qQ?8-cTA&>7D0UBnTTujLjE${bN$afiD-a1C=1trX}AC zh)&1s-yo)xAJC4na<53WL-z5{n)Qd|hcnJu~ZX-_*ETg>~tfH?EKh!Kk3O; z^HAGkC>|)o`EaK1+|AL){%x7J?x@n?BJj_{MVpDDa<#bdb~@58);O&Mx`Z)3Jg8It_rZ_r)G{u6W~d*&RdKW5(49@>uTy7Z%> z>DQ1~ox~?XS8^|Go7_3Wpau7?>WFBAjm(ejeG?xu6s#G|)G2les>8OBt4moRPZAFnuCB?n)r@$L{jzp#P? zFM?~o68FOCMJ{(T9yb(GqaueEta8Ei=O3Fm+gdk^<@Z@N=-4-mM~?{MM$)G%myWnZ zWFj|SB-l1)*?;vD|9s0u{s8#5SG8TyN+#a2c_y_6PrQk>+5jhAy;Sk8LBM;ly<@ncn zmkfTCXiBL5@i&RI%lDVNPeW5jp*RV)XhrItZC=rA!IV04FSLuMf`ea#E;%Q zFzh>obqk-;e_wE?iHD6k*#>hE5C9{G3+Kw1C#zqxH~_gIx)-tDxMV+jHE_*k*jYgS zrCKo2{(>aA4DJx9oi#OxJdNRC8M?Eup^8Uscx*vS!u+*bV$`4Q;m&h9`Q)+l)w#ua z$mU@^i;q^R+Et4(O$4y1>igm;5bcebB*_IQ6p5=O*yroysc#6o;bhjM$E z$e$;xN$3b?H<_RV8oo&U*+`t_z8!ZA={A~&?_a_}MJcl1T-v)Y5c7|YuJB5+pTcfp z#v;ZsezWs`ryb}A?@>J%LW;+Bk||1O%4Q)ZN+rv``A}Gdq&q&Ifo1E8jp6di9Z*l! zKTcuZV1|Yc+XGD^xwN`Dy^&iizPg}PnDxY^DPDOCbQhBM=j)1N!*eHWbEZ`3=SA=+G&olu4{Z6lRSObo6YbjGrfkXJ@C4#yNkBlUwzRD|bt7h+oHD-`ufwg1xIQ~XR&iy%J8ZGD?={f=Lpl-hoh>%K zb??^EOrCm(&ZfS$_e4P;Um5}Ee17)XIsW5#M~nL6H7?M6F0kE9_S$y)P%uuBu>xFD zB%YZ5umaTFd2atc3(V!z-lL1%EzMn}XuP%a?&}=_Kf1@)2hV?uNatST-*d3*puyEEQbWBTseXFD`S?1=n{5}w%DjN?2WE{Fem*ne?GoRC)Rcv!eX-|R5`7@L%I{rqqo)e#>1!5Tx0YNO=1#h)t z!^`6di#c(%Xc7IPl}}8jZjPVD9MNt~8%m9pQ)ciff0crsSn*TgZ(`?J$ezbaZXs&V zKZ&dw8+Y_*_4e`EGnE>EU_JoWM{OL)+uqW@2ZSqy&j~jPBf`DjP3f1?FK1s9e((MF z^wIo(3Gd{YXR|wn{oXz4{n?)iFL_?}I<3NE-Urj$geN@DdY?=?t`!D_&EVeX=KMDW zJ1eB}f1UYN;0j@7bXDGQTzEHsPOy+sPb3#wJx+-s3@5fVfm7axy4lKWS2e{5gwRnZwmvHXQa1PAQuGk8gTc%=I-U0e{a zxU9%CfX*wRKA!~%;k@7wkj0RiTM&@JGO!f&e+PFhD&o`g`q8jgZ@a7*4KFN)BeTQv zB1>`ukyW|P!OiuXL!0Hzic8c}a|=PS-be7fK3xgV_RUx&;faHY#r^PIAP`UK91l1Uu>0*zREmNWLA|yQ{sH(<27~c;_CyM&GK`I(fB)?G zS+10Y$e2x~3^sRnH+zyjKlVOA_9x`LB}|%d-jhk$zRdp2YH%;mp)bX@n&hteRuh94F0j(j3Rk zx5hmpsiBV`Frt=3a~DHR6gTGcP_IX6#2cxTG|^~k#E{&Gi`PWdpqJV0;?djS*^Zfg z6ve|xL|lv3Ml{K2xhTn??ZF@RugV&qX1$BiR796&uO}#PnGg=5W^{7!%(}0>JYCegy^8fR=88dHQ9fEH zX;?BzMAM79SuKphAYNJn=*KfzF}NEV8ZLwK@bJ*k&?F;a%0}keO_RthaWYx#1nv8&l_$ieW}Hc?EZ!hxJm z3*eZW=C40t$26S%sV@lN#4!MD(DF2xW4T|KMj7~&{rjQsH@^_te<#1t{Oiyw%}yTk z&jT@xDeCh*u>!wA*^t?&Y|Ly{HfOdfTQj4|Xoku=6-@C_FvW+##~Iu*_)G@3qaC9f zp`lkK=|TsVC6X@iIx2BcD7LkClsdb*x_?Y;ooO!C*gOn9o1T6R$9XuD`^;iSkgax) zTt)tb$1+n)BHhi~e`>ea&7}7m4>jg!&TJjsfw#NMJiANoW%dzUiO2MMIo(u*jyZt{ z)fBPbLOJHxi-kfW;i2kira~-x&MWCHMGW5t(N-mQ7HYVzbv4eZ-y&IgsRGaFoE%ni z3ZbBxR?wU)6=K=mB(Lf%MGQ*E)uM`DKpj<2s}rhqwK}Mdf2dnjtBRhZqUWd;cxD$! zXOLIa&30kKK`n0Wf=t)8uFzSz7nt##==TA@pyJ*Ut$G8d7mFIiOR z8o3nlsRu4Ebm>=>3tj%Xnh9{2e~75JXzB9Z8@gcEKB5ZdvS-UH@Lq8q;N$oM%8orRT zu0G*T1W7prLbB80cX>lF6e7!_Ug2 zM#G^MewO+1fk`-Y7?f#fQl}k=1|bIVc$XM7pj|Ko%h1zigx_(64G&lI{miNwGsaUx zleT60A5ATvDW;b<6+d4ZUU;=WYgXTj(O5K;DB{CdEWRMG|E~hvhZtOl9B8?}GoNT~ zZcgWzqWhk$N1lLLGp&~ZAe|UeBURx9Jav5AAh_{D*=BKPH^;obz-yD>xi}XYpEOQ8~8PnU5vOLfr!<`B3On( zRDduz4y@n>;vA5Hm$>42#hG&sIxWt9f5bTuLL@Bo-(>N@a=DBnBd%bSAvGQ~9-L%A zBFg2lT?}bT5c1na1cAoQ8a`IZs6kaj#&5r~I{uCOC%~q!P26`swA}UUg`fTIefxj( z^?QE=pS$^wciwUAi?@$`?Y{TEe9dKpyKY*&eLEl~PFF9tK4{qvR8W9N^z68De>OVa zIG#S6J6o{ZgOp0_jU0*`X?!z%s_|snt^`>%8w{&fK8-LioSJ~5jItg|1@)GAv-49~ zcxG1L|CNOoKm}sJrg$n63Y_!b8glsTEs;1yI_V_(m1DWE9v%o=K$s1O!^gwconaUb zv;}Vq1pI!W{yCS;V8g@D0Tvk?f3KQh5yw^(7Acz1M>F`?eG+G=oG>7>#n_b}Lke21|_AyLZqbzmraXB=JE+Or?$kb z`9wAbR4@ZEBe!)>u<*lnFpsCn3p{EnSX~3J05tx|1mkth{p97c%f4Q+KcU`~Kdgk3R+=SPuYRZH@5O z=fe;_Vuw67z!HHX#rCnpe-3sBM<}{=8sEt_<%wT_s?X#sSuf@#VSRZK>%lMgy6c=g z7fxpjoIZPDfzu<20!Ih%_LXbF+bK%JNBv&WUx1CYs{%uMghrs8J>aK+GwjSc2b`;& zgHHPvCv*l<5CD!xD~^i-oLVptSsfXS*dzX?X(+lGep|wx94=$Pe`xX8n8B|!S_787 zK)nh^@dRUeFf3tV2|8wDEL;q*91d337EpNzyQm_IEDjDe*y83;W2%s$N!^TzP*@#* z3O-MC-|^t=HCO9BDfRM5>iZ)zAbHHqwA?>Zp4Hb8s!towYHqoBj)ARTQDxwh=W z#syht9IcK)7lU#R7>xo9bjI4jti}bvo&~XZLovG`yYQa;!}$-v1pI4^;%zRAo6Nd% zUYF<&`4oR3$9LZCx-a+duHR?rlcoRY{4i??dtol_wX|m3e-yB$9Px#n)Q zT*ggVlVE?J9rG&#i3+QRN+ z53aK~#Kz9W&XPV>p03 zHdH>5(z;P%{4nBX-a}_ns3aC%%6y5RnZt*yZO)(qfAHSY5N6?^#Tvlb%X3k)05$Vb zGY>UUGc`DF_F=P+7_s&`Er-l(Ojshlw3dxBeni?mHVJGPSOe~BS$tuvGbs+eA*U@w z%>vZSpH?610@ofQmVwNJD}Uuz3-9a}B6L#+8*Wc@ z5dWkoNlx@iEK^^fc;GW%=(|yo>u9ZSexKIZ($Lr}`5FQNKG4^D;}?3@1nX&9>uZ_o z!?bYl?TJzAe(P^QGx)(SzcW&SyL2TXfry$&e}wGhIa`Et4f>(qFQywC;h_7tn{eZw zwzKFCWD;@1kyk^q2Z#s-9}riIgW^u{pmZQe`}$Nh}`J6JE#aU^(pe49C5px(P#vP@fk1( zcfjM&f(ToIROAJM1OX64#y!W4@K8Z@3Yumb_b0KfW26ND930ZR`Kg^}52?Etvt|!2 zGFK}JXV5dy(w;)7u(dE*y2TnmR{D#}w_S4Ww^NE?HfXbFZC+>Y7~`{%X`XFpf4E{% z+h-vD$;ZDtyC<*1f3EEs008Ujmis{z9^T8aKp=P&oP6Fz7Y+l+3s{3<@+>BhLNxYb zqG@;rkrvsY7ZF|!V=~9|D}+O*!rVP)c*x%aqUa&|Dgg@U zJR2SW5HVo~CYi9?cE>huHkhzOf$?&{H^z>Y#{zzQh+H!>eVRvQ#4v)5tB4s;_6#!Y z!6`BfAJg`VMq;E zJN2fGUTnbqBnAM>3BlyqngWZMx6^C>IP5Xv`adr9wrG9Oj}}a{`pg^EXF>)Ow^z&g zF8dH3qLog=(iopj95AeolFR@&@i73_-&*bms^zcxja&FF9)ctoi#_2d6pNI2Sa?J{ zN*v+e^t_RHmpH}0?KzoXe;W4DHB_y>AwyJ$_o_Zy`3DSq*sBl;uMM^d5DGKNdsCs=7 zS+>vD7bV%>S>P%Yf7VxD(n)`3fk0=GQ0*b9ImkaLs=1c97d*g`&GJPnIBzioO2voH~9MwsW zD0)1i1=U|PL0qp18wLs_AMMoyUmb^P?fp_G8CetBCM)lyy_yhBdkx5uGt+evNOXChM)-K& zG(%?vO41r0f0|+O00Rf~7@;EG3>o3iMhhBm_IO;!8RI(67>f?;5QyGm}A~&jCmg(?{byU@Q1DoElbl<8!m%kXo*?WshEkw9utIC zp{91sy2q9nas5C3*|>LP;8I^sf9v~6pVr>?^uNK|s+))dmQo7W zkqi5(FTlms-Eh9iTWBm<$7iFxDg}UbyXAgRBK~0?;3iJ#+}t7))`}LNtQLZ(X|GJ2 zLhfV)rI@wLYC&rLY4a%adb9PC;DYAYZLd>D-ADP?#n=6BHN2Jk8{=BUtYq$EUSVEp zwkZQze=($MSYUT)#ZqNrr(V*ECFjzj132Y&xQ@P+wq370q7WYF5BZhX;9K;u&@tt; zlJiv;?02nlZFcQ&9dOxPE*hu9&+>Q+*=!mJP!|S-5n-FKQ?LmF+o*fIg~mpZf+e;& z1=Ar$q1logN-H#^6=md#HH9)tdL-8Cdm zOO?|5Qu`FSC1L+1{Std9^>X@S`Yd}k^-9zC??Ap`~=||~@S;|ZMSTPk$ zfA`S~SbN&JsF=ExsTlx>{V_jaGw z(E)SSzZBcGzJq;Q$Cqwv*ZTeq2?RV+J!c3*Hr`I%b(gy(nMJJYk_Ea?T1!poe^RNr zD{?p&QwULf@93koSgO0f#~- zWs2VlV3^4>vzevLdS(asSLQT0f6b6FrpRmr8<_`~KL9&}Ch{g%v6)pv-Sh%x8MBgI zCf^9w(bvhhf!pY3z%$Hy;9cfJzy(=Bj=?D1!7O0r$w$EJGRcR@Fco%%-Ql_{pB1uV z)mwe2H!OD zLx;x7L*xFlW#3r&1dB`Ko93=}%HB0LRLtx!3uibmGozOERW|E!pW5wJ5R2k>W{=}k zsJ8a=Vo+nFOo^UeXB$=6P7Rff!k7#;hZPO<(SpW|pr&RtgA;y6e`9cC5-S)~+*=H4 zj6Q9zGSVBc*bb*sU^oHQ>A`(Lh)x&K3oD?)v(@jk6tun<`ZR6cpU=$Ew7#G8YHh`8 z(_*x5Rc9j``Bx62V((}$!u!=m_@-eUH2}Fdg*d+#rF=j@RfzLC31lZpId1hx z6&TT3#>Kk&T^n4RU0YnoT@KfN;$HxO5nZGx;Z}{*$pO+be@a5q@7=h$mXdO!n;kn_ z#@yHLv6I+PJ2~Es>MhrdGM}+HrmQMP)LbKIKCw+=^q9Be!e#bq{9o4y$)NBqt^?`_J## z?#xq9J@s^Vb=6bvr>>cR05D<&7#5G6SX{PX_LQ9fc?dw;xx>aZmvxTG1Hy5@bnC2z zGZt&rxg7w1)dJW%>yjmbN3!Nv0r4Y1v*!H8a~Dqg{fsO?F9PaU=g#O@j2LtPP5=<+ zE?9Pc-t33!fr>rAm~r#w%$VI1_{*;WvKTtTDym^RN>x-4Rsh$W{>Y{=4FO091gyf*zN>f+>0F7wune%7!UkS4 zumPY-c>vaQNmwBue*qwh00d|eMlSLZM+F99Fot0)CSWpJFdg%;7?)!cyDDJicSQiX zh$4;>3{*7F!33PEXwJX_T->iI|K)!G0x8Hwr;QG*oIriMKxnD$9 z{=ejWNa(`c{sI@e_=kKUbP>JKgRp=sxr{W}bdW8vH_(bT!5upo@3SD?! z=)$}Is$zvMf6^s%k(%^1bAHJHgf9H{KQR=c3q?W~=A9OA{#m*xbRjp*&-#UX^oQ$( zE)=HU;i{kHD}*i_6uNMw(1l4t7oIuonq5K{Y(f_n2wk|DUze8iYxfIX*dTOa>Q8!u zgf7(Zcl}BKHlYjMLKnI1KY6$R9{<@Pbjja>JBukCfAItzKz+C~%@f#hb(*Kh!jd%4 zAfY173#aL*;6!$sS0fuh0~TQ^F2;P!!NoWSb8sofVIsz$3Fj)Z4$Q|QT!a9sP=o=f z#26*M2urXGi!lcSe|DEZ`aS_fF$VK73m0P%I=Fb{JO_@^fal&desVujAYl5}2+5Wo;Dzybs?0rN2z^RNURN^A}~lqX$+ zIhd_zW_2u&xSbv9;TnUdQj2w(vgVXpFa0nEZ8EXFeBEmF@4 zoP2{4lp}!1$yhbwNle{f-1cN7+3o>J-~uoSbE(o4M;FN^ug zyDa#{{G6|pM*u@HA2YE)k-G@OP1my%ud(S zl9P2Z5=~0!%vY|vNGabz%Jp*;jX79|nM!HTR%jrdqki3hBJWV_gnQ{FCoQi3J$U*O z7tFwXEIzomm1{+K!5OzKq4~ZG(lS;Fe8u{ex^<$(59#b z&eW7<1QO@}OjAl}N+&gm7^p>UVLZ?n4kWsUg#$@4WqflukXSn`+!9E1EBqLRU$5|) z!@@1WU|~EEXmrjS7D$k`Kx1O~CG%D_whb$clPwwghH%3iePJA1^cfA|hK#~E5{~fV zEq}yOM-+xS8V7En&}J6K8x!vEu*QTdJdEcc!EzgC%ub9O-`qIN6AZQ##uKDrR(NIt z;h_m*Oi@9D@|c9WA)!$o6PVB62CD;G;(J!DNs5@+7BkEa&z>=@Il*SM@MoA}2}gKX z!g1LV=c#C6JYjBVzW(%74_npfoFCxPRe!6l4K!gzqc34g29`^^bAa!K0-frKtRG(2zB1#L3|3HPc5 zCM*kfy4}(a`7qp#fmKb-;b5ZP6KXHJkGgAuVTSQZ;V7Fu$(|?R1 z^K@p;$uxyi)HyeL!pV{)JV)V?38^g+m=#E1LUTAlb89%6Q-f8rYCJ)Hw2;F1=)~;t z&5iRDx`wt@;y^Cv*C$lDVmPqsdn8C(xckd9B{R|zb*}h5ILqziq^TvyjD9{5izNyQ zxQS>Q5^DYibxORlFn&pr&JQmZ1Aj?6zcG-&xaI_z(K4{uSr`unc?GXdN|;#~4<=TO zZ%)MnnCa<+R2*wb&^Dg3r$5CuiKndSPdRycTR2!4-==hyZ3%7UvLOc49O zNuHBRA3ZTVdi<2;K;x>mblHw>IwO`!uQ{2P<`R~MX6B)3j(V7qnlLv^JAbLnBh7|{ zked*4)rwKiPHME{n^O`J7@iQ@MxxCI-gNj1M{^en$2T ztJvtKgb<;lo2IN<5qom8vndv-{`3MExg1WJ5Xl0cDZ`(*^Pk~Ad~QxA$L50XGJ zD=DN>q<(Dyvy$4BY(+{tn%350R#N0CJ3$GcB&H6I8Vya&r`v8wm z{#9@bXhY)S@G^y2l?Vi;H3x&i#H{R=RjUH40;|GF5wp&1PSJ!ANsy_WDu2oiw^SjV z-Qo$haF9=|m>HPXylUF2DdAu^nDAz|tV)T3Jerl=qTFFdQob`g94rKcqkymh9^oi_ zY$kkwd?@|-n2&^cdVgQ9EYpL0n4JEkjwUqWHib5kF{u!<@irFXX54`$QchmS!;oP7 zDdlZ20@93H+=5H-4kpRpq6tCVhp!RG0L+v7V8U|rkt=Z@p`b9L25(^w*3()R6TSdJ z0V!dRlB-dOS~THyIIy2Iqd?Z97F(&8)`Fr5``C1CTrQEnBY%5@SLB)aJ*lPd3QyoQ zbd!*PzH8*w@<#cdpL(l3%-j3CTq-X_6DFYzOK}C3V+DSTF495=)7|ooFrgW9upCce zABhPN+F-^6Ov0~mCwAaj?8kffgb-pRQL=)(Mc!7ScW>Wbd89m3UW7)RgK=0vjKoWF z$q+h)O<|9-gMYn$={qd@U_uiv!LM*R)?qy!#X-D}4+*1s+C(R@$KkOt~(j2fJch3LZP zBuWZMoYa#yX^h4h5e&V3edY35@^bkF`5?l`LyaY)JtpV0@_L6W--+JiwPnI8* z6Y}%&Ykx}pR-pzBn1og=Mu$>k+p!BT;0XST?+GDl;wMouf{Z4U$erXda)_Lupjvtr zeT>R%Fk8=F5nRHZedqKo?7OpXt6U+E0Re*wE>xfb15t}fXh8?A#?817kKj>k#cOyM zUlAwqkrFbJoJ*QX8<|HIk;SB)Tu!ba*OG_HHh;2o)<8y*G2~n_nY57e$@yd+xqvJsE6AgylRQoKkmtxNWFL8xd_=ycgxY8k zEuw?yU^T|WIo|?vprhn7Nm+UqAoKVLWU=zks#y+QS(pqvQJx>0I zddYM2d+KH5*f`oi2Z54Z7=eYbYBs8a>L9g3)U@$?(7R|Mn=C|_0ZV>rZ=h4?b+io+ zlBaQ;jvy1rC9I2XqSM(%VS`Xd4q`cdP5{j$$1ns#NF8~YyoGl9E-hr6h1dBVRexG` zLbZ@)%GV1=Rg}F62!jb_uaYUGn~bA&@*EjNZ$g+%AtLEUn2f{#ypJ*1K_;U{ILy}2 zQS?I$zyjPto@1}kU06VOk>BGx)S!=COvaIWSShX|?P$UPTtII{h%TlfT!BgW8@Za; za1h7Iqa=r(4}oRUS$LbapcV&+nSU0Mt5AW3SWQ+TPI}26yhd+E6`8}HJ>lw&QgWi3 zY+)m?g&Y@N5niDJj+5u8my{4Kk??2ShmDwo7ZGF;Jd7HsXdDc!Xv5hs(eKF>bOGj* zJK0~!19S++Vh-z|!^!P^-wQ)nIfh^-aghe~04-FtDz8u>*o32~!(2Y!rGK6$98z7) zdG;3Tkz3?o-*i=0-$%F%?_&f$B&)F%Bk%#Slk>=UL8hYxSw0t!(#^t0vV#~%5O2sO zWMtoVQcH5=0BM&q$aq|b^Z1;xuv)lQSSnlr$j5OxuEPf0jX&TW+z%h}FaT$x3DYnW z^HHdb-78UpIt;}yjKtX(hktW11#Os(^KlW{@hkiWk6{ZWjK(CKhnYAZ7oZ&-xD=P; zDqM~0u?9Eec07nT=p*!A7Nj@O7w9E)K0d$)>?J0VbMdxtqp%zkk%RHXg88UME&N!6 zHS$}Sf_!+0kyKzgw|n^u`Ca*;-u-wG4`Ks0sE6VUbpxUpOO6R{qJP?nCV3Cr(>bYJ zO0qqj1C?NFR!-Rp9%f`JVW+OVen>IfgT-tQHnTn0&-OsTbhZb}(-HMJ1-qhPk)E&*lHBO&(^2IwQP0gAir^lj;#j4*K9Rpwi;C4!|v%kYi!vL zg{iJpn2r6Cja#d0%lt!J>>ec8J=nwU!2xy;1bofz0fC=wM1pO^9<~t&*hWRZ5k$FF zFh6~(G;>d<(VmtV?PWvstc9J6GWc0@I-JbT?JV=}9@54pfq!7LLN_tKUa?N0(-k^a zq05!jrMC8NI#Fr}jl9pqxO^Cj z*)Y_zVGtC_I)63{o7gZMQY6#aFf3=ou%8VBQ#1)1#)h#5*1(3aAuuxOC-ad|%p@=- zF^Sc)dRE8kU}S?q*kCpo6023-u@=Rw7WJ$aV_7Yxvs&z7wK%|Pp<%VG76Dd?5>^R` zRbm{gL>sGw3Pu)3F^gjzi-WN^D?|?bEJ)YD3O@^^Lw`SA4Ili>M^|_H{L&B|-G*^= z8`|hLET-GAf^O?nnTRF!N~Ga%<@rxGUjLbpxDgvu$$#! zKg+`*mVc)dcpk?76r0ZSu#V;7UY4h5sTIAiSsrAT2ZlvIam#hu!(ltDhu0=6ji+Z}2Lw^b7jo7Hr;xxYo#dHn&uUPj}d^24G zHQT{m{=vM39&5DT&(3$Ot5Ge7e&A6-w^({*$my@}pL*V46g4P8T5)76r7 zb8L5vPOn^4xx8{+<-L`gD|c6FcF`Gh25qBlk{)(D0JBN!9wJf!(~wF2q0q+_da*(! zg?~CE_q5C-(=uP4mU-8-%-g1AHc!huXIkd)X_>{-GLvMcnF-y~WGaGM0zb*y7F_B7B$yOPr~jH@ zQcF7hSEpiAQ^6oEe9~VMoa>LLB#~5*6BK+#An;=nc?=p7lj53JG}ASbW`LJZ^8_IQ zESGWf1Rj5(WOQQBER3ERNF19OP7?k2DG610C`p({V|3F{XQDbbI;oK-Bx+)#6S{Fz zo3{{hQ%j;ImY_Ez37VRdMCPJvJ$y242MCE@yVjEqTUz)v&07Src5Msnm()A!&2^>$ z!-xF~(w3&NQ-?EldL&UD^CoT|J+V3Qh_@wC#uv zcj#Bpn#KuSu3s^%<&+)*w5D;`4g`6i=pn%M5crv%k5+TNTppzKe2Sj$481LbgN?(s z1cUuLgB6{@XX?y7Q)jNCGdHcnQaZuYbTo$%RCI!x!~dk?`ww(-|E11pr8#G4?B5(@ z2S$I9cegZL#wRY@!i{shRBzZSHXIP>k zJS?zf)Mfvip16!Bj|valg3B74nzvjg%^B7?N*dJ|o-wRt>sd1j9zWx8H}*enOTmnP zakClxW(E9NXFdKek{{>EXYpq}&Y$%-f7X9l(pk#06ssTCyhV$lEe+FB;Z~ZVH#ao5 zd4erN?c(A(#hM2NomY8w3VdHjMyw@a2oFtUhKDLig+mI5@FW3BQWl?|PA5698Wi;G zBoC#N#PHCBDLfR;#`(h<=MU@XNHhQ8Uk5*yoY!%l5-NWkOO|$YEa4S}4scso%H^*x1QqgE7>Y{yD>Nu{7^>uM zG@@GW#&Fcg-8c&a zlzbGe3Ox^_x2$V3Pb7T&U0mI9L7{3o%*#7#AsY5t`+Xu^7$rpV5vM`Oml*Q{_LS15@S0 zSb}NtVJtEG~^irHBAHuKDCLh8w%#aV^GR%|@;d0E9|AZ?rTmBQS#2oogxC(RR zKVmt~m;Ze0zm5BFjrpgzMxt@i4BJ-^3%hL4E^|;zs!m zJf_gcu}XdePhgdN0GqK|K7a()$Oo`Rp`Ex%-jA(VC-28Lg>J`s`E@+0(5G;-{5q1@ zAis_s*dTX*VJB{p`5u|ukvU>|-jzl_%u+J*b&m+?9t zkYC1rJRrY>19(t=32!L$P5h7iBHqG7@{4#|q3_^-VfjV8i$~=ba8RM|;W7CIysyv? z@VLAeAL0plFFsP}AF)|}9)Cio{5%d}tNc6;W1IXu{*3MNAMmk4|AHswKj4T$KfzP- zbNCcV`8ga_=x5j=@4;WOOWuRe75W99miORGJT31=H=dDq<10KX@5a{({RX?`XYnoe z$j{<`J3J>pi@)Iy@-ygB==XSDeg?;|SAGV6$6onq{D2qar|~0RmY>Ey6nY%5$h&Yt zp}lxj-i1EwlXpT^=;@fQS1?`w|4U4d{uk5#i|PNx^#21)zw^JC{$EW0e-x(wf2p57 z?EfaFkNz*F|65FN|1YNhx1auRF@5L%qcEL+^0irEu8PmiXfS+>T9YJ(ZInPIaE3vz zRwaqyNyeyKr{S_E30&H-mpfzUh&{DqdTY-SkJXM5duvf&+gr;&r6uL2peZ+K3eFX9 zBEa^XkW@I1fUpOYd?9~KKUS$=f*)fgHnO0s0aone1MtRwn= zI`0!?Dl|m%G#!Zm`p7wO#>8W--A9gyM~LnEK*rf zRbFPdS(!rB;c$qH=u;8uFqs`RmllV^MRW3EgX;=75jONr3Ao(>`k*r-R8$n!pU@7D z#cKx_6xQ;2ay|VY_MGr0v@oG^flh{G&vs<;~Ad>X{?IqepTB?1T-UTzhCF4@>(bFyV9&7FH=|+8RtynAe)RvZz zVEQdiF?ymOt`4|d0X3PcuugYCCA`_^j`;l%@@Xmr#V+|O!K50Bv-rL@seGJ&WnA{X z)_Xmht()DOJ({yHB9c3Dh*TXfteQGfvQ&C8NVRqqI7+H`_9GR8rp48LCu* zoK)adf+ro7qn>nRI<~0!zBP|DSha}^+a%?0DhzDOAyY?V>Ii9Sb^X+uy6TD%6{9Q6 z`l%+}R8yTYdg=krC*<@jsr|Gvi8{d-gyc~O4 zV_&v*w~F0jPis%lmtuGN>}loGj$bNlPtS>d@sZTog5qMamuvLa@TS9|pla19nL$whEvbkEFBu6E2 zn6FM9t*fav#z|bRt1e5@zdbcfhvJM`k2+(huP5TM?%vjJUKa{~1F^fen}5s$id(x) z3MD49V}N5oX-UH}sj0AmIBF~Eq8M0J6D3kfT@*u$YNABcnxn|l8=}N2n4_>$LzE0I z9~316ss}|$ed&-W8VZL*VbU0*Bs0SpB^H$}3J0-8fs-p8{mjahWOTwladaYg{FG)% zH#B=-wmmy5yLO0wPCkNq`AbOh5s2~;Smh%%{YMMhTZvVjwtzCbrXms!sclw!d0CZ8 zm6BIiRp+KaNuy@Jpi4i!WBvuV-+sXbx7T)zAK$@0zLl2THc;eUt3>mG7lKQp?HAOU@FY!>i(CdHmlj8*ncQ5LL;=b_K`e8 zmf5Ab=)CiPF4DNnS%%z)B=TJcp=3fh!)ekRUhPZX|3F{z6@%X7$_SBBeITT;?*v_* z&TYPq>fA2satl1iI}ES%{x5U;ZAYKn_jt(QGU*L}uaFVd2VBU zZ__tO5p*b*oPWTZIE-%~;7Nh}jXsArjT*m(YMv%{LXU;Sn{oz6dXJ#ETggz6q_acz z5L4elPs9~wq^S43vam~U;NLX;ME;n4rsDe&i^=0#%~T)WDSrnh_jDF&^M~l1$7x<_ykqmHcieQNu~%iV2MA7LRqKzMkW%c>s6ArU9u^ zZCEBvp+#cE>2kR2E}P5hQmL~&UXRb?_Xz5Lyht>XA1R0k>I{S4pfhL<8iPvBA|X?b zgn-2@k(fGHLZMJBk+3l+5sxba+JZrY8KF{hA>+`HGV|||0kyRh&B+qKktPgX-tUhyp zJ@c6}>I?PejCwogyjE9`-{ecl;R@CptqwoG%3n|QqN&co35osl!L!{$Y@%Xod65Wr zB%;zx9Co{d13_LSFA@$>o6Tx>*d6xrGIJ&SY~`H0M_p6oZ8SPo&bfQ^)kVHxqP?l1 zz!e>E*4j-CF=uqZh&7w&hX?w;{p}ThgDQg?2A|t;fQXzAZKyqW`K4Wh!>(}O;XOMp zeSL7ql|zDi`11b|fPE(X01viwnzf#!{DWjPsiD<*B+oeWIFFz+?xYXHKsHJ`(O@u& z&+4?4OH^c|WF{&VCC_TpUt!XiJ=UG{AWU@bQ&8!&1{byNqAOv7gT5~5G1p{&B6A@U z@fo@p+4voKJ!L_>Cs!->c8f{}sJ=Ue_Yivrn+Fs-iTHib-ZLVlC1_P@*%VAW)D(yY zO{XxHt|tNRD|;7kN&MgW6)+~wnnWkJJr1yBNgF~u+3>9{esnDai_qFo+?($-u$C6Ud4%p>CNpVk3#R%hN zS=Z%V7rie3!RUkeyA0b3beU$oz0y!qAmoP&d@*aDFB&#jGq}OHJ~wyU|6%U63sG&f z!0a44DW=f=!u{x}blIw&AxEG?2FU~=Q@81KdV@Pje%!|Mgk5ARGC;|H)NR^7n+E3& z$)t-=2nU%8AIU@pU5Gfjxxb-`$9i}>?dj&&*WF!TEA}1{yGgoa!Aq9JVx=W$SSDrr zbIeYAZXjX{Iwe@bCW$!wR*9H%tP)8#x|J(a)lgGYgLcv$YpD*V``fl)WlnV+tyEl^ zMx6%Ls+1>Ct2NN{(rcZ67PIrj+XUaWH~F8q{Gvx(YMnteIp*(}@tcn$Q!nXzZ)a1G z*WJ=9KK*LZys^;*4_?*k)aV^z$^GYjuxj9pjwO8`{SE}r%O49wr9urcZCy}9kd(iZ z%FD_sO#^dA=8Vd1sJR&G<-zM}ZWC^)yuIdu$_Hz9Sav%0S@v0fyBr@{{^^Krfv-c%<&{yyEQVn zJS$1oZZ{8BhX+?BNv5Q?4QAQd1DJbY@lKM7Y`XHP4A+2il{)jwon%F-E_la>1Lu(= z=ZK%02NaJHdGDWpS4i&>^MGRB@8KY-Gz7C_fGGu~*%g&JxfZLS%B=`Xy!#@NoXUvA zJ3JEa!w_C6D_4?OtfsZS1~u)(o^rU6ldi11tg5mi5=nPE97;^7r2dwZsv~Aua@qIE z1)mie9inL6`1pnwW<1&IbGuw4+Hbl0ipd+|qAA1VoV@IR?t5RGNgu7)KJ$*F(@I3M z=rndbwRrUUiM)l8Ra4JfUt3|-ImGDTNxOgDbUP^jRysQ<9EBG_ydh`HO36TIzw|8{MEXe=#hC&5Zm zZt5Q;^fPIADmR(Jgt6YY$XlC-^X~m{h4#J7>2KnHeUr)b87%L_YrO3GzVF8b?x zY&mm0JSnGU-1zD<37a{tdeAxi)4OhL&A@Z`2b9#v1q@0qoM@Izd$JB>y(b>d`m6X& z){mlp#$id4N4Az2i7`psl1|$R_U>*rOb?qtT&BzV*kJebvl=*C(2;0TkJgo zvAd_WC)E=>BYP}J`mK{T<<^WHSDjlkcKkG=?fb;$GC2e4)3W+nUrEU9vl%SBcQl8r z66Q05QexGenjDg(KS&;1jxodK_6lRoWUQHg7|q4zdNVV-veQ!;t*z~~;;~v3kLf+e z%dOwHq?*MUF`@K?;$7ISoSw$hr#QIrPv2X7w8cN5{1+93ON0&ZB2Ela@Fx9@88?`3 zwA^R_gg|@0U1MA4Ul&*vT${Hle_eqgBTDiD`Po6fg->@^-u57E&^o+HdcTz6&WGFW zh1a2_e>`5P%2(WkS8FOV`h9l0*XPj2d^#QVX=zTxXe35sz(|emqPWjT_&3HWT!p*H z0HQtFd23Bi-n6!l;l@%cb}NK;i~pSqZdfK&1Pb)FEMun8V9YQI>PT*0ZZtPPS5RBb zRx?!xa|`r2MI>Mg7m-|JtcZln{-QKY@eW(se}9nn)?8EgWV!MVkIiP~PNTow1k0+b zDl02^uP71@67N}xOW%9J=AyCr-ixoDb#-4Ymuw`Z7wl+t*Tzn)5iU47yumN$hNV01w(Pg``=}VMk5Vglc>>eS* zf20(8R=zna%VhRubB3sDlyk4K}ixHnfXC@PwArqKw@t9M(KxFcq9III@0JIBZ4 zpq+ph0bKU zg4x*K%uWTe*YqXwNP1*ItDthX9eYISF zC5OCUvWH)awEmObw6>$QJs2kc1djdlCge0@P(VPS3wm$cs6gdD1vcAxZGS`;e{A%* zU4Bxm2&F|U|I{zyE)vR%gZnMp9cM30=|6x34VZYJcX1Jd|ta?~?zu{H&t6J?f zbd74Qc7@?a%Z;{M=|+{dT3xLzf7jI-28!k8a{EB1wt&VA#bT~G*Iw)#L^V$vcZ;3o zPD`gPVc+fC>C!%Kd_sJ{{CmrNw)^dyosYP*lP%-zt{6KqaYs0kW?RI^( zsotEFk8RC1)r(2_hplF3y`2vivaFtZyVLHicXFaj%7?caT|DV?9;%Y^yC>rrW*+|o z4|VC#!oy5cy^UX&3VWn1DT7#V3uKz>EWS*09ZAZcZMC@SGt(jEp=hf&q(dj~@nxDU zbtKDVsWX>x3k4p3-VI;hxUX*?soZztS2s@j>X|LaiROW4zM{h)>ihF1(n7L`ku-1W z`}pB5GQ97Vk3R1^NE*3qH3P!4!Uhzgn*44Dg7RMJoItQHW_390rdFO`y0nyOVgpM@ zl}>Rtmo5n`iT|o{ZRG<6kCg6@yyJf>a47Ol;nxw9F`_GfZS)Th{wjX0e^vZu|L^^e z#$OJ+68tol>Dwj$03D1RTMRK}Am-Jjd_ab(JnaLVW*#48i`vV2BpgL3- z5BrNy6>+)D5hpE#ueeCcFxMAJ8OHjeBCRt&94RQ!>9kt^PI?&%=_V-?s3tzKJU1H= z5=oNQ?aQ-&*Jab}B#BCVqx-nfrqF@VHz6UEq+ZErl0;H0ej`%RRWoYAN#JR1uN~9d z+J2<<2%nVgt*upN2^8ev^F+mn#rRSIhaaWC`@anPeg-6@2BQ<^iK7!aYb<)fE>U&5Xg;%Mx4M}G%|M)GpYx%;W$ zo@Y`Dg*I`-X;)B)ocPVbYwww|Vy(nui|=`KQQ!BUT(ouk!^`^iQGMU2Ga>1vE2rFB zS$EHOO7Gb5Y-Q891vO1~@(uZE`-zdur92HZ&JvvM92INxZV(T6e{}vB(?5iVyfo(2 zi9;uUL7}`AY}1*BPU6jDJ7)}v>&X(ua+@exZC-=T9xC9XY(y4EC?aB{Epi|tL?ZdI zNTeX<4aJbbxPo($hVZ$lMH;5jGhU7y*b0(bMI0a{t)JYi*8Y#9- zx9zquTawgml^w*flUxHkJ+L+2$Zco#wK1{h)7G9=K6BsQs!Y>~iqWLb;^OO7MX~Fz z+YO->Z)0&xOagv%;C<%2so55hyrRWJe`~37cpM%K- zg!_dJh%!rRVMTJ2UiH zM+=#1Z+6_^c*yYzecAqj!y0vRi-JN`ilv!{P7)MLGY_4VY2k)p632-|th9=v#p=zp z+Jbpp>dOh_EY6|G5p%}n?8!Nhqsmzy&B@7&dV^6I)QXDEsPpTnQMX%nNcXiAPS&Y( z>s30PTIDsUgn*l?SiRG|mz)m;J^>P!+YbdLf8Ry?F5;33DqT`VRfTIsaivQN=Tx|) zNM402A{nFp==A9F=(^~=(f!e{quS^$x(pN!5|6<6B%rFO|(X|#WBr}iXi z-bSTJB~8+0ovMKC8PdvsCXmD-kV47kw~{?pVvUF@0@Ya6I@Nxapn8VHk&i~w1gFw8 ze~z`bcel3peB~04xcM4YyYgk2PhDbfyW82V__+4gBQEiXQ~U}iJ9yox&R(rp+uhsE z+mH52aqso2BIhZFhp847i=EM?T7TB4THF6u!Kqd?IuV&TI#DowO7l~61$8^zc6S<# zMp}7Q5IF)@W@ff32-8!7yWC_Om{r#Zqpu{7l9U{`#xG{`v~P zg3C1=srN4W%gVnld_fUZae<%JpLkBF>+cqx2(jW5Z?Hd|>?RWa3w6RgVFSv@Jv$JR zk8XAN`3&z-snX)Ae=?)fdo?oV(Vm{A4-8&^HXoIsuw}u`F34ag%e-NhX zpe}3+y21kg>Ku32m1&3V4)A!UHx~4I13|Al7>bo9>HS;9B2tv3e~>cDii%3hysav~dnC*6p+3PZ!3Uatkd0s4>mzNXv7KB3~B8E(0E?rsJQW}ZnL}CSj zNP#dw`2@PU><8;$49~Cr;Qt0$8`79_SSL~ zRzSE{f#Gic*Dcm6;G+x@wP!eK?JxUp?V00(U)EI680{FHaHUt^w!&$0*3`6+)^@bx zU%7D7KYmDC1Npgt-tvJmA^dkfYWSdUT^WxZ86a?tqFLd>Vk%`Q0nyDm1C@xN|+?+W}aNF_w_-%z&zsuFT|Frpl_3|O% zT($yHRFRp|_(wGN`yVM{5lyatkg&vZsrwSo3hTA*4c6P-k7_nq?{_~@yj}Bj))wnF z_YU8_te#Svp14Q>VRxHue|6K#i&hnFEP5pC(V`bh-zoj1R2vN?=@XJWw>X%a8w!S^ zX0OGOUll}EK4IksUA!tu4og$W4N>UJgDgWAL|lw7jsf4iy+cAYXK5*yR| zsWQPpVtlSa8Eo+7-R|Pn?)vWf+8(9*m$D{h+VkhL{V6-(P_Y{t`3F?U-=I?d1}?d0 zt65v5?O%Ou+qOPaU}9k;4ZEf8H>5#fq6*0y@#5&zg15xO+PnbCY>t(62{6HTRrLFJ8E7*0Q_r zT6EcyM)8Km^9SgiW|Q9NF8Ix?-nW(h-tSG~*g+G{o;P_qA2AflhlI((QDh@Za<*`X z`h=7r7Awv)l$mYkaf_?i=5pC>p=_Uqk&HmZ(3+7Xv$jWqf4V@BB*`qPfMo+rqs#CH zjp{>cs&*HIn_vjotddbzZ?rD59tftmwJX+0lnX59B;Wc4R#5dopjYYM=IP;Un!4)#qB1 zT_`1Gs=*lze`IXNNZ+|+lB!kHnlYQ4uUe3?lwPjC+_%hsqi?7Gnb7uJJ4wplbY_Ur zr2P37pFOp>&`R1{h^eZ)3^psmp*&moXB~HP+TuAWxbt9=sQdoD{i9o6IMq{Uzx`mt zh7b5hINJNxi+$h!VQ=3zFFv3w1Jx;O5ij5S$3NbCfA1gv$k&48L&9jb0tNVHdr+TY zW9f!x6K|=(2hUm^RCm z?J#D7f0;6HgDIG=$=E8Wvw!ahhBLATXweM*NZW5f*X9 z_MTSH?Ibp)J2kJ@lUnfUuJ1m=QQMRrYVo>G?U_P*t1=PC2S@#DIO_EB6Gf-1qXnzT+fg-*YT8o41l@{ceZn ztQDW%ao^h`##tSv*w70Jdubn0RRR>>h&!Ge ze_SCFF-g{JjTNj&6_R+YJzYM0Xj;pg0v}}@5xbA{@OJRaQ(C1Zsl6e*5p2!UnzbBa zPPL02D3HJG3|RB{Dtkmex;3oLah=4dlddbQ;8A*E%+YVkmeWjGpecyi@aK!)Shnnq zj*o6v;)~zA?e_QHyZyHJgrmn7a%}mZf0vgXzVugzE_<1Lkh0`WAAPimTQbE8`H)b| zR=|Y-4oLI$_PcDfj1Hv}=q&moebMr&>jU!#u8%x_aem_ehdtAkU65TtYkZ?TXZxpl zruY|m7Wl97tnu8HeV6Ykm2s(kXZBvU*ZfNMD?YXM1(Q1v03jxC(4i56rVK-qe|yj- z{ww4JN%D#02n7a_L7S{(k#)Cqzx9w+u)2Z;kDX?sW4gPQ4($=eCzuBm^G-(h86eYX zx2lu!H`_c`zmF#6FHb@}X>BJ#`x%CL(lVh@>{cTbo_NUq$;0QpKE#qGI>nOjSH9PG zh!|gfo#-dK-nr$Lx83A7_q|kCe{OV{Ok&w&;(6sMqVD_K%GFOiww8PNgMctaIEo7F zlX4})IMoW(HHMX?n+%y+;&pdFCQi>#5Z!Wr9AdAm+&~$d3CF^W^&pAC9kFNm_rt zZhmU+HN8mKze|T3qAjgUi;04xy^A>A_avuJK6cZk*O%LzR;}fZc^6$uZd8Cav-hn2 z-V@!y?Q!`9_t>>|v)REMe+wFya|v(tSN2^cT*X!(59P!sl{Q)zTj@u^w{pJ>9?3l( z?8#AIn7^=aR`IOz%QCOXZ!ceyzoPs%`8St8n!l-hr!R|YIU3AV079oyX>}nAU#!#_ z5FG)NNzC%yQW^~CV?o>!(P#%zHBpnOH$Vb`Gwcc6|7v1$oIHcAqQxj(*M(fX95OYjc#v->=fXmJ@u>-`Q#;C9N#)5UMXM%@hEJ{DR##PW z6rq(B=JK-Bp@XeVfBC)~=i+H&zT)h+qb|*}U;obI$B#e$&h`7&u6^~@wQKj$m+w{( zV@K1__<2!>#o{Dqk1QB+Vh17Hw-fY@zV)@PTW;;@0^z^^FDw*}qJ~^772f4O9-soT zk=g2{>hveHlu;Y(yf zel%(_i8T;3qF$>DxDGjqGfD50G6o_TDBWGMzl4?~$roD(oHe5#^;=Ven%dre$X6zp zOuq>D|8_y+f6S!R^vw?bqeELgITa)+AMP}{D-esdC=F6{dsG^Au1Dqa6SpQi)g<{w zic>S0JD`?(wg(J;YpVCtLiij!F)6zzPW4ewHr-S|R`W|!nq#b&EDl&Lo8npLWh!Jh59&1MT_vlnQR z-1=m;I@6#B*+r&#tZ&M)CLVbt)49qrUff+k&QCt9V7 znYIqwH8y6{8Jao9Q?06*Bf8mXyUk<@Iib_)K>{XG94qb?ndowzo_l38(=X@x7jt~` znfd*W=eOV0pH>MV{Qpe|yV(j1rv*~2vD#RZe>K23&{%66Y?O=*#zvhvVyH4~^K{0A zJW@sIr0kiRnb}J;OR`l}nzHOhO=I>XjjBXjJy>adhX#^?!|MhP99$Qwwi&s|7ci4? z<^$%#=5Ndb%%WK`GxP8)v)PyxvgP`fhK-OIqM_lwP{{8KGxs;b;vn?5ru z;IK>n$`bnuJGGyPczuDq2#-frL}=th9f||>b$sB7y4`jA>sX!Ztb)g#r;Ty=&hOfj zL2BipHig#pwcY*m7v=%@h1UIVW6DJGf4^+}YI)CAyVCf74gzTu2t@OpF1qW6?SZCVSI3dBK}xepH)~kb5cj+@ZpVv&Yse{om(@# zLuzWA)BBdf-`p_Sn?E}hIn{Xp!2&>-%vPX=TrX9>qkczA_p0}5>3!Nxb*GlKYgTCJ zEX{1~Y!BP$c|c7s_irWJD9iR=f8eJe0;N8!IW=}L+Wa%|&Rt`@&qOw6XYO<3YMu5zcEZ(4?$&W_OW|Lm054aDx zh>N=;QE^A>OE#6z5*PPHrywrviBiVd+tXd&{hxTA|1&>i^<=BG8m(GOf7RJ4x1V^l z-jpvYP<)Z+s?r_Bf3l7~ZJ(d6cvTH40eOjYdR z&&qQC)e9$H)_%G-O54ivmSOq6)gybqKIM&CE^oND_uHQt2q1Z4j#^-`UrFjZS%~QKMDJiM@n#X|HJT}Q>_{?YV z-x!uc5tb2G5R4(Afk$$L$Y#8_#AduG&3|UR2pV{VmUanoFCxVSFOCL9;?-dZ4Wh(K z=#E!>ft5U(PHeBUe zm#qX|DlWWsnoC+@ms;KkGQB0%mD8@G$jOowr+Y2<7!?6ow>#Wpu~8T`7R?7qGsAYR z=(@IRyo>76%bj8w+M%_!R5nw?0e}DJ#rt1es_sl@3yFoOP`v;bsu>faRqt>9`%m)D z+?wMRM^cR33i`05m$-``>@~4ZNksJ0!3tf3{`o)YR5LpCVUp zz51Hl53k?TXg=Qvqy2;=Y0AaO+RfiN{MNU>^VZ>jiKf0v{s|~T*_ZB4!hiX(74%x+ zPlX4C$HPyGk#rEEXJ2!&S=+JGDS00;0W|3QF-g;8$xao!(H$!a%X5W7cg`-xlM?>907zzzbuM*+5A{vN|jC*$Od^ISPFmbZ<4(95<>V2SOsogy2IQt_?Oi;#MejO6W>4by-rWRe}1iEXlybfCx$?!ywIWg7PH9&NduDC-Sf}4cx#ld!-3tTiHcb8aX;O& z*s_2dSvh2_$XuHl&wr2^i>%hI?o${*kLo_KCp8mu=@Oxj8<{aMbAi&SGc600^(_%TNDT!~SIvsL-$5y2AKjuSDmfnPj9>I^2VV}UzvJr zf-H6!M)unoL(yyb>QHf@R!Fm==G=YJEzjIwOGzX1bH z`*M_`B2gQ1QcUJqju)hmp6IQ^r+hx+=5i4iLJ&?^dR*E>)!|?J(){_+nAu|;1Zgg9 zrf*BXln$lq#0QfLP*Q;Us<4E13QLWcd7PaIMDVjn*FZZnQgl3S#Ik@+C9)vU&TuJW z47PVTFMpjWKlTiquB9n5+y`I7hPb+6-O7W562obX`Jd|^oA^Esl+j|4tI_73{l_n_ zUSu+;AH}-l&o&Sxbn+8)6Z#&nZXTglk*h%-%6@{T_9#R_fku>#VGEonMH7iw)Mf*b zJf2$K63O!xI$i*BFn6Ju%UPzKhYBm1mJ9NlP%XfVJcx?thJ8akX9@z2PUHrAZVa~P6yFeM1%3s|jA{3GDBI)Bd) zyB=vg^ZQstanbk?taQV^hw+IT(!*AgOdHgn{Zf!kw3U@=vq^oATn!53a(`Dr$*T{L z&niDu>%?AVw;BZmN8GDCs_az$MmeH1l;}2M7jc*%qf}JZC`~R9y;MQYt5vEhUqoFb zUrAjlT_sMcpB9Q65)+L~N)2O5UdKAzq;B@-Fpx{rSS{ z$|3b#WlH^}GOZTlN=hjbMWv{2)HfD(C@&}nLkFdQQ$B8&c7JQa@4Ys5 zZ|qSdpJ!t$V&q3LxD#VsBpZXV*j9{j*)5D~!solXN|@oYOFcYnU3`(2re?(0TH_gTK8yZ&_rSa<l#y`})eUVme4*sFNzIJyY5 z(sRE?YFa3lTy6Zbj`p&T1qcNRtYc_%xVuXcvJrx4Yn6!%$B1lL;;lFXB5usNML z*W5c6Hm%uPUo+7=hw0q1dGh-Dqic~GdK?AL1xTc4r(wq)zLAh-PY_RZ?&BK(pw^PB z!6@-ve{+`43WQMQuYcr;6w2wd_I2=9VcZ&bt{Z(BzRbNTylK7Ryiq<-IWWpbfd;nN zBq&2+lov)F&UQGfvZxHLO4;EA&V*$N!g6I)5CqezNS0M0T00BBEO35Dz(zqP?x@xrVV;t*bN`w2P1P$hV5W_T0f=D z=-ep{*Rb?UrZx0p1%9Zc^Ft-XVxz0m#*D^Iqm$@FYc_z!&CJZqoH2xgUXi^(X#U-# zUPi3}QD+~YHG z!CO>s9`i4b3m#7^>M&39!tm&ljNm~uj1H!G529goFn`5)5DlZK4;-SwqPxuD3fpB4 zmnA(l%%Rx5jDmGeM!yxFN9)a3COHWyt*`hDCk;C_P8zn*aL!f)6wt$fC!Wg{Av`U~ zU%UvyfDkwr))sb%ZSejci8Zo~-=IzLP-Ac71?=J)A7uQ$Y7V~Icr>CgE!J(QaVXH%7$pMN!Hc5!3ep5Vf_$*65=!*926%Jh9%>7@ z8kFHte~AV(L9>gDr4GOWeg)&JpNjuw$7A9$@nU-oT*KcX-eGSNH`#mn{o+3Rp#9Hw z($-?^$Vvx~0K2PX5Dxh)J_Vpq7WlFl1V$N#DSypHL@7ISUj}Bj+L?@Pr)&oyloPxA z7UJ|%Z84N~u`I>{h9nf)8W1Eg2vB#{gwLxBRj8J5hn8)KWdu@A__yZsB}`J<^Bh|& zmrci(9LMGb!30nOf(T&Qu|ZdYnh~^_1#btzb*^;~ zb$s%{t1epL$pDXDf`Oikdu@?+CwhnzcM8*<=sFpAIL%3#e8AU3RsF2jMLAd5?-_QghL6f12 z2OC?wO8{*CnlPz%i4A}OhM$P!K-^#{Jz48Vzt}W)9F#6O8}5DT(+6DOo{l8SbrdE4Va7#|3E6=^3(EQ4_OO!Vo5vuJc zg*8=v2Mke=M4-ympf=*sS~z&(---ZI8m0AH%uIGqDd?uXToV^2x$ETn8sHo+ln} zIg>Fk?`~(!5dH}Zfgi(?y~A6qfoB8<;X&(qfw}j!5DL69ga_{pF?&A`g+N3w6(_sM zVW?OtTRb;(k(-M~ptCDzfpYuk24;Xb25X`d}K<)>+NeM^N-C1yJTK8cplR5w|R@`NIi2?Hcq*a zdGO}raT>lpZIY%D6=bIqG@^&-bcaTm5jQQP5s;A6M;dWUa(YV^;pmSYC^(H!C^}Q1 z5i&(*e=;;;tGwA3SrnGN6;gTp@kJ}9qZQQQI#@rR2b93b9#1ew01wsze8Q?dl7T-9 z^1wy_BN*-w6p{hdLV|!~$l8N9v;r^>?SVUho_WUsja(iEdJ9Jc4fie!wgBe_lYtY2 zaXD`ZD}-BxwX#}oPVBkML#K9(ZY;z^u(tHIqobd+sV{;dR~vT-78>S`%PviHCu_aVxFko zq_imS#`e}GREb-%|25Jdf3>tQ;~@EDaS*Np9N>9C42vj8YJi^jm<|Mjw=k5B! z>eW9ay==Adv-LDduX~y_*~Qo74NEnxhPTOPv>Jtk@%PvJt9htCd%5#x=8?b9<)qg+ zkF|y6*=rit*xLagncy7%kGDVS9R3ea7T}PV!2$#nmvT-8dzfNB8jT(EYv?H8BdS`TQ(0h;(l zJ&TuD{qaX}fK(1>Op7~L^&lBq0H*;+ig><$JFsngHQSfPbu5*1e$fi;(n3fbIpbcX{WPJ=&Md_X8vj zfNe$R@`ZJ~JI#Rj5g^p`bgx=HnuFf~#KY)4D;M_sY3olf0&?F4l1u;uXh2~AQ4|PZ zebFwwf+}o;8Wa+IXah96lS~jnA%I__4h({D?h7vhs2?4<9}oveuTTn9Klv8VTz{UT z{zviYTI0M9L)A%*R>KKDpVeK<@CS$Hl#O2T^)%H_w7&*{_G}5FI7s(G1&!(f6&s<9 z2o^fAh?-O?8l%=ys-mLETXo(wb4tAp?0#Hj9G%H(NEgej!3rRJPh>r5LlOWQ&6ybO ziA0Fl%EkdUh!9~%9`fNw87fhONq=a;49vz-^k6mCVJjYICBlY0cu{~-&Q*&ROvh|= z;&QCS+6b5O=YM%GP!@bg-+uR16up1&&6~vX+eN03DdcywS;!NHR5hv^)e-dse%}(k zKVi4#YVAf{qwe##t@`KVUzC1il+V9SNv5QPrHN0nJ8A!S-N{d;>`Pr^UVmm;lQuuS zC!;ju#f%qipW82ST%8@vKJLnK<>Xk$eUQ68cYWTyo&))p7I?%#EFNowILJO^@4suT zIEaVO3-1*N$!pQ@HgOP-ii21o4&oMZ5cfyZ4~v7i?_3@-_>J;ro(n6li-SlL2O*1t z$PfpSDGs7b97L@+2rrZIFMsN_K8jhszVpib{eL))EN`1QsC*(0Vx>5U8gUSH;vnvh zV#}F6+7RVy6bEsgIHW?)1{9EyOA=X@4yiqKk9tq2r&6un_aHGFty;E@1^`o|SbmI;O+(+QXY}|``@f8MP z!b|AGpz;~&a1b*&|2Vvadr^lM$u%^CT0t==I&qLF;wQu;JcPBRkNiXEz>T;UgBYdH zDw8lBH{r(`kMaaukg*(B;|~0U7)X|~LOB98l97u><$ob%KRU4-+Yu&@3oYU`$`(w= z46MKpv6JMBLGk60Kabv^bStkT4!7Z95=-n96skOB4$@JM0OsMhk=7HNm^-43{z=&m zHQcDhboAj4+=1tD0H2Wta!_=sFiI4w@>}IC#GnTAa5oW%KqQhyCXmNyitw87HMc<% zF&*=;5PysLh&_Tw@JnpRG2$mBq=7cjc6uwlo4z32DPAL9J34|sJWW7El1F4Rnam)M zk=M!VG=r`at{DZ?XXZ~X>d}ac(T?TVgnO``*ZK%X2q6MlM7qf}gi)bsc@&TOC+K!-Yvc~Y8?IfXn6FP(x|j4r;&^KxB<7~ zPJjFy593kn#B&%T6UoJ78ktLiWCgjI+(sTDFOW~ENaxWf1((n(tQW2l?iNmpPI0~X z2i4lq_R%{>cPj6_0du~k1nED(QR}eeSwY&u|k^Q5L`l)uu$j~t`Tk#9u|Hnye@nud?Ch* z38G6JFD?{+C_W}WCms<`sV1tXsIE{O)!$QZidv2fJQvbP{d5tff20irap=L5^d;)W z^s~JGH}BiX7uZkg@BtY)vzxgMx8XW`MDoZST2KChhw(E~Mt(>hqyk-t+sFX6;z8k; zsiMdR3Qdx@xkjUR94(VY zBZrj-mFLJSqo?pNS)=EQjwp%Bol5oSA+m{-e-I}|@Bv=Me%y(j_yty@6_X*; zi-?3#oWwBR!<%>&yRi+o;R*yXTRjuaSOFJ~;D)F+E`$k>;06eI6ei3=0C(eJWMLjC z5l9Zn!Hf8%@}Mvaw_!VmlnAHiv8Ahj>~a5vmIG>n>8~dJwjgJ-UC1eS z+Cq!I!6`>L<+GebvQ?qV>#;RDY@xvhhb>IzPHT18Lf>z2wAn(#JUoSmMHi3g8yszR zyVqm0HKs0Uu!Ts_))<j|0aTW>j^nkH;)OkHYY(Ty8#v4yrye``ITYG<&mE!FGsdP3AWA-HiuNbdX|>%~-` z*JESVXHAJTYN4Z%r35dtg|v=3$C8bg1v_ma%f=96e~w8Z zIT*4nu!S(a)e)l3at0QbW8;GIG&{T6h}SbY)HSWOacM|fAKWNavUHX|q;g6Q+s2a! zk)UJv(+g8NqbX{qbP_Dcl;f;|g-GXEIOKMR^75Eo#MFn>tOYeZUgGtv4bwqKk7Nte z!A4sMEv+Ha*;eUG^?K}fHmbLWe`U<~dhDSM(^?~O8|J6=L-x7bLNv%I17nn=S&Xt_ zjB+-6&|&v_cJlL;q>#pS_RkHuRBPql-e<36VFN(l6 zo!$N)W(q6ESuT#wWs6obRO!AjKK_FE1=Wk&C`_Ii5?yri%()vk>MpGMRCg%O8PYmK zDrZRV48`+sg0nw4ewN!7iVr#+wvgd0WPnJsTHi>sx7k{4p_zGYc6(Loao_Q(P>b8^ z3B@`?f|EfNFU!E8o)?5(o z8W_23(^<#>zEuNO0jcWW*TKO5Qk)^PGZj*m<}{*p;r1a!BAwsT8cgeKV>6HashqP~ zLu%f=c4kJS{T0teNc=BS?99p2TSLw6P_uh_tE26@$jr1yvYmH%e?1|=MWjjNy&gwM zaDj(xE{DzK@Om6fDQ&?J2|72Hr#b9xVMPfttI9io2AwuW-WUwgpd&ORk5OH=G)IUA zU2V2tNCzg((BnyQMcVee{P+&T_(5AnA^Hr0&KU=Z0)Cn)(7j_wr7)Dr?u|30WwdeER`j) zh>b-snM|JE+D|o{KW(=RY~WOpC-C@!Fab}~jHMAQ2-8TK6cOa&f@DxE2#XPlJjN|z zL0A(>+YsR%7v~8 zi7+Z(BZ^N9 zk3!{dsN%31Math$gJNYE0hB1ikWs1(qZVb#r>Ntwe;(z^r)WTh@+lfop?rb~s8l|| zM2uHH!9}Q2{)$PcR{n}6)F^+&WYj1h<6;Dqk1++Z@-e1z*o<1`BebAS`3TcEoQ`_s zL(JfCCK{CwF$)uwzhE|pb8wOJ7v{?=FkC77aofO(jr97Q{(Do1fC znw6vIe?W`!X9O`#`7=5(UHLQSbGQIAl=snvnacZE$l)T)Qr^R2%vRpR5)PN5Re2Ye zp-p)gmvgubbCq|o9G56VSixa8<|#wyLA&w}deNc0gOvy>?_d==l|NxM<|}`~8Z1!$ zgtZ)AfiC5bxDpGMKVlt+>#<0A8&_em@;0vKfAAVCRo=q2xJ-EqeH?DU<;q*Q4$G7y zxSqosuv|HU8?iz;jGH*T8QscZ+=5=^5N_r0Hmp<*VI$Tkhj2UAC~x9>SgX8=@8b&P zP5b~?D1X2vT&es4o3T#$1Ma|j(2x@BwU4UdNAcz4Ckfn8Tmo2IcqoDQ;ALk1e=SIe@LWNjZQAakFv&Kf}$+Yxp^C zQ(nU_uu*vp58-y@cX$}zQ+|g>@O|ZX*v8?b_<=Hr|G_3@5RY;AOKetN#pAd`c@b5Ws?_iIz4?`Tji>H-+cn|xOy?CF)KjRr?FOFhB*^3YGobojOg6EZ|@gZJN zp2kObLD_?k@uIQ^f5oqrJ@^DKe<{21DSo5u#xV9PyYV-?tn9`yyrP709KTh<_>9B9 z<5lG;{DZ?27*w9ZNxY`)!si@*fdk4ee2L#HyYLl$uRMvb@w)OPPT>vZNu0(T%1(^n z56VuA;!R~I6dY1^{2$u%`2U4XPvSN`ncMW_|AkGr|39(m`P`=axJ~zQf16(LAKUbD zZqv)TO|RfKy^`DXN^aA~bDLiEPi%UC+jN=R^jdDyYq?FY<2JpX+w^*F(;K)=Z}_iG z|F2E||GiD`|F2CyYtv)6P1pSso37_JUC(X0{(o)L|8M!}|G7=i;Wj;o+w^hVrsr~- zp37}|-hXZSe{K4IZTf$0fBJu5)1Uo6vgt4XzqRSx=U8j2MFO8l0Hr`$zfd3&_F{!d z5D*EPMS>2IAb2MH+L`c>NN`Lf(7+bu-6RrhiBeRs3JQFJf&ziPDj5(Ibe#DNosDf0 z6l@U`Y!wt77Zj)<3!^(?=&)K&>!K@z@#EPRC);VbkAUtxpr6+*&Scvtv}^@H#ge8LC{ zgs%_~MmSgSOs>sm;?D{r7=JjE^FWk47Bc4;K~NaMug>HOoyWyEjtgHws|*NV^^d=& zXg3e&jXZF2M`cyff!ajj#WzRsO;Nle zikC$3>?ocQ#Whh}9mQ2qTolEHQS6N3tSGicv6bV``ezhxuFVxb13^&u7(K$r*dTli z0WHGE7o=9OvbJ zgdX7|Y!E);<$iQQ%4XpsY!yC2Ncac?!bdnDeAKTs*=l9sMidA)g5eh7Mu-Rs51>bQ z02_n{uvvHjB5)=o2@k*~Jb(h>0m#AwXb~QO8W0Xa5)OglT_fQjjtd9bE4so#NWwwb zgo7v$4nh_VLUln*5MH1i=z>-F1-CV31rY)P0k=nJ1^fd6(w9VR1w#QKmxycyGX?Wy zm-V)nz-$Fn0Rxv6Z3Qj_zE*$pmq%>{AO_>`9uDtdmu+nYH-G%1-+rkzOn%;PpKcA4 z#r^gYYnUwRw-;K&q^{pyZw-^$o%RCj*Y>bTWP|lR`%3HU_9kn{USWNZrS)64a8j&w zrQK~^XwS2DMUv-4P(4Gttkw3%tlmh9Cz3KNL7Sl6945Qv;+W09iP;>C*<28_*&VYv zFJ`kVW^;DTW`AqU=8Tv`jY%VE;x%y^okpWkYeWszK$93&-jzM<+kA;?i6OPfpvc1# zWspX`>_>@)q6xu0v>H9MdOIx(B?y!0jA?UQ!?ZfIp<%MkX0wIN(|L5Dp?@vp;=wRMLtCgQ8kQT{LY2|* zhK9D##AtY+p{*@c=AImmQKpB=-IGJwmP=Z<6Y_($P`NuqZw(X7Yz-5ICEb+9Uj5q* zLaaA^KaFAKrti14A$e^eHDIbSR!nI44iJn&_qi+eT#(6bStrL?pNO$G##oDEtd1C# zK6%DEIe%{R6ET|`V>TDZY>p(RW`ypUJfk(FWVD5fqJha_k<75oYu!x)w7RijH?3i) zt#!9~D-ASGXX)mx4Q=Q6;G}`ZhTX6;#QET4d~kk)FN@YNz8r=kd|8|?>jJ**6YY%+ z+wJx-o{5}i;)Oh0FXY+EdA3G*gb0uQJf4Jd*nc^XJ)!(tJX!w%PtJGpxc}L;uOHxA{=G$z$F`f)XU*L2F=Py{oaOc7>8FDOa z2#t3%*tSn!`)zt?EhA5NG;GJ(#+j|#*UAeU`lrj&8y%euZ9AG52bNtR?zS;;+XIWg zqkpi)tgrx+)x7LG$jcbHnaNtlWG!Q|n&oCLt8poteJ!oqHK=Q=pBKS9Xspgu-x^G_ zx78&}JvDp^jJKy=o3=+}Uv`dlw}s*ybs@c@j+4B#-daWy!AbG#72GH(_1f|Fv^`{7 zlq5OoLPkd&LS^6X>Bfft`}b;ot@;nH|9^xNWAxRjjY}KO|KpR|z1qEMwR@F&&Dnxh zyIH|l6-`*Z%8mMYt#Vv2C+G=I6oQ#SJ6*M^jV11bf$w_Q{)((x)kaps?IzK#S-onk zlUA*Y2EmF0OIf{o6^S5L#rk=zdjR2DkX3DD)#^2Fw|fmD_&csKLIg9oYW12`tAEc1 z*0}jMo!Pf07OU9%YB3luXR2e4Qv#KET!2okIxYy*qKy%c6PPuVuS#`Kl}=Pm8L65o zeO@(18mU5{YNU#N3JZ#jcB9j7v@aHM+9nK~mQ^?fn>fJMhP}%Bf~YEh5gC{x$7*A> z2C9lBdWc~X8me?@Grdl@un+b`1o=5I3&=HU2z4m zEwMB-bhlnP=rRhTM_ri#J>lHPQ32$bYlj1IEv)nCYcYYBXAN)}6aa2coLV`Z=Pk!_qJU z!%XtzkfCLrTuN=p&VP8P$(80(JFU*7*i<(X^pcyTtITd>3U)V1(IvWx(U9mSmY57T zY&63SzHXeGWY>|TMC!4!$Vg;cK=@v zUG>?K$gt*K#FCN z$)`Kjj%=iaY3xpEVx~&Va@9@rbA0g(j{9epXv1{ME`o_MnmGL)x)^p6zpF=0)RvsY zFkLKbEq|YBAm`Nj5zWr=q#1rNs!pr5YBp)8#_ZZd?jn~)l((HJt=sLEPB0B_pK@ZD zTiXxZZg*gK*jQ0Pq><_hUn-=N(u?R_>2_~dvlo(CKfSqAEBSR2q+)j)VS_??+tJ(Z zcG@G>#9o53(h@({)G;ekI%Z+iw z6K}a}FtcXz{3GP$8|tejuadLs^RlbPRqb5%$s@Dw*su@;ws0HKuB_;-)@n7{ct5fxTGI>CX?l8jOuQVc z_kYL7Cr*sf8w#z3w6M@Uv0P=fvi^H_hr`MHac63pALGLG(*E(|Q})nHAt(c~R!Z^< zLcs5j4J!k?q(nbrNvyBkUF`&Vbu!s_^v=GyCgq?{%ZS zmn5_PP&=~5tZ_1%(yZT@fsUk=)zGv37=JOw(QXuOzhv$e??3goE9=MSWmr8qRZDkl zZJ+ABytu3?e^Jc1mcmu5?wXnspJd6ans@Wd&-|rXig!iq^14+}DAyKL#p*p%^;41b|2 zeYUwJeUW*$SygH#8FFPwMp)Uf!#yjI!SpV1Tm+9xWO#!-bFMd_v8XaEmRyS?qr%c; zkuy3n)>!V!cqn66#+w=O*%^fyuVe@&Q+k#q&7Us2O474pOVXQS_5Q2Vi7lfb<0^{~ zn?X#7iJF>owuV_CW|2$@iAl*R=YOY;ef3Qf6HVQfImw)wo{I*V9ux`eS>>eAYD!z7f6@KB?i)u&h-Y;H&kT?(l?Z) z2hwGoF))^od#}0-InCiuW5DfhBfaerf3&xqtR%*WK~K8Su9w(LNP>|Fch=Sf>n$S($tQKAhg9*W->L9=E2md_BgTFDV?x8}cgUBc?AL}4D}V2cvs6C*J?zKj z8Zk35bE0)t>>R@!>lKFE#Cx5OICXv-nGidNgmq!Ve%&jEH)Dr9M`Mq9PQ;FQ;B-eOP^>|Wlz-VbC^9yBJn%a!+QH3I)!~rSWfBDZ_sbn zZ`FtN$MtIH3-q#H(0`k~dq@M>7%{%R?NdfRkVcMjpJC)EGY!MT+&N>N(c4a#wKPQ> zFE4Fk=^s+{BkP%^0eQ4oaN5sMU*$Z^86T6NO12Avc~;=;r#>r7=)hcfj-hw=pXDVc9a z&hsi0&i63Mn1@Nn0)i0rHAiyBoKAw75XFzh+mV24<$r7fcy-!D9TIff1Qw1>)Pd+? z6Jm*0lwuR~L>m*P8)XA@hirPCWDvW>O`;%%>1(nP*FhK5_2@R}M4csR@&l}{pSMpL z9%1IgY#FIKT2W!Ds34}4id!`KsqXk|q!-Ty3JVB{E-)#CjCoE%U}Q;=y(Z66D*WlR zqtudDV}CEA7m=QHPnNqTW8|%ow=!!yS)O!I<#j+jE$%}uJoH}qa<^>A47l87?#1qF z-J9GmyVVXi*=Bsja|CaaL(-eZ!{)=55A(h->*kmj)1}5m=2hg%ytSTNjMtlQbl>E; zKkpuoUS-sqwRtK}xv|VFlUiD@uazz`&ZezKeSco6Av0iPLK4HuJ92zlx?jplOZOWY zFf&6|o|f)UG3Qd3G0*I@ICEWjB~rQh7D-o?SL~sAS%$;_^4z(^<91UyiHte2XFb`c zGAGF{IZaMxg_-oSR*sYPG4?D+w$qg}E*G^@gb$gRqzo`;87^f2Y03bSl>x*t2U)K^ z_kTs}v4zN(IY~CidV1~~+2=1&kuPkgSuEyr)o^=^Zc4-Sa#<%C6D7%LcIW1@sLf(d zv{=kWkJ+C}O?g=`d9q+2gs^_`5kkUrM2^*F+3h-=R%0GChH0Cu72T`d)a{mXSxg6u zWXZO4SVYUy^fTmx(zd7E(gf*wNsz+yvwt1l&E>u#?a z=8KF+8DI;9hbZ z`<827yd^)CAs8zn=b$lCRaHz?Rdn@p=jq2*Kju~OtG%5&qr@I_!6qSvM5n8YL{p9F z*dh~4h0f9Vq9V4kjDFe_sJocd-OM87X>#91Dfu-#HPBRa^Ft4lrfVV_iTp|`WL4zn zSCG?2$zB>+en=C!XY?|5+K~o`_lo=YueABe^|w}j1w;WRb&ovU6p$wkzqhWXbW!){ zNizSM;+zLIkA5~7QHR0r*RL(A{Lz=de+3)?t(V<@1yKUtu$M4^1&3;9)4T`P9(s0V zbH3k}oswIVR~@|W$Gd*G_TjsU=B~CMiMLuTHBC=61yWK1c`4q~mYrAMbk|E(Q;991 zCNHmG!no4ORYbV|_N^r8o?Nz<$pFO5#eGOe9^R8JyX`N>z3dWZ+vnums+S>w1w8@A zmtTPeXaSg)$bkhNe>;{R9u%@jg*U%~G*!6ox$E-z*T3AC>8r^1RuV`44|+R0C#{^t zJjYBxTqf>ADcvh47+hA@P^nNA^g?l(}Ly5oG~oQf})cd)ht4&C)VMy&{&Nj-J0%87nF38USrS_ zNo&*gXa#MUtdMp2vbiMRE1OHaOi5hGr)_e)%T`)YDwnpD21`|@(lANcMY5evfG}-I zOeipIHPKC`e`ig!*+fj{vgr|pS=oEm$V#8HeU!OWHX8z^8b(hVu`fzl0$ae>ke zrr7A}$@i3Q$$g@|_h@@B*RT<`ez(`pYkkrwYYhQsbQR`UO5?a+O5*w3_#!W7fSG5= zI(-0a)qyOf1t6!DK#nqwt?hC~DPt{Vtfh>#l(CjFf3{LNtt84CL4^f;Cm5T-a_|K} z6Ww)+Q5+M+>L^w*mn=hP4A>aAm4QqKGMG3!1CbK+(Gv9067a;(K-wv=Q!8~}Nm&V~_^ zGO!~q*)OqybvQYeW7DjDNCgs=%>F&(G4ki=4wHERXI+y~_B`nX^Iw^x!93dG0P|AD ze;iszWI8ya(;m<58pv0pZ=5~Tjw;b_m=Y};Jrq%*ra(l8YL)lJ=f$^CMdr#GbM=ez zU(vtfeARVGb143h``vtPOni*fr9PN1I3|RZk7SF(AFSN zY$NuW_cr9_c*`ri*_OmKW7=)A*3XrfJ$vB$tAEe;B+HrtZgR!w@Z>UI_KHI{-8J~& zTUlAonx>nY0?CHOrVMY9Gra7shaM}rlef2q1ziFGJ(m@U1uP4v;yz@-P4eZGdt8@H zi3Qsg9rs@S{4+QIq;Kt~Wb46i4AGx|K9@X-1vdt6@Z99RrxO+I&U+vMlwvrsX5b!p8JG|ZA zP2M4|+UF(S=Ur6RwdjI6K^G=Mzn}r*)fsadwAO52Hh;|ylVLfvh^^X1<5JB2Ek&eA zwmJRGeW68RdY!DxHRKT`kL1-PF*VZ%=n-oOf5IWJ`J1ht5-05BDN4d^9lJ9vJRz=N^1Y^kFt(LG~_@n|buTZa0ZMigrdH zE%NPua!PV?^h`L%#T(ZC0UG|C_A!TWPF-E)mKsB%PzFUXWZ3#TWfh~ z^|;%&{j%%xUpL=UHf|g{<#eSdCmSyFzweSOa{qTM7nzkiiZymvLfAS&l%mmIIjG z0Baz@T$?r74{%7bpB>p4*^t-?frO9*C&Yls26?lNIkomLu}L^Q`o5~}(P3bJk$h3wKUcLAJ@BiM20K{Uv067)_l8=cgDn>IJnwur1@@-?OdSYaH#s&lBog9w&%bXa1TT?LAGNe?8@tB&M7dMsQC+*TMPE;4xRQ^+pGRX`Mi4t<}6?kqby zG3ECFePT%0F%-$LMs|(PBIU`}IRq1F1oaG03=OBT`$A0~+LK+QQx*nFSx^pTxj)pb zNF38k$Lx24?e<=O=ui$l%HlcCT1s=k-?}V;T=v-xp<0~C? zfqS9>g*cHDVoDtf7%%*?5l*!zs)JM=vJ6wCEJMW^lVOXyS+?xpEnBvL-V48Muv(MH zt9hH__9jm<4!jMJ?M{Pq{c1cx*b+o6?ugrxaX`SSt2i7DtAAh!a%f2ap9m1O+7~~^ zo`EGxjkLA4!}Uua>OTUTYbV~g;Ql42kOdRR>%w-?=$4Vuhwr)P+YYW)Di&+69sXJE zOiQX2+b!2)?D@gXyLW$O=6kS%303Xyhr6n|AnYr)kJ~WS^|CEs7`a%PUID@3r5zVCmz|Djy{n1<6|rUfPtW zq##+uqacak3;{`BL);BMRayGs$3-wG^-^2iegR3J;Br&VYJ(@>_sb*_Ee33YgOE4` zk3j;4Gf6ZvVVUh`*Rq?~L3W%y$xgEFgUAU;_kV7y^VKj**c3JdGFei_zB?si6cRE2 zxgr*fH_?2YPs*T)PRby`#bl^4GX%_(pj3;;+u~`C+f!aS4n5Rt`BGHTr}$!Vhbqc( z=<|P)eAR&+yek89aszdkRhS`P_POz1L+?Aa_<;-FsGWe#M+P2TisdVAir3x$?%+Or z8h=SsYpMl$es&mY#o{Cie@;sm0TxV-+c(&Df+$G9hYV_r9}}O9{48Q`K;}hnqf}Z? zY!rXye8u^y_-g14=bPf2p}!DkoPXgz68|Q@A7|Q~OPmCMwRm-KLwJLHMf{t@4*9P5 z_vJ_8AA~$nm&4`}5)#Cbt(MM`8#C}jv47Ht`>>lh<%aGt=zoHjjA$848xvJZtON~d zL?X6HP#S|lqYMl_t^-3Y1EaAl1IU1W@FK8HA_jt&DFI+NK|!P@Rn_mZtE@*FBi4ph6i8(*yBeyN7~Lxwk=C>`@aPgqM_566gghA0^EvMdY=gkUr*GHkFAG=c-cb-|IKGw5X2lO(a;O@VabjAIPGZFm*6pb~1hoQ51k8;KHT zeK&Y(EMgdMVt25+*n_McumkKt_C?mthDu`){-D0arm! z+3vIGU}B<<)B+amGTkWi3V(%TKN$pQv)r_4UaZe&-AY^z6Vp)PjhCVJvgZ$8G_H4~ z1a0$WS1g0w7(P5$qwAhO{4;8oZ~cMXk;!+tLUXgrF&s;P1+@$9Kel}rBta40X;kPY zqDZ*B0k6sz`33x#Jf{9!{<->o)B8ma8wJuQEze$ez``hRrxOwrSXcJ*T2 z!fG0!Jf$KcVl_~nQqYK}B1S$MH-$V3Az`ySoGv#>%>Wg}fX0jda6anKFex?e0yh%S znOCD8hSsi!p)q3RC2`5}vj5(~0J$WGe1xPH1tM1lF|~ z+kUye?QcHSwx*I)AVb#J1BKVEv(qB=YKep5RE!@pU6r@r&r zYj>jmw*I*|;OgJ_?SDX9{}s#EXEHGGt6#%Fw$?lJ*keP(k3Nc!`Y-_YxAd3=wHO3M z=v%m#!2$#nx52RmTmpZ8+j%-b{sf?NTJ!j}vcB;-K(GKX-86Sm*Aii`Vi!Q41F&cA z`AY*2WOQ4BjQ0W6nzNS7TQutrT^WE{1e7n#>*`&CC^P_$0TAacTz;1O?Q^w2*=}Iu zsq?$L&O93U+pht#1VGjN`Q2UGhiN82P6d!Pf6>wlpFZ1N4X}ST09m?l@!YNv@8(|t zP&I%j7Ij^?M4>Qh0ip*GIJaw2cl?DJ4+9DSOkA?Kcj;gbrUImZ*DpD*d&#EVj#+?x zKA?Sy6G07%ED%Wo1MiD7*sn1bYoP>%h+?z@>@)3C5J15oAA?~`0gd=*le&2N(Oc82CDp&z3g4@v05r$% zAP9TOS}34a+^#4GNM``B_x{KE2KkboOk_6;J&G}kj}(6&sfemuKK~@2M}|)I7n+AP z4{I+=ox02ur@qyoI&o$wf9f;}#@EGFrW(^*rnk(SERR^j^10l0*goKR(Rsh~e%E>K z7d+>BOEM#w5#Or;ZQwq+p)}ocYkDND5Rd?nivR?u5kwe;s6aJFpaD&2!B|YhG<0JD zmf(C`gbjb#$a@6=gi(MJRLPX1WXcJchAzy*LY#*SQO8!H1{X?|3&)1TuuopXqUH_4=7l(wscu?4jr-Z$DGfig}_Tu$n*XAWzEMgb?h>AVtN08LnoWjGHD(2etO8oF@-CgOCA#}t|C&OL8UM?@jQY^<3bYsMi?h;7fCxBdx#{$g7d032IEXG+_iabn4H|Aj(7NQI1{mixZ zBY-lLpbS+AU<&4=8-f3LazMWNJS>r67nY{qwFm)>#6m1Y0F$u*^DrMv(JPm_(JMdc ze01YXnbH8Q{2haC%)xo-cb_0X;ap5P{;Ypf(S_ym+b%@_3$YmU<(FSCEugoW0%Pl?5aYOCk z^-Ix(1z3n)6vdm`rcQ~+8XM~CM%30+S5}mlm6jA26&6JE^Kx?{*;(OGFyQxPdOdEJ z(_yz+EoPHw%rNM6T8&zzR0xa`6tsVYM|TDik6-R!NP(-pv5`AIglWoftJMR^XIQ>>1-}6Ae(jCrf^fYwy=Kyo3*;8 zaFedE00~EU$!6kcByxs2T1IT9P#X#hS`zMXb4$V%Zsu>0VA(BQXC@|2YHMls1cU8` z1qsqLH#{eS@Ti0_DwCi|eoR8ylu*f!2`u2P!Ro-~g59guBt^{WjOxz}pV>95Ey23l z`7=z>gd^OXa9niAd7@ZYkT8EYwOu{D*27k{I2QzXan-7;1Bnfj+J@H#Ic#rt78Vp1 zBxv^N&Q+rm@vb#v3JY3K56o&y&@0>966DJE!h!&A32#-Zecj;}j_Eu*kkEujh3Bt2 zyR$2haIZ>W^73Gx+a2F79fZ3juxd(MIGBie!tGtn-py95n!J3AD;|Gvom^8`uvs*v zI(Bo0F`dyHhG)8u*U34Voab66AMaVh-zYpb5${X{<^~d&+!jvI>>3WbYp`l=jVH*D zc2Zc-nmBV(Tg!rkrm1t4ID+H(^$A6`7!IuZ1_{y`?mv7orYnt6W{cl|XE~o7XSD?B z8p1j82H1V^XkP8w~z0FG@;B_*HUp;CPqY0 zF4vt@KI!%Jt61xlgb<;vQ)aAMr9G)`ba-^t6e zZ_XmuOlsR60OB&1ax6#kLVy?0N?Iqk^-;A<@7W#)R?4-4jF8K7lLRtOJ%l5eo1`h6 zn0in|eo!0~bCW`K!mUhE=ccLEn41)N%?^K10?3uAgKLeZDQ&~~K^8Ju zVbG>22@+0R9KJBP8MG;JUU<2jS(OL`X0-)_!Ngo|`>IueRe@FEq=>oG+EOqfL=t2s zhw?|h;pQrYz3rZ0J6H0Fm2(2K+E&e4H6t7h2NRjz_EjlVkQXz&?eZPElG3f-aIg>% zJ^_Sv@CbjOz{lpm2S^9f-w*jrh}RDeND_UEPm|K$)G-B9aI*}jknyP$XJS7V;RgH` zQ%E^^8TTU&;}13a!3anj>Tx43z#Et0@ev`!NOH+a@;ceCz`<JDCs&b&==lO0*aHRuHq>H_-1|3RJ?_T6*n~aU zhgb0yzQQ13#6_ZHDw#!oMXn^jAvckG$wPnSVe&au(63JQSb?r(zNI;xm#<@<{=Sk=JOH7BC{{2L=brrBkF8($msg2qOnIXh1VsFdow} z2g`8vgC8VdMm*nxSLJgWQ6&+ZDUU|f}VJDu(A^aWR5JHs1Pjbl^ z(n_Y1TggM@069iM)$~&O5S3U1Tg#poT*9q`rwuL|ymfGkR3VKA0fPcARG-o- zM=vhN4Y(T*;6ZG`OL!As5GV1G5;A|5Oe1ZilguZJ$r92-E+&_dE6M$2E7?ijB=3<^5ylIh!gApv1r$ta zSHE=3act4RoPpa1o*FC~Y#uykaP{DmgKrLgDCwkK(nnCD1oddgJoMsMSb=}5@EhEP z`|$wY#0U5UpW`chjc*7e8sa8C;+My*iHs%V$uu&Zw3D;QS!6yrn=B(M$%CYiJVtht zC&}~VMe-VXpL|IPwb3G4MC)h+ol4K5m($zngET?kq3_Ud=)YKm6|gc^&Kg-K>tR>3 zYuJtKx9olPkw68TP%4}*tPp>mRWQYwidz)x6?+uVDLzw*%9&{$F=hDtmAyot6dKt= zY`{dy*k|-LT2FpOzbAjBndC|O4b5Z|*+kkz>p;m)jKLyURqK^OWsq7Ssyg{S=xwx+ zO&20ekEK7z8|Vyr745`*57@+7IFzd@MHAR_5U zn2bd&-obcmC(}_Q9AsJ^zn zg6fxCcJupca3pVhUzq4i=zLp1W6~28|enW{kzDavW<0I&mh>!nx?dg}4(BVKd@r z#Z;VuIXDYvqX)gX02kv@T#l=;1~=dq+=o}`1N1Hyq}R}=>G^a4-o?A@Sr#YLuwS@V zSb@`#g-OJM1*k?n{8)oE((9OkJa~waRA2??d+BrOP3eD61Fzsd+=q2oryPaPl}*US z1oExmCW;-HBJF0o`=*x1lWce22szo3kyW;mr#ge2_G!vvBa7K?EMdE`iS5QKY&QhV zX1lQ>jbZS!-H5T>GWL48egoTy1lx(-Y$x`yoib(z5^M){vmMySc0fRkB|+Gu?2*1K ze>};yZgGEQm3=wV&9*>dTR_~wlPTaA49+1hk^9b4U3=Qobju+<>= zlC6fsR)b2r*&ThSOeotfXR7Pv%=#hB`YqM~~!0={H-fWXhz zBf-{VH(QT=Y`u(M4wXB^@LmB+6EuBth)B4K%yGC}h zsUX-S!wrnbtFM>gY#C0F;R?BSg`8h3=NHTQn4FKL^BfirgMJwrIb@UB>BxhhO=9EZ zbRug(HvDV?8z-lyv9WSGo}D76r?PQy!p~Y+3(WAdacs0)9?M$L3_lygM$73bY;<3< zzhr;p5;hvMSqt}>7{@oGm^CBDnjy%T>sd24ux1>PF|%1SR=z#0%|^>Q2QQOxQQWA&K8>M@(uV>heE zK2{GEt7r8Huu7D$O2k)tF6JW5o}+yMDlJ zqN|}sEL9WN(HM=f33LJz;z^dbrM|vQPRpxOsW&r~>fL3=k>{~ItYCS#i{*jA$nt+s z%<>RBUh=a%P;6p3*u`@23d_L(mLqp~4kr9in$2=>J8h&L|=HS*VX{j7dDYx{r)7j*QVYm_XO?N_riN>2-+F>$obRT!@V_ zEKcXwpqQ?~&=uGJP~Jq>K*_eV?JSSwu^g7ea#=2yVe$kMf9vV>^f&Z3^g4PST|?K< z)pT{-x+%IVN@rItu3S-hedS%1n<{rzs&>*Y+C@8QXIu-r9e~-Sc8?UPfLSn*f6H*A z49}BcT!xOgdzRtQEW>lN47bfP+&s(BHp_6@EW_wohT>UsDY)`FPdaUH=hw7t7RYtiwZndX%o#H` znrcTkfByvNOvC7j!xOQ_O_kY(5jZ^?X;RF z?QPq&D``#3WRBOaY;He6hXAcg-I2{5%qVv&ePM6J-6rE3|^PNPuxgprn zyg3*gqG^z68cwE}cQVa9nPy&^hNWnN!)R0oe-V^vf~tf6LF4;h&}9E4&9L6=9u@tC zgKWn*^5*8Ii+JF&Gu+bM8E)xJtUiCflLrn0+tEbcOvf}Mopa{S=V@1WlDrx2Zca3X zn**E2UG$&ziHmskxN!4kT+}k9ZSzI(?&iL6@o_ETuIBbFr*!3SJn3=Q4n1yje%DXj zf2@n&ET2E?l#M@8y^&X+!k@K~KWig@)+zB*w?ZpJv#)xuCI%>C-mV_2}5|4Tva%-a3rr1AXjDZ_;k9;d1+nHvxEF8 zT_uJ`B~0N_aJDRHZduUW+ndh(FF(Efe^`1(?-_C`e|ncL>+N022MWFDU5chzZ6o!v zR`%2DWNp1#*2r9Iv)3i5qNuTX^o=_^#DQ2GirGOR_BbOa-0SchWi2N^?0JPCc}1&kv_!?jFmpYOc~C?IO!8~$nXrbN*`l3PL)1JC&o)3qYI}= zA7KtANFQOY49~@_>2k1e&^a0MpOz8vkVy1KuOEF72h-K)I4&r#$UM8#l`ECM=WQ!p%5edJDJ6@VB^7dJDH=x%4J(li}^S zM0ykJWq1dECB1<=e{rew27V{QyRbsqj}5p?+K=DM@DI3L+K;<&h4eb^k>S1gwe&jf zli?q6rSuy9gsY_2a6hh=Uc&>pMtT(w;#%odJS4-7SS7uRhp|f9hfP>5?Lz`d z!#?~*dIei>z4QvU%5WRjN-yIP89s^|q?eJzI_YI>$2y7cf6};7;(I!7miFQ?{8oAi zkK=;h(WydJ#|I4(Ubg!JX0zcpATxUcfWBOL_s%;x6fV zJckX^^LSo{FW~pm^LP<|ke;r}35y-^N4I(|AXQ?_#602k+rwX%F6);a{*xdJ2CCgC3hJV8&(w}iih9BWk=}CNyr1T^{k>RJ~Ie;Q9pPv9T;v-CKQ%J3UJB|VOB zu}69w|HK~YF?@%orN{6uJSRPdf6MTDJTL9UF&Pfv1!*S+@uIW?k_?CIbgit@wg11= z>AC;a>HpQ~|JCXL2Ri-M|LXMr>h%Asbo&37{PgDkmpZ-mzdHRFb$ZW#b^3q(^k3BJ zJN~cIf9aI3%?k4rJT{}k=*>!1lIXWm0)@ac3|gfkN%W5}M%@|}$2~&eQct+p89hxr zT0efE{xtF1`tjmGJ!16(_552}Qf>;GvV*4JJORf7Z1=Ia0^cJb>;@&DOCQn?6$+T( z$Aq}?P2ER2s#a+s63bGzkR*@BEe5!C_J_qrf1+*7e3;CHil`o=V-dh0IStOJ_-#l3 zp+n-KLx=#8KyJUq`o(@?GS`~SwWTGbhcKlw9E#+yNM%J;d70g2WinKT!y%5Mk4C7& zWOmSOS{x1+b>~DI8uK|2)(y-ExZMGIpHmkqDhg|lsT-mN^$q!j_561cJEcnnlVTK3 z;rq$r<$n_`6TNp?@A7Q2ZgOw(s7}F{NcPx~@#=!Ys+nWsmdde@l-89}(i+Yhr`DJ= zy_T8dlG5(JP^Fw?rIJiJdBjmU?h%K4?St1HG-v{sn4GfkSArbcr-|CS1KJXC3p+kZz?nB&IE*=Ax+(uwiH@kKK$3ujhk z&m5aIb6jO(RmIqfiQ~w)3X5l^b**!QlX_=Pw63*ourh0-B`NKW>+)}@5G`vh8!XK7 z82t*T;wv(V_w&(?=;4n34zXW6+Hv&gVX;4b9_`@ayu)(#=+R?C=tHTq9mU1s0H+wJ z=YNMNLm4+5QCdPe$noLf1D6x2th5Z}sx7G@D=$Bhsj4b>*lj8{ESI`G7-r=xVE(<& z?e_gKNF64VEBHi!Iz_XK1U7N(HuD{Rx7+`RU>fGO0dusU~tFv*iGS9P?s?GK`x4i#E(%tp5Mq8tQ0KA{zz9`cp)f0l0IagDu4J6 zred;ji>b#K}>1*UlN0B4_6L#sJuu1=X#G9eXP-oB`(svN0ulq7H z3i%cJ(%12Dp2C~q&j^_pseN8Eib#&a5DI4m8_Wd_3bR6Ca5o@HUwWi8t0BWx^7|b` z2`4GIk}Hbw{o=R%h{ZUkm}|MfntwQ`EiGwU9-l#r#E8@7aM@ipm(`_EdOevQpU3YJ zlsS>yNM0mAA}DowtzM&7>s5M%l0`zMtT+M|cbr6(*>MyK#c>ig2IIuz3dTu9Ul2zT zEr`njZz6}E^YiobqnDv3eUO^rN7JmfxXt9VxMEhH$q_SgVE6gVu~1U_K7StfnPWLt zuPK&e^@yE@tPsOsgx%Z*n;9a0O#V ztHaN)^2exFG&MRnAV0D0!e6_c*hH1A&LR;m8e%n9X%4&HVOLc|aw0jAaERJ$R=dOQ zu$PyaE7_-)b>BYjilWRGqkrSF?%P{0FY+~u_9;#IuH4#FuG`QQb>`NNS+jw@w{P&P z-(6By8C=&et#=<0c|NqRe%gu)_BMoF;lYEuw_osbL&%jyg1b4_9Rk>=!gugsbDvr5 zNlM?vjV2}38c*Ca(LB*3XpB4P{m_&3agC_g8^tFyYRWMRvOaDm3V#J9PpH#Bc2Jo; z)*bXMnCQGmq0p%HE^6ILFM|mV`f^;0c_tH?2a$-6(N51 zzQ$nI+AH-n`9fYe-xsy!_;SN~tBx~_>oaq|{om#RyO68S&3`vLM@@~&aHwB~< zipR+zXrLno5HfSCMx)icljL7p`8#1JnF$>znYmT{fvF*Tq=7C*Asl2Te8d19U4#O1 z!;qkg-yY?1dbD5cN36d;Rxb`568lNIXTf`xM5Co8Xj&fk`m@YVdv+jV3p(SlgiUec z@LS`=oMnxZw13cDc3El|YHDiGLwcg^)xor7wgoG*svBu#MI;)^C#pk zyzkNur%LM(OYS-2-BlyHdY2Bq|9cQTC4DFmg#tCiw0~t`4M9@+I$mB@R%sfMH8yKp zc2muHP_77GRdcg&W92P1_g3Clv)!`8@uKBL>t4rumcKX-TmJ2kicS2wZPt({tHP9& z{u=jsvMTb_MqM=5#EOGHw-bu67cO5QH&WnAl9^iq0dql;T(>3CP@a(_*KIR5D8mg^ zNn(g=ZGR2S>#b$(5yd-*0bY99qdHe@xk70;yo0PvjRj&c!WHMCL#K%!n`?{5i~UFY z!3SjEkh!+F-(;@kN>mmEv!m9OQl;LC%B*aQRZwJCgyY1bu*FGMWh73lf;kSz!*baV z2Z=^&I(lkQ(?jgCd~h`*4-MBPRh1QyNZRZ=7- zT*AnznP;r6udr$yVs69KUB8}k3n>4cC3{Qw1eplp)wlr+0qP4XGW}k=D@i_nBs22~ zyMNJUPLj^JIV0l@bp< zeRdm5(ktRdqR5z+ndyhoN8lsA9rRoT$;`M8gb-Iq5N!J2?;x+iNwSU)N6+|yZ##Op z7c)>V9)eik&of`ti~ZcM5jomatGK!-`hP2Nj}u&WzS&*V!Kqq)N}T84wqad>CJ;B+#(i{%`9iTB;$H$ys#%%%qhf}q4KeJHpU z3WQNY9*FCULe{K`kT2>B`XW1|Z~3Ttm=pmQRiDmSXwPJEoWPnTduKOnYGihE$dy~ zyXMag79CNjRRLwhWy}g>2fG7vgUf@K7}I!?c_?l}M1PwVM|M`O zIzLXLio!Sv8vVRRN3sn$apb9TWRc@SC)Udz2$#GbStH6;KBXI@WJv9$rLek@aygU{ z+{(jdb=cEl84jtGWZ`M|c3-vci9arSys9Zyvf+(Orqnp?CWASz;i0we+5Q;GSFlb=B&PuYdjSngw@thm0<>Lu(z}{7LZDNAB3P=8A_-uLi;E(ja?N z_yjhr+^k{Tx+qC!JfA9+j6R{!8w~Sou-a^}X+ZQ2olOrW5;{+(H5o;%AnJ8H$V?FW zr>zc+%YJy6+jnTZY_MapXbjYw99&(=YU}EZqG$$}k&}!|X$h$erhhu3vNC8RLn?<| zHgF&3cE$!DR@*boPNlFgGLEbMyRQ2FIk(9vYR#Zzuk;}!Yz_=R_$sAwjj_+JQ};n> z-bw6mK_K>RI-SeqU9_F}kerp&@;9LGKL;gxi)t*!mN{`7N3%iNKVR`x}H<)z5TuFqc;y)&>r`>yE2*~*KvR%G`^mwy#ruf5*7I_vsu^;EH2 zT%lbeE-@`JFR`e`1;z)*X0=AI%21RU>jEQ!BeG-pbx=a<{RI7N{bIdJpCnhr^9r+J5>3=-T5H;E+Gjdw zI$~0q+!Z;wJ_3lKM?l~zAGh3@9FqB-bfls~R^Xf`&9%k#1ND6TWtL1klqV}}SrhoO z3d~lm&Ju}c=UWR4NwzjzND9n(g~-xH3JH$;I+vlRgMak&^mKG|bYz>t!^TV{8`yrC==RygcbqY0^&D;oXjRyIcJ+iSkJ-nZT^ql!k?&2G4hW|T8&QJ; z@e2#Bq<)|NWJJ`R!AQhC!V@u;`b&#T zW2Hi=tM=+)gD}4TH1XT<0|UJKV?*JDl-89egMTSsrdIZ4(3;Sl-kQjoG^1@hywc%5 zlNCFp!^o5lZ?oGSUZ*|nShkan9(44OA;&VUMss9U$xoZjit@6mwBI7TF*!x7va-Tl zRbIy4PDzT%K^4=M-qbZM9vPM6CF0hF4^A}M%=YNyy$fcZG3JbG%dY(7>V1O0jt|M- z{eNz!XUfR-sK4;E*`wQTd~ERZGiKZDCP(qCj<9FUgEvfn@Dd_#aBl;IVqqOBi8=0` z?O&{1p=2gqM$~N1)P=nM%5XT-%QVWQw0n!u7vpKX!03u8r%{@zvAP{mizU-tQN%lx zmPRWpGmCNxxwWJD(MTk-(4Qm=WP2NVX5qxv5SaiWt4*ORwam-jOT< z4VkFfpxLK6s5zohXeuL-A{2^+v@l5; z;kki&v7@K|Xh%<4dInPN4*&EMu^-|$9sBE#XVMZR7o*XkisN`bK_jN2*?{S||9>+i zHKrjWaDpa{Ayes9e9Vq@@uBFEWrp=~%)ou5(3$dyoV0S#|D7D$*~&#DB`$*pIA-r) z>ukB^3l3+4@PFZ8e;3xlkGJB5#X^xHtPdCh)_|?pTkLC8lo$U zwpQ zbowJMbHwGOG@>>}G#a%U#Aliy644b{b6}|d<-jTzlvq8Nm!F&Q{?c5Sbo}Q$_#~4O zrZ@a(E__f{MY4qv8jsnBT+LKJ%7z6L^Q8mAd|@LDaFJti>3QSRE^7YR{(rIaU*f;a zN9{*l%4hBGi0_!+w7=#2yZCpr$}PIhHoM&^JZt{9@mmYKQ**Qa9(upxe$74l7nCok z)mP9pitE%X_19XiwcSM5E7aA>YIV7$UOz%CH<#N-IMw+ysxKC^&Dr*1XB|~NX51zA znfok#wuF6`bB9a4(fF`h?C9gJm&~wm8IHN>paakPHZu&bxN(;qx7irj5(GZn@VYO5kYM+8U&~u z*@DKDtz{Y6+|UG2f(=mM0&BL)wZ+|Zkuw$R8t6zl6|zEe$gyep;D45(13eubO|#mz z*|lC%%$$_I-QqRH#H94y7PB*E=i!wMt0!i6+B0KL4m3&W;1;8cSAE7)MN)e6cv)xW zHJD;HeqAa(8qd&+FI0N^y$>eXUGPV zrIBQqERFgQ&;4|iihl>H&_S$J84kfDqP)y*R#i|Qn&Mj5EX=>=%WGd8e34YXcvi!RO!qZ1648!g*^8Aj}lj$^SWY zB<>X4f=A_p-{LX*vptob7SHymHs73+l)i|I%iO|R{4!-X; zZp@17%(1Mv#u&?r>x?npG3oV?|Gk*G`p^mY?KJq~aynY0n`XB#D&p4th># zMDppz_f9EmoqsrD+Tg#4zT@uJ2QD9cgB%=Oda@+HbnT?evuoUzDW_l9IQMt*PXqwr z31J<_htUe`LC$TUK=K1X>GSrVa$h>_07zK9TsE?zk{Gqc>8ndx$72AvKYCB$d9S?zY4GYa?|POHP=blCGFAy*`5 zjp$iK7YYXTdL0E(^S#QE66Zu`!g<6gIJw!=IcTKVHruw##%xK_xJ7ah#}0A@>~!Cj zf|iBOB!4;c%BXnspe9fc3gGU~@&8r`BU5bmZRuo0A{?(qVi<~@hLVbKhzbZbu z=cHms&;Nutx`&GsR~8+?FbRhusfbvxEbTppN%>D<>AlMa+ebRA27}c>YMmBChQ;xF za+Q)?w!vvNWLTV}CY8p8MvYCcw`o%Fn4Nt#ynoE4Zmo1cn8sEj7gc0Ve9{A|d;AX+ zv4|?$UneZJT;M+6v(kE{d!6-W_k*ep)_dF!7jIKNma*Bo)xF*KV#d)@o0hmpK4G_; zZgSI$i&hn_FM1&3!J?;2-zfd4RGk}2(ud>j?BZZ{b|@IiHD_8Jc~wDFh?3~|fsf_c0Ewn7>`)+}xT8PT zAFDqqPYP1gRe8Sp-LJ_RCiQ#9zB$OPS3-!w8+ z(V^dd7f$`bnbAP4=IEeuU=2q2Aa95eW5gd>8(|SwbkDGH?jccm3V+zqGyZ65fuTRv ze<(cxJTdu`SM$N+WTdBqFC`33?Ud=|u;U$jd`=e*p|S$yW$bD0{1bUTr`&YY&Og8T zz?>H++eDM2`|jsn9Q>Z>UVM@nyj)72@VgzJQ&xWV+q?IVnP_#GqNC0s?AaIjUtv;Q zDjg6W_E4^-Lz^UX zx8w%(b}kNqP|)gwUT0PDAKf|pn!rl_k06A&3$lYNMIt82nk~`%m8nh=zwJr)&j62@ z$!b8SjAMwEEyGw@peYrz?t}AQUB3L)-uG{j%S+zA`IfiezUAh(g-^a; z#C6LbpId(Lf(s8^^c;CN#mO7qe}4n#WQvv20il?!gbM-ei!adHZ?n-dI*LxFbLlhm z8OsZ)D5chqAv99?epo zleegFZh!II@{0_YsF|Rdt=Xh`MWfKTD~p0F!)wDE z!ili3EBs3MVE9N_2)iosyH4s*nWK5Ab)cTJbbo*B5EuK{Q0%StM~pnIr+3059feyu z+Lx~`OG@AM`P4{CNBauYB|OQ~mvdyHy*Md-HheihWnD?-@nsgPDuaektY}qNRdPEa#G0n zWq(w`8MzLN#Ys*bn?Lf{c0#soBN%MG>7~6l-n4fw2>62dF@7 zVRA2R+}8MZZTT@R%)H)v|1g`kSVWN zHp&IFN(u^!OG0^~Hl>pc#4t-^FlaR)F@NP_>9S{~eXN=?UJh3lmsVDmm4<3aAkP~V z@^W)cCb0&BO4O<~0oMU1aVF{Aaoq?61Esr4UMZm^N%HxY+EcoQG?N?vlEXl0wIn;j zrk_bb$?8> zCd|hboKiZvEui;XQx>|N@Od^d$xACI{HWvesg$p!`Vah&^`1QO#+h@joppxaAKyhFn{!b9f2)FB zVFH5}E8_VfSD7pBn(UhETI%|>OMhiCh;3GD$e`3~+7ybA-tKkXY_o;D>}i@LH$CE2 z8uVI_on$r`C^;C<5ClcQHo;1)uFOd*P6Uj^0eO__W8e1wD4=~JuuVFMEnI2&kGN2} z1L)dIR*-SL-2+Z}J~{3ipU3T2nBIA3aMH1_kGFI?x3_%WxDybp!Y6Q|BY$2o$JT4R z!p4jmeVZtTG*qoB#INnT_O`*uHkPlZ}9l}xBl5TzTxEe z{hGh;kU1JQ2q665nuT3#B}UWyc)hXOSd&p}9AT_CHW=f^CS!}n9MMtgd9>u z=v40<)g13q)l#pbN>%1Ybs>gonr`VNdBBStrl7}3xes$`iROLg zgXSY<0cO!0H#76-471so5wd0bWx+;B4AIbNUnu1Fg|e$kQpj?#oR*I+E-x=B4pohg zb7c2{Cek!I*3=Y_g$j$6zDQAFZl+gBRQc8MI*eB42bnvl(J)nYRex1>woPlu2srF< ze`Se%rJdT3MKXPXoCq&RRz_&#SR;x9u|_^QLgTK+R~lKP>y-SB&S8Ey-``h%JV9#8 zdprbbG7l}{;b)}#7fbS__a}v4Dec~3mxcewN+7KT0=aokmsT$*blG`Aj-M!$F0I2) zauxZ0;?%qSsg)SM(tpZ#IH02gtqD(BJ&fc(Rrmse^aWJXyHHB+f=I6q*$UFr#DD0o z;&0$?l%w%>HxH8S?z6iaQ=73mEH-(TCVNIF6iV2X+8l9md6;JT@x0*Ea~6)A6RhbS zF|+EFQ#hxtKdrpztdXPT?1a+7f`%p;{UHY_3N~kIZ_DV>Eq`^V&KTInxtabpKBc95 z;B`5FL(}xkyfagUv`BI`Cs+sw)7eVYkgMa>Zz$hT(>=;PYI?W2PuZttJ*t%|I#+e3 z`b-a7@3~h=FZORCTPgGU&-POgfl{B^obqptHouM9M!Re_rz>Rsu?;fmQZ^`qWQ^8k zWazXZQ_2R3$bS~I>5mMNp>lM}5S7){D9H|T5CJkbZpjP^s=VA>v)QE8Xanv8F5=?m zNR-Xd+L8?=w8X`2(FqlownQoB95~t^>;KtGY44m+GgIb=59FO8 zmoGZ~qMqT_D9tM?+MDxytH%y}dBPgCU)*%%z*j$F5K!D89T4i-O6cGqW8yVtyI{9E z?Cg2+yzUM9p5ia6H+0H#R0~YBn|2Ee)C;s{8y1?nEoV8@wjeVGHB6^b>4T70uUs)X z&2Y$R+<#!JOn`_eK_?iJ^y;|N98|{n+EzTn5nHU>rF=zsPbfMqfg4Gy3bvP!Rn1(N1_gV94hmK69!c?Emwg!7qq;&!359>IWM(e89hC)9%3| z#I%cV`91RF@BVt=&N~hs;L(`DOJ(WJMky(b$4a%v+8nL1wz6;%nMykhXOeE(tvtuD zlz&{De_oO9DdleMJF0gy@8-Ny`mypOt=h#3*u|^AlgQ`)_<$hwL%T`q5C$eyxN zI`eZUnWT}S;dt*UJw7Px<@59DffVKIO{Qm+aub&ytRAjp_{n!biPS`pf2= z@bNL1N1TTXY-y)Y4$S-*7Y&+<~aFTdjV|6-h){rNf%_%12o|cuHo1GPk z>N2eIAA~DZ24aCVL)2zv*CDFZ#>AkYvekJ)bzZMWYg8RkQI)$8))pX-<(jMr->i)V79#ZMc(E)P=B9ZflpcY+F#gNds5*S6((8}ru6V_vsg3iX77-- zO^?vfQhiGG{mhC7rT5(3(t4T8qRp^`D_qs^QmaZg64+;4^{uZ=6@y2^P~Q1 zdDH%8<9nk%w;ZbYbks4+(TeXznROPWUD2o+<+s@EwnopW)uEd!b{cilEi-Bs)SO*+ zQO%`w*VbHHcdxb2s{KvfHb0%Dj^>3UrSXRP3b)gkp|a^~QBhVB7K*Bj8G5D#Gr8&- z8iJ-^lQu~zx3WMHDN2%C;(y*qRWOJ;)zsSH1mA4mVjuIlN0&|s*X7xQajsGAMprD} zzBrHMxmuc3Oc~Jzb!VjGMtnvlZ%^zPf0RV~#eq~TmG89RW6XcTFq&?6DfIot>gBR%aD$v1YE0o2_~=)@;=oV_tqAqe~`wlp7%{2gB4c zI>=9L4B=bq_?g~iXMauYG#mQa(9m|foJdwA6`p68@QIF7jw{wozWTb;>PDAbwW+yl z_RG&cyFzU<(Eo+`f%Ix64-KFNs~$d|GjFpkjXg!WDdm^8Yk)^?xC599Mkau2vr_t#)>H zwOUDctNoCz%bicMS8{yLs<#^}{fdbbQry%u2jNIt$26SJ)Fo|bi76zerY*P_5~qIz zS{f3Yxb?-LTx$wW?6@UOTN={-)fjU&Ekt!FCT%fyDl@yf++A>65Hs3Y=@0G9`@Q#m z@Aq_k@Ls}C9Dhe!(67VVtqMq$a)tYecuu?^{!v^Kg|FwI&Y#HtG=C}kZZ=s=Ly96u z0uF_RbRv;TJAk!JL6NaSG@+EcqX$0@71OWPQa%7m=Il~dJDTXhOQE)9OFCn1wlAR( zJYtO;9QoCVFw*0$Elkp+fcB?!C>42=(P2#Gy4;V5T7P*=6a)u#ru9?o| zGHFMSh=1H{Wlv1x)@^z{Nrj}JvT8Nka_XSVnq~W_E*1^HYMOF7<6}9g*?iWr5Gv|4 zUd`Nr6)XL_6r?D5GPaRC>2xBoVTVa);_C3n7_k2Zx1k6j1zT$!MMBg>QrM&>lqw=g zEqd~i8LF`vo=1hj`$!*LMPzU_W-M6&s=ns&vwywW@zLe5{`BA#5cv&e-bVdoT_BBxc}60NL7MK*a$ zw(woZhbeNG`ep7b%46DN?in~mURFt11@~iRW;`r2<6V12Ot+~ZAqh)OiI?^$l7tmU zRDVe1VwEbYLiOR;&AKSVvs5LSe3(gFoeT$+0$mCW*{B+vu_yMwnyPRB7Ev@p6wO7* zQZ-FgHI)Dosjn^gl?wJn-WM}T*VlS*Ak3038j$0Rx(FkAipOG zavsj08f*d^8Bu9@X8t;>EmI*upV}6E1%I9YT2`LfSXW+ux$*YQ+Nv^&>&k0{KXFZY z?F#p^@2|Z0c}Aizwc9ahZ-NHXB0`7qVS9OLC^TLEbd*gDnUyaglsLf8qAqtlJW*Au zgdW|55DYUUsQeK+rH(OxA~r5^Id;@m*4fb`)%J3 zyWL=FDsbI;qfrm`3GE&159hp6#yY;+j=f1ARTml6i&**oWKd?PkKGLvf!Sq z6ZSd#WPP7J+Kj_pVYGCQD3-UUMk%*`XzkRVBB}m0@KU*N;3c|97vi~$4BYSc`x^$@QNTPS8T@9U&&1oD6WNjRjaFZh*~vF~Fvz2Y=XE{TBP0 zEX#5PJLeQblH0A`;IC&TIR+kfrXupBHMkmPNH$Q+ED2h)Vc^~@2^3K;PAj59rn`5W zBmg>ecZ?_j(4o7df&-vKm-f^F9c*#bnr_RZ*0iUUD$|(ye2+SLT%f;-&E4MMjRmYx zhUSe>!rHXk!P>MFMYb(ECrm=FvEX(R;dDmW-jflZ$K7!FuW=jZ& zM-)$u0M(SF<|>j_9P=p?%;y}_bexLgPHgLOue{pW%EH!SnDrWsZJsmXshOxgDhSU- z)zJ)~vc^!jxU~qyrhi&2YN}IKz401deY{?8y7hX^b;eys^*qaUG}m<$LM#LtA}RvU zbyT7NN}B@7P~5FlG{0QNzQ|GBt@-2I{E3P2JTf0Jxr62v^8*?*w;vDy30Sa%gTfWz z10gAtTH}ihbfcbxnR$GDW_~sQS%bWB5&D^QV?y{AW+ubhcz^zXxV_!&;U(Vq=~Nnb z(jE9n_yfa6xZ57V^@p})b6;KgX2~o|1^qfpTHzshkU8pW)iTx^%kO`OozD>l;3-}* zh*Zch@V=k>d34MqJ$38iFrTG3-baZ4J3otx=x?Ezr*sFT^CEYC@F9{0|3V^4(0D1; zIKs zFP2OC%v=s~CFAf@YsBKQ9%O0te+6Qd0L@sQX-oiv9d7Ur#Y2vAPsPb-*2d`k=d<}@ zFod!7Z6+IgPFSbt1QcMXHBQ;vVYLs1e|Py9H^qv4%N&S1wESTdeC}TU#MkH}y}X;d zaEQKn^FQe4Xa<+T0t6Jdjr#@G0e?6OK0XR_baG{3Z3=jt?Oof>B*$&OpQq^S0BP5W zbpQ+l+LdMG!U1dv$O9~52f@mL73ci}l2znaGxLw)AM3*{No8fYY4}u?{9y;izirZ;nUshdwPk-a5{@*+|9Pv04mBE+#55DA=82$xW z0lAlQ{slq_xqK{h`=Ed4-iu{-6{sk`#Za^oMTC>1C zj8XXpmm&WJ6Myyf>^;URa4jL!eo$*?>Xf>Gqs2N%z)F>|bmo#{PI7%eL+VM;77NvQ zFqUa_zGpsT?3I#$m14^R5>bik`cX0!fyYR(@wwxSni*kUYXraO6%=XFpCF zaqyt%EGhSx<=j?sivo^RLL~uvsflS?&yq)K^ZHS`41cPggG%Aq_i)76&e94qNq=@e zyN4r}#0=M?$#lO(~1d)->ytCD)wNeby10H6^2+;G*f}86qVwXwn-Ni_yp7`sud#w z6^klRj!5pJs@4eDQdB2f1NIfw-jX*)7twRJbr2>HMePAo$i$|Y>6ijmhF+Dz1}_fz zqR5|beirDt-wkYmKb8LmnE}I>nE?hge;j@0qmy#bKM=Jult6=joiW5R1fv}E(ldur z#5xljgi!TN3a!+Gu|k;{Ui;Zbm8<*NQ_t;)Rpv~3^*B?=ELwF;i_TaXX=0;|I0UPM z`05tUQiob+8fPD!W04llK|?QQm1HRLiBu1&;oxxK(~XZ(EHc}5UW!HLt=H=9e^Ml# zey#9e#wZ89j}0-!%F}P{@ToAy(=RY-#(L@{PLe5kQfzXKl1ItNSQ&{T5S+0(12y9e zgMD;5jB~8&%+MrZMpfYRt!5=emftlArDF9P)FdRW(H_LZtgO@{g=#}eM~%Xyl3?gH zPIlrPYf!!yphgWU9|@>dgGy2{fBNdhEONafBh1!1!zMTR0%7pyo1f+E_q&;t_)}4w ze0(l=J`WdAn=neUQ^sZ9Dd@W4v_>s*rntU2+gKx~#_Ed(+mDk){!fDV>5JV z_odyJcK<}R``cF)n>WLZd>3YvEzIcQ;F^%e7qNs8^WFa`gvjwkS@FbMe`tkPDfBS0*3;1}M_*Y7h_%#yii?MM07z=a2dZP$hP+~B9xUMKQ zMHaXvh^wBs*vJ32*yZ~87SL3qoAdfe|(pd6rA%78IzJR z(o9UiYpZ~q!>Ic^Zj9o&d)^Y0f<9y>1$~m56nvB{uacIVjFB`oQ}E?o&?gB>!8zlz zr3D1#+)%>=f}p)r$$WaULEwiZWsG&pQqJF9E~qO{xeiSv=pj=HPleP9jL>p0Fc;6& zz{D}D161+^5D?Tee?>rj%vl1fJo^M(wJa4#0Oqq?T0HXwa^)#95JE_%fxvp&4P@K% zbD#*A$pfwNq#r1lX9qzWF@p)J>p4eIZ%X#f8`mBv9}03s!3G10xubo zt;=qdxg z)3s}Jw62KYm0e@mb1(1yjsoQs7+itD6&PHB!4()>fx#6R{G0=W_f21Nr7+f^AGmYEd z=hfk!o`8qvV<`m2>REl5m8buK0$3>kYI#io=<4+l-~kjwfL&J5aE7u85Kga}h!sVO zrq}g%e=U-LPZ^3LMKblV??n;${$a$7MUf)8f2n|2QKV>*AnsL>BISfUuqsld?2xyr zNRa|X?psx)Xdwg3Q#C)9v1+lhNLh6eKM(36c0aF+*mJkKh>Z~HA~qAKi`bmE!iZ4^ z3L{2ED2y1rx59`q1_~p_IxUP~-SbstWL7>ee*1t4`x@QtOQQWj$`hcNaTl%wKMOUU^+AD^JUvKsPIQex-l^Un+OT z*TrNR_g_))eA{=u_5Au$&RYM`il@-)%klBP{`<(sz2^C_#uDn7H06(FlK&#cXoU*@K10nA=9CZF?eX~gz4dC4%p z^ft{^=BBBO^~*As%%#tE_?Wq*>g#UonGC7`Y`IISzV5~*!XW2o8cv$3rgG|@ykwZO zK7`3js!x)a407_a@5xJsACi|;ACs4i=@BL`sd^gQWQoB{VPnd&!`!y;+oJ@JaTP;fL%csVXNqkX0Gf_Ej1D+dlyJoA|fl z_&oot+=u4tF?oJ@#z8=FV=pV`>vHg>J=Zk-P?+o3EWpU^y$dWaXMZ{S%h_Mf{&M!0v%j4EPs-W9vnF}}m+lD$7JvVKtAo{j z2dMOwcedi}hGsI}S-<4PvK+D`F&b>c(kN#hS(es@gMYQopAVHB&X7B=)fsfg7AOnG zc91oaQKCBZ%s5hva^}d1@PK7VdXU?NH!Kh@Gznsq&aBu1*MZQ6k zqc()YcAj)>U|z%hxY>hn9G={RaC|;kN7w`Nn+rW_8a+&I!*qL`+}2AcVS1e01_JgZ z++Kuk3JJ57Ny?C(gx7lBX+qOqeLD+oiBl z<>2$JD*JPW)2fOIMYvs6fr1BXnMXvAefb(;RRL|$rcqUl=QP%Is|fsHKV*cdsu(2# z0jsJ|9UG}DvwN`iI!~&qWRAeQs>(~Wak;9Rw*m4{)f^O*n}4c?gM%@ZuiVxO!;}UH zVpT)bP+qH;tQKjL?5f6%Kn1GWKwjT(ic-~D_JRskr&&#)dA{z@HMFYw%IZYcXk4A> z`VMz9yRaU+84wtsnHryl86=o57%rfUnK&SznL;2n7)@Y`Syy158DU^Em}?LSGwdKZ z<^Vv%rmHA(Wq;%pM)N5kwB~z2yunL>8kj!=Z85($^{Q?T5){x}DJW_V$MnYQ(}TC8 z5&c~H^4*v3zI^xPyD#5;`R>bi|NZ#xmtPHy*WdEgGjqua3 zY@&C6{*mrKufFSLkito0j_%CdGkgv)gplI<@(;PKAb*DX3Sy|Mo$T_Pf87T$)Sm@0 zjH<3WGa0)NVyLUJ-^GK`O6q`@AW>KM0rJL>njH*c7`+c-7*j*$vQGV35X0zw5X0DA z5W~>)t)P(9#R*df)n$zBH)uFRZ0O@=3mC1VNaVJx24i<&j6mXG&MY7SCblHHjT9w`=36v4zufn|g!BzrS%&G$S%=iMI!Ayfh zm_Y~0F~bis2EhwRqd5~7T5~xd-Qb)+3(SpyvY5LAwF1Wo3TQ4A6g6{k3o{RIcgmTW zhs$eUUi^lfb1v30(Tqz@ z$t2n$m#*%pqX2htTX_n#3VK%ucbA3h>I$V%`cj^*9=ej~!ORle2tHdyoJQT8`%(t4JAd@YU}ox8XnEfFy_Zi&B)@empO9$C9Lp@9kmyp`D^-l<+Tk(XJnSX=o35huj z81)OLF$Gjl=rNe7^1r%eS*H4_!SU+)z@cM~Mj@M6I#;|_k(&+UQms+o%n0RCP#I?Z7C$21B zK5@0$>L;dvP(Lw6<@yQjDSwE!`pxU750@Xm{P^X^FF$_y@ym~2e*Ev%kH1Vxyxu^f zvZhEgH%LlUNJ_l1P{Oy-et%-(_0|&OZ;_Z77SKdlq>^>*Xi`(Dl$D>XT^)!YV|o_U z2z(#a2skad@jk|+Mt_qMK`V`hS*{q9`Vka70Usk9f$u{b0q0^vKq@(m%{B;Jc|j7G5drTb90eaj9D#?l(sV1P zpmfJ_a~ES?QH~x;n1iR91;v}1sl@@fQO2>F`Nmn9okt3QOF(Lw_gG}baA$FV+2Zle zV%8S$I8)8PA^X7-qJOBE(?p>%?}`Elju?g2d^U=;Id{+i2m?@AX1IV#wSo%NKL~tK zS1nRORDESo9Zk?K1h?Ss9^BpCAvnPg?(Vh;?(XjH?(Xgc_W%j*&gK2Sdw<-jJ~Q3V z*_qwit=-z~>3-U`Iacyc&nO2}H{*f!5=s5p;k`s!PB$PsmoC)|P_ZrYG}cdf@x%EI zC+wK>BmHmpX)SzO&_eq%mu!oKFl+ufd47DNrVgdvM+|rhfZqrrB&Q6ql7G$>#Un0W zz~EWNUzPyO#nJyvtXD*Y|E7UCH#dVILc}ur-^oXg5bu#fjf+t%EI!}Ok(OQmgN-lQ zvj2B4*^ol2!xVm3J5oi;Zs+X8?4JP1_Rfkh@+5?Rduj!NQo-lWo^f?<*(?Bq{wuc! z=`mwnyAP+Al=YsC_rrUp7NG4dCuAK+yUk503&QzgjrlNfS1D!H4W4s4uGg&hNJ)K#_TED^;Yz-E+(zg^>1=Z*UJoUbd9Sb>D*q3?Pg4D+4?Sq*HM`jSsAl< zsYl(p|359?lE+$nMDPXgu0YLjLbfh@_Wgkoj+fKi}sP9I&P|CTwLhxQp#rNYWk?~ChQE!#i3E4CKbzu zx7wV}sf~gOiEX8Mt%|MbzwxDXT?_=bL!(&xnD`N`qSkM)jL1O#aAk`LVJw*!p*~7)#cNuAqi$)Xr>tOk5S^LdE`3EW`M&d2Rai}qT z7lyQecU{Jet-$f1-|OmmojL||D~R^MA?-m_eRA{JTU#<&hktPPo%s;t{~;F0_?9@s`MSESmBMseSTEgp1EPe)i$(D~-!2+X{lfZ7}=s z-bZH*{?Q@u%(Mcuy-(a3RDU?VrTqJV>v(^-`y+qmYOlB@AE)EIY*WS4VFxX?%JrUm ze~(Sw+9yqRJgxkviFmuCD%Xep?k%dpO}$xY%J*D&NXU7Gq5O}#a{URKac7!(hJmmn z*2w~c`|3maNm}Q>d2SqItcRy2)k92q-?O421Nsx7TF$4*rei2Wcy7%#td6xOT&IK4 z^eHgjHK|8oUN7bLub|hQ{h`N75vh5#{nK)_oad#vSp7zLOfbF1%}ua8|3B3~Z^4r} z(1MGx zi=s=UhJ{rs;hNxE7;A&Ev)h7O1?Ynt$U^|X0F3Cefs0j`xA}Lu7pAk1Hj59wfRvZv zJ@=ygjl&nMKWa*JK50n(CP9p+6Zia;o(2{w^Yw}hjQm+K zrP>n0_QM{;6R9=9YkPTP4r7USwRUM{Djo0qQ|8hRr}Wq+3}M7O>OinUWFX6Gc zFA+Gp@N>*h(~YsupO4^JkG>zo@2&k_2p+}xM=%+fC*`ab@6-+9ieqdmfDND7ZGxJ4CF(^_X>2B+mFg$>xF42nSRK9L$#nHITW@eukitLOZkHN zs39}2>gwcsM_NjrrV6vIbu`#YJ2EyLx45)_oYMcHOi~ULFO(=GqQn6Yq4RBLe|oZGP4PdF7A4MG$P{3`QtT8 z#z0rit$`6B7ApI)6^-YfC6xmTigusrPTfBoweiyfx=Na^cpjk=+NJ^?t%Ex7UTjeK z(HJ7Aq>Scv_#bTjgdY6fOIX9V5SHauG?Qq&F5F zUW6JkLO9}vP6)pOtSH;vx<79;CKC)=L@s!;3+{tGQ*=Qyk57aZuhqg{1l`L^eY&iB zP?JNl5(cNLTLi$Vs{U6M1I@PDboFeFhCkbarwavlVHd9^nzdZzrbJtB=l6VRlK=#f z+?zqlFFR<=lv-S9K7ix@Tc$eg^3+vZc@laTJlgsJN(};~fzoh;aRbvpTF@xsf5=F} zmA@45U|>5;Zo)GhPU$;INzzw$h#| zcIe4wgRq+S6MXX(%2|2HF}N_zZV)))KgzxVG9NsrdEB86?ugrq%Qs@&Hf$6aDXwwPaAF|BTrfuYy#NL4 zMM>xGuw)63L#Y+e*Q9h7;&0D2aoJyKz!X}3g@;VPLKAn46-0ts3@3zN7PCavv=~vb zQu$UYTb8FLA`vIF1f{t@Nz3>9Ew!I}ZPZFSMdtLEsqkaYX}_h(fDa-kO-;qaJY5N5;OT#TSJ^6~%GA;i=*?{s=*y2D#J z!u@4|x#77$qaVQ3isC@ke^UAw?h@C(R$@Oe(BC6T*4z2`@Cgg>c>eM+ut!3K3R9;| zFgUeGa*he(7{DFcG9F`!SSh##uYUM592#o)GtHt0_h0PqArtw2sBUWFZ}1cYgm-ki z(BFd?D@X7ug{hYfv3TnMRHRe{;^JHcy18Fz7K1+7?O1fPK})p-IBnk~=D3{J3!cuf z4@_V6v_ce)C8@{X*9qL@d*v&8(JDo-m-7+i>b|b-pM3Ctkk=M~d43aSIkgyca_N6( zIC0DNMr!A=9ce$lIp~j;tsIp7%>qMLi#SpD)!MTZ-MXz1=~x^FI9e2$5L%cG8`46r z0t8ZO@uK$Y8AbRwuhyyq2g$eK?nwaHJ}xjDXJ^$z7m)F*qruGm5;5=KBif>bE| zds1p3Ozp4RcmTGl72MqzrQr65C-0vf$ye#KB;pW!G>u)Wjc8(Yfw5T4iIH4!vU+85 zArfLyJ`E7S)qlW}C(bqvGfRjAFo@d;Ny9qRIoCkca0x9ROJynhynu@L?)&G zQ%znRCF0WR;3Q0Mk|<8<>Cqhpg3`vvT5Zu%V zN%mdZji2jRs{GMM4j2HnB5P13)i$Ynd`|qx=>CD_H5P6W?{n#Q`VG=k^ssMX>q9A$ zQ3Ve%!BR@298L{BSgTr*{~Qs{d*3`zVhovp>;aTA%9Pku6H-g^iZO))jcXLoUp}%D z?V*CCtwBVf28X0tJ#L2f&u7X72EL?@zHy!dk5MZ7mK zHZuxyFmr$)TPiKkm^z(5am;Wl_)I1sx{Zw&WB{v#AQeb%l+Uf2N!=WV92P^D%S=mM zVZi5nddehqj=RbtE7c&SW0Le4*f-vE&2)%;V0^tD`<1UVHS|YnOhp}1k1)>5746r3 z=IC9qS6u2)f1J=b6Evf)9{acyg}e|}v5z4UAxkvIA(zd!?6xoPGGJIJcczdGCJfc6K<+2a= zjCKc_=Dzs&<4gDSC1e!CM_O{a%FJ%4s`V>z0zv&xjkuUg5E={Ja3qNa$=sk3H%jCkx^GmxuVdbf# zkg!9V^WG>{H{4*Jv`&jZ6iq$|Lc@_SODxF*-L5yLG&JN`&SKDx9fU>Hw`noVs2d{- z$pZfGyM$RlEK?}7q!ZmYMlonR$|Vnsn0QnWMnEbp@lH;RC6V2ro1Fo0E=A?X2oTT2 z4qbwn=JupKh*Mxo1|fw7X^LsAOnBRI>?azo;AzO9clG24_zpNv``BNzDfU9HWqE!I z8GpAMMrsA0U{O*ola}IJJCWrtSu66<{82rri8f>=5n>c=6r3-soIk2*LPr1}AzCvV zPCY0T9x`M;m=m^*$`t{$8TsSTb<%Y*o?@M2+M%}xrip$Z#oQ20Cz-D~-ae+jMZUG= z6(-K>qJSK|7!5h_K7{tH*CiW?iH^=D@&(;q%@If25x>1#Y+F27tdB;Re|X%Fu5OwW zljOv7GHg=|N$KMX1i*}WdFJ_qy|($tb56LACP>A^R~3e~GW!F_S9o7{zn%`w)P7Y+ z1rJjshmPE1555xI>bL$K6XHn6nU8dn6jeH6)#`}2BGpufPQ@Sik8}q$wH8*yW`uII zm+U)PEPZ?s_7%dDAc)9r$WBm;D8B~%<@jxs%+rJ;jFjz?TIE;I4%6?5E^@w0W+Dy2 zz_;HuK9D6zLRiy)A>aKzr*;8zxF4%O>Y7A1wE?deO?AKeZzjJ`&z~+b3;s_xct_J| zo8N^h?7V7?oSq8n=ffx^e)apm@&nZ~|Hj6$V-MX-dD#fubiA~!!k6MR6H^VNxp0x5 zx%F%!H3~FnF!P1sIyt7xZ0}<`7%1Aa7K)#=ey`dgx2-b)p%w_M>t}go*f)WvwwY6Y zEG3I}$P91LB^bMj!#rVq`q54~EBgD5AVdDiLRs~%Q{UwNX+I=Nj? z$zTS0Tc{`it9I~B(??ZsKeCoMNFy53)k!H@t=9NNks2~S;|vL+&2qTJ%aggWLv}LJ z=DoQQ%3D)o>uC%3j85r(@9%KF*j@A{Uj!p*ZTty4b8u^9vVw;@o01QnLzi{Z2#Mz; zRuUw>^%N^EFV0|+S3qrEq^PNF*hyyKS{Lgu@NFxf=w&s2!^t59EK>VdJ2@|81A zSU`m@=FV8JP<79!Go3CLz#6k_;~qNNv}Kmmc6QGc{2R8UcYH#iv@bY4?Zfsbl8YL| z;iQNR$k>v;pn1bOr)QG>O&^s$61Vxm$}-efZMJta4eL5-SN;QaUaiTNC9%#US*Xwf zH}jK{8SRK$SbcLo@NzY?b0D`rh`-- zCTkPgJN4`GZ!rrC__+H&tU&$DKZjcVE(UrKP&e}r_HN29Jn&2_a~^r@!t(1JXEG~u zay)ZP(QQ;wq`AE_ug_MOk2x9XCx`sU2~yY<$Hasv#Z`~=d1T>C>c31DZ%{&)nVe3e ztvS0sMtGqTfl|b?=#{#HD16kjMR>33=h>IopQN9~z(>;~ohv#>-$2zUGv|^p3iY)D zMrS!0L^GPcj`XC_(C3)6wK@yxG^XdV&J69!Uz`tQB#otA7I32wT5RU@b?<&; zf3Kt~bPU3%j-AE~-+%Ye1dKNLV+1f({y43PJv)xWvP@cgu?@}H*w=^PIj0jwUmqmA zCmiNM$IRe|I|e~w7r^T$XR8u2vG-vDvQCufVo$5r^JDJ^4~nduRS{t;&gE`Fh}E%i zFX(!2SmYJI;wCtwR3$H~@M__4#y?(okDmBEOXk6Y~{SQ&UH>3@iTSq5yC|GlF!qd>qPL9 zkvEdj(w{f~#OB%Z(A;>stIDqeXA~`yTMThJe;94n?7>c3*g5Z1MJv{d*)OI)|FK)M zhoK;n`#~RJ0?vnE2%W}KQkGNB1C0B@9q*Ts#q8`-g1!)y5Jiw{p%uq*i;2f(AjAvT zQP4}O6tdW%%Ju)1)-?$97ERQNq69(6@qo#KW#hDIU1)G{>TwTxUa$i%tyQGLB&RB{ zU-AM;eq32jf_1A+d>3Pg5r&B3|H9CC4Qqr#9z%jvcm3m-J8EAoM(YU?adynyFi>9* z0v+)hcW{6NKw^u$UXk8mN2PkAqv)dtf=m<{q+@#mF~hD?q($OiDOGqB#Ohz6=0R~i zKciInDzA?mNF?3~a5DkkII0{;s`A+ieHgExbONY zKOh8K4|~W{RE6pfddQK{KO187gPHF?ZJyXL$fVv8!95NVzWHkkh8Zc!?Ib7}k~tls ze>-eM^m~G&A~kr&ALq%6{PJX9DxAk3NfLellKz$)q8x_yqzcIIHo~JHDk(>)JgF|` zs=d<{=gYs-S+U4`YI(Zv2*t+ruh@%uqVEW1xuWloDJ0(j|FqZxCFY0)FST*v0&vxX z7?z9$p3?Y_$hJ(*e93pVKY1GOus1wN;LMGR#y|sem4oNHjG$KSCkh&B|_+blJByA7jHI7{vF{~X584+Sl z0E1riaUY>bnRenKuQ0k{iciSD2T#oCleYWRwWxZ4fC`>2Xu5;#eQjOF52CKj`(5~_ zht{ujhsKXzOID1Nd=R+|n_fBX4sNMj#_adaZbzjY5lUK&qI@uPYV`%f*K76t5VnV) zpBQ|Q@ef-reQgqfkg8Udcfw{+!YkiK^wf36BY1WE_8?*AR#?R$R~_NXsFVYCiTl3x z6YM!4Qu7LZe&_=8e86=n<|Fma;5T>@dAE@M(1$lip?g@U<9I7;T?%+(EV_Ghtx;uQ~h&`>SI7OI8&!iG+2=N{$>4OJa{8q_^!?z0 zVT5bdM;xY6m`gbQMC2W&$0Q#x02q?H_VWohn0R4{6ub6&MPizGar{y<3d$U;aKg!P ze0J}o5()zxyx;?_6S$*R4t*ap7nmHhwnCV$bUcZ>`|S^@FFCeib9!+*X@q_?c&Khg zpuQ?@MJRVtUIaxJTxWmC$;Z498+v^ixfPE-3HyMMcYhV?yVZ?8@rynIK7XDcoW)89 zse*CFUNj@OtkEZ?1Pj!T@=PDtsYC~I4fFJjI$HFbf|6 zCm%f{x9=Z@&)mfo+{M-(P{sea|3}_OQr~+_OFmvwvxis&B8;CQqfb@|78-bpk6!2vhU;QKbe|6E~Vwf~$zaU11G{dvHeF_|_B0MWbY~Y*#iz8I? zxHbsG4}`JV|IH1)0A`_$3#Z(-HGnql-%FAy zlHvf}5!m3N#EpRJw`&dgbcFafsAg_h$b6P6bEu&omjG*er_cdf+f(?_Y38&Is+1nP z+h61nKK>FDFR*5o!6!&?mo6}{<}&*d(;8-%?lB1U0M3B)TcksEvvXT>7J?96q~VV4 zG%%oijw79E3~AdB>*vX+dHjWO*iq#X9`AGFa$sH$>ZMJ}{2+V5dwd+>t7dx8!cn#@ zeu>vE`)j`?WY9t>wxaRBwo9gj8#Rw%R7>arN+)&9LTHH`jul+QQ09;9}!Y7~}sLvf#)lYN!Niz=_5eF04^MIY= zNCRBtENOk`iFmrCVtTvaMst0T*vygK%*a2FQg(M;)FW~|lGAF!$Jm0;=M*laOS~CChVQjAt9M0Y-zuBTh$P z3@V!7@Xt$@uL#5s*7EnVGOggA{YZv(0S*x2jc|Ok45z|5wGiupgebq91p{g!+(0nb zfrPPvgcc}n!f>!sAe3nTJ%L>SRuNw6_rL0XRGdKaS_G+BYJy)B1i$w3V@W!Nb>_e` zF4@-Rw?Q|W#RzY(@NcEq&!js7y9${YTL-3HZ~>Q8r~MhD=v#plonsTc#Aty*Z=xX# z^!(cfLzzeS+`Kl=<34%toO$qmdGNNPn8Ycn!ptP{ect^T_ll9sP<|i)zR;P)wjaX< zK{Xe}3JQ6n7VgkRFx(KG3XbSJ8BYH^S#mSXzocihxMmXNdI$TuR(;esmBgfv$plmp zJ0zBNiIDc2)?u=7P0-Vm(7KHYku~Izkh&#!1Msc z^xkh(Rh?N4T=K$v9cd^)B01K-Koq`|pQP~i2>a58=1tYQAbZsrfi_AMO>fMUa(1D% zk1F-V(qw>YP)bh+c*a=wQ<2Gd=Cdi4M>PVW7=f^j;;08j(TwIu2J;m{C0bA-x}8tf zr;9FlQ;2v|1RWUPYEe3d$$V=WSc&$eWqu)1PsK2 zMp-?On#PyMF>m2f8s~+6&I-*kau|vc`@%rFc_Bi2-r`Vron{I)&lw;8=@#@tTyM3< z76?XpKyt84E{Op`koKQ&jzC_B7jwoa9{e+MF>^_}=~>-T{Lh>e&zz9YoW7|ec*n}W zY4Bkp|I8J{9xJoY7NDFcw+Gzt%WsROb_cbb=%5_y+`^;Q&TZep+%}J+KJ)SBgcuam zd=iON++se%`=)ivBhQJ=-ptUwmgx_J`QozrrcGJiqO1YOq%I3$za^1DKZ*RmRNW>y z&ooDL4;NEE<54{0tsPrueqh=Z)$IIuhR-lPA$^<)^6#wFcxHw5I$8QH?;en!q93N; z4%g+v=5?ZuGAFl^mr^aowE0uNJ#NIMAmu(crCNkZZ^Bq3Kc!lfNiRx&ZOAyeAf;NE zsf*yV%tgQ7DQBwVe7>(wu9^GN@AaViU_t|!2jUl*m^;X z?Rfv;deMySU-WLBTpV#-Z>>-k=jfEBxbmXyBng>%qN~LS^JOSVzPYy3{u0uSY z#BOB~=M-@AGgt;Ei1Yt3i?0}m+V!G*x(M8iL+=ektNZ@bs|Qi^f=Ju(#5!L|+X=*6 zpn{JNarO=$=1qUg6Azg^b3@+FQyv!)9v5XD7s+{g(Ro?ods*^%ofr{0(|Dbb-Ogj( z&QEwuez~2ex}7%zZs&ve%^1Bb$-PeaZ|9#n|E26YJ%8hE%Vcba)N6#$Yed)6Rm8TH zz_t~`ww1z8S&(3oz}5?7T=QpSEQw$g#IE9ZqCh? zD=$I#u9Wd9|AV)cmPD17+v6YBzCY4@CJpfq! zZ&e^q$RI5d{BeeQkvD``iw@S1DtsWa>Yd7u#n#@*= z1>Dja6=gUE+x4&9%5F$;8DVe!%yJRnJ?5p)wN{o}$qm2H&2%G=aqE-P9FWr_ji?Tc z(Eo+##Y5ooNg~NJf5LiAq9+whd0XgSu_+iYs5S@}y_vy`M?LD#Ku)T5zkNu3k#bUdoW(-pC> zjyr^_*mH0zpvbh}n5oKFa#Gl70HXk;W}dstHwTTC`AKy#$Opd=M%aR`rF+N?z0>(& zN7|AKqFyVv9n%=(&oA63>w?DW{iNa; zJoG)(o~tcSld=%biDU(25BT2-*so26WEU}9E%=0~3o;b96y!v&`Vo1J&oNlZ*=r%$ zu-3(LW?X|mV=en*`+0%_<=Ft{0>^N3+v~_!)APvLja7tajBi%*CY?KK=td)S@D_3*y7#!;>|#x9v=2N z^!%1UIJ}I0aWiGE;#$p*`v8>nsBJk=wa@-TdPZC;X(|D`I*we42JnGCk5!a?qj~Mg zl(1PV6W%0HUB6Un6GWS#I<#j#xk)i(=dIgRCD~N%WEfcHVdU&HaHglPPHq^^3 zP=a-(yVOz$X?~1j>BSPtIX&ZE$8FAViU7-gRejSZ8<`QWvTO?(#+jQ~Hxjwp{?c?7 zemG?)6V?FwXreXL9&oQJDE4X@U>R1O@U&w3v+Bw+!#LeQH%>0@L4bWZs1z7*!@WoC z7eT$hy)*V)!k-Pex+*@U$YAT62z@$oHWN5&TiDk#IkIf0KNrw!@sp`Tp0U=?URc5q zB@A|4S{U@}GuzIxK&%I+m0uN{G}hf`Rxi(PXQ7k%M}BnS1Nc^W8E*EmycI7;(#}?y zXG>Gwe^a0|^(oGmSsXh8Cf;R06IvhcK4%nC|>ukURK@`61D5I$4umH@-|9IfE44 zhWzJ#A;D6CfBe=fp37d#G1!gM1MtIZ7K80gL~0CH@kZp~0o8izlVr%E zGnxW6z7osTwp9Oiu3{|~Ds}jlrL9*ay9|eZ4OQy20LkJ68bjq03NT>1+ObVjCTHz; zL^0+9WamO{!)RoT1=cH71|4=A4O;^}9FyG~b@F{%nyR4q#A>yyLP+?lLa-_oM-`M( z^#U{{G_6IpYT5fq)=b(Q9u>ifOV20y0cjrpL-NDVk7rE_7aYB>1;%Ni4Q`;F%EDgU z-$US>fB?UOAlB5a-)FJZx7ye`b?E~1 z07*Nh-|=p*K)hRf8>dE`2Hjr*rMZd6SLao9usYs^A6gIyU8itO+Qwt8#zK}7jpf0h z0f)l+fnX41NWkZWY@*M>3Mwp3)a`q^RPNz`&Pjb6no+z!=n5`Bg*xbpM9;xPI)3?- zRI+PTtg@UP`ILPMA{ze)|A{x=uy`7gi-8tC6&?Xip+c-#dvQ@|m8r^&>92cKEY*(`Z7%H~$chQsD$tV&kWYz{3{&`9Jb&53 z*vQqwEtK>$b=z5m+ao;8M%9{IEk7CM#g zWFp*+7uqGnRWv90TNnz}$ODQ93F!JnzlaT8287qJ@;#$^wpLfw3Sy(ngwg#4KY|^^ z>r5i+ z9LqOmih5`ZlKpq(fmo6X-7?9~F)6hkLKH*I&2K}`Kp7l2R`hOyqlm9BK7$uy-V)yx zJHB>O)rBV}Z2dEDc0pdNBsLrCw$Vd3+Gv>xE}AS60~@NfxIA$#n+Aw>Nt2Z!BAaO= zc#m&Du$*42|EF1%eXbZjF*BLAao1s;{ZW7aX98w{&Wv7AQop;q+-F#urht~Z!AJCI zD+%zm*gEsgB5D2cE}V$rCqKNP5*gep+CyQW_08MDvRp{$l4`5&yZVoMsxq4((=z)6 zBh~(-B7p=Bye2BfpOJvJj+H*Gfq2941`6X4$ddyqdgam~}!CDsXd36PBExyn*t@N1LxMP?F4 zis2NEfy=_gjE|ZEaYbv7^V0irdnW6JiE}$=wW+>C*JdG_taIm~`0ey$wM~}2@=&6; zHLcEecged(a2#-o%_$$wtraJ!Lt$;dw%kZu0(V$;!+=yK$MC`sZiFC{FdjbN@3c)c z(`ksez;_cE%GWo!Az0>^$5h%(J72kMQ^8iXsBNA!uf4FWb0P0dVr#IbW9gV?`D9sB z2uG!A70f{yOWPKq!e$h%^6&E;SEz;wFfg6bR-hzE$^+je^8WBIGea7MnuK#vQ&8#Q z@ZB#_H__sCF!{Dq@^COP$aBfoVO6Xe)oCxFB`m0sls|NM)~ z3lsJ|0R}Zh%`2iXKz(s!Nc(Ss*ckg04KIEe%85d}hJqTctE`F&S$2Lz96W~}{SVbR z3#Cc9L^J>&tpoi9&7G1+aj}*}!6%)QgwXxc(c-a_`is-y+zU5;D&pmM2om{W0TC7# z{~issq^jk~R2$J1-arI%Qaz=J3HQ0e)Ev&2OZKCqI9juik}(MH@dZz0>Gb$T!*r8q z(>(VFE!8iRn@5cGvgc&eC@Ds;+LYF^z3Hgv*gHU1F^6O;65PgS6;qePvi-TG2*M4s z@nG88Q5v><(j>Zn**v5(^WCGU0drFgzd-7mW;~vJQseNBmY`ji#X=#5IY|&|Oi9{p zqxflDHdcKw4*Ab)2bOAVo^a{TI9PWz4alPLaKp`G=7GE5IP!xURmm9Iz3Fb9zc)!! zG&g`mukUn$=-sOOSW3ZPXM{0)ZpA@T7y~&kIYech*mRqz=5SoA{v1J49$`VbvQ4U3 z#$T{7qbs#@jeh1|rQ*3O*kEPszxs2a^dIyIq$$p!P`OLj!8PIOS!-x&*eA!j{u?39 zZJJpkyd{LSUofuy1aasMhTr?y(MTaY%Vws&bq02Wa8GZuGEm{s@{cry(~w%#7%R4x zvr?$gSK>osGWNk^67Hfb71h2{(jJ&wDOy<-mr|tacS$yxEW?D1VtHy<)Gi=v&?uNN z`j#oYcmFNKH5$T&%6_-dZY#gTg>+LU3ypWV-hX63yu2txMh+dw~YogE$wJRvUhA)k~aH`?28{5dB18W^vK z*Mx&@&0gNPnGTM$q=mlt-4&>SR`VY>>Nfs(;>p2P_tAz=o*_6X(_U;$kzOX_#LI5v z4G1jb!>>9Fb~66F@f_Q-GcZ>=Qzy+lq)dpIoG4IjB zO*eA!EA%VQ!F_F-1Tev>;Yx{44fL5;7BhxWPAb7*3vn^|&S(oYP`kvunD=7!0^Y4r zN~=1?AhWL?>mIMgI?%YeCRkP4L^b)l@9(qc#N;k2^cvPb>8GoC6;(?b7Rscp%4voB zK|Ny+$Bl#>DQOpNB{GvqeN2Dy2?PR6o@Jxm81t;5Z8FSF=K5B`BkuWJt!#QLJ--Nce2bEKRL zf@`ph3Ih3{yAu&9mw8J@;(L$OU)JnbreaG}mh}z788*>Mp-PcT;n+!S)$*FZNSRbG zDUVF!;k4bU9EaQ3f_#iYR4kACU1_7?W78CjdXiLox6D8y+asY))*-V41B;|9%a>eQ zvsnrHt>ahBnG_4~mIaVYE!Np?u&*V*|N!g!jL3T>iKBI z<@)O9()=Jo>TmopPxt27*ZSPL+*;kb#cjHw+K4M#dVJ@tyF6cLZozgPH))y8U#nyf z|NB~6Kh>x6lkpGcseB4OtKBS{me?+gF(P1K1Zf|z-bb|WwVAqmc~wi>p>@&e8slMx ziFY!*DmfsjBM}S{*X*lI(%}y!aW)dgh-mXXo%~*}&TIggB94uXO2Tsl4;W&g30tu%i|3?7a(M#1=;0Vy%UA>xII0V11PQ$1uiZd`8b?VSFPGep8 zCqJa$0;k_1b5Y;sU+tw?VO?T9T4W^h2U8DGjSV($3#Vj7)_Cz*O{ZK)Jyuo5Do9@p z5wD|Ihuosyq^WQ!iC&^ja7^XESawg6(KdN+<9@HxsH`=wwMq*_`!%7^mtx@%_yW6t zI2rbBGCkWdmcwV-##ye;WDX|c1l^yxC5PWt0fteltt_v@{<2ks*bOKcn{l6BU1%3S-J+EjV5c zf5zh{YE3rn&^gq)A83*LIvR6rVjy-Y20CMqi|0&iq&-3`pCy18@Y0a*`_=G>EyQ7F zaARYBF0#u@r>thtkcqMBWNf8Cs$FaEIKn3)Vg}FTcJ|g#ViU8#o{QoT=AU4d?DY}# z6tqauXQXTAY>`FJAn>LaaR@n#c^Djo(v4(b{QNZ9iw`R@O&I6dd5eqz*Lil4 z85l0YpgSq#mSMuBCRh_R;)U2 z1@m|`fABe;%{js%mZ?+{QW3!4d=!RvHcSXA!q~JEBCJSHids`|gzB9^aHk<2;Sul% z@WAzmY^i*X-S}ny!KJ8@O<~e0g_w9>r-%wMQn?$NXyF>!9-P(}9-gtr%0{({rP3^1 zTw%%pTkGzsUIP^RQYH(A?-qn*jiKB zjxJKMe0@#>SNnc5>B&UVgG$^u#k~DTQNWR(ua^UXZ_cRU81CFbBtrZMGlNi!d{wqK z;i_|aEX+N{5EOL?xg8IFadC`t_-MM zfW#<&N;nX4XplgV%2`fon_}x2Y$~mk`-M^JVKf^a)B{G>J{VBDTcZ+Rm{J)p;Ur@x zQ@{^Usam#=($_bMmG8`YgXl02(@^?Zyl4 zy`fQv&?J~#V+OPmf&tE0*)xgPb`~)ea-a3s#=;dnZerRQ{3K(7=Fg&V_z7r+!z2yw z*X;4dItwMM#mbhI)1g07u#gk_Ot=oyC{zQ=))&p!%;pbRUKowtUEns+c%9Hf};#1xi|)ZMDSZT1R?!zO3#*r zvv9(6Z&$uszP$^@*7f{s5o-*Nblf@ym+X9HXUj^jdKNlK>2Wl6N6=a$%rb^^DyIx@ zM!Ejdcym={0;f2U36+6dwvgTuhfTawn8dzDtGu=|6=I!Z8ig`DU{01cY#Q&;#FB9A zIxHWbD?c6>L}9A$Q9h2%Ita!IhmSP5;otjk^T@ADFUbAed({V{?|t^GZ~tJv54qX) zZ6}~=T`)H#DjR3h??II!8N5J*@1_DMg=Zk4iFa5hXe<-4dbakRj$_qF) zrfq(PS%qWYab$-yAa#p`*;uA;SkL$R8DZRa8~Aq%-V&kXb)Y83eDym-FYy=Yt3p~A7Q0;6JCzI3$9d%)gr$aR2AAr_D~HEVmk zZ(h4*8w@@G`ab}gKxMy!U^fth#TzD5qx#e{rcj@^w6M-79}XTLF_wS&nSnH7G?fx& z0Y&y%(yiI)X|^jrL zl8^7v>hp#$dHe7`vTe8Def9It-1Ot#4WE)-N4_!W|8)PthVu231~<){wlca}|57{% zA0|?zwAh_qoIW*ue)@l(^S{VfmgG;(Z_J-xu%tkdlu_cX^)B#U@4eA?SMh_z`|XG9 z+Bi>~S5@Hhc)X>)sm?mzeCGmBr*p0I0q;KVuf6(S@AthlSIyv%MofiFr_*-Ps()M+ zp8cjKNU?GB-|hX_^yxOg?|K_)v=JMd_cB}oTUZY7DJ)~|kM@803j!}jk|e2WZoqbx z?=jy&pWu_KihTCkBAf$h;VMPvJUgqzwur5?t#rUyJ2 zRXlrMu{FJ*Fu#y0i>-l7l9wLHBtw}5z-Aqola2jq99a$`~uFdz?tG2NIH zERHYESZ-Jre~aO!_$N(=$geX#A=((CF^U<<#!^yhC^nXv)I`!~rZi>n(@o}+G|@LW z^ag|R8*_hL?D^Rq3Gx6Wrj<$Kb6m!lR_;lkF0ozRy;>37>vd+y+YE0m;sUzZ!)o9E;7tOMusV#7!82NloHSctX4HO8Pzc4 zagYib-ZPvus2D!6*GJv#$qX;V_Z1ZB2QKD1R2!ik9U}Z@p<*w$XA z>%!PEGfSWsY$tFdi)}f?D$f5XYBc@H^y$()h&S8Aa>^bPCHAnK`ecIJWlzj>xwwB~ zCM22@5)#dDyCXrfIU&Jp6e#6ElhJH48RJ0+3l^K=%_dX4E76}xG83rL&VEQd-eh(s zz=QZrgn#qNd5iEyFEV3x9vxEct?k9RpEg(zv=BTS`lfrj~E$?ZuAAK%6mU4F6iDEHnZ((0F>f+-I}RJ@e6KKO1>QHXyI4 zzVCOts`*NS80vxr{tX|{sUru36Uw6OyfQxiMqVI)9Cgyk(earzQGM13BL8yaUWI#f zDRjt`bSfWF`v_vJdeIUWCi#E6e?I;~B46pSL)8n9kHnvx*}>1)mrf5>jNHq_jGd`B z%kPT!2oE6}C1kQxl%pVdxkOQ%SnMng<^(-K?_}SqxU1td3VVY6ZuJYwm+fyVk1Ibf zRs-X|4Lmk9%<0pO@p(BV86Y=hlkA+5K&(m2deEP44;Zu!S}JM#v{ZlVX!VkMFY$V_ z&62MmVD2;-9O_ z@)LvmqNfxyM~26DClDO&2?qIQuihZ}76uK>ATf-cK@WS_k>8r(o;8u4*UAHXd<%ox zXpd{7yUg0?CWV%7QvA2)Sq57M1mP$E&bLNj1~(1_ZX|`?0O(WI2=F)6PCR>2C#e11xo`DW%b&CtbKrH^;wJOE}Z$ho-9DC1=KIj?de;LD0Bdh01)RcSa#Nz z!M|yM$|Mk5Ft4}g%tL{{{0bn80o2Z$*W06il;!~B6acyN7A}AN#mkFwS^;(qr&+LQ zPESooqy(T^0NWS#{9>_+ne_lM0tlSjv#>Y*;`B!W;YWapix>4RP32<>K#F<&;`4eJ zZ`kFW2{^g|{WAaz{!D3I^p!g)tdKp+4~- zfcn9~I{;y?tdW1G3y1%OW~PEs|E=oQhj!gR%iQ$6R;N`e?#-Lj!_$x7o>nJo{<%gt ztc?QD9le7f>?LcUf>w2>stO=E>6G>0EGnr~RKs+Xs;D3+Z*|-;d3 zP0IPJ^r?G5_kjMa^l6x2m|*yVpT^VqX}T<{`Ty=TH;Q`kDa#@$OM2XTi*2o4tDI*z zUUPorO1Q6gU+Tm`$m3U2G6g3Mc9j*guR&Y6J6tR@2bIcK3fDGKz+D9lP7TC@=Ts0 z3rjP3hB&G-dEq!36`Ma6ZmddN2K6 zyf5Y}@3P=$+jExE9|4TOe9XoI1>2+a#)Ep zhTenMFGUaLV*&b58gK2GGC3Y=X>Mv9)=*zpQ(aYAQC?PBQXDNREXa@K<%UDSfZvys z?e(}_PKVuQl`Nt;%Vad@by|&DB`|+VP}~+C)g4Ggx)VYqJZ4M@FNb>qiAc|Ji0(w7 zCy*F*B26ODt&jyyq>T3j5@(%68BbHjk5Upb(1fOv;y_zCkk~si97vMslRCnI#C0RX zoq@!Fk{_?+*C=_@$Z%&cSW+Aaw7KSu3?xW*pe-@#f_W?3x<{52lZ^&_Yq)>4S6@<$ zje0|CxYbZnjD$11cq4JP5G6yMZNoNFXiX)>Z3$0!WLv@=9?4sfV0mplXC@|2>S!D3 z4F)?)iW8)DPIz_#;SmXQR3SmD@|c9WHK9=+6PVB62CD)ai+8PDofI*Ld}hzg zjs)xJRvf25${<&rlh$2^uWxH1iiAeBSEh0EGZ7~H{oxUe!t#u8^?5?9Z2ZH zBf|4mp55IONO)EzaN4q9zsD2bCLe&OEwFNOM>v>>dBdGOBeOT!u=0PjWt-gbfcwOn zlH!e`CEc+bv&@-{(R6&K_h_AxQ^izpU|~-uM~%IJik7n$`iwZmER*ly2Arso`~tmVAOfy_uyGR zPmWHt1nC*dC!*0rQ4xQiBAV8On!iDdQm!c}z932GhZl>1B%R+DNMK?|g7kC_D|3|; z2ZMZoS0&?^T~ZuOteDi1E(b8%+mCozv@=1wdCjh&8v7Jpvtp>`=;htvU`g?2#n7-P zw2`A9v*@t4%^Q{=j{i{Io33v^J={KNdPksbWp}1;+b5q;O4onaAFa#e64urZ=B1e& z^)jV4A+^ptO3Vu##)OcU5c1T@q&_pL(N5|}V@P0BLhK%shMoFg@V~q$DSyMSQj%kr zWty277Co`tctZJv<{4MA_Q?q$Lfa=#U%66$LfxqFsP2_3M}-5UR(7xKNy;l`hXZ1G z!k(G^FQA>YpVrY&wFR%PH(W23;D!~*@2lID`&2p9u9_siJa`tm1$Iv7qhZEl{@q# z<=eBv!4iK!_!JOsf>-zyJ~kUZK;EDEe#AW>UY{D2W%@REk22r%F&UF_s{$vJ@#z$2 zVjmXbM*JF+Nfmh+45EPMe_At2|C1}EA+y;LqULhSQlJ#i9CYnQ=KrtD6*eq?a zTrPh{b_p-Yv++C9MBfq~#Y-3xS3p&t?<#-HxNK}B(4GE`V3Vwy#u?tv^y*>Ds)B)KC3nnYR)Wx^~Yw$4M#=Cf* zFsi4M=@hmeUNmDmX5&WOjNjlvyny{gORC8*5+_%YN9Y9t8{7>B0d_QCjMDozVlD2) z{n&urconbVZG4LqVZ=?MWD1!{eo3w**OPx+$o=FI@+kR&s^~k6vCD+#gfCKW$$I%t z`9XN$MfOh?B=-U9aS9eW7Lz69VsZ(&k~~N@lO5zO z@;>>B3RF$)G)kj%4!xY-OgGcr^euXjft}7e*b;UzyP0ifud>esQ79J5h4DhSuuQl} z1r<{}v@acT9$7dzd+^S|XHuo9k*RZ1t5Q#;-b#HW8|0nx$55jjP3Xj2^x=P(SdOc3 zJ?_DScnELdLwt%a@GZW>_k7DdpnxOB}cj@=^A1uO(StYAtEv%a@ zVOO(j*v;(M>;v|(Kn1%{A)J3MEEoQ$VyZJ$x2e{ucB`IOeXbVOGcqz_^6|badx<_J zw6FzOhl!N2&*|&5iTsitCcmdSy7@im z9khf^6C%urr9bf-=yZA&?ZyM-aU7;&$Z6yPwwJD>v)EeUCZUDAjpcvzDFM_(e!y@H zCoSYb@&=aBw`d95AiT`)sM4|{s)f`fUoCv9qU?1*XeN}sNT!nkGLbsSQ>2kzk1&}| zL^6Od8H)zIi}Bb-rlDRqz*f_7^nEm70d6Kwv6tu$ETB8c@9-V!ks{}jiR3O;flJ8} zOhyCFrnewO7t;_f!4!Y|ja*LbcpHbw!z7oU1%a999PFc=Xu_*RqNU_gRAV7lk(DSW zgJc(8qBo+J^s*<9xCaX;IWj;tvN7054ht^`FHix8$x}3kloKt9<3rqwwU~nE5M&WN zh2ORyFYBYD$Ze_bh2ej!3d6CTxJj$JK?_xr zDo3am?82vL!CW4bQO^_ht1jnx_69p7cgn%kELB$O16+i6F$V9GRoH|vc#k;98Dx?m z({@3Yr{ZC{LHIy+5+e!XHMyLOO>H4fBv%fQC9;7`!c{nf#|nj2!j;1L!XfA0>+KUW0nHU<5{HqE}Nf9o;w+XW?8d!7p$(9>GS$ z(T*uN1G8}!&c+h-;X+)DOK~}_#%kP%+wcHhqYu%0Sdd;rpQRVj`FIcSu|KjnnTmbF zwZd|oj$BM4R?J5on&8K3td`%vbQHo%%%mF2`Mj6Ekl%lj|1kIp9>4>*2{)-n;0tvt z3NV5EAb5ysJ0{D!*slI5Rq-U-)jv#0Hf7~juHdP`q@?}2s@U){whN2dE^J`C@Cw@n z0khaHEYDyV{A?FuY?p$)L8)KIb|AraU>DngSJ@5)vmFVx9lO|eyvnviK#V0p*kf#K zf382CWSf6CxpOPO9`0eAAhS)N>_)ZTmR$hwIoX z5PZ#6L1wE!{H!CBPGeL1EB!l% zce5!V*r335jK`^OP~a>DPEg=-rFOZJU!>$0DfyU^k7e>4mK_KE3N&-bPGhH|5Pmj^ zjZ@NztPOeavk7dRlAg-OD(QGOT1ih~G z|44s-`S8VT6lSqDZZk2CABi$H5-~Osf`Yk$jl?=O68ja*EH)C$*+{&?MuI7ngpFh) zSu1O0!`X0{S^THz6Gs_~gRwY^vlxr97S;kYYX)J>tQm3Eq`YGj%2*R(tO*lX6K1g{ z>|#xLl{G=bnphJ8tOn(*260w{iL3_QtOkE7m{~E(STSy3#bB(Ml^_>>7No0TgP#R5 zsh_Tb4}RvOtNMNZ_;4NFjEQtJy6I*trkk;XZthn}=HWKF3Y@l#uEGSm3bW`cEdL32 z&ri4wbQQFSrEB5_8ly2bflgpTJjn_-H8oW#X;p1H&CW@uMo*=A_<5`l%UL1rVTFHS zFtb9Gu|mX-mi(*`6dPDRcCviD!t$}73fTK2bvOvrvCO)tQrYRX-VK9v-8sF@dh;mGnB4(d!VS*Ktuo zITM=|SeD7JMj2g=p(}3qsl0)%hMH|-+gKqhWce(g6|e#pVj&h}K^9;E=4XE9V?Mfu zuAw*38|d})dU_qbj;^Mw=_ZSMJiw>Oyr*mT(7|M6c|^aGwzvbIylqx{7lmwGflV7Gg~ zGZ54g_(}fe;AQ@ggGqt(`>%fpCbgvBe|fqzBb_vINsWA3qCVQ5&`q4tv5}DLI}`QM1idCnFu5a1WRAMh%Y$j#KuGbG*LgE( zXD7d=W1~Q>yRH+C3u3OA)M9BEHS*tp?hK3`J6zG@3yHdDPU5!q(>oFm<#Z-0c}C9Z zY)=Y=$KJNldRp5yavOiG<4I@7HvI}(-*y_u>sO5IJVu8At#2E-4MCnLbO>-d1Wuy! z(K=3-$CEUjPoeXjK)10u*fw%wFgQfhtk5){NHh0Dnz;(i+zbs%(*%#B(HuZfp$TdZ z{0oimzo5zcw=~D~X77mTe>liCj3aMtY`usFF1y2Rz1`uq?!mpt zOf%9wd(J$b_VgynTjAc3iPrGQz{YVG{cC;VB3?Z%JaQv0YMb1#@uGO|$o_Hhac$wA zk)4}H_Y|!^;c?dvJ#J%B&%e1@55HLvf7a;r|E799uO7{xwVpp~J%85d_-N%>%B-K* zu~CZ=ovky|=_Y?_&`Yfy-QHm52#2`1MVZZwLD!|;?E+uVH$*!V#_))QDLg`{Dj8lf zoL31@sE1ftq|qI zu)!i9h8=$v`JZq=lK%-OtnxqMf=&Jh+;GVMfJcE|IOTsJ8&3I0U7R{2i)LB!7o$MCE_)P=l!aEoxCLe~UVl$lsz~fek2? zzripCHlj@a22H4tzd6Hn%L5pV26+Hu&>(+_u^1+QiE(I@zeGD4gI?r(wAKIZnrL`LCFa5%OO#MS)Y%CVz%$7%hK>4h42%jQkmtA$Q{|7a5Yyz3aIOLup+kTE2#e7ne~2aMlt09Im?3|NKFp90U@2zG z2XH>RkBc!!{xdGYnew0UOZ3Wr#--?$|Agf@ zOa2p9V6OZpT&BRwF;D&gS19mTI9vVzSK=J`16+l3*ZIl2{*{EV6y_ZV2%7Twkq&3+$g_{ByN&l z#x~p}@5Of9Ec5*wx5|6*IDRd^geP#j{1TqT9r8=qslZ*hQ{IE86!!#(ng_#^I-U%>NNC%=Ff6!;>3E5Cp}_?`SbUQ*y*+$TSemvO)R zJYK>5@*nXk9+3Zt*A)0VelI_VH}D7fIqXy5n|M%u4sYRM`B}WJz<2P7{4Cy8;Comv z@5cLhRNjpb6!<4>ke|Vy(Jy~LgZl>kOIHQGx8Jo0lVcV@OSK%AIFb)R(>4+!1MCs_@{pY590-S2aYIk z5HHF*kis5$J7fhOFVppkOxOSaQl=ODPp1D*rvFc-|38rFxBpM3|4*j>ze=Y6f5}cC z`F|+W+y5ui|D#M_@;{mWKRf+D%Jl93uafDMugwZ`RXjGM!KjUDO_CTlQv#L1GYopQ zDoKo68KWMZhU2ypxV3*1E_Ovv6%RFyA8a~R{Gn;QIM{?((_j<-R+Lv+f|k6XB{)~W zkpSCuB(B0?1cY6nJgIUvAER)kHPV%*h2Iz zIggSV&=AezbSwf$kyGJ{ia&G>96Tr{C4{Nf;ZP)>MQW;R zt12CK8&jY<91d|5eJnzq7RgETXjwR1+M6G3ZYknGxM^^Dz~c$f2V90wX=zx0MB5xK zZfY(nY2v?$*dbpkSX3i0n(rrzS534|%)ZBVk9UJ@gJ*+RGa6$ed1Hsi>xxTiXN-+o zYsPM^Xsn>5J)D0#POFo0vaK`5CFNcHp&BL0O(!`@vej8LZmZMe+^FXJ!MyQi)jBeA zUA%BzNnl+rnbD3JW8yRFVl(Pn>Z-?7w^vL085Z3PON$gQx~*D@hias_V_3BmH`mOP zh?Jxg<0a!uXVjF;sLh)(Hh0FjnwHw?vDFjDk#W^l?+kz28rM1(&7LvQw#K&3#%wLt zq`WI`D7vj$w63wPvoh=B^jn;QZ^?2i38%Hu0w~u6bCZrp)MZI`%=js zI&@?ReK37?qO43DUumzy^-pBHiWpc>KQ$W{^)PR2~xC z#A{Q3d&2r8J(&8@X|+02#Xgr{_L#}b$8sD`v*D>*lHjUPPJ z#CsC4rdX3jYG~k-yFuxyYDua~&uNXC+HI0kdGkv;(*fJ6IyGdRHIe~uC7+9siyg9 zj&wRC2VMSeTl;NaN=~g08Qm7W@dYyGzWd3T7ma$0%MeO!<*kjT_R-f!DRiicyPn4D zIDl^;V5>m>MxVm#W{qD%HII|qp~pg!lNNsy2L}(LY(QyHkYt)eb`eYJZEwUKW~6lR zoyxFVZ{$4wvHTJHOvQJ4m67$EB&rW@m%js(5A~O53y16E?@%BgLcaWWIOM;>F8_UN zc9t$nn?<+FKSGqh>(9w5;a3#N-^Ig)s_ZO(R!CZ?^<_&aCHX2-D4Z2+mWrEIl1hJN z@-!n!U)oxc+nnVt|Lu07hKm#{Q(*jn_`?8VG0ss^0~c(ThIFsCE{jj6rDDY8cDfyI zyW8egsk6N~UZ2E02xV~+ zHV5Ox>kh_A#8@0hDJ_mG3j;(6(-(gg6%|DY*pW@B#Bz94mYx$7~7a^j;CQg5c!|Bje zNAe^2k#LCG?KX$g;dE40N;T}W%X;q|cSUJVo7s6;@15)Y>?t+HV*R5-f zx(XV`tX@aoe>L^(Z!T%93EtE^weM9T@_gu~rm4#>+}j*>hf@c3ZM*R0=8!v=1b6WT z)q?>0O!yIAZ0wh`-lY6v+-!eQL#y+~y%VL0UO{KxP9KDktc~kLqtPrrsnb%9QIWNA ziKtYRJgLq6C`2Q9ZQJSFu+X`WL8a3g-PE>&UIq)C^yRo7b1fD!7a|d#po@`>-;$Tp zGl=WPCUI~;Jftw?0N0Mr28e^rQbU=Gh~FRDeL|t499_yNTY?!;nihYyL5pgLee38N z65vvDZ~=!TkowA|GrRR#xA5cPnNF+Za!FRFP(D@dwwO&?{>!h20rs{^g(#`pNIRk( zak0>3$rD0)uh-TbQW;d(MrJ^dvcZ?CVgprWyp81*-feKme~uS>bF0UgFUq1VUzP*6H*{Pm=s&Gj9`ikQp$5k{O$|A6lC8hMVXjl)y=5 zz(-6l(1j=_Hx4nX_`@O2r-uf(>>C(}HHm`<#Q~D(S@51E(P)1~Ia-&+v;Db}%aIp| z*n_S(tYJ%>IQ_Obk#cQul3}{bE=vzXeSJNakR{R1x?skFu?K5%>sn|{btD{8Yt$K` zTAS7cYPANML3*XjD!GpABlvE~WdEZVpZkzotuu-i=lpFwcYhR_aY5>x?URFi?9RXB zldl%dn^3UeflGh8TpGPoEWhuJ_f`(;>06rm;I|-nM*c`3Di!L9Wz&Lsf~5RiysEOY z#xg8-Z0@+c*820HULL%v{#N1Un%nB{uX&(;n{~T$k9Ci2uk(HDpPXM>|LK&=Ed07H zwvacs+LDz29MAUVRu^i`hG>C>l?8ns7gXVFxP5_wNU?uANoH&c1f=35xo%UWxhgA3 zuG=CttHaH;Nn(oY?aeGZyMcLzm2D>`WYfzYGq@Y7RBF?g+sTUbSRfW7TyP#dc&hk` z)KE5F95^%pJ|Ke!rG~Nri`2k{sKN-6v%!)UrPj9HDyyojt*MSgGUka>DJg?A#5w6PV%DV>eV<(L zS*h76ing`uZ+f<8YnRXCc8^(d^PQJWyQx^T7%Z-7%kI4ArP=i1>MgT>{prkdQ4(F| zzQ-1~uQ{D_7+E>vj5STwHl0%}Xr8k3SCel8<-dPLWp4|gA_qad7B_(*Kz%_~jz8Ps zPLfZy=Hxu-Fx#ah>5fZTSx?#n!QfoVY?Lw@^aqk;#$${Ls-Vy0OOhG=$U>5S*PoM< z%{jpVGnvuvu(Kq+B5o$CthqTkewcj(KH}R>&qa{Th#No%afbxKZv5?b@;Y23_vmme z89#scL)Q{+?F}}G2O%~M@XS|D;sCe*M2@yJsID%J{!-lS0_UCY_caZr=8EzqBv?bL zEJOC;P$nausw|c;VQlaX^2UZy+^`#^z|`{`-d&uUMrQS}{39>%zDs>SB%{bIx_>YT zN+kIs!J|?kjB@f&+*lg2!g=(Aor>HX=l{Mb=@~cIyo5+16#&Yphr1 z?yzpjeb4Zo^o7Z4AS$gUppLlBxq-Z3Z(vSvS#ViFU)kdFO`#n{Zy7(*e`1uTYr}u$ zplFc-R-51MbL2SPqRSLQuF05Zi0Daq87(aq3bciqXpzdP&NAgzAW84vQqs(r&YL8E zjywF#HdTJJ&gA+~-Hal!C{R>hBosYC_o5QHBo{{dz+<82@+^|&uGm59$z?}Pk*@Jv zzzuc{9z<*)HZZ`M>0sL1aw^|6BjtY;2ZDlCG+WG)nW>E?gNdq(g`zkKSVKwjNZgKy zJ~xiM+yZS;oJ3V6aS}B9d5wYOneyW()Z{BH$C*xSQY;Y8c}obj2v6tb( zx)#d$Fk=UYL$KSNjtpCdLmD+%aO(ZNSH1e=?-xE%+Zroh_vR&&>s=0uNh*JAekQfk z9l3YW;(ONh_DpZ0*1mK1-*?+Tu3EMJ_1|1G|DN8E*)2Ksw$#Q?gRgD9Ys2a*9yz@Z z1aHVG_LlG|>{zi;$GCP;lkRvCRjV0&QfD-o=GtMi+hNy%7@Y>Y5lkd>u0d}xi+Vvc z8n%-eAoLHLojSMU%j3+xgX4b{g&k8^W3b8MR7`0uwyw@9jb?EkIYGHpl#`lZx+7|8 zf_5?_a@b{q5AfN}Sn5%&BTI6rg$0puT=d^_)#2wo7MG}(K*?VDBSzS4n0~TVD&jhG zzr&#Ihg#Y}9B@M*jx7d*+nv2|8}T9I=8I`n7vt9S2|l&;L=SsPZvB76Np&XzHhW@S zJ_FS{U?a2`)NMwRU%u<;YlbGbr z&IBB~x|TGFKQy6i{NN9~EkpK7TGXCU5-N@;77M$D!{hSwF|IKAH}wYh-S`)j|4v`n zDcpo2l#;FSXsx9|YVd!y6xWrEmd1KcDIQfaQJUzO<(XAHvE;`ha}-5I#ifMO61|wD z_r)Ei8%+0@=zbG16UrI|$b?%blh{qc7xT$A5=|C}QiQ9@I-ndy8gN2yAe(wSAH(tS; zB*k0HX~a?zk+zc-Sma%sEc%#*hXzEmE@rk6SSDD$w#XL2k|f2O%GwsVk{M%j35iCz z6_m~nDpn_#^cH`qp{z>@2Q`UJSF02;e|4!Vdi5`NyP!R4fqvVyr0me{;}QQyMdfOZ z*wnZ+? zFv$?!9F_9w466iRUbK!0G^)#rXuE@vh-a8LVy^I4lvTtkgbH`V)yvX@lNR8oia(4W z9OR-UHWYupNlWjBOmxB7z`e|digL6k45zmzawkpi*oJKR%YKUu+vP8jBY(NY;c#ZV z92o<(lXNXX*Ag;hpk~Bzz9Mq@X}8-@Ratv9TEV4rDXXcemTIdi**j^DvpA`0>e5?! zrp6;9^0SG!dBMXIEq2KfJ#Fv&8E1?+V&W}95LpHBe}J?>RL3cK|=#_YHP|k>s6U6No8$mWo21u zPK|$F>(3WUtiA3|C8&RJLQy?(;AU#;G=TEq2?OR_kL`n8Lf?wC|d@Zl+!PfP7r zIO-OkN3@at)a^C36W8=#d*@1`TDhpgX7>1=^t+uoQx^1I-*v$qul*1xAazcw)kS}t zR+B>m!v7tG{Z+ULe!LwoDHBRnVPn7)um$X8*=4>KRh6;aR&I}F$9$)%T8(jA+}@r& zA!mZm&Udfh7dIGd6<0e)=k_b*>{?`J`;p_;Ql+e_Rh+{dtxMwNe0#0MZkH@ME`P)= zMcgh*BU*Drr_*xLYMCGs(H&U5Kdpa?c<>v1+{6Jc^#*>{%l=RPH|hFU-}?kL7N$3z z5rfx54O+8~=saN%pH*^)?q7CXi2su=#A0bPKrzw90i=@?4EKt1VhMj*(t^Qq z)K(9l@H*s8TBTKg~Z_+1_sN6Q9@m!IaTE|Y&+d1|u6?EJcPdMKV{6l3;)NoukBOi~L;%Aakrx?`qHN_i^U zW5!JC;!y^Z#o9u$EY=odi0A%&q>l&tz+=nma0nI=Rh14&Q%!kzk82!Bn0L+B*X~K} zAvJrh{p#8&Up=w$Fwxxq#8-6GA5tH#Bb_9Rm`TUF)JG5QC8K{*FMRNM>TS}-W51gK zVTN!M!YIKvahKo`yc!?;R5!C( zW~9u&mns$ZXhy0OD>5YvU!G*njpfqZT$fI(EzC1#lWb2}3GrD(cj*tuRCs26t!q3t zthi0Z_jt$6xp9Ak6w8h4%(2|K!5rfqlUaNF@5K%eHPzRXB`1rYllWDMIpqZ_YZb35 zND^sbl=5=8WQoGPpRIp?bY=U*VN+B8AjYnH+aJ0-^(HxxT6&^ndg@ctdmdw zMa!Ju@P1z-?-!=B6(~S0nH`_>kmf%BL!~UD$@4b~ORawwdM@y;uwCi7$#$#fVa+<* zeV#|lwrC#D+GyMC+2-4mb*RFwCvH+i*qxSJJoMtym8EM-AIf^T^x29xD?YB!7KD=Y z(YPnCESQ%U3Wf@#9ILaiHi+6n!m5nA;@TuR5T8!2DS*Bz$PBt5ipAo^#jLon(P%8N z-6aNdG`xSpgg_t|H#uVFASnyRf)j$Xg7*YB1a}7a2em;@z4M0hpqke&Qs1NAsot*^ z)b6^X9mh01iH;xqX-l;km5#0@88g5(X?n*F_~dV3m3M#fnk8MND_E0>9`g8j#z!6s@}@<0 z#ztllrOs~S&U78?c`UbR!ZhJi zWTSt8ieg6r@ndaekFL{qA29&@A=c8?z!hrf8r5*dB4!kR-g#q zYzgWOW-i!&h!-2ou|L{B$a^>cfd4@7i@eYCHM#bD$H>6=yz%){0$q92^UpS)?Vg`^ zt=s6}V!h95>$Fa_pObf1{tq6N+T(u~?VduhP|EYH6xWKkxo-8`Z@=Gdbc7?4#q73u z6~D)w?c_d>#ei!p!9tB;lc3K2oii9VWHo9#*ZIjB|1LlEdx~wr2p{Bi5n_(`BWofo z;*Rb^iqFj+Y8qb1?sLB*w64Lry z93^_ooL;ZX8S?2Jp#oi(K1qM(Y$^yE9h@Bkp`gtNqrs-(Kk;+=b%7Q9|3?V%6z2t3 zh(t`1)tjP4D~9~{C7J#i~4{OP8!HrIVrMvvcI!LBr-v7E+4B46mmRq97yB=Ip1hZy$?HD&U>%>yRPhMQ*b2B2 zz^n23ddD4hT1iLH)94)f9DUCEqWeARJ@*IRzqmg3|I=Y|XBTBx(|X@H?#UfTtBi8eXnK`N3|*b0P7saBOF@wkVOkT$m< zguJf8U=AP!+@*gdF11dp4<*U!xV{#}B;a{PnVPr8O=b4DeX;#jyI^%1(nOZtDyxq3DJamkzp)cSTy4#j}c{-t406Vn3qZLOL4qB1Z=oakytIhg%=H{=%!P>@I(s*81yt=UzyzRRpbRaP*Mn zL$~qyxcuz999oAYIhk`o+j5TKT>s0|rNX6b1@civeDR7l+hQC2Aoxb!m%)R1hl7W5 z)#ns0ESXa_r|KfpC520>Ru`_Qy1Veks)q~LRc-fWQ7xASvlRiMQ>nDN5QQ&V;R=Y( zfW;za`EGx%2nO`gAa0Imw2f3v)TAIMKmvNbs9UE?=$KhIK{rdcLHCMIrSsI323LgF zgx7@=VPR+ZmGFV^H(?>{t}g01VX`XHf_s63OZ8=X0ja3|3;wVeXpC5m};UI0fkeZ_lK{ibm4If)`tE;Wy zQiRr2OI4M}iw<^KTKDC;7SA0270-S)o-ppe0cqvSMRy*x))!(?z%nn`8ySf zv2F5*;xh`A$ipdPi-sTBM#z>e1gZ90UfO%}EqnKZ@c%y+77CxDo}3pixx;ffKm}qa zXR3eCSFa(r&~@ZKnjo8~{(kiXn$4;$n&&j{X!d(F9<9Zx$ZfODZ=<%EE}PBi3Rw!v z6oaRDW_fXOS$U{X)TiaWiI`^UOeVc9B&O|GL*C4c{aRni%i)@`ikh0ricmcX6lMp7 z!h!;eMXZOQ5%pSKz`fr^TuFLw+%OEmK*fK~@>j}fd6ImwsbO@_(WosKG73j!L_R+U zEI%voPnQ1wp(?$PZ5#jd4ZcoBlJbFmi>DgVXs5!EqQ|S!sPnukx1V@4*=d&K%irw@ z>8SEh%ZIiEjDB0%`spOxizOB%Fm=pEJ<7UiJ67{A_#w;aw23#*n0@WcGyHD1KlOh# zS086wasJHVWea90evC3TW+|L4d^&h|+UT|$CJg@lDF3n<7nKAq9Q^X=J_p5A0_Fdj zD>zgZFl1wSyeQRlq*MMr?oXoJq@%g_p!ZWt5s?KMb4{YB?_C(najy8tcDA zkun`X*IcrkjN|V;=u*73ao_vA9>2=+?z^c;N4`5wQb|@9m-#yY!6tkP7rNrrv+aHM zE9}gyGj?zpPqnHJF3}~I{WM)=P~}Xs#&vObcXx-y-QC?C4$g8GcXxMpcXxMKbQfDV zi@U?+{i<%#HF>7fN#(~((wXY+M=P4@Fi5Ey7G6ifHK;?~qG;=f|7j`{t;p|x`HsNr zSemv+f!$p)P2e`^&#TWZY|kbvT*>Ht#lQUSKeU29pbX}XC3+J%xbutzPRQQ zpG(pf=r)?Unw!(@(yXfOxKcM9v)az+@HIQz>U8(|-iId|RGEguxY|Shoms`*KvS}- z`fBo%{-A(Qkf38`v(-qW%xo5W5bOsI{ep`m!^b~D41McUF>>_5*QL^0tWveq)I72* z+*EaqJKOm!rzbtCr+?6>BAdC1L&ronF{y>2sA|}QR=gr9`WOBmKtWwwKRexeJ-Z1) zNqXB@{X%E2AdVuD(3n(YXgU!K4WDl*sOfu6s6d|0#>R~tqP=T8v)(2D-1r_)fGazW zT2NzylA8!gN3W#NQtIuS*XOv}dQ!f5Kx>bEvbgC-a_Dy{1SkXqL#JL<6}%gSP=68C z${pYGe9Vfdw-L)bm&ycP#J_&53#*|IA&)vP`Yb?b(GLXtXQ7It$M1(cVE|~|rK!&* z(P8~RwyHGCbk4H1Ip=1;dSd{MqFV5o!>kT zQs*a&{$+JStyOn5d&MbdAyG;Df3=|B(O_*6xc%gew<=T}W6Kptwuh`a-aY)?^e_Jq z$bF2h+46;2mm!YFz@jpOh1fbk|C?OB?&4W>wgWlcJ2CZYZ`EI{H&JB)vGDn&-OC;n zSoBYOjTKoQoXNB4rXTXp%SjK?Gv#-X;F%(UW`EqS2A(MXpJ5tLhDypudLMn^ht3+~j=7qtdEnQR; zx0X`RP=4f87abSb5koBpRGu3YhinY|l)8NrSr+GZZj-BCtZLQBt-X1Q)Xq*`la!2N z#?Nwi4}=|Bw?mz7n*p=TEn*S)DZIY{P-c<#H zC5j<~4dpwcNH&*!fkR@e$h?Q*4U^&A(QS;`?%i)_H8;}P3c}Hs8Sm?(I90s*<4DNa zC$Ss64OcE9t7p-84pznr)jY3e_{fa@;wEtx5w;F6bXI=`Oq+T29SC(Ctq9705v9+x zWf(bQn(HCca=d0ws6;%UEXsPbAqn;h++!tr0!0*S)P)V&FT_8n2s}&s z$kKBCgRgm%-~Z0PUiO_11Q3Jd469t6iRooz1+@x!cn(izk+`UmConfH`IGOKjPCi$ zN)PvoZsm~XE4)CzS9_}cSUz{6lvhYjTb;CKnAd8oyc(o4HWO`rPxF`5Z$k_TbIAuFXN0a z&6_VX*xW%3$Bwd-@ue#{`Q9OVHX7WaGyT`8+Uwg-{}@2IHA4VTvZ4{8wSkXOoy?5U8CTk%l~3yex-#L zg)wH|0JSgaV)p4xOAb&=`(WVWoN zPC}0M^WE#{dM|g|9;Uaoexz|3oY(1hCo^i!0DD6HC!Oc@kT=eLv@3w_b$0OWe=T3T zRO#X2Pwtn*TLbnOZUWNG7+9113Hrydr-_wH)fXb4DM;W2)gHHA(rZ{^o|^BO#`T#l z+|&@-Pc7g@&xs@ z!2Y)D0R4VN;Ew}rk=&A4>@W(f>%V1o@zXh_jRXWLhPuSqa`v;jQf08s9R%6g!D%Md z!m@VU&EM(h6qC00Hxf5ZP-C;`kOtxVbo(TQ|K7$_We_?sw!j`36!Fho==8X&lFD&E%P#2R9+t-cmPo$z58{ zOBb3Nsla^Ju|wnQ;)&x`a@Y6Zd>M+f0A4d@k(|1;zovYO0sHry+^etl?+r-pv{pFU zL$(RJA?kN~3n$J_Et;pzBL2J7N1xS+&C!m&e%@fQ{CI zPJ}OLIO9~v>o?zc8_p2O9aVAYBWP8h=?fgR=u!OP?gN9Kv{b2R1vMZ73rY>SG%}jt zD!+G=(vqUaV`|dv7phWeM8bx|&cz^6{)|^ENH^`n*#pHCw-M*uG`8qV?-4FDCB_uc0A%EzNH(u&AxM zi}KeHW(HEROg6rTd7_*X`Ffm4++-gPxDdiD221Q22k;ZeB9BFX_aU#X)G!xJlQmol zOaH;dB3CL3{vAe5iF%SG8rZhykza32qWr6P4nC=vPvCKW`?XW2jw#o0`=>0p)-V+M zW~i`3kR?PRT%6YeeR%97(EQ2bk8@DEDp(i$@T4GPQ5K3lG~3vq%Y*^#9zkYiudSw8uBOc`_}{}?3(6*RRVi zKqqSxgmmJY%9D%5VVqV!v9vJ)VU;xZD>cZCG{h4HGjl0b@J@3{xh9SwV?FEXFoB9Gs+oa;{pod_*y^q8>R{X4v0Q*Hylm;^3TZU#*RTYbiXLpv%I z18k^Iz^g>Q{UPRlS1{y;VBe9n^O9JZxrExyJ2&!zIp%febl}Cp#lBZ(_#T*_xOD)y z0f%V)wpb80+Rt_u*o~jX9l_s@$V6&UL+P=oie{kTELGQZaLrmF=)Uj$HOlaSS4#;` zDC*%WppAxyZ?ZkRQCMZnNa94910L~G=mY`;VSGEY(SCKTD$uNydwQ@g>#B~bPQWYi8oCMmWWt)cSu3XOyx{&$7Z&GA489-~9tcTx!AW{WjfQ!4F)p^<;Ypx??~Mz7MOMNou0 z7%KXZ2g)!+NGro_5-Gw6uhYgu4n_4f+fp(BX^Xg)5@w-~-5@O!^lEz^8#QeAKrvT> z?diX{K3@8#kWWAJ%*u0=ca*Eg?Z@@)axxB|)5%(4n1Q85^m0R3_Vt)djj}5tSNcr# zMvn&Vg2F}*ZDV$hxWH+r^IO`w18ZlfJC12po$gbH+5D@8GwV%NY-OYBk(V4XR>A z&4jh#W}y69lWckehJderbOylZYtszoLJ_sF*ipvj&&q#^dA8VN=H2qN)g9DcSydJ0 zbX;LYZ|7LF^S&2R^gyUA0|{g7P~0;?xl%FU5o7Xp0y{?7C zGuCaD9uP31dxDYc#eWG?w#b*?uJHrY(_@zwRHexqoz_Iu#M(p@I??Ri21VkLhsT*h z{3)=?hxhj|iVY6YMNyD9xO2p3L9AL1@7fp|+}rk1EqxFI3bUQA9cCUJf|srRr2{4$ z2Z-=OY|xXoMRmU0b*)d`1^)Le87m)8c3>@^Gs^LLYSm_GwE895qz)!W$8CiE+b&f5 zQ%$RrL+o&G^%ehDz>*_-!nc-oqwwxfA){n1$BpTFvc#wftxbWWw^ zD#Dp)7Ai3`PV&G=e1#7%W3dvXnjsz%VSu>Qvie{eOAHC=4g;i$4-k3Dir{ane}zOd zGRbCCP%Ys&IA!sMVwkR|#4}7urckXMs?@_+hyU6~;a&{VnLVMEN9?(Mbtu7=(0J&K zj31@qz9)6m;<^YZp&ty|CuPVe$(oT1CynIXB~g|6(#k7vsikEg7&nb@B3VY-0*A7w zzTt$%`_bhkxQGqG!vk?;I`sL3Pdv}lme^X8u6byQjQiH!}LCVyn5 zsTC2YL`#19H{EDnsJGl5*|c$c+ZL*hDgWMKq<2f*nwM2v&5#q|cCOQOi1869d)_(f z<`4XY4w)AmLa=nQa0j?qnmQs_rq4n^!KJ@0!q@?4kjS8d5>O#1zt2FSV?!r3&~;F* z5!nyYGylSNIMve6g&G0JF>A&C`fAk3)WR@1tzx#AXijXCJkEraZU(%(1oYKkiuCUa z+zMLz%=ygS-BDO5J}^~;O4T~n>$-N11LQFbkq!^Nbq}b1%2k&Xq7L2VfpUOBa^aZ@@kgVpM7{yMv~O)*YEZm;pSnp{7)V zbm7gCC`jsDD63B!A8WtyN#rgP(jBm=G?q(;b>t)#FgJLx@f*$4I)C~6Cyt-p_@oTl zo=movPMus3DqKIWsva1+xme0}U=zH-)>eV%)%-M?cv@!(EsUhA74iG**&q{MuE zeu~zQ0s=sGqzNGeN&;{fm0&Rxa@jwm?W1BBSWk_3aw>3FMbIjjirhi4(6FA8XSfii zOE|_*D#HA}Bm*dtbqNSqA|GipV%SA*ev=5Zny;I8AL@3oS(0xKPTHw6BD{h?|3hGu zvlT-?%`*}l=ds(LXR?=Xm?{iy402#ect-{TX==q{qMC9@r3hbZ@>)0siX7Fo375GD z;w7@oWQNpJSZQDvuWuY~)1-Lcub;D5^19oT;}5f`$1b`%EH0ov3zD=iw3#Ay9*zC0 zNmcj3*@lkj~7Rk`;8|uYDxC^96NIP>Hh4>Q> zjz|a~0M2YCcNC>Cm_%$fBMz8I{W!#aD}Ew$nf7tzOh86|E5T@pC_?$ew=K{9iA-TX zoHdhVh&yw9|JAG~jAY2;4VZApEE0kq0C)RD2I3V7v3*0;x)JXPCmAwydp3WbekvY< z*bwtZ`rdq{Hlvsjq%xyeI7Y$76V7jd?|$20rZ!Xi6TU7(A0FqY9l%s*%>T19?)QR$#5W@M~0g;4ajnYc6O_@kyq!nYVIoq~3t=KQj+6b(T{!<5I zsA@oGFqNdxGQmqTCt71SrdeZGBv^<Vi7|H6hoH ztW_g{L(nL1GKvl;1QHPFG8J{z9NVcxpzCa$#J`LU4^J(|rJjtr>98T4>&)Kh1WlVa zd7KQnt#K?j5EIqx6x}CnnL$@iPXTrFN^67;g>?c)btc8ObnOic#%+WR8?*E>u{&AP z8eZb=SFvoY>1uT1S5G4Dm%F|={fHE6JhU1B)w-`r79fF4pahMUDVzN{vQ%v&dhDd0 z?vtJs8NxY| zM*9}+>B3}?!+!nX2?!)>F@fVbuyVtYH81qqSDkorg}i_WB<}t5hidkT%57ebB#_|N z1?6IJ9XAM#1z3n9zI2=sBW`1Mb8v-zF=){vQ&*U|0ue>F8!0ZaFG3}CA?iTddw6L; z;4~nFD;9E*URI38voCEIf5&Tp+K8Zifc%zmBHPxY#}7fJmJp2(5(R;6HX^*kB^$dU zy>TrebDAM*9fbce4K2<^f^@@z-Y2Ha zt={!F>$fUN3hY9RX`OhXnDDPuv;*GjL^bwMrNY`f?5^0pft^X?VPgV3NtQfnQo%_I z@=Vdc3Bd7*(?gFeSsu4_i2D)Fe3V7#fCJTqDIBm_ET^`zpV)(xvqpudz)SA_6nX9uwph8I?QtiY(i zGf?r31dD*YHc^1WuT;#o7Ela`zSC~=RT%bODTGfqgVri0AaJ3o8(KXXeRP3zvUoi2 zfb1V~5)3V83n_m3Rvr;{A_Fl=8CsH{K$<*Zv81q;c$xer2A3-EJA2<#B9R56xrGlH1`cGS#gzt9bq_=pBf-{N0 zHdRBdD}`)TPFaRUM!KY*3{lIQ6}*`hMcbSqAd>ZA--|aQm^TRJ3M~!;8Z9D_HzIn5 zGJ3+}(C?7i4d)r{8Sfd-Cq+;ykJJ>MdOpE=g7g`QPiB`gd{XrWoKKNlqKNrlDbNyt zW++!*6u)2%LgXA8bp_?*y1NF{C7=8b;-~^l5kL@iC9@E+?ArX1QFy7IFNlopOrq~+xX0WtUV;*{Z4%V z$?ogPhY9unE2e1gmblIqxGh#@ zLNyyobUJ~mHO*9j>Qkfxw_wTsaI4su#4RQ?b<$W6xZxfZ)Xkz3A`vh!ZVa@{ zlH5*I>Q}hL6vYNm;u-Yk=D*`@$(%;Gw-HTP2%kdlAO)qdDM-2_u|bpqf!!Hl?URnbLT#TgWC!1uZF+^c@B4m>*7HZo(AG`^?iGJ{X9KSt2Df)xw z&y2fYe!Udlw|{Iq8sP9GBf3E6L{A@jzi_=1yoY>b_DRBmid)h{fM6g;&`&`A3aO^t zLFtGLr5pW?*x~iWd!l0^iNp)}PU4@FXzN`*_Y;NBOxQ2VCTH2N$(yWAUVe?L%fghv zoYxyE+nqr8$vSxk~EJg;a;=W!G=qlj*vq&Af=NMM1O~uc9TIi8eu7g?da^ldUt3L zR4}Gko0v}!N0_ujm$v%DVuAh<)o;e*8SgYs;VtpZ`e0Unqne}kks%Q4_$zwLCU$7R zZ<1EZ7N^rt4_7y$+6C+3hQx%K)aa`O?e2CNUu-kMKkHRRAc{iOopKFrK5O5Kwwi&) z3Dd-5$F1A=QAZB4U)!wRbW<_A4~_U_$E-ewJ^e!UVpB*;+K!sHeRRNJKVDRrWfE60IiS=~ieB zznhDbbJPh5m<-*VeZIDEu71X}wgBfoZ{f5%D%eH$fSt|s+q`uxBTcz6OlCn3Bdg2w z`ES;r6n_*@{Ib?owLt4L@tyra)%mLHGjWL8`OZ6~2f8V8mY({ea^c#MpPiW1Yf6?% z){iKI5Y*!u+ejKel(@PuU6~g^ZeG4KOFWOaMs+2BJ2B?SUHwL>F&u@QI2mbcXv6dlv zKOX144g5{M?&l$$Yz2Kih37nfz=xx37Q{Av@xQZVoK7uB8MFIFAlezOwOPekPkq`1CuiIIq{aM@*;oRv(#W-z zX!9GP_aL&(tatdA3<@K!!s1&4LU%UT4X)yA19$XJi3boF8*USGW7xtk2Ncy~s7!#; zz+WniCC8gpu^S-{F{0*dd#w=8)xlY@P(tQ%APQYh&`#GgrWmCS$@AHM!h=r4(wFKi zCH5dEFjVF>L*URe{N~1@TSYTG#SMv?4QShEEuMkA(G6{%fxN0CZexR-_>hKBPxsrr zdGd=%LuX{)Kb~oYrfy{=-IWb*+HGHIh(EtoY;I9X6C;LR9ZalAkM!< zAi`)QylR|Wj5MLyYqDLu{aiV#Ng~r!Ur%?=5S{X{kUuT7j*FWPpQc3(05PS}U(Xhe zW?}T(IIlEDhy4}a*V&zTie$Tz)|^bhUp=~hu8Y>4;@5KtV|Z%3;{4XMft?t+kaY0w zJ8LRp3%2cHcgGb95v=Xcu>k$()(w2SDf`Baw=#@fj1QGyf!`QW?qR&;3RsLRLdE=P zwoM!<|2WYGfn&x-ATA;yvS{1fCSRdqJ8K!2ux~TD`-Cza6I86MJ7ew|)K6MK_(KS| zkI&9;z7MhkGaEBYJ42oW5zZa0xMB} z(PTL;$Bg||=@rnpbaH5GH^3pvY_n-Xtos^v?r5ejBmVJ1Bb@^VTIoCgnvVU>npE|I z$+1l$sjOpxdc%w$a20PT-h z4N6(#;Sn4Bq|$m5si-@wr9}E4q2Hu9Op`tW8B1h8e}<|u%q*ohkQu(9Z^UdS(&Yw0 z>Mqgo;&}|x=ZYaWl_ukk+c2Lk$sP`py%RY}3AxAtrG*WaaA-|dfYF2?L`<`sJLo7@ zr5D1{iBw@}_?wdXy@OQX$#MzGQESZ|nI5b73mBqHjEhmAf>>`zw2C%2&*=zz8H7wX{i$+jo=FHVXt`RyU~N zkJ(9eH^|^i@#vL$Ee3Og3~NMHd~xg-nR|mhbQpVs?{&y~gOOs40+B)U9q74B`HhK- ziaPYYvDFO0~e1I+GJcmH;I^Cg-ck3(BQ0fj5NXRe@56S8y->9Mkpsp5ii%w# zafRiUb^a6HA?FL}#qNt!m$o~=Z9qXZv=g%%Y+owgfz!Km+7Z8aev)i7{{9tb5BnCe zNOIr{LV1FBO8EFm)FH|rk=vol9|7x<3_ukb1u8DtKjAs08V%1k>iQy~>~n)2z2SbR z2gHZFcHj944xJP~1#*TMn?!SljN`sjwaL}*Yj=qIV#Ra3KwYE+gri<01%wAk!8Rzq z5P6zr-ywJ&IDxPPBmGLW8(<%0SPtm68G2(_FOrSMj2zODO-L@%k^k7f$?*TQzQO>3 z0rN(YLG9ki0;RvrM2dsGzx%?^ACxc2KXDba{5f87z9J`12?+kp`hrfJ^mW`f1xXT` z+*t~e_eN-6Rop=YjGt70xq1*`SMs3sC!yl{J?$ia^2d%l`#11-`S}A6K{BCu@tD5A z1kMN%vvke~9z3BKn$mY~M8A@E-k}p<{#8l~i8BSGP`C)k3-W{9{GQ=ia^5IwvGjGz z9pmnB^Ad-5{$l?hJ`f(^aKYU-;ep$wZS4}NAQ4g2G;EYYq3Yg1#m!(A zymwe+Iln8c57P6&^{3!F%D%zVrDWb%o)Q{Y7-yMowkQ#~ZnVMdB_|nP#`71Ek-Lyj z=rS4(1!dEWyqo?3z}6>*0*gt;h2?)@^h9F*0u=_rz%5JXP^dS_FdAh2K|T!l>>s!T z8wMnr`eF^=(T9PO@yfJ0fC}|i8N#8aFDaj9FF>~U&&LemD`N$baL|{JYR zXdyq-o*ex%I8XaKa|;BxQ6N(f#JErB8!@&Q3>1VHzTvj*+2PzDS}z#Eo^2kuhD+NO z_ur%wedR#3!#NWXFMQa}W!}NuFfIJUzD+JaCAO-!?RC_SdNMcT;=ot@o$d9LgFdN< zSA6Nt`XkRjePQVYl4Oru5ZkoL2ziRF_ccHfo~XfQI+U@J15)-#Rj5u?L04|g69_up zeW*t+&Lz^v`+ZR7djHC1P=c6S*M} zMi-Pp+p-QvN@7Y=;`6y9*k9T8E;OzN$cZqWEHG2_8EGsqR$N%xvq^^D!ABp^$fHkr zxWG@_nBSNOJY!G)aE*x%Zq59az8Dp+r*I#~yQzCrWU=EKxJYF zER)BD=cjbSR-BWQz)Q#ZuPH}ZlpGKEZBL!fbK1i;@x!*_z%68|0iv)0BA8Lt3sfbS z@I!6GPI1%@@dmeWl?kGtFWDz28SnkRwE&Lz=)TFnV0x`(=?V$w0$FhkGq6Vse1uVQ zac=0@{W;JJ&hQ9>(8)vU_SK(z<#ieaTQ`Mw?dX)H5DZCZ06L^>o(dN7j#@-5$=Bf?)pd;_kbIgrRY9fWg%NzIyG zE}k1KNN#I^Bb-*_Yv9=&e`#r%1JaroJ2NIE9J=l7qJuSE4Pd%Dzo{I$fOuz0gXMw^ zUcRfc$)^dkwsQZ?5GwDO8Yo>#RnTS^f<|OCKo<%%(CHY#ZU1JW*mgz*)NJu77!Ile zFcU-IpfKRXi!l?E4St>RY%U7^W}O zyG71H#m-C9J_BN(ynmMUtE50AAi=-D)V?o=2`Ft`Sig`Cn!W=Q0uy@e8?w7+hXG9| zoJ`;3NTHC*pcG^i4`}&<1>b>T+7#F4)NU!gR0#?#YLhK#qm|UNKWjIH_65D)Vfmz$ z!u}CDMQrHVJedZPo|I~vW1PcEvh-^u|}K0 zMqMzy047A;NTV);Vw^cLKB0_;zZ;^Unt5-wFPI_(X1HQM01BT6O%UzIa+yTDu_5D2zW1 z2tC~&WE6?eg@y&dpx61p0ua%k_-ZU5RhT?$FF0u|5Nj-O{ST*B6jZB-Y8L~8JnwI@ zG|>&?5V|0+?$|Y0p^eH0 z)D8ZJ>qb}&LruGY_`{5!rd@=?0O&A~C9c);RQtbGDTeBEt=sbWM3|y2qVcE0EW^sF!m|TC=&Jr>z6E#39Ml}au@O~NN;6{tD;Qk zYS{^MiTQAO^=d(LqL5*)B%LDL2!_BAoWU@Tu`5PUA|0LMd;~-b*F|-X?KCX6nzr{nR zX?{%i%Yaco9GZ>}EC!}kCsmHYRuI2{VxGM#bdiMB7rHo|Rd3oRG-I>CuT8YQQ*?c` zz}|kLmGh*G`-C1Jpqva>7YdB?r?fJv-tw%yD6{v7u3KF-tj_kYt^22E_}tpnWbd(S z@1d!6gLf@19WZtB^_M}Wo?~^#AQjKmr6kj z#vz)?^ycK}thG;=Ak@}IZgJ?F|A1#Dl|lfwiT#&d6S)3YCk^=*FpANX-Dg0{5k9$U zr%h~{r;SxvqW4H>3xE2wjbDC3%gN_EGC{+ciK=TF7k7Kc~ujPu1@L~aGs1MZ?Y^`tEI9pF!! zm@R5Olc``80+VhsW@djf&G*2%IA?^a_KPMt!4<}eQ_-`YYZk6_HWMw2!%x&bLo4j1 zY^Fi4c1=Z(;ucxS7QQosLxHuFN`ufnT3t^Ji_PnIN}7rza7Ku?w3Lc-SBRn}311vz zn?o!sEOhog#^*-Brr>gPtfr=CGFPDW$F9Z znTE-j$w9j5!DnT+4L}lOIz@AZ0eA9rpG;lR#)i4cpO!1YP@IiuDfVp<*WkA_s|BNFyq0w+ z@peZYCxm;ZHoZqPa=f_S0T2SSQIo;n^ITJQhszxFESr3@bLZ`=^QQ$EzOF^#QW65Y ztgKg_h+K6T{LwLdzt@yB!~1Cn1{O81(~Pc9iS z9i{G50^R)jRDp}3%;3p1c(Zq|*E81-SnK!R8MD@T6w}C!-QZM9uo|5;`edTCfKhW4 zq$^5b*xe?H?2ql+cAEI8ZE?Pd-GuDK6UjB()oLEw;^{a8&nGZJcDhzerAm#{=&O1w z{IeU|!Vyuo+o^Z!+$f&*GtQooe9E%RbLXY?bdGPWdxItH$XJn4ed4mZl2vsEs8*$< z0s##S3f8LR9duo(QN5;tTUz0$WAC(vr+Md)es2z8dFKdK6@mCr?SK1XkzxDwO(}b@ zEoK~#fyY});}2)eTS1L^GUZJ(=6V6ztxRUe*n$lJF-yukQESKMu5!VqhBR||*2#1i z;GXC?2WVF2a_s61vQTX82<=n{GD&WhRbuB?c~+GM9X`8ni#3Xr%joaVUsqDUxYNs2 z?TQlScR&Y|ad0p&u*@_4ONO|3Bd?X>aNgbS937RsX)5_uu2y|KV{1oGcRdNw_l5wW zkgcUJ;9Ardq~Y%tsk5qrRr9ZoU(cgRPM7N=MnnPUo5Byrmw+y?SPMRHAZEhRL?I#! zV}0f@Ah3cfZ?X2~20ZV^^rqNw);?U(X>WQhnMS&wP>7lp!MXa=BHkFcTYBes$2h?2 zYLdABBfqXlOie8(DW{}mOVb=#sZx#pe4|e7_tQwU5IX|{9iGTv8AbwQt+Axaj-(N` z@~Gx&xemurk3di+cZ{vOi)w+aPvfmLvIPs>35Xif=Y+EpvQ_g!9&%pXcW zp?-8Jg!l6bbKO9}D^*wA*=SZ4Uy?w>&BlCl%cnh?5KF~vkEEd&2Ue+O1EfgOV7y8} zkT0x16gVeDR9HeHNV^IpvPx}Pd~jyC^{wN&lwZ)`FtL)f_6dM}`*K-dX$qE1>A43< z&RM#9Mk-vBN7va}%(_iWhmX7*V~S4A@ifMQji+Jxbqx2%mT{-?Jx%7;hp8VqHG=(< zeU(5*8KVn-G`x~|qDHl}s4k7*sf-e#Vw~|QoJ&bC$6qMKR`wYycfZs5A7KcAJ3N97 zbu;u^B~{J@&cnO9u{jC zl8#@112uQQB3L0VEB>(1Q*xs-d}E>*n?Q4q+o&X$Eq2DVq&c0vfeVoE&G(|~Sr`uU zlRUpG+4PpQVybTzQe?5TAC%8eUwwo@$E9+N7z|@2kC6xzUn9hYkHN&6g98z8N2Py0 z!l(idrsaIrrNiq3&iYVLjPHNF_d7EowJAAtuB`Xjm?6Hu^gCRh*~M}*8>JWEe0x3d^c8teteDPPRL8KUMyWU?nFMA0WYX?cS+9 za`I9o+ZL*IGK&xmV+w6Yjjt;0;-%Yr3D^NU z02n=;2Gf;N+4LI_kq3QPUkly~4hqz3XE8!1XW`_5J4^zAo2NX?t4V_u?UaiKq<_f& zI)s^2(U}$E&dCX-hYp)} zA?RL+i2|W_Ek)(4=PhhDa&4(*{<@X%y8m!#M^xl1)sn&|ZpgpS|ke?)Eyp?mUA2Sb=^R zX?UwfT95D|iQ>OUy-~zYrD6lieWU%I|D1DHRk7NtF=&-A&Hk?VmEmvcqg*Ogyhizy zU}!%{J5zv%hoJ#)mNS>0kf2e$1d3*qY^j(q6c9CSoH+Lar0+~_y0+8pgu9yhf(Aw+ zD_>7a|CETTQc%9~GXJ?94J{oM5=%mHrJURP$9#=1*K?7Gekl{V<@mLVLe8pp=9n6} zWy1LQ5R-y~h3;h^Pf#mFDd~g)vwNJ-RHEa=gEw7ldO)-2evUi5_T>$?Ga0yyzAC?; zPyLJZ$;4KU1CG|^);8a;u;5*?=v3jatF(BY8#b$9B+dGKNb>Z)ZHKF$)KkCLxUcTE zb@d=9TdJjT7kW6E^sWLc_NQ(I1BU#p{%W<(%Bzn)3vp>WI`8NMt78&x`gd@#;8`h> z+oJyN&M;+)%pJbr-7ev?rfgux0$dhc+C|l7;&A7O!%q#v1_Q?_qfwEZ8mmr$y5hfF^ z-Nj^AU0w!os|^5`vn6V?Dm4Dxt*l@QD&kN;+I8u0T9b}usb!Ftah3qe?@G@U_%ezT zdpVErHh(g1PmUE{St?^5j$zA<9|qDv<^d&e@1=jC+gYrf)4-VfJkLTqecXy#I2yq=qNP$IIf@d6dt=!}35z1`C}7s=1W+LgM1RQA9S z0GSE)EJ)bh(;z7RK5Gp%6*~#Ic8 zKY?W8+K?H{RaK>P|rE$a^;qjo-W}XEh6Iz3=dJFa(VYl3UD`h%q%}W>pTl9Hu<*r zOp0+mG+ZI9ao=(}Q%|mM2C;*SFCRKNFcH?Os z1yHD#va_b-SH_nY61z9Umyu{H34;~Pw0UCjJ8R9lA1^lNlxP zOW^8Zrp)>j(!6#qK!Uu!FTg**Rny6`mH9fVn%gPQ3RT`Fc>9grs)wp~eqPgiLj>(j zE@#A=%5qij@7V16e7iwme`^2ubA$S6Gcc*r^;TAgV2xy~-g{ANM42(g> zOE#aj_iIxtRZ!qtcaytO*-=avyc+eJ7je02T9+MDuB)7UJkGpXUdHYhZq~3hT;1sW zm!+HRR6egjpMLdL=XF7i0V6^w8IQRkcf+6vZ)i_I&Qa&k=dgD(n|;_kMh2QE9N!7! zEh*B7IexHDnS8z1Bg-2JkCa@&2aY3>dW&aTZAxR7km?m?QqzSV_C1GaU$VaK8 zv$(jIxNf#cJ32z+SS`c{sirBSkY~Aqu73PSr0mN%q-P&{* z<}Ov_Oxql~(_`DsJyz`&vf|>ZzP};NIl2KI@k!|GoCW8d+=te&ItH*C#bEefo7!H< znj4S?RJf2hhN()qDi*QWoN=oacQVdf-9B%d@++?-iJ_LHatm{{-QZc;Fx2~Pb4W|? zT%h?ld3K}0O(6R0m2|gS1ChklvpH!g3Yi#@giGfUewih#?UT569~~tRPGFa=5{%0E zHLj(kWaMNdWn@h-Am$)jH>#Zcxls&7W>-3OL-h-q9>l_vBb2zJ_9dK%oc2I1XWj~g z5`yX%>=U~| zIzQ7+?M$_7p6@xGxl-&xhbp=g1|oiPj~yh~bh`;QTAU_BFf;}M4grTo+#mFAk~dvB z4C9xITgiCGvjJIPK&PJ?QC%ZBYD%y6ab?FHTyV?Ss`Yo&Q0V_KHqpD#eKAttm6x$; z3yan--Lj_D^NX2igCZBjY+d4aPnt24hFG7y*F#oO8ifJ{U}89wU%p09cHO`P+ursZ z!`6X3JC65luSVt>qid#6nIPq}+HJyL#d&c#S2N=uewOi zpZCJT+tBU}nI3Q3GiHDn-A?0s8vi&jWYLW&T^o`0@d;HQPo2HOxaiyR zOgij#KN9l61`gC8=1b!JkWyIbW~|#|pNnV|%3yPKIH9sq#Nm*v#T}OnuVUJ|@aD!3 zXIzowaejv0E!t07YGT(IHO8f3!A&4TYC2c;Cj@@P6U@aw^5=X4!{3k5mD6F4ymm*t znPNXEB;uxz2;~nasyNbo45YjbqK!u;4@KH(ivq3c?`TQ~5>csTVa22+JR`*MUv{2aZ5-zdmDJ zbotW4CS$kYKH1uHthEP$fH}N4ljoD_Ma@q-MU6h-l$TEWtSA@K86OamS^5_Lh^!f~ibRsf=q9)Or$3Na?=cDD$ZjRXfColsCv9?9OVx0L6X3)Zr7i=KQFIn*UbMqXsw zdxmKwa$tI3Qr+c|w;EE50(GBNr+SN0XM>;v;0O3;Q9_;+1---Kp!oK&h9PUZJe=s* zf81xwzHltKJ^2OR!s3z=?7wIr>E*E?&~HzT@`QQ*?@_*U07d^$#p!U^#}c`->TDj9 z(cvjE+C3!!)T0eu;PsII0S#&s6+9Y^TJ4q%B1~JJba=${QjZL=g2PhcEeVzkmhdHF zx)3PYM^?i|Tf{iCIn7*}ZMOsDX*v%Ee+bgxuJ{z6Aa|_Y$+#GoZt+1V6sVBq+eaQF ze~FzJ$n(>=i8CUfm7jFC`bXqx5COk15|HQ6R%YvaVUG?6du%vFc{1buQ45Zm`d&Dq zl8%_9BPQv%Nb;Pmw|@KN=iix9%#!}}INuvaO7siW*XR!32w*d>wh?f7}^S z%!qy~8_~+h;iwVS1)?@oCB4u8ntvO9vOvsSpj%q-itZKXtFFW9!wHAoM+-En1eMdJ zJXF9ZhNX{1v)$z@(@oVi8}3y+eOACLW>xsSqB+AC@YZ|Vyj|YoUdgNUdhH%#m{jhz=jgfgFyTaf67}Tp z8e>*!W>%`nDGI!CL{P12=f zR=|vdzx=irdVYMBS>chdrK<^F@Wuls{+31nqm zz)h}*jLaDCb*w&o<6T1!fBY#s+c~N3#=1a?ewi^dzt|aGdDnxFmEOs0VnTtV3`G8~ zRNl!y3kyCKQ$@XK7Slwh=n^%`^KepSylAMWNrUn!E1c3GT+yMA6nXgTRi+ryfc)oa zzKt_!S<^+mm?oNIB{`2dV-nh|>1jR_)u`1582|u*&f9}FGDs-fe-Ud^bOB!xPEQKc zW>IHR)vMZ6oGQ&ce{nWKu=~G|s+jr`ufBXy);D5qDi)^?_ftY%? z>p>^wExe27sxO$7suC`;2)#6jIB5{^=Oz!u|1{%_h1#;FTQjU~I6T>QPd3CjeE=YC zk8Bdeqfx7K1~X`eIp56|R(1mft57J2LW2+# zx`jS=davCoe+&u-1~Lm zJye!CH!IVUY0c!6x#k=PaoTbmWL$clgSavs4n$8i@~)H7A^G1KqAG#fb7DJnJ2}DZ zFf!#l`jfW~{yo=n$30j7`nj8a+`Hj3vh&bC8RuVqf3~2(zkcG-#<|m0$}jgy@AHlP z+n7rJ@MMn3;fz7H-RUDHyVF-BFCW=Kf12#bAd{4nGcyd6QYPP!exrSJ2=(bcCUX=$;La-u1nPo7}1W;=c9GBH`b#lG|?sVFsBD@vJ2 zslgE@m7=vY$HoQn>+{?4yYjc>59cer`6U0>E-Gppv_UPW4HIsFQ$v>38giy+EDo=O zI>KZ`G!=`f34!8qscF6)#iUrYI(?R6Z!s+nf79zkZLU6#NO>f0QZgHgL9tux6Ss=I zXr7iJPw1%$frPO1)~?hvpX}dbb^5j@kc2S3?nwbwP(-(Z6KJz&60)pW^mx{ZESfb* z1!bY~H6^F~N9|*KNnz}%(8<=G5n-ffWR2S$eF`~pvbD!Q(&Jv^c8~NRFmfy~(i#}) ze`#g2Ols@^lgLi_`H@?mb$Z-x5g; zx~{Y&n@oJP`|=I|`HtO@6PUieE|6+i zn&R>;o8YQVN|;pllU4UFyi(pF%KyI2pOF!Sg!cl{yQ1Ha8UO?of-__pQUhg)W!cMx zWr?>4Hzhu0JV1V%{Rz>=5siV*HW|uExlm@PFsg~D(M)d6X6N9tOVq@k_2~t{e^4b{ zgg^1;XCWj@gAip5N>!d)DUV^$uB_>zd_uEZE2fCa(c@MzRe2t(p1m+zF za6(YYcqG5{=aOqCypY&eT&hnDeI(?UY>jaZKOV;$S@`WAHN6+YQzUIZ73rsRIv)Aaxo|{2> zb0ChL)kmM1waRA?ZbB|XE~TB=N$jLHHmTa_Qj+UsxRqEJC`_%5Ec{Jmf6=tm!ayBK zmKUgn#7$p}&8g$9!Wjd1T(C?Sn_`Ld#OQqrS7a%4aELlpK2hfr#F_PcT0)o<_5VUf z>0`o&@Uq!nesq4}u@nE3)7#m}@6zdkNu&44S&p6bwn*>t_i_&-7vo8#SemCGg#|=W zmQrRf3*-gd0Z(QAs)VZ(e>4hfvh^PI3(A+RZzzu`zbsP&=l(r%Y;H=*nr=ue%p0E# za#JqJ%^UBFH)`d+@Mc+kg0?|RMQxv!YHe*EQtu%iPi~T!U+hcjGzzvXRj#(rM|?Iu zPKPj^zuVT9O_()njB$Z%b9w5`g<(2ZG^%6_v#6}9LV2AqA+RU5f3ul6Iucv%$nXD* z^aKKI8?G0``~?9)-hm73{TsKtWyCFSbJmRXtZ}pLi&h%kmA@dMjqU%nv2BbtwvCbb zKs2e_-69)^pbn-+e^Hi|Tb|@7zvL(4{zG=T*G^ou{F((5(u?QUJw3fJH}{Flu6rk` zsG!23n^<6Wr3%Su4{nJpU`KvkrplagnMPYhF{t#ZG|bZ0ne{HYP2OOd{&c}QvZJaM% zc;8&2qAnHvTeLduN`O8##!VJO@c~by(y|1RLYQw z990n&({0cORAvvH31K>4OiGPDjC(C*IOTYXl%m>^LQ=-WQqtT@u4Z=Njvfp7nJM(N zMi-8Ok$|DRf5%`fpD;F%pVY~R&+>9PI-2E2Z`B(`b8ep1rqI|F77NMMSS-Y<%(jp` z^*9U0p2l2<=}j9&!Icvi?}{I1=X2tmcEsz5;CI747HfA<&Ox*73OnbtgOYQxvIVu0 zR`d{qY!XOLf<4=nlWhN|6%e^#QA#>y++Y7kGA{Dre@Bh?)}D}8Kz3#q+}wfd`UZCX z@P`j53=v;ZQRGhte;YZKms`x%Kv%GHm+ifw(A7P6+yR0$(!2a^+{19=xH$8O;ZV|H z$B~>*j2|X_==db(bkb?NR-L4=(=ubHVVSWrdFi;*@yfV(Vw`TAnbTr?C+Ude)1*%v zDs!4He;x{DVp@7iyiU*v=_EZ&Y`e3uDK{ZZzu7I=a#flzsS`C+nPSV1Q_ji?v)58e zyR(jF(T1#pSv1R>pU4Jtw~N4Kbrrh0UA!yJ^ZRHgw)V)Y{>YkE_ssvVv2THIqdN0F zXCzA+NtWiNkw&l4=rNKlOB&fyh#$#J9*$#&f5e6mNaz(wX`l^ciS2uNZ27gA0%5m6 zL)r2QyBpdIq?dL#sd>Z+-A%e|X(?@?r40$(i@n|4@F<3Co1~@1_U?CPDS^CTn1Frk^HR06=#J<1!jW-3@{U0hQpsCda2zq;?6FOFQIU7l)QQv34s*^lme7N>u` z;Q`xcQ+n^6eM>{!j)?a3mu|Ty%&cA7ymHB>K6BSQZ(%tBo^|QWxcxoL{sxVb+vD;z z1Z<~$nDNK~Il(k1Jf%P>k!XHPeXEℜ+%Q_$2L5fW0*n)pmO-39v;n3(}aC_wK4!;RxfzG&ZJd*2PAa6r6}ebxDh#4987 z;s)yw13!P!wNa;&T!hUfB`YJY*Id*o7j}(d@i{JT#Hz&F{INuZiDM%^5~p^>e{p;ahm0yR zIH-mzRb)h~GQxh;k6uN#8K@0;{S}1lib3jQenD3h(P>v0PkfBpGKy~Y05>GHN+;tQ z6~-fmH=kt?f03<$cNQxe}e<&zqb9ft4HDwYeP^=@3Pzhu909)&HTck*`O}B zutC5oe=*7iNz?~Nkgs9ITpU=2Z=cf*F(?MiWr5Sa?UMtE|9#K!Kdg&4Esp1=f3)lD z^l_}e_JyCdtu7`0we-lg&po2ys|Kzv3mq-FXl4Z#Upa>T8{7K+f9&F|H*LJ)ij4@P z2NAOWRRfFK@LEH0MuL%SZ)fD`}(JQAtB0mcAyZ#1OZ&(1x}aT3VQp z7BWHup)H}2kR#;qe{ZE}YOBkQ^4gh(G5o&aO(>c|DdB1!vltvnBFqGC@lG?qR@uSq zVfHbH89QPIn8VDgjGd7xV;Fy@?&9-nPoH4ACan_g+7l;;7Xb_!XvtHsF*#YUKp+OZ zOjlV$!%&L2Fl^9fE&t}K{egh>Q0f|-o&&W$e>KRfUp~BHe_UVO#H+VmeeGJ@MS!lu z)4n>2fPVvW-OlgGi(5*aPH9PD9Z8xgw0!z9`}b^5qYNtJ`;2y9mMT+DZ_ul7Wo|h) zCXXpUlz*svoc*}$VIp!S5h-OJ@}8FesQe-O$NcHSnX)GfUcFq;u(Bg=Po)ec@^Z0%0%~%?v zt{8PAa#d39J@h{MF#RfRAEb}a6SPgHOLRYNqr+_j+!l`FUTPtUn4IWOY)>5 zCvZY)?fvX5<>F+G@L0^6+f>&HsGsRwC-g}M$QRbqf2r>I!{GVRd7i(y7*94QTVzy> zx5y~3G|9Lim(KP4S~(IeM@lKX7FAO?5?ed$~_)0Aq+rPUP9AnVvXw_mNheHK`G zb;W31RGl9N=6iqJ>Qltmf9kt8y$c(^y6ST)@9X>7^hq54*}D7my*J*t7yjG&mylwE zxc%$@e+yjywd=OFwBX=Reu{&I>E5BIo*Ei{@=1vLBM8~oG_c5qqUgngaMy}wJdH~! zxRe1;w4B zGJ#a}Pa?+D{?nK_OAMa%{ld$o*ZH@CKQA0F|9}3yvj6GQe*RGK*}|dHKk?rWyc~4d`Q5<>3ySi(3g|D%3tLj44*G|lsBUd{FTYgW#y_(;o#mHPKh$1V&L}ie9upo*KBE1da42<9dsT2H$7Uu* zd#bPm9qp?s=0Fytp^Mj6gbnMfoFDnhe=>@eODMyi<()i4sr-rx4?%L^QW%enuBnpU zEBj&EYb;t{O(uG(31wMgrLs;NP&RA3BDTnG2if)g%)T@ zV&(|2T0mO}mIGL_Z{`TxE5o7!j2K?YeSYcF4=e*b_xld>D^EsGl_@5Qj~DkBe@_(~ zP;tCS72)G1msiJ&xLDM7h#G0^ z7&I>kJTIh@Ntm^lHKAPAl8Rt<&GgGJ8_7a8!3II=%Yj-gxnX{80Ajo+z8*GOhDDS$vm~Z$3 z^Urp`tny?tlxNyXX7H>H4Kr<}TApNDg!I{%P9>CNGF2{X2q||nt}a&>f}-%II?g44 z--?(j?1@-T9M|bo2Hhy?e`Q#0Db{zR5Xj9J)CI#Y>4M=4>QOKQzhsWSAS7>O9=GN( zYaX-aIcuJ?=BhPUt$Eg(XRUe4dTTQJf;zEH-Y@7`xOOQJNg}N0!Du9XL0y9r7fj(5 zbd87+52p(t;ANiiaPT(dYNxC*3HUzkW_2xDpZRFNt|e(dd|sYBf6$=447@61p3QcT zUsr*Gk^_+i5eE?i5e1P1{U{q`OKjB3Ad-M^l|jTo#6U#NspQvVAfg~t5IGQ85EpK@ z`|tm48qU{{r7@6+my?a6PArr5@p>}pW%LA4=z=~S!Ix(~$tMOGNLTE%9Yf5r$IK8ycx9;k8ZacODa`>@siG43Zx*#~`k@;Kfw{jE7%V`}Z~ z`G^T({%HD`8ECTV5ron02-z=gU{MHt(ePY=7IIYNMZQ7m4(fJw+nN7mw?d4zEc2DvOCN(Y^|2K)XeyYLXf{yZ(XNvk+^j|6Y*a zx6C*H7^y9=e=|pb(g_q5!|QLT|JINkzrbVt=HuWwhL>xob0dm{L*_%xYqWfs0l#F_ z)oJY=jraNwQhTV~Ml@b%u43o%u;Ol3>^Hle%N^B9C6fub8-4yU>Wb%rqS0C{rM6S5{#GF)jHuDLu$e_io>mQ#(^Dgi>%YE>mKppL5_ zsWYm5i#n)|sQ0UO6`rHQbJQ_>Y7`ZUkcoFOog{Hkt9v@Jzw`0V@y?0PQ=JX3k_{U< z*m7k-?=+U^l}=;X@=E8(ik?cRv3gCVbL8Unl}=;evP!4%samB|TA^EuYU^)!sFq)I z>BeVve{|x`gVZ!y!JMvbBC+CZK3}VuF8?_dJPVxsGh)odb{nrOm@Y&$EVwMc3Fzsy zF5uHWC&ClR*A*0Fx(E*x;ejH2LeZ%6>hhb&TXaozf$BpH(RD~AS%TEHcduLnHwV~5 z?djg1`}9ha@CH7kR*y7JGt%IBkp|bPLM#5dPRPRSFD;g~BN zvxOSNF-%qu@Vl=IWod5BFSU ze=J?v_hK@YjAg21GnGoODjWad01x)*OP4{vgzesra;BxFCBJ0gOVd?olc4S{r8%j4 z`ZMOFm?^93y(-_0yORUld0&N!N zvTB|6%%*xyo;GoXx(4F9=9!9D)-Yj-1kSm_)+MZDtqU8R7sKW*?Zb=j?tlKef6L&q zk?WT(UDb2_rTxG?d#_K|LjC3i?bfuRD<7D?V|I;n#|k-j(WdD;{PB)Dm(9G4h(edo zjN5Ou?L~eRMgL@6b$}Xk9CaV}y~+JDa5VHw>CMQo=sUjOQ6D=RUy@#mP~0ScB5+dr zb;SN==xFpk>K(^P_pg2Lan7xwf9s-8HteOJ@;u%6O}}#+b*eZSn}q-MzJ*$?M$mXqB?@-yOHV{pYt%{>44N{=#S0502irW$#`@&3rU{nf*cAUZkQ5 zK4z4r_a|^7yeRVda9EO%`WvlOB#DP)QFUImpm^sVfa0rG#mg#qb)D=Yy=Nv&LpVBs z$)7&KOfnx3=V*a52*8=}x!_E^t&(ewr<&BH+8ocyxGj~HaZb+5f4HKw)*+gC^)IcQ zQ8l$SWiMw+DWswWC=J(Aj6@5WVkDnxXo;3msE*>85Iu3XnweE=B*4&qy#Vy(B8UQD zV?_}400YQQE%T@HskVSsN;5ee71gS)lG@qlZY8{-2j?Z2t9M`WbDZ1vz=8hVl(6!? z&5vHWWZ&&y`um~jfBnQ53&nOD=`&tc)~5e;?3FujDB`c=@7nY~`+F~aY&W9N>gmhu zA6nY>x=}qQoffAg(6`@ezpXeuoFhiDu?<*n?pN7gQ4-zN1>UJ>u?B% zr0Q(_C%@J#x7RB`%t`a68zw49xS(~7V?pEM=W1NEr5p$sGGeABT#`{aP?Awm%F9>_ zF3>kq-P$S~e_!ERQ}#AKo5CEsP~CFP(O8q3i{(=d&CzTM$KvOx+jC8zSfmBs=VtXL zP_7&Z*fm<$G)vLWPu%PMy=Do?I_g}YX!hl4U~x>F`0|>^`VTy?59eOLxza4ip3l5d}R#BwDKz0`Jt(3f9rSehTf6w2ob;5gl{>J!1xgd z=18ia30K`rA4Bb9_OX;~*nM;C;)XfQ=bV~Boo{F&jP|+T`dqLEI*-#K#e2PtE{;tU zN)^^v)>B~(B~xL2VUj3mtt4@S7B3i|7o-Yq@_EK^%usxa-Pz;_OK#*!xHQ**Yl~~p z<+$I4e_i1`Mu_D=5!obCpo}n}Y*7Xkhaxr4s}WeLwT?MCTqDrr+DS{ZOlgA7=LB-z zY@{_c!_QDQhVrEv{5Cd)7?zac>$+1LB4CKXKyJ%|AZt4ogcYoYX0rf7OecZ=PgEbM zuG=46w)HAwNnX87$$x8PLBXMq)a&mZsV(hmf337Exp@2b=~vEyM-fI3&y3rlp6mn`XW1dT|c61;^`29*iLh7?_)l%rvHRuMb~f^z4wb$JNStVxR9&m3VU7zY#X zb-qAtKy4^ZZ81FY*gCl_(WbT8+6Y3Tq$+LF>i%6;xf2@Om`RJ*I7!OmlS8!=e|hM! zAS*U~@@`)-4~^hNmAUp=isS6xFl!PWxM2Gb;TVCkhDq6d`+`t~e@W};eTRID*UqO+TYH)Qo55UW6R&+7_52SmaE zNP-ttXGu=*uTHVd&L?Wl@-)qce?9BQ2*E}3dWclp%GMjYZeArfCwBaJVB7Gg?|FOE z!@57oY3=RBOslVS=jHdU%T%jR{cipG+82M^b4M4i_?j0piHkCeslS%xEGq;>#vhGl z9=PO&zU$?9qfhVa?$euEb4@K`C>IWM;lAGMZ|L0`iTZqcU+aocu?V*Kf3=x$`yu;J zQ49L^sN_<{@TehYM5L&hOw2)_X;4_tpoAq!C^R+ULGOf@@{+H%qv{P8GiehtQe*J| z5}@8PAZ!r^h5f=2VL~`1xEUcqc8mxO0< z(*TFMePQ1=_qN2@L_?ErvG0rOI6mfo*YBv`hvvMyK$x|Oxwy1&e=(VC1PZDl7`(w5 ztPwOqM%0KIe((H{^+vrYro@{hhtsXVqS8&Di7Q@@E16V)q~J$`cpsj?HlU-0^U4bp zjlw7b%Se_T;jj!{hRq9?kta!3ZFWu}SU>7|*SrkpS=#XUt@}5STPxIWgkX|SK(*(v zP?9dpwgub6upWGIf8*n;ulZVDHWO5R+0tFxtcWqS3>JZLLD7;nB=Ps)IYi9SMx1*SOaLAE60uA~1taalZ+8f6z$B<_ZGeiALgy3L1%4 z(MY%|7~v{!gsTC7)q6HqIBNuY@G~7`PDV19%(-!gw7CLwlM!yjdMl@l7>)^SMg!bH zU=M=xrkklurkz@p>7`a>{s+5W{1Sh!@GAZh^)mO*{Evl~0^iRZQ9s5rtUzN2MQ0qU zgyR&O5!FuIf2Q`~mFngAM(leHkMpky<6s)eK$V9Npc>ICGv$;~eOE;Z4Z1#CATqJT< zY7UjzCuW~yGPA%RS}*l%yf>Z6KmcU^k?)rGN{9~rbiuJeohahSbr_zFRtPZokEM9Et13YoE)w-0b3oeFWGdEsi)@K6m6 z4=spW$ixi;W@(ADN=)S3e7w$CBbhg{=Dd+Lf9FEZoC`T~?vI;ue_SUvQm|gH5H#n0 z$(;Ko^YOf7KAyMcT*#brAu=EJw8Qi}o^$g9E8Y&*&@i^8Z0cN%#py`#d>hYO6m;vJ zO|}&ExvzZh+l$-vzQcWbI?})Hw&zC%E)HpW-}n0Tixz$JAMxj>cT$IK?RiK{i;2+m z6$^On^fS2I>aT2Sw@)oY{|*3_wMv)40t6JdK`aN?0RuNVIhVnK0vUgu?sO-8d*8Qo z(pkE*r?WspUkE`K5m1%{h$J8a3Wf+SxPiL_6vWX{aRkR@+>j=qHlPwmoNLAOH+l0fxmB&M2)o z_isDT0LX&?+NO>i-&}vuJw6`@1_0x)<}7MoEWDsH0#pOwsW}%e4LqDZ*8*hk0Wwyf zy?EZDnZIq%1~dYoeraC&lEsKX3*ZO`v9oe223rQKezp?LxI0t1CYf4 zs^`z2+n)It^#bHn0J-xQExnk%5%>eZRsiJug&lL+&94_-3ebPu{QZmCFJ7z?44DAY z0|=bgzG$xW()7mw;Sj*Y#T`qQ4&-ABK%%^U@%eKXZ|b%;)gagP{RME{H6H zfsaKiy9Q&h7HUw4C`Ajv4rV?F0Tc|%H4wsN5QX~0iva3}`tJaQUO7XaF8ug2nwbhl z{r5`43(M}GWvGAuPNUT*75C;%YUk<4?@X(aGyb_&_)!x9pgsBoLFgrGp@K$rr>YVl z-c-ukaW*xnR5XKWDOFKHPV;?f^=;ycO2mYajw2?N_JJ=2(u5zosRj=LN7M_)V6;WLNCtc?>LTz;~YXSN`zj_7kaTZ zjpz4l7kaTq=*1aAFGQgidH)F`f1+J0^rAT3hbz+Wct_~P<>~sTj~^qU7kmsC3ca|Q z-lg&ZS(?0@R1w(|H0Lu1e=AvavLsXOK{p&I`xU zsNjEqC!JTr1E3KdxB%y40p{X-oQAo$2orGz#$z(3D!3(BfDW980IE@fI>azuDR*Eg zmSHjGV#rBP38bGBKmo>M0p{R*bYKZOa5k2r5T|1<=HUV?L_5y^7xzAd04h+13REM2 z$(WD12>k5L0p;%Vu~>oaSekBY2?7|7g;;-x08YmO%)@*v#S*177fX~kU5L3jOQFm{ zrt%$)xtNXf(`}!iyx}}dKKiax(T-(GYnLK`h3HUp$s7bQ2OU_9WlAqn?+P64K^ZC$ zP;^qNRD-C}j&>}>V$4SXqtTA@lxNJrxoO(5=)ins)JNk2oTZFjs$YC87ASpL_%DCk zbG9-b0gS)`%*H|m+pdhpiG55xrz73dfbtg3i#bYv2RU|;!Y7Wo0O#SXG@q6p<;fUK zRz_!ma^HE%_zqR>pQ}*J#UjjBM*A!U2GT7Wqzx$eC5oJI-MsXu#0~a?*DpW2=gtF4JuRaTUjm6m@LMNQ3napA2_YOBJ-V2eL+yb?xcxXpTO!aNNQ^p>CJ|^;$O0!) zO6`Hf*(Xs-DN5-mB@qMls4tENnnHm@@5oRfNv2O~4h0f7jtsQ~5`9X3ypn%ktK_pr zhFXHb;%FeyKa3hy5cAj_R!)j z#6FBD8ES7DvV}sERUBz9J(@1wP*isx#kj6Qo*$IS3 zBn%OS1dYmT66(f8hVq)g0^WZctO{(2_H?aIikRIN(VrDMt9@p3g0;8scNilHduU|B ze#w5vv0`yFVQOr?{`guq>uPc=2=HQ8*Y$zK#!1b`*9JLkX>k-si=zpeH>#~`R6=TB zJ-RqL?u@|9<^;XAr8z;aZ7Gfhcu#n*QvI77YT}r-a{>u%Xhdj!*ExS}?SX`=D}mFO z1-o4?X}i1+uBJfOaWSB}n^VJ`sr|ii)_1 zWHct!ya&USa;!LdVUjKgEfxbwx}YhLz{KVRX>S=)>L`u|gPg&uk`iVYM}vtKlbTcI z0A{(aS|xv`nKX*x&UOsP$n8fP9Q=7nZ`LdZ)9 zd1^(d&q`)!CN-xpBrqx=wvA4~mds%AKfEa^f6ebwl4G}}o0%9AIk7zSgz^c^(|56P zlM_Oij+;Eat1Ex=gt}3oQEgpaqe6jEU2R?MNqNQWP(TcIZD(N??poZ`HptPWyknI+ zF=};7LTsB)h7?D)P>k3TA~#IhB9R-;nBKfy1OhiqZtkXpHnxpu*^*0cnAE&I07wd! zax6#kLVy=Aj*L6KxtnSfdiQn-SfSJk3PLH*NfIbH%^-h{U`~>zaAN93VdX^$<4>hgEGk!g+Uu9CrBu9Y3SnM z7SP7T`JrV>rYjK$%xn$@gNZqwmaeWqSD-7D6ftLNa|$MeaDvR>Q2A3HxTP8)Pm4R) z!j*ht#q58;%;v6{UDHFsP%z>3v~;CVL0-)Ev?xz#Ps+D@LcwA{_yiEv!7Y3OADayy zAn#3oKjPjGuOH}_W%>?xjnd!LH5rp}s{$vJ@u?JN;Y}>U&GZSFdn2eX%EKO7{lfNZB!i(~3{Fc>3i?Qn zfPt&!Rq}fIuAi*cL(JR%oLnw1!emTA8!o_QSdJCA8@;53Hqc%2N*K|Mxmb=T@iK`B z5ZZrW!s(cTYj8WZ;~Bh$KjULUh=CN4732-_rV9PL2X@P2Vg)e}FUcdr z>2x-oZDQ~A|7~EO?1K@LaUm|orC5Wtcm(g@UA#{i&7_m*6t)R&G+;Vr<7V7~yYUcS z#9pEyRb&W}$aUmVdZEDjcY{HI6?GV`jQ)SkSdV*gKQ?1G_TY8AgKscE7;%yanL=ig z%gMFmCh{wCKY5fqMn0!1`e(-2mBJr{&j;R?Gvzzwhv0@Ao}VnpLPSxEQ?UrWI7kXe z5s8vG`4f%MC?kTte_)_eK1E(GKQF(75b{xr28=`##$y_0V;Qc-PW%DA=*6ozfPa4w zLKw*;CgLRl5+bLQGsp$xQL>4AMf$0YdTA|PNW1BqEW&z)X~JXu+Xk!y-2-0@$nqm{ zLViwuMd5EXYSD-(XvJbIQ8@NEcH(*L$7lGC5TYi2Qb0zNabya)ojgkRk|PvUL$9EZ zQkgZdwd_T~DcnAA+Q6cL+XuGFRq}s$5HP6VL=~zq1ofDL7A(P4xEc52VLXDZcm;3c zOX46tQbxv*sic{-k@=*9EGC`gQgRu&mOMnZk)7mi@;>>J3RF$4G(sbE4!w%rLbuV~ z^liGIft|scStq-c-NLr9J?v9K6rw_zFkWaAmI;@rpkiv9=9MG%Ba8ZH_uqfn|J*>y zz{r7f2UZO{JMi|vN3u@dC4USx%21CM%)=5~j^(%xH(>)F!ozqQAL0{yj&JZSz9Woi ziHrD%U*TIL8AHaCsbm^yA!n1b$$WASxqz%7kC1Ni6zL()k{8L#SYtzMA}G)f|8vWjYY6ztXBusL27}R(Z-)a@1VtOnh<7sEd76JzJX4s*U>gS zK%T;nbTm1gT*!LqMmmeF7uE^G$U9h0pA|r}$YBh}a59WMMBYFreVZ1u&BCkvi7E{{ zqFO|=SrU-o|?9x zSo%Kdun@P9XW1)sCl-Iwo#eOp7PS~4=aY%#E>?~!NGB$v4(HHcA%`xeIk*f{@ON?* zvEm*4NFE`%^lS($i_XEDv<3CpLrk=UT!AVq!Ya~*DCs9Xc!l1KYBHBSbHv$SK*^Cl zvW1Pt7V@L;qVOUW@FRJadPy145D6dRUaZFy`~g80#zUxuibj9I(26#k3M2iFTt*jS z0lA%hM((G>F#&Vg5;}_9Ht?M=oK<2tb`U3NRM%;ss#kf1D#0pzf?=4)<1*^`!d}%? zJkQ=>hvXJHI510>u@HI6AG(@YlRDh%K-UDT#D1e}QI2-4o6Bpw*cobV8VH~F5Ow7jFI0v0rf{Sn| zuE15e9;n3ojy!AupqsGK2I;C3-BJ^V}E24nTmfmg_Xi`oPk_SB4#W=4eH^? zYOI#uz;qPCO$?+8%emakpUZE{5B9%?2k-#aVV!yeK36xQ029bz!9`R%Fj?+lJ>63( zr6lX=9-<^$vvVs}@Kl$jq}|%e`0!HJgT<@|n^_NDV?7Wsi}hf68pGgcJ&3a&1-nM6 z-^g|%!FGS5hwa23wo}3EK!WW+58Ht~YzG9ySrUXj$)4!W^-D>%ZL2f4;;Z2jyFGx7O5G_=h{$T}ZII(8KP+9(ET5e8qq60)d~cM}nantE8u~F-kg~ zouYrFr?Rndz|Y39CYa!7W7#OBJcc!4B>ZeN8>OVDuuQOfEOXZ3%W!0IuJ)uV^iV-KrG2CHZF2(TE+SPT-2 zVIqs6jm4mXfkjcuqFBSCU@XdtkqbWy($%oQ&jRVxPglVQKl9O5-9EoGTuZlMBHe~I zx($ozHmsoAx>Y8_a0^`pPFqS>VFF!+S#%Ya|AgD{6K*qI1r6e<8c9dvG|nc_2~2;G zlB{rReSL+JR#vA{k2jU-T@{Am=d(gAXNB0n3c+Atg(zi(h#xKaSs^GkvwZAg`FM@x zV=v2B20R}Vek#pk`B=m9v4Q0)RBDCpE0zzL<%6N)r`+il6uI82WMwHSU5vMnDRYLhBHYl((onMVox*CIbtofw=T&{?sL*z(w#*oN5V*sfT{PTEe}X&Y^mGGVg;Fc~$j;UX0<6ItY+3f!c?^A#v5 z&@Q=VX6>Ju^}@`oJ7#9xIy0+zX4YvlvqsI#DxH~?B(o)ZB183<|!{3L%{@Jj#3!K6UC{Z|K* z8q)2*Dpi`1N``Xe6aKQ`JbyHW38#|W;L`$uA5+Mq$RH6Zn(<=BtPClmE~6x)IHMpV zKO>ak&#-7r8c~z2(Q7g_8jV^bXs8AnOH$q^Mfm=iMJ@6~EpR9(d69o|NK@NulxQf% zB4K9Z=(saRka3BgIT$xPkT`rsC`mFWO;4yoBS^wD4&x?|a3pFX51CNxP*4% zjOHzb+|-h&jU?y|NrK7ENg{L9wQe3v+YUma*WTz(r!6h~p5`qAx$(vp*e;Aa;-+E7 zx=|y40koxIwdK z(8$1+v6uY3K5+@J9vd3D1(!5UZr*ZGPxHl6Ugm4mO_Qq=wn z4{PTSE8_1uWzzvKmkvV*7JoKx(O^VNTDV9N-bxOkW%%|nBZE8IH- zzL&3yv?TPQ5s9qO2&Jlcc=2#vB|xdl=JDxtmE($`LH7>wV7f{SjYt?nBj9LSFtTaE z$R$hCng8%_3BQ(}x#UbGRsNPNyNla&YYNM{^e}U9yBMIbIB~tLgc1UW>I+>DzSqdmKrIhI3$5IbOaVRFv|ag4JP@Yu){3>6AoD9AK-*d{sArp zx?z`pfCqN@dwAiHzlRS_`Fr>k7=T;;2Z9RBfk*xaLh#Cmk*mNw1%~014{0(YQEPsPq1=gWN{u)CRI25Jw*QiIi{52X-E`Nn#sF1%x9F_7{kWeXq ziQ%Y{zr+Z{%ny`_P0MxeudIEBE0P)X9AqjXL=YjKL833yj53`3sE0Q2BG5 zihB8Tj91`k7=I>zjtPj%2Qg8BlOV|laXN;}2XO|5%b#H~M#!IGiUOyiN&XbmaEkmX znibfB(ekI5jxq8ln4!R#7%P8*Rt27kaqTmB1HV4nOJT&cjTFkk)vS1a%uoFjjLYjLjp0j|Tj z^82_R3xDPJaRU~~?_(tv$?u^H=gIG3l>%3zLw*l8VzK-#ZbGO0F4o|D`CY8V68T-+ zj3x4)u?|b+KjRh!{t6e!@8DKkD8GZ-6!>dgEWd->u}pp&cPQ{qTqeJb^$NTTm&@$J6tRO z2@m2r`A>KV*UNvx!?;0y9gkq8{5l?0;3jm*uj4Uv$$PLFtK>aMV70slTNK!ho8;H9 z6>H?zuuXxFW3Buuo>1VExLJM`NvxA!#dfTd`6-QCWPYaOR=F2X;n(sjcpA6MuizQn zA-{rM3haNuo$||gR)N3AdiiBMhr8sLu^YdUU&8aaTYd?Dzy|px{1F@E7x4l%$}i$Y z1-^uPJvgYq&+(MpgD>!u zybFDJTHb{(@r=9+Un%fw?2@0sH|UX{!MAu;eg=QX@8zd)NP*wsIr(WE#%}p(`~$n? zr|>O3o|m7(4|qX-3jb8#k9bkui6aW^$4l}~4B%yX2V?~vuhTOXou2vsq)spRmqvC3mSv-1RM#lo+FY9KO!LXfMTb7gTz$yG} zmQ*>>JkhhkvcbLCve~uSopB0Ahx5h^mujNL)icIO=Gd4g%72HJQ!*};J65ALc|GPC zW0P`EcTP-6a#M*{NuIFB#y(-svTsrIvsG@XLA8;L+$a@pEDmhUB{Rlh#%O6qO?*b} zu$rpTRpY8mnKO*q8OC8Ispz&Ulav!PNwy(XCdm++Wg?~|ohTKLFPRZ5o>84QV@&Rh zv9V#*Rb#3qj(;U%tIX~hmbH$J4(gdP(X!UE(ZVdl%t^UN(iPoSC7RcoH=3FGDf$gg z#W!RU91-zQYvha8zE-hMJk)yV&=+D~`g5q2hsM58vWE^G8AR_-eOgdjD)w`V{(63i z3RG~%Bg)H2D`AxtHmgM)3Nf`hlpl`8%!9cab0{YqtADDltUQ*fuCBD(tQqXMTl8$XI8bpcr`+{D2yGoW!Zr(^z>SGgexbfd zq$+#1Ie*h+Q>#^?-Db89GpojHwdRf4xqt`?r{|>|LMVH&2b^$+LkvrW#7^Ugf;ybPx)Tc7u!M7~`@ zC^U0Ub#affvZWC2% zvub>1rga!^uK|8gxV-o6AmazydziO(f4$hJH1~woS}4s>D~zkDHpQxFzQV!^yUk>y z%YU)8-z*uB2R7yCoyJW4i)8eD_mj~t=`)QEUCzK0ytR>mH|gu71X@%|j^E=?*oUtn z;C~5${GC3FKN&Lo88qW5ayv4yhoAt3{o56d9wPp*>f7A%D48yHc}KdmFh!dp~(d`vjgKe6S9d49(M}jIei%NwRaxQ_4i_?>p3&?n`HDD>>Sk z>Xb;Zef=|yZlg1k-m9}@8=b1$e>Uei4SK8UL3_5-paaFn@<;4b6+abLN;YjZ(SOX) z4*6R!`A~PUrf|4c{uTxDA>_;dfKC1ftnxpe@MLSVHQ98B{5?eZ+iq`mF~6fo{#FVV zsyx~L>>Se~jn8933CUMw<%F_>4W?*=%A`_dxf+n9uRKwn+mP)nyJrVc!$G2oh>!0R z5BDJ+=NiLQS7$WU8S7F~)3{8UPJc_pu)}G0+MHIW#i>$z++MfO?RN|6{BS|IFkBQC z)H;2pUaQyWGxRDo3+EVfB?QbaiA2=t4bmARB34s#VLDr&%Pv)OGKRpI<_emImvtyYW8ZnN7eD@-x=>6LTu z9D8+%x5;3?a_*hut}5}36n|}#8;hI;b*J38u`%K(s2ja{BYl6*z&CeaHZ&Go*D!U- z9wPF5&bs=k%P;C}2suLo`+Bxt^lC$nGnWK=_zc+(uup~W;l`G3lg6Etzn2U~H8fhc zh%Wk8LftLjEbz6Ohl!k5l((qr2Jp!rbWI;z4Axdr@oT%dALwued z>f^e-uPw(Q`4aRb7hS6A6IFzH#P^TA-v|3ZEGmz0wuXUJBjw5dp zeA_wM|JbGHJ?vC#^`gn1F1YN#mmTvb6fAt;idIKPrd=$% z@67kQhO{qPI`F|gAb3vxNFXW|YKd{{!dil){H;`3QGXFL4#^#pJ2tPe_I#+92d}HW zRk$T~TkZX^2Wq#Qci3MxzijEXzi3>ECavEA2Cy z>bMeBCW6UcXH2P5PgN{8&ukG?c~v2am{nGZbg8basE$>I!)f!&u9Ore4bGetkC=JsC4b)~7k*k|u#2K){ib!#w?EP9b2*)( zJ8!x3vT5t0qETmbOj~y6hF50ON2(s5{p(L=mWd|OVOa9y;&E%w;4_SL%{X&yeU(LP z7YiDu?7C+1ZJ>CY&obc?coD?wQWh8j)E88F{T`b$Ne(>W^*&=WSWQXNCYiFcpRopl z!GC#_Stw;R=no{xj3*frR6$>sFG*%}BO6KjZMWC!;WNPo1DVlnv$7<;S~3t-_B^lG z4}*`uM|?Zzc?gmjk`9CrXO19P_4n)`e}aSL9%V=8`2NGKo!px3uNU`2tncHQFYCoV zZr_R=ZLCvWUlO@o-0c9LJKw!oKbRWI%YQmaFh(kkgZA%WCas<-jm8jRtp5%2#^zDn za2=(|%ynbpqnkG#UiZs5B?9Yto*z5PKD?B;SVe1a(cD&^?hT2GF)&^g4R zDlR;=a8}`Yg|`>J=zQPtxkKaRLTuwgY2G{ z4rG~ZbS&2(!n%REe*a$|f8qOBUQN(ua++>@@pm_EY7!kbTFliD7(S6dVxK6MR36I7 z_0mYw?{Z$km-tdIxCE~?Qamj(m#TExg2SC{adbI;Mefwxsk?sP;eG~-0JX|;#Q8ca-5apPB55Sj_R*iReyEOpeQKbQjMavtQIa7 z=Hv3ryx`n@8#nGd_netUL*BaW*KZCf%(~}-rT1*O@S+X&M^~(Pbkp+Xo9L>_-?iQP z-g~#s`dwA5Zqn?o*Iw(IJ#olq3)kOu&g@%m8OZ3k@4oZSfAB$2(kp+&2%C+ppDd(u zNo(k~=``I?n}2o^8=Me`?QxyX>GUkxPJBoQBE-}J8|QZYpej&$U_PNlr{va7oK$ln zV6!LI3_Xp1``1jU9da7~{$%IRC0)V-rdL`~)18q^lJtAYZOt|4oG!00!9*sQh{059 zikq0p=}Ct~T3b8o#l!U|9p8VLw`I^uN-6jgN<#S&#eYs>zvA$?JbjYS5B?o^gL}mM z%TF51dxcYlO{m3Q>EdDwDMcI;z*IJ?ZK{2)b8)#z3UzPv~c6KF)69oDo3 z!(rDDcYoMW?k_JbkCzMO&bsTDIg)9CZyn!vns|78e?NCY;)4MVzH)L$B;~={>$qQ1 zS6+s33Edgv61kJ6H*beW{-WDx0iT3k`HRPGHoM1ROG|bO7wpzfGHBAIm(hGh1M!d5 zYC&a1^-=$wYpW6#i&dGbD=XNaQ=?_HQ`OX^zkh0%Q01Ic1^^m)l#2^=7tRh zVlV^@)Zi+K`h0}{@}I(4ypz-s%~8$MnhwIXc8=#0pkC}#0AB_EoiX3IOsWbLWm>Zh zSq8m9XAsoky!^a^yuv&|Z8ljFG(*O-1SRaqNKAm z&lox?*W7jDe9Jht0tYLqt7EY$&c<*kNW7;g&cW_;HkV8&^qzn1oT~=vIc7a6KWBTZ zGj~Mp>PZ8yO=br-k9Wj}_x*U%`77BSiOsh`HJzEXFI8UXh!5LRirPQmnxa<+L+3Tt*;Q~&} zBe9sbB)=F%Vi7Hhgu~uqf08Ve>RptCb)np_D~52M574=&PLmThc*s{C*+V_USr}R} zQM*yQN4rn^wN|B#g~KH%7K>?dl79@7Y^s!j$)}U4uCza8`0&3zBKAT2uJz6OqnWhvqZA{N!HT1J?y3>vpkH7-Y6%T; z$(YjavEVV9G=@x}*YROL(#|>3*{P_cB^=ZL08v(Lhso@qu>t@0O0;hqXMakHQv-WB zrgvc6ET!g44rhU210XCF)}adDNN2XGh(W85h@w{;bo*jCIbL^Vv7yXgM#~~qRo-H% zQB@P-)tH>th|%bEhNCDH3u$2_FV7pz35A_i$jc1_PD;XBC)H}I@{04qh>FpPQ5NOn z9nH-RfrQ1JFx&w*o#@`^-hboX=lyaajp2ZD2UG3;q81LDXi$MAK%~F z$t_QXAKdihp_TsnW4t(d^l>~FT7Q8Fr1fN9In9Eaf6s%vQcm=MdyoePosa#74}AaS zCo*BsTva%bmHEpo0Kp1*uW+rf3H2l_)vgZQ8K9+NT$~`XG5S%tQ-5`>`l-1O=pM*@ zO1(p`6+-q*N3Z1!_{ZUVuCrCm(AQsvOo%0EM{7iCun_Vmy{Iy2!U%@e%PS#YpBNA zaDB%~%Zjq0z+<=EUw`h4D>l{sW6Mj*#7%o^C#bpBl%7i!#N8*XJi{{~%3namcYEc7 zD3lMPKtA|*t}VwF8eD&BTS#XsUx18!WhtTQg~gtBqX*Zcl=Eh_S_Hlp4Nfps%Fz}| z+jh;mzW1gHE5BU*^6Cs*Hs_JiPSmeox^(BHYJv|>y=q#DRe$7HK9^`A-2=DBswb}P zUU_F1QFV2cTMRDWGk&MtJ7wYAn_4ftV3B)JCdmYhzX3p`jcf2+=w#!qI3X5O(E-BN3N5>~hljp+hq>wVFy_Zj~>$ zQS$h!HZ*Q-q-z@YHqyo<-6^@7Ouk^y=qsZVT}#;nx_^gK1D!=XD5Fo&ofydvr>8bo zT08lY$ER_mUaDAT@*`?o(R z8iW=v_J6sY{vSA|YSti))4!Nj5BN?{A&R9ra4Ok0m_K40tOw!$S{3_DSO-7ek%~)& z5>-ea$O>2j)>2QYZb;JmHW24}pV-H_-uIud@|U>vv)JYd278F!d{TUKA5W=bzYD{T4c4*2RJ1Q3Gz;qx z#6qdosLPIV1BEYtfY;5m>i5(3NQ~PfG^}%T6T_e-T2~0fXEr%=?q7D?cI$yw#N#Q4 z=YQDx^Rrc{yo?xw#(!l2q}}+pXo(UKY~vkx;RU5r9}jkhoW_M@;LMXcMBo5~9$_77 zX{{9h$a}y?M`3Jj5BA^<@@LQM-orRd4tq26knhd+g=aVraDS!60Mk1XK@qkMSoN+9-WfUVuu_x=}{i(fU9{jIQ zX~^qUC6Vhd-+jHN#1T};dStILa|q^W=u6h;dQB2jN%rl62yRI-c=fq64s7Nu;DnC*6p+3U*n z@p4YE(i;r=yxv?lB_`tYxGf%!o48?)g!A%z;oMxBq?bJ5wuId->PgZ|q)ejA%p@AG z$48PRD!GBElovBZCq!pOJECi%d!y>8tAsM2f62|s&8AuA4)YrG*Ji0N-Ss6AzK3TZ8cRW(Sd5-Hv50OZR@8F+<+~mK zpYsSDIH^e?`};G&SlP zO{KP8KSZoFRoaF)G(|L`FBS7ldA3r=e^8q7lwp_HZR$36TNAcjjvY?TCc|Um{iffV z@3r1%+w6GQshMV;WNUS75N|c#V!O+6hf~vJZn8Gn#yU=QPB%;!Pd8}_9YYM&<{E3A z<21uqvB{*-sWUZhwOdnY$T#O(Gt^cm5j18)mVgXV_Zzi-)}WJ z;x@jGnQd{$Z4R3^?%+V1l=p2lIC<4Uo~n}a+egbf6EFXsr`mLC=4qBOZsqr-(nC_V zUW{7Huep20&ruF_)SGm6fV!^eVlgP|fGDdL`OE0h_YE9p$}TuEz)=Sn&Qw@F*lXSx1! z(}{0K@?g-vaCrwOu(B_if2Tx*s(3Icak8)L@{vzBy?;u@xQRoi4*Wp$t@n<5_^N@o z$i9K4C(h_sR!+JquhwOre8$DY=G@K4oyUWo5!Rs?HRPV{2+F&q(*nU^5sTe1Y)0(t z@(apYMr26&*z)PF=JKV1rO}IHH^%NSdbs?x@LT>j0(--66@L{re;UHt@+SYN;Kk8v z{aw+U{lE1;5`7`?V(>sD%ePbh9$FZFkw=v$@M!2U9{B@Bk)S%KI2!VopgQbyn!*lR z3}0ypANCSH;w2>-M`0*jRK%@Y{|*LEkYdqAGBn1-x z+4;nrjX8UAzRnSHf4E6vFiIjR6~7j#=&T*P@R&!P3T^Cf-OrDo_1D)cr$!WwuWTD3 z65-75OZiBqy8q!Az{!lS#khni?O}KO^?@DoA%3iSTSOnT`IGYD?y5j}Qa(7ibCGti z`EK^V()npYvDxf{W&jQ6=T#mRnJFplzwtPUIr5u#uDxsee~KF=URr$DBOL?ZeSF^5 zNe?X>c$sDnj6G3s{&@NH4Y6T&eXH!2+MkI{p181f^6enlF7FjA!X}KwM^aHk<*Duo zm93Q**{-u)?^@|zU3bTb%rSvc!zmYuhlW2m;w}3D`*-#XH}9m`QO&phW<{jJhM_Kp zL1h7{$*w31f3cD(9%DD^oZ;nQLGh}dsb zcC&e~#Gc*{R01dEWqdP_m0%HLLC`IkoNVM}|*pIq=;3SM$+L)$F|c?k7hzmEHdO%$aX&N(jR|oJnu{c+~y6 zHSHCrSNe?}Z+_RAYhPYj#;ZQ%0r{D~zI)+_c|NNvGexy4BWr21 z6c;0f5Qg=S*z)!4KVD3qQNpZ>6ER}dfA3Gddyaw`^ozyx`V%3SO8FVcaFpRx$Jj`l zcb&M$`-9_$Nallh&`To@tvF%|6v(ZYZCc}qDcr1ioM-fwRK!lKw2Gp|>eX9qIYk`h zL3nYPA}og6!h6C(I9wPBhl?WKoCtJEsLs)mLHOCtjtrKOQAjf~81?EX2|9V@e;BW~ z(&6pL4qC!`7S`nigL=J=f@t{f{KI9A ziH?NhYlqP%aXJ4jg8P<=ciGt*3=u^Fc*r(bq3AMo zC`2lM2}|$4V4!8V-IA4Mv6DK7IV;<2zlU6>CRc8BShBLs4pN&+C1IG>s@Ge!DR{)j z4jy0TQJy?NxKCJz0%lGfL6;m>2esK%YJmuv0+&S{4(O>ims$%`ODtC{fAz}YWNv1= zr87HR9qtZKhxZ2Cb@m=rkL6RFwoPm^wwc<@!fTX>HqkEGB)j0CZoALv_xcJ7?bWo} zR&F0fN7;tkTgVJsv;7A9gZ3Bc3%2*{mI4QtC@4^+NSbNH6hV}%%_T=u#RpqWN$j!|!@CFN@S1Tl1gVwL52JJ5G zUhP*}S*y~nRcWw;WyI&OTO1BMWt1?V)n>6;Z8U68(hDV@BMd^Ae>KbmO@27&;(vjF zIh>^qXXz<S2g4YVZD$o?{q{~2ICsE06lZs+CsWfKex7s9E%wYRUIR?_ajY{DdP10rE zs(|%r(#rp%2NH!qe~Klm-$HsU#1a-&1gZ(DHLBNCg6e4!MIoBVWH^+mak#a!ueI~g zmrilNi=XE2RQ_q315UBO)8*(>e3Q=B{Z4VeL;Mm)^s2L= zV;P>NW>h3{!klV7X;QUz{*Q=bvua!-e8#v$(WL3kPtq0Ce`R;sTxnx&T*7s9W1q@j zbW@EzDSy4iCJq{Vd^4rBwIvv0EW}Ro<;~_wv-u<(d*_-jKfC5KzoLF?`6{@(<8N1f zw&?kkKIRBNiywJb7yeC&mit_fl|G*FRQ49jHrICF%h`v@t(nA0iU_;Y_$wE^ zw4|$KeaXYwkCZ%L{#Nt|ltjk&A5gabNhB2k?~C^-$Bs%{`}n%5 zoJKlo0@fMpPO{!HF5yhGZx=G;?@=XxjhOs3obsWqCQXSZy(xy)&h$o_WzzKKo$$$D z!z}mkf11u#(i)7VPYZE7@wnq+{77&r0G+mwSXik`9U7`(%}?(6^~3w#8FIsf6)R?M z31~%oX7-%BCT{3n%-Q_>&}+s#Iq$TK&R?{1&ayl2=(ywwgLp&J*>#x?lQGlaD*DZw z{x=mH{DNi zV&JTThjQ-EeUfa~J>`2Mf4Ayo&6~mpn*FMS8lz1pCl#s&T_c&G8{?Zwrl?voT6JfU zvsDXq7tl*HFZC_+uk`KkKb`Ycs?_$y;SCiaHj12_*wa^`kS&} z$6cjDT%4-RESnjht8|v#9A8Q;m6nt}e=7Mzl;F9C;}>vW6_%CV5&tagB*GFcge&Pv zwk-T@`g!{4(5CQ#^YTIX(9WmTy=yJudqq3)r~&|sl9J%&BmfAJRb zOkuYb@Qy@WL~+C=7Sl|+2AWc!F^L~S6@F-uOvH|-_8oZlM_tF~2s9I1yyfWe+-2xJ z{!`o^MZ4r*qvz(+4%o47N9 zp>)M|GXR{>S!ZP|G>KK5 z>=X-|pg-Vd-AKiZ?TbAik-yNV@NpFUl;=O`*WIPksE!&9#PlX&)Y(f0e@8^Q7+7>* zwu*W3qq~3pzym+O=giaA{mS< z(~Be-vzUrHyaz}?0dJd2NO7}(C9x^k9BdJG7(2|pE}dpiOJ^eg7CJBgm*|(GiD(LI zja?VHUS1fvSzZxYF0YELe~WC6ZjQa;r0x^n!BO-1Ka1yo__ente{%skMA!de&3m~4 zNF99(lJlff8#kT|!xy$3X=|h;hM|-5VC2{AS(%EP%O@Ht4bxgvaT0do&Ehsv1HH9aI>G4#YM# zs0vx7f{o=af46}Vkbo5>3RFmv_VjvodT`2vg8vKAo~E~OH;jT2T&TcDcua2lzLq0AsssdhnsyvFFf!c^`9k^ChP&R^!@~!};e~)!&v@|y%ErK z`$|JA7tXX0tKVIBe_UL9>ZQwUR-@@e(oeaQ16s$HAnv|4GX^yl=x>x#J$;J8U`8==r z37==af77Y?#Hh4M5VR|ZDJZlCV4yPi_<{>YY+_-uSkD!Os zR;e%Z+0YfJ04OHb1igv-0tHd{Sg;KbuZGtlML8U@-0|!FfXb{+=Kc3`H-7&6BH3iQ z5ZdMY0C4b*Pe2HCnyD_~9^sn;PI-Lu(XPhaf6n=653?a*6T@gB;Bk`xDhy4}ruWl0 zElI^sZ?&jh{i(0|#7~TW-ru9=9Z~LM9twI^0RYE-ya#k(2{TQ#P_2Op)I=&xO`=Sy zotoxh%YDthU6H`F$bxu!+ux}5dymPwX<9he9wcC<~L ze>ka4YY`|k6;oJv1N%06mc7V2086tbi?ba8mZbukP$pX@7-+PHX&o_5lVe(0bG<#; zNH=1Q9d(V3^>tcvhlwT^546Mfj!b*InbB(Mh*)`TO+`tRfUZP~X@CwQq2giHct)r6F)C6i7D}Ne{^5oQ;wB?-UjNFOdAR{K->Pd6K!~#G(GWB zsK~2Do$Be)%P3$~0B%Oo%bfJ}^vlGnN85sitf64rB zfg}H0;L4u{ME*2@`FBRN1GM`qT<8hHZ5Bl=hEe(PwLUT2X19}ea)K4}SboM>n4>dx zd)N4TSJA{3=HXY%mQU_dTkn~8OY?M#j(&btW9=Q2JFJ(p8)~X2wOiBYtm?M)67QOO z&$Nz?X~y+85AR0Oj6GxCG;Q(le>>LeC)($gRNijijF}4n!Eyi`^Y9+f3fGz~r-)N- z>>zQ_jcsxF5q)mF+tuU37P)SB-yXrAkGx1=56S&-7ludWr7{Mf1H)o&*7g=DK^8Ef z!%8P>Y-ODlW>qh&udc4E*D4vW?PUgFpo0tqyrjn1Q8Nw7=rXKqVIg#Ge@&uEe^W<8 zQ&X}*OB$^N+zZbF1uinV64l|Vtf*jFhV+n1ctCZ3QG{O*L0ba(NYv?exd}H$M4e$7M%*Q~Lx2GJF=6YId6>R-+*=I#i(1r?`M5AOB2d@8W0e|sroT?0YuYWjty zodD9H9^49Wkj2)TAyy?!#N?ZSU}goepEyCBB`y+9A`8#;hY~N1#1klf8XE5GM!g3k zJ@4b--hDvKUjlso(k_}0@WH+LbAZdA>-Wc)*qFudM72k>txd0pP!=8y3<^LwDwgr` zR4n5rsaVE^1_rf;f0eM_jEncO87~?{o(Z<`XyAB?NAEajvJ{^oNgthYqXEMyISohf zf})lx6kU&a(8X~`IyZFSVD7h&J$L|eb3f|s{RsWQ9k1msLS{cYVBz9Vzx(093*R|A zfN~qTRo3oB-EuW%rh%j;#7SyGQ_YQVF4pP49WKTe6U+Sff5L|nch`DJ zI{tpc$HaNkE#cMpL#}oBW_%k?h*4|HN_8cY6fMz2+e&%aqvK4{WUa1XjiA4>jxvO( zA&NqvPW6(ND%|LB0of=c%2mn@-QmV+5Kv-N$?TG^m#ipplt{_q^a$Faqx8X0+H&#! zl!y1_1?S=bf2P7$kIKz8R=L@)K(y)&`44^^*T>=9-6;6Bb{X=&QJUkbTWVakW5%}o z9{$&Ra>K8FwC)XSORXqMdc5$?vzt$z-2BW*yle9<3-3K~_wHQ&l^kK0J-ML6u-dnl zJaOXf4Nts%!tQi;+>GB3s-R%<4+mhiXEwQ%eSm$Ge|?&GfpbMI_2`w4>awiqS~Mc; z#kPYGG)<31FKQ74TyHmLSIn|#Ypu!~;H|HXbh`YI1AKrcOUn#UMUWX zgrr;-U6?Ce19+vB(r?ghcl@GG=u-9Y!k-HTe5t|& zGj=kCf92cF@d1&Ij#%5m3XMbTuNF>W*!Q$;Ij6`CD@-YiU>}i2bBs3s2++@EqO)ro!KukMNo3WQ@HYEC5TUZd10k z{6p&-+_5Pia_@@ow*7L-Z@9tKucmy?T}u7Oe-zfs5u&rrGezbEQD}=yc}&}s+DCck zaW}UvX)ZzTyrO=vttMjz+>T#hMRPwQcz8#QAJA1 zf0zqaRKiMWTDuD;%1PDxwL%ugA_AZt<-)2VdU$Y@6+mlj(I8Br>wSzAD0En`cK2{= z%M@0LmT_glHbDkPWP%J^lnF9qrwB3-Ga(rSLv52LmZW7E2^;BFxmgDMWX5v4kP)_r z0)S=N!;#hBW$-C7`jh-8Aeg@Zrsgm7f3@)~+5ClmO-x6}qBN_~wbSy%TJsl7k6+9f zykE?;BJCWag^a<|LS`yb$5VM9otesesZ138JCtO-=@n#zcr+BLW6%lzRD+?w2gM@( zfhUUi2lP9efQXlumKXSkhf$ytva)oobJnh(WpvbkYsb{vzW&ycBdgtl-y$HSf1tj3 z#rJz}oRd59$n_^TZpW)i!eMzsEG$atcXKv-ENV`Xk{8_I+|Ud4PO}93-8875G+QQ{bNh zhrRE5iJ%+xlWzwOc(*CI9S)aUe}gpd5g3YQSl%i5Dzk8l$;6D(QkMZCAbhIidbH7ht;7;t78p)j<@6o91HL+5Ql>4BOSX%tU`og zH|4Q3u&>VT^LgAFWv4~Gky(YbXk112HJ}uhb||H#s-nfANb!nlfH)Zp8FDN}xjhC= z5xk0f6$OBxi2PMgCCw=Ae-kd~%EI6DS4_Wc)Tyxos&v|JTu$4Bw$0srA?NYGsaunT zCQ`Oav1>}RoP%(daSlcXEWz8KyuA&%!Zv&r2>A;@%%1~n{#+sdXO(l}MIXPlHZ5bf zBh{R5Z9Dpq`4!6^9=dbZn_I1A_|$SaANo%F{QIz&wHWK?Ed7c7f6~qopfxbicT3`3 zK!ECeL7wSp0e&<2Scq=(QAJ`0zcUJf(r zm<+Rn!I`~qDd3>T^qVZKXIHSj?Axq^eHHEirLYXDh05@y&hC#bYGMc!aWR?nmjV-4 z7I*(dCHE?oT?FIV#6)os)}|$jXRw`*=YH^2D~V!tO+N-xe`TIM5A}AJ+wOip`>-erx;B;Lqr{*tgU- z^f!_RQU}^8Hwb}eH5?=%+s?4w9mR4YrhcKCHXIWNJQ@pCCFasKt zK^r7zu!d?Ve@3{$NE)SvZX~7{?M9Q4G7Pi5J=5Bn(e-$3Z9KEUnaaZ2T}u0N85&h? zBM>@$sw(2EP>Ba&J|9~8J?ER!n6JQb8*&spZZ*U0aa30aCe<0(o~WRlL^8g zKHdvmqesq+7~w(bQfNq`FNLgZr!;dgga}+_LY;)Ve>Bk23?Up~C`1pUNiK) z8rspRU=R%|S)#P1s1l_u$xD$o8rl3LGV-*5{#VwuJ)1w+PxB~4bI|nDe4C!8`8E{| zR|UY4BLHn0Xw=6X?LJWp$0tE(*OEqC@8HPhe<+-+q+`8sO*v16<=pR)7y4LkPi~*J zHFBTE!W35y*W`Xw%28qYJlZL@!w4+79VH^qqu-XoL%F|qiT=XDGZS)0?3mmyx?nfF z#%=uu#S))F#@4r{;A0$RvJO_{4(Be2wHz*eIsWlaIdCRrxQ*$Or0 z_t%YT(ufx8iNV-rEf&+Xh^ALHWU=kLYU?exHE4R1wY3dNtt!cR>}sRax!JBYdLTeO zG22ZhSRaJJI;$^63v$=9UtO6hpSPsCXu5l~_ zfjj18JxK3HBD@g}(*}tly<2J|8jPx{L;%EYh+!*ZXJZ$U)10~i(KxhIajtZpbzXE5 zPN^}m*HXGxbUN7CO@G|kJsSTMY2HFfcdfhD>Wo@zLpEQ=tNpp!c;uG8^4%^sP@Q(C z;TX~eM~?EkstAr3+C~*yo_kP=h5dr~u@$t!d2o(psL#t`ny($c@J&lTEfyELaDRyP z3m!{(&&Gaii9e>gA-K0XR_baG{3Z3=jt z?7Vw?RK@u}{+>B!H@itTd&zBgbJ;!FY(jE2*-f$uBn0*(Aw+_Za8Hz&1QIR^BwPf+ zOJYS)Y)h=Ss5kXQiDWvxrwD|fZp0PzqYjPLANxoS8Y zzXyni)pxFF@BH(YpI-vxyaps%00_{5!U&?O5Wr+{h43oMu@PEOnBYYtpxc#bfd~o# z{2F$le;2R8xZKv_aKV>bPqJpY3|ps8A=Odp%n|LMWdlnT0Ny2DvEqm7hE%^ zR5`)^p3<0yXRihrnZ@xPJd*u1utMI@1n}StX zh0|m;ohE3-c8yc>yykiBO;IILYcBlL>!OpQ{}BC$*lP_BvcI^>xJuJ;b5H!M>@Q(+ zf5PU(zb6N*W?SI<|LmR=f6Aw+@27p5e$?@y^C@YpG&XZ-<{Mdm&pteAVb0HUex7@e zXRhb7ylwfvFNi9<+dsc}EL#;=I5H5i|KAwxKU`uz_K5xD^+ek>FFu|e#| zePTb>i~Tqfsb_VE#eVWnIf?!18)83Ff5d($kv8dKKiV$fw>5$p%>=Pued~g{brGB< z_M=Pe$8@nDN&g?m(Xe>gEd zlGebAtVmjmEC5yLz|~lR#c0P0Ohr4^pdK@jhe~u{3ED6PGclXjuEb(=U>Te!K|V@R z{12_2k@n6D+A{hMtioD!qMh%xf8D}~QJ8|on2#0cz)Eyr0ahXBeEs*ge;iH}!iPeX zz=@eygmyT;!`;bSuRten{Bu}{ZHydwk+uqo=ZQIVq$!u)fwr$%sHWO?nwl~Sm|2y}7r{B~4_S4-n zHFdiBboW&K9#cXMvCF<#SFO;DV=w(kjp`$ht{)2Y!qAwv&fLsI1fXFZfykds$1f<) zN)S|yv&RxcLsvx@vhxw*PW!0MCOB870=1FztA*fE&(nH=RSTm>n1onKBPIf=6oAir ze@rK@dTy;~FRejY-3~TJLeuuV*m0?xY`Cnb7vF9&*A}Rn?hrIhQ=CoGyXMn>*>Zz& zj5#CSJ1mTU8oK>>%dEy!rVkb!4(4$>icoZ@m<%U0VU|{_X6q&soa@IN!%7oohb|3)~( zG&v~o*mwT9(?IAE&>zkSbDapq7m@9{EJIuL+}9lR4$N9c zd_Wl9=irku2^SMCm{30^#xO{a8oCS=tlG*CiT)uciFMge@Qi`D$I23b zkKV+FO<5`Wp7V-X_><7p8Ni7WE+j`DBuB0|ZwCAY#H$Um`AOiq5F6qT$Rt(p%VP>29?^ z@ul(~wLcor!p0I%w?A=Mf1)9@W1cxf`v;WWkRl$q?vtjN;k%i#+jpuSub#5IU0O z$kGxp8>6>H9LVAl43iWqq>dLYL+Fh=>J{2G+I6`YI!Au(6R}r?Wrbeh@0PqSr<~55 z)|?u4lvxc~Et^o*_M6a)QfVCE>P4N+hY%U@JNyL*4ib3&;00Xc=Sm930#&mqy-kRn z$zz_waVYGE(O&+(>#-1jGyrp-;L7<$%)0aZXBH z)RYmb!`dcM&*{(2P`FL**_SP>l5+yA_e%wDVJA+rPD!{WrR5biF|X0Dwh!g6oW(=1 zNTWuy76&}{djRR+dbqwJF#LXH-`_~ifmY!W>C%)Fq^je3E@WR77qTtxFF{C&lr%Ph zc8G&YO41m1PU3gSdHBsM37>Lo9QqI*hmv-t&_GAzcoFhmr!(cUq_1>HBs!k7J(#{g z&k8FQZVe7ESTckvgfn<9m}!KI*4wO!nDLEC#d+=_u_%~g8C*+AwVp8Oq#akgy%3UNuD-cpnk~Y ziQY$CG@&>ys+NDz9&>LDM~IqB?zotBEea7Ir-=NmAWBN0Bc;>?>@t7rM!^5Kzu5t+ zPSDeWBA~Ze;~wt47|k$YZX(X<`_h64T0?wy0P~>+3z)1GqMnxcYeTfOP*J#;E4L69 z%MRVH{HM$nC6$sW=bg_7iS-C(Vh{m{D(wJ=hd4FdhZz@*WPov3zD$)tJL=&X2jd3Y z4~Mk@0U;qD*R;@SL zmH_NY?CO~dncwAOB^KA&B;=btMgBE;3i%5ED|rTY&PivYjBFU>9XuQ4015!z3q;dN zA%cBLWTnu=UfJLA-qSxK2n+n~oj1h;f4{bN8ulpGXpU7BtvmyPz@?!+LVxe)0AN=b zfNz_Bn|qt(esM!EkKfaMYeRAzOZ4kU0+z8Rs)j7DsXKIf zi__bggORRr9}g7H`LMWk6Od;>vu=2)x+sJgbF#SH~^!0b8bMZ!-*QhcAF-0*}|tVDusa>9G^4j2QS4Rind*%%Q=4U?2FTzF!%Fapk z6~dh3fmTpDt){wMF7$wz<}pViU+y)8d@bXaL;>reS7ngVzpgIoQWHy9)w!D%qM)ba2cGQNGQ+w)e(i%op$FS)^>B9p^z5T zpqQ9dKE+%rsU0+34h4AH8bLFaX74*b1@|{QYM^jSSEaV}RLX4ruKI~i^UY+chUI)O zbNGpEi9whCMhRh1&t`|SMUd6b!8Z?zQ3ZsMjmM#0pC3k0le6D5I1b*t@RxVR= z6x;Tn3;w;aWnA2{^11#7*}*#rwkk^2usp}SLFv1DKUAKup*F{i4*oIIpmyO(=UTed z+v|uv?C1AZnio|>r!+kZ$7~(CIPk>~TRS88dpk?p7K@#6^m-urf`CoQ-AIMHL6$s3V8~e#8`8MfTeUrB-$vM`)Ll za8P#!73xlDy695NaMqCMiDaV%m8QxL)-&rQe#}UaJdoRtEVRv#w&BnxG0n#HPy-e& zMjX&7=ino?-EOC+I2@vTpI6H!2edqtt`Kdug@bsp$Chp`cZ=J#8(Fc}_T9OIM(^Um zOfpxTsKspnZX8@etgd(z72Dp6K8<`@Ovhe<%$NCl7D_{JEG|}iIh3726ApCDDR~S` z1jj9eyc6SvJJCG}qB*=)F3>Z4Ifs`m85;!Y+>TRTUOk4rk!TwY1%wV z&so4`buBsWRYaSf7bzOZ>!f0xn)d`nadf)oe>3B7;8EQD)>AqQdq zf@ug>pBwBq#t)MiuCz1?6y^tKjXuTEGE$i%CZv4$>f}@HA0&pDWTf0D!GgM6XM8jt z3J`msTTdwV4?!odG9*bEV$)h-N}~De-q| z4d{Y=u`f82L{(m4;t*}Lvfv0ra%Em2ZpkTCdN|7i+OkpgD=edM$E&8?AlE}(`H1I3 zU3&D*=~z2D*n_EDK%swh1^#M*$UDqKxtib?p0cb+<{g=pD?7sGL3COq<`rxDFTe?r zQTcPwSNnmQ8mt(hEWr`K6(go zS{-^mg7SfYUb5*GQ6pd651MWPQ2BvV^;7YkwRY6^VNPoXh}&EN7-YB7{0wfvuO0gS zV6PVya=O(XJ9O5dO;UE-Y#;9alrPIlSP z^MLFhXuBfXo;1|ul;aKKap3(xd3 zizJobMR6xpMqZ-@iY$GPp5*KTa* zv}!%TXIb-x{!-m=L}9zCH}Lpc^#LQ;Dev`%JJA1^p!)&XFTvcgx#jouugmaT16J0` zpM6L>Wk8f4{v(j&!Mr=%u$<{Y6aNFZPYn>1b{+nT_b+rP?WP>?m0-qIFc}Mm)frX2 zq8f}GoYvj&A{q_>D*7Y@bJYMLe_Wq=a#c1WwwF%puA%vAdc!%dqhCo8T|8lgTaW<5 z?kz};E}qzPm2XZEyeocOlR#Zhg`KcA6cxk%Jg$GN?iEaX1m_x0CcnR)=L~kDJQ_52 zf}Xg1iI~cLoY3+8P6>T~W33$DVEvQvBP7~iJH1QOX@tg84}U*p{D)9i-sSYYu975s z_-Ywh;NaS|yHp^o&(-tC`>88e%-TxMbKnq@v(Qe&SJ{41^^OuPTizh-D&>vf;H%_~ zXydDR7{LJ4JdCg%D|z$x>(eG1p{W3-?FvLgzr1PIPR#Yn(wuVyQqS&h0fkH8dS!Ha zWtvVo1_QsmDb`NZzgE7s2Ati)elDE+7kz6dJzvY?U*70zCkvlqWq9ohoK86o&qQbU zpA3TUf7VVm^vWz2f|MKXr3@?PH5fvZeMg zV0}rAnKZ&7z!LHm$gMD8b!JNp1=9$TVHLt5c(}-#v%~^t5^xdl1Ao-z4^q{yk%9+C z{&md@xa*J)jGPIKWC)B*3jBe9ZtUqJr&mx^D1jZSi7ip~GkRw5rx=@IJnw)khq#Mw zurbWfNZfir)+#ZvO}+H;UU0ebl`*WPuo3EPz9?4^!=N@k+N?;h<}(!72X_z;5U=@q z4yPH$vO$q62z(GH8-12o=K`&FQ@~z=gmyBd&KR{fl+-uI8))nH!>~yA8CMu+i;vc8 z;ey=zRe(UnXIwDjaMhM<+Z9*FK1FPiKOL#iq{{$iC9V-b9_RcaU7mwRe}^$FWLIQjb#sOq&KZg@SM;*sc*Cb z(9{i%NK~lj`bPZA3u0{jOUu7zehrQTI14>vd*6qXhHp|up7#bbo#0Ogie8{8-1@5q zCw2dco2T&&b^wy?UP)r5+`|wVM_r=?4oZU11O~x?MFu@1+66FYK(y5$ptmu*8uC^E89ek8HcZ%Ajw?KAQ1}tRQ|p9G z2_()Q6n+j4QVI^5*GonVHe9l39w7Ob$nnt1-HmY~!t`B)=``2?hKmw^P#TDQb%rcA zNWv8&dJP+v4-@8T_~$PKu+gAk1_jlBMR#OAYO91Jtf5e-JW#YeP_tYlN@?WDoC4-G zSOy=Bc7vB$grZx7BH5LKL4*Rp6Cz_3j4LdGi7&#P6Jx>^+z>eJoUsRNXA2yIadB)I z(n=tC-ox-+Cx1>?KyCzLG&V?&|Lu_T43V=#Wg&qPAVJG;g4qzEjGRT_S9NOW-lXF4 zIk5L7;Ps*KAWtyVYS)Yh(MKPVFFu}T4yHz8lVIeC&{8*spyOkz2(17FNJ`rB<2hwd za~&#?Et+%yXWo zlkVjM&L8jyFhuX;+&Jd?Bn*rCzNWfG%@ewNjLy8vumpg?QIR*K-#te8J%+^+$iI31 z9aQ|bAo^4k2e=G_nz>(bHQf?1H2oXV3l-8EiusCL2EfPyRjo@Jnroz9hCS&q_P^Pb z*8R?pG6?(ShDY5AVh0u4E{LxcL>a)L=(}Nbf>uCK>{_1V&l*5bx(bMj;P_QUoBb$PL*yktsg>aDIMN=X*0DAgcBXBU8T)fWvg z2x95PGorWqhG=_4>%?v>R{+3ogCMX@OmH^>D9=xDHw-Ay3U+=KbN?Grehzm2 z6tj?~(eEcgp){l4j3eLlL&3fd(hmmf#0I~YfxrIf0*O=?DH;*@;ePJ~`MND|xGlK5 zEkJhn;^;R+>NjKPyAd*V;Oo0Fc3Pozf-t(x5Ie2Fzns)NLFV0NP@Nz-fZKvLsIci} znQ1uX9=6$4fWS?F#|n?fikF8g4{ltPpfg1R@XIm(HpmZt=>+SfqG8!$LIEj4;zoF!QC_OR(Atv)YTZ9xur;36_=r zEzIC3$hfmEb)A<3;LXe7Elj_#E#X*|veK!sEooc*%{~Q*EH8{HPjRm-yp$K&mls`> zA7r0ev7TDNom$bIa+UFTbDx6rmKP|OofUq$A)Z=+pIVXqr}KdSa-%#2(Jwm-fOR69 z-@__FfP5jW@V++_fX$K#WufFVz|3nvaK(M=!3X2P0t0LYe>+CWcSX)efSH&0PtOVX zmJ{(UC*;dPtpqM%%FFY_*V7uWyP3dXc1Si0Si*3sAvb~Su|7A`N8cGzyJ8!x)oF)2H93auUCyvOAeTQh>wkD0l*XlTqFGAf$A#Gjh(tZ`Udo%}+^J_BwAO9n)Aic8(tlRYC||2*k$qNiNQSScm{iO-OW3&DC2Zoet7H}F*||82ZOpTNOTVZUgE*GZ5yTg1Qk3&i5?+@ zM&iMjaAM0i{PcAEsm3)?R*VmI3x{|Gyhem_4jroF;u{5G;HSER4u9q(KjG#hB`ozU za!H0~15Q&;@kv1JGm#}9fE|1^a0{W#G(1QGY0r_?$Hj}P@Mx=Du9pQl6;kTm9N z(mDl8nb)Zu!6ZZyB+h-oL{TG5+`8#%oVrO?cmh=_4oEas&(^1_Oz`Q*Hx?L=cs2(| zTnEb|3vyze7tvz7og%38Sm+Fh>aJiD^ktOQ0CSE--a3WezRLVAYKjhOiW+K)7HV;1 zl~fG0!j=meZqA)r`ppVuOQ&K4E5d2WDseP~k25_GH4!8=gt!hokSOAcRAq8#Gm%-EsV>>d`Y9tkS{MPvS`x^!UbL^@xSih*?we)CK^ z06&}gqA?Vi0P8&W=f;T}Pf+U#-xg;9bNWaUNg!;@z@U^)#ymECRB;y-8jPZhcHV5hv8xxUjcvxRHfuczHGGFZ$!@A4cT;_7_PS_$toN z@&**?D)80c=G`4``@vUW3@Fq9AMHMQ0L$)!ZHm^|l5*@RwWM$~xZ#vpXr>00G`^U$@~ zXUsn{5Nxw4@f%~2hjI~YM}GlF^QZC;aP&DujXU8L(wtFtT5&792RWp13n~CWHg>Ef zyN+}VxUvn@0+d0vMM$~gwKr?gBQgr#_n-OIV$k2(OL^f z>(=(lEnU48hJh_jrbei)WA2=;pQ-R-27A*s8Jqx=p_&U4mOYz1Wc;(ty=@M^2amI$ zD(wfiwP1TKef}onEt?WQkt=}P7iXvHm&n0mXGj1ARzsJ4@J?(0;MIv8$r*jW=L*A1 z?kPoeXY7s6peKWI_h~ZEY?U|jmfr)ymRq@9btc~EmbF}SNo4_rxJ|Vj%dgmDU88EV z9uo5}+`>9O87Gvfeu{8VRifsR`k{I~ElM|SY)>FwMdR*I4Vex3RtZ3*TK+HsbMaEp~m6p|V}9O=Mc&>D?4 zD>A4O=a^N0InJSi@q_>x9EmAawW;PWHo-SfdSn>J(|eQZnss`=1e{x@`&OoV*&CFG zb~U30wJ7xQekGz>4JUmsY{^Ut6uNk&z9A2g=X}wr;#+a6^qo|CQCq?~Qk4@uf=Nb7 zX;KWR8>i3MNz~S%-mg{#@m5(mK`AuEWrXn`k}(Gez=OF{r2Ykfxg#`0>^wDm#Abbb zze*nXPLvQy!3;dtCMIhM@NI>7cJhg#sfdI>_N!aoq460qD*65urNTK&wg(oe(z%hwErKq?M1fM zn;(F)?S`29Gmj^vPcs_l&)c0piLn$zj)J%A4=ZW4|LQ#2491XQ2%(4VVzAu#n&8}9 z6qz@Qg&O?={9^Q_n!7HR2~`vyDL4L+v?xZ%lk)hv$yJlgTCrSxjg)}~&7q6FlKZ}? zha@Zx-%A7j)ctf!WqoSy$n8pzGaA}L<# z!{+z?uql-94sw7p1k5HS>u2hg+~mG^S^FE%ya8ZbeH#w$T)HulAN@#}g%3iqacWVjDHTfyopPdHGn`=Ht}4o}(1350(G{_7C7=37{*})^&>S z0ClnGAkzY})?KGCcu`N08--uhg*MZ2tI%YUe+6Sk(qG2|ZzwdroZMU8Nix%X;&_4N{&v-hh4s2ONI5E=0lC5ii@4Bl&ghfbgz#w zg=@*zdTlc#oy|m8O>D)t$~GO!1a|^8FFrll*Z5={tHMn=VKL_<$!>MIxfxl%Xn6A+ zmLqE?H`PpD*7$7HP6oEPIO(3+*2N_`G4UwQJ3v7a)$LGum?UMl5`b-l7318{%40h( zQ!}?@Efpx`s9gAqoK_|+F*`f>_=K-mMDm#CQH`8C$yZuN#ZSdj#bYtG7+l&rwM5#- ziht3W>Q7iHQ)*a>p4Z_O*H*e5Fa;?ybTZ6bgM*7a4Xvr9*-f;U-oVitHdO`FD7ft) zc3H1y0;!{+U$Qb?6OdQ>XwRg0%$g69EQ4B14%SNbvFzd>nY*5?{<4EppN8F6kpt^8 zQM}n=HQE2?yIMG7Y@6@54nx$i6KJIl;1Yrg1xC=DSH zbl2fGJ&~dGY}i-(dwp%|n4PYwmB3m%iQM;hvjvZdnNGYpHzMyOn(WkPpFSoHkoHPr z-kqKs4=^}L$6y`f8fzH!%<`;zWA(2Rp0w6BrXK&( zXQBoE16lR%_V>A`cxFEU38XGuabdUfYI|(T!%$M4b^GnDINlnw;hXaV|7Fz1o&?y} zfHr64LPi}ynJivfUfo(|J$4z7nR51yr?^+?+IHb4gHO3f)?4Qp=Xb13ru)uO<(Ll5 z36U5^1?k4O13rsh{~T#|!NexyG*#7OQi-&omI;b>z1`+ah?usoYx5t`Iw6(_QOq8b zE+ZzF#_o*a0nxg3LQ}ebt8+Ol<9-mKfcC@blHJmyppp_f8s;WUgQ$=0K=d#Q>FCui zcI}fJ1)Pcq_l(0cJ{I3i`V205YZhr~nIvh0W=)9zP>OTGkk3I3=k7S={`aZznmtfB zgPHk;-eUx;9pOHc6kOZNN(+&8--nWqzW&2-lFwsy^~XZyBc$yry_KP9j~{RluvMq+ zae>=uy$vo8muF+^<1M@devq8|3jGK0Iq=otzW2VeiZRD!MO`#cvFoH1N5+*^cO-1( zX?O#d34eU#O(uzijD6~JZ5=5l@6f-58|^LRM$TawYNw{*37d$WZ~;H!z37H4W;Q-I z)jy(WpkcnYEFdfsw@+NSn;i`rY4|VEx zbS<8npn8DO8SMAf@dj2HqZzS4G(XVDc}2|DF0W)o3x0N7<|+nn+60d{Vwi?zo~K!$ zrto6HW^mFnildyrV#OvyguCxLD^-zOfQ#)OOp`2V8p-|w;bsi4+z_>(xadoy%+jw69&|Oh#eCR6IvKE?AZHGxg$9zjF+2Ktpn)# zxw?l19XQj(N0Z#cWK(L=kel6thRujC`;*r2vQYJKw?KL82*BMxnT zK6s5|^s2apnluZPu7ML~trOhb^k>amsORok8>V-<6%?G{n2J!*!N`h;*pDSb+NHW)Ya%JN76M9CZiR9Tdn{^qE1B(EEf z-MP#f8*Y`>@qY9r9F9r9;>EePr+8ZQ9B7FSFB2s%OlxDqIs``Vf97Umj25ACU9wXK z@1#qpw#z$wMe+Z}rMUg~F=$S!+arXvzGjj?lgQI0z&jwds+X6Vm)CGyk}Cq4KYkR_ zGhk(Tc!-u%Tp#_CGHIM;Ej~N|*E!9ke4YniQ)^uA;kv9PU{Y54h=E=-mrAgQoEyN$ zgs_acdpllK{P^l5m2D^y6218EpNh+>U82ljEP4gS6TIOBz3LC*UAoH;FHYfc{nv6WYvVdS|CFOygLre@JQ5i*uAer^=Cxfl zs_E@m=yIuo}vSlGU=M)`@hfh-^Jh~B-0?6x;WrCcjC;+6J zhk<=#ugUp%dRKj#DHw=#u(*@t?Pgy{!|y7duu>!~SKOxFLXqvAF-Jj-(}Ok^7(*7$ z*;PL`Gm-PK^U(9~nQZQMGA>1um{iA`URfr}LDh2mkyDfCKc>Yqh7V(&%t(1Dsgl|e za5BPK2i0b?dr{Cbrt~@&{*K>=?EqS-E$D}w-OX@@?}A7Gsj@7xWEE-IcDpnP1b0|% zt)1uE;vT=?`E~G=C=q(QT6@ie$F8keu3ihz-+V#^&ybkHK8Vz780meCc9$y)@3&2Q zse5tLSZmETH$1j0K5o{23n~9WbHw;FYK5;>Y%75Vt*R(npWbZVcBIGsssm`GbXI?4 zFY?%MFCFn@&87McAMYGVBG9E3{*fZ2+Gx(d9?D_U;~dc5+5WdZw!N0ie*3N&MMrEQ ztF`N*WP)j40=<8-K=ESBy7`$vU>`0at~E~kky?;0kqq%JS@kGLK4GZ6f6sa81+4=< zPH-UiYUWPGzOajW>ayW4=>Q<_t8Y0c1(tNkO$YgYr zgSWL%q=(zv9>@^!5eka(@Sgfu$V4gix90{eyXa^AC?l!5k+wd)#w*gMLd%#!>*qFw z#-_$?vKW>nTLy|;dN?FLZOo!AAY%L3_RQtXC0Ls9A~ZfAmh&`1`fAzZ6w)u8UbXNJ zL)Y0q*Mx4?RF)F%rCB**$|dz#COPpnF%>nYgj_7qBT=pmkJxUDYWR&_m)|de0S&!u9BY#7lC~{9;~iMy16ZWIXDV)?qO>UZh2{B;QKw zmz&Zf7zi!E{Oo>oWe37sCq@tRUhFzdtUL|=Qzoj{n}kDPGTYB1FpACo!I}GS=&CZ` zWMr6=VSwRB%8N4C*05v@#>EuT&A|yN)HEX~i$7_vZ^C&gV_No3rLiI|M_^(jjqD+8 z(}&_Q?Gd?fT7m-Hpcb)tBLbX|LZ$vMoB&9vR^Vp?{oX(83E{~szhUXeSdm)L?5}0b z5go*0bGWXj(4|g`Cy+6<&b7;FYZ|`KoSlzJ+O1w%aEu|}l zqFO}AtT+B%;T+!PywcGTjwJ-+JfjB2?n_m4(x## zeEVkRp){;y$r&h<(^1rObq}Ri0w~X#vNVl}yWT-{aglJCi;n9$I6MRfQh<^dQ+$cr zhwFm7IYiPZP@5eJ1C9W`fmlnxHSXq*a0h25{AV#~jp#`I1{wzn*#+A^eHo0@sL~Bg z=Ybs*PCX*`p%g9CWcJ2Mp^tZtKl)z-G+MXNeGV0R&w3@x6ixiw4a!)XCZOfq9u?S< z1VmnFG6W`&iQP|f`x;I@L;w!7d4qYsQlMkQ%s=NSh!{)Xu>|6Q*4`Lt4-rjQ|ALG* z7%ebkU$VnSdX$EV=xWZQ9B{k*w+V1Oysn;h)bH1yHCYT0@b7XTNB>$RW2|CwU>YPf zv?{^X`TI6_$c&Qz5gOIqrB;=&*?YZdd-mu0xD13I6VR%aO-`j|k_LnoA1qo+S22Yn zs!5-ffG;lm)-YjeQS+JnmkMvLmeI#owEbo@>bINs%(ffNkJB}kN8~YHHK7Fmw;z?M z!A$1zMsN&#ku@aq%Ocvj;UFYhFQ}kV_{OVeogkNxf+OQL?;ovk-^(wcd!G?WI%pM+ zGG)XNvjyqKhG^QjWC4IzhOHGw*;2=;9>CUob^Rfw^z(7z7CUb zkl>-EO0y-at0M&#wz!husiq_B57MWstL=oGS)M(C%6qVOn@}xPT~5ZCGR(i8i41m! z(*-8VJQIMB$(cC*jJxfHsDjB2?EciOTkED3Rmm|b5`n|Tv;Z3Cn*bB*!ewfGieJ)g zvPd$DQhiCgsR9YJQVkL`M|wino#Zkqqg<8_8GYFS4e-&fP?hgT@X_W**(?pChO_-z zP@^i=&zl$zZUw*$PbGf<+slZEvNk_=TjDg*>{wCjWGxbP<-tb^b26^h{ zQwM1uM(e9B+L4?`A@1bER{cAjErBcB_isxwr_EqkS7V_yqf;Tkd8MkBUq6xiA?fTT6!Yk z%dkk$EQ!~qW5(-9H%nB4RZBLNt0rJma2e`5Kz)cGE-!~Gb0d9cvgClbG=A^xPZ4z( zQvBkfvh^+t3#DM4-E&Aoo}(rD(@w8%0XPKOx0|wk11YW&a=L{`g9u|uVVUg5Eh!)o zV$i*@2N5$ch!{IvBYY{A8aF-?6a_*c0|pp8J9rw&)~Vl5>qk1hbEsh#I29`v=BA?q z1YK`36t9-(UKRY>dL@ZU+PVg3y>>z(5?$o1_nHUA@uK{M_o8{YvwQbOjljZk>v90;c zmix%BeQgF5IKLxk%5BcvgsY|R?$~=AOK8G0E1T54ieako0|xuCrpZfu--^bd}}m-Ya?D4pL#*B6Vo+Sz#O?%m)r{QV~m z6FtETg4_hRN~L0+*&W6*di;0yan{Ot!+x_fCb)xscz|$tZ%wg|J*-9*15QX9dZNg2 zxd@2?hvm=giO8#g%NY_AMnSAPqL$<^*d-54N@Oafw;WPvxbgBYC=ZuEVQf^uOU2ROHp$Mbn=~fFBT86F+R9`qrRE zHIt(emwROsBaYrT`_oN6u3zt@1Nw_6^6r217C`r{fHIjoUP{bB2Hq4nNqM{yu8%nh zV;gQC^U{xOHUz{UdfQR(2- zJBL3fpPO}e383+6HcNBuW93nZy%WReG~ZCoSeFSXK7_|PYLu-v+Xd*?G$8*NBbVjuc*v3cVC_3H2S>-z_60?VXBe&<+H4jDIjjY{kHa$yUTKU?fzab^YVn-n>^-kq6K+Ot%HLs zcJW>i8GtvG{JEb}*kn!eoIKhTk3#@+fB1)X5)r$ zOTtQ6oP%#U*6?E2kI7Y=gUe7dAH)&+osSL606@NmlDxTjcM;q}rWHPvtrk9HQqGFF zHMGGMZx+2S3NE%AZteVu1-(J?Dwc;c7J)KB9+*1w@Ej9mKT3gxj{^yjghTbnBrE8JG^KH>EWPfPF!R;zvJ_*pw z2x$61qz~@%qCAPC`Vnz@sLMkji=Ho-N^R5y>5~NJHV^Z5;W`wf*T?lVJFnl+_14Rs zc3P*9yP(afZ)LV47XaUhTjQ6C-FO5Zy&6`SRjE54sN9xs9}ZA>E9|EEP}&3TzF#o? zl-!JCu4~OZeIs`3jk^@RS|l`TCib4|1rP$pPcLpI3nN5e*gvFNYmiwoFAD`1^@ovY zTyAL3m&itnO%@hKPgYJ4PHIjXn)$OrPx2~*6%bTyso~T^Qu#3tfe$C>Y1xXCH+I?K zn!xr;$0fh!)zw2d^wzck4*o>yar+I9!Wxvu@DT_S1p)`j?5)HcDPKp5iRDE%N(4UoS^q|~tWNwk>MJEGCt zhGC=b`4!XaE?7FNSFPn#(ZTsMh-=gPC!Xs+JFjLBU$z$J6kH<6&1Y%*?&_Gh)Rvp1 z@eEcDy7M&>3A-O(T>USj9*(iiy9a^{Dyo74;xV4CUh{uKAFEx%BQWR95B(yEf8a4GrBRos${s_M1DV zNl9x(Y{oY!EMX%+ne8>nmvF(ap*Gt;?!@Ne!8VZ%8yr6_nIMjhfCvE+r4SPywDY4&^2{435)}i$X?~J<`bns ze*>f001j|mjmhDsu@h;^>BYsnnA~hWJ4Oc$U-I+Fj#igZ&nz?`yEFi{RA4WGJMUL- zkex?*cD%Isn-N3^=ut-c9{`O&a=+^>Xl+y&oz*#W&4%=#&a>0C{!O3`y&Bt6Xl~|+ z#-x>uD#i+cD3t6i!1we10NTMg3XnOHAa#$oK)#>TZ#1U9cLLe)y(rZJVLWH?jKit@ zDISavPKVR(BuK(-Y7AxORTtSMR%t zSkRr$bV0N^O+5WK_syTv+(Rrko$GWrvUFEYzF~dXvJ*6ePS~dxTWm0wfwm5@Bi5m{ zXeq6=Fa3G?OEhVVcq4xgIiI(`5c#eBr2Tw{6Mz}NvoSk@G{AXsEuB#SH#fuPmd=8k z$BQW|MG7o6Oc6R&p$JM@-3o_VVQXu%pr_jk!qq&hNRDQzQh)`;>S_R0V);I0breSH zZdx>0@@>ggi7Ry8fp!tu5pm=k7Du2<+iylimQ0MBa55vX_~=H%E21V3?@h1LC^L3QnIRC$41rLy_$A0K<4Wv%m?6xUN;n!a3P;OI z(PZ8u8siMMXQ87Wxvnb-i;+@-GfFx-E%K6smp<`p=y(GWzf4xI$E(!6{rQg;M zy&OZ6dgiw4zPx{`E7Z1p@VS9pbMvn2Z~udk&veHddNM)P$9e-#Y^|-rbb$^2zGPFF zSGwB(G5PM~nDs#$2PDt}x9NEsL6Vf)vfp{c`KI$Pq*W$Zw;X5HED>>M;}P{;_1%__ z>>ouY;|*~XNmcQ0Pcm9ur(6X*@>8xtNVi5qdK0BOKY@P+4yNv}F(V|>5NT*)DiA`e z1fq)7!B9;K<&x2a3c$hQ+0-4w4*PBgJmG*2{N5a;IfAVqL05_8y5KVi-Ybt8D|>d_fB$!ET&phm8AO%kAOOA6d3$MkGC*S5z38&(3CqEQEj8RU3j1e9D)!eoG)!u8GK6Kk% zZpaVtOOh-3KM2R;?+S0n9l=0@8`$igKuB~qup}FTp(<4NMZvAjbd~taK2~XVkX1OS zlZ1a=RH82XQVH)Tf#QgCLL!ExqY@zn(;h6$BPs-HM9rxqs#OiN{`yOG`sDahwzjdH zT5{6hl}wyuPqO1>Byz|vHSI72i0iBqMFl9-kf=e~1$%t7R!0|*LvVrdRsU(H2_*(s z8z3&plZj+&sg!96d;OVDedX)Bo_fCWsoZ~+v6jB_-L>Tsjv&q2KRIT7+myc%JxjTqw9RWdOGDNrd*uk* z5^-g{*+``2ck1t2u=H^gk&og`1j$=3(}-N25p zW9(^ml64+J?psYqML9K^HY!z9N5$;Ei~rF`FXDG3XUPPQL0<0IZdPF}c2?DPJ?G z%+|ixfUXUmS@_7ZH*2S0(<{S|F2?c|GsNrb|77Dn{2`L2w&oV-`uS0)=JS)KbY_Nh z5n%4*nDu(gP7nrh_?S*r`Ks`2=;tA8141hY8l}QoV!iNl`)l@N!m+@c_P2k8w*vn| zoU{KA|B>)#`GXkKVP9k?_;tcM|MkJ^M>~ zfD9M{F9FLW;+46X0svM;$J~E96dO`RhgD%+Qk7V<2i)vJp}5#W4fl&x)F0N}v3TKx z3%Y`8{AO4s*64yqj}>Llh==g#4NSokNDQnuv@+VBPhy&1Dz(I9wc~s(MDRGo!!MAVy%E3W)HD1 zu~s%vs6zOIx{6ONIeU`r9XIKpOHQ7|S_JV|MtfOgbdPJ}<5PAri?mE{J_j};8q>$a zJME?eKAl10^_mYQu7>exQpByFMeS!_ICRCB*46A$H+}Y+C9oG0B@Wf-x+@0%gxaN> ze;{|YW_uigzVv@moN_~exwXr!Ke2olWsbo6^b(yU@`S_fb1QtFpUYR}s`790zbPLi zKghe-kerBwvWW-XXXOu-za&3QolT$1yOKz&=j#?$vO>8~#HFG)P_BYsk2Qz%Y&d2J zc^E>%Vzt>FPLi4d7Yja>7sOyTEVeSuO3VRnC7?a4gk66Ot=eF5E+Ts4n<%j&^B=GR2t8z zGR}=MV7-anlZbn#^`6uWAP;ZJe>H_o%^yUXA6%sQTQX9#CE6;3jMOTFl+rB2w4A+A z^XKxR#(aM$8?)vb)ffx~XK8*q-jqx<$81e;H3k#Fyf#Da7u%=&C%ZjXUl?s2#hKf{ ztVEVe&R|{t=^x(o7CQLjRoBhGZ}2y@Q!x0OrT1w&Z@h6Q`fnNP!$c)<{dfKjss3x0 zu5E3FzF++s`qH(5(I=lA-T1^4$X5>nVEw+016_aMJv}f+Lc3kGC+!yGs}hE}?DP8r z2Z`6FqjK2&&E|6Xi#Bq@0j5aOIn%;6{4OJmH~lieWWVHd=41Cs16?3eg-`1YJQr51 zj^?H&j$^5SAFT@3IYhz{au-?;WUw13=p>!XRq{~I!+fALbge03({e$leXt}_Wc=m7R zuUk2Us9tXmYI*-syc^rN+F~_v$zwOwHcfHGSP1`iD3U6!s8wd1GfZDp5D)ys_dZg4@LIvyeTHmE0oKo__*aH8$?}@!D+@b7m_w0KozPtdD=# zIFPr!u73x3uJnA?bEBu?x!bon{j>B7*_S=P^Zk4Jc>cdUZ|9lsW_NoI`u3#{W`FAW znfC>s)9QKD_dt4w=W*|MeNUtvS9?Z0TfyDYt@*Ee?5ro1@6N9VS9n%MSLYokJn!Vs zc`RhqtK^i9=+(;R=nK*JqVL4s&ryFuY+H-~iZyqca)Yor|3d8FaxW|A6cQ+p36Dh| z&i#vUFm@pKlHiP@2=JmJf&=yp8Z4nfJktG_E-46CTvp^6K<8!9n9qWQ=e)<^K^8-5 zUIBq%dxw{y{_vi~MSObx5E>5X9hViOkwwLbGAA-$S(+PGR_C^cwl;1JZ;%lsaGSU$!a3zBN_Rzf2dIlFtO(-@!|6Lv*3bK- zfsDSW$Yvs$9hu#kGZ`DmjAe)n`nu7%#jy;`WO5tC?c$hd*&*&0$HWt&RTj63yTnP+ zil9KfQ7wu(Srk!pTGUHLu@ZkMin_}^cZDbla~jM~SO4VoPaVd*HxJ%*ICA=)ne`7w zO9Ki3`uw2+3hg71MkhUj;PD8tXcUb~`J9l?=b}nZZ$wonP;*J3=+47{aFcLT&f)?2 zsG!6$xjfZw9A|QQ5(aXIAgY@7Ajred000EyfqgvhF}5$7B9T1-$Tfck2i*ujlP0GL z^*ZHdH8Ri^je7D2iN62<-`4}4h@`9y#HHBU+<&CVwFI@66HxSCI0)YX9^y%z;{gYP z_JF;GN>Pv^sFx4G-vd9&Ju&{yo=o8+l<{%&pPe|%m9h{Svk3mjeorrZiakI69zgad z0F*7P zv)9=RkcwSd5AX{}Z-tB{Y()2`lFt=nK{SY3Ua#}Ln1D$QqkWp7GXYIN?5##5228-{ zX&*AA@mMm)VRIZd$4%zA$sDWZST)B-o<;8$1nQfpL6JvW=>M5AP5kO(c1*+BpZ{pkp`Fp#CGCQy-`ZH6rq1(Zcw3G6zk2DW3IheC?pbIs)1&z z#PVl+qTW`-@NEcfRZ@4Mj_X?2;QAfgL@O^=;TfHiB63b9WHi$nkKU&hdh|JS3q6&2h~j+7;zCd5Qp9c^zP!+*f4W@g3Cz<> zfW!Pl^sdFrR_xu-1A7h-H877oTV9Fxit{MD)KK})s7SM@IM5h2aQ22(X+wpmx(QvT zR`z247|M%!Mnq4*KbKDoYa)7}h#n}SZzzB2_57&RO8geR6TMSrx`s?i4x^@}1@jl9 z@`c-p?F)7{eP+IqxP){@xxUjljGYF~*lEl}NP~;v4?7zg6YfNal)@k^IUNC)FAT%Z zVA$es2!H;PpqoH5BLDZrZv{9iZsxy3l9yJ;ct?>Qk#|I`&&0!Fjp-F#a zb|8|25W?dGjd;4^DHJv7;6rvK5>_NiieMN9GXrHzZO z();@dpO40(;Y1N1#$xe>dHt^n@Bkv1AxfF$-tK&&wY4?XH~iIF5%I=|E!j99SWx?% zF~}s+^NeG|-bP0Nf_B6Xw(JB&*rtECBd748uw{%KlL>N4AIx1rV(B+@1NIo}5f&6; znRfM5%n40rGTDnf#=0>{Ixo6p7;{MCXSt20aAz~7rrjeANXTjA;JJ`ubrkJMRb^R* z@`*@rounQvVxx->6ixS$At4#;lz@!QwM?dxg>n{V10Azn$X<*fOlf9gd5(XdH87s~ z3WW8Qx6%x;LRbdoJkOY6a|%D+x15^Vhq|^5?Z5tVG;MhP;@PVf-LS0gSmyjg#)K}& z9={uTL1Np zPuO;nPrAO_@D$@%M_gmSn!16$o?k241;yOPkL~uC)tl&A~9FTyIxZ+va znRAXfEzSePIS@t^EA+o!p`lzZDE|y;N)UhY+XV!H#?5+R zR?(<;S4YNgyQ4O7-@TJy^WRV2b1$^q`Kv{r`Sv{rfB3b#e+Zws=?{0@{>B$?8~^)z z-u?3DE*sf%j20Wo>HcDeNd%TAzz0z9T?C*-ryiROv)+1%NJ-5#P;V!v`kIoAAI z`mN?uX}cU^)oduDTKRu8!oYB%0E#k7dN>u*+v2UxPvqE{348yq9J?SYMg=yy>n*d(W9SWw#PaM_GlWGBrfqBWJpZa&$wCnz7haM$_`S-1UWL4j;+rRq1Mr*sVFs3sl3$7!$ zFrTaaXZ6K9zmS3dkh*K--wq8dd+bpF!FmAjYHNnKJR5=VVLRlp0hS0BDRz)0cCouS zLe{M_*i5!*Py7N@eKsS>dNJz=>&uH+4*_Yw-QeW8NIHL8;Pg3*3Y@Ma3LG88+gGj) zZ>Ok$0_yh*fdXu%T~!#?6&itZ_F#Yl&WJPT9Cog8jyUbxoX{CeK>#=&tvD_UFd=!VO6q%+ zS&%%YuUPJ_l=}zU3ax#Yu3uk!@dD5aK=9Dyn6=lk6D%Trq8CZtUJUSJ@tWM`+=IEt zGy5{nXI>?LOTC&uMZTFo>pq|5DCn>`NJmFgt|NcDsCi-5iPBm15k#*>9BT?N&>8Cl z{ml!3Jqu#-rebzscF~snL-`NDB>Z!X;%zRAo6Nd%K9}GQ`{h6|$9Lc5x+nMVuHR+p zQ>Fjt{vd0K_+T#Xv$SX26tJcoaYb|oazrMQYb)eX<3^banYIFD_HHB1jWRlXwWDNQ z?I?fYt9yqpD^O;SuMZ9x*9V7;XD>p}K4^3&bl1FMF5{-GNwA>Xd=J#?WH4Fi?zOln zs!FWa7vwTRE|;+=oep`yrUj=LSeOMv3kZ1uT%gAig#~&?alxy7eZ6*{9!eK{x3J2H zaze2HMN0yY27#0u?!ONO?Z0YOwYf*m)xm*Y5qJU&`JnL-)N*pAl5x6qjsD!+%9GGF3n zXVf8Un=_~YystEhSvY91261NpJk%^i%>vZSM@`gBn~$4)#OxI#*507ykeQ7MOQe5~ z*0ND1fGD|dOaU7P)`0tZPF)1+Oo~Hq$Z3mEvk)~4X4K-lz_o`6CPKkTb&3Xr{?%!q z$(dx*DK4o|4#O-LOG;R^$6Lya`84YtkmW70SH=H!_5p!L_F6?}hBz^PQ>9$ij| zKv5Hku$??-Q#jX100sg=y15ySxKFqVH~wk6i|$}15jPxpH7t37fKc#ZVU2$ugue4--Q1XNTG!eYIsTyL+j%PwXAJ5}aNS;QnS18oT^*@q*CC-FAQ@*cu! zQLQ`-1Hxkq1G7XQXIAo^jsUC03qpv~al=BWW&OAAY7aN{MDn$<&mB61_0%BNO1GI2 z!>i|dm3hJ5R8u%R^u#Ujd31mA0J?U-#M-6FG3z6idqFdF>QO36do&V(R1_Vg*HP;t z=Oeaex{LmbItGt1Z!z|I_1}wXZyJd4^u9FP#E&-UqVC1?NZzDGBAO)Qp1EbcRu5Gu zQgguWpcG{4Q{*{Gal4$+sDi@y3>bmC;0b6!gsosod5$1K5QLC%&vAbh9?B>iuw}M! ze+t_=2I(K*;E>kKPwzbYNZrMl)s}EU%X;}qgPwtw_B29eFdyq zQE>8E7hO0CAn(B%lq7%Wu82lZ3(?qzj#xa_$r**1FYu~JXc!YpGz#iJE}A708g?m~ zy&oCpr=N0BV&*<+00NAsyEsI?qOi0ki@E41)^T4Qzj)O6=Gh+qBi63ZU5w zPLzZGadx~s9t_|^qlN@_&-l_7rvYYfac2A`ls&_m0CmH4%2`8T1+FTFAy=A_G^iuT zUH7HUQ@*su`cWz!YB-byT=!9?H6*}h$1|Y9kQ%P6>`NQH(1iOb3;>oB9-G-$xF^4#0SREya z0dVpo0Ia{U+zV98pYf;0S|ye@xG>0Vs`Xx9Z5DN+EH#v-T$ zi-I03dh{S>aPM8Ty1<*g7k&9|JjOj92aK_PM__dUQF$tS#e6G=3|OA^t_H*Wuy;E^ zpPOtU5{VMgkr*HrCjN%IO#G_nUg0J93*rU-Up>DRj(C5TIIMmECpm$Hc7jaU)c}+T zE+MKtuw8#0g!9!a;f;_!3dcN0g)yX5qu!zieF0T(EF#PH*~X$M1-c7db@GpU1KlXU z<&QcU=q?cGEE1}HBsF&hhwKw{fVG_8tf$9v9Dk5_V#>;{S5Jy34iS%E?DX-b*M}ml zk54_xV7;N8)O@LZ(m*_sK&B7n6$P(X6o9H$iQ|7d=@kU8SFoUJdFyqG=LDYTJOCBK zJFYh&nd3e2M3bO;Eh4ZGNe>S#9N>Z1q6)yndI*n)AcZQtUS}mK9HuDJt|k%$0V(ky z@jBp$*L6h)!(ar9+zD_7IFJvIBybzpjc%vdl>GGp_%+~91#p?_^2w9+d{8qh6jw_f z?ZtnQCEi!U5FYNfOx3nSa%q&fGecc7d8wOh<@6q zdHf9=s*?B%on$1<(=k;uG40bl(X`Ki962)?CxJwl_iKco_s=kNR-zQFjia+H9$?^r zUL#b*n;|3o*=Uc(n>`*kaK^ZSGsZ%bF&2NCj4{ghFncT`Y4i2cK4Z)Tj4=~19`6Yl zkN22k-fxU~KOXOKmC*19t_v+o(^A`51{KeOCJuYd<7xNQ)s9(X-4Y|N`-h)= zzpJDT9val*p`oRl_E&~4_2;y~pA2f99Z&rj-dfvC9I}*BxB_6rUwaNNsqKXeOx}M& zbICd}2kliU0IWML_kt4fcLxAB`IgSjD>4zSXz@#GA%vRF>f~F$$%$uEoqM<{sun=4Y)oc~~okbqx#b9<5la zPVUxATCwC@R&)TT)Ct$ox6rohMjgzSRy}m*=n+6`Jdxkv~&koOSkImy@n{}_R(A*4Cu*9~eU^>jmG+UCwX_G`*AkA-$K~mwGP!OZs{CUsErp-CRmaE2&JnJ=L3@ zm%2244}B-QIdym1eI>n$y)v~beGPp*drj*4^ds~`Eajv9tdI(&2kC{ZJ?&gvOy?FA zS!Z{Vbr1zGYJ)#U0s)WJ&KbgxjdxOa-sx^jW)bVUWP$Ee)>2ElRBG)>T)QsWo-?Ea%SP>T z>r<9{LE7Tg@0`o52Y-LdY-X$sqAmi|Tp7Me+RWS~JrK4r6?F2!bX$R`ph6E1MiYe* z<{QjEF$cgt<_Kd)WwN)>57IxEY+0D0o7o4$-;^Gg_J>~tN5ZEhir)@kgvm2=m}Sg* zW*7Ju<}^6XkTIsnYyz8@`&XgPFPY^uPUAI?CTQLv z&ye68;)eJk?`m!}zuL1}SnYL&BWUwvk&W7bju?gp0H)Kdk>>^-rmadd7nrJUi1M$H zxf+&c)>mV7hDd*?W|fIqAnHX9$TLP+3gewD(={e8s8T{t)nK#Kql{8`h7XgL!Yo5W zheKu4=_>Jios`0YB!y{)L8CB$0$^AG&BpJvq$(_vQ=bowBC8c4*$IvZwdp9VJo z0&LmAK&D0`N5(Z0hHQ9K_(a$et`ZOJ-vl9m5dIK81~Pv@gRdFcpQGdD(TTv>vVXjM zlEt^-FwI@xw7qL=sF>MdmRoROW`?nO8UQ=0{r}cppNv=(zcqUtr$Tl7pA|wH8)ZuL z%$okFnty7vY?L%*usJMiV377`Oa(P{qZynGFdBm!lUTu^8wm&@jnQZ9RYrOP7Tb-f z6xf)6>db%OzQ+@tDWDhDu7zi7-)bvpgU=0W+WbGAnX74oKN-+EinW#{Xx~Cr+O)x6 zI*6*htH}uO*P7vLhIQOrvVQbgW9v#A6~ul3fHiHo7l?4J9>0cqpCY_eNF-jNPEo{M z*8=efc)?{o4&HGQyhytn5Iyt_J?d&GxX?X8l0bi@Vy?@mc#Z06;|-D9Uq-M(X4+X&ECS8Srh|I#toTmmNP_#@yH5@l)7PJ2lbE zmr8B0Zj||r#W8JFF@ol*p!vi$iP2-;iVK&Ztn+_e6_P>WU0jt3|1hX<28Evi4Q?K?Zymm!`96}R;V2=@Vh76|l(5M&Vv3YZWA35b9Lh6paWfeS8xf;i4NqQcCm zGm1zPP#aK*BaS*6#g%b%26b>ZiViwDlHAw2-C@(2&-47=e}13$o!jYCr%s)^_g0;% zQ|Fwj1`q%`tOUc7$!C>S{_O92&H~8q0d!0sGpVJrXHp^H*8uvT&t2SqxkP9bt_7$D zz=LxyTIPEof1U}*PXSqL&s{Qq@yy?J<^x%u0qQ@^?_9bB5oiG%1t88}wEWzKD~Hbl zD(?h39Si1lo^!0k#Yv3l??F?VR=d zaeoEqP5@6V?!07)N~Ozx21qUd-}#-3=ShE>@em-q4KQ&@*V1K!g_s7AC@)`f!Mr8g zdaW}7%NQX0DF6%_Py|6_84SEHX0dBA9_yh7g@`h=0_>CQryziWLAeG4m76t(^6*^}_d> z2mtM|I|xD_Sq~L7sykFw0CA^N)`@eeL8YQuOiQVX3WCzA6RxR~8hw!9!&c$L!7KS2 z()ki^une#{!Uo}SG00rELIU8Cxv|1kc;Y&5@T znPsiAR@uJeAA8S|{mj}KGA@pMS!SI8H7Z&vu zcb8N}ieq`Dsj@H2Z{ni^^M@KD^c`=M(1$($uE9bd-V^$;Ug#qcp%1%-KGK(=zc2LR zkkE%MLLZ*W(DwbfKI!|Z`)2s{LLbf+`mjRi!`(t3T7*7q`r+MH3Vrw)f5r*CoMsdH zP%89cfzXG49T_^WvrFj1I-w6|WoV%j>b?FSp1)q`LoCyVD>KhHAoSsiAL>mL`tW#$ zZ!hm7p$}%E4~u?y?^}4iOxYH^gbirJaMWQQZbLtSEX?4eSWn6A*4Vj;S4K76P_ zDe4i&BqiU4Wmt|Sn1^Af+{KrJhGLwFd67=ruiRrUewN{#fG#XhdVL%qdurQ5~( zVxiKOMgR7F&QQkP=WieN2?~ueUR^-Gf7vg-J zlabT1V=@_!sY>rGRO+3t^zU$`{yc?a9u{Mc(%a`K(3g3mAzq(CU#g4~u7#H!8*xMJ z;N{EEiG^5%r6`peTc%Bw5+g@63?EisR~xUcs;nq4D~&}XCB;RB;ZQJ8;P-hwZkN-4 zVYgW=W|PsN7j^l0xjETdO_o|EFiH?@3XJXWCBq#_AsiStF2?hLPG2(Ic>Fe|* z$DYiS^mQm~zLPnnPG9oeQ#hqGr*w>yh`t6i#G<~YfG^oMCg4kv8BUz2UY7+;cqboiQ*V=r2;x~XGKEK0WLWH$yH=ViyD*q)u! z7--CiMUk`ymTV{1kwihLwQ1OP3Qb-t+LUwz#xy1Efie6Ik}TBJc}}u4DSTt#9Y`Ol#QYTy8WLxOt+10DB_a!$^X*sdf&tYq;Ef$SM zlQcB8WA)gi)VX$CEIRQl-^`XIUDeu>B&%9uQ6Fy!Z&kW|^8!tr(s7>#477HRacwtY^_k0e*d?F+r3LymOzq*>NuEJht+fIoPK__ zl2~+N@|-CxO$(FS#*WqEFiz+7ld6yy@U8wDNzxJM|LkN+XNIBh)bHm4UXzkA zCl>W5S59e3=Y5#t?15AkX-(1&UeY^MVxGoJRt}XMtKJdt$D%tG)5x6Egpd8{M2oR$ z!LTH;{DGFwZ1tv~^nbG2FTHTT9+lf<8%B9Qej+JGwq_MGuIcWx?PNtM54UIF8 zG4o7IZc+#(g^*eq)aRtKG*epA6yh736g$SHVQaSE|39phk`MD*N^-nf<~5VUA}8mE zpOio8^>SCUiBpq8m`h#&)b;JvQJQySig_XG&gwIVa!~1FLtjFbl6< z($p~|(UiPY7OP(m9!Mz?Mc zk{hP9?D7GULZzI_i9F-u8B8P-&uriQ_?;WQxL| zjZ>2(ki0B#iGMq2WAcK)as^qP^!aAC`2GImTvzMr)xOof)q#|Vxzk(HFe!wSq>V%6 zPr2dt8U$RePJb&`^2wERd^1~C&s;qt;1BqdZddE-G|A6@v-z%8vpt zdbD63R^U-QPa*<@4j6DIrr}!Lj$L>HFX7L4pAe#dBSmB-d6m4T!oa@4ee!sDj@*SN zoPlPnBs$_IAu@{2U^CcOc3|M|gYU>5=rI)+;SyYiby$xrIDj|t7GX4-PNmb>RyZ*N zGcX6Y;8xs?`|%tO5)G*)!-zz#BM;Jx1U9e_3#sPeZ zLBfcCokYkqGLu|ER*{>@&&j>yLGlp!l&a{T8Dm!oe-u6)d_&Hb?~w0@6Hd5(upo;O zMIBDZV)Wq?QbbBflqAS2G(w|{2)P4;gH`fr@(THB`2YeaL>)$844Nvk`1Pdrq(mw-25%xOnjP!5wn7JP8C0D%eqtY79dIrlA!}aW!s# z!Ef;ZwqOTdz#I6S*ocRelksFaX(1hC0qG)3NH@8RTuxSz`^iqShrB`FBA-)%s;QYq zXoSwCSJPYRPP&i2K@Tyovser3W|y&B*-o~feI$rNR45lF2_3?6;ZhY;Ol{G;aMXHq z@xYvcI|iN_EFBy(__M(^gHH~=G5DT;oFng*--jCIXh19GV=1n{3S5Vqu?hF%0la~C z@gY9Nm-q@_6GpVeK|I8($gPo#CzHr@ayDrt=aO^D0&*U?kgOzINDq08^pYpZbL4sQ z3VEA+K?ya}Qd&xf(-CwUJ(pfh@1R>~lD}~eGKn1fO98e?Y*VU~+! zKg>7K8T2~Zf&0i~_@0g8D+GK2J!W@;f%lHv4b1jq~`l70lpc+}%f zOu{a5HtK|T*jhS)zJ+=$!mZ><_5$65MRX7O4ZcDh2FV4ancT@La3$$~##GefJo{WI|Zk7FmvsL+nZ{t$DiE(&~ticY9!(WJn%py|+nNAdBc{;Yx zZNl5KmE;mXUY5(r_`!!s0}0AL(k5~DE&<8eBgF|fpc&!&PO*c!CiO|+aX~hrePN5 z;9Q)CZY;%@kr)UYe+%&!{DnQkBr+YZ2{#HWa2A4?LX235S~S3mwOA{^iWw+|ljuk_ zR`78ze=5Hr|9;>l+=u(H0UOk#@u|8IMVL&!5gbId8&l<8*4s0!N=mWbo?%L|BR^QV zlBYR&O4_5XN{lLFy;#C}v5ocOCDsc8vso`zWGD3Mf1tFn0cETK3D$tgtO2uG1A18l_Ok|Lu?E%vAB&@$#UZgcnpqqjEDjZPEQ&G~ z#X1%RV^J1E5MJh|Yhi+y`7)`Ou7L+$=AmnPJYH#(mhMC|-H8sm6HDk$tfV`8R0iEB z6I}z&TSnJlGF^k&bPZPgK-=^KZ5v$!4HD@Re<_D1Xo5|qlbIl;Sn-aAhDs%^s!69V zcRI~=RO&`uz>2Yg6=M@C27`_jql^_JaV+O$#h}>63bB_J;w4sygRD^L@Ip-fAvc>9 zVjU~QCRV6$sTIC2SRrIq2!^g7uob89sFd2?A97_U+=Ww%P{xWdn-yWj5BN4#1Qial zeHqHB7{Fx{vG zU5m+dEia@up^V;y1igu?63QpBPJv|^d@ai8S`5`#_d|XgT?;ka#dfh`R?G@nAuD1< ztbi3TKl3vm^D!^;G7t06^>jU5N7vDtf9cKiCVCTHOV`phbd6-%7TFu2v*TUy74dcP zP4R8mzy7BY8EEym%z9Dw0V>0Dbn8P181 zc+36sz0ou!oKAxN#{~i}rjZAcMIur(>$$AiSyEPgR%uo&t0=25E0E>QGHDDNQIoI9 z)nscl8ns5yPz^Mul>Ckq;rnDJf3?UHwZNgE;3DOarnk{3(NIi4(#R&#iD!)_6O+Aj zF>#JB`OR5@6v>`4BdH3ECP~9YOq@E}maL6TOl8SuChH;-liKFCmhFVx+?uS5B)*&TPLOj!eei{XdSI-8ncVm@}#w8SN2L;*K{VQXRjR7 zdYlhFTGupY7yLX?_~7Gw@SVcvp|zYZ#FI3iN8$6F#J7EfziG^Nzki5lgu*l8WS;pa z^UPOx=4W_Vn#X?vPu4r|e=9uxtapCIV(uAf!=a|+Vr*)QWJ?U{b4n1yrN#{@8f2@<=tb{-7w5>l; zyp*{&S!ckU*?&lHJ)(Mf$^G;B=^ z$22V*vvg?&`5*o*f92P*SxaXrsq(jU*@a7&F5`m2QY>AD#+fanauu!Yr8gu4dLfoxNFot%#tSn8 zXDNx0$WpQt{3SDYQTDzW;g^arLJ5IQ^;u3YzSYRkKrIhKe+#WVfNTZkAV(fRE^_4o z?QeYS!`5P3% zD}Rk51s20Ee}9b<_~j#rpg=x?C<5{k#1vSHp!^S%Ate6;F$NI2>j2VKksZK8z8lkiWo4RLWlf!SllyTRf9mCaj6=Qr8OCFn{23--xcnI= zVz~S%PDg|MDJCiK42+aN#bhMpPtdHuDUjq(a3)5{pWrNvl0U{&jFvyfGzCsall&3R z#%c0LXi;D*#>pRH2FA-DqD_G_F+u(i?FyWQiSh@Sjnm~1(1A(v2k68Z^81*B$@2S{ ztH5*6e=NU`d6*&}!nq2Zk2B>%SfId#m@5Ar=V6-scl=C&i!fb&4~ucO{2tC%U>92C z_pk&l^1J9ptNbo5K%4w7mZD952g@*1eg_w#U491_Dez*9G&t(T#7mJ zL0pEp^51Yd&XNCyD=<&~8?MAW`L9@kbLGEce@|#$P3*9k^V60~-~1 ze*UPWq0o)+Jj4ilPei;uca4S~JFXJJsmiJ>D*2w#j#9Dbjwkxm)H_I{Vbd?vS6ylM4I;HpnrUL(ht@1v+g@@#Qcw2#g#WwjV{0%+wQ#gnn@>6&R zJLRYFE*_TufcF&mcRV8h0f!X$J|2~y#0N;pPvS!beuQ0eFFwW|xfh=(@KZb{_u?}= zChtW*9+&sxb37sM#TN=ZjJ@&`fA|u;@)P(9Ps&f=ANYg(IF2arYdj@Cj&HC}ejNYA zKKU_xi>Kws@Ex9&AH%;C_&uJJ_u!}k2k<9(4+inPyc@CtPt@tzicZh||D{eZ`mav^ zuTKB3PXB+Q({KN;PXDh?|G!G7|9{C&AM?M|=@b8})BmGR@BXh&|F50?e;;-F?*FTF zI^}z_!h98v&17Nhc6C;YYj zY<6ujZE|iiZF6jMW}Sv{f8o&hQBrL*R?{|KGRDV0QZc-Ol8J%f1dZ00p91hR#{M4$~+x<`Ys7*B3iEkUHK5V$t>u`8~+}Xs53-VAN8UNc#laV>|1cbJ9u8`vB?Syc*`|Dr$#0036zZ~7 zLI|-~FcdU}Lcw4l7zzYkPLs>!bUK_aN6=_68I1<5MiVsXO$LKL777MjDik@42EA65 zuL;7SjR^>)7?TY8EPq3rMuV*2B&W~tIPyt;irgXTG?H_Y!Iz~8LinzTAVo$V|yPfE(YaO^m^`V-yV6#+KMZN`v zg;{E47}VB=!pdlC~Pa*F2?`gD)r74LgH>LGix)9{Whe&$N}1tvd`fJFr{+3QRuI6Vnur(#l_< zNIrr>`Jb?V$p3^{{^ujEd~LoapYE2wg(!d3lPhRH{732&Cu>k5mLl-wGB9?8)Nmw}MHrf6BCZ9=GyFZ~bS-rfLH$k&S{YWbZT&7uBD3)8@vAt*Cz7+RgN>{exeB-hKJ-xPQZl=}Y$$k>dp$8m6zfxNk(j z9vFP5ch|))jwrAPiNBYR;6niWNca{`Z0|8>oGJNRNvBssqjgHoW<#@6(CT*6`;kjF zN?I{DS0_H9)lg1Rk&Tjps8p0Zp~?LGCClJ6?WPByr}H0$N~_7WQ_~)L74)#u7o}`} z%-8G5e27GRoGyV2za}rHN09hUdw+vC&@Ue8N1`Fo->;}mhyx=G^<_39etl%$Ntudr zv@22`QVz#-hAJ~(Yij9w;^VqtV3DF7e1o5xv^smX#x8vO{Yx%Cyy03Uo?#>czo*~;3&#fyFiUTE{h^f$16v#E@@Bw50 z#L#c~mtnvn6lsb|47SnJA_^Sp+_xXi^sVY~atK=FkUS95wo|Lk&UK{7cRTq(J7EuL zLk=iu+o^e1KO!_Lk9HvjD`|s=o+2p@my>gv!Qz_gMZ#V)z4*j;pHEE-nC$I(W3jV zY`0})TgCEwX8mRLu+F8+2H*ZQ2%eJP6NpNMI-=jPsE!~dee!maUN)ZH7uuWpxdxAl4B^QJ!QTgJayKQsQzDwpYby@yQ&&S14ZCI3xw zIfK>38eLALNYBdr9)}I8fD3kyuP7X~r%2llpU)6Yk(+jeM^xpf$W0F$MyLZLYEmRm z$~KQ+E>}Hs3@d-zP4eKPS3R0zudh<6^FG^6R;FcvM1n7ilMWp^L;S!{Up7hXKhh5_ zkby&n`m%n#p`I&IWg>91AgxMW)$w4+XcAPR>VQOyDzij_@vuZpf9 z_U<~=brVb4P~bX7u?{R%l{N9|a5!T;T9uq4q@kIUmJxq5F1z&W)S{0{byiU{ZQQ!y z>CQ*mJr28lT=%VaTz>Y3sHo4;+smXjYACHqZg!qJjpB$33?h%5Jjc~}AB7c{( z))Co`5n>j}+D%uXm@axa1TsGqOp(7nD%xWqA$v#=!Q+BB(lF2<_7AkDh0vhqLKx^5 z`_o2Ty&?@o1~!{ZrFE$s60vC=5^<{C60vKn$NPUDbtDpL?Zg(9w zHX45>iD`AfO%8IB$zl9=2FP*1<}}w1KZAb<)}3IL=mBA`umL3~C67pv8hyQ?-Z?T_ z8#~P~-f?<#Y^>SPY?tp>ys(Up2jX=$m} z9*c$@#<0Uq9lJ>jqGY6GDhWF!oi+hI(K)@&cbtcvf-^;;kCfA}J{C6YCL^Jjdv|~6 zvlDvmOo}>fLZ>ItPu72-m-T`^MWQ>(niknonFX+$L?T=>r_ljrCFK4EABgRWGu|LJ zT(2sPaF?Of7Pn>KxqIguGRlVntepPW*_ zSb(w12L9Zw_?d%$G5qPTOxnVemdtswrX9;>d0NbjiF7EheGPhf-6Ex zBNxWjWv?@>39buirit^!71>L~CHf_XCC01?zDfS^!HJRU@>P|(;l5%1VWEFS$?!;% z?le)OEwlSverL#8;w%g3N+O!&;$y*Q%Gg-n_|QeZ>wK%rZ}Z*jd)TLmYFrk31aMoZ zMin8%ttt2Avp`XPrLWLk9JUmOH6FL8qO#JWp%zUbq|5c@mgOdLC+E)2?aIx{O_6J) z;#dfJQBQUH_4;1@e*HW8!+L+U-cemxAu@(iKM}uvtzjrt)RZR}HJGwP<9|jqK4uaf;r(B!Lc>` zD(+!+cXzk9x3`D%Lqg^v&QcbSV}dsND{E^M<>lA=D{Iorh@YTaal?PayPm%HnoFDS z?Ho{Cw5Lh&?8zg>{QTm<9pwHgmyB$^d(Gf0Q`6#p_|iLOm)$vQ>Y6!RI1=haJ>jO3@V<%7cM!dBGbpma&hM9PrBWH6P*Y?*GIXFA8Suyl!Osbz_6r!~9Q zRZ~8}GNGo;+7>_0x*&hP%Jr+V?5YZ#&sjjgH2D^5ZKW^Z(dB^|asoRehEQ$J8o?8a z)G~oawE1C8hd&&440DEc72b-nibRD_VXwdb1R+f7KSTUx(!c=k{=`tQC+*iOPELA_ zu2@0E6a0XDT~Le4K-Dj?9aR(twz0-s-`dddFON~Ji5?D#GQ+_H0#X< zOXSSHg>AFO&APF2)rZ&b7reu{NIv#DY|g2pS|i@r8MDW>-1^wyr?Y08EqZI&%=UnD z+?HF;-f}tN2lzN~Hy~UjY=9e4k}LUd&b~3{2E&cU8%=A?>%8lHtNk|>t}b3zlABXR z3Vp>cKR>3b{Z-+^e%h#)$TJ8%7(LM(b28hHPX@kVHHiHR;H&e0auphvOP3uq2sZ)y zmsKcIw1*+?qR+tqFljt;J!GWb$vQnb{~K5x>(WmkPQV>F)?tDl^8`xzrz zo1^1F&;kf$!Un{NL2}IYcBxmWnLZ~!VlcRK3S8cJAmDZ}tvV(5?$CJ>Je8t4dqO>( zQn%LRuttnVx1+k04{%x$iO1cgg)x+fCA1_G4u892-V|9RH8>~<=LCXbM;zgh2gq^I z98E!3=OSOYWEXXfVqs`Wvv#v~zxEyNVXaCV4~I(;6Js=%A|oYBC=>+oXwNj38NM(a zHZX&|WnCDA#IM_5YdD5vG@6o)M1~5E z(SNxkNc2Nq$57~~>X?)=F{QZwI8TN`rqSzow;%1~66scS7+cCI1NRZdnz9*;HX0xF zD(l$b&f}}q;6YC58=N>>Dfyhk*&x^i2+M>GsK%GltPT~?X>%i@=+^q3o_Ill+gTOU zm3zx+d8E499itjm4PQnKc5_6pciY2J6n~4wv^Ww9xuXSvu)P|gU>LAd64u(OR#P2{ zg~Eu6(dH$QJ zQrf$@WueHUzd>x^ft!Jb^W+J8a_r2SM+JR^eI|15($(=Pg;b4Uid9DfhH zi+B9M6(@g*(wK)3I7SwRbsDdR zYV0Gf?>c2!Q8rt|L)`vW^clDI4jo@!>NBxm#rrr(&9$fXTskA}J89(^l?_q;3@W}8 zE`Nez`4be$pFAA26j%a7>rY)P>2Bu>ke;tBr8Kj!STj!g(0Y`14b5hgz<<}Gp$Vo+ zyYWI<$KKi3_uV}C#?RM2zc$N~&t;^y67|cME!#7thTz@PuRc31D)MuWLo|_|!Q10C z&Fgz^ykj*{t?sHY=^UOXymqU5+M;d!`(T(ngv>%b9j%3`3v=fnIDbDy1k&tp9T@fjY1dED7L3d<$oRb<+ zN9rQgb#?J-_wYc02ZU(tmEmYK;tM-M;YcLyGc*hzo}I1LRC$8co_}DYU-MM{+h9Jbu64Q%)tip0dewKczZ4n|4t~AESFPh9BHdZ#=bkEAjIq?cI?E z#c$&?wt;&JicQF&K4T)DI#hl#_wO_Rsn)6YP&7az|9wT7+$(8yri4Y(nG$6wx%bh0 zW5Ock8xs*F=;_y2{eP66sHqzAHTC`>R?6T87F&_`lx8J{C5>ivv=uOej?aa(#I|lh0h{ zD)Wp~RppkO%FPK^!gGeIF;_B4=83M!?#UiA|CQA}QciA-5`QRlYwcbo@2Y{z<%Qdx zwuN$3H5psTX5jfkbB*3?Ht5|pZ`f`K+ijGFHM+1?tKm+lezHhJyKn75+c6u6OTAz0 z=Th(gpNR6Or1hi7ss9ASpYOJu5$Fq}H+Jv_Jo~KDsP~5&L(brXWN_9g4I;1sLa(p^b+k@OyyyPF zL&su5T`%_IRq|)o%kFRR4f)2M9YUeI&=amZ&2_fx_kW&Up4adidCmO^`N*Bu;vpng zZx}rdDfyj;Ig+c$+_;Hbyj~sE6&rOrgVCMqRkVzVg60BRP#i8O2!-9=GDXkiR94kg zR>o`GWjQJ(uc;C=8kOMAahlUNvk{%mYooSelg(x}xt*m&Y1J2Lj?hSPVI)#i=q^pk zYb2MOz<=j*yFG-O2#20Jz~lCq+-?t2)Gg(BLSe7h<8isegy$!?T+X^$%FJOWEiEgo z373`Sk8Ku?k{|& z@Nl83Fh$>$%x*84P3SuE6937F;BpC+3hoqLE`M2!J|>t1&t&6E#)HN$jDpc#|A&nE zIEh;+%J!xlN+9Ike#C;Llzt?iz|7WVQ`^Y{XMJE?@x1*Z`$d5GGF%3t^zf*Gh0KL0o@NsdY zqJPBx#Nlai4qqfAN&Sn8f*Y&s-#+hgI=mYVWHvo`>a-k)($`MbZR`^elmfz4!UjZ1 zmt@gUqIKC_^chNWh}!8S7N?M-S4LTWu^~TSZ*b>?BI(goM2d=|MMaUQJCrRbELl}7 zD@$PRY==q7TO&rR)ns%#f*zhP@K?G0et(bK9duG+AfEJIJ#oSq35P<8RIPShm?7uxrjXPO-GxHi@?xZ?)WM`;}eOWNb1wS$`(jPPfm{ z%@EHtXo_vabT!6WbG_{h-2}18pvh5ZYn*DQrdU^KEHr1S&2}PajJiAlS=NxC)rYcK zeu#(Fd??3esBp0GX({pDQNJzC6Q7qbJWWlBDF1b{Or6yi7`YDw-3ynbgMjx$^YJktAPl z9GP3dv7g>+=HnRc#6;DB0_a6lRay*L)s$~A^B9vsSa8D^H$Ff3Jb#Hlf8*yjPW$}v z?cbBEdmsOtj{W`MyPHWX$tOC}vU%{m`}@e)!ROxoWbgoK;$v$EAhZb^5I_uvC7a+7 zoLL@tjZT9%5!!q$yiE1Z5dUVBN@vm zs@O#VctQqUFcGA|pnpxP(G-VtF5+^O#fV2Q+DpGV9<&<@74b+B_iWpt%`=6Ume6y1WgZ_=nJ2ZinUC&S^P8#r&0sb^g>a_-%{-+y^L=m}v1VyGp*-UYwB zPddZr9~m)OZ6n*_=T=-;!LlO5DkfCSaI{n`^DT>B62B>aZ^;7{FNI(CzUn&|em(X@ zSg#9fE1JAx{g*^nc~?ho@&3lUCHk!IIsXTdJkK8aTWF#CNf}k0B%|TSW#sjhMEvT4 zSTx`*MNQalH-Cg}GzL#uDev}D-s7dE8e4H7TvEcVTkmdqDPnZ9ln2xjk60CQAxy$4 z(*E!Y*E$zHN$T!%Ug`|pbAS{jQDqc~%u6R@Nwtr$(vAyZ8-Nbu5?mOvFf4|tTOy^7# zJ`;wIhy!|MuRMLmF1=5y1Wqc-`B5OEoSr)+#Lhz+W|N2V_-$r))|?4QRcFrNr1xkG z!^gI5*{$g%)nFy6-(I`sp3>7h&fPNV?A8ySdg~hAyXlfWci;W!*rxK^U!FPh)vZZk zq<@PG=?xE$x?i`hv+~R;uioV@Ts>?3^Ea0BqK|k$e&#RlUNm~X$Lt7<8@KA(C-^_- z0SFC>R=rs&(P?wzJcwA}^49P$FV(2xJZ@;TTWSmjw>@C+I2}~0(b!X@>k(1ZdjOIm zU6N09mAN`xFS!JrE8&{#n(bQRTIbs4I)CWWxIPYX%bG{hk2GZBPl^&eC9wCSFyD^` zvj5njy&;6I|BK=`{*%MM4E~yu56!TVEXD`P0Hx1$=P0i_60$ zC4q2pu`O)K4jc5;9TKz!eh(pCSO==ZWX$FV{wnPbk47_DJ6qeOU7=m4RcY-NC)l6u zN^Fmh+V;$m>Jtsm|DzBLw^7;^<$qF_IW8HF9}lz+xe_LeqC!rwC)vPfzgzOqrKfou z`MI97^||oQTnD{&4!;a}~;vUmOC2dxQ-r zV#f3VZOLY~QHxcj7KorJa+uU%UoO=Ksku0z;tyfER+P&I?+Ap-SR;699 z(rVQzcdknCIXH{SJ=;y(al6~?u)BSB8>q$VOAY=@sx}MEXHp4*$80j0&88y2W3!uV zHajJh5s%Gkve~SZQNlcCi^*)Z(6BW{FOodAFbHAhFcUO|VZVd_`G0)IaGpAxmrKbL z%Ky<|BkiyQq+P0f$xgg>VwXzdcB#6i+P<?jE(e8`L?x?5Dv4X9vbcp;wMdS*&hmwYT2iECCzZl+nxe~lR6g_Lq@DkF z2P6uC#3ZxVM0!oc6n_>~1ggoZb*h(Cg6eS+MKPMlRM^Nl>7xz(?cGN{w~L1y{H%Mo z@(;g!U>66v9kzbOI_+*hWET(F#LsbThGgPf4Prz8fa0_(N2OImXQnxF{2)Xma`I7# zpE}&|p9y8$XIH%TiOKL;6O$!VX0$v?S5k-7VR2-Z^NC5vv45>yDu32PHP)1Tc)LX$ zTJCu`y}iBFAK)hYIz1yf!OIdy zpA<$Oi&7S_vZF7vznw4_UkBKrumN`BmFkx>V(8R%nma5@vb%GZSkx)@5&cNVG*rhl zIxn;8if9?D{*i#p2mg36PhM-6%p zh(;&*;yTG4*GYC)wJt1hUp!z>YsM}Ja5(kh+)+M4CX+6*f*d9Su{(zSEVBbO>5#IR zH%uDf;y?CN6TP+mv47`>89%ryrsVf_WYR~i`3cH& z-iCDOx!v!NlephJv|^cwc_?hi29F+~4-CA_LxlA8f$8*G-no~u$Fu&atWFazJ~~=U zLL3LhdikI*ovlO>YRDXE$^%*VcpoTb;jEB%xUkH4vEw4=O4BOG2GebhEm@mQ_c$IZ zdpPT{{Fl#12p50p>e7v+59DtteY)cHiuWrtMFlDPkmLxJ`9q-se?gJKZL}8G_)$|# zSXHhzT9YF0NHfR{MaZu5vmC9T?+Gr6vS{(}+}tA5ouc2J#S8M_^ZBJbOG4)-W&VVJ zvVXRJlYg6kum7N5<9F0q*OmL#yu3@jNxfHnP%WtKwIzRhjxS#%GHKw0Gt$SA(oyIB zM1Ma&7FX8Z&)2deiWzM^emw5fGrAL#_Kd*xB1`@j)$(D)<-@ScM|K!ArJBq}6xzEp zn^&eOGg|h*BOiuQ?&T%j?WElw&zv6Rw%G|s=lCJtbkH|rm9Vf(g}TGsOD{$D=u z&VgY!OkPO2a?W<2R z&2js6>Vs;kc9aCBBG+d&@grqAQA)NeCQCCnj?eh~`QnDmg+R2TpjH-8Vl|2a>I+d>tGE)j?_0Efi>PSb=3Q&u zEeJFL9iT2QB4Dv%SF~!iL|zoPB}%)gbr&cf=A7p_|L6bw zpJ&{wh}HD!$nDX4BDf?R8J8b~5QFk7Dz z0Ktp}#?gYonkRmlgZBI%cYLt^)v}!YKfM3QBk!Xx>cse4`}2R;yDxug|Fc-U-GwRr zgFpE2!yo+M!w->yyKt16Lk@r%aB4@4b~A`p`NFJqGuZ>u2Z{HpMxrCJ-zI)j<%mmF z@+|eD#6^Eq^VQzO<;t?eJ&H$0q{=OVxJdXL>4wC0RbK>c_MpN_!6cjH6T$DX zPqB{$HUyuQo>e@uUdeNeB8ITeND2F`_y^q0#gY#9Fl7(_qd%s*eTH+tl}c(~**f>b6wVCy_FsQAX34Ziv!ln0`QS;Zkrm@0Gzj}~ zkXedy?B!98T&^I}HPDg)&1v#glvRgVJ!Ied=O8ql2)?6`2L^}zY~kHI@!_V?C9|^WC!O4(@l+Yw#h{! z81^}NCvq{9cCi!G6iyDQVigKFDhnrub!UHEneb5)!H?cz0dJfs_m{S^P_~sR!g4W> ze01|KZomB(w|wvzzFzt6hR5E0_puG{QYTK|gnY|$2X7y_?b}E1I0)ajcJkl{9}J?M zOkf>D133T`pn^BeWwg9eBGSZ6;!@%oVn4B8_?hxP|Gx4;=>G*ij{cYIRl+sl4AFlc zxgd05baCkN=!(#d(Yr$Tg*JvaMqacrtK?nbedIp=weV{ZyYp2psHy-$t|I1lP%+N! zxh!Z5qR$jVQqrie;*!Shp}*k|dttWQJtX zo-3T%9ulJwB3C#$;p$;;Ka9!p6ls5(wKIXk5*$!A8YU3viW|Lhx{b~)aBF(kO7Cx zgz351HemaXXKmAIcR^HK?pTx zyjlZ^-ejx-0A5w<>jHL{lh$(ZK9g<*wNMQn##?iP>1~iqX{Ge0L`h1^s-5ulqSWRh zEO+W;Kf&R3CxSWS$MI=-red>qigeRglM01v!nIM53MHcuwPstp_M94<*5>A-w7jG> zM;lQpC2|`e_M_t~(0J$tG`@eZ`GMQkHA?}}DLlUPf87S}!H(8DeqJd&Cw8L!xMunH zWv9&Ze$s#A>@`?m4hZmf`MapQ$N^9VnqkCjnk}vri4S6LB~HeUCr-!4;`SSoH`QI! za82_a-aC{1&G#h-nx9TS+`K6{*t{#^Bb>+^^kE0#ve}$2jR28UQ$T-Z{VK-X%Kd3ht(A-RB4)Z4Z60uNXCT%?yauFE}JXZQXd=8AJPZ)Z926_Kdg`F zr*ukJGBsD9v01UVKzZcxPUJ2|v&WH3&6ZTO9aEe{*)HAb;82f5Zd z`{IF>i!Z{mrr%v~Ta~=-?dMOQe*W!shwi`sXFt3D{zJsUC$Y!adD+a`E32_y=E85( z%=l_2ggbUXke~DD>px%r=+A%tr}$t#0Mt#?3D6F2HtRM9Ppf|f1toZ`eU<$o_$V<5 ze@JYD!vy`T{YQ@NwjGZBj&~hLgN~q+^JBlwh*6Oc7Y9VqAJDjD0|q>`iyLce8ydAF zOI!Zl3%!dmnWC{4esw1n7x8O*8eQux4NWaA=_aimBEcw?tghxbwjEFomUg;SO&Hdm4zTO?!VD4>uBxIr!V*j`OabP{<=EgDtA)@-ef^ozvm}rK*=dt+_>F>_ly* zhePoU%oRq4xL^jPQj4%bvcZteVNZl?N)!eiVap^@rN<;Ayc5_9V>?t&RJ72~B8z*p zYCtA2>V)Z9IM#74Y8YO6@%k(J?pb_gR8gY&&(ZO5<#&HpEuPVEW4YoDTQ+rK{PcqJ zWNM5sFI1C2J-H zD(pC3rOtos7o$_e8lYS=DCsT2Svr*B8$djC=Nfnc`hSlHa5#LyA5fy(#=ZAm{*teL zU*@TJA%J}T9ssEI)Ctf+Fevr%03;byYY#dDXclmYyT95equBkSNqvqWkA1lZz9{WMx9DO~e!NxZ08tTUs)@ zDDZ!R3UmS0lJXGnGt^pUpx>Q%AYXEyR04Q}kApw{?**SkW zg)@Rvt8XCuX<4}RDqNDn=Hf-Bb9Fuke{eNUBAr5ajr`;AZ}ZlG+L(4<2Q!W7 zWTrDF)6L9w@s*xd&-TzzEmZ|uAu&JP=jaRH>bNy*Yjvcb3q0*%!OttWq?Y0-$5 zXl=A^HnYt{b5BEab7Ok`m=Y6OsecSwIeT#kJG8gYVllEtCInR z_E0u=B1u(6q0O$){wS=r)kI;y6O39_N^GZ9)e3rh!JKWONs%*M_zX~m&w!)wKCl|7k^Ul8oVl@W3fNh)3*l7n4V0e-I_VNMChag#^1&RKs2v1eYFoz+u~ z^wS$|oY5C+zh&ALt>@v2kEiA~*IzfI2fv)xR98E_8{a;L6+8GP**E`|**!h8jSDXy z-+^{B@wj=}>?PxG;nxp$FQ`afYh6sjaR9-M08k6a0niTDnQd>|-*yuF?E9R=GtMFV zkdy3p3^<5u9M?Lp4UvCOg`Tw&tE0nkJ3)q{%cBH<6hTCsycLZzQdA-B}z~6RI*SV3leOCm;&v*Ej<>rOB?NWxC@Q|6<%Ws6*0<@tghyHj&{*%@TdY6 zbfB;p;62nh*hn-g2;EJBh9b7JHs|=*Xm<3kS0?|p$W9D}ZBBoO)9xhfVOuZ?L(U2d z-PK@p7n;cTi!fLC^-n^gwY~ar$y{%5FO*t~q1Rcv9_9M_->JoBB!NP7J7sh~C7~9T@KGDCca14J4g=53s2p5@*sCv;cip<({ z%SfIlqJcvMpTI=2Zjp&(oir24I?%wO77G=;JL?eLeAbNyS>*g(A{qpd5z!O-Or8<5 zH0@!tPBh?T0W3+TCjKmfh`lT^6y-cmXMS|=zWis9-?tYE^FJCK{0M!)tuNXLcys_G=&u*iloLeNo<=00slyT)uL{wsHx)koNtJ#^i3+NVwyX^C z8;C|er%9c`CePWt>dt?=B|rYsNB6ysO=?9Msr>X?Pi#DLWaHyU$i9tNEWY*d%{%gi z7xRC1OUfbmDFXwdWe*>I^Pz{|JZ$v_p)MzH11Tt(;+;NN>zYR|=Wpll;UBXKBiMEW6V7qJBdplP~_03H>QY%%9m&&3raTFUJc@y7()99}2@(Z|y9gaJ}^I?Ki= zhh&5hd=Jr#2`lzsU3eHP*xU+#PXI_9=GoCEbZCr8rb_k+R=EJ4awzxuPlntGWt|EvZJ~MmHT1B9Jf}T;@p4tO%#W3$C zBy2r|<*j7jkw@n*2?~ls(1Qy%4?Bf7@RdUYq%A;T`#%u3ydkt#CZ^>CCT$vCNkO@i`<<2gsxw zb*jFV@p(uZkep&npC034-EkD1}h)>sS}j`VN#jh?I7)ybj*Eak>$oJr()wQm_i-1CiG8ejj_UwEA|PQR6iA~ z#(1k!MSI&!UJWONguhFQ0wdHBg>7m_6!J5rD3G&(DDVfmrcbNrjKWaR=xl$Fwnl+C zgTt^39m3X76qVxhu(bNy4KYK9e_A*J{DqTXR^jAOm)MpooE+BV&hR7)h9aB(UW~-r z3nxvNSI!!uSI)L0?;K#ItRb>eb{2BSvqTS@oh7=NY#99>M!^rghz=nU4Q1{a^uj+^ zG%bmKxlGd~+RHRu=zEr`tEzu8UTl;`-f2ZXC=1el>AL&p8a<8Q-8$>)Z@qEgz#6CI z#i}mFuWwxO!@)}~%^$e?!XxXqkg1AbF#1p=C@Y;+?H#F>&gw8D1oS)4zu~zhn&=Bg zo{t0-sXp46y<^tgh6XjWwDZO_C_;IpaFjBT>K?pi#!rW!HxvvJKcs(m(0l2(=;O5Q zZ++kOZSeibx8MDa+wOOw-X&WA1#dPbCq+4&8e~P6#4#+#i#ElR%)w_&E@H&v4g*49 z_rw&pcsG@U|7?o2wN95>8QTxSY*-Di4DSis!a3sO;W`u)p#Elm9dtzj9rAxffyGAS&Sa-$3GRZp?k3;9s(=3eHqpxl zyy_qO*KffBq^HngkbTIw$A9sSzGl^n`ZC2X`ray{0o}w^xafVnqHvU2MD~FyD48Cb z+94CwG7LHy7xuuO2B*j4a%zl~c5;X27Sm2uF?3xA;xOK$#^XmZRjYzBBdRe2RMGx` z5sgF`r^{d&yBH(gstSN#MtIegWI5G&*a01gj;x+aM|O5v%~Lw9s*|FSVJfHmKe=0z zh9+{h>KT_ST?iR}0=aMu@P%W={0dH&SCzf}cx~DyFH70-?`}T0+We-)8Z4dr^G$de zKF5%A_4m6Mt|B6MG48)~`A@Bv7VC!Az(AiRO!fgCt~EP1!A<;TfmCVLt)enHpUSB0 zG+@AXewuI{aXq(8T&8b@oA@6Kycvahz{O&r7CUo3frVOs?9BNP3$@sp^HEvn7E|&9 zFY9galHR$vyi=n&-a2BrD5BUV2{lx^xdrurS&WM}H5UOb0xcV`7__+)1R6&`s9Jp? zMI8WD5Jf={1s(#rNR@?HgC-5yW!DWc2bY^}fiN1lEVq>-xm|EM5TMKSnmlaeSMY=U zn>@w81h;~JI84A;QR_6;+yBW}Z?TWrgw`+H+0am`JNk2-TmFaEEa%oLAzmq_pG6Th zPrXBIdm#VZ-(V62cY?SVW)iU8YNgnT80Pt;7gt-O1wYS>>ZJ=7F4OGjtfof43xCf2^KfDzL;0U6Bz2JzcQ{XZP$;&9Z%7_IGRWQ7E!xK|g zuh(N=5rBbL6o`_Rm0-PMHnu2cbtiZRzxz2sRT2M$#5CPFt4hH)w|(ySQL1# z>6hmdW>ZIoK+h5AIl^SQ43UG+nO>WEl?0_%L~6Zg*buGK*n+0v_Kpm`Oj(zSDttMA zToJKmma}Fhh-Z_R{TZ7nwXCr{Xd{q@kg&Z3kAY;FO?}bZJ8|}pBAsAwu-HZyiwJv5 zBEr>WFP1z9x*pWxhPNY?c4&62%(rhs$B(d;#b60=vQ^W0$*X@;NOV7 zuD_n%o7vmVI6(kBp^+dB`EHKy)>%zwW0~eOjAha~%d;v>ix8$W-8|2$v5Xjhi)9D{ z8jQgjv|#W?%utPBlaV&!hHli%G`fuzBV!n5cXzhEJ*(?g_4QTRMYc>1)^At4pUko- zIT3=;=845*kH-dND9aV_NyfIqM%aS0(>XXYtUp=BeRxM&G8j4}7twNba(?Pn% zZrDHB1sxO3_DW#-xH1+PRoJnA0L}_47ab3v>L9M8K|vLyXaz@+P<1rG9!EFPjp7^x z0d{m0RU(`**wz&j8GPYqC~?6T6Bm50uz6Ulwu;Ai9nHrOm%`@?za9#8b``;F@k~Ip zhR(Js=`368ugkKgSe<2QUeB@-pFhh+ymFS+CVmS47{f4(1s`^B0WXt(Y0ecs9r7|o z0Ab}E@IS1%aLjb^?kpE^^V#NH;h1@Wo6mBz?C;`ej_>N85#h5C4c%>FE(_7n-4ps)Vid}jqD|W@u zaL(d11n6N}o|4r#Bgk)mZHCa&+)P*nglCwET_*?J(V$Ed(>CkfTQh!L5W-6266m=1*IBbzjplcUeEw|7jRn3|^NqXw zrl15%y@MRF7Fg17w~+6Q-%GS(`O7#UZXW-_3L@tfj8Dg{!4J+M_TG$M901_I0VGo| zx0k^J1QfSiWe5W-f5M7XYP>4*>vNpPJZ43{zs8mNPx9GT3+uNy%t$tp_Aw=I^Z7+K zy|pfy!foF&TetMqo$WN+1=+1Te$!5;#r9NIz3Gs^|4-%r2VOaTL(pN+qGEm(H<4Fv z-^*tO(5}vla>|Qf(asi;cPMFFtsM%k=jVvb(FlJ*D&EgD%rF_3Dlzl=hLPOoctAJBE6$le13uLS z%o?IisJnyVAb%E+l$>;X@VR)6x7xn|YP*J=8unSj;dOB|D7aWL^$~iq$|H`@h}9$X zMfHgL%H_~eSPoN4>!H%zg4Sb8a@DvbXYbDcio>Fma>iy>SZ4_6TH+bjlvs|@mo8C& zp!9NVNv-hFnASR;fl#^S7!9dkjzJriV>F~8w8E_NFYj?Z2ZT0^X>*y!uy+@bf z2d6EwA#Ism)0SCFTlcB-b<>vQd&Lu0-yoo)IG}TRsFDLRX?oV zSU;>=)era3`-l5}|9C|G@EfAs?;7QPkM18&{2)Pa&+3Q&^4AZ)p)(1)b|!v5t{>lS z{qU=Xl&BA0t6Jd43!A@2mvye1)c~ie>KxNXjEYo1>k$%KKqi%GRb5n+f0&K zGBXxxBZ^J1(Z(tQr{3^;+y&$g)tasvbGU1O^l0^ ze;>4yV4AAP$>Bxu$X9WCuQ;#>UPAf3jNmqpLb>z$P0PFG%|0m-uS)MxLk)4QN6O z+R$O+`>|kU?oMdmg&qvCxu+%R(joD>tDP{6z$lEtI83m4w;c2>V`cq$JUp3L2B23h|NXq^ujzWz&_Xye+S?o z+xySTYW10}hF}qv*uFm@>EEm3zpY;%h9htkmSF`}*~!X{JEvB(UxQn<1J_>Vma%Ev{3V59Cy?K1p#r;42oSFA-cC)+L_ug0b z%4T?WI=1QPZQA;=*D%8>w(1Vlhlh`|G`f?BVDf>^B;6wDSf%)Dma*Suz4f7i?g5CBH30K<}r z=OijG{9xBP0C@yJ`?OILS}J=cM1i0lF#T-qMIB3o&sD_$)c|;W?qy2@kLAs?0(nmZ zIjhcJGXJ7kzv{>Xa*hJ(-_7snT7np~0KNkt&R?|b{M#>Bdk;{#0hqdX!Mu+1`qb|} z1CS*EY8Nb+*OB`Kf6WKTnE(nGT(tCxkKWAR0Xh2a2 zBFkXlebL5#im_M&H7G2&^RZ&4u-s+TN%7mr>Bm}TY_;}zN{)BYC#9vqj*c@Rk?-|$t z(CnGkY)@Drf8cHa1qdi_A3!OFVk{W>{m{%<~$F&V!mFVP9CSb%V!>P+b-|J(cmso^e@-Ocs^ui?c zV!F_af8|0i?iYH|BJ^VY_s_OM=*5Nn9zSUB%%%&3UTn?g`8hjIX(RqG-e--_i_+{n zT*L31rC*&*pUI}XgfpuD)eHl(2JQ_S{>%$P5?QW!AG>9 z1*i{qXY&MhT$jyL$~ETV!fe}d zSd0ZquaCi{I8W)l%zN>^Sg5?qqJQ~3f9EUx5x__+#2hSAs2xggoc@lP>nzT`X+XIP z=fzy*eFr&qxxyz-xfB=UyeyxVp5Vz?Oi_Agp>p2EO8*X1&Y!2Wn1_onN9pbJ6bxja zXs~TSp?4|cgv;WkCq~@hd+_?D=)giOLKn)Urk1Hwq~!3%hG9eN>xR@+S5;P&e<#XH z^7^#Y!Z!m2E8s!?s`Al0YjezvD%2Vbmc|2tX6J%YffQ*EG^a*iwxGMY zeN<_jY|-U5g_`E&md3FqSJxD3(v`-Ma)g#_A&%ih$xui0&@B`iLutG@4&)>da}yfmJo;nD5gqf=7HsxhVU@#h3)wWR0`tt}~XLu+X~z~6+w zRp$NXg_=2~{enPB8yXo}f6#qFdq*JU?oQ$CWx*b|TiPKXg1b4;J*6cSOeH;`){as6 zTde3ld)Zc(6mXqhQySkQnlc@`CC`}6=nbc4=AEcha!PZa8-MnRo+bQ=LSs`>dnzzD zkiyw5p%e|*ahO+!?zwfIAU|43X?%R@yvZ%i3sc&r_HJ<~r}Ohuf2yz;3Uq&k6lo9j zeRevfBTG?-#jn7#e4LyZYAMn&m`}xGsge>tL~@!^YW@bpm2ypK{IWD%7+N9*(sW^S zAcaXSDbmq8G~q0b2ZNl!E7KC@l*WUp6_Z;s8aur_?6mS}kEicufXU3EYiKCxqXnMX?f>LPipk4)|A-3fDA2-Z=o2uB}8tXyhS26 zpEILnhX@32p3>4o32ka0*}A2W+&sBuM*xr%D&2Lg27;FZhmWb zcc44a9ZHLsJFO*yDIt;~GdU{%lnZXDMJT`36Kv%|e?GNhPGD9`_pI(2p|1qw4ecZ;Bvf)sq)`21wlN3FAzsP z7RUoIe_=TW$klj&P*50Ahu1L=YiI+D37>+Xgp{+5|?Vvak*UnlI#&)mgnGCq=6m~p1>>UBLxBmu9sKJ>*RaCw^olaZ~yahg?tgF zU@F>iDSm?GSb_V|OIm3o-7Vh&6Iw72%kdQUf038~p&e$Njj8x4?#2#0i&ybSd`Ji} zk|MH#yiVRwp?~kdUU{rMM_!C(oP|kPL5##p!ej)U!Dg^c?5+O43>=buFkuQV!xgv+ ztFZ*umoKS$F^e^ zUch1e6<-lT)WlDU$QUx7OeJ@d$H_tR9R=0UYv|)tW{qqOds%P^cMqI3aM8fse*;_P zYIy<(7*uef8r2wz224dOx^NwC#{+l_8?hCy-~c`+PU0iwWGtCRT1Y!tKo*lFq?24l zenM^_kCJU<7db%QC7)A)s;P~}XpGLK*U>xZHoBJ{pobaQIjn_sva8q~Y#ZCpJ`qGA zE|d!sgmz(>aHR?=rnYNd`Ofj(e?|Rs`tRv~exPh%)WC%UD+it%I56;mtdn=kA3}|C zG@upp(S@tA95>=NtjD8x3gb^)q6Cd#_d}|_O$pkWuOed}6d~!Zn zKrSGck`-hl=^;;(J>)s^GTBG|K;9!?P(p3AjF!=1w2@Aw=hN%xJ#-^Yf6=$;+w?2? z4U4cit7KJdIBRE}>?U?IyMz6ly~jQjs9+N+gmZ-D!iy@VI!|?%YMpAY>Lt|?wWyw% zl@U`;^W6m|3Dka)%08PYw9J>(XXhNO=6R16CDOhc3})If;DHI zI;aj(E5w|3ehvByTFRyie-Wm~((mUR=nQ%zZO6mpX?#n^kh95Ute0+}v)MXftuUOt zh2``)0n|W_V+2N!;p9>BIy&hATFN#Hzvov}Y1ntFi>N`qN%&Yr*&hI*kx=$KGK2Jy zNz_iBBg5!z2$2~?Bz*{xv8cz}n1CH*I_iW&Y!w|x-$gwZ;STZ~e|v@Q!Xmnh{0d*9 z4g=&8GKt*FDsTqYQl5`_Z`pF)=LT^Vcna7^}&edN;$#;EZ3mbzi+?iI~T_=xB1+z*oWu zR)rDRNnE5!U9W+vLFE;y1)K0OhGRaD$*30y2UXYcJbRrTlUwEBz-(3Cz>zp)#A|Xn89T6@e>9LnIY2sP9hr<9aW0Pu z3M+*hgiD2=0P?rE3O8ac?!j;HCLV+jQPks1Ou;P7!9tXx9F?d+9fo5hMqw<@#3W3^ z47B4soR5pqi7Rj)9>*3)7>}tq7jtkvEP3|f9ypjk!g5CxJ6iwb5MxM#Dawwf(H1p3ajMTF$2Z$5F@F^az5_mPvryh zBmJ-9VLXhrSgRh1Pt{E*!bEaha1+%|Op*7nJv~#aq%_;pGgL{o<`q`1;Hl1_q&?cI zVKij2Hb|S@g zVh`Ji{cI-$Bv~4SJ;k2vDfCNewr#7cu=0x$ZnhON+X~8VXDbnepPidcXJ^yZY$ZzI zXKS+Qt!!n_Fu!qxmaPQA7i=YDwh~m{!|v@lV`AkFB{QT!$*dcstlK)Iq0&FX#qLFl z-HSc!e_rfo_d>uI>|PM~**c`yI_zQVu%E3{=<7g~O9hLwm&#`D?J?T36r;UzL@sM( z(@+UNYsse5*|eTY|Lzg(Y$^ygE4YF2c=T!oXDc{S!R1QrawWf5$uCy&NhP1m<~b%# zLBE1Vj_ho94vOJtli4^Woy3|EhM!GjPT0C$KY=^h`DmPWah))(kWJY#bY{ zl*h7WjDnwyVWXAw3^uxFl)rq$5;hvMSu?kp7^jayf{j9wje?+1Rv6vdR7buBP&LN6(f0~HhL?)m9CP0lXbK|5$WZI^Okw*xSn zH0}{16)+11@(%?!DR_y3l7bG&Je&$!p76_=ZqxdQ+wuO{G34Q_&K38$(=kSr3#HCDf4)YpEA;! z8WJ0y&XLbf)y2lAw3BAGY$4>f)>K_AMQ=_MOle6InUikt@L<{w5E8%PR!=r#419`z&8o`1#I$-@~twU8PT^QP_^e@;v4F>h-e-l zcR zpW68TgErwGZF5R*&Knu~HwW2)apb_3rYm{ivOUy1uRYYNEJgHt~CH;`cg3IzzdaGU_L_ zY|&t3YtyVux|Qm3%}p)so?z=pySQYyGMa}4o!5AF3VhvO7i&%FLnBj$&`71KbVTV0 zUL`=O%H#3rY?bqxVL{JM@<_Hy42?{gLL=d9UO1|G;i#^zZ00}w*MG&2rRR2?tE9@m zuBDfDbuHzLLKnK0qG?vk2)!be{q$BvTCY?jGMCz{tE+V>6s~q%3Vyw%98O;TMDEh1 zU0tN>)M0?GA0B*c#E|)RU5c(tNh}85@Y3wS=^`-_>mps?51GA+vi{8oKU9nnN(h{) z&vbk6wMK>pYIy)!Xn*B?udbuA4=;iN_2ZQ__j0%d#lfQ!rM)_Nq6|_K< zzl9Yh`CHgvlK%la%<@0rfJOcXoUqE@zy-Vf4crQP;E=yTJ{H!MB$geLXm>S2+Cif1b;#K7-A@pk0Fkbd<>-u zmZ4DoA0!Z#{|Ds?Rv;q(4=NFrzeE*Ezd#aI@)wX$C4Y_)sFpv+NYu!mqe;P0sFnNBj3II# zMx##d!x^ZT`+qP7_3~#Ji=pyo7>8l;sT=~!V3C@%MjH@wE{xhz@Jo!&pj`QU| zVFl*Pe}BTY3SNf=@_V>m!Jpy+`90i#3+4B4BQBKR#Z6cwzl)o3k^C-h!A0^r=*GqJ zJ6NgUDlC@Y!L3*#zm40_DZh=?xI}&%YtSXXjoZ;B{}F4kRQ@CGQ1EBCRDKJ0;xhRy z+@;{pafSRA?#43t0Dht1J@|=y0P7UI7gx(~;(tC|Bfp9J6*P1^0Iru`$Abz!grCZ<<6#AVjT_`Y;1S#?{{fHUCixF|3^&WKVIyvlU&G@HZbG;G z8lFJ6ydRsfQr?dgR>}LZMZq52CclcUSS`PbZ3=G38u|BlQo*NiyZn2ku~z;)c3`c{ zcYkQyA@^bz?v#7+G=46>f@g5I{0g4MFXUISTfsfJN8X3$6#Na=$@}m;?v?jpFYc3n zhZk_a{5$*>>*e3!MXZ-!#!J{Bzl@g^{2hKNzl?qOmHZN3QLq;e$}i#fcu0N;ui_#3 zMeN7J@{4#)!9U>F@^A4v9+7{GHxzsmkAKR)#Q|)TU%*=m{t=JMFW_wj-@zt%FW$uy z@?N~B;GeKreja~DkNi9iVypZ-4q==8Jl@B4`8W7L!N1^1`8PPM;D>lhehwcYEkB2k z75oG{`BR`8T@qe8B zEdB?-k)Oda1;4`c@-sM&z49~oJNC*?<7>PiKaFqjlKeFOq2RZ8S>A>36zs?EXa&i|uiI)CMBv%-88kIm#@^cHnan&`Jt0+qls47qAmn&_Wo zjJmZsoc1JvOEd8*XY4HTSi^+=hO@-u4HLxv1|%E$8~C@Pyvh_bg@dNxd;#AD*q-ks z6~0A4*aL!{G)J(|8W7{e8#!4kN)I zp|h=x5Ot^^Qd2#I)Yev2+J9|UcBp@r$zyWm(g$?bJd;aR_>Y#b%c!@h9&zNkj5<(! zD1X2{QSluk39@OcndXLe%3p%X$9hUN#Ur%xmnf2tAu9hJcKPqH$$x(`KTn&d$)h{v zuOZ4`_IUG3`57hhmr|%$m7nL&D==TA@#ULQMxrW1K`1ZSXpT3k%zrAC!QF^7edWoD z!p1yT`7d`8HJl`V182;HKJj=Tl1Z^o>@(Nbo6Pkl4)qn~P0OSiv`maRT@IJsWpi0w zDs{fc>+yN~9zh+A6h(?7B@scb)9327dW}9uuTrx}fvHeJz~YujOdXa`DkLNlG6p5$ zaRnt3(Z?l}(YT}p7=MWp?kg!NDT!T+y6i#fPCc4twMaIT&*Dm2eI`fJ#KG?KnUe)+ z`CCcynUhg#z9|{CdcM|yyR!3ek#35?68X}E&}`H?s`f9zIb6LUDfqmf87Qh!q;4&gj^*zFE`PIV+2 ziAF*N)Mm5V9d?Jks?uD;KDl<@J>#w~^EMkD*Ur0V{B>o%QKEfHQ;Dmn{)}5UG{u}n z^RjKM{GpU~R*+<(Kz1hFqb6Lwj~y{`1m(WHh(>ybQ@%#%EV*0_^C3O!jTX+^!>C_byzP)<>ib&{E= zRFpic$!;#sF?*~#>02<-`A56CCvSQZDA3Ok_SpB0fWxARoUZzt4;y z@pxNbgV^6E9_vH0A=%eQOlC(t#QsKeeZon^ua50Kt$$Eajy8qMrXZgu>QIo+o7$?N zNtK;KwL|C{67ad*zWzlVNnqe}tJdhs)wqPOzn$fp4Xbt9EdyT%XL?{lG_+r+muPCIq>iB?h9WnRW|6%U8 z3q_iu60>vU)R=;Uo%`NX*}hdhLk>d=9Wj8AncKA5T)jI@zS+i~3A@Nl=s?NLZJPH@ zjo}dnx)`N!keToi19bEv#L4Z06IDEZjL*|!eScyfl6`&22C@IJ*hjKG3*NIN7ON;n z(=sXFUubsP!-0q`=#*dynIz)yTP0#Hv`Qp9>8`yt!-l%LI&_lGSnH4==R&33W((F7 z4jE2ssw1HSb&fhG!$~3(@$@3TFlPx-XQq0bBh0ot1f=brPk_2lVjnIj{81{ z%zwOW;Ey|}1Uc_6{mDn4FJ3UQXwk#hv^jHf9b)-|=f2ZDw4-b3z-44r6$3DwGYp>&7 z%by&dS^nXW6DEG%c58vBu-cTC|19Nu3V*AMHAY>m$ixyspW6vlC?76gpePb|rOC{# zfq*%lCbw>lG*;!M$*tSXjp|TiZJHRQTw5c{&#!0hp^2TufP8xGQ#x0Dl}c^+Y$sWf z;RTXO!UgBy!)J*fnd=i1#J*#F;0)X1Y%Dw{+KYa$Y{3T6pV*mCXn2Z_b%+B)k{*GcTk{NQ3nVGWlhwKdg|NQNO*4yB|p zX>jIbc*HDAuly>#=#w&|Llmv+Hm!Z3`G-Tl)kcY)#npJl?w@FIxU zBm)=%)E88F{rPrRntb%6*ZZv9XfvltyJXJGd)5{R2Io^|rIgX2KaeIfpJGf<1$_oz zn#}A$9@6y79aSI)4yCTm^z) z)BkcO`2(D!@B}+LC-fh0>uhLf5c?a%!w?(#c;@p4v9CdFXb?HsRIj?JEOxcH*9ks% zzIvl!Ff~?`camTYsWN4{FccchWW`gJ$rK`t^}kMD-#psycKb&wIPen3`{D!B$?Ogm z{q7ascLQGy$|y3M9_$Z-V1F+k=fcN`-hg7dXnPoBez-7A{`8dSDh&&{gG2aapG`Q{(BB~T^?$czhHrz358wVi zkq=?QjR5oD=yf{tRoZ-&TOv-aTOuB{S0XNrx(j?0I;__16asW;-3nC5W(gV4mOq=j|_jT@xM> zw3}V#TVMY5ZJU}!r+=N6axnx-%<>0<>WC*Ushl(tS<1yd_iAir+l1mLYMMt zgkhQ{VZ3IlFhipbr{zCy^%PbIvT1>mhN=tG@*7evmma>DuTW!1%O6O~1wqhQ1*;|^ zL^LIqp_cKMnU)JI%PcorZYbPk*tNqLD-@(k@oB??I)^z`AU z3L4AvNS>==7k{ZE*Pbx++9q)I(cjj87|Fh5Umxf7Va{bPr}#G`ro!<+P_T$blhJHs zYP~^cpz63#B9VZlAWa^ZY>4C*N(dJgX-Xs#QzL6%EnOEMeDJPsZd|$P5BJ}^aQ(ajqs#2b zwGM3gIQZI=_ikQw{p05h0m19?06QRj3>#K#(K4>P)udf2p=vdw&uaAs!+aa8HXCeO z5WPcZ(|?1BgwEIHnv7zuAnJ8H$xIOX$To-8W&i9Hqx$d!#T-g1f~UX1;d6Yh7uILtfguBv!48rFD?J6r#w`)Q~ncd^4Hr; znxdjYPAe%Y*eQR8uzaK^S`g$`kvUc*X+n*~#cFS(MU`k&8$xOFwj>r8+r>yDd*9ud zw0}>uQ+t~9NxG^)qxgQjQR}MwfirTfPdwJvcZ^G*#7D|N<>OQtn&qVx9>2*ZXnf{? zgnX-8B4s&o3FWGYMEoYNL_9XHL`pRY2^B)(6c>Xl)_?Xd&_>!i(b>ee?!@Fzw))J; zU|RlUt0PZIrEX*N!?aoTAPL+c6sT~l2< zWKa~^ZPpz15Jhd=*l_5=3ucuJee0AC__p z8;$N7_xm}G@n`5Gs6HvW#AE%3&k~PM=sWfyGNa*eGUH{K6n`}fgK6^kc7K$r6DMTX zDZ&eFF)pw=$q5-2>jELR;0Uln8d6rG2f>S*L7dxzAr-6OW1JN<$7-5V}>y1J=8 za>uM|Zk|!^cAE5#Xw{pf(pq!h!V7=(tMi9-RR!s9yOy5!+y(da-*(fc4|^_~bXOu- zAUaJBorP3=T=K_#cWk@$mVd316ayu_@&}BtIWT4Dn3i`e0UK({ZEdB+B z2@rM*Yf*wS@}v~2HPxHzJ;UQeO3yHlb)Oj@T{_7;$v)dXJ3guO>wgks3?(J;GD2x- zu9&6|N_N9)!+HZfXds4SlffXGytyWGsF+vfMIu!tkw|fgH&hbWGKHj8S1DrJtEHtb zi$b#7rQTOw{3b?+oCh?C)xwIt$^jM^kj#OU#R4tb7x z1W%g8pDd>lQ)$G!lMIJR-m}$|n>3~6J(6hDCXFTn(?ru3CfOvI(j>k$(Y(l+&brQ> zBo^a7T_)SF_|V*L<jw49d*NVsfYjV#Bh5RBn zk2l=$iT{0a(?IW_SxWu%?yu^|- zE-)cDws3sx#ynM}aadqzaA-JLGA!0?JVVrI6Rtph&=dBQcoHFFNldd$e7f+(1REU~ z8@?=XW1zeI&cH)~?Ey_(lW%v$0I!{DR53!ln({y%3q}>?RR*Ho;)p#O(fGW+ipom6 zhT1iuuu<>VC-h1EMEz|2VttN2O|F-UOT#dUCTcXTG3_z!Hytt^HK|SR>S&RV03zs7 zlT|Mu0q&D_FCTxL)Q9M7Bb}X{ZEbCBVbdU!74@X3trLv41S^NsDi&DK6s)YxIG{m- zPR?H{-uJ>o*Izm5p^pAly!-+wo;|T~)Xy#-*h(Iqe8uqA`&SP9VM>PG+poN5cH-W1 zr>vaASx#$1`4wibO@SLa1=n-*gHSCiHQg)8Eg# zUx|%odS8E0I$ZB$y!(2^Kf?Hw?ws+d!pSpQb|7E=tjA;pH;%mWXWQ*|N50dZwK!V2 z!O_-9216}b(>JP^xBO$XS)pi(tfj#9Ng1oDsW#VERkA7TwL}TP(L&SJ_tkR|mR- zw??~*SC{B@MI;(1&JXhKxlVHM+~r9t z7wl+r6^<-iHF@CG?4)R^n|;BAg-fsfa>htLE4rUM_wKVATPMZGf}jNu62e;45VPc- z?O&{3u4X1(Ud(Lv>I(AxHKC9KyOZ{oGNNR9X648YUBkmeR!ahLfraDbQ#F$UM$d~hJ{sNh zbBt>;v8}W3SX*aSn)PP_GW=g35&M52e%1Cy!--5*qAA5#Y_Q@4orjQ#X)s=CIuW56 z);&eRAdW){R#}-S^VZ~Q{86#gLVOPAaFEj462DhuK~F=ZHW8^kzotg81jBjElO_wL zfYoZDC1FA9JHM=~)JF*1!=n+S#;>6oSL02Kf1p;BMNm-*!zl8MTYHC3s+WIE=q(#C zI8Ds8W#n9@AnrX)^Nh%aD1QbO-=QKOL9u)UMe>pDh4un_Xi)#uwUW*@u7FHjvy{=S zVsT`{`-A!@6I8a@tOD0XgA+`ZSpX0c?Yn2+)O*{+TRva4Z&ePDN;u6X2T{Lv)zV#) zYYE;z^SbF7R*|3i+@h8A4BUTRQ#)x*&n@?K6IJ)(3aioWd)DuAc&9F!cU#+Kzj*C< zpok1{SS(KBuo&z)Ah-|^77J_9M1CXb&A+rik=SbAoe(mvg3b`jdI;`-V)=_+;*ABp z-aydnj#nxqBuJvTDv_wH^2QrRa*}9F`ja#nYf2_ZHhCK|euPdP%esFN87D$#FV6Z9 zv9NL-V-YEe6&4kR3%#*nHJsFhI#L&_uB)r5_6`db_&|u(RT+uLV}Xb}9Ers;K10K> zVY#_lO_i^(+E>^l<@>AGH*IdBtD6os(WW%rC3%|7zF^SgE2k1&L)k>SpHd^8O&3!} zpQgJoivOSn%35<Y3Z6u*tn*aq$?C^jKSQ`SWM;ZXU}(!VbJyR&|H4MhSd z!IOl%N75RtNxNjUCKG9S&r^Apq+QChBr}1K;6DY^v!eP$us!%slpneq*Z04!i0gs( zlxbhh9gA-i2|`Pk_}ni4H=I&Ed$5hmzl7Ef_)d2@6hVF_**1Te|IR*G55oVt9{a1X z7Jj@Xl_rETRY)H&1grsDB0u39uBy_PTgz?9{G{(JRg+$_O1AO&6TK6CHva3!2PK`p zR#{^8YF&P%oL`Ild_TOdj4h;7)n;uWrPf8 z(?pSouE45;&J%w&5a)WI*vGlv_n)xx$GG)RYp%gl41aZq-u{Di*F%bt|1%{HKm258 zo$O35eVu@?M_7wGS|=qx@P6c@qcN^-5BB4A^2hwwyvK2z9QWpi5%orWk-9VTr{_Q7 z+u?fyZ;&^y#9nTFLjkwwUw1MwcdnIrIa;Qf<~hfygH99b1^3|I{i-SEVeqGHmlcD zR+JGHu}Lu+D~`ruMNw~AT3#vTdkF&hUayZ(E8*y?1AJbe)$8>kO}&!N7moP-K3~2! zLU?&xe!hRFZU|+zh=-OXqP3AkLZ{OUmWW;xiPqJ5eLnAyT3=MctHd9j9bFvV9NisN zMWtwQbyPCf7^ADB`=f`VN297}n!YdDynZs9(ADHs{?jKRKVP6!@TTc9$!-ZS!7BJB zT3)prw0vO^EUxvVsKeQmK=r&IjMtt^0XD%bsr(pT)S zh9ox%ltQ0E>l6EU#Nno^_uix_bH-Fxi+f|ve=QX{|DTDL&SQJ|dNsMEvkjdjME-ff zZBQZ*@-NrqLiGOjfoH^Z%B24t$1`d;{+m=uQT)YxE~JV{y2T( zbXkAEj(}o;d{9^*Y=QwU@|`5VY<$5*%^%r6a(*LzV?Jg-=2E|Ce_MRpe8B#e^RMDx z%{gw-ZMNC%PT@uKKa9sM>^|+C`UmNwszVK#Hoknv#U8TBJvqFE1oO530xDpr}R>_eTJ5*pJd#IQMRPdI;v(VVA^yTu-JkEO?!vhQ~8bZIsjpAa81 z|H|@!?Lqry=VLC-bjxIWn{&N*r{xa&z0O~_G|iS~TeE$f^Gw$a;|%d^v!>WN)L3g7 zVykzaWgI6qn>9LhuEwMGXo`(dOVpO5wz-I)u^0^kavWhnYYOMGyf6<;1W=9*P~m@a zYdFWX)!lTZGZUcai-kOJs5rnp_R7Nu*+@bgI@{WsX0>d$=jNM|=Cpi#YrZKdrsc1< znw?2I-=LCb^(5_1yEp0NpiRq%wi;c$>IhF&Y5Bm3vd+xQzu~Din_75kFePpLyi9sb z%F~NUTfkr*Zt)q+!wC=JTU<#)Hl=?&6>UjPV!8a;rare`|*7~Tz8?3 zSgATx0F#KSO1n9yn)1y(+)FnL3vT}6mVE>JNX@=mKEGw^=g(~UmgGG2%;$9UBLnYm zAgv^i7)i^9fe#+-C8Gyke(%V@Tcnx)b>FRkFjH8I5K3`Watdz2ljDQm;xT{w!=4&X zvu8&vx5OMx%b!c)rS6})X;f39xx;;@pAPDpSXS5kxNfPi#j?63u4tAJd||V(Fj+_o z3!PexrZ{ZOC;9F~De;*^SK0BCVUIy)oBP__H)!L(6qSsHlFpngl(fcVp`u2Ukbb&{3vGd?UKKS7RDdtQPpWY8g`OL{y<4As4ggthx}!zjksLq zh?ADWmnh@iUdDU8tW4u94n;~zxP9Q?Nv}jH-5?o&A;c$Eh4T?1ku+)BzC3?*KFv>) zB8mU8fk_1$3icNqEf9YSxRNrOB#|VkMD9&c>xJluA;O;kKYWj~;z36wZA zVlmF_zJ}AIkN+v->o7iL&iW`letlr4e2j0V-xkx?*!^kwcu#epA}t>oT$9VXD14vN zztRZVfnv8i1{DL1M8j1lhRoD;ip<||%82>yzPE0;cgBiaC0>78a_`2)17Cf3@z%+Y zE*scKa|gzqK5$;VddB*i;rD*2?1OPUTQgG;U;l_ST)U(({N<(oQY$E4!MVQ!~U zWd#|MS6LonWz~N?N@>!$A`K1Irf`!kpw*6?s#__Pt&CQOgH24JQB6<@Sq=%$_AT~N zpL?`5ELB885oyHY;^oDwi`N%#E>;!0n(y05{HLtHe*8Wp(L1zHItY+p#ufHNB1R%xoAm?)WE> z7&P&IWKrpdi$;ox_iqW@mQ$>`&bDBPWS2#iiJDnU2$8BEqtb^i9cUfluo?_j2dQ^j z40#sEFUgH+a_t7E)sSa#lDbTPDhb22Hoe}a&ER)-cI4DDm+fohgTgen0!64LbEL_S z*eEaf_RoHTg zi*}AgF@-~*eQ1NEPhZUNlf;4?Xa)%SaaJV2?P-OOhS{%i-LDUu# zR;Aa*Yt!VAG=tn+gxsni(`kb|X165H;>E-C`XcMSV$hqzD+~w(f|9|WGzLi`m<&z~ z&JL~*ZVv7a9t>)N?mEZn@}Qd6FIKNt?^YjF3u@Ppl3gcdHHl5=|LCmDa$&|R9Nfy2 zXzSzgBxUEsiAh~=s{i4C?%VMxS5_MDMvnY7s^z1ok&nV9AKPlylxeboBD8g8gG<)Q zGg@}RCm)4H-otA;+ellmCcCqN&-_!icJb}InQ&iLHnWIQmt6s8El=(L`D2IP8hZ1@ z6)Wa!31~$}Zrhauy9`K#DrB8E!F}&JnoP-LgG)T@>=XN3hnWIc<7b-}ls!`WOChErerje& zuvx){c<2Y}m7KC8g_PX=R+^{>{=WUaJ6<>?W`6%WYuCQRzrx4;um5)7tKaM$IQrX% zlx^9=mA%0)t^d=X*02B5pZMNv`JgbKtw0HmZV%?_jNE8HF2!}m3+!ekV|h5Ma(9n%j!|q0bTiyjCRG%reJZ7ZmXcq|CJ*c(&Y`) zv~KW|HU2$*>UYPj!3byah6pi6{E;;g7IDS)p2FvUP7+fhw{4vhj%7Ar_a*xdXXCXe zmjW{yl<#ySor(!Fs6*AK>QMWsD}12>)KsIYlD)vA-b7j5Q*Zv+uHPJZY|g&3ZKBCB z?}3;04SY*<`<`Qld_GH_^}8LOGgch=`2%l^nPhdCVk0jk?8SZjzh0rZMm{KPr#pOEsPBC3R9gBECfPEHa%35UnybQJh)Jrm@XI?jVPl=4xmg_1Rtme@R1lbGH!OoM2Q;2h{oO7V-k~yh%>M@po^=2 zh+tIQ6|-uLjO>8!38N%Caoyl_@7}7Or@`#*AKY8_cJQ49R)3>Xpx@&5BditK$7;s(l zyAr*Ey#nzR_SX0r2T=Mc^yKvGut8|t5I~`iH)D1^?q0uLOhcklwl_Kgiy6Q<=jS2E;)Hq4GPvaV!Up1VXPy z{u>%RP)R^e@xE@gA@$iQmmtF-$S|JPN&bZ+X{n4!P%=@GL&AbNESr*)R7&`#1`y_= zldIv=N`c0G9R#BCH9UKK*!MDm_Xt6RXPouvead%S6wmVlS)4}eGe` zxzEknh8~J207r2A)&BS$lF3Oj{;v3nc!1bVR4fb^ojDCR>_Pe`;JxN({6+e~-H(31 zo%4Iq3L{3VdF!G_psDwGM;Myqa%)gzB z@P9M$*A^;4>rAZc@f*Rim0>59i}4~&AY_OoZedbnX5qDjd1!X>VS?5e0SMQ#a%x{r zq|oLeNgCv<;Mr82 zxZbSVp87Z74H$G0Q#1M80a{kMgkIh*LBs&pz<3$NJz{vy^p?y-HTh%FW7uQL<2sD8 zJ&Ux6!V?egatrc`pGWnL5{b>spRAfeNS|VB`_FSAH^4M7d}HUeClrVZ*&b5#l(8Rp zrN$1P-HQXQQF$>lwERKmDUvcw&_<$lRYq{0U)OkhJklAX;F_&ofEgl`Eh*RAUcKJE zC?R=ruQf+=6BN@PBoI@!dlYKpl5JwOpC;0OFxkpu8GWkPua38et3vW%);{^GG3=5M zGB*4==MtzXPc0)~ISz2Q{YyYR3N(HjxYXP%|6P0&m77eNIFRB zBvYC5FpjGARdpPs2BdGnm@;FEeN}`pjLw*7At@RhSB!KUX(GXs#Z`|?k)&Gl{DV~<3N}E z>TPjHVJOJM(Tv>!P@bo2ZPtOYw9|vT4GGp`x*n7TuIAJm5yHR8#P&ITHC_K))wP|7 zuoysSd|pdF0QmlKy;UOr(X!%hVu@zkg=<=8+P-;e$jO=Io(q1P55p&frFOnhU}&TCf@g;gKnw$eLX56mTm+{U5#Ty>TVVLcv8jBSi?@&i;rU#84K%04 zp%l~yzr}?gyNr5kePtt4UbcC)?9GBr(>n2=h5TnBC8~xRhqb|?QSh?g{14n^Q!H6# zk=5SXK?CnJSIuj+Up5`^d@Esly%+2{wza8*RC}bo;O|1VBmPa15?_bxRLvv5s+~!Z z5&$CbI*)h6SlM%#H%?i$ylBeSNFtp{IHVZC#bN~?Ea{YXX3TpqBleDDh4y;pU%i6$ z)>77yxFTADpyJ19d)3`g_$hxus=GP%oeH)=_r&vv*DUTUj)-Z=x|yk=x~@WZ1w|TJ z4d^vqNy2)tYXVwSjyTx&a?Y@7R^PzYJdrG@niTr7OR)%=hx`wL#Cov|ao_L(H;V6>U zcp+CTYe!VctsvfR#Z|Hk{N~r7FiY z9;7zFiH&Ab@zBpkGLKpJj5*(0SBE6q`XrB*2XmfIBhhs4*zUfLlxnoH84y8%M5MbN z2JrY;butjjfzn7xL72ocFZ}E0@V+SX>v!7j$_LkBUmgW92sn~@ENYIokTU>Wh=0@m z)It>VgEat}(6uk-BlNxI(V^{7_ml&_6<1F||FARE@USOVk3s+3OU5NTLajZ^)#u>% z0THc)-JjQ*^(R>%0Z3y$j6S5Z^1!z~kKhe63g7(GYm^sM)vF36ze>WP)y% zqmH?l1PTIv5CH_Gu6vYx^I2hr^?U>*A_tR%x7R#P=W8JzLgUzLmpD5#DOn-kpDcbd zOq-2COatrR&Xg-KR1+bKnE}Y9tO;BSvx0n+MNBtL0I=5&CQ*~|FmM1kQ6b>&9BZPC zxb61GSc=le;%1j(urHEc&!N`UO*u~=tbIk&2}B|8p+``n6M=-r5Y(?6MdF?K`wj_OMqWzED@22d1Qdy=z+ zxCbew7jdh0pnce4qDcTi1f5jB7#FUbh{5R)w4vzYBFdTee7ZGNC_mfeh$l(LnCcj0 z6bdc^^d`|R7-{?FMcK?x{h6m_V9~ja-Ns_bgygg4`dF2y`^9w1u3*xF74oJs7qG?x z+C*}11xLdca-_w2bGq$oGUoXHRH*wehg`{uVsIy+@8y1tR4l;$V;;rtctuWg%l#$P z;CQ0RBFvx{`8~wshxjVL^UL%La-NB`OBrDu?@tk;?B_6ri&;@A?EvdA7k-x#5U#@6?4 zr9U?WUz-OzTDbD{)=*jky#_&NNw0SyZ8f=b@QwQ!wgcFIl18x@JJnFE^YTwqTBZK> zXH_%b`V8H@Ef-l2X%YT(9>2)X=l&tkel_m8!;72yXf_Mb@ZaB`Q0b2T8~o$$@5#0) z3qR7~?2pNQ4!G8e&5iFbKaTymccc)b$-bMn>Gxe2ve&p%07>+*P~L3Uk1%;pl}EE6 zayf&7*T2?!5572mRre46*lnz0x3%t?_|<**jwlU_Bz*pApbItFo3MP!v~+W{62vz4 zQygCeedwSBnaPMQ`-x)^;d=>!&|Qj~T9XVEp4 zj9UJT{p!PY6CB6aHywXkU%PP?VPybm=-`s&WRRPHrC98vQ#lr5EO3@RB=_kYwDahG z<+(HaxR#MX?zpA_#-oty0@>pF_x+*sTlOJ-f`HlwlshfOpdTqo!3L&!6|Sz*NqmE9 z?P1H2>sAt`*C|Pq$0<>vXDLzFW4ut>71rU^>iU6G_h9pbm{{SCrPz`}VJg*Gxe|)f z;)Cn}H~6=`Ji8X*nBm2X^g=UT0=LR@ZjGe!KY#bzHZzb0EH|09+HD%<7u{DE;TZd# zVzdm`_Y%7`Db(&S^;SR4_k!Ri>$d!F5~err?a8sDw}}uYWUVTD$n?(S!*EFQcLV;k zC{?eB8!^ABvzJRFG?X6Hz+rN6R=!s8)olg>Sd)n~V^JaR#gw5CGa?pA&Jccxttp)u zJVia}JwYo3EPACmMcrEUg5MZ*5d>geyzC-Edk52WKo6WRe8=jdj@IKdB}P)I1;u6Q zFG-VULx%j`kDznBcPxYem_&MbFv`|M5P_I*R)?+v{{qLIVfX~q;}XICH1#GZCYQtk z6qHj?q^2Od`j!ADG6_uBh1)m87~t+>XyDY`m7ciI{V)ipL+i|D3MQ;!HH4sB;7Gcm z?H?!4a)`|lhMapEUv3{K*O-f!D(=`Xvc+46U+*m`43$^{P~ZE^|2mD}&X*2vOYI&~ zq!bOg`cX)Wj6cl{G2+NgGM|}JPlEXZa198Nju)`;;Jv~ywfgVW@oO$s`26ECrH3>a zeppDVA3{pce+HsNN#bBx)JKa&A3AFM_{~)0oib6MeZhMbGK2cQt^8I!NfnGsS8#FF ztjEabaFa8g_lg?%k~UQ%BZh{f=iy^L@c?$=jseXG=^bVbcx=Um)!^_Wluk(k2-o6+ z`yFdzJhw!8SJ)W!d2l+YO-A7E7;GZ$SO#oMBGekbza_1(_}K!p+dkTT*Qd3Yc%v1t zYJbl3Hmh*CLtdxA-V^tt7T*t_#5QL?>;k`3KP&n|u2a3<3_#2p5FY#=79WHrq>dY} zaDRImhp}u)v=@V*#4l)vO3Tpz0DSX|ISSbf3>2x6lf@PjjZZ0ex(BxBv|kz%8t0qg zdc|SKVedkNx#R(i2rphHz7dJdgJ0DT_HXg;kzZU7C|`Y(WS`Y~h~ql+bXFgDDKX~` z4~DNGKZX5_KCuI?zVP`N05_)#pyJ>lE7FQ{;NdVnfd+a{4N1ciDv@P?InC`(2nZMs z6UsZaGh5<&OE9CfGbLmD1HYlJjZ8&yRU3v}NJ1zdu@hBWa1WxO5;JusAV9Xitipdu zr5TjQmQF?mQS~uC1XtY4EkU{nH39-dK?6*WdA%-`_B5R*;1u z5R`c@>~DI&PZuOk+BqR^W``P4}>ikFaciseai>K<~`EQw%%c!j4LsDjuv!B4x4 zmbCHY7W_!@>x|0GBHW9~1~nR*FcooGa)~>^AKN#-(sMPKZ**QeL;F^*TtL ze{U;*2$}m+PO5czbTysX+GaTyl&j>T5U!yd?%V;Z`I8?763CX<`(8#pUGC3+;1^cn z=A5rn3p7gptq_M?LBN(SAj8GQ32)gw?+{D$qN0r|na0UiC;4c$fO!}tv1nlfko+>C z>m`#LewPo#{;1xFcioW&X&~>2mHgpSH4hU@dnN76{yR2bp;;v-nD}>WEUDy5G^jwr zSftO(L>2VZNtH3DQKdZ|>LO=E>gv27{PC*a_bkx3yr~LzPo0LJdU<(WlS0e<^8Hz2 z1$|K>_2iip@A);#eu)lC$Kk;Mu(F9AYGR+(7zO8@;U`z|aG#%6!Hah6B%STH<(E)o0l<=S^V9mGonedY+~CJ`Qb(~7M3U67nT3bqbkL}{U$ z6-xR6FaMn78Z-}o6k<15}WP|lxA4qc>B0VQ_byl(K;T*b}#4Hh!TPl zn~zW}d5so3C_zIS7+a);c6a>Xueh!U9O9d(Tl0?6@*H@+vrl`5oj?-;X4hyCu0IPw zddq#U{+RetjP;wi8G-;HUIJ5}M?QXN@A>qUel_12WoDsb!kk)b4OVsNh3GYR0lQkZ zw;l%wuLJ+oWh%ibPrXxga)3=5yxMbSjce}&;pq|%6y+Q8}#1^iGlPzR?7#uLJqHWZh`NE!j(9IAOzI# z#Fen1)r=b$?In^V{EE3a!3pc>)`;Jp!=HlJeq9M zKa?Mw{A$TE&%!)EyogwI6^f8usF7*A@VfBAt^Id1x@M>Ar0aAe zqm$RT<63k)vb1JG*H*R;=ogI5D`8R~QXra^H_NLA2eH1YWN6TA78b`ACL|A^6A?uw zSu(@5G^RW;W<2@Ut26_^q!!@W)gxXu0GFZ3A!g>Xr#blMhdH#2m)lFNq+qhL1`QPt;nwU%C7l2gq-xCU)|-bzh}D znl92Gq?oz%hy|ROgr^@?msLcOV$>L6&Yw6I^jKleZQLPz_ey|gTEu=RV#G(CIFv)s zOrVyj2^if#12YgYZe#!q*V%-gUUc9{TN|9OyP+P_5X9qbM7Mf?m41XaJ8ZZeT_GJ@ z$aX&F_&ea9{m?JBGxKkMO1yF`sXFnKQb&n)zPd9A%>>$&J{BD;=I~u5s!S^NUXhM;xw9bo_qdhz8i9k*-#YL16 zMQno7IUoG|PFvVotfqx5PDAdkG)$QvpC?6?S_CCWvJb#_H>F@QLt%_K=gh~G`#G5% z+;VpCjM>Aei8cAsLjRR^>V{H>v;sLS76Kn4A~AS}*BKBEMY?dl`g^~&%rD?!kDl)f3O^h$e@F_S zpbvjP8+Q)}Uw|Rjj>46Q7alBk``ZkA;J6*pE9iHiAT)G5CjYPZq>X=jgRkv)UWeGB z#v^oRgYj=(O9u|@ZXf*JL0u|QY2zB~NxUK~xOKGClu({YvXRc6Y zNh9?#GtSykB@f_5(w%5OtbW9%ix5k^y+=tWlCE|_oX<0f2NrJwm>vpAAA06c)zWl& z43BmM(LRkTxo3D??B~xb-4?wM@I+@eLdu9C36TOC)HG!ipV!#G2MgrRp8k1M4M zO>4lu7=mRHQrn^DJ7m|r7b~!v!G{BztWwS2z@Nw^J^Dv`6tp<8WTHZ8;%J3}x7tgp z*&O@S2-wZCc9cMn)Ez|Y0WnMhD=Sd3z~PC~2g_fkU94NS+s7W=-#axhyf~2B95O?U zkP1Ky$j@-^abCvG7vKqaPzm$Nj^eETEeUwX?t0O=9i%1^C&o%}bp00fS{Dr+lX|i! z(BYSQ7wwVmLA-LEt{(vEs}~VYTMs9#g%V&7NQsjpCMw8A$d|?w&AFZPl902*U_ooa zW`%@>2psU=k2lP%?Jiv|LoJ;yc`YL?p(v-vBM5!#`(@4t(fy}bH+x4O5YzJ#322vL z(2)rcz9APP>myf6JRR#YkG?oR6zy;ht2ZDoB;BFtWwpfp_o{7vm9JaZT1gcj2W-dW z+DClHM>=HT2O62B%affZ>X-|j6Vr_&99cd<|BUdHk?0H*Wbg(W?z`^8?lbO(pP?{e z?ao)@+2M7W*@xk(YgMgQaa9100c^5Rl=-03?Z}h$r~=wylg>YC#fbs}FP#Oxwn8`W z<@kYCcl4q4L`DbD5mY{j@~krP5aZ&k8B2+njiFnzHxx*TapP7;cCzKt{>|CBQfYHp zXW&m3Z{O;|)|k1-xoA6>JD4>G@-DS&B!Z-Z6~9J`YgT$({B|RZVs_Yk0K3=(lSFoE zhfD4pVmYOsvi>sLWuFK-@yg*5+(@T~vi1XL;l@ygqmEZ2g6}`__KD|_$ygHb4=C8i z!CVnuLBBN*WddXa6ay3q$>NfX5}+gEPsiNM7Uk$b{b7hr?PpZ09tV4uzY&}@HYx2JVaND&r38luUvM&n1H=ix|2#xzjT5)-f$qaR02q5P+e9T%zI8%H z(-KKt(WZY(wC6Yu=G}wClVAbL7VoU!6Y44m#0HSh`?-$jT=5W1IeD#VQ{#n=({B+!c|_7PxruG;ad0cyOpY6B0BXE0Q+q46*cXMt0pujwzlj# zXW~=_u|}f~^8w{G3z&8hC$0)?2sfB?tW=4!klFM6Bf&tSu6LvBOte45hx`Oqd+Yp!=VK7qfIzwiggPlqdR zLQ1>k*Nct|6^}eym0RVi(LaeX#nIl(k$rmzR|5pzut=r|y3F9P0%6!Jp=8+oQr=ij z#!!UA)9vU4+(w(xlGPzt|C}AFxfnxn;`Vf*z2U#3oC2e}oEaM%K$4-!(~b@-_zMJy zr-rB3CZHzCo)k!9KJYupr8N`9S-}C6N%vas7)tvU^Z)Ls36}+f2-XVx;ia1Y!i~CM zdG2BA*0Dr@vPP!KEI#eboq zuXL4pN}D)IX+L$&@{Gj)LZ_^K$$o0_BF19?P(B6S-nep1EwQ^5br1oxq?I~KvL!ioQdR^&&inmPF zNM#*mOJM{zG*{>YL1n#7bX)9IB>}RXlgk%O@JXE#H$aniyFo}IEfE4Pw3QX$VLJ}M z2B!;ui`0Puf6Li!C>%)8Tg>RCbsCgfKes+%pYCUp| z&5ekr&kaY2qAcxNo0okDvJDtC>0YD(4=;H+vFS3hkCE*7CEJ?!p$Ccw1s(v$>xnbz z;+HIhpm2>dE|tMRnNx4>t4AOltae{`6`b8VhWyDrD`3A9n!xohb_p~=W!iwXEzI{A zPXuloow+t>_D~cW7xc|x+~h5z#>i=>3xZJW*&!?n8mG?yC1I-%BtE4lB&Fk~UnFbL zZ8j($sM#_AfC%~7@)IzC7)LNdyA3lm13VN<7pLp1C?V@*K74Am3o<-1!iJa;@3uJsnItGd=OQ}+jDBWEP~Qx7c+VbgKAC=2zY#{iL!uw z&B%=!N7u#b8rTk-nfFuzN#V|l4vRok-Bp#%PL8neXV4-Hf?8iTBN;|V+!SSsn9Z^c zUYTH3X}1961Hi9w1V(6tPO`_k-5zbM5+Z3aQcl9eRUBxlA|72zeYio2DdDc715oE< zDy!9VEs(EaeMB@rgRnu7)_2>D(6%Ibo=d!~MtuO@{O z=k0+GBdsiz5H9Y4E+eg~Bs^=wS_Vm8F=`TGD1e9t54dniH&Krx`yu(Pr){j-CqY}L znZ9gR-(N@=oTCP%y6hAWS@njnV4~J10$G+(Uu8rFhxlyA&65&eN(h8IzfduEyO1pP zf#4Zajr%=VftBb3(J`ipL>9N`*SJ`+t%2f=>hBGC^pHI<5hUpDE*0l(aoOFl6c zRcbyl5YnqZG1!=OKJZUPHHAjysV`2s;}#_WOXW~=A-c~XmM*+_9v4>WgEnjz%d^Z_ zi%Uu_f@P1+v2Qe4la+ae7;H;@#)2~%UqNupY9DZz#-(pC8_v0JFpT0w-)O%06NezZ zjN`=VJ6swCRln)6ECvq>{)4W=2bBKvglVKw|q_ezx*vlp>pP)DPex zq`3#?flbGAJ@TCiSgQ$%Gi@v*HNX;FglWepJ}YSl126LGF{74*ObE)-3gte?7za(C z zt-ASucP@WRxcMyiv_~vvHOOv90T8sSZiX4Ot9qmK8WjDp+V)kS4c?K{DsPR+7}dT7 z$Evk<`>)&ew}XlHVLgy;_MQ~=D{lG?+GYLmgif9u^=o=#eCNtOLI1k?5WOu6?NPn_ zdczEuIR9wZ^oRQbUM{uObeJURQ5WwY8UZG6B?bq$nr+U11xdfBRi@9 z;=)|2-hBCkHkWn}RTPN^k(No`!SI$z_-D@1){1+7869{&Bk+%(*Exs1@eZ`B`4i~z z5d1c{xLgbET3WqB52)@9Epusm!)-lueAeI(_Fd9K>F>FyTKn~H$zUxaue|GyKA`eu z!0m;}11opb^4ZH9RBvf_A0VL!bszW!8xWIMQMbpH-5Ub6y!$;3DgMOlJAT68ul~*l z$u1_>hR>_K)%|hm_F0}Ox@XSuUVv|?p?4u~c<;H3T=#M**JA<|pO8-bGS90o-~lC{ zxK3`JP$nM8x5in#;a)u3QDw_m_k^ugOr}I-w}&{-5`KZSwv93XHI~L${m)c1%dYAgf-aAaRROW*3`<;M&C(Myv-$|&~a#_A4FJnZ{o4%82F2HJf&K$@_9onJs01OQ!EDi z>4t+WJ)vek45LrHvF9H6i)GI8c@ISLfG?!duP?$ysL$Z@GG>8TGoOLJ-|hmV|JlbE z?&6oz^x~Jl{Ooah?j(yqoSBc{=#yXU`H!#ur!V6-0P}}X`lpleThtesJmC3@q0}ko zw7LQl28>ihnf$6BHbEE@23I1;Ga>)b{AD_6-y~r#UwRGPone^8x48BIbQT_A-$XlVjZx-lD0 zaFiI+u!d;@4+dWdc~#62FM+@riHncUam7Qw4*?xL;NlK9+91LG>tg^W92$C8^rY|5 z8ogHn>We@s%o&UccCID~8 zAR^2ijkwRu2@}@e7|9GB)}X>2Jw0H8Z;tAr{9>Emov8O}yVre^nE9v;?dyGRw117g zOL!<0b&qHI{)TOYa|n<#dw<8yLpw||>*gJ)GVLZGi89+lJ6vaB9Bxl~>_eKO*;Y?t zdMAJ&7&tvc5tQn?OOh9be<`BNc>E{}5AO{UW{Ex5$Zw8F&XRn8ZN|U{fAlt844%%nr>oEkIN(Km;v7 zBoHMaN^2p;Mz?J+Dz}&&f^LC^Zc$d0@=NZgkw^8*)`A6Q zYYn}K_j4(qurHazi9m!9bHa**!iX}0i86A+cJQYL2Lj@QV?+@lNT`p9p%h89#zfA? z4LG^`es8xz!4z|=@SC4d<1*GMpqnM z87%rH>;f~JD#+}iOV4blC=(-7KYzTXNh<(Gl^p~m6cNl8m5t_uYP8MalSXjBIdd(f zG>{Hbkp={jlao-Bi=ZUVk&_pQNsGqChkPcTXDOCC@njGRW(az-`nSb5GpyTdl0Gf} z%3he}J7>f%?n>@ZcTJei494x$;iq1h9uWEESPDhsukz0n-^13zp{rG|OQp(XWZdQ2 zW!nYskexLJD7ir$u9}+6a4ZX4V2@#$JY%)Qa|6TxM{G9!WLi9-A~!Dz1#;8MC0Xcs60Cis_Qyhb zV+8CJ-HPVlF35@hmf6LD#>wU=dLr-2-s@X^(dda3 zd81W-qkXh-$KpL>e3~;@6ZbNSzX^i8erictZ3XuBZ=v~v!}^00JR#J6;c_ml-jVvp z{M6}$`<29!k+!U8^h1QG2Q_W6CjYD`tpE^LD@D|U@BaiFepX~RC$(A_S1U%;lPu>m zC*?aYrBx7Ddy;s3Rzx=^rBxW`={BzVG;eWMgjE!02!^u#Bujt7*?DepR(d(Fz$C@h zHm|UnpH(ZtWf11*Sd{fAKkH9nR;}oNd|FXftuU8C#D6^Fw?n9-4@+l93;@!H0vh+s z!aDzQUYJP=oT=|utq8b56l5nNLiao5Mlj^YH-`NWcj6hilPTUrTbmB6Eek}f%cqN{o#Sm28q^&iT0fKKYZ@0zJO6)Os68# z)fSn;L2D2x+X)Xyc`{XZ1qXE`7G@F)td$Bhj0NFB&bRwEl>AHNJxH)-DA0{45Ch3>&&_%|c?KZ!DCgb8j032sCR^5)5%&1 z|0>+(6td49xG1n}|MYPO)oF5vwTYo4vL!Bd{*Zu|Dr;ydgsYhL=aFkv&{994Z`RD@(v zBHjkeyc3(XjbzbttQnm3I%LXW>$HPZdKNF{Rq$?j{~zVqrv3t{&?7;1K4gnZg-_0jAvZ0KNZ;9Sr7z0Y39O5OGgr{mA?hZCL;ojS9* z0E@@^&kAWxfWKLcR`*;6GlkzQN@8j9_d93Qz+i@I1t;rfg}=nnOVp?dj;JBA4r%m?G2hlfGh^i*ChQ=F=?KIT!nR zSJuR+bpXt_LN8;VWz%n;1whZft%~GSp1YWZMI`gWA7?5@>D{Hz-%*T zxpp+?v%Hv@HX{o)54Dd*)RVfzB`W}{t%A%^joC4Y$x%&Yi_&T9`xrchnRbN?7t99o7~&M=pdM9?89>R#v;7jw ztNoI1psiZZ7U}Qz5-dTwc&HhYvkxC8qwa+F=>as3CsQtJ?olqOLr%|4*ZIB&{m)k4 z3C-#%C&%?pMIC+%<5t$Loo${H54}UwpRYP6j)Yuo8io%7Kn4@w_>|`1!>x?rOd?)J z&GFQVt7Vmn%~9(`TEqP65};8dY-6SKhe~e@C1v`hF7JXtO^c@4thpcrWyh6P*)94y z++0NOigRKYXSLVr134h3FO(u;PiFiIWlKBp<3gtPDd%WjJ8|9skF&!LCHHPSvo`Mm z@YNJbRP_~exH~`O{f6uN(MV$z@S6Xp=Dx=8Q14pLw=$nYP?K466aZnT`A@kmUqa?$ z?3(&2ozmUhqy6k+xkmnlAKq_ya7D}f`9iZ1QjjP@V>)yBFs0eYgC1HFKi&MhL_V=b zv%+A#4g;+fTSu>?yz3TCCC*dyT{h@BQ8%vnp3O|{WNH_h%vKGXBqo-` z@QK5)ACQ2;=uQJjMDlI!T@FaV!W>61Ja>PN3~I1RRn4#w)@0h?*97Tv=ne-A_p2sN z9=T-b%ZX>lhxDUGLXMI|1WyU@m+FegotP9G|1xbhCE8Iyev$#Bh#)2xJ*7K`iAW6z z8G=ZJp07TXPpW1qE4kQd79XS2yKVUwotJC%j{beVj;07e-coNkW}Gd`kBidinUy6a zH8mL>N`{GKgS&=rQx7v!c!DZ9Emd2Mp)jC%(?sSGU48SMAU63aJBarFtSv1CN3E*+ zoMbx2Vq{5X$6cAfGJxKP0~C92KtOiDeX^Nc;e=h~)+g0)tY;gj1WrEfV0G`!eFjvz zbia?i;`0Q=dk)c#aGT;sXikT_KsTzlJmPACOT74@)f^u=>Yamm=YpC~}>1kS~jFuN&%WVzPeU^0Z5VejOj5 zVpgVYgN~dWWpY}?&g>t<*O#8Wo1TOFy!YOk>LP%H>LsvX=0}q5c|)9M%!l=ld;XXC zTj{?K4M>DON0o1GT3-i6Qg!C=$vq4VnH=NNVw4VQ3vaAkmOFVg>K56z))Vbx4TA+V zUh(oJjr44Vf1DntQ`pEZ_BiDXlTUT9Z?!T{|5+GhQnE2H2udZv{UEf%aIH+M2e@3PcUpmO(|K(82>0j z^eg%heZYKF6wYSGng`FDD>fACI#|h$8WqhA4;ODXmGWKTWMrWDR3sirH*w?J*kow> zTKb3+sLPMI^9V$l53f74a#L*MMf(1l3B>^LJ}@UHh&ZV}Nuwc*%fw3ht|?y6F6h*Y z7IRU<@ScB&LE^nIq_a2Y9uNZa8h5Zac(Sso46*a+1J##lxBW z#fkgVsu6=N6|K=QOEog+U=Ka6K{hg9$wHJA6a7{hKCZ9gVwRxPJ@LXig<uRG{xKDKf9=R7~ zmll_VEi|GfiFGfd%Bwh-(VprdU|5k#+d1KFXa|C3@fGcIY0W6p|8xyav`SzT%(zWs zd#h?ZivEPb`KF8$M;~3t<;T<)wgCn1l779K3!9k3tvj5Jk?Cu5OPy*(Q^TS5Kfk-K zD!Mp5+*xYcT&E&~o+~p zc+QH+$mY*;1-bSZ&U%+-S3|n}ELe>ety|x7@iA8_D%);aXS<3pQ^7XjtUv*K}TizT&&huI; zsx}}vjvORT`>Xft`m>Kghw-+JeEj(1WXSrl?LqK{?G3T*IbdN04xnS1v+3R5R^uo# zxkyN{L+q=)%4ROn!IJX`YDPP|tIIJEZ65SYMGfPF6G>YNGyHVNp{P1+r z_e&J8F{<2)DTivMpbX=eXW(Js33-4)qobwL05zxbkBIJdv8tCW;ObQp2Exqlq2^MIf{}_z-klg~u!5eO{1uOB=fBj7fXfbW79V?YejQet+O`Sd-@WK>ZJ@ZKnHUcfTN>$ICu5q zi*6isV_DOoCd}H1s$apf3gVmG$ERssrpcUQY?Poz^CZ2iE9u0t4eMs+LeKxuAGn=asqSDp!ly7JoHcS;J^;WVjj|p=-yifKgNBF?Q6z>!D z3@>`VLM<+tIxkcXYL`T`apEt*kDaTAVy$;iQ)x+Ztkn2*61b7)N zB!KuP*V|_=M1i{i&sHnf!DocV<@%xQbEbRo)ZN#)Lkq7vMV1EYGW?K_*@$*6Kf=ft zv69Em1v@GOEq~uXIluk|d8G=nzAj&_9)0{G`&ArtHIW#axRN;8xSD2-5}v1znVuma zz@7aOKs=M4Lt@178oF1LbW7U{SoqNBR0piO9$Tyuu2R*KF*^9U1nHl4&a`Z{D6Mp^ zg^Kx`Sd3-Y9BG7BHdcZCwc5pdQBg)43t;rMT5ekQ1R)$I#otRzPB(PyIYE0@Kh22QyFqm&b%rMXY z`TC<*6re(kT-}g;j4;D)7M&^Lx>TH)T)_7sdp2|Stqmmjad7r%mD`kfr3`!aqF1_J zoAdNDcQ~Fypd2Ee03_MQO|;u5Ne(b6rc9{-Ct`C0OCrjo!r9))z^GZpNWmk)=%(P& z(#h!Z+~Mf5ee1LJ+<6JUidB19OCC(OP0_XE9>J*P*`ltDQ)z0BO17M+PxODm#F9+` ztt2IjYRyzS+W#n54~>X&h$gCt5^|v<=;Pyco8w}c`+Hsj(xY-fVOZ7p^6kbE>Y@G+ zhRPr~+l2mQDqN`9BQ!RNh z_tAp=30foBQQBrFc*r4eT^q%Cz*rbYAI12q86|wqE@gu{cogKBP$npL|9M=9)QcubE|(3ykw%l%>aOIee<8OyA=D2(9;fOEAY| zrwV=Kbc~;$z@V#Ev=hy?wR~;o#qrsd6IA1Jze5DhdnFVqo2c<4?a5NR(>7?@+diiz zR<~+&h3hh~)x3juGj&Sbx0Oeq-v+OWX2dLIcuODVuzCToWlnLi|HHLaB9pUA9r-L?h$Ud0cQfnfMa2s}Xri?bfgph_?(Xik zXmEEYxVtYd3&EY>?he7-S=?oV2ZFmhfsl{)yLIbUb@e>`%^7i?K8;4cBh&#D$1+K_aaB|+tyIO>@CM%jW2Q#Oixxq6KCtc-d?g|b1xY2cGYp&dI!lhc6eeZKS3zIW;G$(xAT<97?hP+Y96XWE| zL|tt|>xs^P&ZH}b6(&Xcn)q4jHS{#rP!~DrTzKN|nep~y=`>dF^&gYOI|2YUYU z&=gr8nnFw(O#()>J^n(>GF7uSy))13VxX=Wm6)aS>H#_OH&=Af?wQMC z@wqgNxVfELyiXldu8@_DFI_BMxaflHhR$AGZ{Z0vAe!bm7O zyJ|@B-C{)X+|uc-)->_`^IBD`On_sLR^AZlmY*^@h82J%oSe4p(N7Ib6Sy>)|OV-22c=mMIDlAT{B7GKW zQ6p)>g)U#WyCL={b&vnrU$<{a7FZc5R?`jeb#|`7&!3oHH8wuK-EQ3a$81z@py4>N zy&4u4)?Gz}HOrO*Q@9ELI>!*Vtv~;DuWpj*4vu@;19R-C%sP&g%IQIKVgI!#FPu>; zFFCE|C2|!>x29@yzCq7}ljbJpsii8jvD}Qd|CRpp>D$sdnRs1j=Il#&T1|S-l!~mS zM1hk6*AT=+gC3B>;-kXi6LWE&{2iV;&G);gPE^`(QbWDFo0Hs!)%oatUT$6luCla8 zWcicy2Ig!Xye5$G4`ssx`!e|}+G??Rr^H2f-bZ6It4uO7u&|b{ z-88ELkgdYpWcB`p602tsjESXTjWG85=(rpOl#BHjXD{nEe8D}-jcN6Z)I%j%Ow%wLdusPRs8)CsOP{(^n8M7Xpr3_*vvk9^tVKvXx6_h^1i ztGCyDMji7jw@KFM@@%qW-Bo4rVL|6JxGtsF+Pm!zdSZSoQ=MF$nW`QkrfkkzO}7di z{u$-Tu#P2fJ;eG^Ui?^1UC%0=ak5=LlYvgW3a65JnP%)w8r;>l-Z%f{Y#HHo=pPZA z7G@Tv0A^??5(WZ1Z{H7XOvMh3om~E4;w&r*s^}ic2AWA4A6^+7cVq@NYLziPFeZH= z4Tf)AQlc|Gxg9J+M$SZMX0ODt+MiUV=!%lu@=#bOtsj|d zPDXc>uYKUh^w)dismdbP`h+{CHu4Ru%XOWt|-TvL-WVzMeRuj$4b)}Nd<@R zx&;rnQbioCtSyxxQ$&qgtj3CE!?-B~{#sc=y-H4A-S~#7BkU_9Z9rQG`4KOZ3nF7? zMqbXhbV=mvT{rL&Xt=0^o5rf{Auk19?im za}hy@nSbl4-o#sBN=3*lzPiNTsaaP@VKD>j^?)~FT}es!P9K2LUXSmt<^2UgPX?!J zU`SgfqS}9#PaOF0{#2)lR}MX?SYoi0)6A}Q-6Pj<*-zv)lm<{|eGfSjZvB7&cC_Yq zXdSl-7VL^l%Pe{V9}*aI)U%}BAn#jR!xaN<&$dinsFwMDD&`4=96e)hZ|)x&BvU@gPAh!J|zE6ECiVB7OePoW}l&zlpC2A&y1?M%j2JrSN68s*NbzJCe zW5$OWVp#C}mcKJ;EPZ9YJwa-=qJnp4B-)IBNX+zz(~ExqqhrhX+2D6gcWH!~RumkF zMo&_f!?T<>OSO}iu5z-Kk2kUHlT32>4&6CUm`=7W6_YkeelW^J5RSX+#vU&61{rxC zh7Da{>f(#imX}7TXZ*}QuZX4PXDpVxj-ODKSM2;(Ngd!A6ESVJDx#p&Ef869CW@a$%4*2y#;cndjjQBf?~$tksb-MW`9##OMZ8m3mAD7H!-cHk|&B1%Z7-#@^P zSc)%;-96z1eH|Q^7ob~ta_1TvGnt)M!{!xhy+UqWXD+9AYC5wFt^fARD)VNkjb<`WT;Gk^YH>2pp;`pDiF!QG zK_ThPQlHg9uQ2vEJkVXH%gg^Duj;|M>Ddw?Bes0x;zK=FV7T-3i{nkD;}tLDjpn-M z-d|qcR(@iY3wJ;%z5D8TKe*tRsGF$$a)Uw}nlwec1*fMz z2F{pE5lsz!gU{NsW224>E2(GyUG$_No;GY%%*4d{rSOZSI4g%*0#fc{O0{sdMFQJH zBb3pB4}l6)YZh~QJ8`|8Bq)ke3feiLY){$i{g32spoKYLS5DR&cL@BL)A-_rtl+V`HdBvNzi zDQTP5!u5D5%vr!B%KlH0u zVBmaT?-?g8C))j=g3q-hpZ&aq4s(y)+t6K-&*xcXw1dNcCp-3U77VOaQ}Zf}^5EOG z*vj|_-uP+jCglakx|!)o?k+|J(M7hOrq`o{SdFTpybQyHgk<@N)DFu%MK6kvj@?Hk zBh=RM^F#&e>f|yvf!lwJwn865OAe0SDS(V@buZo_ImOh};oehuiTLt5LuViwwt?yw zytWe8Pn{#B@ioW3a{1OrbfJ-YV_?rH*YHpw9r2=Mo{EpI(wkZG1{yiM#4-<~-+@l+ zDdeN2IFMxG!dvVZ7T>04rPKQR0KieGtthV(*b-7vm<5@4D4Z7sgGb zL)8&aCKGKQ1kjUYV=*TJOtje}ivBfFwvQ*vs?@Ep3rc$RE>D(SbD(3G1Ml;jJKbl! zQ^4;I?xW|kvorRTCfs8>qDc9Y?uK;tL!5;cb0xxvv(A^=KPC{RY;b%i z<4Dm%e&hoKM$ zn%2);Dfw1+CF2>^<+{VU2!+;)oHvCQmQ0nn|ur|+6>h{XI$R1c zfa6=7AR?K69w`4F@pv`cmu`9OAnmFAo?`YYV+oSTJ*tqIKBWSryKa7+1^3ug}WA5aLv5<;1WC$_yY+|Y5q$jXcMu#K3riI6WmrtUAk7Pwy|F5Oh+{p`P?<*u#bgipO$=4AGnK2y5>$wuB;h zcf9<1!0zp{73l#v$H{Fbf>qgDjs?bwZuS#@Goex`>pv_mVel&26r&B_&yx+1t?R(ehOm{o}rsXQ^uFwa?2^? zG4$t;-_V@;TK&$iS`U`ngO++yjwR-|uTLL^=xN&+aK<~DGe&4ulMD{b+<)-z#I}3# zdv(Nv_eq(QxyuBF)qVSKcS{Cmc59v86J7u>3D|T8jSa>^7kF+jSeUC$?tMinvZ$*# zUV)vMV<4F>aasyZbe=V!p+DrQz{^spZKc~PhKD85mW6w->z8YL4yI#&YNn0sgONNj zhJZ79@HyGE#xLaTT`-^oP#E~o5-vbff zifYcjor%*$H-5^!>bS`rxDZQ&FPHZAy*Gxy zA-Zb>TdLZ=b~I&+ouj#8az3k>Ca$#7NQcBbkuC%7r-1tYcY08+oBp8w`wyeJZKg{p z(BgbeW<|xO#tO(`XZY4nh=7ilyR4-v>mbob$NO*PZZm@H!tj1h!eP0Y4BgsB5j`& z)3L<+5aRY>8#x>|cQr()o47oA>b^4@wERIicx z_pznn>%w5`-q80X!S(NPAET5o$=^YxDLNDkE5}##DI?tIP+C+}8f0i%_%RGcfZ{?Z zwR{kAit-=CW=jET)lb0O@lbW}2n`f@Zi-v}a9wa!*=BdV&9BQ#K)>zx#pB<=zSNX9 z0o^D&<8Q8nD)__U-rAjl{$6(O-tH$+S6G!B+Z&aYSDF)x%cg=Ryc+C*e#*0 zB^9|}*-N^9M7bA6{{`!Ge;ofA z^hH@9mK8*FE0kjVlTHQ^7%-d6UCbl{w_wFmK94t7);!yykQLCwTc%{AV(0m}c7BWS z$G2G$(Q)i4mX8!FRCp|Hf(deO9j}^ipf`iw3zcTG;#?B@B;QTl66;%OV=(U*4j79! zEgkDytYw&lFP)s(d``^Px52O*UlnV>qUeS_{)+=$w?J@8WfAN)*x!dIPNp}M`lliy znr(Pp-pCSSKs15*a-G}>p=ceU1@D2ndI2i-(G1{u>%$+<=YZ&o5Uc=~BD6R0-wr1o zS(`;J4XPD|Cj!6-Bp(lFXV>w?`Y1ELrmptB{W6*|c2xB}x42lhZ?h3K89*1OZ3iJV12-Bog}a&E(P4{u;WyQTuq@5apY{iA-yS zZtF^ipIfH2utV@|U2!CbRx5#JViUO_mbhpXaW9b}O=7n_mdIC;yrrDz9Yetzk`?^O*x`KdMEKR7*~q|`3parwiulI}cy~G^H@r4I{)5!Vk`%`m z$c&_njLb{X{H2b2zYs_Au@!@A&87os3FbI#lhX{jssz3Vm8AO_@dalm2_WA*-7I^j z41&tXMRr%WQ}LMX4p$JT$kO%g?xcrc7D`{8qgc9NjM8LJRyEULe9DRCarM+u7sh;; zrf>QGk`Q!D zqcVycQ0^))$K}>FT&_OgA6z?_@->$v4|-V6RxIJ_xc8%#TqSmL%y-5;ul^pX5}uf} z2HfiNc2>O6V&b-UmCLlGV8;r}9dCjAu)iyQtM;`&g za;u}$hVDVp%#4I}%0Y=>2)3PgD{w@ktU&&|r0W-22~_TQgMi6%9e|78oL6E;f6G*! z>M~H`|6m1UQAlS!%a;=Fi!RNEr_=Kse0Nsqh* z9Po~Uf7E_{&0Sy-i6FiQhNyMv2W^dnp(hfQe<$gI_y=q5S=S0;T5+A>+nXnF8k2uK z;(l_jym0MM+-4mliN;V)@8?!^MJY!V{Ur_zz_m-F_~lTBB;}R9VO@1%uQwK=Uxi2Z zI}q71;B2AweC1(`EZphOYO8tO+g3!~j>KaixOsm&q3?F<&U{_O@8|%>9PvW0&l(M4 zLnZz|5=688k|4<*I1)_LNlp8WKV20wBLE`u9ht~8Q2Sb!ub3ic`a3b2et(rUZEO8( zpjW@8$>1`3MUcQ*r8NyllA^U#u`@jr;k=~wUI<8h95j!7QBXC1Q%^j$qrGW35RI`9 zF7~vprowlj;DuPNsCfztjtJyga1c3+B1K`Mx^je9jG1tEiU{C(NWwYd#DZ@(CN0z^ zLz}WExasu-gdN?|%XkK-nGm{{v0I^{YLp+$vG7HVWE{+hktxFfc7+x`IgAUIuuCu) zu`u>QNM#5DGu|kRQ|gFOZ~62US6A`iUi~G)n6;MF`3Ga=Eh|EdbC?&Hk57*4bQ3WO zhO6;X%MQPE15Ts+kxZLU7gBmm);$b>Z;Yq zweC<6nDy&bjA1>iad(@^OH)+wt?*!<<{do3cgIpCL*EEPvf90!-&qpdlP&fJyDP8? zXOL!{{aW;aHH7?&?8l&(4oadk|%GEDW{f zUKFUT!0&Y$eUWNKtZ>UeKZ>$~lW*G3ZdF|iJ<#YsvjW+=>P>Fj4REZA)uu}J6lpDE zX1u~E>Cf)oTq)pk?~S0GLH0BGMPt}1@=ao zobtNs?}K;UOwR_1-UzE)aT7u5!sAn`%$4L8oZ z3r;6a$h34&VOC$j$V8-^!JkvuNCaAo7ivqmdIU}OuOi{Knk!_!mrt*LCV#`2CXr9- z^U5(RV%H7PoD_kvLRZ9?!er-Apx<;z#i)+WlGW(R3+|7Aj0TOAn^VJtK8=!_Md|

    qV;Cao}q% zMb4wtX{Ep5p|jmP;G(~G(I#`b0)ns`QQRWX4E7f4;+;qT67a#+PF~34+_3bsX-nR+!f+CJb8T^9ZQI@f8KKm~ z)_c%!uq`yp+lbBMGq?KqN8djSDStEmCRD)vJrNCx)4qbG%DF16NRy=pT*P!%9Fd}I ziHa(>w(fAu+M?|iI-f&w=rZKFv*p^#Dn84GE81%su_cVZ>@V*_Z}?Yf#xT~{DVE2B z_c&r*0eX6#g`(x)9th`l{<&oXpOWQoS!3U8)S6p76bJ#~mrqIQ4eQ)pp*Ta{r`Q%& zv%1ZmF4H??Yp9=B9UYNv>dV+^iR{*&-ear0g2;kiZs+rptAI-CQOzB>X6Ejq{tHnN z+<>@WOcJTjcHk>5h%~IX*y?@%4BAbJqhR#57XS;^hX5Iz^hV_*@&bS)rTemv-q%G- z^?&$l{ZvRhXC5-x#F)>t!wkrd(c{LIXaSpiaoDH*U)-H1;`ak?KZpU}?@7|K!5I9i{}PSj}^??;mm{);DLci?0LTPA8g3U-&lgi4(jC^-7M4te z7F2kPoRfbHDF+RTo7C!DXtgEDERx8RWCo4oj@L40!gQR>=u!$w2TBGi#}}oKBk$B# zHwu8qFZaN8OQo*S&N!ZoD%G>q5vgr+$on-XNuE^16uBh{%ydNKB6s#T{C{#>T$8A> z=dEtApV9e|x+5Oj-ATTcVLyqv!Rb-`DsU3@x@xOND?ohev0-~g{TpH+Y9@PC_03uVT1L658t0)g~|b zERUZO>e4_u{^%fY;oPfIg~}k&C4UI}E3{(kgQ!yL0zgAhLI6eKz_EQ}A z)~Lt-VVV<-g}IvycA55qkEQEz6syIX%lpe&-%DsN^tr zN5MhhnaBAiP;$B$#?FkcUp@-|f$RNG+df566iv3#9htK7)fKv8803W-_z;re6&`;S6nbF(Vu_~J z+VnJXi46LZiDJS6wOea#>SCMMVB%oWX+1n^jJT3we!~roP6+C>c)j_&B(Qz(|4Kd# zFB*i4?TaoI46}q60GXs8rL7P%4I+yR^7M*Erlg0zG9P-s!A!um7|i|d;3Mo#|CleB zroi_~Unn4_NaU^Q+3Ts!VJSWT=ZLM(fXbn#Cj0BfrXFPMPn~rYY3vIN(#}jPc_iE& ze?@_oqZSSvHCJ?)Hgg$mYP8)?*OaOX`Ue=k95%O^J4Qre7vL1*?ijIW7$|DWNf$Qs zGG?|RPwW%S#0wnzs4oN+<1dWAi>M@+l9*l`dBpq!EoJCGL=nKC(IHqNR)C2mGdLd@6xVQvZ8VNUn0>j-Nswc_;DA4m}NTZdN0;ZMC?KJ3q1&gw<#*|6{*%{Kb z2fpR#evKoB(K_n?4+Gb1j$>6oa;lcFIwnISP*3cb5zn77s-R;|AW)A9h?Rns$9R=? zl&R_6?e2{2gR`%P&9#wP1?vw6b7aI@>W04G#tvk{u|$69@a(k=&Z&cg#WoWn&Il>B ziP+U&AnAT!1i8JZsPHtrFa*Kj=*I86nBb zkfWjR<80uaFz+c~=5?~AzM{*#^C&2weL6p353I*!n#Uz7=dm8OU_7|m)EhbdvG-Rn zc-i@o_*^$Qth;R;2pX!jNm(8^uI>o0#|fO)`$61;rrnG1LpOY1H|~SzD-1d~5_An` zfsB&5p^gAH&+m&h7@gFR4u|zc>K8r362>(T+A|Bvf80967o|dQ;c}wo!(b}kj2h(# zs;UmG-Hs*!5&9M5ca4K!0#P^`3A$lmyhb>1dE@X#ek{UdOR~46 zZ3!_Gz1#X+6iJ4ae8s->-RVZ9kbuaQ4S`)eU#ARghU+v0_ci~9+Kt@&W9NlX!GOTX2e1rcI0vZHLY!+CA-0fSV=EpEayiXlj9 zXA?}|iS;=XOx!IeO7vj-$QVTml{xNho^5-l5Ic4hl(~2s{~^-h;-`5uh7>F~LvV3?J_p zG)Vbt`m29TRTEZwIjI~h&nJAFzgof&Na9;4u}J~ZNK~rjsT-*RnEr|45?_H$g{(|S zYX@*&KVY1VFad+$fU$i$aKu!MX8(Z!-NrzTK?W+lGES6U-x0@D##P35_mFR}qY{yP z;)P`Xj609R-q7+(#wYeAX;_5Pb4UC+*6j>pEz^OH9vS`lK!Sl83L0Q}PYf0Bnxipb z`o%0n`6}*h_@wzHu85gDObmAYw!-?R>M#D<;;k$6UdT*I=Z6l_;%^=2c)fU(R~2=o z5D-Uc2?l)B(Gc{GCM!YD+UK82URx4deS+proyF5s?W6Xu=+kS8>!j!A=-1B)TXYu0 z&lEn9pPEV9k^&t@B_M2L*>?#3WE9w2=AoiT>gu9Sg#@~>f;MEEqmN+rAOnAS`zsNI zF}$DOU`>NSI|?@h&#>{PxL<8Pr6n$N@-=NwWq_jD*h*dNzU z^yNc6(dtu&n_!?6E+v_uoDgZhU%M`lq6}ujl|w`8$K3ZYZ-vaLbU9=Wq{|)3ZV4v| zGFHesHO?c`WGcBxf6zi?+)89=Ms<~{Wg*TF5P#s0)!INE!&+9bCf1@>74IVRBDYqm zT~3v1YPnlg4Py_Zkr3^ho)Gz){A=cu@HJzDs3Hbdm{-_xC<*)dQ7`NcqEL#=h=j?wjqq@7J4YUue?C6H{i(Azz!| zgNLhEA_N<-z6=s_n-E&~VsMzi({Y48UeOv2I|+sBH;}Sql;?#A)JOsVyWttUt%IR5 zu5j=|04!Yc&@NXF16>$-_#_3lYs$bvA?m5&9}T%f#dkd59sFkoH@To1YGez-O}gYO zuU8Vm26t~J(n0eRnFgY+#f06GKVsY17b8x;q^q^0=T*Wv6a~l7QWRuZhZoxkyN3JB zSjmllv4b~%@i$pd*VJXJ3G#5;nmva$E?n=*e;bwxg9VHAs@xpJjZa@&bQvl~2s3d} zZCJIGl$K?Hla-`HMC8&l(8U zVk)5_DAecc)HcD!`v{tO=?<)7QJ@oqlnkqpfb$xij>}Hc#-BwRsVI6U3>QiBF9+kF zLK(fZ#Cy@UxxEenNxV^4@JiLJ>tcnA`!7|4ypMY)^^3xphT^(cnr*FNr`EihD#~60 zM7IH^>MdhE?5JLrx@@kvnywtC9$LDC!@#tL^#R9tlHNC^-wF8j^-}T(9!R_yi&A*1S2!Cl>V$^GTPJ zk71S8@{?r@rXBY$HFzv<{`nz>B3-FRN-bU01f~0KGQb(bW24UFn>1~il~#sWJ))c* z-t2CD{tx;s=Fl93HZEd$FTPggnHAF!aG4&_pPI%&UsJhW=ZFFP^Jx;fKf07^UV%k_ z9SBrhJ=3yyPaV84J*6%xO*?4LboY?VwL=6Ig?9;T$P$!dM#=?O=VfmKpb$qcqN;Zg zT-8@zf(iWGMYL)mgf?@iT&P@(-%&CO!w-(=HFF?xn#F{x_5h^BgPSC+q<(o4d?&7f zqunH!F?37w-0OiMuyw%=qy!bLVMqr^WHj@pJ+nNElqbiXIARc>+y>0J%ua>dYzBuN z_ay#RH_vFTPkNhAO6jO6v2NaTxW{ed`rVd1x~>jc%V`4pO4zyGFEp~t{bh?@FW!e* zb(K$dmkg-&RMIT9K@SWPW6~19U-WSm!jh{ALqUWJ^Pu4La3w928O|m}2{YZhP^pA0 zdpCW_;@nmAQuNW3`ojGpdWTpqfq&ET82iBL;rR}`hDp?PIlKcpgT%hA8%#cA=t1Z( zv4GXD60=%F`J?u^@{>%Z$8m!6bM6gqFnw+JyDXNB3qc)qM1V8A=SXnZcx#0w>_YF z%p?1?FQ6r_egKR222@qPY-gckve&3&O#%0`gj0{gp7QT;x!@3Nn^(VR9$aYPN7!J$ z{Xn5ulxzHZE@^XZ%!(BJqTzGE8@kx-mpc_Z@`ouZhW)C~rpdi*+74-1Zd<@sJEZIS z&(Rb}x;ocu?*$?b;84s>ymXHUBfd(Z8a*F#J$(74$Uwqky0Ej#EwXX$5KAwQ(p1$A zXA?6z5Y5*TY8xXcv_2{CPJDd9?l^7>Y7Pxc^Z$+gn3ATHUDggJ(co=yu#2M?M%e&_ z_(7d0v}8Aa>TPfe$Wcw?t-rJ2dVk~dHZ#*$KKGJfrwabsOUo3raGN|+AoL`H8D()N z^kpd2Vo8k?Y#e9dBJvc3$<$yd=A@hi>LNhLn)N>SXih#uy(UG`*l_rR5AmdsfJ%b$ zRJz!OYFQMF^buf`B(Vm1N@;~XH7AT1$~F2QbQ8j~BR__VB7;-UU}<33Vo4o9)d$=; zUxuHLxDVWoC4xj(3Nhiuk%Oh~<;1`A{$!jJuSTT;xK6O|VAP>f!6HwvV}7s536CG7 z2HeYPDi6Tqx_y#9O4VQ=D991#M4eb>AFS|?!v<)Ws`rA$38yA>>RoK4qHky%WVL!F z1r}1+z7LqvGEd-*ebajW;0Yk9XUHFn0`0rE13^?8{80`T40PMu?1+GUYPW55WfRm0 z9~UONEveQU6u|M2_N?H<@uRIjQPWn={4Vi-2ik&vd@U`WH;$FnTDtOvqpU#j8J{Pkz&|!dwf2=ngG23E(2hgyS+LAB=>~&UTJ{+U zO2I^CiV)#Zp(-LN%$SPCkvynZp)S(z05~l83Vw!hS1W$~d<)D;h)L<=FxGx1BIHnd zW?~%}o-lT0C}RQ-e^AtkFGA)@DQ-vgm{8*`Hu523$*Am3(4JD?92E!PnYP~GHJir2 zckb=@?x~OU@V6wd)->%kw;)REK|zhN@VJUe*5>q?7713u zg#+a4KDyK3*L@{_veOj4Yq%Pn&7pI!Zrv+JwrlB)jKcuJenLB(4g=z~guxHup&D(Gx~z>ar_Yg#LVScl^t>@IIP%&>*5~$PMBvK2hoy6Cz$l z#Cj4wM#L+0Cw0IUUAvsm=P$!QChVUGcp2)pO@EcWk|u1uOk7^m2Nt|b*C#O0NeAJ| z-9a1S3O=H*A9r8t71N8pZbuG~56PWiLfU2B$2r@o$Ma&UD?syNVl$_^P%|2Vw(Iy1 zbh*?ulFe?(Oaw~0j%6^$p$VHF9A2*$Dc>yFxqD z@!Z8X(xwE)>!cuw>|b$pR|$oH-Ml}*O>hCDmQxI$at7I4L|4Put`RNqdLd*f<<~q$ zI(Z`u#F}{{w!~mfPc!`gI(TPB!NRS?g~u<=$8!HrvhyI0zKm_hmGAQ6wa*NS(ysLA zo_%r1D}3d=es}$=Ea8y1CuRMP(+N7+u9V;J==2;?-mZ+UM-I*MDPWm;d_gpTq0hc$Jw@pvAUP-my zP}Rjiwcs0b>>Uj?&MK2#D8^G52Iv#j3T>>Y zzs_XlSN)m2e7x{^aM?jHzSjqf8ID+7Q+$=&N*s}d7*}GvUh$j-HvdJz?YyE5p+c^k zq4D0vn<6+ItL?o^zja8V5fHi01(RZ%`Xn@Y#h>xwjGO zZ2YzyhY&~jqYl|MY}Jwygi zwH1lXwCf530+Bhw6M?{PQw^EM(0`-FK83Je4|DxwYBHn>= zd*^}Pu$D1b6s;&^l+6B-f!h+q=ptuvT>Oj{rc@sw((GUZHiytiTvH~2updVlt!6Rx zIFv55mgubz3I{3Cl}~yr(Y~fkKZ9J55Vq0j*_sDm^jXvIL@m$&eu>z5jG~VIX2CmNY(MpC=AAJ zJVuKA!e*q@BW%V(OgngF{(6*s5UIQg9xW2)sO7hW-35G7HrXB;&wwxmq<%K|dOale zZ1Oz_+n!ld;-vfP70T)gvxNlu2XWp;Q#`jY2W)VD$GyYA^o@Mq){#=Ho3Q7dfN+DP znA*J2fZUQStGF@5S$#yK1=r>mMTX>pnh+ot2AK@=DW6c_*s3|I<`#>7Zp3Jex; zN&#?~kQd8XtP_3h~YJN-p&f`xYXzEcJNlqj728f{Zc>kzOM^qBA2jSd6 z8nFkH1Oz8=q;&+|;uJU{1kJS^6`aluSc2x1L36C2Ijy7rd^gY>&QSr={C|GwQNiS# z7@G`Yx|%{AtQboVW(x?;?pUj0|9p9Yr=rweO<}n(t<6|LP)(srRYB+f>-6HZT2U6m zsIQxWEQZlvJ5gKi+lDVe8A~r0#MVj?7)Eez1`?c05}b<@ z7>50)4dXdGKUjijCTvCl4K?D03To2ng|SBQoUHw`AD@m>ub`i=pw(N4A6`M9UqLLd zAd**upnOk=O4nBT|JeMmppUO0n%7r^R}jN1h~V|k?aAjQr2DU!FAc&m0vL6nntg1Y zti+yOcG)bkc97ip9q?k7=xLf*3;9p8j*=S&i*;iD_lZvI5D)>v@jm|ExfhhCJz6BV z`Y0KFP6_WF%l6*hF?k33(??}2M`b^b%24?C)j`mYM`cP!W$CUH{vap<2r3PNDgZ6t z0er+DXvb06?Gt#8?HweC-0aRz0>TimAri0=6ll)@ti=M>z5&*v0j%XAM$v#y7?NgW z5(8z#+yuZ{5MV9xKYvCVF*gJtfcNfm8Gf_+17s~!xf*Xonr{9)-Apq5?m9|yIf`*P zN^zw_71@N%D{u=kc?&ZqZOd-w6^Z5)iRP#F!Q9YQn=*GsY;I_W%|X)15$4bNQME~$ z#d)cUV#kW&^NQW16C17*8h&A{L~1?a=mE^d4-AP8f={Q1o<+qFXRV z(PyN2>HqxPIP}~Q^xPQq^zCwmt$of{5XNis=fE||O3X1!VM|(90&o}z?#SrF; zOXtty#?pbgym1-mndBErgL~(X(G(VPHbhW5$tjPuM*;73^5q_ z&-+hVOM@*FC-MJBT3$_6pt=#fo0f?)16!FK1Qwh}JbM_vJPq^JF40c?%XjiZlFR0T zh7pb+mbG^TTzR#cgic|!XJL*frKn({iVj3ZhdiA%BEkq3uZLK<6BW>jtp`H(31y|_ zU5nSiaas$nJEjzp#4{6g9Ohm7#=8~^e!k=UIY+BG|B=2tol=xdOvEuXftNgeCL&@c zBxWWoc_uhyChdpbqyMT^-~A--OBLJtnW1s(DoUS26W+U-fSzrzw?-l$0QxfsNqO-onhswtlSo38>evc@w4(fDTJP-#qj6{mai^=i&in`9KLhwcW1Hi zXR)kiv3O3WDaPs9FAz4%tw}m|YgcR8OR+49+sD((SdhIemFqd0$g*(K-!unv$`%`c zDwR}Fi%Am(Q3@Onk$?<>BmCVL)Q7kbnB9hsT1r57th)%4Yyqiv9 zsIg(Ubvq4J&ti1z_Q{Rs_~4dCv|WQg;@!}#F&2A_*gVtly_MfqHu&vgOcjv8n6 z^L;ah}JMJRVNY<4hj^Egsju!IS%)Jkq~9+AIHM z(fJ42jag)H$Aoq4EzK5pb$g4ux+Q$ux}}zI&q9Y|Hztt5*bAIFEejVdWw^CHLI&OK zlfx6-lN~!|t^0O)cpWRA<(|9)>#FB8>{utaPwt&1&#HE}PJeFft6LIUeu21KN5$<3 zE%}bdmaxV`Ojh0U?CVQ=R72+^J_RN?E!U;*5!sjG6Qss)qPsGzb64`B{EGYvRwRNKC9zj#~Ws}eUd{VGy*iczYYvREX3c66MeGu*7BuVugzG?7H(1Sz88M-TA;VBq?2usyp`p-F zVPINVU%x>fOC716B#$X4JxA@adr}fC5|VWWiDam(60!uRMAG8T5;5w{60vDAB{*oN z1a1M&b=UPI#Z29<99mKmG!+-6nl!=O9JfoOPJc-;r==DbjT>7c=6rDInkVl2+o7wU zxc~P}B`r-88ZQgBE|}0rzj|-q$PZT#&(Gfb9qCv;^3KDLUR!Yu;&*fk7+uy1sW zxhg+wcxpFnO22HdIzwr;#kTb}A;spgQCmbg-kWL-MwEUzF_mcJ;u8{eNqU2E58X=d zr+*K~x~!=<_cei0YD(5rW4D=@<(d++?D7Q7vcD*3j*t~kLlvh@O#2m`1_MAB!U#ea z%5lbe!xqDKgJ5`$)*>BulEbh_hR>VIhYUl8qX?CUh9pU9DwU+d0Hm%ai5QEEQd7)o zx6_qV5*%AxY}BaTJUNcO_F8QyR6Be(gMY6*<4esg^;W6;r+!>okYCC^!u&wur2IU; z350!DM>MPa@Q}&7S@2n|s43at=yrE!U*i!y33+ZQyC(al?3dzSOwde=pNr*a&tB-+ zjL$t9lgr>XWE(sOTnF3-vJZH)@m_kvS7g75ACWV3w%lfjCZO(q(0e_v) z6HnAch>)XwL=Z@Xe6myR&PG~FMNp&BChGRk zC2*3YU7c#8w&j{5bcq~i`&0`#w<3sGb&jXb4uX}&$Hm#To3&JH&DlflB9}##w}~mO zBuR!7OoN-IpBUov=C6_@g@%TVr3|ISFg&r;Z-L>Y;YE`v;y8cFuRTuxxYL(V@9MG} zR;-+wla^GN?VZ^1$7_G{WzEf(4`fZ6w(v07e?wLIwAHe!%9~w2rhMn}j~|_TM^8H_ z*e`vUR7tQQlQzk=?##`Z4`vGG8S||58H=sEt*WtBk|~#!WJZ*pK51?!ll6vqOcakX zGu$K3xgh{bfz~(LwYDZi)3jmX=#5NIXx$+`4ydoRA|W~NJ0j^ zMb^P4>XQcXaB`H*3_d_-cjp<$_<7)_<6Hy23a zwT2gADrJ8zXH-dcW_aTaK}d~-0aC^MyiBFPuRM#7fE+h2Ba|td6It%vK3jT_;axc; zHaVw+GbE)OLN?i!9<;dF!`U1CrE8x|*WvT~`xXMT}81 zlX9W8DRGvNWFryote6y%D<*|%M~0ZSsULoWd|WwlNR@Q@-O~L0vRP&MQIj+431RZ- zcgdF{+A|xKjmlp{S(OAYzLxdY1fsPf!(z*`i7qYScb{Sjl26lXwg{v{Ai^H=lkGacu1B{;CkAw~u0<#4tkND5BDX{h zMpx7H6I?B3F#VW5bhHVf;iIAQVM&t84a0xKT}?wrrNThf2HBEo6SX$cB9T%dR>H>h8Jjyq*uXKp zD>sxIOG|G~Dv)kgUHhViSx{%xPL_W-Q%KBWjuXm8Byp^-pj5bOWM@iowlvWoR+N`a zs@*kkI(t%Hd2T9u?((?u7ru&H;Xxrr)YVm)zp8viQa8@ zZ*~iAw?DJStn$}rbhhW{Wk@4Q$f1|@3ASPf%Nt1&eDt!u1Z&Yb4{7=kUtJht-qEnJ z)Zf%KR9eamhr~WyUxN9C>2_197$4_RZ+$4f9|>C)jwF@zIgrm#qH}Yw=G$6+m%;cy`FBKcz@H9U$(V9xwz^6iSm~E z2j74H!I@kBeDM`mTs-}XD~3OtdBY8}<>qD%6NKS-g?Q}R+01?_Oo7E0YKqG%^>NTC39?f=*Mx!yr zM`+W|Ok2L*z&PU5kV;amzV2O7FOqK!rVlaYD<3i(HJt21X!viT;iHD5MpLP&v=mKU zqt1;+d9ycRbm?k}O~sP2F~gK%9?eIUN;q$n=xge6-u%*kwynLQYZ<%u2cK;E&EJ2p zt!l=Ms>-?gB<#si8@=57!2cJbvY4BkBGL6a4-O69B5b4v444 zy~u-)-YZ`r$@;8Njx=)2E*k58vE>a1~Im2bRpoK=4&6|_oMVYtXRk2V-}UW+~} zWMo3j5#?PuDLo@-aHVGijSN_sF&Lko5lpk@(Hx`K>alt9a=aym@z$FS@#WrPAN9J} zQskBLh)Q&ty%NbL4b6l{IG4$#HU`tkXDM?rcv^?wCAO7@~a0!c?W7 zZ9|Zw^do;==|`&4k3_ch(5cUT8F|#1GGtekvzl!-tI=l-TBynEg30HCo)E(N#ZL%{&|x_t&gFE*$H!@{ z1I7q#l;cEcjYK8MkjHZIuo-OGwq~1XdzOBR0#JY2_>5$jV)%_gFhuC5efe9)TO`AY zrXlt*m0JBxmLcYGbN}i@m()}~#2qD{($Ab6A9H&2Sy4PKCyK|IIqr=vB9hc-h}Q8& z>v&^zys@>QU@VQs3N?oEa!q-8%!8A>y3uJMHFZVp zY*S$qck_u;bHVm2jl?E_iWH??;3y?fp>-swsEApHkxyzvl^2uBn^=ZCOMY}wTEQev z4b>Li^zb93_S&e`C@7G4-^HVCwhG#Cqf&ZPLvZ2!NiEt|Fn}O>?Q#- zlT7Rx0!~PiXY6Eu^H&88TY{tezL**$^FT!~$L%yaM^i64*tk;~IT9>sZFSpnitp+e zexx=ePaS%1L;cvr9U~{n!fT6jw{98vbRen@13#!*S5$WY!WmV?S>6(^6kkrvn>cpn z>32OD!AVzwKvw=D-Xgw(ad<;^UOA4~nR!}{Wuz^)E${MwaaWV|DQj}C9JkxLD>K3G zdX@kZKqkt%>I!G5x(k3F;{u|iSnVQSa2vbbkuM*LgexV&9(x6zMra7 zJjFRSpT!H4$?Y_MEIHqnUs{@bww^T z4NcQ#v;Nk@O&eu{-XL2XAsG4%)bOg$o5`k%k$@B72ZdFVH%4cS#HUQG^AQRSG2Le! zp2R|O_AzlOx}?OUgrxW+QJv$-^-#6Rm~1o~1+~-Va8dP`xNI-6r?|bula%KrE@PG# z(Orwz>*d3LfTnTAs8^{fN=?h6Y&2MZM^#f*KcHP~}9u#uBrY zApd@yZyQo8Ux2N$Ep{c}UWntfrm__^POCLOOXsnlqNVe8p_%j(%6GbPsk#ucIq&%g z8@$h@ChmB$FvC%%^@V|NNBKtAnJAeKoFD4rX?g{BLXVw(_iVT?x|A?Cl=UQAJr0R` zA&a+v%dH!WZ>%G|GR-Wi0z8mkZ|8IYltg$Ics6=1G~9ek3dX zFe?4fEB(DmvW_)qQ2Ki_w^E=N|eNYp5@4s?5WfiF!IF&nx+V z@(cX_K!y1N-8o;3Au0w*QIT?DhW32@dF<>(pVOJW=U=m&WR<;i^!I68&OLN5ucFVI z8j$^P`2o3Rc93^(Qt{Xz^$X6)H~D9EbXs3MW@q$HPPWM3zjo5fq{vRP<61Jfe8#ul&91L%Ndx! zz(jf4>|i+q6Br0hEH4t}fNO$SO!9)(;FvKMS~g)qT%1;m2>D#r!CCL@ac*&n8Ygi^ zlyL8~61GtHmNC@R8{(*M2EU}~YkW)@HM_2S@Ysl%eYA5U=53)CZYUTK3 zYpB@8ycSo4{IajZPyF1wHkA4qG2oZ|SNqv-^!X$72039(F=;98Ebb{5iX$ZL=}ITy zAl%_F1`Nbtt(bM}oWsF9j?bH#POvao(~xA4hF~<6`bR@;U8{zoPHU*#aP%lKn$k+s zE{Mh5EEdEfXp(eu5_2z2rKO{P52J53B$Z$L;^rS$hDWbnK0O~?p>Mc-J2zpE+c z)4bcq`hs_gAth9PSz1zPqAM+lkq-7*oxG@z^%TRg&SIg$B8FL~v5=vj)8FmYoeleO zKbSO0U8G6kl8Tgf<+!A@kV{TV3-PYZwK_wRY>W@(GvH&u?=r@RTrvlLtmox;T`0f= zjmwA%)LU7;M^4gPLoPOUF6M;=BFekZBqfJjzNF;yFJLqRDX}VuLR&Sce zDw+b!FoJ;qdsGAl0a^(N{o z8`2`mo3fsz&RR|V1-r*l1IR4k*+*J(oE$GF$$Bw&)CLBgzrX?}MJ?pFS4!68sGT$D z&!>+50+-V|vZR?UmNaW&peT(59RzWBfTvp9L*7oaA-_N5r+#Lg z%#I%C0Vjpi;B+_xPSGjnl{h2hL)j37gYC}Ei6J7J5<=XTSq*x*vO1`jy}saPJ+bTk zdaAb;?|&qJYTCLa<{L^93(-nVUFE|~l2mRrmHJnmwN|jiw&TN}mxoTAILhKhrqWVV z=_;vol|*=wJ?&stFt&Y;C1d7o)UH{Sep#209t_9{=|OP7ruyiEveDf%H$4`mzt24- zWZ{OxSrH1z&WaEiuyDJVpB4(p`Dr0A5G9Q!3G$x#4Hal%1mTMiL5Bm94fLT zm_m>fOrZb+oI}T-9OxO_Xhh(f7KwBWDwHGR_oi+R3jghY*y#`q1BCAdjW)C&Ex zHZ-YX?6^?vdnApR-meXfFX0bLKARc}O`Y~}uMil1@SNpQjrSImlHq&lzz$)YQrb2I=|pe((8nm_6kl4NZ;7`$lNW5ObiCW1*?&d{=+> zd_VVFdZW~|tf{g=HpfU+YvISm$ucNHQ%Vuzz)nc|zg zV{E?fm_IhX-XIqi2knM{fg0pwOK>yu4J3JO^y!bpHdh8dgJRBlG=p>Q01u~1U8Pcg z7vXVLHdoHhj?u|sRgOHv0;~=mWgUHf+=NwZT6|04VryU;`NnE!bd$yBDH>nxhG-%u z5nXL)lKhHLI(%1D!+d3<@uZjOve+V*Uv}C!x_A9j+>3mSr)qg&PS)70DOvNfJ}CU6 zP(7}2O5vQsc}0tgRB5hpz8c?r-wnQh8}siO`^ebcj(v{!Bq_ep z`8U|f96PbIfp>X=_J|VcD=uUBfnENh;ET~BS+1HLv|pY7%ly6hLcUy8lJBU0Dan^e zKATDTK0lvP@c9dvc_=8*TE_XT<9S@vD@jbr+_CoE5#@otf}$YL7ngA?o2zCAd)&L+ zFS-TyK)uu=^++6m(UY+yqd!BH@kQDAf&$=tSG082_zPoS zhR>UZhNZ3{ZZk)9?dXtUh&!c!Q`=MgOu4YI7_uQB{L+fGetT54J>&grJPxzR0uFvsmCcYfOg zJ8<||XIDjS!HgN!{7JQIzxvrL+Z(4`R&mYxkI8EzBj5174sC6DaAIkHW9bHieSCf? zxqik#dUkzo*&-0-53%P0E)v-dDDTSU#^OF)UYJ^7Q;=+&zSa+ z-?=^_@d+f(D7q}hQc`LdYb-Nqi5wSK+2G>u7O<2Y7kjIRMeM&}?-I{N0Fa{eL+0C0 z_2}l%HL8_td&pv(JLBblR5>O32wP4&&n|w$#Kw{6Z;hIhlTGJdf{=;9Xyn0p5Hmnr z$tDxa7Qkf&TrN{GF&cn4Q+hBiXtQal$*6@PVCXdT7{Z1lhT{f}!$1to70F?DW_TgF zr>I1q97^s^-kkh=^08zkS>sP8$qrVU{DLF;IK8Mugc(8fAPg0MB6Mn>n?>raESO{) zV(%I;z+3~q;W3){v&)z#a4v{$vz%|^aP}cm%(}7YokYm_dZbaiiJQcpevkV2bTP^E zbG=Ef4F%F_MlSvB$byT~0-;)x!kqR1k?4yt3pUPSIBgV;8SLXn!yAPCpA7M@;$Gwk zR@v50E>CVZU!Jpnj$D(x)_i4-mOyPXKrpc}>a#WnO{@oITAPEAtwrO9*5^Rw$chm-$k{)(P7ew}>6{B`Q*9+QLkb3!!WsiQNJWwY$j z=CC(qNbIeS=mRBNdN7$$b6nQ4XpyxnS`=q33ns^?M|LKE>M9#N%%5ZtkBYdM`o$~# zNKpEr;|5W6)?Av-H;7SfbZ2LK&Zmw(F%szc3vj%gAnW8LIZ<`)CvVStQ1v4un;j7) zz0X96BcfzHlak|cq-J|OTrpEp%_%9VX5{2Vvu1NjirFZ{o++7(W|PU74EDI_3VEz4 z*=#Z;ds6*>*(5uK8XfFs;*(A0oD`UlBIG3Zn2GslTvjkXn3)+zb37hOi8lLL@=K&Z zAisRt)Madn?$^!CgU?S3 zB{Nsm%x9O|6iSx=pT@ogyp8Hi`<&6}GBeWLG`d?e8ePVgb+s+oR_tUZ7bn;uvAO0# zP0}_564J&_x4=T%m~z`KVMA%T1hx(B0s+eZCnOM*z&2rN(`{)B-8Mkz4^F#T6H2|w z(FmT3hH2z@U@&qK1*Dv~i-qA-FVRRAleR^x*hTjv5Cl1<9Im+qc z94vnmufTU|31Y4#pN*Za^8$dAyC-(owc2{%0ZGH-%t2QU0w&CnA+`!zo_!jbyA%AF zm3F@{;ZA<{qlYoWWqq$cZ(@g;Oh=3s0<4;Rmwd>!3#35@oNJVu?XZ}K_I7`JqFrx) z)-!r`Zte^0S6Ip(^Ti%?z2f+3>^F`Rj&toU0H!)W*F{5;dj)T?xg!qXooSeE?kKrM z8m(YKj+J7T)1|`6@j1O-ySDv0cyf3#}r>zyoGas>LAD*W(pI8bi{2%KQfuN?rVK_XfmMz9j zvaK~RgMn0Pujf?i9)Zmy-(v14*OM z%lx6t=f8sYL1x&5AMsW|{4$g=)5mq8GAxLd&MBSbK`B*;Awx5Oz;0fDINcmm?UZU) z6qu$I1;!k41va~y6i{cK-3ody|9gYi8X33dZc31iOez7~9>{lRK&E~-ktA$MBA&1( zY^ekw;M85L=ine1h636Wz$bx3Tx;|tF7OfI3~CWvxAc+zqp+zq_THrrEjf+6!UWzI zwk!7DIEw* zvf;-Ek;s|8Q=o#x4hcB#LMS(l1_}*`@wzv_>U9(Xx#BYuo?7G7S38~RH2H%7WjUWn zHD)W7d~?(n%wO_hpKJ_gkpMkY=4XIZD27$={Gspcxly_u0;{kY^O1662d=Ou<)( z#hQPs{k9oPpD+mte!oH?(c-{nI0T8q@Hix3IGaK%6IS?seht5wAL2*(Q~V_FI)vl+ z-tBc3C+2(CvHmG3K-{a(QD{^rx)+I z^u5{`Y&tsd@KP*a2~)hj`F*?a(Mw30TGP#t`N`{0YiXH8>DFoKBEW*lQF5bg7l?u+ ze8ixuVpVz}@{Hg^j7G9J;zDuWa!VtS;wEn^U`0H4-;Iw zV~K+hH%J?T8^arw^@(p2JC%DA&nS;2{uW}QPP>iqCS~YCCaHN&$%XT1p?GP;^}35V z?Sif<^gl1kMzoBjjf=)gybKL_L?*V&P_DwDQ3i&HSifo+7!73wKo0bS*MMyjF&^Ap z2>?=mH8AS~*|t`ckaf*Tp+6eSkxcwVZZ`LN+mBumE`$b_}zjj&3rH6*W* zC@bC}FX1&jT*(_s^=>k?GBVF6Faaf#S!S^~GZ~>$K-7~=CNqwwg`ZjZyljM2UACz9 zcoq}poDlK6x2bN4{~N=xe7B_zpy@vnlfN;4C?TLLSs|b&s*}IjD`3BE6;cG5L8$t% zhT`s3P<)+%twx6pVgZk@V{Z-pVh1h=<9@=o- zLq&M?z~@?|IoYO$)I#Wg^)1M)Z0q~N#p`ZZxnjji0KxqLkl(TkpbaiFRA(d*X^eD# zM93W)BsgAd0|sNbKY@1U!{G&m?vgW-vF=$hHEqSz3|a*@iL(eTt!)6#27t`lp8x>O zmwS^&&yrHoSaw+{X_V)blE@KDUelyTfw(T$2G-@WSw2_{8o`0!+Tcjg5p;0tD2iC; zqCuv3)?S5wFx&`FC)98`0|kf_Ni58N`)+dAcmxS<=6CYD`9nMj_yPV9{~Ay7p;8sX zXX`3Hv+T?XzI)svCM`R00&9_Oeq0~!=DR1*!T5OHPX|2GGTkjjuw@X|Dcu(WD{Ur& z(r+nxB;Y>lrNlKbIi2Lc`EzLe+)oc(F{*c_z1r5#tzQPaapM0_jjf|8@K0!eTz==X zN@upvmd<*WiSYFdGRIi+x+<}bEH z8d@TS1X*m*5-<{;rTN)pQ)4Qfus0>O1WW-wu+y5S@``2E$_ExM=gSG6%1{?+n(^j%;6@-FnBt$!|B{0aZ2@BJN8{p**n%VuHV z7r%soT&;Kbi6@4)JpMR;VupkPAfK@dpcDMj2#r$E;qW^e9X6EqBTRQW5DbP65^qjt z?{FTlP%O55%#fSEp+i%YYo>>7#$9H*Z~AS3#pY-!TCaUh?(GDzDtyY|;Mu53I@3)} zg22-YPFI;M%4=IsFiml~oR&jr`(p6<7d+ZJwo;tR`z#d&>y=+%p%Wy!*4 z7HwG7A8670-tW^}g3GZrwhOhTTI!-lZm4bLlnN5jPKAf?OZ~A-d1Y;6#x>LRMQw`! zAeY(&U;_={l>?}M``13kGmk)GEloUs^8`fz4^Fk_`QG8yPgls^?#Cia|x{5h=TmZ0%}+~dfru?xqJ)oz)XKU=8* z2yO*{yx1;)Aov=pWcgp#Wa5qXF`Gr9oD=1;^i5dc5zvCIK#VW)Yxzf!@(E+!YSty9 zaB^Qbf#W@YqsNyhiJO(p`K`*<{B~t~ey6fCKdOx8=@yrQlY0tI?s51yk4Fw)$>VXf zb5tjEjApT=PV|mmiY zd;Ryc6!{Zg%T4DH4Yz2o{}fj~chG#Pxkd}-8|c@6y1Kipt9#{M?f|iqc-Ux=bIoPw zTo6|2W|h2=b}n#~OQlrGM|)VVO00N3;5S;!IJAyvWxpZMDb-_caxJd+yVp;O{wh3e z2y#p*DujYoT0v{BREZV)8%51%En~nSsg*VS2HL20N}JTkwc3z2qTQ>J8hS=U&uCS6 zdN0U-<&nke=DTpDqm_4dL9Xl3uF;9Uy98A%A9Y6^>udA@I?J z0iV|lzXxL<`}|Q81M#fR=^CP+XoeM5W>$57KHR5pAVs(Nfd^V<)k*XHU~-7n%JZ5HvbCT~cy*9}}@Ki%31` zIh~;jMqQqUlsgrn%Ii#``uI$6%Lj=pV=UyqM?{CW$2 z8sY{g&TBz~j$tox-W0{i1k0QzSqfUDDJKHsr3gOXD@Dw(8w^8Kn}_T1&=^2=!LrL% zJ@2gZ=~F9VYuSe8)=SE{mCfZZRJJU++L$-5@0EBW9!-_;VIq-S++yf@-vN}nMYI6h zwmB`SY&M&jJMi^d8RhzNj!y4xG}b?9p6BR*9|^9DGNNS)Q}{w<%d~S8q{1CCP_TJ_&*w)9 zP$|GdsC~A1@5bKUlx8-!=lGfNSvhxD-+AW7YbioRWH#4%#tK_Y_{nyEYH1(rysLlz z#>>&N;q^-vu3mEerFElU4ECD~+EXkJufDH#+m!vfZK2ZCv8r|(C(kkMJ!dT=Ai$NA zqvS2NU4R1(;NOg^Um&WEH|S%3?Azi|-y6ZBp|>M%HN40Eh4|3nITAV&A;fX-3Ex=g zg9!O{@QsG|iT501^at$wqH|qvW5eV2UDOlI)1D_e=LTZE;~M&UcB8n??~qitGpv#f zk6dONrA}kuI3U4`#91JN0CB|&imT`va@kx5h_fJy63^&AtE&SX9K>mV4ugrrIZ7AN z;KTGn3Xv_|-OEw>bc#Vj;c3#UdMEv6*M>T3am#JBiF>w9f;<0V^6qWWcKa`ueD=F{ zAAIQ_zwr`${)TsMyY=0_zh(R%?*8DbpTBHq@0Zu^+69QoQ?<*<`)#{`21@WPqcEYI ziBF^_a%YNXN)AVa)`Jjy=^qaYp>9L$ciSSw>64OXAhvE}VN<;{-Y(z5=qcxdz zeJb;SLc5y&Uo#KFsCXURnarrs@Y&E!QD@N6swQd5#WtdEIZ=!mv4NNk#Q0b&c05Mz ziNRR7J#uq690~#LPsKtWJ02kc@W|nK&4R3)I}v16wvb^9815c_!`##pW;nA9yIJG9 ze&z%}&i@fB$EmCp!S#g>#- z)LIi{ORA6n8kiN$h}nFkA(zTWG6{ROp^yOeXvc)Iu(~apT+|{qFchcf5F0d)h8&6^ z^Ju6W7!&~wrasMopK9}2kTXt8z>;QVAuz^#-7T1NaQ`&AeEOn?FZmDHwEMmn`X45w zMfa@Pv3lLm23Ls5?76k@qTNigOwDG7#}DhX^Do3COkHm9iU3eEeaPzk14rV68m%A$bD z5f0J76>}9`1Fp5MA(!J`7j%U)5CB0$J5GoLOe!2u*Q!IRLk%_0KsYRDbU8n^We_{_ z%f`n|PKh~xnj!NA>eXu&%bDAQ;|Uv2un9Y76B2+Ia3Z0;fd+?hp8|~RZd zsHZlkbTck6#p?J|uoI&D*8AtLyV{tW(JogrKNy(>mta1MZQID;yuQ{_cJ9TSHq~Ce zAfNycJUBT@cH4G=CB(}{nGzl4kmxV3FWy;vp!isS{<-`s`8TNF&~LPiQSY^!ai1#) zG<4dXl(W65*j`wYUR-b`(e4;xIK(#ObQ*BbmFNKT(u;wk020Zja$#{{$z3fEwtNUC z;a?N9XlHD0s^BgL7|9(CDxq*uoO1_rckw@%-xk=h%J1fUSg^$cu$TTlwpYx%?G=1?-@s)h+M4nGzJBw5U%&bE z67=*zb2@G?3(Lj4nlQ#?qW_o13Pq#3rMsn3syhyiM(JDm`0!PW9Nh zp8g&}>47~)B30@!+RHs}%$?iq2pExEDR2{iuMVllRU1%sl~CUZ(~YXc7yyB_^Ot9k z(i9M*$oXjqJf9yBaMLmYGNJ$llbW7e#ic@U3YL~b@tCZn8xAp`3Jz??nfv@=ghrJui z-$ltL{D5sy>leFkT&y(5HvfEJ!>X2X!tk7Auu}s+BF=e&s#OQ|0m#f4S_k z!LR*%$!*t1H53Bd}^y%r=rgYXHYzl|P za9{8BU+i5MX<%8suXSM%Q{lk3Cr8PH~j9UGlN2B2(LW~td<^v z)sJc#o!812z`N6!ZYk2d={t9Sv_+e`VlB1N&mTI3^;93$O1D^O?llX1>cVh$rYTzJ zfBYu+3c7g!-8*36AoAoWxx=;%q@l}*({a|TQ>fgBX2a|TdPD47%${aD*{^A%@Gb5n z=cxCv`dHZ^C-)jrIBl0^yZCVrBDEQk;Wb1cXVe!73WPxfIroAvB0@!kVyJnxb3cZC9g_+P zFmR`Li_@0pIm%$TdaDA|0H@xr#!Q`|tv$5_0`?ZBN_ELF^3q>f`RGO0d^@9ruuXtuu^*WWAN>mw+F zvpG^BLb3T%4|*SxjuCH(Z~ERy{ed_szULcD@ejiXhzGnoq#daTG>3RtJnS<`XQ#k% z@wjgioEHD&W5CE9#7Ik|N?=5emB2_t8H|L>k`XR@jd0nA5?M=sFnJBnnC&yiB(tG; z7P;-V(3%oTmW_xb)<-!Nz>Br+SISsm}VnCcOrK zM*LL#k@x4)5#NtfhqVvkq##kyK~O1&7J@P%r2JYJY}5MSBJE1}Wyrn`N4>90qewL3 zzOonn0h-ZZ_I_!9DEsBmoRUzT{5|5orK*#^$NV=!uJhk0dcjHoSs8SI_iE7UrN9e_ z?)La6(A^FZkA2*A7iaL^9-Df|%qt^(XuZ{QaxbQ}ZJJGMJ7!QOtqrriI0V4gyTyQMs4x(N zr)g^2SNWOLwy*L(x`5UewPD*8uMLNL{vaFBy+MzFC~ZG8C{EVB?Nj|S z5Zx`F3z)!vk$~P3@!C+yml)KEpctHCu2vy>@s{CPb_)znG1%CE$zWpxCWDRjVg?(U z@wrDZ&pm>9E;X6wQqwHP8=A3<8|^ym!Ii>tmu7*`t)R^fBDw^BLf!)i+bP7 zeR@axlRtzv*X|?^*(w>_{UH{ty$F}p_Q4)2Gmx&36Z4U6%m6^{vTXwu;_nUsVe+IQ zEG%;|y=)80S}B5tj_Tw|6cnh{$&*Hhtd;!Pf6I_SU@pojEMJkMIfaFPtfGuuv92_T==#JaL(D)alYy07G>R@? z8ii4G`5C?<@q7icd{lM?=t}ND=71u%rW`+Gf6O1r{4{r-J;R^Le3WzDm-$ZaDRvkC z61$IoF7smU=jsei+YVc z9LI66Em+71`1v;Lz)}cYjN(gKRMbY*5d*lzD$@cc&jE#fW^*YEC+lc*&N_vunUWCb zm?Z)Lc64@Pd@R?v7AXhSo?FiL+?A>r+0qk<_^8@he#mcTeY))rZ5ze z9rW$DyIUIzh}TrHLH8J0Y0gzD*{;;J8yee+rgUK0s9jDzY1;;JHlK0(0&Wxd5_cy@ za)=xN&~Rn+2Ki3z4*CA5of|}AcQZ$M?fCv@J+Mh>hSpB@I(lc%1`jPC8%k0#X#jQS3YC6?5Y_+2I_U) zPTtk+>aN#13|bu@PwopSi1_mxYsT3I)V=WqDWdanuENgjqPNM4QY%&?ywKROwL{`!j z^8Dva)0H!OPCN^L0GYFG1Ae&9NUo>GdV>G2-{KV`^c;13KT`dPOJ z5is60;*6)n7>uXX2sApuTn?`EU&CDEcYZ?S6p!2o%p4_3Q%rX>Wc;XO+6sfC8HuJD z2GD-W&B*>Lac(~%RYE{liE{=8WEVv{Z}R!8P&Igt;hBDaW;3&$xtBT4IGKaQzW@ML zL!xQ#O*&;z1C(u)f>bE5b$gxkd7_&iKQoBgCEep=*ijps=oTv#Sa-^T=H{68syIn! zM$mdcq&rD>_5>0Lq#*=ZL>5^RAdr9v zI3UD;iW{J#$R-HtsJJjHj*3VVKpRj&#T8K;7hDJQi_54{bb!%;eRXS)~$2u)H$cBJAWVm3|It)xx+6kE}J#w*&Kj80-$;9fME?~?Zcu# zP!AYyn>xE?u27}=2B2yH+ooPVFYs9QGz*aZG@x2>@!aXNCqB@U4XBO+%Gaj1w9Q2f z8UUvNh|^~+xcKS?iZwvldSL7wGp4m%)S>+78Gy_M&|}7oX)W3(s2w2Z1AoYwF?-&X zAHvfCuqy#_@vJ#hTeeSr<1YYx8o<-DTdtg|5DZ#?=m7*SZJ9kSv2Xk)KsXFAaqgV9 zd0kPA0Z5$J&%JEg+|7IJ69L;GK>Gp!1~n*hKqLtayf2#AA2ArKp#+79Vl)EmYwZgV zK*1m%U15v{k*Uu;2%vnl^M5Wt*e|K1@xsa9(2SKa%A*g>+R;lh*-&#_tx?Mr59W?+ z;pyL=87WDsf2|fys$&2&r|-ao{bV&1P%G|Mlmo<@PFV{srY41gs+fjS1r>x}Xm2?C zk)wyz1&~01T_=3mbscXZou1$?ECFnau!i>xtN^Io0E|F$zaM}l(-Rg5SkHg?fB*yt z2qGUbRG=EYF%W|>48t)NjhKnKSb+8HI(|n4kcSvbWU77`jPo%ZqtJ*J`~jDxsign; zkLT1=>wl+jfB)#2Id47Z{EF0)T5@mqNuOnPf?qhHSlfLnmnfGgKRI)%Bz33e8SRa_ z2E9u@pX6tjFMDbBQo~dH6c2wIA2x+d|1_WAr&WLMY17(1u&;LXb$sGn?wabp#C_0x z(7VX{o_}y)d@wJh3@Jlz=0tP$<*tm}kT<=+6dNk+$Mo)(5ccyA`R3ofq_Ceh3HwQ5 zhIaLD>+!j;A4i1!*eLAB3&MW9_gflb&ZJep{|p#~{TL_g$3kI0?h}9Zqe0k@`_F#H zS@}i6emFAu8E4`7H9Lg;SS9Sog}<~_JgaW%e_|wmFJV6lGw*O+<{1Zt{kT@xk1@i2 zJd>f@E$qiGVLz zm;IY-A4LFVC_yQz5Wr~6z%&GY^W=bh^<|hV!xqfTw6zEU^uvEF%t8R8FcZ@;1M|=( zm!_dje$wTbhKpp%ENJD=AWXv)T$XA3aQO+BV)W@}osSkQkXt(s0nEZ2Oqbs-fT@@x z>yOJ$KPzzh4N6ds03xSLJrS4N(Sli+ix~)D5L$4le2=O4Lxy$;=3s{0>w_>K7s2UMbFthX0rbaAOu;M}+amYIx$l_1&z#Jg2IQx3UQCtWx0_>E$b90M z`M4ApW%xAjG*1R&wA?#0RDM)URHlvQe0FRj}_$SMI*U6;ZQK( z_jx^Tm(yXlSuJLhQ8Z*{>2+F-TBTG7j1t7_!vmWG$w+fjh=d0XD&*yGOCT9(ISbL8 z473E21J9*N2AXBEz`2x(mO%32Ur{E~l!?=nL=4oRrZ66;4+oO_2ZRGDGJa%3IFMX9 zAlw*8cF2GEVRC-8oX;8%ZVUzscVxp!Z?!l@Z2rL-j~Q3YOn9Lg+iTG7_U#d!UO7)&hP-j1;Q>keRYx3WiiPo{sjgwk*|l!Atllv*z>CY4EeRyok8C)*HppRP zqoXih7*EpNfz8VXCKD|y1{KDKUKp6zkfb*@HYCZ7jfL?5e-r*z>Gzu!uIHHMO9Dwv zxPO0m#Bv-3gf}#qLB^hasX4@?MM{I8k4k{*X-%8v5w(2i@Ix0U)~%J7RI;9hLL|Y zsg9ifGl({G{fu5oV*3x()6(@rFANVIIlduKzpOdaw?jvtQ%cuYovzE|lIFSw=BAk( zbu+m(X{wuenwS?F^hqH%DdZ|;p}r`kQjcs%V@P0NQfwZShK<@_@PBzxN;=A~l9Mx+ zWty4n6+5@w`<(JQ&C@SqLq{it2pxYqdi=6w+H>j#h6gq;TQ)Ep7`Uu?SxZV3xjcV0MIhtU z-8h1&DVoNK=?6vR2PHr;H6^5L65Z4Srl!;xr%T$w(&)~FlZ zaJD?igG^Q!v~F~ggp*f?uMBPhtxH}OULa?dB?Ezp4Z&bAIn~p+Y*}DgU|BdNV(Qq2 zG)xMSB$>dW{3qXVOAmxSjqZP7BUkdtMNUjo7!xP>p_V^iP*q(hm{XWY}_^Q6ymarRE(l0@8pQti=_07h|L!Fd9KTi0=_cHD-TET`*!Hy2!P7 zkWf$bO)Q z{Ydr*uS!$!0I8wx2~Xg4bdZpMt{bG~(mLs$U#!(*%-i{bR4UEJXpBKK=HnVH#3I~> z{iKohp}VD}Frop|un>PwVIPSJ5Sn4aD2%}$aVK`*S-gq&@i`&HK=Q~U@-}%#fzG{M zd!@nB6lo6XaREkP5it-i$tC^hcs8DGVh20_r|YofgAt=~Ij+RjScTQth=ce59}z~i zbTl2qHo=WP7>_Bq6>D)H9>uFTMAW2$^dbpz6M39oF0jtMU=V*`MKuP=y?-m#;X!P` zX6(fQyoH1K0bPURAw~-CxaqO9CWJMv)82eDXNiM7}4T)JDCuiq4|#^c@ys z`-O4B6P??-tX=J0-*-vUMky)1AiXa0w+E_FhcRfvT(rp?+m2m$5l8TM94CY*iJ#<= zL1ZWyL+&JxlSAYb1y$4Q=;Kskeb{RDs^Apv?7E<9cGrKMU0bCJX&49?6mX&f73hT; zj6oyXa6N9tgLn)Zu@$f5J$y$T#79cVU^138kY+N2%pr40E4i9nLvAFGl5J!cd5?TV zzM}$FQY($o7@bP5r)%jpx|hC3k1((cSp#cjSF^Qj8#}`lnBFwW?_MFl>!Q; zw5eY|Wj}v4yK_qC-JLIV6?F~h`a{?9uIIYm>-tR6NxP-bp+pI4(1_`1!?jq5n{W&6 z$D?=*@8MH?iEr=&e#CLYh=#a`kN9Q2)sewu7#T~(kw$VcxtPo#myr2n5!p!E$MYK2VL&wmI>Gkw(x{-e-=?C-!dYt~uA}r3zSUKy~nz%R-sh5P*^CutYC_Z6n7}rDfTK}QGBfwl@l^LV)WTQD|?+jC-h~r zupT2QV_(z1(i(CtJxTsTz2rH1oO;;^HiFjC-k@X`24OZVs&&esGDs~DRn7b!^e$S+ z#tDBBrpLTr#vAB(dJ}EN!{lk4q=U#Payi>i*VD;tov=peOAcZoeNF()A}7!f{YYQ( zD0v&L^gUY0HVbd?J1W%dlwvl`l9mWxDk%FaAoL-Wy++294l;t;$aADOy#--1o`|Fa zVKNxi_yEJOgN#F!aG0&2L+D4S#w@HQ&#`~k=`PHoyT}9h5mo3Smyr?V9#)F$NGnF8 z8kf-95TbKw2-jc?{z0xMRvg4hvXSJ_iy^QqIu-BGM%3T{G0`G&9V##z%gHjtNhjHZ z*Xgb3L8h^1PdPjDC^^+Zwy;6iLQV>=3a?TDC&_cvOG=2EB=9L7#5#<@O9-+E9z}l@ z6f_QoCN$%G80m3x4V{IV$uR5m7^ba5+|usR;!_?QFw(4 z!76--zL?HqG0GXjA;tAP&)#Ooq(&*&HCd6}^)ar(2N;Bp$Z~AOAbdz{WD*%ENOY(m zNn^2*ZWcb4>_kt3cuOiFgS)nq8j^n_1xTx;BO`GWCh?e{uw1xNm@ixdNGEYMZo(Se zjpy+$9)b^1RO5V%#zaiPOcbI7WvE0I`l3Gu$T74L7>n^}#znXom!cI{;$A$CEl6M} z#$Xbr;9^{YR056Z>BHO%jryfh!5GzEJ1(9;vHeB zun-p_2P26YGtm<@@M8s5NN;02^5G^1Qh|kB?xk;}_oPQU-^9as7;CUb*&p91>yU@x zcNik%oO?O}V`$CM{hY)^YHIoX<>Q?`hwx-2$)-Pw)U(k^Y?SIdyr)JU=O&tdUd&@V#+hinwP5c%-4k!*;Z zj$rl3g`W*)L*(=VHdud7hq3eI^n5l14*1znRu2>WYzP}Dmj| zfWM^QTs9DsSv|Lz7{?DlF<dHUNT*S;YomJsW^SGG;OxfQ4)T-ed#7WJtHE$qgUPH0 zdsqz)uo|dX4XZ(bRicDdBEc##f>olKRYCy+i=&vuv5LjPSez9i2Ywc$D`0`21v06h zE{6|(=A+Boef~s04c&$jbQ_xKHq52lu!wGJSC|a_EOa?IZ82Sr;dD7B)8$zB3-113 zaGU9Js8O4)N$7uQEv;q4>2M|_QY?RKO--4cmiI`f9&b9;yUGmxE@Syv$ntSN%Ljvj z<)fJ8qxN*k&+rIhKuXHiHj3Whnq zDA|D{xX)?GL@55+7GlUW`X{*vF!@}R&WmM4FUSX8bb!Sb+*;CoG#|yJK{6<($fem8&Z6uiRX@yHd4_w$K*ZOq&y0*lYky zMzyP-NCiwp7WtP9H_7la875?CPq-##9hsQ*%EYX@CT86}F{@!>)&&!@22RW>o|u&) zQxf)A)Ixv8*1ktjbtcc`PeGmetQl8p(e+WZ_vE_LpIq3_~*Xl5y=>&^%2h zAgCtrljyeKV*lsClt9}3Hw05^((b=LU7C{zeq?4TBGXjAhW60xB zkys+GdQ~-9l~7fyid2QFJXKT`R{2#HwMi|iv(4h1Cpm&)CqEN*a}{iVaO_MoehfLdY$R$*NeA-kc&B-H;*@N8RY=!L%J9B!1&ccP4FY z!>yLHC7KC@H?P617m+@4oB?lLb7Mfo4jM_g$>Eayp72+o{_wb zLsJ6bv9}$xiuR}nxKE` z@NZ~*{|lPj-=#ULH>dTF{fC3>z!37@mb$BW;IcVfKdm`j-<({2`3wgS90Yctj=YzN zX-1l-Or62gmT4*SUU=GoWLgM>PI(hxhgSjK>Luykos`T zfX1!owG?bR=W$EBAGf8T<#%q@!f$_8z@K&Arr)XF#H-Ka&)USFwTVCLyu^9(vt+3s z(Xd60{*84L)9F^K)0*lUn%%+1{x)%LUs;-a2OZbBcM5#nUKeXj>cjn$S>gV2Rbjuv ze!NP6T$Rn^)0ryAb-jb`o#c^Bl^E`yG=}@bQ9pA){mcPvZJEsf@~@2_^Co|_O_Edj zuWjD^wzhekQD{TkJk(8W=%<&pvY)P$we@mYBXh0I+S(fDLFQ`PeDM3t( zYilEIXNv*aetmG+h#~!Hn~%2nBo+fFoSzY#HWDMTHqr*($jn{j^>0S_phPg6~z$cwR6n^PA@?@BgpmZDs2ujBgLr8x*hB(5~F%-(M z2szR}P>fvZA1IMwDI(H8P==`VBg#=A{fG+0q#sd!#F$BG(Z!r|TrEhRPYNT&4OokVruk;OuqgMJFBV;%d z3F&K$LON4p7a$OWY~y7(pMOd!P1wQAj63mB7KP_ z8BW4b=?hH8`O+6?#xUs%wBQ2ib42pk#;YAoBeU51uDII^o#WI|ZQPL62kl{>> zmi`BqV2t!X_=5~*VXX8SW@DW687`IK95hIuVJ;e^Ptl4-=~G;W3DT!%!vyIt=3%0A z81vC29meG{yaJP?L%0&n(jhEBi*yKAVTyDJS7WO5H(Y~@q`%=>Oq2eG>o86F1PgJo z^a&PWy7UPa%kY1C%#c3D4Kn;AE|EUQjrfD~F>b;iq>r!!v!su3GiFO4VJT)yA7U9U zl|ICB8Lq$_=|il!ARtiol|2Uv|Z=>yz~HtBt=!93}Gtd-$ym@gf~?YLYz zh&yEXCtN8V#GP0my@$JGcsH(*-orW>-h*qUcX2PSliq*DeKNcs3#E6k9*d=S@Mjr5 zfa|4q@E~rG-o`^R+<-qyZ{uMZ{slKmf5juXN%|`u#S-bScnmj7Z($>rN^jwD8E(Qd z=`B2gWzqp`#&YQZl2{=fz!n*{;}+>nY{e?+O>C3lcC41(z>_k33b#scAcZy38`yz0 z(thm3T4{ejcHwquKc2>)q}TBb?v!4~v$#uo9lK??2X{;R@SF^v$2w^rUcf!lKJ3N4 z(rb7T_erneCEPE)hL>@_^eSG#dg)cXD#O?CXX#b!!voSQcwL73@sRWi-oOUw6}*WJ z(#tr2hozVCmJI)jzeq3PZ9F2qgm+~4E*_O$!h3(%D7}b-GJGG8OE2OB8GeXO(q4Ro zC#1djScacqv-AS~hIZ)%9Ku%V1sujU=>>d>?b7r3Ooso1C#C0cM24T^Dd{+&iUXY%_3G9`g!9THAdKy3BMd@k$j8~+m@h=&k#H-RSoRVQDUXymA z3;U#U!DGcl}`WvlAS)_|4^q7 z{jW~{k2<~ezdHTDcKUzR={x_g(&?11%?f|h6+AYh!oV#`Rf_1hQ38d)GYnd#B1QC1 zGDck*6~{eE;8YL4+7Y`zJXSNTv*rTvM9naG9Za3~UGk;;l5mAQG%XtI)3<;FVNK`wfXfx24?A?BqN1?&l)6tWUel+b zum&Kssp}NmEPM$!MkJ#7`T~(E?Ad>2t;wcTDnz@@Z0&1S4AW@L>$7tJ5fo0(YdeVo z4&uC#_fpfa&SN!Vhj;|FHMKQHQ*||OG;eYfsW6#(rrWAgQme&em)jePMredK)jSr} zXPca=OD9dbROK{f>vJDTkRRI!C8NSRhf%A4tt<7=hOX4Bdaco^3y~pRAf$h=>l9s> zX>GoSYFtk0bP2r08k5p)6BSCcVwhHI?aSM1fFBet??XGuuxg^Gkf+hRaVewx~J_nlZ`I?-PZol)+Kdq3hA9jt^QRq=%Ec{&}(|F(V+`hGE;;~uh`&35tt&v#AYdH#K#&!x}UR|>v6sF;6j+G?WO@J{JR zFzHx(p*p{xM*0zX(lJD(f5ImH6ISV;PkOR7+3IY%Q~C*_^kcg>yO3W|ApMvK=PNwf z{_K!xw%X@0p@>8kS)p)tu#YL;M`2PZvRr+TqOU($n$suSS@P$dL@ZdH!C2Z7AKDXa3D5H_QNPeUsA}Dow ztzM&7>s5M%l0`zsoCE@9SAxWpxd{{s#R(EN1QW#V3?@iKA5Wl&#uIWdnaH8tf`WpA z*kV*=4pMdYQ8%$6VKw^9&RUDlXs1u5}=e0P4{3hQf?9O1V!D9FGtNgW8D;oRS zIUv8Yroo%tNUWkP$I(b68mX)l)UcG5?oC+iX#QLi_M&uY|^V-#dv!bB7bN}hjJXTC_FGPx}~=|LFj^rxWE zsP#^2*+mz_2s?cvp~ZBgkxYk3#AoPSc<^WPMp}ZnKCKZuJH%u1fbZZM)m{y;vyZ8| z*g?eO$M&96C@n#g%;oOEb9ziEx>Z9@x|#&|Sm~T4kDfr+cNUGosZ~3LpH5D+n@tXf z$!r%&#wvfEMnjgGe_LoHzz!-Dh>@OKXhWFDIssbTDT;PjY zqQ1Pa-lF3IPJS1RCf_76_TJO{3B3 zT`BVOHr^)eA`_qkB@?!(KQ;Er?UzO8pb&O40X~ui9i5FhxwU(siYJcoaeAzS>(!2q z+8VL*h}c0gJqzBmBo-?zLEVCc$Ddh#c4KF zRaJkXm9)khdj>PJo;6sR)3YzFtcZj|N|iFBuzRFu8KqJMRVTfX>$p?z5d7FW+W*AW zmp83Zp#p9w^vKov1=omEAUl738-mz9528hhmo&KZ(hS9KYb3xhXR-7c)HyrXJE z<-=7w%scJ-%=;|+?H`#xv43m+mt870^6R!+LhhUjV@mp4!sE`V$X6S5u{ogyo@oBAljeR`xwRzhp-!#tj9=IT|vlVpFv zLl-}#b5@rtlv&^IB#Y9#Ky59bHijKJa)J1Tsk(TW*m0}_oFSb@Ox495MpHFcqVhm6 z*{h9dRqCmz%*i!d1VwH|I6=$`Yl7rdMiRs#m=b`@mc_puBo?b`YOO+5E3u^~^T_FG zvb?NEWkn>CW=OeRF3C*l9yw_qG4p@CtB$8;eN|+zi=t)SrZq3NJlW)PIh})A*WP{2 zxHWOns53goEx7ys*Qd~p72Bu$>C1^FqDgcZ+Mb#_boGUNgpp+vCatciuxRXJUY{|$ z|2X;%Q2xC|c2M{dUIg)0A`1)w>I*8oevi$WB40e|^*(DeSWPL?oG@i)KWl#t1cTEl zvrx)t&>u*V2~RO5D1yE$Uy4jbOQ$9AvR!$*P*1~Q@DW@RaQL&885+0(sVKMXzs zAMx#^mm)|eBy=EzI75P9)&F@X`70bG=QKN7hjpH4YOSfM5j$%{K8JVk%y;svUc)Ey z&KhI2Vo6c#T5+!feC!;5r>0apHI$aLl3*n%H+GwR-IB9CuJp|V&W7V^LlYh*KFG1pqLs;a73E0MLAJSDdh zS^hItyIr=0WwmwIxItw_ln)%G)xt+n&mL@dzpazTJ=nZ^{bf&A)Ky2;PQ32s@zpMe zQE!iyze~z2mG{p4!vhao+`FwjNMCB3cYo1ym)zZX%aTo>w_iTuj^f&o=rG!KW>WrT z!TbBxZd@IM9$V?#Vuo{l0iO`|sk>?4L!I-JBwiZ7nenLyEW( z8g)Ai{}7+E2`OSrWa%oh|7x%i+lNjlXYU|BIAW+J;<2V<$I?b=$FZhkX*>EHw||5M zN%#1tqjRfNGk6N;YLg&)ygCPv`4hB_Wf~syB1{(+CK=g*7NZ z5qUBZ>tU=mRlEDfdlsH&8tghhKCp0vX@qUEYjS)<;ZFsI7zzsFMTF8qt(c+@C2U!% zvhL5Khq6dkzA-CHG1rHKwFJ3DKabH5dtu!;Rk?C8Jo4T)elq%HuFlr4{mTC- zS<?Q4sx`SH9s)A*) zdjsoo?~gr^tGqgAVQyP&e&H(ZD$DYmRk`Xh;xuugcCI+rIM+1StU($Q7#19yGcX5}vw?xZxt9lS3M?zR zJ+L8{ltlqDf31GFezJa!UZqcw8xr}2xiE@GYA~)g?lB%P9yT5|Dvhp+Xr7PA?)gy= zILn7DNXrCwA6qkVj3#*s;=Yury11s3JCSKyAY&4rJLSl#(w7rAS+qKHB$iuXDJ&$p z+HfI>oAL{hql*+0oVL~$qqT{&wzf7kH8tfLyO}IIfBv$WaGKHPU|G)|vSAQ32FrS+ z4Tc~=tL%`9_rAE{hO0(wXz7%l)fY+rG~&4FPwEfT^=>_MT;d zu+NYMX3~YX#Z0+9b;|``ZmcI0XiSqGQ8x!85mzsF#8B!lEiSDs6-u4eOU`1#uns;m zb$0UZmwnlE@5@tDCT3!<=Cf3FX$giVbr%jzf98xF->?H7>DzXr1v{m0;g!DKZnN1v z4qL`FZX`{uXlfg96zU;Vo z)y5)&-)FOVeRg%sr_oTKn&w0d24XM-e+<;%DvJAjg#VHNg|l!MsV3^v;e@6$gMoW0 zHDZShco676IfZo#5*2|0tu@<_WzZXR20+}I)^o-OcfmQ|RA)4yJSw<75S2%U_dHnz?!9Dl(eQlle`PmL zy}ql4W7d(7R#O}=E<%z2A{9N(Xhie=ADy7PiQjU(cNLC^pQ z#ljj?5>vu8**{0QP|1wC?3l^q)rCC%%5d20VH#yh+OyT*tL14TZgAEr$5QImSX}m) z+3a;y6mbEkrLoFNZ&9=m1!4g$e~3jQ-a>zh%u3X_D2eF8IT2SSBDp?5=b}1wC}QxC z?>&--dit>lG-QNkz2<=Cu;!>np{a~SiclyP(!vz!o3Q2P=79J#qs+yo?@dQd%;fAb zWR4@lxsFb5KOf^Wnb_3YajdB|qs=oX%u4np}*(8+SmcN|Uz;lG(8%oEn20zV`sH7kfgqmPNAR}*ymDnlW!yS&g);xC~k zv5E?BAyq4S@M*;4w8o4^f3GtVN4}U(^JBTW-gqb+aaJHVCjvMriD;Zuqprv;%#9!} z#z(|iocDJ;CnpRN5knEU18zFPz21F5wnG%|QO1BsATAPDi$_I4bXK0&!N<|*DW$2E zTNW}uxC_HWbe%P4c=7Ar$JtzH`W+^areDWgGA!u%pLuXkIvCUCf9~diLFZ%l@{aGk z_FN{MV=rWBf1d>){I_b@--R{s<6xq&SSV72^?|H_C15S~6#M!r%Jn6d5^Jre)^~xT zPM@$OtV2D+y~BN0{+)t{5;}bkIhf_uIQ??j(*qulA6{o#i|G_SGFr@G;^nBdhtX;^ z8NCjF#A%8+9h64Ye};%gqvqzLakxlCXJEx4$7$__T6yZ`mR-lcRayT@nfgQr8s z-4WwoMYs;j)AMZ{3Vl!6&b7SK5o3ZyfY2bUK@hVNRYqNQC08w6Z~?EIX_OyjG)X1b zBs8LPbLC*r5REGg;xn6^p$!YpT6p=Q3AME~!}z+FV4vQD3C$JkL1KBfcHJckm8*$NM$;%A3{TBSddB^&f+jba*?@=w+Up z@8@%s-#`ude`bThWcKR)xg0MdG$KSp`H@g4H{$gdSIPoYR^Fqmtg?rT*G? zRtR35+nTn_TZJs8AB#Aqx(8jIycy+tW$dBWo*2zb0+AE6e) zp|1+?d3_eI*M}7KCUm~sh~Mw?dAt$A%R@XKcU4cyf2)oh!hv=bb7%Y(W@iT zsw%I~=k3|U7fs+z;*U;_&WUc0?v5&=iD-UBG-0YVL{~)*L=Q)gMitQ%{WM|q`pINM zSCKdQ25G_L5hxYBDY_tGGY6Pp5q!hVZ<-I8zc&kJXZ7+Xh+nwm&ftpT(a|$85)(%9m{)h##2VvmJE&UHrRA^)|Xrq3)^dsV>*l=zEFfrgB>^hq{2q^u=PXDc4r) zf9OqBPaAfN?WT5fyESRs?bzv5Z!$a~ZZJJye$e`mZL{Msr+S=uq^-$uzj(WOt?eGi zT~2kqx!ziD8{#c{9A#4HJ9-&|)RBo8+2u7?`QScH z6Iz>^>Lxa9w`o1bT2o3ovDIU&6;skrTTPBy8(-SUwzz9;4x6{u!GR_v9o}ki@~W?S zsz^!ioi6K4y!<>*HJQ}R(=21Hm0y=mk0rA8Vy!ihW$J78WtsYtl=RhBv$HlUf0I(4 ziq=|vCUx*gT$a(?mt-5wef1%p`~4LnzDNYV-l+_SU=&eaW;3ZOC|?%h{(?!Ear5^} z_jT(lk5kz^ACX;|O&*`xc(z^+$6{<`ZRspl~p zZeuuf3w&feJ502Tsps$sbalKhm?+YHI&W^%!^-Hxw3LY z!DFRwM&9+m9XJ$uxA6Oj(Gby;*82wruZ-X5UlzaB|A2pE{FT6~!7pN2zFpE!(7+(i zv$4!P+dZ$ApEIxaw#G8^YTO?vhy|6Q!g$zUgdP#6(-d*gLimb{5;{|De^Ekbs4Xf| zJMzPkf&xD8`ghW+P)OG&vVfk%Czj`W5FwEiY1+Qfv&us~DUz4qUyU0PS|2(PIvNr} zTv-~736T_wM@1?+tA@-v*8^{AJ<@cfNtA6Sc|}v!NOEKbu^5lda6ja1fBb(tn^$3I z(vf`nr2LrK*v%Hlc~HwER2Gl%6(KHk-X$ zLD5Jwx4bOlxRWvKWZkp=jMYm{-FxuHd&VzXnc$_l_iUWgb^P;7w~l;tLDxR2?HY2f zW_tPB@%LBuz2`?cl5c;ua`cEd{4m;A(A$Fwq6r?@-jB6hgJB{*6i(L*o%UcZ6 zzJ6&5Uq~igpZwZwPse|Kl>3C4eG=A;k(&t}XI5CE@+l+P+O)l5vJ=IFe_Z}h(fQ36 zZ|pa&@rxHex`Fp@x@OmX_dPYRzU0ogCQf{NQ&Q;b;Y@nZf5$!fn^v`yjVkvWJ>KZD zNvroQE#XyPaVLM`pYEI0f4a}=3J)4|;~$^pU#kU#8et8>xFu0w(C90s?T~wo1J5yxNlcH$!0VGA{Bm$zR*wgHJ(<2x>wVvUg$)35M zRi4eBLmsu~fA6_`&gb6wvCKM2t-R^xSI)w3T!-HXa`5z)i0%ws{h@5p{*%KGyB^`a z!#45WJJ+D?`h?3ixuR>SoQ6Sgp>#;NMp%Oq650h1-<&D^)b1BOe4~R~`Y92*!hJ;f zh39Mk&-A$Rxcevn$$&;j1toFo{5QJSDU~Ki+PJfde^zQOcUr9ur`J?ak~Y!`Nnt(; z3rpZFFluE*mX)u`%F=4Q#{4iZpBE_)apCahmqZE*!jb%ZN5rI!n2gk$D`-MNA0czF z3e=NNv)5m^bh>Q( zq!B{j&i-4DPI>uC`mF4_$>vS}<BlaHy8S+_lo5t9G44+=NfAfsqA~Qx5%dMhlv3m7ZTd07eJc!JV zP(;K?bL2ooh(z*Zkw`(z8;U_EFC#eSsE9%3SIto|l`5aARE&Cclmwl;al;cg4Y?Hm?gMvDEQRueNhLG^j;7?(y z3~IvGpffCVJM)zpBf}Nole=>BN zBb6C*#A)71AA*h3oL*2W$l)~Q(O5Vd%?W!8!l4imLq;&CrYvkOjl^;yv4TLPz!fx^ zbYz0nt@u5&qkC1T z+u9(%M$omVmABLXVb`iMUiy-Q3rR0hK8maAFL<$xid_RvuLC_zi@KFVSCo8kCRRbQ zS~?_*Ws8u99%M>ly6$8q4jjjjHvQe}`O86mM5O zoxR1f&9%d~FZ)=jRZEX%a z8w!Tzqla19GH$Bb<}pqOXI~&9bE4plTFTU6Q$Z%{p;OOX+Cn>ayL}cPpFWNqEb2v zr*v$qNnNDQtVE!xHM4AC89BaT7ktuDn58|urnQMQ1uHZAbhsTOe{Typz0)$iIMFQ= zEF#xs*1=iBQwRR^*x`e{ZXUj9(UdI#jcC_qPrYZv{q1u(%U|sM$H7lczu=0?X78H1 z;O@KTT=k?uyt)43YOTX$)EZm`_fGA6N47B^Fp9%_k2-(GxXGONh0-BmobV+)$Rjyh zvdo-UIU7$yA&*bRh%OM(H|bJj>h?%b69|$NnVKkI9)PJd zI&aXRJfx&bS3!6*^Z~1dFX3SmP9rI6A}*=Ml$| z^d^Ps|Fku2Xi}eHMq>0O8d9Pw$vH1?Y~DqAkA^nnJVkcsf1dU|8QrVcr+!EHSbaqC zwc2PCN=ccbkFJgk*A4cKC1Vs#swUk< zyp;6y7N0G>`KpPuHWFix@-kR0;3jGKSIz>dIJ0qq6x?|*MU-9t-2U;}7te}`-}m8~ zH6QYi@MY)Qe=l_%e|~S*(U&&J+vNJnfw@=i|KyYV@BiczzE@5g5LMaKl1a>qw6F%-xaq6Bb>?WBg7E#M^;Bz#2MRr7N1*5 zOkVJ7Y8`egy&5#CI{{|)s@adC-3uY8hK7T!t$cBO_isdORr1m*DN^}?7-EN0H zgEx z>fWo+n&}_z4%f(wqBUa25wYXQF+L9dz2R9}GBjz+41%rMYLl9)m^0&I2MVNb+XI#; zH_ju{ms`W?9Or2rb$aRvS1L~%BW3n(Q8u3?$^uQRm^GhX_SS+0Z?%1Vhg_cf{_S_X zfB*g+x4$oZd2%+_Eq{4s!Qm^eJapA7kG;y&L$(LLTj$34q`oqL7* zF3(-Qrxb?yww<26Y_I86&#OMA`bDEFe-Hp6MsLur5`spZezdFidj7vK2vX$pggq4K zO?t1lkU5s!mNzYjEP}-uEO`7Z5gpbcZxiV_BF_okTLR8eGVL~tG9?||=C=5KG$nm| zTGf-LRuZ(?ezmlmmQ1K*xm5{;ryj9={^+DP`kAvuhgfoa@%vqeh~bqth<2Rwf8Dif z-*J(9AAGrQxxr~Pie=-7`_-q2vg;p^1cdRzm#DzLL~cSqLa|73gMM-8 zdVRZoTkQGRJ299pv@QQr9qfxv@t4Lbju7 zc%Y{9h&)@KyJMp1S6e5t3u10hfhX=q%$@Hi+=O4e_}{K^^(ZgTYzFK8h6EQxYxiO8O8`k_0xJTAQCe;%9KW-{5C zeOCQKj^U&J+OF$_>)0YhQBHh`(t68W3;j6wcJ8;qBe^Go$8wZ^$e&#}wRmdzRaw{M zx0bKSUsQf?{;lO3^VgT}^kq{u*9KE$1))(W)S3{5FIMUZi1vWdC}#WCmIedbSP*L? zDs^wFBubL!4Um9VD{9tjf07zz&~WE;v*t~WLgT6|3N8w-4zCXMiYq+}Ts6E0}YHjx}mg-+AiL<157u?b@xTIt41?sYt^i#V}jg)k( zJ+3a{Nxr_EBMWWCXM$uILFbkWsXQH|x2Upd_{{Fso;@nL7NM0Df2Q)XvsDLMoSyq~ z9CIfQlb02L7;;6_w&dMSCr@sAcgen$D_?tU<;s2ZmAhq)v14@q_@q3$+3XFCj(RX|kJ-n(XLt5FJF_e8YV}yHR?>=Dv;zX!F$uzsDG;LsD_{e*4`AaYwcUW5*4T04 zM+k|r!flcH4VrB`v~`oKw!x zy)$=5LfU)(|NrjyfB)Uqj+~z17~9|bpl>-Q9(2yeub$NMI({wY(Y?{#(b?Ud@6?MB z2{x!qI?eN35l~K!ak(}1WDo``#8Z}M7D#BFM{>t^g(nq;%GQofR)?g z3C*Y3(}TcKJAXj)#w8p5EVFq!9;?fzG3u1*+BnvEIT{sSw`l7PBM&V9Vq8_@)elkl z_~JM2Tt27c*2au8wruLXi3>}vn*Z?7#P6rUx_6KAI?3NTax1o|u!N}+i` zf(Y1TwdiVIwbbj>FRL5Xzfhf`k6S89y3gTtFQsYSt3=dovaCnQmx&7e?%zioJ}(2{ zVTh`=dnwguxvs5a7G(IEc3L10vve7MGl1;9^0mLKsY=YOI zzk4Exf61I{{tKn6X#T{B>b0NzuEA3YVi5WKBLGlasrNuPQ8@@QwHHPeUpa#mDUuiW z){x*S-z@%EB#stfi`0^8&$JZM-F?Y&YBYTXP~OfLZE<&ZcQ5Yl?(VKF@Sz2QYjG&< zTHIZVJH_3d;$LwokKg~jmuz;=J;@|9nN4PA_ug|oOO5oHs=0-Dqh`>*Nl`MPSgRDP zU{9A$Wt#(V2?sJjM&w}2Y%wV z>HgN3wX=~ac)aypxPGAeo;X|;Qj5Q?L7XMB3iGGqbo?>_^d$PySdo06R{j^H#at4x zveBsK{i1qI1q%|g*xR-4%+?n%qRR*Q(}tXH2C%Kb4B!ch>CFx9{(J@UA+a_6_uM&DG zlB?D`u?uMXrP-wM<>ANIy-m;{TVo*9_W4~R1^W}TD|nuvj6^(qM8E2jU7rk*?s$zt zDFq+Hw!)G>6Lb85Zzn*;WYLMbu#WjB;)!brSlBk=3jUh*LQ>u$z4~|Eqfy1iH}ZA zYzJDAJWRZoye`04WyrN0TA&Q;*-UA9pF?;txe>0jjkVCRuBeh}x!?iW!0zkf7z7_X zpht>dH|}c~LAA87^&?J(cxH9ZF~e+THi=vkp*0J1e}7x7@p=ERBg9a&*Kx`eVu9Zr zcC7uB@=1@qJJ#&2yy(fy_*>*S#GCAM{9W?fA8i&<6rMWRji+5F`-;ZD5hV-^Gt@;qDx)O#2*rh3h8S__=?^|+UrAR( zn(qqKmqRd^17>|&UpMED@+EmhK51P*?Nq&C@;UTE*WDjcKL-=lxw{r_lP|=lMk&CT z^qH=dg+5e|^4M4eBIt8b;CS5Ep(Q ztFcWJS<-Mq&?AAcy-rcH(1(-7^TEG3U1X4Qvme8`=JJROdGC#*uLL}_Lv_xGIUz?g{%QJs~) zw>SQ{@LlyXP38WcHVEODVZ&{KHB)#r@6O#dYE9?!-*pjSIb6n1*OV#i$JE3i>FeZR z#QdYn>LwJxf3r@21dYBkyCz>DaRr^u;2L`zxb|4^;sA0|E~ZYqLQjfFJ~5D42a=Mfa)=z<738uLAmDgF}?q#=k_ zy!P~#eUJtj;ZPQ+C&>LL=BECXWRYD3HNVh4p3-%@t^ z2dS*sqzV$W)Ml6iFCFVOVKGtW+X`*bdWUU8tr%OIZr?hOX-1GH5snca*s@eXxvpIk zZCVYfUF%OQZi4MGAbJd^1_xO!Z7Ox+`l1xs$5m+x`?xLjc$t~BQ!{0L3&!a4D>?6U zB}kW&Y;u=UVr7IS7~_H(ot!2j`rW!Th4I6Gx^}JH^P?!QD-=R>ppoZ z@s#_cgpFd931vS*sm3k+mpjg>;f3sd0@;I7qwNn}mZt_<4~(oXv*nzJ*L9M`sN?OY zrL&ddCGLcA)t;x7`~8tt;GK`Z;Vt}-D1I{_-{4!zpE_$ai@?tuUl|hZeuMy zad_@vz?I|xlC@&T2%6!hT@=JPF zE1(hn0rT=|EHoIRam<8+MV+oaN(ZAhZv9U9ryfy22OA_Efq;8{csB1Pmhu{np7Fiq zj=*7|h>uNH7h@1DFSB>YMBD1MP+jd?9v>vHMY~>&MAF%UnYYV!S9P6(f7csucg|r0Rkl%&VSAZ-27hbzmZ#vN z(b7ee?&T*XkAnDItC_MmG6kwvOC;z=pK}^o(Xhe%Ar4pOZzf3))U}z7wsen!pEQFu zU*u6rJa!+dc?n&^0HXT z*M9ZWZkEz&Z}4d8($-0u1{7Q)dMLxoObunJ5_i7ZeKk5P_tQ8{atcZ?&xd^M1OBcn zm3Ko0?7DGKCB)xD#Oi?iDmw<$0g6Vg?+=4PToEI6NHFG|Kan6@g|f5X-b%I1D1R>k zTTnr3`s}ryo~FGEhCg#i7E?8>GGPYn*Ui5VMmIP9ST9Ra9xF?U85M-%Z+BA2Hp-3I zxDgtgNIjPS7%Pd3Mrhwi{w^e^E-39I2{C`PmsV`RRwKMsO)3(94>f7TQJYd8^A%?C ziSPa^uAi{yVc63>Lp-_JYP%I{`utQ0)VjEhiBtt@Kn>q}h;F!Ecr5B(y`SGycaAx6 zVMmK%A~87pY+p&cU@f7l!sohdfBsRXdzvJQ{bJ8tJbrOw^i<=6Bq-3-|7Wf`YX

    euNco6M5*PyVfUNhCf4V}w*L;wyCsL$9XmG1x zLrh^dD~Vf@;gNnE9<{-p4dXRKOnk;z@q8#cUl+n6)uyWU&bGdWW939OH;oAd25X`8 zl5CvRiCmbsR}+deVq1K;s-?!W5bag{S6hn>6{Zi77punE0`~oz&<)pLq1~=#jkA31 zyvTGc*=aVI&&r#4jq}mSXyR2sZY}QBM%`no$=C>t|JoI=(`M|DfNK62xom=~>g$=U zOa~X400h-d`jQYZ@P5LmSV{nqvVs|pK?D^#!m9Ug z3qiC8ryuEPbEDYL97u@^E#cna`NJucFQU0wTc_(|P9KSb0z6yqe6qOpy01+=_v|0h zC8s+9_PSdY%5b{<_2p{7f4ZkhpO*`c_W4!N4I2O2q_PR?65BJXc-W2<1*h|oTW8+} z0t+`xe@}UE>XpzwwjS;hJAe{VhnO%8zPwEy0*BX&qvF?=^O(raz8{ImTq`=B*%>n1 z3dN6js%Ym-HA(K3PIZ)fH=~g1P6RtFyTkmce3op=8E;4lhB?G(u<(fz(QU zp~}G&duPZx%Bzd>9>zxPAnCq^Ycl%Se?NXOm;>FRsMWABng5VG_Rlpu26(3MX~~veYmfg4!w6o zQ|E)KWD%J3DJ!j@3>R2VjmOOoah`EbMN=MjUxMPJkj6(KL`bA0gaQqHHS%SZ5pSJ_ z!t=6{oaEdJ2~e7AR3#D?l5~=UB5FLTx8;(~lCzSb(~MH6lg2Jits3~N>E?c&iESr5 zVdBaqRS8}Kq;AP%9lN9t9}#g}pEfTqn$|D!J=m1(DY{&WW>L8bQGRxm!nR^4h*d7s z)Pp}uJ76lSXEMt-Fqc5g1Xo}qS3pzCmBT=3u;Y` z8DS2AT$YqGQRSGjp|o-+Jatds3N3x|Ga2b1NA4*GBvP83APu#dma7d;oy40preGGM zhY>4E!VxQmz%YwVI>qMC?0$skqJe(RqVhXoGFFTrBvoiCayD0N8H$U_3{hiDShLdk{wulef{y zBV>m#pFf9xt~k#(YY883?*STvVO65+hTo?omqAU69_kxh^ueuk+0?5_(`uDb7HRa; z_*7S>{&fw$UN#DCo)ayzsi_gmlsvb{kkj^noD{9f04z~YR08cZW<2lO4dbWs<^yYCQiWpaGgiveR#KYmSfw`M0#jW; z1{X@Bbq&9nXBNzS6D;ibki{x{=K6Zp#KegNOv}|WEGgSZI#7)8gnL@d=w(GH7)Awb zk?FZJyI|C*-?}?1=dO#<^t2i!P7r2V`=+t?eF}) z8XZoZJd$|YzJSRsi~9TXZE=Qse&YgXl`Y*r96zB)TBZ&_0g|IoDAs97k zFLWtw=zpS+3N+Ta8A~pL$@;|J7zRt=Q`gpC`b+)^q*sqXOF7~j#b>g)R|mCxwv|8q zJOVG15%UCP&3dFco-J}`{J5_7!`k`rYarV5iiB>-{XY>hLpXHLX^3|V<7UktfZ=t@ zQ@Sj@m$pM$m7|bEhHZ+N=C$ZPok(ohT?7AO@7~OC21?u$jB~!B^ z1HeRM;ElNd(g%8ppWscqjjVhjF3t_p!XVy2MCA{!LiR$Q*pxL=G^&_hKHkG!Hg_C*76G zj$Fi)h|nElqTHWWi6)3+D*QI9>%Vxk1XC|c1T!ug1pNVw2;15(`lG)dN)&~4r0c{X^%uU(rDx`wVugE~ zFYE5!F9hY4(RWTJp!Evo%qzP@CbuD^d zI6xd9X>yD|Bj?~jqlf_r@RWf*l6Wwrkh1 zchfp_zpm@H3@}$@b{*P?T!36@bP-e(=XVcWUDJ$%Io;e5_LhYI7&|Z@B;!=EZ+%Mp zb;iCEz)QMUd>_@g{p$>Cc|nZs6bVseHJ0QN{pNf3q+j&k{)yx+>`yxY#CT9S=>JNv z*1JPwlL0e7TKK!w?Za^CXDFLlnvAgRCP=!Pws1W9I%7JKE-Oy{IM7EzcvPo(h+m9X zRMvGGXe~`R;DI2doqoq>6vO}dC-Sdn`|9lF_m|)DxwfpoC*7wfIj?+drsc&x+0DX1 zY~FGD`%E0YZ^0x)Kr~I&WUgt=X!VlHIY8cevFZU!TP!98_>kp@ziMC{byi8+Zif}b z4&k(1kvj2Mn4Vtz>jP^L)d+B#YtO?m96oJB&afDC1nlPVUdX{hegfOFT{>Oi=YpqN zKb^v|o8RnB-=9FZ5tHLV%9(aKEp`w&{Rs>F$}hIWd|@!t!%^TxE0zaw{bGG_*0Bh1 zy%7WC^`D$3*3&$6Lf4WZZurPkJiMxnxHE%9AqEG)ow^{;-p&hMyiXZ3Gc?=Sf+`k}6Bb#NTW$Je1Vt^Nvz z`^+LF?QcpqrrkzKnViSN3~JJ=%=jyN$Xh{>^N!e{BZu`Juuv0ep4id=NN%TWKF zJbB%17d^;c#kVsaRjkC;6LCK{T*kVGsT#*_RRe3+CA$-@?@I85l~_2toTtk3MUx62 z5n3{XePq4juIN|qgDqwa@sS~Vtf;_VxceMx+~FHgE{h45_^f%@tIMNJELF=FNg&$& z{Z*>i$vw0-@;dtJrspd4n<}wX4`1Z!UcMg}Wuq4Hpzt2~B{rP-(^hkPeF$6;dzyZG zIczx$n`}R{3^bKFA`WR>D9pm%o?LotNQ0bS5Oo`+IgQaL#@Vn%y&#&CK}0}Fl5VLG zf^%0IrlSs(eQhcE-!6yNvnm=7-cp3M-BEE!atkE>n(35TDZMgto^V;#*uKC;yj(4i)047gX+f6G{fn2FHE-WF&cq-vDwRF#D8P=$g&RQQ_Pu%HcYB?9BQb~&ta6GfnTZT3kw zLNxJ1A=rxWLcnPX@E3a7C$Lcg3qHx(~J`m}-VT z+>7b`RdRy~+E9Ddd=5r-gF~&`h+B8lq!i~44#5=k=2Em3hXCB6zum~^bFs)*6+86W zgjNe!8w-Ay5!NJ@mZ%q55#nx{%cN~FW|w|R>hKi?dTf0#adAF6#Ngj|lO9eL zC5pU*9y7YsdT`G@QP}(AkW&f?W9^3bSE4>%&x;f_Es!JwmJifQtUL_^#qQt{hQ@?W zgiZB_^c(IG-`uFbpY$G_9lRXc9<(0zjt%6`P@$MCn9~x@hE9BCaT%z+;maKnd`#k# zgV9&1q4i2KP2Nr%8RI-~{;a@#t8O0rHKNXtx{!K{rbnoP>}|@!k zipwC$BY;BMPqh+u%pv748fGPsp}02c<|f=8Sb)B?3xy~hS_0bW$N`f=x!fiQGDik) zmgw~Dmgbq(-_#D96e|~F3wsMYc2CRo#|o_r9+|FKf$onA6G8uzbvl_#lGV=&vYfJp z2lT7VWux3+EN~2%;>on`7c3eg2TG$WKhHi#XdPVb-Y3)@^nXF|t||19aVPQuu8BXb zNP+ffBjp;pk2jaF{jtlA79Aj9Qc{4CeZr9wL=&J6oWZF4O8>-FlGQ0S@$P03K%~ZU zY(;4Ewx=;5tw@Z?V9BotG!kVqR7MmVlp-|K0r~^+oQ5-uu7fPs=@RzWW(e+!xjo?oWHw2L6AdWFw z-Z^aML1z%1$lxNr6l_mE_al190aIqExOoC--w{mHjw8zf<;(>UGfG5H&6@-;GM8k0 zHNznobX$T%l&6l4`P30@yokPf+ho1qKDGqWK21~4d1>k zN^4hLNI@o49oeFxD-94W;BNy^y>?ALeM^Yj9v2E&$%XL{k1(hwGxGNt!pvp57tmq*VUVe^X$O> zE$gh=Q^u@*#294}QYgtGsa{sDrKEMh_!-ADOuj%{Dn@q5YY1xZY6uP(tQ&VpL5T ziH(cP#rJo;y_tQHxgva9wcECPuv;Hh-0pd~$lCr;6c%@LJIMFzeHHStzU3mNtUPQ7 zhk@mv5{TKhDbnJ4Bzb^D$h|@Me?iN2XkKP`q`w%s3Q#e-15enavG9jqyoqYf(MX4t z^v{e9JpZ&TqvZMd9(7kg}WiNatz3Jc=vyJtB3z9`0L8{7xtUPV2Yd2orA0&|$hQ zjQ?&H>X~SG7$d{hZ{3FcZ4fZSB{yE-vc0bw&fqNNT~Mve!K7zm$%qyt(-79y+R`ul>G2$ z{Zi#p3HBY0OFvPNwYF_q4k4N4NR1oEuZ8QAl6^o;(vtza18H^euJYCFyK?`SH563{ z*tu!dE5ajA|GAGd8@Mg~!`QgFb$$mee+W79N=}R;UY!+_pHzv!$P}V(6zh!8NwVRz zzDuy;ttc1qS|{CJ8syX!z=@l~OT>WtbdXrR5_#@y0l4wERx zWy3p!r44ZQoo{dVl*!6U?jo(Flgmk7=TSjbxM;1@Q3Cr2^LRd;>-6(3o|fA%IH#=y zJIIDv-V7_QtvUA{#EMVqeYsLq`EfrQk!a++zOr&q2M1*%>;6r9JkHxGyFQ>yz9D1! z_l>XT$?fja21Z#dv<3GutibQ18+1I|f(`=PtYn~$$xR7C!C8DA(h!|9lUV!@vsG~; zIuRar=Eb=kt%<5}ou#klT~dBWgL6?$dPyT#JWTVr&RHmk+}<4-2nbO4MlF51kn;)Y z^FE)WnfROtE^5bSUlp?ro_eY{O=rkwQnqW~rO=c7B12oG***tDbQERrxhL= z=MqrK8$mt!;CtTJbE>@ChVpmnEy3^dh}_xoL!XWxp;1p|TW@-G&l$CIxiRLdnHpNV zrje|Any<#!)inYC-Lye);K_rN#AE)LXSIU2MS88J=B7)JulL%?gc_Szca=Kbo?2=O z@;3@0<8cm-O=9Uv{t0rl3Qg-loLY*5uO`43wn7W%;fxn*@7}ce4+|;mz_JS4b{i+g z$fj<^KfrI!=jJafn`e>QGCsC(Q;qB8aO~`{=`)uX`x1ecUcc?gCEY7y9Gyvr`Vf6HZ@RxL1Q?^`|_)$rQ56IZ|%Kxqr`|UwAts!$A!eoY* z&-9d6D?T9_HJv|}0c{-h$55&!Y+o`Vl&H7h=hVj5qzvf`eRgAJu)kvh3J)7slt(Qe^owzSUpLyAuQ!uz`YSGCN3DMc)x7El& zODqwcpi?q$i?b8jnEziAo*c`4(mr~8UQgZDSd_Vht_K_UuV9ubapQFhjq^L;JimNp zmz-B+nMHNy36pmM|H&p1c^b>@KWiM7CI4 z4}GpayE`9xCu29{&c)htzFiW?eo$#ldm)5`?nezHM_2gpoy{9T-f>Jt#?b=9FQ`pW zManb@1>+BnQbkHvy|Qp+54%=KSNRbN*d5HzNHXPxLkK)^4U5wOA>Jp4UlM-(#DIOm z#>8ODlfW#ar5-h?ab>6ZGc z6wCMlP>5;`E^9-Fc+yk~qXwewvzLmD{z0RZCy4feRBZD#{^4`-J4-dca@Z8e{DW`& z5E4N;h)-u@0zz#T#@>G!8PUH(;h9&wqD>BHJ;58WD~kjJG3sn&;!K1GXtUv`;0U`B zZZvXwcans* z2YWkuwIieQr62K$#A(psiDcvZB6z(G#_^!lm1$}G%f781(>qL7oytEX9?R}myp3=a zuwffX+Sr#}RF$j2!w&;Vcl67ii^^4BDmV*h!|MhUJ@S_s&d~J+y?kwcwS5hqH{BzA z`u&JglluO>x=lwU(78=TB=E(x+wW8F@E!Q<5yd6RbOdUJzBdlewegisDAe#k)LhUd z^*uC#-yd2u8Sci=Dd{8iaap{1<11l6#QMSVHD8(P4(gLOv}@TbqvzMP_|5~}dMqzs ztkw+g@`q_(a+_=bOs8vn7n$m=iI1qnV|y3bw>s&qi0(Gkt%$N4BpIMgGO z=Qxyi*1Xqs@hdT^Me9f9`m8HNBO1|5LH$k&9N!wBCj#*gb-Dq#lG&ug^Wa8rvftys zcc4^62d@rozd}QSIUnJ2)AEL8y~P6v$@Zn6?EQlA4!a+**~Y%zsJ@DC0WrU?8@k}~ z_T#~%$d-9saPR#AK4@`!IQ*fO-rA_UNGiR9j$qA4-m(!6deJZ}Z{w}lA7PZ!pWAtO901PZ~8w|rFXW{cW6KfxC9X9AKtfzZb{s$4ofJ5 zRH;WX5Wdw*P{T(;-%*NJ%FTGvzCLGMC&+!(qE_p}P28l$bc#KoH^Z@dgeKsJ{O0_b zeAG_(FNpxrI`!xZ{)A(w`eUd%2&rg=@wPsaWFcgh6ii$+;yvk)YZiD=zdZ<{tX}yMHzMo{ML(Ti$fx&QneJ

    }0qVvQ}J0PKt$5Y8}Z=K3^2*bKYphHJj$v5E(QnuYwg{RB^ zn7qEy9Ra(Iyu?KR9baW3kwpL>itO^)Q05JJspKWvvb4gFV4%kpned_h@Dbxfh4Jfm zZ9)J>>h<|hb+kft_~MlNU7c{^_URQ9;X>J7=&;>cOz%}4CzH(oQeAmmZf`$Yo~yPCx4B4LDC(il>t=+d6X{kkAjn?6P~ z_z~}Jn_c|c2P_a$UcTyM=<>^$4?|X%YMt^UwD>L-GJM`n;I(}3ni*4CsAD3P5z;VG zs3S$8@=CCaInr||%L=no5PUYmX(&q_f?)!cQxLV2ct{y4FkO^baz1idT07LBSG24|-TL@esMU_4`>KdZCdO8zq6Wg*7e z+Vkj!$+^aL>Ngz4_(*uuHFWmON(=A)5{Bw1=Uvd7RDbNXCRnuwHY&i>DZmsdz;u?N zAxpy{$46)Us#k7yH3*M$jewIdT?{lK;GEzx=A%16^BUD5(tvmn&2VTDT&81S(2k`s zOz7KQkUs9iMFA&50hbj@9F8CX>n8!rgFqnk12r!pPFX?#nnG4iR-j5EJR$Ctvo)8M zPtS-H-RW&#X(P`0&C`}TAt&vj%B-xBJt}6!OK16@Idue{;RIJhERiDp28c6*O@)JY z2V6+mY%cSRun?5;GIVS3Fi$mVn1XTxadaqhbH!+@`rF`J?+qENzRB@B|GBCw-1v~y zrW@?19i)_v45J<_6pxh7LXUBw!1cEU^X83hd(w(}(*iq6{~#zlZL|Bx!%qJFyM3+x zb}B+#@=~n7U_)n!BZ~v71iZD14a15cHx=SFp0mO2^bXpvDb?ewhqNXAggB87v45i1 zuuI@)0@YN{U}kOVOIANSks8KI*v_tc*mof3$m$k3v6xD*!H6@x3Btb#UT8q*+|Kp} z{gOcoB99;qmO{&^AK~$Z-xOMqMKk9_b1sTNKPZ4;of^NrX}fgd2WWi)N&C%x;UQIz ztxqXBQXCs+Lq-eWC}u;@PsE?uRTpQy%!-_d*)t`#gQT{_q5R<}{UcmJe!c+36F=%3mnVOsEV8qg7c8S(=#-SuiFg93?K zb>vOigUHrSL_qWYz>3m?dEjLTWc6(-=R-?u&u}T-Ga>ae;o6C#(LWrg!rC4FXT&V) zQ<2B%LCCHeoenbS?prsfd_l2U#pQyu8dlQMKtqBx_-CeGH4P1$jBcya&;besr)X75f4iDrg8K(pE> zg_X0?%lR>9Cxx3Qg~BI=O#kCcP6{Vxq|=K2<6~x})AD0Xf>~>dewd&J8+4#HgM=MU zVHd#9j;D+ZbBpCAj%pKUwI!S7CBo$;O#j1*>WXOvKUig1YI}dM%CHy*8~7qP_`Cr_ zUH>dPP=`Rm(WkK3f1hJc8L{UV=}R5eCePSPH|a}-=}VdZhZWV8(hAa9WjQX^C~(sz zKpfGhnAr1*YLhsRZIEQfaAd}4WSgJJba#p>Kgw>A~VlBtstcb{=3;C4>tc257Kq|s-Yt)J#r z9pol#41(yegX^%P>uAemU5jR23uj%6W34HRF$rZAKr?QFF*Z`g%L!p!3uRsV{vSUr zh371VmlO7ZQ&}aL{Gr`Xi~Q=C#h5NWiWJlGyn^AZ!upKD`t0~!(_GB-r$wQrIou{U z;c5_oYG99LV9#mLo~t8(Rozr?B*T;wrc?7XmsLX8AG+B{Q`k7rcP+?wEz0+UY$?ob zDadUp%5|(L!z;+0mK1gt7hcv+pFyR%;nTO{=*t}c56xtl5bOzr10UpnP+*=((rD!WBU@kV z$TR%^xF!rq+h?oD)BLpLh!bn-43}T_9i-bc9&LFwLp&X@hNljo8SQjQ-NNu1F`5f; zgbNwei{LcYhzM3mSYt%GZfyHo%#~Bjl@klS6G||;v0Rcpol2UZ9b8WV(pS-(c)+=d z#L%8dz>eu?CPrP-P)+{0Ak-w3SOCvt4H?Z@0yYPVE+>{t0LgO=o+yVQgV_t%H19q= zLp_VG6|53A_0n_iy{xnOAW;&ne*W4r7k0j?b7}O_b37+m!u%G&J+fs!Rp+IbbC2q{ zmLZhYJ>XF9rDx6s$$p}(;X}y+l+@b=h6_!c(y9Q%rv@r)2TkGg77X>`f1N^XEJI2w z#pl=Z?OkS+TxPI&?Q&_0J~Z#Z^(nq3M>R~`%cegwyh=*%6_kfkGr>&U(z*_`Mn7+i ze=@Wt{+37JI#|x$nmTph7EVF|K6UT^RlumU8QukD7?}cCXnWj!M?$>GK-E-0NKx8XU#;uvZPzUugxph}y)jpBccj`5>FKU)E~$L`(M**sL^sJuu9afSV|K5TE(w-f;vYe2_36ULD^V*HhI3-D@;D=N#(OwM3NKaZze z^NcZvTX1<52NYigD|rq0GAuoNr!)(UXOdZaNY&qVWSo_(OvTGO*Tk)5lQr{ar>78h zb-LJSs;M}m9!W!bP$W(^O*yVfLNzsYIH0juR<+y5+Y_N^{Wd!-b=IER9_y2bTGak# zX8V1jZ|q>_HP?uc#nO%7d)VPzo6(w&o1nw_qPF1qJ;0Gc$g1hyGuiUjy2Ula8H0d= z*-}*2#)#tFXjr7?8t${bs5tGuto6qG=}FaNy#6t%6`D;#0ZH;wT`Si*@nVj1+@F@6 zDMws7n3tnhxn)x4Q_kFG|$u^iRe6-($vr zs#k;&)x<%)e-*`lXta+59`ikG-D-^vO-@bxTMD&ZbU1WmFms+TL;S@juC80w|Au zQgR4Tqn&@8S->F0N`fm!cJ})vUZI{Q(5g47RZvb(+tao3S*7|GJ53T_*J_Mn-y%9% z;`U0Tz}l#5=yOe*9kG-~l74Faq-l}zLkZm6+58Zwf{I6Cj5tpqzecyUqH_W0b|}%l z(A4yZ{AUa!bC4^n25(47;N*w-idZN@gtTsR*xc(YnF7Hu?#uy&UmGXyr=ULWf& zttPH-%r|d#&7s5Np%r9&;~tuT@3$$B2I28!6uy!cvnZ~smqggQUC`YH<)aCDQn%rS z@-8YGhrSFYO;u(RnFA?CJLxA989xWZ5bOi+7?e@l(0S@Br-_SUJo+9p zJj9Q0+m(M)%7{eTJ+Uu&>;}GHfYn8w3Sjy>YnrJoei9#c>iF=DI5!NVZl9WNuK+7D$y!RBB z6I+COKT25c2OM?I7^$3+NqQH+qc11tNjra#;8(S62j*mo=Eh7F5TMn;DqB2#m}9vW zc}9}A%m}^;@ZP zTX=@uwAtjz$^RC<)c;*@l!Ch5gU(PP++(1F3O)roeAC5CF>yU73(5;njmbJ0Ksl-V z8$R`WInUYh`T49lNbF+N_xb>+`GXbVELKk@;3AKY~D03fPuDx)fe|iA*X+jJC=$-5wg8N z1gr6}P=e<#SMs+&O`Mz(U|yT+V@Amx56Nx?of+woAgyT##_$3v6N<2aEt5V9ol@2l zQ=FUv{Pf|@P7*~y*r=#$seT<~sJ?&v+MkjAz>8Zh3Hsv_oJp@;Wy59+Ef}@FSxr5D z@cj|pnEGdOubTKc{R5Ro_Fo3hH?#Ixhi2_&d1-ChWfM2LcKqE$K)8o4Fz{SRSxCgd0;Uo7l6b)M)oI%lOgRrTUQ+pTrE&H;D{undoV<5; zms3UZHP}!QOR9c!&<_*OQ~37^vEW&=Uz(5 z#?DOAz{jB*vU_!Pz2R0Tbgtn}J38ucM8wfya_k)tBvIJ{;yRNi1HPlp#=OueD{LsT zg_EPnIT#0M@?bX(q4|A_kG^OKpC%PV-0)rFd6N7@}<%0$5o-sN-ajjo2dp z6n}5aTNl!7X;|jqaLNjfbm)9b_KtV&uAfkIEX|ood}nN-@+M z&X=uLt(GD<#M!6J9N1CE=5zQwBr!H{IQ0m#Xv+R8AmZ<*4g58VvD7v&;47)_g6eDV z(RIv$dmA(K#G^u(07+lybbUv`xfJzr*I_x!4{%VhcE;BAKJk#(`~HjOOG1jNvHAte zm;yLc`R{hRL4Fg<*}0MDP*a29DW|pc=iKe5%gy4iJ5)(8Uu%T74KuNqn;XoVT#V;w z@L0Cmf_xz3N6Ee#arZ?TeOD+^FJv?jHpu|EMW_ahi`qe54x5k7`i8^Xxink(Z8~pK z!&sM8(Nuquqmv!9|2`g7DQ-%{GOB#0ec2cCby?)GY#@tb9kgCr5R6 zrZw5EjGChsm1L8lj0%Y{>C%*&Zmn<29qf~2+ajMOFc;Y(*k>tY12+S= z$aptTi5caByk&0P2M?nY?m%VQ2@LIA3?$OvI||~}7r=@c*2DooEMf*2lEDxy)SwsO(yAi$FJx`lR zY~8p0KhsPEz=yYvH5m-eEe(gw)ByPw{XZ0}n^G%N-bB6mrkkJ=Jqdx&0-xD3yb1KP z>KH9I2Zc*Fe{%FRl_BiF%Ka=RNK+@5>Lpim4>ycOcmC0&U}{8OBT~a%!&C$Cst`PI zIfrAa-)81a9~2I5&)XbOM$HrZn6)nLv>qj7qd!^M?t&v8zaQCX5<0%`(+sc(Y{3i! z?NW8@Ze(}lx0rXQ9Nmo2*}im%R49Et>P!-r*N=Rlv*|nFwCzjhWsQ*{PGMkR^kD)~%tuBw!d53vQX2V1q-eMr>cheeF|BzH?oZz&}+@Gw&Rja&0ET2{*7gZdAC)S&zZxg5F2bBjO*ne*J#!^S)6u_@QZ>C)NlS?pWv74A!wOl0g9D})4O zihX_Q-6kt#4e!CZzmV8gP7urI4(<`_=@{ zbLsU&mFVfO8*5x&3%i)r6a$uTjOxp{%j`AtEzj&^oyoC4WmF3`Wlmv1aRg-%~MT&>=#%DVl>qxCIWUYj48yXb*p1^b?f&wZa)Kd*yb zFLm3;quP_*iQH|ESw=OfOOa;cdU}pN&Vi>4jPdf$}vT5W~Ip3Bhx_bYL zoZ)n7SO+cZXzqAm)fP8Hcaf6eM~tMg*zZHFu2vLBk!lu<9H6JFo@EoVZqB`-fWpDHIL`_oB|#h*?J%oEc|eyT4W z7AtfmVKcnyDzbvRV1GY!jKj_svrFcD8550(V+#|Skr6gbzsunuchoY6d31kmK$>E+ zu`oGs=xBFOd2RNzX(n%3?dnqxyt=J<^2Ozsulo-AkGl~hRNj5Pi7>gJN?d({C|lQ=WzN-lEdlGl}y?I zcau#lkV49o6{#uuGGoQH=Ib0AOYf|RE(^)WBwcKrKSdX-^{bO(Qp8fh5t85AY0?Ht zL-Ko)D>gomoE94&=t^G@Sa0o3zsGcM$?p99+L!YWYTwTPsPvTiWNBO}(~@t}29lZ1 z(n(2XF`+QYmVf5-n;A*6`SSecFexrbvK1F_kpg{sh?GjUf(*M5@YZ`2j=uB-Ek+VovSpqXNO`Fs$^+}s0QA)lbj(?eGVq73DBp=+FX!5i8ZkyA; zIgZ4I=v7bZU;{;X8Y-ksQj*SMv(TfKV-{*Di-Iyo`MOe2epU169+DGTQyp*V8P*N= z46ksz-Q4pZKHkz(GTh@{;dT%A@b&a?OJKOCB`|!1t)wHHeJsdUU+xyR*mb)}3r}~3 z-TUyQZhuTP@;N8$!e-NRSG$qyii&*cxyf;5>MTM@K__(s#UoE@$qIH?fFPL!# zKi7%R!a*iUcF83rONmmFWRl_}wG=JINU@S8=7($Eah55Pi%AIPlvIn=W>0gVJmo9~ z*2)8L$pdUXjYN3>N%8&sXM0ttIOAwQ+6-{v=lDp%#3~-O=K7y}g>M(PnNaP~y{F209o!-J~5*JPh zl#TqnFgu$oVsmG+{GNEPupOD0NJ^!GECtEQCW;Bh362SYtbjY_~f(khMZxmxa5^tHJAD5FgF%9JUOp=*3(I0DIJ8_cFV)N^w8=|Qc z-4{)x?X4bC?;##fX1wIh^T&4@baqQrW^|vQ`0Zkh1|d3Um%TNOq_M(kLrfqoxhV05 zoDiKQ8KM}1SfgxFIZ;BCsW7lR;(yyr9bx{Yn@>6j4EF>A!)zl}tCPHQ13G3UI%Xwq zx4U`R&6c1mhI>}HE9dcr{J>7{+(3BK&=Tf4bA%^w-XAXNb~hIpii-3_y3YyUP%B~! z1-6FmX|WeXR`_g*6lo|h2Mm$?%K>(sp$KKLgR^-0Ty`hTvAZku4q zEQ(Jry6{)hb8k9WuN}K=@fC9m&3SWbpPrJFnfb&eSG^mbn_Zl)nUtOEO4KEo9^5oK zm-Q#TYP>G;!*XjQ!0 zK_?hG^@|Lh2@A)cj#b9Q5`V)K!_InHD@#%gqGotckUO?n19>CI#j2UG{!(Q zBWgy>talRQc<(fa_g~2OfOc#}_1zM{&i5L?y#I%s8J?n|?5xy;r0nTe-uA@9FZNB( zneE6bZP_?_^5}KDNcv~9ZWk6g0#mN7ElVKkhCTh9l49|9(53NzRKBA;7=O_8vGSAnPfY)& zCzSs-d>j9@^^`+9L0O}uh9&V!k}gTU#JbRNC*5k@?0C%jfa4oeOlp)uh#8k|Au48+ zS;c-8$23!#zfW~QMUSb7DnyJ=8Z1(30dIe8s?D#n5XsVKp?{k!#1bM&QUN4`BLK-> z04b%w3Zg|lUWXvFwPCE*4~TX)Q0#1=*zLwB(XNZJglJno*2aY7zMYQA0nY1O;T`o@ zN4o!T42em0rLQF++9t)1lN<%saoywSI7y@Rk25)^EahG7W&`vHn`Yf^_teOmo9_&{ zTiBkOdziDzd4Ek$S|pP_!0usZ{P-|8IKtdv;JknQ*jW5mOAmwNl8Awj7CxM*{FbEF zCkCt@ePX~7lHcmrC-QO6OvBwm?BU5dVhW-o4PjGY`%VerX*o(<^6gW$-`u?7*=d%{ zLd*EkS2mp-JwyTruK08Q1wPw{zI&G}zBh+l+%P{kzJJ&=KE+u{jISOf+NS*4Wfyj= zX__;qiCM&Gqxih=TekZ_Zk3ASGH5Q1icO5Q8*&X5hLAO6-)G%tKb3JRH%4c+I&Eg3 z^X}N=*39eQCXyaUKi77#}v*6wld+&6GD~ z(b=u2k6NbbPWH5fUH_4iBW#r!C^-@cJNtYnpMQbO@DA#e$x@7tZ!PvS?shkGZ$Bw3 z+me=*=CLB%;<3VQ&$JS+)n`5XC<0R&*GsybTysjU+2;^*Qd|yVPA0k%H^y?~(#K~w zGaZWY=`IIxB9g~9W?D!KdPqS8iXD2kClgs4uzfHN;t_*5Z!_kCV+@NO7d^A)6BhX3 z;(x_ex7Pl7^dpk|=V`YFwy$2joqdJ+QijAM#-;bKVk_5$(>gpJk~sJ$lIR_s((}+m zJu4o3kfB8%Al51L5Rifw_prC6cgASSDC^3E7)@D&nn)Tcj)q+>!?^f_^H-N)kBNTw zr%&guF2%Ed4K~ zn~-3O&xvn~7vfE+b00XnRX%c@?;Vr`0zK~GmayZ~!g?mbQScuZT{L){=uYy-5jBjS zd~k{ss8#3>9U8rCqNtNPt8tt<&To*|Cb_?0!oXzZW2v~lHe z=jNC2%K<5WQ7*Cn1S^>oN$s~x(e9yJ=@u!);>{``Q5DJd=q$UqHae<8S>X3Ooe9yJ zIBkf|c{0%`kSOw{>0vE5qHRL+#l3ikdo2%Q^=i2NNU960Ym2rj0v3_{7 z8Mc(@Cb42ku7a(Th<4JpNkfwkPdYY9@j4F(JkvAR8<-@O2KW;TGGvp~b>2|j; z<7D%HiHkY?F7DE&axQ7+dIK)D@O4QM$HCpqT=|xgldOP|72wU4XiNrX4Dmhh1(j=!6j)zPy-)D|YegW3n z8e<@>Ph$+^GLj}~4Q08E1h^w>D2rS^++p{ZU5CaP;Hw^uF%ZSJ6XMN0-XCucJ67l+ zEhJ$=cp1x|(In`{5H#{!=DhfK(J%t&!;EC*O)u~^Wfd$dT2XVcR905|Vwxi@)mgxQ zgAPafn)-;_|grg>d^(^NVd~k84iaL zgoQwm5Aan@0m+l{l}e-Xo>XB-J!GZovv^R^q~@bPj16p!Nh3&WG$!t)@0=ZZu8i@S zS#EE3w(r?hbfS?BT$Nf%Ents6C4;G;Tm1x^l(lN2PM&B18<|pEc6OhSSbfB2noz$e;!N{b zDoXe~>~@EjLlN^FK0eI5e#`>NnB|2HFE@v*(S@4s~4#Wk1CsAmuFKdlYqB-MvIv^poJXYTEz*PKQDYbvedCpM2>!=Km} zWfxktk!}RVY@%Ny>wY?dpeOeye#{8?}TkRCY#R z8h44I!>Ek6$3`XF#TXrPZlVFUm2?;)o~9>YK_Z>?lvS0Z>Q)J=J@f=p*=8pD@`VbU z{90Q0x+KP&rd0X&~UUtps z$gQ`?xc)}@=39tx?O;v&uWsJ^%uO4gAy2M(_nNETTYuT`jW>UG#e$jL{j1xyZwHl+ zjy8&S3ESaNZP%dFdY2f85PhGpmmN$-CLfmMNwrT%Yc?rzW2;txJtcQs&vy zqt&Xo4A#ny9GhfounDl~Y&P3rn;5haTk-_+hU8?E39c`5eA(P3HR++V>2h?h>xOhk zb+RsME8AZ#Sa5m7-{e?d@=*yh?;~Nyb1HXEh691)M|8uw&p9}MM%+y>cQg6>?xrQ* zKR(Oi$aJN-vMd=^lJCf{lJQozmH6#>V@@Z3kT>RcI$b%gJcpR;^f}=Bu_i|C3vl z&j%{T_7457$i4!9vnI0mGQQJv7u&~ng!d6H*fRYMGX9C%pQ_(N!GNvu~(i&$hz5gXOX3S=9M^f8q~+_xCtn{$P*EWSJ7HQ5p0$ zug|ZS%4__3$?o*)kG}vwS9D9Sk&E9QS+D%y@LUvsK-SdnRUCA`vM=M&m3p|xS zYInQcVH#e4+J(8xDed!uQx-@~J$2MvE49UWslCcxq` zK>$O4>n3ntb`W?C(Aw5fHU^FDQ(dRJ?toSJX)BVOcs9Tpfnt&}?z>_EKMk z4Inhj?6<1Lf>JCNSbdW(QJtvXtg^UTuQG`$tXi$V zb5Vg9DIBBX*W4K#Beo!kB=>hnb|0FP_L_+#dP0e8r(uwWDh;3OUfm5TMMR08%o^!R zzZ-%}`+C`CO|^0C1Fp#^+VB0gA^rS=2WtBgT2LUh zYK>&OJF*)i%^mT$9Ip-SJ23Qk%LYLpweGFWw!8{XuHNvR_xu@b1iyMS=GSN8n^qzn z0eU8#R=wQEO}fO7#b7L^Fai70_LT$iLb}bNcrvOM1`6HR4=ax;W6JBw zTgtrhk%B}eX}>V3G%3_x1Yx;hFRE0WD!W7cS8hZy4XW9W0P?`{0!5X}6>-5XqoN#Q zJZ#1zLlrQgCKWhb4U}w_dp+BhDX-Np*8&rEmoTQ((z*YoqdjWJ7m{6nD>uG=@uIy> z)$CQtE@#ZemAwODeQUgu>rjpQ&kn&$wDBBmJLj+mKwG`x`4M{@WTD?mp_C9JoF#+^ z65_%r8cp6#Hf4p)!qb@>@ICwi_BK47|6{no+K{EfyLIVah@T2t5i4vdR>+bq$rj8u zSgM5s>r2-42Kl0E*_hXVhja?{5%;mC2Y7!frBlijgE9CToQLcrgfO1dFEAX4gBA+z zC23NI2^q?<&U?ZAqK$PNc^yzxPe?_+TY1iM7LT2>L-9N|GpEWZpB#cr_kK!=y>>xy$?eBk}v;%xPMER1z%}YjoivZ zo?o!XL7oj;M+WeI@GX1{doWdc01dm;?`X&HQSAq66P~0mPUpKzcrukPf$3DbG={&A zU%}_VS$qY1snKpqm==DoH5srVWW{Oqr1q*dqy7wfazPwS)s1;!lKZ3t3KBDadqrx||r@&LfX>c0<6MTs8 z0I5X`X{|6NY{r9loAw@fSL5U)mqbZE8At{V*$5em5#|huNJJ(fqL6SsR9F0UsV>*U zd!#+`p3oj;PuQ;}IW+L7NUK7S{)Djr0LqG_stF+EZNQ~(wMbl(U3nP?>9_xrq=w2(g!PXmqlp(U!~%2&WXz<{ZjF~lnZ zodEop3Pp8)LY-Gxb(T3bGXWuh5dIFn01AM>>yAEuaB1Y=a_rVf^U}zIXq$4KT`cvq z`wO|I!{X(sLbF@4qNe-sluz_m{1wNG>uk)<0d@6*GtmT<4&HII&2Ol)t8>3qT8Nm! zrZBrY_Xc(=-tL1V)LcDocczy}h$aZA2_b?fX`oksR-hJ}g%~E-4z_X_qj_#dX(8C+ z&2=S+ic&WFGoH(V@iff1Y_mNlL!s2VLmza(T?5X+TPrVhmq_hGjgW2s{%C-Z+S@~< zx4hE%Ky#7QR{H6@yy|0Sy_-86Rd*!|uRB;SYkEHW8cvuFwx@IR4FEiO_Be>Z$E~&} z&?kt038R(>^DbIM%m81FTmgUJJ%0rs@{Al20zpd7&sixxSmLQexE*9rEB_GK71_)0 zjrcytq!!d_;O^%UtPRK-9|6E-l@YHX#Pa|}xB#z3W|`YFRH%ah%`&$w4rqQ3`3{96 zvrxB0%!_=Tf094JKgZAWKK?xOQvjfDDF}ss4iV1chB@{I2f0{u;zUD8T&Rdkw?=H` zp|Z3n(m}JhT#-!^n&wm?H+A@OvokmxcF^J@&Gh+@NqRr2wB=@tLlWUBtN;!5g`eaw zr3L5c110u_31WpHyL+l353j%F<0EOkw_yZ_x@!j5q=(_B@SCjJSuj64!faT%V%vro z*x^5!CaKN*k_jtAgbck;KRoh3Dk#d}m*IZ`6SpSY0m}gaIG6I=0fc|g6So575df{{ zG>mL2>lzsYB3{6B>$KTza~0!rt_G+Yz@}-J%nLr2)oum&HvrYr^XE>VJ^7DqS%4OR z^0n!0opTX~2EZ`@{PbB1&L?NSy%4BK0>Y6Q?QQ3ED?fS`Aaem!&6v^NrhSsm1IU>G zvS-YmciGN;j_(038=!x0%$hT;ZS|W^-UiTT05W5C+hubV6OCGc=m7*TYMb3IygqRq zpgasPe(s#kdA%`=2S|ZbKlkGHx$Ad0CIikUK>H#91~n+MK|~P@Qd?|fzsDI^0VODS z6r&knUu$0k2MPxH=#5|;h%9~TK>+2WJ$C`zE>R^;X)4<93l1P(ZD?TTu=WUpi%NIG>so3aVln zN)?pj7NPGs)5o}x^+5;-2Cdwo-m9c1q|*iIg++i(=x?_ad-zdri?=4U#t#>04+yh2B^JPzEwiZhinly9isSHE%kNAsHW(cUY4bno?j z41-U6vP@aaj8p&hhi^3%o4z#PYALsrTXi!bN(0HE*#``;c;#kUgUORAGZrT zxn0D}?ZP|1-s=#zi&*~euZsyM<(p2*U-&O%o&V+NRcF%M{wL4#-{U_! zxLx88092SLAsnXxs2_J`@&tBVlgU$LVO}QBAfO_X=T4GQzzJ_AuY?ysJ?3COF2+o> z<6@kJc3g_l7>kh@hjV0JCuU*}ECQp&%qTyGU-|0rL6nvP3&( zW2)TR=gBmfd7?hqpv>=-?L-=#=N-4WzW0#o=b;TVF$uLw|uc_`= zSy5hAT2fq8SP;+8%Z){IvLoS8FyQxjJ#LrNVYgW=W)pABGU#<$jasEtaEuZZG)8}h zv<8#W)+85=3>#J`l_PDzWVG!hMr$(I7EBH~RVEp1mBoUmN(ybkhD+jKz(u4TS|{gHBr?sc+X77GQsaR#zXX*A*5Z>4?nTKpX>!oS}}!{u?ONhQflz zq&w2km~=%Nq$fzSoW{2ElB35oH8yxcq2|JZB&nYknVLjoaMBo;MNlu_CaJ7Xs^r@Q zXG(8_CBY2^I~FfZ@tE2g*PjKD z9=5pAIWs5~7cagcm|Q!i>EzmwM4OwPg$0ELNt!dHb@7m-(6)3~VZn&8!O2ZYdR=o< zl3dqZSP+!nM0%_A`?W_JB~I%F!K5ZKI5K1L1+8ttq(rXUf(^VW-LM<7jG2tyaB`;oc%7V+#iiVcvyZnd zk)9}WMp9@^2B!s+IJ+s5q&d|RX|KlOY1N*PbTpH~f)UB{#xym~Ols;|7xVokzI1+4 zk;6xVi+@6rv_`tWJ(bgz;V5(XpCDx=J2`G@Nz&GrPsZcP{CvqoRP}#JrSt{^<#J_V z!6hj=GcuPCrs&MZU=pL7lBBJ2d z7q@2GcEq?-O6mIQ<8^UqaG&LCe8Jej|)qMCVi62Npd+#*{IJ;snlbd z(i{>TlH^;5rD?M^6#5TON{NT1v*hH&X_?1N_K%-h9&k$el*iLAW+TQWxhNemZsOv_ z+EeO=M2563UOXfc9J07|aa&4UG&K_BBa64ND2pzh+t}Kt(UgCY{|!w+?RJkWFqJ)3hZB2r`#ST!|?af>Hq^ z$cVF>x~N)~_iPb>MRF}CGvxBL6oJfB_wfj(rD&SRr*9OMZzO3xA zH!YsLcw!_J2_=2r=EZ4NNGfJ|o8>FCrNleEkx(JP9Rh#2mGE$f;Ad0e2gLoE@8{CY zSE}#r5k>l*G%e12)5kcB!)-DhM@FVooQJ)bjazUB#*uRJCLV=~N(>l6cya^^Wp&bkHG+rlh4qPkDI2+^f zd)$dFcn-VqKE5D?7)dT!MBX8L73kU7yHh+voGO3LK_kw>Xe=T|;v+d^5S_>-vUTje zoOI@cruy%j$B7>CbyCY z$rFF%N%9R<(DxZ*S933O-}LSiwc_34qwv53@2?(Y9tu#6Gcg;x@HNRL`J{j($lEkd z3mD<_J-xl<;!ts+_>%Y@B8Z_Hb!b2%Mq&b{VgatjHoS~o*o8OoCH_VTVMI&J#7BZ8 zLe3^*$$atzSx3GnJ=9Kpw3^PMU34#tvt57O1n$Y6O})0>uHNr^Me%VlDZVJaA?vpa z)u_jKv|uheWsPmdHoSy`_zQj_geXaXqjng=tMz5i(=q9?8?xP18*jU!Y zI@lF#72Cx2u&+3tE8t4Fkz6acfV*4)1ykD9Zya+Ro82?D=kA^tdy9G-dN1r<())bx zzTVG8ow!~60!oyi7R{KBPW%oFaXo)-#u_||$FL8d;Sj#T5BL#35k@q`P5dMv>#d%g zK}M2u$OO_%&L`)S8RP;opDZGelP>ZM*+HHsuaeiv+vH>NJtfpei)axYKJY8G|s03?z?|chEui(L%PKdsDiiLd}jTW>bTB19wP4 z+1mhDM<{!ZOeEc8G_{lG$pCsYB4i@rNjD7NdalkR5n~-hwL9&YnBw>dB?#SU1_ghG7Fa%Du|H zN;w=Q&r=^MA!;JvGu)5W7>}0`Vo^MbYA9#{7+TPZGhw1Xkt^ve%p`ZRzmNy%AdEsg z>!d@-?Y%#7gIGBRVJm-ek$Po~8j4zlkE`Hp+#w9abSd7YoWbo^TqEV#JM4(qEQWfg zD6)D##^v|`!|)MVf{hr44~dIe46|=ROu4L{CC^ODrL0^lm1#BwGxU z4pB$O;Ch@Z#fZ5j+;!Z1?n*#BiYstER^o2FfOqi#{D`3jXJUUGCSxjQq7Wr0LnW#) z5QEWxGjJwG;~Y#xE6&6DxCkA%4EN#*Y=D3f7>{!?73bpubf6QL;tE`aYj6XW;uhSF zhwv7CjILoJdLw;_UP5Q$Lwv~o!~}8<_Hs9I3o#bi7(*086n{dIwhcSj zHtb>BWX@J3*;edeTd{|21&0Jnfv~69Q(f5sA;mUrbY*{+eLu*}HbP_@LD?;A2|@_4 zb2I6bOuC#cK|TU(MJ8RwmUImW7zb(C5)gdPmOx}nK*b&Gp01&z%C^XvezkIDbsuN- z#(uSBfk7^I50dO2>|pm`54#5(zGwGMA_MFEb_$%e}5nQS64AHGq>j z%UJ`~vIgvzIa62z7P1EHW({DnBw-D#fz`8mHi!*^kqN(=kAPw(fH8pyEWr|NAR7oH zs{>(mtPTRJmEW-z#jF+yR*O-r7E@R)cCcFPVYN`PT2_l7t3(N_gup5>npL8eRYCzH zD?ooSE5LGA0LBVfA+ix*A-WV+1XwVW2Ivy_5nz70q{|-=25IOfjHa8=N;hFH-GoJS zQr1D4cbRd}#VijCSsvD~JTMqp9*Tci9umh(0hR}f^(=<%EQZ}IhW#uiH+T%A zel1O5F)U{>tYI-(N-4{I&tec+3=DIA%`H4lMj@Xa__b7g(p4mGE{a($rm$Qr{58Lx zYK$qmq>F#_ zHx5eBr5Ht*N|kgOis>>W=rRdPsMLv#GA+*Jm!g<1Mc*0Ae=V=4OQB?2*cO(@@>q<; zST4(DVHRc~7GgmbWC0dne&(ku=nA@=E~huso9QyTj4q{1=@Pm`u&$49kJBlYb1D~B zF0WiuxxR9HrD_{(qiwX6whCItuSdOa+-b1ovda!O4bK zCL8XWY`AT*p=q+=tjUHUlMTg_4Jk5JaKsHC#SJUshI8VEs<@#tZYYl%^5TX;CelnM zz<}puI#{MzzQXJ_DTpLQMNmt;SbZLK5IvF4_ zp9++OrUweroM<}94n4~e1TdaF0Tqc01*%t7Q&fVgMpdLLROPB-s)#C}vZ~E$UY(`Z ztF>yiTB+vLR1LK?B_0ss(%Pw2$xDfnlPD+Wc`8wwURtF@O)(rv3mZX4j2%oyBzH{1 zh^fKk&toGgq8&3asfY|FN%MaQj2JiAnd}!Iky43gC#&NllA6(znl=z}b91sfo}@RX z2*x#~h$ykH^GLz8Eg+=ex@DeB+T1Li)3kvj%a%36eo4ZaFb_1<3~Bfmq%}k1Ck|)) z^BY}i8kNlA0l7VUo`THScI#Mdrr zXg(o_Agyj}*n*Ih$Z`luatNL#=coN7xg04;%lTzF|0!}C>OzeT8$zKznL1gf?o^rS zr^-y1Wu|9jSXw4@l8ovALb6Oqb>N?5{QrSW&cBp7sWsaN$A9A>TQHpL+faYG6u4}S zG`6=!8e5Y~E}7w!0tbJ=EvP5^GBM3)>(ps8q_nL)MfOG78rhTw+bm;ZBp@^Yzq zc%)$iE^i#ywBd50y`gKkFuXC+*3i6hXj}feQ*L)t-|aT!xBZKYwMiGtm+m!m-M^?_ zCshxX?zK+3*E;E5LxrL8y=1E&-LyfC!OiuP)9FU4)0*p>T0MWE=D~J;?m*d^2ZWqg zdA4%WJ`P>HIjN5fP8uSE<*LF#g@dFj4sunN6raviIj>B{jMhtJM3zvS zb#^w-gRIrg`H+9EH%}rbE`K~Xe_m%N={(sC(0TeH*+v}cZ|8h;&L{CWB*FO^!|5b( z67M9PkRCE~6?s1dBhsN@j8H=0RD7%3fnU@j)KH4O&_E;hKr2%nbYc(m(2G4VKrbFc z77XGs7-h;MOFRY>jN(z4WoiL09)%Sq@hEICiT{8dX7PU?aKIw|15Q}QzrzK)_;VZT2JG^j+zrY8l_zV1SiN7Eq(;z(J-w={%7+&#jh`=ZQjBJ_a$TSMS_%mV%h(94$ zrg;d7KOr9>@d)Awi$_p^hFWLk=-_*ax6CjN+W_#K{iQO22YOxzbQ6qL^7;40CaR&N}-(olhh~Hua28iF_ zOw@|sV5CgX!a(sGj6y>E8lz=827>rC&c-0|Ym9%zAn`94hr!}sFkYtTpi%q^6EIZ# z3QaO?#xU_KOvD-DAxx6#WDFM%p+%85hcQ7S0hr$81axKgUHfor5OvbIe7P z_!)mX&@6t2i!n+344s%H9>6?I77t)PTEqjmM5dSGTyZ}xL#wzS3(zL+$K{wR?#C6F zCVq-5ah~`oeusAPQ(T31@e?e>`Qj&7gz4fZxLT&yV21cHu9fNUae??TuET}m$G9FB ziXY(y%o0DsjhHQdgqtv1{1A(Ak@z8&$aH@x=7=9+8Rm)~;AV7)A7D8y7C*oWbc!F~ z7Icd5Vl z;wtf7+$YmDSSaqrT3jve#UEt)M_eQB#r?Qedopf+jtB&if`d@+$6q*CuF(~i^aF_Bo>Q%upUdqJxF4yxCa|#+J&3N-Pnlb;%;n` z>1M1D-^5cgeHyojZz6@2;+xolmEtaJ#VTzhL^EMd<}oX8u3-Ug0C%h%oxACy}GTy->;>*}8(|7Tx_%in4 zaq%U*C)4-wg!mFZkm-k5C+@^Ycv9Snk7fD^){8IVQ*?1%7t{air~f9VZ~Z?C)2XyJ%S~5Eu^APH zY*4CFM8Am=C^#v@pj9eTME?|H)U8oTyr&3U>QPrX<7e?lYDf0ep2dIvTsxBQsYRl; zr&juwmXw=9rks!|G@Zk-Alq?FP~a$n+zt>D@7+t^B1O=kTyVaCw{ZZ6!Qm;6{FOeB zw~eZRimIL=cS4KV#0O`b|GDL0&p{M-mzIzg5+ce-I9gfJkL)0(-uFCFSA>zGp7+Zl zF0Eb)Yj340&O#T0!7YF2v4g^`pe}CO|E$vxIuB_Qxh#&G>j_gLFyR;;yyv%O1DkJg(RMGL-)uYGslgJOFs{5ZM zeL?Ys_&NJZA?+9`ChInusW!4z{1Hq%(p9L=8>A6`M6P%QG4X$Iu#10#P5j$a-YiX) zI*V=6PEv4P`jPpcyOBun-F&yXrp9EhF-fGRw4{E4Fp(DVQK!q{vb$_9 zt4pEudVC(gC*XhKl(A@TG%uPT<&-+TR za7sKX2!3-SX7!p9F{_79#H=o3B4%}DB_a}uS?z{IL?VC8>Nh8t->gd%YR$TYUCQ~a zu8?$*Zv}@dlrUNy0qLwjf@*owK!-%gzld{7kKIgcyh<{zSTq`oR#x);s>;jk4!hl9 zS5-t~(O5JRrZ$_^?yx)T6h--@c4ZM9^eZDKVX6UlD z^>Jrz&9Hx^Yw1UOdVjd@$^n(3m38NI?jgLC53j5}XW^y0>LRX4?|~g#E`75u?8+vg z9g+nf1lU*HFYsVPms#yeiN6R&lM-r;NAQd`kM?jH<5v18^klW5;q`hW|C~lmC60ou z7R*GUpyWAqW^=j9?6Gd8@4-Z;KMjROt#?uDHhO4D%lCBiN4k-yO>}n?li5)NzNgMyQ|u)CPe*p1QYbA!i>zf+DBVXwavv!V znG~7+TGfxPAVI&|?eCc-Q4;L^&Z;rGv}zak%hAaWi`nTkTO3@;IZBtwXi!W4LGn1j z-cx@l5GVaM(585kz~>oEIb2xl@mTA^3Y`L5$Rub{-1A0xqPx6Udd8Ac&lcFlPlW^0w(WTv#kQjbh@jrPOG81x*8p%Bi`IEBx#|{ZnJ-d zDzp0yq?HxXNLZ;-s?u7is!BteQUz5Hz0PSdJCE%p__1SL;K?g4dd#KN=y{W4=9ad5 zKaWnjr1$-;<3f_|=3n{ccXMWp%ANJlRV_}H*1?xNaPEhT`?qz@>;3o-Ab3&yoFfVa zs)=ditZIUk_@hu>R#s{1pM6I5@SK18>WiUV7`ndtHf~kr?bQ!fK2*KMveogr<#p>W z$48b=9N$|0;Sh^W(s`S$VNZ62DJ6a?cs7~rK>Kdp1slq-LfhHtl$ zMQL3iksuOq9z1v!|E0O6cqHF_q#Ke#dJdXvin~qb8VN+@j$n4wn9@+{t*Fe-u~<1p zPDMl@7KKe9*_Ba&SUIx*$ZEOz*Mr34)h!*>sO}(kxqnD7BdbQjlB&vzXf&;ma)(@! zmDJaB(mG<6d6)l`n)OwY(ZPT7*467)zSQM zN*}M-JoS!4lS_Cr?=*HkJ$J;4u~H8sizl7CqPD`Saqziy#8*SzkX%);_SvOIroFF7^xlHr31mte ziyeDIYP;T_`Y?)2q5FG6AlNC{Id=#J_*4k%JQ{CUljrL1R21f&nKvcxqP#ovUUhxs z{KlzvNk(j!jM(DIuJ8mSYAYYiwg=oK;0xhdG6^{nlpsV73L1Z39mi=A&9S7&p9PJh zPV27YRYbLwUWYt7YjY0B^qlMz`Q&NdRhYwR`%L&mn~gkD+f&PT_q3$Vx7H+?Z%;Qb znJ|%@0CS)9I-OpH#;b4(#Hn!$#G~{H#HDteuv}D=c)X>9nEH?+5{{j2xsh-hP5Pjp zEF6Ag-F@#K-gJNIMP~_7CvURc(Y0#FLyNAxHfS*0>2L`_xRt%_fxxGmU-_jnr(ei! zcA1yG`tZ%`8hNLk7D_M#O3dQtoLiwl1SRA#L0=TMW>EU@5rtY6R7PFK>|jo)Jvc42AhaO2vv_XF z#_+cMefrO}U+T>h)e&QeH<^PLYry8W`y4LbX$T|RpwH1owWOq&78P*0>O56EU*S+@ z8L~@}q7Q#=F05lr<4KWE1$&^*s)*HT49?G#b;#%QgZU--T>i6k7s`-LvZ1FBJsqwq z$s$><(ru)gTz%ZpYZ)mGA3ZHS2a)JbbazX-J}7Bf!YS#ShN+x_V2HEuMw8KOWJK`5{Av{u%Bc)WY$>^wqL*Jxrb*zTUDPZS^Msl zflbJwhGZ<|<4Eu9zbf8h4NU%zDC+xOi#b4`2L=rTLB*4_<= zLT`UPbYO}$n0ns~j zHa!?m=yaXdWaPCRuh(rQlR)Srn;aUK{o9kA>VqR?cPJqPPfxAMA@?S!Gu@C?6wi_n z=#-(mw1iZK(hX5r8M2W+KxbF?JS1TWW4(V*s_j{3r;?i$mAl27>yN(THaU5%84QQS z&)Fe)CXs_ua)Z!demMLZzQcEV&dvF3@xlr5cB;^2aZXQ`)w$StE4f>Jw{BHzP5hq1 zN6G!M&2+nVtA1;Im-e-|WdV6GL`$uODe>DbZ^WMxKj|uo6m1nhfld5nlS!SMn=OCw z@^iym#cz=#e%%!dha|7a9M2Whk-EG*rLWGSD6Uf)A}R8Lz~|-J`Dh*c%w3nTkFryH zigXLQ@?ahRSwWq~Rd(8BS6(7Gc&AJlnvaj)l@(R}`k>Hm zv#ON+b+5;C}Fgd^fySLx5w|}1D5A)~!Va+9%u5o`nv1ri~ z>lQ9tN0*d8+C71wfde5rmkAmtD5t`0~cNV$RnV{ zB7V*}6beM0V{~Oru&`sB6Wf|#V%ttm>`d$veeT#z*AB{Fa3>REd9~m7k9`~ITQL}j&1&U z8>khaa61r{DBJ!0Q{Z;_okAkwf)rGYAuDT9Oj*4Cbrxz=sQsw0UcdU@OOwTXa@%x= zQyK(y=#z89z}5_(MuX(ySiFL;pLpD+ZU)(!WV`8kOx33H1QqoJ1-devNcUtSnfew$ zK%0=-A~wGqiO3-Q$zJR|A%Enjr`c0HOI*{hpzwRfe#&V8dk=Obb_hk*Bq*+Uxc`vBQQ-T}9qXm0CI7+uIyk@-$@loOl(`yVg!MpF z7%tdFXzQ9yY*-(+3e5rdn{v58ZN`L54VDkJAI_Ii504NO-)1g3e9$_A3o_HR7-Z*jYpgQdE6}~5k7$%_7=NZDH!U1?b zBA%vWCZ#ND=%P^jck9|JmY%D!msjWO=PZvWr04ci-PuCul37R8{G;N)iNOp3l&n#_`G_VG8oZg*{Y8GZh|vJ;RizLleN7%OZ0rOR@$DNRh|vf6X>mU7=E5aWCCM~g6%rQ2KfM&LL`mrdiA z#!6$rTclfMnW!GMJx{X5mNe}CjX;mJ86$asv85F1h!&SVT_zQqE7P~_50^4t_;ZJR zp?o+WC;kUKhz=Vesyg_VP}Uc}avi-{%jYtJ+|(*BDP@R(!B?VIbhIY#<;HRW@J%{i zTeK=Op^Q0!$Q3}Iu@4KhuTTpulw^6?V(=<=M~f5{leAf~ezZifM6toj7_)4E3-KXi zl8+Av6riCY7^vY{SGE1O<+Cy|QC+d?auB91cQNvnYIoE|XpWq&vbgX~T24yRTfnMW z|Mi^OhwC|4=W&U6+Khu1cmJjFlS)$@>ld_z;s(R}K!vb&>M&~@~j*$&P{=tU86{;KV zbsLxm;`;3UXZFQAdNffSFFk<_oI>NmL+ThUb%iZ<#<`;C@)$Wr{N-~Q$d(>rqM8LT z(9_erWGEwIto1M@kIM`9@Fiz$*#cA=-xeo1t$N>B>EX26PP4CH;M7lJPsi7oPEfVp z{N32dvNiM(E*_|m`cWPOPzL}spJBxN{Ll(OPRSC82z$L{d^Gs6?My1okxMAw@)oTZ z4*&f{0J(MUAgli_H#AgAUB0R*eV}VoxaP?C$d4N}6oqaJtWyD^7EAJmOyx%jiZ$np ztdY`7Sj9Fp0D*Fww_iuILlebP+N)Y&!R^l3A-Rlh-ZNGzMn^H6qA?3c9w#~6O!L;PAgYCKdHqeLwBIlyy)!u$P#I~Ng4&U&E5_5gm2nT#vK@DDI?txF}pE#ce zf2q8E4HIj8eo+gNc_n&YdlU^oW)??nF{VeEN5_AQ2B-LOq#Y$$KUj)7vNTA+&nw^W zIqS$xbB2gD{#eYwP(#m9`TG|89Lrf-f2w>DVXE|QWe(Q`qmX^4Xo|mb-l`t-$}iDs zl^7cvGw)%*NIV_=5}~?>(R)q-=jAIXl&?vy0{XG@^in05OG0;s3H+C3NxJjo?W;nb z9O~VfbLN+{T0pF$PFNX%gL@A2n!;GDEUZ1V&izVR3OI~~Ur~UlrK{zseW<-)m5>iR z)EIzrDQ0crZ=!J{b>l7xD?R~P1Ww|Ts=?_iy2b>Tu3tC z6orxQ=w$H|->S~(+e-6&UxflOhOZ=bc+%EeNyvOef}WdKPOzGp#oVLt>k8{`O5mH` z6$h+P?b@J|d7^y#Cr8hE;{A4y9os z3w35XMX9fhP%;h<+ucEzw&@V^q;b^?k(J=6&8mbvfWk~&C#;w^t@ z382w6zM@IENRab(NSKF%8;W>qWoS*NCEK;Tmeo}pFl>Y90O(ZQg>}R2$_cBWvm@tmZb{l5GG|Vn-lpHl%?WEsBit!#X+aov z$z(o$y9IH;1ZnQGA4(M6&RBYCv7s0m$Z!Y=VN8y@NKUSmt&02dWKk2|VzR-Gi$s45 zp_>b|NFTodR7zQuSRPs8Sf|)v;RCEb5tX>-Z`rEM8ky3e*X^xA%yj50HKnR!eg@ypDqq_Nz>4mxCL0EQW!P4IW!`XBCMO1XE%)0W^=V zUY7<>0Qd&~c=4qif8_7wR)CI!i%_+Wjc?C~+0D;Ic5Q;+nH#$AH5Np4jaK222bgZn zryxzP&H_uP*|UP-I${>D^83v>7TLwtT`XT!$78HeXXn0r$LduJrvr@;e%W*OJQuus-mNeZSgj<-Cht?(U=Qt%Qjc;g3zo3EyjFIB^l*u{hIj9<_ z8w48!8ia~aS}Tdho!gze6F_QhuZIqN`N9|^t9Qlx1msRuCP4B7z{VVt zm0HXnLf9O9waL>;AVorTEk(lWmj|m|sO&p5_MWkNMCdL?tSv`nX0t(84LO~+^g|>H?`7Z?xjd$QSf>C^#KDg*r#`ff5vo-JBpew4Z`aD$9gfY) zPNST8WaY|{^QxV3jp1Mz^S8z36OgLe+L5I+CQ>|BI`siNOOHB!HjA11B|x>9PlyfW zHE)vs+Yk6c*BICCWNm%V<1L>$UP>y$q+xJRtTNXd*zB)i_Vc_uBi<;LJ6*XFiiFoF zwqPe*OX=`xN^i?cp4Q_-L43dOZ&q~@Pf?%cD~f~XXJ5gBXF(A)i`0AoSIkop^2*-@Lq6^rFOguvZ=-8XC;P1!!Q7oVnIQRRs3l&iPuKem8>b2$B`c#VR z_DJmaBI5btme=v?c`QRo5Tspyl&Dnn<7=joE09T45XAw-%5^B1iRvFC)=5;j(5m3n z3#l8aBk8@u)H16^6Vp!zxR?n%JOUEi(e!WaJstrzKc^I!JM|HCTy=g=rnuPR9%Yfd ztyU?2d81Bd4R+5%AW*@w5hb0A_cdybG>^|t7& zxi={(+JbTXJbMEIQU(Y<2#y`*KfekR5|$;yS@FZF!|KWyy6z|i+~b}{E`ex!(q8#Z ze6zmaF)L+R;FgM>07)srePVO7TF(RX8s!!N)IT1@t+U={6vTeimpju%Rl$Wf8x zbBE2xzOLbtF2AO)*n6I}E70M?R-yRQ>)pgove&2!cym8HaCX^!quYJOva%nG#D~ln zQY7kNRb=U9DT|JPJ_M!izT)c{?+V4yD>28iinhl*0)l7S`^r@#$2D|^TTBrC z*-9}lD3IX5;0it3C@|tq!cYDX1QNa0v!6|GU^A~!mp=2f?`PBcHt6$l zed`#7D4WT69MoUK$nAJ){>B0d@kwhsXe0r3Xx5oUNbLDlr!fU0iu^_YX?@|oYKccA zKV33^GJbD9Zc~jqNzx|x_`dogu|wh(G@f}?mACkBH-{ZEQ2-Otg})vG;F;oedAoH8 z(lO3**go4Fb;~e(=sE*b7_zkniJ+O>h7i&-o6VgLgIZyKC;JVjlS*`<5$^7Qu^Ck* zPt@8sUp8GfJ8J@HKf@E{foAT_MPFG=d}m#Gq}>okfU8wwNgf`F!}!pW--Z|4`Uo-S#I09%x6@YU{ss)P@ zukpQ9(C9#_0%;B)mwIfg+o1DclqN+c<)wYAvZZo`d_Y<8UDT@3wL004(2M4HeWo|7 zFrQ*|4Ds$Kt|CK@reEvsSVzolv1jDi)nt3|`%OpVq3(yaI+ONa_0_N+2q8L{CD+4p z*&L@N46?4TeGqs zkMj_FJjl8CAR#btFTs(xM!_^8;2ZTgvqPHFn^s%aC>}{=n>@V~eWV-%!?bGevf`l4Vn&`#cOtjiy`RW3NxsqPW5Om?1EoaQsup`g6>9ncSP|hb&_quH z|2gM}uJWrAg=+ViPmt;>b~DqQQnd8>BqbH`30o@zS}fN%y5-h|N?8&QaR`I(2EBtn zX?=wtxs@P_qwLMdQJ$cYLhQ`sDV~W}=SMJ!tB+seW25?~{j1^>ai{g%LMC-CfnzH~ z=e8W0`(@)D4Jv((tMiE}@!(g6Mgb`rBs)F9iem@gMA9*8eS>cu4ae*I?X@r^%X`J! zhDU!9Fu!$Z(H?~An=|*iHrZs@!O0@`u|(Es8EV^nOmQBeqYmT#bVPI9xI9^be_#gqg62eR<7LN% zF4)I8!1SFCMcMScu82$dqrd%2#EMc*6MW8dpQt5?{X(l-btJp3uY%e0=?0T=7?%Bb zWY@G<{Psp*6YVP5tL0$3kXHCg|3R$;0LP`!2#$GD)KGYsQk%S^uTVGNlGG@4?~qj~ zxCGGX-v9eo^cffM@wSYN1bV8+qe>C7q%NHFo`9VQog|#-(EiST7spt?nugtU2z4+O z_?@I=m+YS-_YUf@dU8?vp$`ueiK?D~fhu7&KDqS7BYS%jHOaoE6>5MlFh-}vmcSP9>MMj%G|(P2=LD9=reIgP0A@6za&oEqFpno z9c3q3UFV*ap(wc@s!|)Ld03kFy{KW%`eA8Z)>i*nRFN-s_;RIvC~=I6Pi`Ug_5HH2 zIR1C~P%AUbTy5B$69sRMduJkCAd||b#2s!Qf8Bd4{;qjJ33Pp!oyu%Bp?B5|RS#wl zp&M-dHQ;@vf7ou_rq-&aa0PIuYhU;+)+jAeT0W(gdu&`OfJ%Rg9T07XX};A14UW*K zat6qp7c88``J=Lq#*>83nHzIXt&hK4FTI3jr;1%9uOhAytx{!JR6o^dfgC7&EWQyi9C{KoJx9=zk$ndS4QFuHpm>(o78i%C z%q_Vjykte)bc5euX4u=?6KM#@G=)wd=-Vt$5PN$LgGS+UYm-AJkv;!WS={@8Aa*lr z%DStML+6p8u$sf(T6LP>c)3Tu=dalw|J4l5?vyoH?35Ey^(pWIly)fpm=|BS;^R^i zQ1cEjPAT7X?h>;@WHpuU2jV9SLU~HeCCAM(hGrqa=$c~$OTp{(#uaeEDY{70NuMW+ zrhKu`L9P0&x}L(GTII?mBgX{UFXu6_o0P;?msY27zb3mj|JD^2^Icl54pRJykm9^q zVyrZ+eCA=?J0?K(OZ*I0S`;lRYi>ByvuM7}3DzK|w!*h&eZ}OhoXu6XiT)QX`=yzW zoc=9W_M6v5lm@+h@!*?fa@e4CgDeIgbp31wXvX@%N0bSDEGj?;W7ukaEHj*A`0}n$ zDJOd2(XIPW{S%+b)(b>!)Tiym+H?_%c6Z^^cUHU9e~r7>cTc`;pIhE2e^bc`I{~Ae zfHhckT1wf*p^UU8Ej4ZKUs0t@zwV^@>;MLqX;RfA-7V5j1INV3yD%?!oI0*t)M@2BoLzf;yq}y!FXvNfW#V%D{6cKzk-lnqMFE+iGiM&@A+Nl+Cn&0*&JNM>0$ABZ7dtW5- zk8<~;FUaig7W3)Ldtx_x@^&mI6U^U$pYafrv=`7v&_|gQ%?wwKWgS+{T-UOcAT&6s zK7&|0244(CayWd?O~$|RDIU34l7~4|HCMm(+ZZd~O>YpA1GJ1L_ZnAuAkhHUU*rh2 zRTz&x$PR&482wyF7#{l6uerT)AM=_0KH2adAI+e40C;J4-dU z__Y$Xd&*v-^*>9o{4l?>l3R_HfgI`wGt9ZX-z3+gekmFts$?H+5G`XCqi$?-?^&lx zWSWPox4c$uDISehZ`oQ=Jv=O8n5#W)@pf(6Ih8Y_yU*`;V%J$uP{aCCv*TRiJk=XC z!66^O?n>J9@r7kfi?jda|#Vvj#7ylTQ z;XCqK)%@zFz6*|@<+iW*>PgAsEd`&IPUq21do6qH_3e+<7meTDu|U{v_M zZLTpVwoyNfKB3Ir`!8X9$R^yXoe0syLt(P2a9~Pk$2S(5DM)~Hil8uoiVQaEU5d9h zqtvgCJT3NV6wggfqYW!mbRbl5M#$iL-^M+JV#st$48w;>=5$w>YNIFM6z9C6&P{A> zsya^7@;sRkjt!EhWr=vC_a24{b|E7NGNa3H^O(1SCyh18nyQ%^_5fA_!);ftWw9aL zeJ(54TP?_3;+7l@d4PFy+Vaa9VX&KLnt%h{+&JZDd*)E1C7G@a*7r0X6x2kelL@N zfSYH_>jHXKKL2)yBJBO05w-`{{pC;6Tvqmz;L zvs)=Ue4Xgh)aA6nB-<*?tK&O(7S@ithlbu(CKVMm1pefvJ+@FS43o3|6CxNoxdZE-c3&L;u$~6p={4?<%d?Ug0Ldtbk4NgPh zLd`<14Kh$Adq&G23Mej6oudINH2_?d|Fr_5bcWKV{KU>)!X|N@?NXhg2TH8UJ7~Ji z@g3@qF`K4-LT$*QGI%!#3=w~R_f_^(@fGpL?v(r#<*CY+NGVItXOdNi)g&YA*&X}@d;US(3D z$RQX(^jQ%2?>IBNSj-_k<=>Tph|pB|PPE7zCwfvK1TiQH*Ndroo^%p8J*6LX}szlqEfg`p%VU z!^{`_Ektu_N!0RgOXPFoAYn?^IzL(nYLJpZ;aaxg3<%$TQFYVc3&vCllX?khh)31~U0&1!ELMmsbU`w93rai>2Y!%x8)j zn?=tIl<>Hpm3N2_0Zpp@`6vQHElB8`%lt?}8VLpHcLvB8|TTdsr<(qj>rG2ojd8Mw+BYZkS ze{q{{^W6ZisRYMGEYhg${f=7vv_wEqtjzF6n&Y8&c>5bLS?7a|+mHy11H5edU3nY|`CfLXpCllv<{LG(8WWnm_XlJ_u$rdMM zyC3>&Vb5C;2;&t|fysFSWFyi3;3OUiPaw15@qAYx3(F@RlISopH&kY5(ShU;ciMAX_QYVkOT9tPp^!ny7IraPWe}F*(R1k)k zAU!>aC9Z!}ZOynTB@XTxCG7zQmX;6-^T<{hq;cK>anMn5!Qa9}NCRxC0~jUuB?+HS zMEaA|CsspKA~Z@=;9KILw2 ztotf1@|2!!=xQ74E+kmi*dgWUdj3~uLOgWr<+Ki*MKTQXbOYoV^-gU{O` z0)Y2n%_rkv6|jFyciS2-y;(Z)VPfk4nk$g+{JrPh~G+@$^ zsWpa_ZX9+{)V|2U)4FquvpgIh>zH7t;NSg56RKkd{G6dkkHJO^>P#-E03XyhAW7jC zC{mkLcb2~`vwi@mJSA`sYl&eh0eF^`D+p;eu&1#YZ2iSq6j)L}6u3mMw&mYMql39% zsy)vFmF-?ztFM(-!dtMy6?pz&0<=-26$s$JnRG%@RRW@C0!2m9nEd?!6?o*dP}imd zk>F^|zKrQOMf30PcT2AV@dB;)P6Q|WC&zq$d z@D#WpKDE2?U?G3fU3KI@ZsFWO7_Z6A3@5PBDC2y{$TIE1d|o? ze69^gM1ZwCg~DHiQH+^206Y%;{Cq?JTr20L{8`z#Gj{e{+-gtiT_{(ucRKKn| zJhgDf;k(9SS5-T|iwpb519VS45CFQd?{*1;JZSWIfgJ?rr$jL_=Lao=RF0ZjSbDJY8J}UvZdLhC1Y&f1}pJ!J4uk{Jp7FOaATCr!o;?0}eOZG9g z7yI9XUiW#3ho5%vTtg->DJEo^g#^lvT7k?h-KCq8 zay62up+s5)-MOMIDxi={CkF{Il($zLKx1&t;hOFM z8?EpXwYDh{*rmHleMGL5LW0N_-_}~R&68d)KU`M*OEq`2KJJ!XzT`}Q2tOhstr%j) z0D}3MfaH#tke2Vvx}o-ry8`UUxcQ0Ax_`U0bQuqy>fVJqb3hUu0$L=DgAk0z3n*Lo z7Tc!3b1t8=+gfp!a1mcVVjdRIatz{Fo?E^UI&yVhZ_yjXbOqUz*`;tU;r@UPrY6Xc3zkfpmMF4M1xkI2Qx)yq$ zpByLv&VFYj-$BAp;NQYPro-e&ae7GCcNWh~Ff)PRda>uDt^-r$&3j}>JF0p?>%vCj zEKpD~?8G8lGN+K&`}`XLeAmb@Mni}vgZ{736*s&YE$><#{(Q>O$D`OBiEYBHq(?ih z1rfRE^^PP<@dmd_`N+#VC`d-Zf`y91jCzrVCx{DDyP%*z?61zlPU?Vk-9qvixTUcK zvGwBH0`6=8_R25X7u0-}4$;j(?X>9RXF9hy(OP{UtLKmS%0>GJ7U`krmRw47ROk?D z!|X_;B+((C4vcp1J)FB=i}CIYb~Amk^b?{i_PtEc0*^b0Z0Q}$uN>dVD&%}6d=Yu& z`+PPOp+Mwl;b!r42gVuH9n?PKzBB3*eLg^A)~j0BYcS$oPC{~HRZ;5s(T3zLVTaOb z_~r;e7$63z5LXEUE&c#AWFc|&!1xyT7B@p?84(Z#wwCyq7>d8JN7!Hj&ADsg5pVba zj)W-+RTlB^NmWeZE%mhl+619K#e+rZS zOBoqO!Im!XCqA8j9{gv9Hj71%*%s##a|`V_A~q)YD=(ZuUbApG=4{aGgaeInx>Q513Dy8^Nvtay_{yvXgP2*B&afuFn zACU0?$8Bc($p~4ark#osDJr7l5Br{~XXMLav6TP|R_T&2R)#!VY(rx50k1QKr$4`x zU@3XF5(%zPAN{WCF59l#Zdn?I0ex4wHrE`l^Z5w#kD_Xo8Vv{K&nXINKI%Lag_bW! z0fvB9sGK7nvlNS8u#F>=5GYFbnq(z_26Rmc%o7 zPwgJ>J-R(Ie83=ECj9~A7f59;;hOP2xx06L&6%O(C+DZ?VD4bn8N}No{JJiLebgbN zWpv9y56=OZvB=vzK2LB&qXbqOuGVcC`HC7OYPo8tWuN|-_E>pX$9w#GF_RupAeFy; z3@bqb-2SLHtSIQn@nPX+m?Y^UM~Rgqu_LYroVSR#1YZl9XBxj`0i|pXxl+8}Eo@!r zU#hneky|nzMaeK(Uk>Tv`4=F1XOy6HZprj4I+=_#ZbzU}8CqMgMjv+HL*GXqMW10X zOK{BqmQ&OTCQXF?p3-3Gpv52va?fc}eG+MMP$%*6=S4}&F*k!Ec_W8Bu8ORVa9k8I zzoKCt_yjN2Tes(ybXQ+w5k5)6ZX!blffGe_9}Q*hMDdRUij7#qMEHZ!17i9a<_+oB zTI?sd*tpJn>kTBlkY^+|IDJusQDhFtNJqrYn5P>GBvM?%nQ{*j$O8tDb-(|2VXx~S zFA4A8Lcb$ka9~G{8Y;`$lP1wQW76qVZ~cc!Je2Lc@M6iZl7Kppq0!qy=OR3 z6RpVJ{(*!%@Zpz)9lY6_PxGg{?jhS!v`}Hvj8UuTUi`g=5ssi^-CRK@NXqg1<%0Wz1Ky%VaV*y?AK- zjl@*guJ=a^jNErAwPL3NNFpFl&Z6C7S7p@@e(<@=fUg@jDYfB}OiIp7ETqKKNU!IA}0PJ;o~(1s@oFBiYmF2-B^Fd@^Cm zP(ck*q`;7L#1ivB^}eBZ+ZEXei=2(QYf!N4k$rXq0}M-<;!b#g0mOR5zMBe~ZN#|5 zg}mg6leSXgPVb{X5F4Y|4{+KuqRuRbc^`0%P?6OoP{wJMp>gQtMQ*hKsO88Luh${mv0`7G&->U!n2~Xvz~eA)Si`&cZ$-^G?`(IXUZuv zgeB&zY7%GwDqReNprS2%P_%NF^0`2tJbc!QaUWQAg2@-yyL6N)$zsBEYIb3L zT1}7*<*Pg4OOTaU<)Mj@Vm?VRUtD0|JFbf{)~_wz;Va zfEyD!vp7gtEvtw1y5XDZsm&=WYpJai@LSeb3DM(gd>iP)LvTN z2hs*lLxo{+ZdWtM7HYhESavZ$EXGlo;c{>sGNQuMux*mjX^VZ)uVYllmo{)m6%Yt= zRpH&ah~H4*RX&f&tK|{p)fo$F5)K&d_j)KP3xp1UP%`VEIMUjRhCcOG4*Zt_XJ?W1 zPet*JaA@`W7>`EB<~cmp-yLtpa`eutg<)Fl;RR;8ShRCc?`6czxrO(+#gvWPvb}9= zvz_m}cI&t9dn}fmh^TTaoH;9giFs(yRCJonQ7*>M^rM5YG)#1t1|LdyN!Qo(Nmc|W zrEuwsd6Pd>v->Z&h!TtazpMnYp14msFXQGgbC_wb2#h|4b-!I z=z%DCXcFQuXAi`Yc;c~gh!f{66w>$IrBv5kIxfR*u+03WT{5<%pBh>+H{(k{?>Mog zeQw+yE#z}2s953&&g7yfLHGu#@nVoQ96x9hQcNjS2g4)k#_}$9jHy%7`WFaz7LLV> zvckekt9X3fFxw$8m+b_h@p_)B{q_CTZ?+AC;z4uHW|p{7hZE zy`&K9`5$KwCahvCJ@35I2%?)o00aQpjneP6l2`4?co4sp<`Y|$=$7&w1SxVY_YG@8vQ%Y4)aWPSO3zK)jV?VUDLY#lG zHS*VI=%IDK6MgN{#;I8<_))kQ>niCnnxNEUQ;oC9;cr+40glIJg8M#*xtCsx>v5qe z7T-#J(^t*QY;2MVz1$a`4i(F`ux#syifdw{B#z+cw9OV3_$5I`#v5(^kBdd7^}11H z_DuIy@DMe+LN@a87HycX2~$lMl0}!7dwqmI0WK1XJ1-$B5Q_7$b8tA4R#DW0ST8N) z&{&9tCQ*e^vXNTf7KbfC1SWH)`*U85QL<6>1W907czjw{OB_FPt@b+Hbs+ec&`8nT zETICFMUCctau#B19_a69D*L5{19_vwDJ%M=MH6_V%qS~qjJ|+LViXCB`*B9fvHehm zUW7lT&zzzHiu@1}<4`&eSUyTFIPO=pi!04+!Ju#eQ0m0IzTRJX!w!UU0>< z>Ztiq{mxK}VrgL@@&}T#oj(|ZXF}iM_ZP@UXjMYIO>E)G$q<)0{pw$o>HcKkc zEyOWDvq%eceqfg$6#uHkLSEhFrHWtO7mO3WD$|5lx~YKQei3-e3rbGRp~z*bLLw9u zi%Q=U`?bFqh(oq0naY)ZQ9NlCe!+L#S&>#}Qj94YLLgDZvqe-^)Z;ReJ)a3>p@IJ@ zVTLIUp&n?o;)1&) zItZuY%7`cww@~eafmtN=74ZA`T9r|Cd&petcUSZ{PX~nDVzVPvO1VRRYCm#|vM(aQ zxYY|xXz$wkw=(Ju{%`fCeI1kFH%a2 zgfDii^Yb@*4MP#A=JFaNf>7TUeP8Hxr}kGiw;hYKaSuZGG8R*sOJ&18%oa6Yc$JOf zu3-HZU0?L}8cQFh@8QiMciv|l-&N# zGm>lmOSMmbA;)KkOTbsV2mas*>KNIT^HBCBX4xlu;OXewt$eO}C4{*Sd-Z+~?_a(q zppR{s$A7bUf5af8cWA{e>M;{%D_NaA49z82d_c-g;y#=a7pea6n+v#aYN>I>sQ zQSlE2ba+klR}~cMUaRYiA4Etzka#xlfvQxgwCh0F6}w%ov zd)3Q%xmG2XeZkJGw|nQyc^c4?E}P4EuT! zKb^jOKA!$x2~+|deU6oO-+wNZI%J+#RA9jel8Z=F{vAY!7si3d7Z2o&&-*ZYZA?5B ziQkEn&I{#ZZkM54!8o?u!BB^S#wH8sWTr!;UsLphRXXH^r*DFzZ$h9)L8RwU4hF?v z$j}W|SCsd`1@^&t1*6-dOOh5`L~W2Mu3}BwVM~(s&|3E}>p*HR7$uhVlBx7>^T<_a^}!QjDGG}#KjW}{5=#YLGp)Tmaj%77dPs7|2=qA-;>1v>T;O(X3A(tk zR?r7Kkiu^Zqj!lEUL$)2JNyxOh5@1P5)fi_8DEh41m%5?in~TOGftCh%w=qRG5d#S z{OyBA?lN4CMr0SG-xBxN&B~~1JbO{vfblK?W!Xm`moFwrvm=rQi8_b7t+S)RLn&F} zE2rZYr;8<43^^@f2qU3HkRw*6;t>gEj3}Z6_gre+#5mC@0|QI7Niz@%`x~g#9xcX* zbEx+HF}*%QUqf*h&TJPBKbXR3LZA=b5)CURPoFz*vJd@F0eMs(x-CYGQKTbO=r@V4 zz4}XFIMwL0>Ta**wAjiR!sT&cxc9)lg*V(Cvwyz#yvA*SH!QdJ+`*kgG@Q8C!WP4@ z*TNkWxyMZtQ@^)DG|U{+eFDl9uy@hOxrT;Y3sIV-@QFa~D@B{3_3^?nufL{iLdYd2 z_lfY^Rr`xBC;`D4NglSw67jb!xaLG}B0%l}7v;`tKBT{6OKFC}ClI-h=1ZC?u*DJV z)!fAt4_2CC@d*^@qw$6R>7Gok7Zm4+{LLP#Iv~t#*Zv;P-89INE7eK~0udC_j*fBp zi+m$ma@XDx+?a&Yn1mJup=STjHLteV@6Tq!ccqQ0M}Jh>H)UV)BPk)Ku6fVg;qUXhPp zg5dYOgF%1dNgE)SM*GaejElg{9J#OByA9Z5(=>-Cg9<_8geN<~4Az4R(X+*H_GBgy zAtT5PwuKXw9+BkK6RnPmcA{|*(7mqfSYv5<8(Mkcc6;)4-V5*B+XIzCqh<$%>kZU* zx>-AUYb3-45R*Y-wTkjS!k^|@cgJl3)F&c~pA^#Zl_s+E^~^EmPMoV5l8HkQnR`WJ z$x)e&?8XT<&xj=n z7Wzs`>Fa2(ms~8_&spp7YA=_ZFWJpmnb9L6H;ABZD!QleE$i>(RK#Z`NR1^p7eiQ8 zG*wyCb)rGp-Pe%b*EHy&w)_d`LWbZH01HGD01F}J<{@4`1qa<8P( zJ-AqD{)C*CD;;AU6}SgOnS(^*&Q2|c{o3bAg(nK}C$aoDvYC&25yj*a!4|rDNEk67 z3050wG>}BREp}_toVdsvz1X`p_cBEIX%11MM`HUgB7wd}|Gk12@pQMWVR6k2;6I<= zR}A0qE@{KBhY-l{$o&E1^;AyzRL)khkfk8ID~$M+oO2#`R>?3J#_s+w@u?}fYpjIk zl^*Mre(khU@1MDC0n0w#D_f@dX(U|E#Art~=PL%B*XdzPl0BpZOD9w(P{8Z7_@p>h zM4UxG(!dMd>y-C?E|RAhwiAf$b!vS-_am#0uoDOk@;a5hpR-rg4m4=P>IC9>ora*z zDzHf5E`QY`T>7#0UUY4(G4^dZoA>0vdDoL8-Zm@Lwo`iG{NjJ|sWWgM`=o?ncG49% zPjylvH>;4EpLt$Zm>QH9V-U#OM(ld8x^VM)exkE58>uX{oFB7nDCMmz1;~%7mL#eH zb;mGE5$Ol;wqdw-{Nrtdas|?zov?jvG4A=519d6^H|GlH3@x%2M5-S`st<}L1)vp;qZcut6)~V6aG@1_*~_69jiVhrpx(a1 zo>F})I%kz;86>R%#Z?cIcESY#iC{cGf*N3hfY>mn)=2*uIU~(se=A~O9XTf{lKU>5 zY7)oXPg>KR$~;v3Mdp$v3Gp{*L+fn7>}){n1fm}|=chImrn=>&GVg$r?q=nV3saj4 zQVn|OTxR7mXXSKf`gr-uIxzrwJ7_w!2k49l3aG8T-iZiax}9ffiK+MN&kix zPC>NWSILh)w*nQ~Sr%Sc77|(Rd##pf3G5om zWhDr*gE*_p1DGWtec@d7)FAc4VAjH6)y-odB=qTQ&Nz25|GOa z!p8*xoP_~R|6gA}E1Wqae4H0>9)D_*G#@HLHV+Dkv!XFugHAt>v-(1kp`^PBAMu)b z37YYeu-S!7xQ+ms&DN08oBq@C60q3?${&A;fk4*V))-R#FwzV0I5)BpS12ojzy>0b zwE)s(^rB-5>93-Te(+_-9N2&-vKIKCx*okq0d9^5&Y36($hx)13#0TnwgVb9z~f(K z2+|wg`Co~~+dS_4+kd(*>DsIY>C66qrJTRXBGsn<>E@`Ba{eZYlmrIinpWZF{lUwNK=`mP&(1Hfq48t zx(yHzJ`2d&n#)X%vKF$hVXzkNa4NbXhHJ!d(Sx%Vqqz2~^&UdLxT-AwPDNx|Dr`#3 zzbVh3lOlCW0!08-8;HW+0B_H$TgwM}bS*s}s^QbG?7jq6y|&G3+`E=mUY{!hlDLyF zluFNAO6MCF=T9@vPJtR8y!vEHr3}mSr=YPLU|XHy?M9Ab>iqm^VDbm`knJ3UhE+oX zbs;*;Ek|f3_d9$ju8Rjss2UF=U=ANyi3^{T6TgiB*)IB5ie!J1q?l*nt_)isgE1)y zLplK8zI)DbGx^sG0ROC-L*3A-tZh!&t=RZI`PWYJFM6(*EcG5?zscQc?v4-*pkn~*1`I)qK7!N*Uw+?-P;{S~<(Fm1hT$nRPm zRyyH|TKLe~Q!}c6-qN{{W#tUcWkjW8}FpRKw6tSEc7+S0F|yh*9Q@Nf?u` zIZAdZ<8+(o)szo3nMBUAoPgI*Z<{m-H$6WPPGuuh;5DJ=H^R ziK+*c0``kOi&kPt%YGFJk*6ifAdUUtj}kpa9ol!(O7zgmZFE9pj8ISOXIGQ@NdH2A z)Gu&Hj?MN)N#e|T5skN+M9lT5Z>sjMvDHWHv+EqIeI%jr{N`W|PHq6AINQKB-^wdw5Dzg-~2b?uLT(-~H;{c%eRtm|Z(Y@TE)n=<(aKzkhePan3^ zNv6ATy^`#DROhPIxyI>SULB*?&t9)2Z+=v_xmLG%oNjZBXv>WJtbTTLM9pl86vq?w zQIX7c&u`vEWm;J~c^93;P)qYJ`&KH~&SG@?*2yiW<&Z<=+R3}%VTj8ihshy-=R0y) zbP|)xWhf?>#pSZjlG`@bQ#*N^$1^H3mCH;$TW0IoGF!RK*0_uilkuD(Go}1$uGa0$a5T~RXV?V22andqJD-ZpF9_xX`^j6KUcc^lT%HZ^Zsr*uv3o2AUE z^>$2d+1{{NUVfIk8%Nb`lNbL$Ws6y5GSk(t{0G>}8M}e$TF!JWXSy1c2Cl1iDYL%D z=52aZx75s!;q5dj(OlEqp6+R>wn{ydxCu=3*se_9EwUdxC;3|<$=>RJh{0RUS%IoR z6=R9utQ7VNZk%Pia-t`FH+eA5lDyRsleZd?3Eyw&+R6X>=URTO`4^6VMG~X@wYJ)& zlh6EcqxP@$uUYF~+Ea;({QTF>>{k1%Wye zbmCzGyT1N1oBv$tNX3ldigTr76*Hva3dj}173^CS8fWsDay%w~&tefL+(Q2eMT6sT zi~Rs0uc?EAfI~=vM@de2Mo5xC@P^i&yqjo9A$YYjhFT#H6@_vvT5p!GBs_jxu~iUe zO`A50eHWLXdv1C8x#zMgeo+0J=+gvYga>yjiPJ4plQo%BMT6%_dI6u8E_fUu4zG>n z6JVzoJg(O#*t2eb-9_3EzXfSX8j9V-kTe8&h-t2m7#r6s9nb-mNe_Q;tAtRMBm5zE`Rv0kM>>m@X!C$TGHNsI)%wao7?3cfd*;gdwW-Z=WQG8CHztC0jiGhCK#hLn6@%$?-fW~rY0?g9s#BA| zN>xvP4Rd_XY>xYyN)n=U#!iB%I(@QXH(d-5N!i(>C0a+WB}x}7363xHP;#rnh!^L0 z`s^?mH!&f>rQf8ddb@8oxs6;98@#P-(E9y;=?ELatuu}caVz}L@Au0?L#DDaA`MrT z1#OUyO3!1}YQKM*mc6LT+G+2O1Sy;-K^o_OZy~Hx$f{PXYW3%Mn7O51d`Xy( zRGl{7Gvi}jrqhxK$g??~;Di(NX#Se=t5>X??n_H4%FeIse)Edoe?9g3WdqJh^$QM= zm#(gHuGG;31eKqhTf9KD&FGJlyVRAiiIZ_HR^ zWZz}ijJK0arMx6Fs&3fspCf0o*079?;jtEmHz-Z>0$vfW{^+Z~Qft1UB~jT@7cE~h(*Q)f#{(<$k`ud`;meS zdV^wsLo}u&+Z${V8?`-2XTl1RUZ*7LiB6|aPfN4nNxA?T(9;EqBLh~qHDpz+jn*FP z2J2Sq9%};2QtMN+5l-C7M~8H5Rm}7%;(zA{Y`8EptQeApD@Oc`HZ<(7ASQEJ+4Y5f z@e1jAn9EoI8yh4$GV&9oF#Ih=AyUJl#!R(;dxewtfRZpFL(Wtz$t?Hoc1L=c;hnw` zhvF;Y0x9W|>`)x(VMkU{N|^UrqA4aVrE-f%htet!#D)f$^USGAJW#1wNg zsb_ne5>E*kVRg+|;YLZ+xGQ_-1bhGXU&{8ZPv(hL^Cp&k#6_u=t%jw4drDG=MH~4 z;tx7a1}iA?h+BL>=!OC5n7C6PfGz+Mr9+A}H6>s*2CS(`uoJr@Q#9K%)_+H1^Br@^ z2v*EsW8)YbAw?k)Zxau1A>pi?=sa;7YZqZTgJ-1auScEn$d#pqg=J-hg{7eEKQqJ= z;?u}O0lh=H(61Psvd=%kzu14Jf0O?uzt-y~51L*sIDoxmpS0Js-@f1RasF5K#JTpx zbg5~PeGR!Je_g@#rXSg_@qb@ia994%3Je;P!Jd$>DJV5fuq&jB))=a!X{PgNv&oQe zGdg7xQ(}p#? z{4AqIM!r9f6!`sANhPDxLFdWxW`F1Sa>wSON{Y$B ziRo%Tn}Xp}`;o5p!>aZpnN7O}?dhNOjXDyObGl+w4D|Hx|ITzVv7ZN~I~?}Ym*Fok z`6-Rk3zbC4WRWD3-Jh4ovTldn;&9ka1@^Fwn)9<@F35tB5W?CeNC=72VI?Uc%i~E* zOwij0Oi|jRB#8dCet+usOL;7p2#4gzcCGzT#Md=sY1Di{2 ze(6Z-5c`_T?7>#s5SwkdZ#lBc-&!%mokW4!&kVeP8NAUM!}Y!x9&6#a&uEDmZ;KQw zlOHRSA1{+1FOwfHlYdqj`GcYBHHH4`uXz6YLK{OcmBm)wI)AC6LRV1{_g?;d!>IT2 zx2}r$iq=*>#SxG0tk5Hk#LZAciqp<=5=m6(7)dEEW}|-O^E$cu98!H9%aA9@ozv0^ zCvmD=SA5-l_mjFSVir+YPKB(p!oo6g!X$ad$Bcy3k)Mq$0|@(<7;#v98pXo9kHaR} zsEyxeLAW@oet)vFyrjrhUQ!%YcPe+-jdGDVttL<(3TSbG#8hd`S zvAQ`es_s>cEQQfv(sbI0c8`wIev!O$~j8BPi_ z6eIn9B+9BBH4({pCUx|ev>x{;HNiRE9x9qzM2e#7!R=#Dx+% z&2F*T?0;z}o>okX-D8Wx#Y(t5T&&2m!^KRX*p_Co+0yJqq2e?WQf8NI36T&O20>a; zvEFEN*{IE?PYYYajPMN877w z!VD`DO3T8c&0_1c-DcZi`@nX@rnA_xZB4doIDg@J+Z#50wk>RH;u0*Yv)PQHAdiZY zo-@2+|xYh5ku$#+*tK&1R z-+vEV+!+iXtB{Wz`M^{bY&DmanafuD%U1gdPqH|}@At2Y8*e-r-!mHxO>JtwVn|94 zhm@rBFgRd#KN_Nr+A{YXHno4dcZzId!C;D~N)9QWDj5vecn}gulS4`%O$Gxo(pZZe zVj%?>;HGD^$5@%kjFrq-$ricTmSmQpB!8LZ5CdGoz$OdD$iznd(RU6OdaUNn;cxx! z0>|XzD2v6HUF%WCsmD~AlJP|(un!}I=QrjhbUi8m*wg8pY;i$ z;a{Fw3uS3a^9#$!@Evp+DJ{$|)tq>DG-#my&EfUt4^F0RSzpta!NQuN;ZZQ z97!2srQl`ZoZTo_vboonY>^#V$riagd!fAE)th~X{mzP=<6bhpFmAtb@3@aDzezt< znNrELjI$eM2h&+O(UvZzmfGA|Ie+1F25jzNaX38&%1dnS@)9mmV#k;HY zL!d3t9oQ5Y3}}M^68OE3Dv6DW?TJESln8x-9!xgTlsh@Wl^x8c*-#8AXXw?uKD16;Ebfk4v#n3AMYQKMI73850CA!LqVoc9A0`^S0(2n@h)6j=kx@M>>!Fq2c-oW5)){$^yO&tJRdb z_MGmkO2%c8i4XN$_>;fRxhL#4%hNa3$-WlJr6{>&z8b61;cDL6dVlLX-t1g?`rUPM znrV^M7hYWIn`%j!RQIbDcbLm@?Pc z7HCgdZ0rtbB{pDpW`E{{Q>4tCusN6zObjLklY<7g$!&Izaa-J}Zfk2wlQbvL8eEpL zNLmzF7L2Cs3O+|(&V0r7$Kdmo?~ntTZ@J#B{5Ifn=eozb^W6Dvzq=q93Kj*6gX4nX zU`cW)H#9bs7s?O$Lj`h3E|QDoadKELNtP4jL^(-LmJK0O$bTFf6S9O-L)M0bhQx-X zhU5l=lB8wgVYsNLkW?jB#lAIv& za5ldn5GXu*Vt=;s%IWwCrDf$4D=I7TgKYh&_4Ctbun#K97V^WB_voKsxSVGeV095T ze8&}sg2BSk0!hy40ar?jyRAK(!UJFuun-amR!S0^McdlL5+i421}&MHL02FU3|1CQ z2>Zh0$LCOzB4rk&S*?1#PM`8Sa*Vy@K#oB{CB0fPOMgTrjijAyAbZF`a+v7J(c2kais!G_ut|`mY^RZLOKl*hZ&Z7>}6?qiTkdFfSk**-E*P&vc0<*{E=kn!!nZsTuO= ziK?}=wUtkzV6lVIDLYw(QoOZU~71(?9923 zN7yXJCdA68w)lQtuI|k2I6~qxVKMhUy0i(t+<(&qt&R?n^C~Olx{s&J<>i0cQ&uk5 zeN-n;svu1xPgP8m>z=NYEr!4|PX-JYx$dbtxw4!t8(B!o_@w7Aqa!1<+|SYlGhw5acjcM1<64--hGQj)JBp+ce=ZyoO)FXzjC zxqqNCup;I1lmv}C)qRKlIqggCH?$vUkB!#@r~b)hbd*}0(@kSS`4h50uFE5N`4hs) zW^S87r#mbqHYQRfaYG_a^t2U_h5}MhkY`Z>#bHaAS@Jk_d5IgsBbbmZ2Oz!nbx{17#snww$!4WULlY7blZBo77xW+NzfBNb zR7!SbOTHj=CkM0LzR!H0<)6@=aDS`WhHNFlDEoNZCm7{yB{3oz6II!6I=QlfOOVo8f_`@Lozv>vjmR^1jWv5tya?f!+A^Ksx`#RotIAAbs~T4(SF z8uE~ADqCeTmz9o2*^e8TZy{&-mYVg7BQM|W(Ij{@E*Hs5aJh(Eo8=<;`mrv=9#dU) z)m50@v|f>Xxk<^s*Gz1>?5aD=;GJmdkJn5|edBdAz?8rwS&$@H!;W}BF?&ae`nA3OFhQ6&o z{pmd#(@40eXymOue;hfQpI6MI;)@wPad&Sda`~!TZUMn+^xaGJvQEy4`((&dl(_(X1>Y}m7leJ07#5~7_Ggw) zvvm%;AsHI&7<;-k*&roI=_EZ$JUg;*XqmfL)Y#g*`Lk%sj%29Prs&alFi(m z9{TN%F1g7e&6t!wx$^vl*M9sqak<&Exk>7v_-Wk!dX!*dl7Bu$lPVlZAySen)#aA* z-ATdJpxd4Qw(sqHZhfX<_lazyo7r1FAKHmYVK=iyp0gzw<#c5Xvp$1Yf5s!L@5B#Q z@_iGuIj1LHr?-w_);C6{PaNwpB&Auct^{UUMs$-NLi@=Yn!6cI8@MT|2qO@JHj8VKLu75E-W9S&gU<{A3=S*K7^U7>`{(ub_ zzu(WF(hbSOe!rP08@_mYY*^E*sj;P@PF#B83HNVq zT7UiYxz4;&=h%^#Hys-}K;%7F{CV88p!@ycolBS886p=nE-12;7mUrwsUg-^_7h|C zxVjbRbgpZjJGYs=1P_Sy8WRL$;JIDww43j8pxzr@Xq{alI7?czmdl=2;(X-bT z25!sr^k3qgImwEr{y1-xn&_M!q%v)w0)O32=R#n+H7RAXKm=rH4atd`C+S>RKzJ~h>C30c}Lg2kRW@7_}nRELl7_W&wnd6j>Nbr@?}W}T_tlJ7sWjvEw>93j#% z{?K|VgU9Y;Hl;BgI52YAaMkEm4f&Em5cOR^LxcxWE!?bF2aV)@?ZcT57d)A{%YXS~ z!9eCK1$r|J0k%85e2!LXQ@vqxx2wCb*VS9N$+f9)i)%~aplh%&u}JSytk&vg25GaA zrwchWa!MhGgQbHqm067mDdAF9Z-LR;c!k)YN8><7^QO`PqQk;B|IET_mx-`XL)!u zP7>SsQ_{^=(QJ*9!-~o2c7o~Sf7g(oWKw}vO$Yvj1Yh#zcwwSHFf z_U?&f;x0OZ8tF)D3!ih2v46EzY#a1(pJFxecy+rqGZwcR<^^OQ+hFr4@le3uQo;9c zkFf$)R)9BGnl)3lGC?a7w6Z(2vOA2g=(q~DevPkWWtka=iAN!2wUg`FONd+OmfFbJ zj>)li@Ystlt)pAHI%f0f@i>$3?KjNx;k+m@*}WaK30q$fBtk$>sb>+DHsnIu#1 z$P{b_M<(HOBGb!Wqq!>X;AGa?2CJO4!C;k(7|2qL=1D~i$b6|{o;3PsIKEBHuESuJ z*>y0iW80RNbe`|Cq{l)ftRk%>b$o2QZ2UO(ASk{+>ovvSf;cOGIvd~JjYqEe#WPC+ z&G{uO%2rRkK$$eD?ti%~Z&qeb2~T>x*;9%XS+3i~Hh9^Vu5fdCQBFZYfxoixMB?pClO*)2z&J^$AL5NdkYgYA@+Ycr4*yf?!M_362R)Fw0a@3JW&` zi7QBg_VEpiC`+l=7ZFa?4PBJZ`t-{d`dsoet(qsS<0toU8ikX#(kOx67Em> zt>HnVZYf=)?Ml2bWtq9ts(vbzOgK8&@5F@6JEZ zmwR{Ta~wOpv(Jv5IF5an#7^Vj_FdXKSqzOkx~&6bQeXo`jfxWlOa+!8*5;3O8X8>+ zf`7p@jUN@DjjfEdMQW!?aq?xd#@7L$&(@A&l zz3=Dy`FtcxGMVC10#J$Wh<;pe=pH@Ny$IoNzS#sMw80n`S7+)JlpJ1LlVrlW*^$yP zyC;0m7QSh-AS01sMMg-v5i2EuDA9Jj*?%z9r>WmY5lIb@NDxU4kVtSI>h#uXp>`Fz zK=l8Eg38~1cKDIcTKlr;2lVVO=U~USjqemyw%D_C_5IbpLeIWWOigXPxeFKp2+nUV zxytO%!6@^(RrJfAVnl8&e$hN*E|@RoFXpf3Z~EWjZuYMF|JJ+Ce`rV?^t!!%?|(p- zIbe)tMhssEnH`M)BHA6o96->Q+za++Mu5iv$&Rj~F=C9)_nz;)12*A*lAP=gu)N>k z&2T{B)wWn9YRW^W15cWN3jDDY=55TfGg|m&|CS4$>if^U%@1S zCoFWnufRE(CzWNW$k~aG4wUTCfqxPmef7xE0_S8pUai^V)tY_wC^`GGotCY@!J?Vx zIaepB3^~^z+44s_3qxg==eR{?%Bq-o#WeG*zSkS8%vNq!SX8N1m{J5EaXMv7&M!y;5I&~#r0n+jek7vndAvMG~@w?*7;(s-9S@ej} zG4B=TLC_C6nB!JJQ^#Zd@qV+P?Wf(ko-Fi7?yEiRv^I}Dor2w#Ue`$kJGPd6pM9AO1M=- zd-kNBx&LJKL`-WDaJ5p!nZB+}PitFOG%81{V<%3IJ<`5M5OB5cU|T*<*5bL%CD&!w zA3+cJ)hiL7z6f8jVyRZ3r&B4_nP+%0)z>>bGxuDCBHmOrgDd z>bcYXYS+i&y&FqkxO$cDQ&qYveS>^tu5LVfAfz9Rma|=|QGfgCWAHi|yhO$>+5H^Q zHkVvKV9$aK^jQfmAq27C5`vf$qQWFM8UHZu&Ip6T%HhK?vnqKUWcutWvW~p$y zF5L^d5-nD%6|xj7Xvvmjg{?MgkEL3O-&wM5HQQlb%S1e0PAA}t^M9b}e887T=!B?1 zpaEZk%aA3MbbmCfUt#Ixv?A@yt88FX5E zR&}E}^5sIVuYl%=WojXjDm2jd&i*FqE0gggLPRgwOI%Ogz)$9hae9yyk+aR(`)tVyOH&J z+kaYpMWkkWyRVSLrFmaI>;9HVeM@%93OlyLtXK4veP!E2-_%sq&G%jn#|UBfmXm46 zNqo=0Q`)hZKqXaP>+R<3s;?{{Y6-*T?Wc zaijZin~AF%!(?6F@G^^@!LGb*0nWf%HkQkjT>t$%ij|06Bwqpm{1333A*Q$Ce*y;r z8NdXH1P}oQAqE%Rz!e1)#AQ?*oTrgw7?8NRV8v&IFFmchs&c*$Cm;{g*&tG)m z>_ty>+ou7JO9AZ*02tJu$N`ZgFz~k6%&xg@US>hEfF;gk>10XZn~prZIp70s)JE z@Ol4LyoPj6g1@i?u$jVI-ZHQPph#b7$+Uz80=faj5P$$Zf{361MJUB!)S&^5XvS$6 zi?c8t^RNgP<1(zr#(;(2839C)j~Gf$Dt$U8U^-@CJ}$(Pfzr}n|ATXuG;9BTztZOa z{uq=wZyh+vdE`9u9CgU&NIH|wq$&1)!7oq2lR2;Er{V#{1Ik(aROQO&bNo~nXl~c8 z)NSLZ{)4QCvvaclVfe}T>?!A;jejj=19y`IKB2y07(&_m+4| zyg&KJ`40uQ1|Q>R=+p4k|GzmO7J4vepuvS6{vltV+7Utz`qLq86M9I|aXyKE3O(4K zDf5}ogHQjHjum=H&nfr6{e-wN6D~c0cmE0TPfv(16MEnfdQdF%VD1V07NG~*gdVIG zdT^%D15xNf?!T|ov2cyhgCd~^8-9N8t1{1cPw2swLJuYhJ$UAXYjy}dunIkx|8u=> z<=18S{MtQ257r7jnEG?MAtzjabBEA_-v6YX{(JoAhtMN^4?u+}903IlKz+C?6DP3Y znoOJ`8;dh>h6E}zap8nA3OL}&#Fg*>Xv9KXgbOhbvvDELz-(NCaX1rWFcFhwUMJ>Z zAud1w)hI?SDltY*FT`Rj!6MAY;8X4r$lND@e2l?7%)*6Oh)yiTxmb*U0!+Yc%)v#N zj~Te|UtIeL0w_l*%20yL$y&pQLDLGs)+L7s0GVJ-p~i5a*+zQ-(_pD8;E3o%!2^^v#; z=g6&>elOk@^W=A#|1axvuG}6048uIk#C(}MLvD?e-!Xlkg_$=E$WP&YF-v~mfgZa= z?kCQ<2p8a-Og}9?)+eW7qTD+3eX-RQWELvEQpBKr^ z35S9Kzt8J&yPOWY&1x~5jG`esORv*v)GDPyV3Z)%6mD)0BqQxfArc-rvWTa{GXlxT zj1w5`$-s<2vianHGRZ)@Tr6;M$;6C6^4wEOCekGn$4U}05J$Wy7HA3wl0C!2ffSiC zz9k$;-aI_q8c6oa@iB6IjU3M!9&QZ=i(-L5lVk4iK$5fvnv%^I&t1{fKD;PKHtDpD z;l|n8q8K)5b&cUhT~Q24dw9_%Vy`1|gxZ@1Z=z6V6~&r=lCJRZrld1GoYx@9a+_wH zlN>j`rD?c37;G(yB}wC~@XRE_!;*%mTm+5sW0K0oq)L8FU><)PtPE_5b+1^J5;3zq zsy`=u&Wvd-Nj9UEKf@SJ+QY+>_R9`9jwg#^NmFCX@)L92Y(lW zVs4Pr)>cPgM){#NPtn;mZA zoc8kqNlkcIcEl8N?YU{)ZB2`%9y z&8^{Nb`4g{s&NPT(MpP9qm$>1Z)uvB)HJrQ5C?NUzdotR6~loQKO#xm!@b{}%$bql zD09Uh!J}MGj)_{5%ovC#qtRqxAr}!Maj~+jzCD62@J=3ao_c^sFe^pVJTd*Ci2R@gC}yREbWUQRw18PDb(*&_j&C4iin zJ~(PLPHZ_*9^^qL0|srJm?Yuk<>5iN?H<(B&$QyVB2^fCPc^iy?v>=Y#a0%YQBE55U)kDnN_kvU=Ex<%fLOU+P z6+hcX%WxlhNGlymcS<+Gh!)JoQapv-Bq~5?hY1rf3D@B+Y{RqIgZJ?%A;duP$uja5 zd0T7W-_5HPfzvP1v6LB$rF2&_ojWyVS z_wWHeB8+P3L^_FWgd0OK1v7CgZo_?e1g~NrQIkqCm?X#z`{>}ug9;p_f) zC9QOi^a$K=!}GHSS%4USYH&Ihpa)-(d{Rhaq@MhdMrn)@LEqQkUm=Z3gBSxPN&6`TZ;VpX-0O{}V|k?UX)+5~YZv6?4#u zE3p(e;1=AENAM`##b59_zQ*_X0Y4H(G{i-G#4q<-BRP$Kj3JZBS)`SmOU@;8$$8`= zvW#pXUF2!fO`apKlHKHwXE(Cj*l*a!>{EdXR-sHdQ&=jztYC_B6n84tDRwDdQGBHol~XeqG4VwE zlD$r!6YAK1e5}Vf%Gg)*k2FrMq({gfsFyrPf23YEj*X*@bOmI zL{&S#2fdpXv9p8-(_`_^;|+8Qy@9sl_vC3Dp(Duzaxv?n>*;j1PFO3{k@v8aJ|}=? zk;7;}1F0jAkhjo5-=#(D3E>TXM}?XlRV<)c(sJQ{a|LC81caf4ve(EI(o4os8+ncl zp|>DRrVx?zB1}$0Ek3{)Y$Io(M%d3*(NXjx)M7qvBhRtd=?=`NJIL?w18UGuE+pf~ zy{rsZkq%5mEzYC2BSaU`5U#)^{Eb{gtauMc$Oe)_&xOFU=q$WVTM@@zVxq<5DpX(C7aktY$8X5SA|!pfFtBN>LsN_O%nJE9>6+G z!b=FU2p&NV6f_2gHnih(80nAX3OXP2$X)D9@(^vnSj=Xfw3*!5|D({rD$s!K#7P>J zwQ4Bh3a?NpScT6~hdJEerJO75Q(VL2>@9YGNNSaW{nHiM{U75pe1MVoh^)kBjKqh; zM$RVV1&NLpBxy1>&?khCB|FiRAl{Tp$!Yyhk~qnc0;EIIk@2_zXLBF2uu`~QxJbAH zkdEMT+<>*X2hZajJP051P>a(s5z{ae^JI@~IjT^DIt;^b*~>Z(lQ9MDI0xtA0(9Vi zQv4Q=VG|M2`_TcyUJ=S8a zau~i=HXSo&DUyhr!RfQO~+%?rJ%IJ==jK+ktMj1AEyHnX?^9wjJGUJNB~e5Kzxj zAnYl&wJXP;NU<%OojK*-HMrPjNNh7GyOpg(5Po)cCY+uLSF@EUgrBX+gg3J$m0d&p zh6W8=34-s~N=R%asMO8w?HVz*e488@6qh6G1~}_B4~mzekpen@lTi*oYsrLXvB_QK z{+$i&Y!V2bkm-8H*DqGfbh=E(%5pN(S8a{4sZgyHbBk*rw` zN3iCu;r`NwMXVWr(^(VOnHc8}M+qB_dNv$_%vsHbV?7&=eKKb{8;+%HIQFpNU~);q zhO^$5fLOZL10tOaC35#KWHH(3<7%M^!{47XU!2&-E zWI{h(2_O8-M^|?F{D}q)-GXs+3)<-xETUVmjBe>tm<$aTx)Qu>30;Y?bS0+Km00>S z@BW{8PtcW6qduLJ(9wEY&&JZROh}|y!RC0pTn;O$)1k+k4)v~bL&Jrv083c`?q>yH zFt7rYumaS7A4~aJ0VtkedDzMFu!rSgAIp;)JP%`kPEBWdSk3ZqKg*L#DdlqCu{=mD z4-5-`jx9ZDK01>_*tlnY78m5vWpCVHZ;`JRTxWG@l1L%O6bj~r#Evb zp?nY1uily@lRPZ>Fp0D!P)cOjw?X?u^puRST<@R;{kOzv_vqomHwGbOxP4+i813 z3!4ppfXS$KHHcKeG-Q!~%5`!i6q%W@N3%YPX03^4O^#+&N3*J;SryT&f@oHQk+hPtkcDSuI!vbJG7ZVpOU~-b zg63&56+tzDpX6-`UhV%hm=Z{r|JqqV-0Ck4&hf|6oJcyz2|gnb z_%Vq*1{H}WVyahF(^Uyot*Tg6q{>(2slqD1%Az)@MRm4Xuhy#7YNc9GQ#I6nHsJAs) z&Lfhyb#zJ~-1oMP*3jyv;oImS9<;W9Y|}2IHBA#ZU%PC0>+y03(3+;<+Ysb|Tn+(V z4uMn3`RE{CE|&-Caz447@1$~@h6bC4Zwdwn$_$mu3_ZEboRiDUk;}}2Ws=JZ@9rj9*2Zb+a5L3^X-$nS?e1XfFq^ojPL}2&LC00@?E>HDp^LUA_2FU3 ztne^7tEi!gDF zIXQm&W3h`CcXpD_6U6|Xryg83qDX%_FGA-%s*rk8K1H1GSyl_ZA z!3U@G6Z|p_z%Bh9L79f&k^YV_ywYLh$TU}`5%{FT$b(<{5&1GLKv4P-g$PQA5JgBj zgc!ooAr#597&+44P=Z|PZzz>%86wi(P>ww52UMU?`T>=QN1&Kd zz4R5v$#gst(pQ*&fClL+oQVeMOH9Nt=}SzK>0~rXU*If^kiI~ROj|Kh`T|pMn)ErQ z%5)k=NuQ%lre|Zc^ckk(bm=p+V~q3}X5b9zQ_RFz=~K*-={XoDeTvx_FCD=mOjA(oF#pN3uL+wEz&1{ScDeoFX%w4^cP%+snTE2 ziK)_lEXFixKQ2O>v>zAC^b(vc?Zc&Lm-b-^W=Q*R8D>iRa5-j4f5sI!NBT3a#BAx$ zxC*nSKVd1(mHvcfm?QlOSIhJo%#}XIwKBa9=Sd&qdYmtPj2m#i^bwY0zVs1p!~*Ff z+=Kx0)c0h^0L8tTqZbhf`KGtHf z^geEr>Fu~kdJlKtV(C5HDbwHJQt3V1g(cFvxLc<8;0ozotdr@zxKertzr|J3JGf7# z_hYH_HrC^6>23UvOn--Kq_^<^u9e=xgED;x*GX^T_cHwhf3BDQh=*~5^hZ2`<u||3W zTV?tbZk66Z3Tve|unlV^zWe1isRui7htz|o@f+!NJcGNW*YPawmR`qBnReqIX*Zse z>GN18?ZykZe^=U#UHGl^8eYVG(rb7L_e-zgW!x{lidV2+dKItA^fmmC^eT4achW0( zU8X&FP6Q%h-$GOE2S1nf?)fkY2)DcvyM~Z_D%@JR-e>cdhyO2P`sn{+`oG2Wj{jo%fA#c#i|O0{x59MF*Jgz|3htXxp?Q;1l_L5r zlt3Zy2!mFsND=*3#;8l9;=HW{PW9N!9nmwye?##xeepBI!|^dsR*?jO?H|~OTyve*?G~Sb%mS=Yx|}IT&@89y+ao& zE)Hvts)t5n@u7u9asEA@erX@;7x?ay1{_WdzCv|{=8D?a$m;>ckiyBObHZ~~Sw zcT>Y7s^8VUP^Zl)DM(b63{JE~CJk2Rf0UM$g=-rKps6WO(NvgD}{`Z2xr@k1_WucO4(dnhjU8cp_Edo4)^f6I%b z*;k6Y98imWLrt|M4kCVEa%k6b&fK+YdA7JK&fB#OZNWTcx(x?KGL36bx3E&BibTR8 zrPX3LR}V_FlwqaHo@sfaR9Y>zit<5hVq(fImu|g${wVLA^FqTzQLWLLZEf&3gqr3| z`C@2zg3o2JT^BxRbGCF_O9Tuz2Y0_JCVUPRV z`i9m0t2=+=FlE`)kF-s;n@tX?wOl@F_AOTdgtqk`Wlsp7!;Nu?yaIipNEP;Mv({u& zDixyLX13Ou6=O6S^ZM)@Km>);^V)WzfP*;Y_G=r{#~VvLfckiS+-R!he=Szag{+NK znoNVz@2*l(tHorO-!qgKp%K~^e>6{@ZE~tEIQ#4iR8CX2KKJ1S`Jt0gG9j#U7`6J> z`cn@+)Sr4)uQfV#Au_5TgcS83rAsrlEznSn%SoLsf!A1LQrc~zLTOfv(Q2)AyuJqb zLE-W~xSfm{sPAE3-ve>6e^;*VNwu|5s!Dg=plVZ9CCy8BpWSA%(WSpy+wVL3rT&c} zz0;`Gze+|v_z)TSnqF&k=tBKld2OTpZ__tPF*K-1IG)EJu^$H^V5>m>MxVnU4JyBi zs-7lyL5l^%n;x(S`VOF^SFTWyWU52DiLw7Zcf=WHq`2?>@~~5@f9DHR+o?)0)1_c= zCG_Z~a4D!$n6-fe&H?c=l#JmwvIeUJ^U*)hrI%g`g3qM0*jI`L5V0UJSfjBKr-s#_ zR?|#Q(@fQzueq39s<}yhljcrxx8@=8h-NFcl9$P=ns>=(pj$)d6$m1HgfD`sxyGIzi*n+ZFFks z13F8#(W%J!XG^ZrptmX>wr4vHI#7HneZsy_@I7TEWaDNN)rPlAKY&Sxx{A~V4I1eO zF=;gf8XlK)?}-*>2~QSh|&*T-s~cNMWOUVeVy~%|L#VMf zEj5ix5>sfg7;!l5PMg!}v^W(?kK60^x&3ZInHR~A6hsOmf>Ni~>NR?`UZqzkStMl4 zNg!Z$B}i16f15y&P?8{FLoh+y&R~K>^sxkrX)GZxK@fRCps=v8FnTp=G6$(S@o1dZ zlCTQ$6#UboE7Aldj&zV_u6h$ZzsZ!tM;#8!UD|f4|CKPqm`4&dv$>m6b4F?N(wH z<*}3(iR4A9szezE>^7U-rmBqOMe-uy5Vcw@HoMJkt0*^Bu`jNkeb1_Y#rELu=!cmtN8{ zH0%ubfA8orvGfneeMtyHRm)n!(MDxirr*}e2o`#Wb zfSNoFLN_Gz*jAz>N~a0qE_b9z@cJm6CB%_N;{&}1dVAqKr1)Y<5Wex=@Nbec($B+X8vQxD3&{V41d)}j!_ ze`ISST5YT~)w=6qgNjC&PIH|eYc3jR8fTmCnjRZh^i!cBio(KJF`=|bE2ij!30v0c ztoyU*zATbeV9d%Ajb5$M6fWRd*^x*^VI)#e=nWUfG)!hGl@(N}WYnvnMNYHKve_n^ zY&NsW>ogfd9?lx+hku!Wji2rH6Muo*fA9CWy&<>D6)PJ@v_(Y`}`>gg5x_*_}iCM$w*F}_?;9Ob=K?1(PE@?erT)Vsuh>=ICV3_$e*h;E}%RGFq@*`UYO< znp)uv$tc&d){}ufm6D%Us|6M1)yK3Wt`!xts;Wv;bwxRQpEsS| zY_wCw4o_$mK^`9@_EBJ@-Zurvga=0fp zv_}0!XH0Kyx$Wuxug{)twHfUt)7rxBksEG3Yr_>p-b#2sAS@Qvq7vUH&Tdx_gGL_} zMXx64_Em*KUUx;2q10bWOQV&Q-Xf}2R1@M=o1E6D(dczXVki&`e`rB8H`f~rg(J>N zlJyT_To~69$Qhp$OaoHy!6*@7^nqDusK3F(49% z%fvO}K~WH$Rfo3`bsC4;I^tvc+B*0+iO0o5ZM|_Z&ZpqMxT&_JFD}N#zBmzkA^zC* zc3kWw;*W2~kqHObf9d>V*|P8(gC~o)F{AKR1dVbhRaFIz!A!ReaLBzRAWOQN(~b_G z%b@eI-#ScYN8gpC$dQ(C2d(P&pCtWR+Wvj~ik|+_)8*^G<#ak91D^uyOJObicrQ^@ zA`~ma`ao8|60nwdN_=&S3Vo@i)LQSU_no0=)F&(n>uAqdfA3hImG3lrFrm{|i+a65 z^lF@bIqj*2$K!|BsityTQB4#IO1x@^iKp|d)kdq;Wb``x5vM8QbWj>m8zLHwnuDQn ztVl#>VAZ~K!*fFw^<1UztBr ze}PwCkzeZ5ftMj?_*_nZ|JkR!5P<^_x`nlE zVRG23%|)I!&ljl~;W^9muy331ZM;q1_I^da@Mg962+7*G z!Ed030<*zjGJEy@T+SB}8W*CWf=DQo8}a%}s$_vFuc$6Bud4Qz=oE5VT_LE|3c;&$ zThljle-MMi@1TwXi^E~Hc-_VM@_dZwxG0SlY%lCXOHWICa% z$sWFKM(}t9N(FCA$uP zr`X#TjdnQ1&s==Embn~-Wcc9#B*yDGJjsb(nb#}!@|k@3m1%uTaizE`>NsI+w4F3k zf7&|!!y)y{%c9Y;QgUHO8#+jsgpC!yhH89jKc>R|vIxDez5f|;os3McaXO-k(>F*R zseOab>6Oi#_V4z&UH)|@GM(-_by)Vr=-WIzkq?4mK)701ix^p$u&F80c$^;kG9@~q zbi0YoE$EE0lw}u~va^jQuP!&5mZp4?e_s&G&yU8uxmrOkqN-pjmB74Omqkw7qh`C^ zV)nXnd^{ZrR(OL!pVyn?ro=>i9=FBgaT7Pp(MWEtFOri(Q}nW}ZcD`NqMj7JETJVj zt(K_09v?}OSi%j&61i1|*x1`|aK`07*}t&7ILfUw15sP@>xsqasV5fEUC+&@ zR$1NqUk2H>UqG&`aRkHUU(3QNkQEl_{JuNZrTduE<__NfAJh5kI9icvStbPg(V?g4 zbf2>qk7F{$Txp*$SJ;RwILXn3fAp&1MJF|VX8X+X5Ah$SL$*Us<;%7Y#1BmG+TL?~ zDSl~ExkQ)AYO^_nmregP95%DxYVOcKNFPx=qIppNn({TZ`dYe5akF}v{wDKH*4ybi zg?f;3kh($>*AEseOcl1l4s{`o>Py62Q?9MVF@&m~HtZC;OkL(KYtpvUf3e-E-e`DS ze8}`W^8?lgZBIBJb*j%YkGHis?icSc-)6hlako?5WNxxH*+w}|cTO=(5hs|`1&+an zYV#m#t>X;CD6z?;)+x1Wx6-XHFyxu@tSY6|Nd&dokR?E6&lNPrTrJDa~+v2XbIc(l~2Pc}8w12a~$+N!Vp&}){dn~Op@$~aN)MP?453`K*R(@SN zJe0`Ri}lt(mZ{F{%QDrGl=Q`Bv$H-c6H*?E)_Q#=bflyo5?Mxbe;vs-n(Oo-9{Y8B zpUW}02Td6c!6>4l+-6c$Qf}mPJ=Y}6z45!7cK7clRl9Hc_NGbSKC|fvQ9bm`x3u}; z{=cjztt6WmNXz>EPaf$Z&Hb-_{8j&Zq>0N`3m`lztVIz9k^k9-ptLJ-Mj%)hwb&hX zQ>)G`yQqw*qJzsuf0a#fwUjLmERJ1Tb#v82g^!l)iM-=~E3hx}PSJM}qamUxYw|Y- zFO6OAUlF_2|2zMN*eiiogP%pSd^@C{pn*Zws-hXKYCwysI7y2dVvT0BsF*)c7!4{z zMX|8I7}XJ{(-d*gBKS&*6FO6UaYARPFD_O)3c``XLat@`f49@iP(;@!vVcLvCsyQo z5FwEiX?t?1XSIiVQY1gYx5tkQtq<)D9SjK}J~bMQ36YeD2SqA6YevmKZnUJ8;{$C6 z+C*7Hmi<#Q^2k;tqET*F_R3D|T2tDF`OkH?8jMbwGImavUmw^m9pcNsTcY|Zn?EHT z?y3xwrKGPif3^;4T4ldCiAMh=_M{O?m|KeD8MH`Vr!IvJ8)zH-X_Rdx6Nz`4Z!Y}LeZ z^J^yF1%hqTKEWbv#Bh9)C>&aGx_fLzTg4@|8*Iy6F*mta)!sc!ds?8mfpU>}q~YOV z@7O=H|7cga`AeD|)hX%EiRsZq!O$Tthe2Th8I+gNt^yT*!zSrg3dJk)DszL4OrUw{ zplo~&%AM|8=%YSYvn4lC770fZ4GRmF7OXC~zu<`iMS-*Fx7&&Tn4__6%z@rsu{Z6d zPFtiIlQb&!8EZ>2cBwt>v`*WoWu@FLNI0IHYHp?%8+?>I*)pDYYsRFh%=qIf%6Sju z$*0U@x22(f-DD?<2d-QBVDahg=Wb{?tM#)NKDw5-ZaQbjefK@p+*Eqko71MfwJ|Bw zd3Yzi>*E&a4XbCAPpI%4J>I+(XRq0PQz_5-f*YsPeskaaVRL*|S9s*e>#uv3f3*e> z;=)>laZ94mpwU-xGc@G!SBJx14^=CwxaDbf+Nw=|Ca*JW^0{49qgFdpWZ_m(H2MIN zA`24%(Np4S_w4Zq22Z_btY^Ask!Q8%3C}){+Vf>D*YLRK<&dnfrB^BXPBjgGVJQAW zkO$1e;}N>%L)m`$JEtG^Kg?T)ZRD+YviZ{gCobFMlKz|IFbsk-rG3H`!djG)&<=R` z1`X+dr!K$f;cjcU^iv{qiTi-^GtXE4f6yP5Ke~VN9|>r5R8SJP&VRjoolZU+A|o3U#!};8H`<4IZgFZmJKcw0yO!y1MEVy@vID^M^%`UpB($ z%GUeRTFkmu(`6rqTS zk@m>mh!BYsL?e;Hs5caaPIiGh7ODteC0eLrDpdhhsTlR@Cv-KI7iZP z&>=Xun?`4+krL~4>rN}Prbyjp$xiIs$+fW2y_;jQH}jn9qvD~@+77k#a(_&lJdy^C z9)6aT446K@;>0}FNhzB?|CYgR9NEh0XbXmkECH3(awn%3PQ#?)*SPedi~3s|?3S!7 zi=EUu%vsrH`~Q#|l;rC54og;lw%I{y(qTfV(^&O-t0qm4+Speorn$Ev7Z4s4)*_#o zH!1ngkR%*d2esK1N`VOKe3wNT3FxUNhgu8LQ!Iy;xV#L?)jfCO?1ip{?uDL(-WzQ< z*t-?omM?6YcCp>qZfZ9RdngfYqCH_t*aZi5+kH;I*Oy;lucpG~a0?jY6|Vq0uN6 zUcEvHxOfqZceS&qSqFU;&Fl5PVjP#cH+W13rh-;&3=A zp^W$(c8kMdr;HNjv)U|HtBpqNDSC0j=ZJt1W{ogGofiqZ_+KDkj$|n#S$ayIm49K? zLE7L1NL!+OkCXVF#F;3pawaOPE1kN_rAW&bnut`<6kXD#2w0yXZT!bd zNeluhN?83C(rqD@h^Qb?j8&{w>`@4cXGjbMXd)BgkcY&SO8l8-sIXYQ5eoD(zbQyKoT{c%nnH!yS9dmM1>6+y*TTPlUj5~Q7t?sm8GcrO^f{q! z0C|swSjo{h*`H59V)X41diul2Le>`5RH73~O44h~C%F}cJB~ac<9nOm>FnEc?0Skd z(mr7_TZVj8lbMO}kE$N@KU&Nps$BmNVX^rV*TwE-mg`+>EqAy!sMcE^bUj}3r0VJH zO_nXLZNA-q*@w!kTH+*ygxzDj-9;}iUQxWR_|fbQ#V?k zP%xBl@|x`h)j?Dj5LThr#Hv$de_{%`F(2BBAk%4r+(W)7#$p9S^!j|uy<*U-;u%>8 z1cHeyTfHGjN`m#lvBBxV`-4vecLw(b)j?N{eRXMnP|5QbD(_eBRPIv>O6Q=$9ml6) z5*^d`*%|4jrnD!wx4yU6R9n(p($>r8knJi7nA!8eXwwru96fJU@yvuE8q?*6VtTufdZa@}c9%{k+e z3m5E|wd9_=7hbm2Al}$?Zmrf~GHMO3!r#v7dt0^verFWN4w-QJ+_R>0E3!!1C!8gG z4iEB4&L$3$k0*3ui42gTERT(+&CU|5(`mDp{7I2dxe2OtgD$|Aq?=Vt$*Lx|V?Em|dAK&)k zaqErU_u<;LAM%gzdEZ+v_5b+%uKt5BJ;W7ap-y&_zjFVdfBtm;{eSus2sTLjgwbpn z3UTnspjKz#u8PBnn9flDvi0NK5Ayc=_Xoeu{VGqDW6iS-4~)qjlQ${QmOCZyJi~d; zdAT<^^)~LP=rmhe&6BO?=boE)*riaqoTAlLAQqT%T`R8=Tn||va_Vj2h{x6#pAW?ZCv8`haU*GNJL#_8fW*PDL5@On3ntk%C3(AF6IjN7!HW=AEH}7J zBw~uJf7%=^TsE){-jQh^?yiW-i>-07_kh@Y;1C}N|JpDpD;=G*Wd_0KY_&GREDb&m5GMjbQc!d1#+%3`^FK$OiVh_XP_5VQ6#7rwb<$(x-Y z-zldTy?@7@@4tWN9q$XDA6dY$Uq_tRKI9+1p*+%=ndLcLeQwwPjn4g&wt;Z ze;`FZP1r+$A!NvU3t4E{Y1w1hXAvyUVBupYi0GJJc?&}C0eMa^)t1Ej;$rVfAk$^D zC{xnGEpCh7M^n-_$Dp3Hb&#OVcFK}DgVQ?Cae`5Jr#Qo}1MA`qht5-h$*v(wqeh(0)2%n=8 zyA!zy{W!%k#kKmY%hv0=^jo6ON8gTW?P`NY|B5JvG?m3DBV{QnYz0EaRINynM8ZW# zNS%`(LT+0@&be9hhHIQi)dS=cpkUCW`KM9SKl@ zSjjoci4XD5XPB2K0VQTKj2D z`%#VZ7S-cA>an4l)?-!w%FRtCjJs{>%$ug2?RPr;{onEFlnVh^EzJ`~H4x{IaQ+6$LKo`(}WVR+T{cZ~6;1g%J!MEKL-KoaN4hbAof0bFuR} zr^=iqwtrYGp)93d)1pv>^fr(44y!ffVK34YxqYignWfi)>>%8gN6G#~wjd}1*0C01 zaeBuuJ-+Ef?2~&bUVpgvlnoF#aR-exTxI^n-i}NI&^1>qC8PLz_c>(aZq$!_@mOK} z;Di40M}Ig0sZ3@E$NU|DU=cot18s@QnbuD0wNh4Q(CAw@##6PTg(JGjVZFm>3^|}t zYe51=Q5-Ao6q)FBo>+Tc@qbh6e_7*OPpTKsFL@4rr+vQgrM!LO9MH{0aFe<}!MP#})2H-3DSzwZH;IW&v-{qX zrgFI(OIf<)aSU_ zI`>0Ldbxiy*+QAef1aO$2$cHNrnK!~u==gk+AJ?lgiNQ-K}KDA4u8rf+0EMQY@Ie_ zOwU0ga>ZPF%0!e^)tsJ)%7@e_$#$|I0WvFL_67x2L4Ll;WYlW30oOh!aq{U%l&7OL zrRz&+sgut|$005=6QzZ-?@(`j@BdTU)d$B>mht!9z1zLpz1_Y2ywB|I?Ot+8uE`~7 z(p=bUZkq-KiwP7XM1P22#$Z!mLTanncA)6k77HB^K{9|-2b9s46lgodLZ?`vr6XFD zQbh*(F{SF*K$+~Gd{u5Ps>it~HZy5e;6(A=XJd-%UZbcJM_d7@E`KN$iWhjtY%jVX9bJ3f z=Kh;{bJt^kIF2bE-?{CY)uWZ!sN^em^>^3lo35Dp;CwdfU$gjoQygVgf z0W`@*+uC6@M9@*tA|g0K7W4wE2ztTC2zr4=i-?pFReus&pcPgsuxQZ~G1RG`MOFj_ z-SM&`2}*%s0>Oe0Ed(hf@~}*rnEC042x}?#Q%hT^e>E(S;?mNC^%W?Dz zx4$%f28w%;FzC#$e*Esy#~(X(6d_&HcjDb!4VqztQ)p&{jx-~5v^87}`-lPVYjB7d zqHf_O;YedUv&OFz#FNHL_b@IM3h9ESJ75-6K6r zJ%29KakoTIylN#9re(%s>TY5jgrVd3F(=cEWvbB~y|q25+S=-rnPGVae_4u`=AaA| zKFFl1ZIGduLNMu}RXb+d@pz08=rc4yM;m}*qy+0K%WcliSdEa6wFz-8()j#pF{1CRp-}STf%(S%2X*DPGRDB@0!u8|Y7Jt_kAFCoWxbcSL4* z*=minKe`vL#AV)Xh}!lWOmHIy5C5=lC@M#2*@|Abb-ERsMiN8Bi=|w62&q}gb)Xx5 z=xkI9@kNAmCFlpk-P??9?LW!ACLip2S3aU0>3qBE@AApkzjpmgKHK_nm&D4H=6~(< zcO_(1Q#)f_o6Lt=Ul7=9BVH|6hdR{+uwxww*lu(rpwy)%fK~`6Kq%a~@RF*0 z0>+|tK9^XK0Lmf}mt80cyGw~yhVxE}9?_J4`u=^dt) zkDu?^kbfa+GtptLFZiN*JarA$L2)^lg zl!O$tRD@$N052xpP?eBY!KP8D3N{V;o6Dz3*Q83)Uve#Kbix?3%`M$NKR8Zis-n@v{d!c3@ZpWw$4IFR)P0)C$nVZc=_ERD04bQd%t)n@hM9(% zpcqLTq?u6IPUyPe^V>mzQj#QV7yyJcRImE$f}-I&L_->ZCx5kb!IOO66(r_e-nskc zfC~_?{}yf?20AF%8nYl0N%m0QYS|+ufJ7ao^JAFS;LHi~!ld zM&GDH4gw3_?SJIA!mZLanKT%KHIPt-Hv}Vi39w;Kx5!rx12E5j~~+tH>e&p&^NiB#DXzfFUc2EGx1E0e^#Xt!l?&L7O3M#!p$cG69!6 ztW4Nhu^?_2NpUw^4rJ(eI7fm_(ulN0dR_8Jd*F7Eg4Hlt;u)MB7(InKIFq1)WmU+3 zD*a|IRp27LfKT8F;8z-0aLz~{&YydQcxLnTQ(wX$3f7}-g00oC@m_o(kMOWQlEX?V zWbn_q-G4+GS$SysPR}FcAZUTdoJC;}mcnL+ONQEDo7l@ap>y&-P1Y|jkw0%PgUiG_ zllq3U5eI*&d7R!_+5dxp?mHfyAm$T#6k&r4e#yVW8O1f${U$qzZ<&;uA@&5 zjDH4C4UEoIY85_G8bu;Wu(!l2xyU;${ujR~p9bgNP5Xj*Uml*Pa+UmM!TfSB3(KBV zej~;l6>5^Wb$WF~k8-MZ3YXXLTDTO4l=l+Rpwc*X`nx#fV-6~$NiHmLsvo;qFY&DF zW}HT!d!<}?BafQ|fP9}E1R?M@hv89U27i4#L+mMj1i0eIfB_y9+3746pO}n>{ia*a z3bGs&OpS+xL>L^ea2(GC2p(!25rDj4fDlCz1{+}DfX5b?0yDypOf;emj09jH5?-~g zLU>wY1)Q9D8%$|djB2Y5jTwk*8lrf3N2CQ&^IzH#YH*KAEjs?`IX+a#locef^l8)q ziukim5TP3}gfmcuWo09sY=g-%7nnRUwTZ~#al{lLR!n{5rpYB!3s+(-+Y(~m3iROs zfW;39!}B(=3UKI+6Lbo&QNa`8^Ubs0I5C@&^TfIJ81Y`MN27${7DWHq_x}b!x9H3QxE295m!abVKYy%v!&+h$FQ^q;uOC}o0@4LRW3?79`AC(D)YhQVs;wz# z!K#owKW28rMQuNQeLvsV_n%+S*?pdwd7hbP&df8w+f%&a!xu$> zJOLmuck+yu(w2txKx!jkxNFghj-Hrf^izNi0(fK5+BKF(uDGQJP=C7tb^PL3;_L-H^(Kk1Humh5?J27sAJ!=Pu&Pm^;!PiD>|;~(Y$234EGs)! zbWI9%qyge*fKb)by?=U5I0yd?5I3Xutm^9dzm zD-Pj$aeqjDUmQY-IE1<4kbFE!TaJ5h7qWQKD$HkEB5DAdg;%0sf@B1vVG1>#h=v8! zKBmJ9MS{%)+ndi0v8n!ZIwuQmnyh9_zwtE@>^g z(8)Qqh~fXK=)yv*iq^k@OIV5KbFwZ$2iEi2u7L&1(ap!~B3Q5p-RQx3eiac}mUCB7 zh<_4TkbN#T9&TQb4lG9xmcoLm=)g)|#v)u1<*i3ImhzsNiYw8{+bwcktSy%DYgztJ z>$8}*2kV1nScv63wS%|D#n%`qr#pJ37A}SL#Ug&aV|}#_9Xy8xS7IePqy4nzT%Sxs zGjE+`Jl{&*z7u)=F3!<~6RV%#gCCCEMy}}9*+J$3}46TN#Rj|9tJQJ{YQ?)7$P|s;^*D?FR+n4gqv|Q zxrvx~>YaEJ%w}xDT_Dh*4+1=-1wTjbS?(inVJ_~$J@^_!Fya;TVMzWQlkhg0Ie-5+ zyn=f$2``gtX(ly;Vn}r2Z6b?*B}U;!XK7bCazz&4SFN8+%TKOR~VK!Fc$Jj**#DMtf=ttoj z~f7rh7~!e zL@k=pil?y?doY9#h)7JtMoNgEOeQ~|m(aC>S7;P26|NEbg-3-$;ym%`us8fS`9}F+ zd7u1_{GL1l3IlA&$8^j_Gk;oeH8$Z6{1i{)MI6Q##7-uWmE;HHF7i|I3-UDCN8TY} zs-;f}Wx}1pZjp$RxK(^5YzY4>910(oYvoq?405p$H{cfBiJ##yJc(U+5yPa8Tta4% z`6NJAlAFk_kqhP3@{RH> zm)+_D7eF6i6K>?^?YINKz%Kj}&tV8h@fl7L4bhT#l1U0lA(=p`$RyH2){q~P`^Y2Y zL-H~C2PIUbE?P!s(k1j3`Y@L?>jEbNdqjFN1ACQ~KUE~4sGx9U?BzcNFLqa4( z_K|&Lko=k)B=3;J4IIz7JNdN&?{Uk z+$=mM{9JfT_+0ph7%wJ>+2Ta8OZ>6;l=z}}L_DpiQ_N7TQyP>%RBnk{j-d;^1X4@A zbTOrWq!k2l=)tq}6`GHxbG-jI&s)hqaDYt0pUCLh70s=<71!evl1Jvz8uDj6hM$u0 z{vshKAl1miQ-a#E@8G;+)DpK zx02(iqYv>q|B!TGJITc^43SIm3>_BB#QhkLDX=0<+)A6MlB~xjJU~S}PG3PYcAy0_ z@g(j+E4JeXRKt&PSc4ie3xxcGXkZ|>g5omRa4VUNr|=XR6~Y+86nQWIe?kj!Bevpy zUI2UGz<0A5-xjxeYrp z6~8CRxL;l_d+{-b7bPF>Czfd4#3z>pQ zzovhqpVB|jcj+K~lJ=1xAipOcknfWlEC3|}$ssv-89$dF7Utkq?BIjtar!2)gnxz{Qb<;kSTY?Skt+NJf59&7 z8r_B`@PzVl?7<%8lQ^Y(P&kc$t=NOxXsyB^ddMh7X*aoDzBGI(uEy2aBmN0<0O^vJ zd2{D9&u*I4*f6txn!l>jH?g98!uV2eNpVr3ry$?$%F7*>lkIfaZB~mpD>EZK&6Jvw zoRpYgH0X8l+PK&ljasEthyo>W*V?B9EWzwRP|UVZotn?$_6|!hyW@g?gh0^JVF^yT zm?vlna5l@uoKlA+xcFO~QiM}F$4T@SAAI?4ORe1!9GYymgvk6^Ep|)r_R02EOK^mT zXYjC?%_G{$_ExJk-)*tfrY@aq36g-NHaKPN(#^Gj$@y-wBQ~bSUegtm@5YXp*cy9H zY`z=86noDOl2S!@fTq-cR_vfqYxCW;!8H5i+MvlknN=YuIBPpPgN?IVYA2^#t*!a) zAgNhoUl@daQc&mOEU4jPg36kpii@!CR(*CUk&EiG*Rqtr<(8nvKFPjx^W}jKOE7J75KZf?18Hf} z9{DKJYAu_aTkO`LKi%HiF*##LA~rXz-)WL8ri&^0?j3qVq&0WM>!N`;?S+A^b2J{} z>?}0B>0EOXRwMg=w4f9SS{7M?Xlk(ssdEAYT@$c*(S&p>J6cJ;dwQ^QR!i-&pr$6U zSzp1@S^l8Hskd7;pF)rX>?5CDoYE0ZQ9AXfz=BLU&M8=sbc}_AE>|!wkLiV~Ca7dr zP{re=`R=tLI%MzBTS9cG))GWxOOSN5R(MkL-Bv5>)!RaU5*FsWt-+16S|V`^7N!qC z^0-=qG{7i>W0a&hjIwczaxQzoZq0Y^;yV*bL3Q@IpH82gP`k7uNRs~rxhq1SKHENh z*8CPr?dCwVZKpS16pPR&oTEiU!GxL?A)Q7;G+p4-ps{AbIc64Vi3^I(py*U`P3{b- z)U#S5Da0~=C8!Tfjlk9ztM%W^6p~M{TpXRx7OiHm!gXt1tD0=Y%iV=*o8oW1T_4$)JLlrQ=Y`3r%u=22-4=MDIJ}E3fpV9zDU>Vw_C8 zjzhIGsCNbpJe=$tFd0}43|zMH9Ap6BsR65i-uFM(LC1e7&Y;Pe3cXK#2GP23`w%3N z#&2v1q;~*uK#sq(vXRGr3g?`bpprMQm6_3Kd&P4Rdj5+P+dRFgCD`B!Hn^Hv?5)>F zMy55A?SdoUe;pLEiGJF|e78L)WP^t+*>+2|J>P9-N@)oMNx->zLb~1B8j|Gzv#PuS zXuxS<Q_BEVbN=)_60ng|MV`Rpi$VlEO+A)I zuqZ?$Y5ItuY%WLw#iEcHp-5xgA{K?zk+h8w?r~9WH5P^RjItM$0Gt>(Snt*}w_G^H zdGEC5e{)|$fI!%x5ClRAL8{`j*g<@ymZ64P9)$)Pc@!~-kw+1WSa}q2h?CDi%V9i+ zI>gDRp@&vJ4Fh!YX&9lGPa^?(`5Pp{Ab*1-4wGS&zeWlY<*$*-p$SRyS4cy${1wuX zB7cPp4l|J|{{vYt$^U?vLkrU6FJVQx{3UE0f7+2LpMnEf@+mku%!Wlig&f%AlNiTg zF6{D2j)|B>xRQ4l7YC{|!|rkw@T1sXPJ+W%3BBF<$-* zf0H<@!36m;Oh&o<8ER23{}oeEA^#P1m?-}hQ{j{Uf@!Ff|AKl{$$!CgRLP&>68Pm$ zF$0qPDQ0rmfNJ>@G-8tc31)HFgc|u{%;vBewerW9gF5-on9JcjOqKu4d|CO=XvK8- zPneHO)rTi{#He$O+1R*C z+#|n+-MB}76~Dy2@~a5pKKWJb!8Z8-_Tql|0G`7G@&W9_PvisGkB8*n;CXD9e}fk| z9K^%&D|it@=F-P&*fj?zd3vpf4`8~j@;Aoukc$uEx(Aj@QnN--sbQSg7P4Khn?~u-r?{t zo|Rv~yVxzifFm6K9>0`dzB-!tC;u;O zy7m8wO)ua!-NS9Ve}~)j!hhSQPvACv0=Mbq+@@D>n_j_f`b2KiegDL!`?*b*xJ|F- zHocnL^hw;N*KnI&!)^LxZqq0K$EN?srvLxmrVsqbrk}IvDsIzb{)tW3a+|K@HeLI_ zw(0-3{Pcg{rsr^*p2KbWIBwH(xlPaIHa+h@HvK;~{XaJSe?K<;->~T~{2$r$SO4GI z^d0le)s-TFM)pbG`9wCe#A&iHFFhsOp z5IfFOwnSswe}ymv=tKorr4{gt3TzP-I4&yKb6CO|5a@-|=oU_6yKn|ag))6uw4}@HI9H zUn3}djibWXtQ~}};SokrD0~gSFv__CXLI$RjlUp_e`4@#&Vy0zSV){>6airr&z#K_ zynu^woDjZ-MjjNt9+-G{@g5$~8hGH;&I(`g!Rkce)Y)t6=TIk{f=4(7zi8Yv0eBSe?j3>3<{s(pztX)=odv0c~BHty@Y?z zd6)yUJSd#t<)#ZKc)6dTNB9IAg->|7pInsEFMNXS!Y2p{pI}h<1P6sr1~f)XwIpmp zp|A-IHwv2|A|Px-kFX6Jg>C2;wm}5WhV;TVScGjT6t+PUwxLnj1|=XIhF&-filf5Y zA~+$u%^r6Z-iBUy8y4Yh6bf%c65fX5qL?7OMBC8`v+xMF9{U1I0UO#&58yaGAkCo` zD|tw9TtOcakBjsn;kZB_qPK+n0;U8A!*m_C)3tbrmofnZJqM->v7L6{A(wUm11tva zuR6`QewU~L15*JA|2B#d}&EXxFQvw4xf5?FKGINOhY{1%N4v{4T z)>3nbEFQ2HnL}jKfVIXPBGtRBh30RpA(2Qr^9R;d=C`c%=AgCQ{4h%!Fh9gevF24) zm$}QDXYPz7&x@cMhIX4PtxuWrBPs4k%A5pEf~G%2_DChF{@*&ybS66$z1t^^`#x zdEt)|HAOuFdub(lXypz%KA0d(r_*OoBGZF|i!gnmCHUoRdx*r$njciyCy}6WI;J;I za;;9C9yHCK9-KXEeoKf}1~*QgZn0P_K~oct4o+?je`fPwh+uMSus9l)CbtGFqT!8` zTZ47c@ZjXu*5G*8^pHw!3QllM4{91OZP`J{k6MEhTtRwEh@iP8L}Zq9V>)~EZx0AD z-*|gE!}5){x3(gAtv}UotTL2OnfyH<5QVPuN9y??lij#piZeg0GS{liB`ULB#nPwG zUN6PMrKlelgE>&a*wrBSd(t7w{xZfR*!De-kErhsXAB@Z@|ikL#ZuU6cMP>B58T zK@%C?F>x(>N;6=u?F!gy1Hs$YE=>(?TxhZE!9+3~eSkANuyD~*hC8}KWZ2#{IXKZi z*|MW)?RV+HwT#?kpS%NWYnxkktd+VZ4>UQ%GGPme+8~| z@wbNATN6tZ?0Gd6CQ4aK)d@|az^Vz3&VR)ckkh%**p@QkFuX;{QTCS!vvi8B?~q6u?JnY7B#WOV5@ zO~#@ab(7JnLX)wAWKK(S>E}*Me=CZaJuS_vnmR45f@DoGyYzFWn2TbXr5F|iMKLA59ItAkFQk2~U83KWUlgO!%$+-DPH}M& zb4!Z7Dz$p{?B?c@5-(%$=2sA4>eRZri4%1dq~g;{r0T}%Ky^>`(drY`f6D6dXM7<# ze_+a+(_WzS(L|O)L;+cf96Eo%{AOB+&X;10XS6FkqFB$SOWE92Qze?m#ZSWqR{RVBjK!g_yIy`*z6GQ;6`*`xjGdnl^ zbWN!*FLT_E@M{lke-FR5BPT1*mulazV|9?ZJ70tc>GQmnrII$qpfV=LoY6^R^^5bs zk9NEO5owkXsoilqtJ{|s)-6$WzQ4+hrCyrDd#X6{`agaCpVw^Hria&*`SP-Ic962| z50SDR<1+JnskWw74P26*KztYEdC(tYe;-stwU_oIhCILHM_fyf zjp#?<8P)rW3W=3OD?`hOF?=K~C(WrMiKB;#Y)QH_HiDm!KNPbS9_V1jy;97y#JV^| zW}T?DK1VO(zTjog0wm3z%HkTB=w;8U)f$uS&OM|ZQL~{R(T_w72b1g{@sAW0P7mrD z*Gpy8lI)Cke;TvXvz1P>GbuLJg#@kMMKTm77qSGai=@OPx`;uS=pt#VOcyLP(*-_< zpEr2dlcYpyw`J4PQm?V3IN7N3=49J#DrHhqVoGvJ@%XY*G5h1g*F1IKpATRC)cyb6 zRvKuV*m{|_W5L8$`t=6~!arU?oR56)8`8Zz{NAIFe_vaB$?E_5;E8J(0%6|?5OWkB zq~V!8NRtO8y~*lNNn4z@E=@>EbEeU>kbGhw+2jq$gHl{FQEOsibR8W>2&A;x)25sx=_*> z8uk79f9-lfzmL`<9e0u=;Qi?v(U0hl!SC~rxLmHba+j;95U$=f7coRlhBayr45~

    ` in GDB to view several literal pool words at once diff --git a/WEEK10/WEEK10-02-S.md b/WEEK10/WEEK10-02-S.md deleted file mode 100644 index 8158c68..0000000 --- a/WEEK10/WEEK10-02-S.md +++ /dev/null @@ -1,64 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Dynamic Conditionals in Embedded Systems: Debugging and Hacking Dynamic Conditionals w/ SG90 Servo Basics - -### Non-Credit Practice Exercise 2 Solution: Add a Third Command - -#### Answers - -##### Patch 1: Compare Byte '2' → '3' - -Change `cmp r4, #0x32` to `cmp r4, #0x33`: - -``` -Before: 32 2C (cmp r4, #0x32 = '2') -After: 33 2C (cmp r4, #0x33 = '3') -``` - -Only the immediate byte changes: `0x32` → `0x33`. - -##### Patch 2: Case Angle 1 — 180.0f → 90.0f - -``` -Before: 00 00 34 43 (180.0f) -After: 00 00 B4 42 (90.0f) -``` - -##### Patch 3: Case Angle 2 — 0.0f → 90.0f - -``` -Before: 00 00 00 00 (0.0f) -After: 00 00 B4 42 (90.0f) -``` - -##### IEEE-754 Reference - -| Angle | Hex | Little-Endian | -|--------|-------------|----------------| -| 0.0f | 0x00000000 | 00 00 00 00 | -| 90.0f | 0x42B40000 | 00 00 B4 42 | -| 180.0f | 0x43340000 | 00 00 34 43 | - -##### Behavior After Patch - -| Key | Action | -|-----|--------------------------------------| -| '1' | Sweep 0° → 180° (unchanged) | -| '3' | Move to 90° center (new command) | -| '2' | Falls to default — prints "??" | - -#### Reflection Answers - -1. **Why does this exercise repurpose the existing case '2' path instead of adding a completely new branch? What would adding a new branch require?** - Adding a new branch would require inserting new instructions into the binary — additional `cmp`, `beq`, angle-loading code, and a `servo_set_angle` call. This would shift all subsequent code addresses, breaking every PC-relative branch, literal pool reference, and function call in the program. In a compiled binary without relocation information, inserting bytes is extremely difficult. Repurposing the existing case '2' path reuses the existing branch structure, angle-loading instructions, and function calls — only the data values change, not the code layout. - -2. **The cmp instruction uses an 8-bit immediate field. What is the range of characters you could compare against? Could you use a non-ASCII value?** - The `cmp Rn, #imm8` Thumb instruction has an 8-bit unsigned immediate, giving a range of 0–255 (`0x00`–`0xFF`). This covers all ASCII characters (0–127) plus extended values (128–255). You could compare against any byte value, including non-printable characters (`0x01`–`0x1F`), DEL (`0x7F`), or extended characters (`0x80`–`0xFF`). However, the user needs to be able to type the character via `getchar()` — non-printable characters would require special terminal input (e.g., Ctrl combinations). - -3. **How would you keep BOTH the original '2' command AND add '3' as a new command, using only data patches (no instruction insertion)?** - You could repurpose the **default/else** branch path. After the `cmp r4, #0x32` (case '2'), there's typically a branch to a default handler that prints "??". If you change the compare in the default path (or an unused branch) to `cmp r4, #0x33`, and redirect its logic to reuse one of the existing `servo_set_angle` code paths, you could handle both. Alternatively, if the binary has any unreachable code or NOP sleds, you could repurpose that space. The constraint is that you cannot increase the binary size — only modify existing bytes. - -4. **What would happen if you changed the compare value to 0x00 (null)? Could a user ever trigger this case?** - A compare against `0x00` would trigger on a null byte. In terminal input via `getchar()`, a null character is not easily typed — most terminals don't send `0x00` on any key press. On some systems, Ctrl+@ or Ctrl+Shift+2 generates a null byte, but this is platform-dependent. In practice, comparing against `0x00` would create an unreachable case — the command would exist in the binary but could never be triggered via normal serial terminal input, effectively making it a dead code path. diff --git a/WEEK10/WEEK10-02.md b/WEEK10/WEEK10-02.md deleted file mode 100644 index ac088ea..0000000 --- a/WEEK10/WEEK10-02.md +++ /dev/null @@ -1,159 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics - -### Non-Credit Practice Exercise 2: Add a Third Command - -#### Objective -Find the comparison instruction `cmp r4, #0x32` ('2') in the `0x0020_dynamic-conditionals` binary using GDB, locate the branch target for case '2', and modify existing code so that pressing '3' (0x33) moves the servo to the center position (90°) by patching one of the existing comparisons and its corresponding angle value to `0x42b40000` (90.0f). - -#### Prerequisites -- Completed Week 10 tutorial (GDB and hex editor sections) -- `0x0020_dynamic-conditionals.elf` and `0x0020_dynamic-conditionals.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with SG90 servo motor connected on GPIO 6 - -#### Task Description -The program has two active commands: '1' (0x31) moves the servo 0°→180° and '2' (0x32) moves it 180°→0°. Adding a completely new code path would require rewriting branch offsets throughout the binary. Instead, you will repurpose the '2' command by changing its comparison value from `0x32` ('2') to `0x33` ('3') and patching both of its angle values to `0x42b40000` (90.0f), so pressing '3' moves the servo to center and holds it there. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0020_dynamic-conditionals.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the Comparison Instructions - -Disassemble main and locate both `cmp` instructions: - -```gdb -(gdb) disassemble 0x10000234,+250 -``` - -Look for: - -``` -cmp r4, #0x31 ; compare with '1' -beq -cmp r4, #0x32 ; compare with '2' -beq -``` - -Note the address of the `cmp r4, #0x32` instruction. - -##### Step 3: Examine the Comparison Byte - -The `cmp r4, #0x32` instruction encodes `0x32` as an immediate. Examine the instruction bytes: - -```gdb -(gdb) x/2bx -``` - -You should see a byte containing `0x32`. - -##### Step 4: Find the Angle Values for Case '2' - -Follow the `beq` target for case '2' and look for the literal pool loads: - -```gdb -(gdb) x/wx -(gdb) x/wx -``` - -Case '2' loads `0x43340000` (180.0f) first, then `0x00000000` (0.0f). - -##### Step 5: Calculate the File Offsets - -``` -file_offset = address - 0x10000000 -``` - -Note offsets for: -1. The `0x32` byte in the `cmp` instruction -2. Both angle literal pool entries for case '2' - -##### Step 6: Encode the New Values - -| Patch Target | Original | New | Purpose | -| ---------------- | ---------------- | ---------------- | ------------------------- | -| Compare byte | `32` | `33` | Match '3' instead of '2' | -| Angle 1 (180.0f) | `00 00 34 43` | `00 00 b4 42` | 90.0f center position | -| Angle 2 (0.0f) | `00 00 00 00` | `00 00 b4 42` | 90.0f center position | - -##### Step 7: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals\build\0x0020_dynamic-conditionals.bin` -2. Press **Ctrl+G** and go to the compare byte offset -3. Change `32` to `33` -4. Go to the first angle offset for case '2' and replace `00 00 34 43` with `00 00 b4 42` -5. Go to the second angle offset for case '2' and replace `00 00 00 00` with `00 00 b4 42` - -###### Question 1: Why do we set both angle values to 90.0f instead of just one? - -##### Step 8: Save and Convert - -1. Click **File** → **Save As** → `0x0020_dynamic-conditionals-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals -python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 9: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press '1' → servo sweeps 0° to 180° (unchanged) -- Press '3' → servo moves to **90° center** and stays -- Press '2' → now falls through to default "??" (no longer mapped) - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate and patch comparison immediate values in ARM Thumb instructions -- Repurpose existing code paths instead of adding new ones -- Understand how `cmp` immediates are encoded in the instruction stream -- Combine multiple patches (comparison + data) for a single behavior change - -#### Questions for Reflection - -###### Question 1: Why is it easier to repurpose an existing command than to add a truly new third code path in the binary? - -###### Question 2: The `cmp` instruction uses an 8-bit immediate field. What range of ASCII characters could you use as command keys? - -###### Question 3: After your patch, pressing '2' now triggers the default "??" branch. Could you keep both '2' AND '3' working? What would that require? - -###### Question 4: What would happen if you changed the comparison to `0x00`? Could a user ever trigger that command via `getchar()`? - -#### Tips and Hints -- The `cmp rN, #imm8` instruction in Thumb has the immediate in the lower byte of the instruction word -- IEEE-754 for 90.0f: `0x42b40000` → little-endian `00 00 b4 42` -- Be careful not to confuse literal pool entries between case '1' and case '2' — trace the branch targets carefully -- The `getchar()` function reads one byte from UART, so any byte value 0x00-0xFF is theoretically possible diff --git a/WEEK10/WEEK10-03-S.md b/WEEK10/WEEK10-03-S.md deleted file mode 100644 index 45d9b41..0000000 --- a/WEEK10/WEEK10-03-S.md +++ /dev/null @@ -1,49 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Dynamic Conditionals in Embedded Systems: Debugging and Hacking Dynamic Conditionals w/ SG90 Servo Basics - -### Non-Credit Practice Exercise 3 Solution: Reverse the Servo Direction - -#### Answers - -##### Four Literal Pool Swaps - -| Patch | Location | Original | Patched | -|-------|---------------|-------------------|-------------------| -| Case 1 Angle 1 | Literal pool | 00 00 00 00 (0.0f) | 00 00 34 43 (180.0f) | -| Case 1 Angle 2 | Literal pool | 00 00 34 43 (180.0f) | 00 00 00 00 (0.0f) | -| Case 2 Angle 1 | Literal pool | 00 00 34 43 (180.0f) | 00 00 00 00 (0.0f) | -| Case 2 Angle 2 | Literal pool | 00 00 00 00 (0.0f) | 00 00 34 43 (180.0f) | - -##### Behavior After Patch - -| Key | Original | Patched | -|-----|---------------------|---------------------| -| '1' | 0° → 180° (sweep up) | 180° → 0° (sweep down) | -| '2' | 180° → 0° (sweep down) | 0° → 180° (sweep up) | - -The terminal output text ("Moving to 180..." / "Moving to 0...") remains unchanged — it still says the original directions. Only the physical servo behavior is reversed. - -##### GDB Verification - -```gdb -(gdb) x/4wx -``` - -Examine all angle entries in the literal pool to identify which 4-byte words to swap. - -#### Reflection Answers - -1. **After this patch, the serial output still says "Moving to 180" when the servo actually moves to 0. Why is this a security concern? What real-world attack does this mimic?** - This is a classic **display spoofing** attack. The user interface (serial output) shows one thing while the hardware does another. In real-world systems, this mimics attacks on SCADA/ICS systems where operator displays show "normal" readings while the physical process is manipulated (similar to Stuxnet, which showed normal centrifuge speeds while actually damaging them). In medical devices, this could display a safe dosage while delivering a different amount. The lesson is that **you cannot trust the display if the firmware has been tampered with** — the display text and the actual behavior are patched independently. - -2. **Instead of swapping the data values, could you achieve the same result by swapping the branch targets (making case '1' jump to case '2' code and vice versa)? What are the trade-offs?** - Yes, you could swap the `beq` target addresses so that when the user presses '1', execution jumps to the case '2' code path and vice versa. **Trade-offs:** Swapping branch targets changes the instructions (modifying the offset bytes in `beq`), which is more complex — you need to correctly calculate the new PC-relative offsets. Swapping data values is simpler (just exchange 4-byte float values) and less error-prone. However, swapping branches would also swap the printf messages, so "Moving to 180" would display for the path that actually moves to 180 — keeping the display consistent. The data-swap approach intentionally creates a mismatch between display and behavior. - -3. **If the compiler shares a single literal pool entry for 0x43340000 (180.0f) across both cases, how does swapping that one entry affect the behavior?** - If the compiler optimized by sharing a single `0x43340000` literal pool entry for all references to 180.0f, then both case '1' and case '2' load from the same address. Changing that one entry to `0x00000000` (0.0f) would affect **both** cases simultaneously — they would both use 0.0f where they originally used 180.0f. Similarly, if there's only one `0x00000000` entry shared, changing it affects both cases. You would need to verify whether each case uses its own pool entry or shares entries by examining the `ldr` offsets. If shared, you may need to find unused space to create a second copy of the value. - -4. **How would you verify the patch is correct without physical hardware? What GDB commands would you use?** - Set breakpoints before each `bl servo_set_angle` call, then examine `r0` (or `s0`) which holds the angle argument. Run through both cases and verify: (1) `b *` → `c` → press '1' → `info float` or `p $s0` — should show 180.0f (was 0.0f). (2) Continue to second call — should show 0.0f (was 180.0f). Repeat for case '2'. You can also examine the literal pool directly: `x/wx ` to verify the bytes were swapped. Additionally, `x/f ` displays the value as a float for quick verification. diff --git a/WEEK10/WEEK10-03.md b/WEEK10/WEEK10-03.md deleted file mode 100644 index a6479a0..0000000 --- a/WEEK10/WEEK10-03.md +++ /dev/null @@ -1,141 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics - -### Non-Credit Practice Exercise 3: Reverse the Servo Direction - -#### Objective -Find the branch targets for case '1' and case '2' in the `0x0020_dynamic-conditionals` binary using GDB, identify where each case loads its angle values from the literal pool, and swap the angle pairs so that pressing '1' now does what '2' originally did (180°→0°) and pressing '2' does what '1' originally did (0°→180°). - -#### Prerequisites -- Completed Week 10 tutorial (GDB and hex editor sections) -- `0x0020_dynamic-conditionals.elf` and `0x0020_dynamic-conditionals.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with SG90 servo motor connected on GPIO 6 - -#### Task Description -Currently, case '1' calls `servo_set_angle(0.0f)` then `servo_set_angle(180.0f)`, while case '2' calls `servo_set_angle(180.0f)` then `servo_set_angle(0.0f)`. To reverse the servo direction, you will swap the literal pool angle values between the two cases. This means patching case '1' to load 180.0f first and 0.0f second, and case '2' to load 0.0f first and 180.0f second. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0020_dynamic-conditionals.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Map Both Case Branch Targets - -Disassemble main and trace both paths: - -```gdb -(gdb) disassemble 0x10000234,+250 -``` - -Identify: -- Case '1' branch target → first `ldr r0` (loads 0.0f), `bl servo_set_angle`, second `ldr r0` (loads 180.0f), `bl servo_set_angle` -- Case '2' branch target → first `ldr r0` (loads 180.0f), `bl servo_set_angle`, second `ldr r0` (loads 0.0f), `bl servo_set_angle` - -##### Step 3: Find All Four Literal Pool Entries - -Examine the literal pool entries for each angle load: - -```gdb -(gdb) x/wx -(gdb) x/wx -(gdb) x/wx -(gdb) x/wx -``` - -Record which addresses contain `0x00000000` (0.0f) and which contain `0x43340000` (180.0f). - -##### Step 4: Calculate All File Offsets - -``` -file_offset = literal_pool_address - 0x10000000 -``` - -You need four offsets — two for case '1' angles and two for case '2' angles. - -##### Step 5: Plan the Swap - -| Location | Original | New | -| -------------- | ---------------- | ---------------- | -| Case 1 Angle 1 | `00 00 00 00` (0.0f) | `00 00 34 43` (180.0f) | -| Case 1 Angle 2 | `00 00 34 43` (180.0f) | `00 00 00 00` (0.0f) | -| Case 2 Angle 1 | `00 00 34 43` (180.0f) | `00 00 00 00` (0.0f) | -| Case 2 Angle 2 | `00 00 00 00` (0.0f) | `00 00 34 43` (180.0f) | - -###### Question 1: Could the compiler share a single literal pool entry for all references to `0x43340000`? How would that affect your patching plan? - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals\build\0x0020_dynamic-conditionals.bin` -2. For each of the four literal pool entries, navigate to its file offset and swap the values as planned -3. Be methodical — patch one at a time and verify each before moving to the next - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0020_dynamic-conditionals-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals -python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press '1' → servo sweeps from **180° to 0°** (was 0° to 180°) -- Press '2' → servo sweeps from **0° to 180°** (was 180° to 0°) -- The text output still says "one" and "two" — only the physical behavior changed - -#### Expected Output - -After completing this exercise, you should be able to: -- Trace multiple branch paths to their literal pool references -- Understand how data (angles) and code (branches) are separate concerns -- Swap data values to reverse physical behavior while keeping code structure intact -- Recognize shared vs. separate literal pool entries - -#### Questions for Reflection - -###### Question 1: The terminal still prints "one" and "two" with the original meanings, but the servo does the opposite. Why is this a security concern in real embedded systems? - -###### Question 2: Instead of swapping literal pool values, could you swap the branch targets themselves? What are the pros and cons of each approach? - -###### Question 3: If the literal pool entries are shared between cases (one `0x43340000` word referenced by both), how would your patch strategy change? - -###### Question 4: What tool could you use to confirm the swapped behavior without physical hardware — just by reading the patched disassembly? - -#### Tips and Hints -- Use `x/4wx ` to dump the entire literal pool at once and see all angle values together -- If the compiler shares a single literal pool entry for 180.0f across both cases, swapping it would affect both — you may need to create a duplicate entry -- The simplest approach: if each case has its own literal pool entries, just swap the 4-byte values at each offset -- Verify by disassembling the patched binary in GDB to confirm the `ldr` instructions now reference the swapped values diff --git a/WEEK10/WEEK10-04-S.md b/WEEK10/WEEK10-04-S.md deleted file mode 100644 index fac3964..0000000 --- a/WEEK10/WEEK10-04-S.md +++ /dev/null @@ -1,56 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Dynamic Conditionals in Embedded Systems: Debugging and Hacking Dynamic Conditionals w/ SG90 Servo Basics - -### Non-Credit Practice Exercise 4 Solution: Speed Profile - -#### Answers - -##### Sleep Duration Values - -| Parameter | Original | Case 1 (Fast Snap) | Case 2 (Slow Sweep) | -|-------------|---------|--------------------|--------------------| -| Duration | 500 ms | 100 ms | 1000 ms | -| Hex | 0x1F4 | 0x64 | 0x3E8 | -| LE Bytes | F4 01 00 00 | 64 00 00 00 | E8 03 00 00 | - -##### Patch Case 1: 500ms → 100ms (Fast Snap) - -``` -Before: F4 01 00 00 (500ms) -After: 64 00 00 00 (100ms) -``` - -##### Patch Case 2: 500ms → 1000ms (Slow Sweep) - -``` -Before: F4 01 00 00 (500ms) -After: E8 03 00 00 (1000ms) -``` - -##### Literal Pool Considerations - -If the compiler shares a single literal pool entry for `0x000001F4` across both cases, you **cannot** patch them independently without additional work. Verify by checking whether case 1 and case 2 `ldr` instructions reference the same pool address. If shared, you need to find unused space in the binary for a second value or repurpose another unused literal pool entry. - -##### Behavior After Patch - -| Key | Original | Patched | -|-----|-------------------|----------------------------------| -| '1' | 500ms between moves | 100ms — near-instantaneous snap | -| '2' | 500ms between moves | 1000ms — slow, deliberate sweep | - -#### Reflection Answers - -1. **Why does 100ms feel like an instant "snap" while 1000ms feels like a smooth sweep? The servo moves the same distance either way.** - Human perception of motion depends on the **pause between position updates**, not the motor speed. At 100ms delay, the servo reaches each angle before the next one is set — the positions update so quickly that the motion appears continuous and instant. At 1000ms delay, there's a full second between movements, so you can see the servo pause at each intermediate angle. The SG90 servo physically takes about 200–300ms to traverse its full range at no load, so 100ms is faster than the travel time (the servo is still moving when the next command arrives), creating a snappy feel. At 1000ms, the servo has already completed its move and waits idle before the next command. - -2. **If both cases share the same literal pool entry for 500ms, what strategy would you use to give them different sleep values?** - Several approaches: (1) **Find unused literal pool space** — look for entries that are no longer referenced and overwrite one with `0x64` (100ms) while keeping the other for `0x3E8` (1000ms). (2) **Repurpose an existing value** — if another constant in the pool happens to equal your desired value, redirect the `ldr` offset to point there. (3) **Change the `ldr` to a `movs`** — for values ≤ 255 (like 100), replace the 4-byte `ldr r0, [pc, #offset]` with `movs r0, #0x64` (2 bytes) + `nop` (2 bytes) for padding. This works for case 1 (100 fits in 8 bits) but not case 2 (1000 exceeds 255). - -3. **What is the minimum sleep_ms value where the SG90 servo can actually complete a full 0°–180° sweep before the next command?** - The SG90 servo has a rated speed of approximately 0.12 seconds per 60° at 4.8V. For a full 180° sweep: 0.12 × (180/60) = 0.12 × 3 = **0.36 seconds (360ms)**. In practice, with load and signal processing overhead, **400–500ms** is a safe minimum for reliable full-range travel. Below this, the servo may not reach the target angle before the next position command arrives, resulting in incomplete movements or jittery behavior. The original 500ms value was chosen to reliably allow full travel. - -4. **What would happen if you set sleep_ms to 0 for both cases? How would the servo physically behave?** - With `sleep_ms(0)`, the loop runs at full CPU speed, sending angle commands as fast as the processor can execute. The servo would receive thousands of position updates per second, alternating between two angles. Physically, the servo would **vibrate or oscillate** — it never has time to reach either target angle before being told to go to the other one. The PWM signal would switch so rapidly that the servo's control circuit would see constantly changing targets, producing a buzzing sound and erratic oscillation near the midpoint. This could also overheat the servo motor due to constant direction changes. diff --git a/WEEK10/WEEK10-04.md b/WEEK10/WEEK10-04.md deleted file mode 100644 index 1642eae..0000000 --- a/WEEK10/WEEK10-04.md +++ /dev/null @@ -1,144 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics - -### Non-Credit Practice Exercise 4: Speed Profile - -#### Objective -Find both `sleep_ms(500)` calls in the `0x0020_dynamic-conditionals` binary using GDB, identify the literal pool values `0x1f4` (500) loaded into `r0` before each `bl sleep_ms`, calculate the file offsets, and patch case '1' to use `0x64` (100ms) for fast movement and case '2' to use `0x3e8` (1000ms) for slow movement, then verify on hardware that the two keys produce visibly different servo speeds. - -#### Prerequisites -- Completed Week 10 tutorial (GDB and hex editor sections) -- `0x0020_dynamic-conditionals.elf` and `0x0020_dynamic-conditionals.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with SG90 servo motor connected on GPIO 6 - -#### Task Description -Both case '1' and case '2' call `sleep_ms(500)` between their two `servo_set_angle` calls. The value `500` (`0x1F4`) is loaded from the literal pool into `r0` before each `bl sleep_ms`. You will find both `sleep_ms` literal pool entries — one in case '1' and one in case '2' — and patch them to different values: `100` (`0x64`) for fast snapping and `1000` (`0x3E8`) for slow sweeping, creating distinct speed profiles per key. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0020_dynamic-conditionals.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find Both sleep_ms Calls - -Disassemble main and locate the `sleep_ms` calls: - -```gdb -(gdb) disassemble 0x10000234,+250 -``` - -Look for the pattern repeated in both cases: - -``` -ldr r0, [pc, #offset] ; load delay value -bl sleep_ms -``` - -Each case has at least one `sleep_ms` call. Identify which belongs to case '1' and which to case '2' by tracing the branch targets. - -##### Step 3: Examine the Literal Pool Entries - -For each `sleep_ms` call, examine the referenced literal pool entry: - -```gdb -(gdb) x/wx -(gdb) x/wx -``` - -Both should show `0x000001f4` (500). - -##### Step 4: Calculate the File Offsets - -``` -file_offset = literal_pool_address - 0x10000000 -``` - -Note the file offsets for both 4-byte sleep values. - -##### Step 5: Encode the New Values - -| Case | Original | New | Speed | -| ------ | ----------------- | ----------------- | -------- | -| Case 1 | `F4 01 00 00` (500ms) | `64 00 00 00` (100ms) | Fast snap | -| Case 2 | `F4 01 00 00` (500ms) | `E8 03 00 00` (1000ms) | Slow sweep | - -###### Question 1: Each case calls `sleep_ms` twice (once between the first and second `servo_set_angle`). Do both share the same literal pool entry, or does each have its own? - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals\build\0x0020_dynamic-conditionals.bin` -2. Press **Ctrl+G** and go to the case '1' sleep value offset -3. Replace `F4 01 00 00` with `64 00 00 00` (100ms) -4. Press **Ctrl+G** and go to the case '2' sleep value offset -5. Replace `F4 01 00 00` with `E8 03 00 00` (1000ms) - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0020_dynamic-conditionals-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals -python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press '1' → servo snaps **fast** (100ms between angles) — almost instant jump -- Press '2' → servo moves **slow** (1000ms between angles) — takes a full second at each position -- The speed difference should be very obvious visually and audibly - -#### Expected Output - -After completing this exercise, you should be able to: -- Distinguish between multiple literal pool entries for the same value -- Trace which code path references which literal pool entry -- Patch timing constants independently per branch -- Understand how sleep duration affects perceived motor behavior - -#### Questions for Reflection - -###### Question 1: Why does 100ms make the servo appear to "snap" while 1000ms makes it appear to "sweep"? Is the servo actually moving faster, or is it about the pause between commands? - -###### Question 2: If the compiler uses a single shared literal pool entry for all `sleep_ms(500)` calls, what alternative patching strategy would you need to create different speeds per case? - -###### Question 3: What is the minimum `sleep_ms` value that would still allow the servo to physically reach its target angle before the next command? How would you determine this experimentally? - -###### Question 4: Could you set the sleep to `0` (`00 00 00 00`)? What would happen to the servo behavior? - -#### Tips and Hints -- `100` decimal = `0x64`, fits in one byte: `64 00 00 00` in little-endian -- `1000` decimal = `0x3E8`: `E8 03 00 00` in little-endian -- If both `sleep_ms` calls share one literal pool word, you cannot give them different values by patching data alone — you would need to patch one `ldr` instruction to point to a different pool entry or use a `movs` immediate -- The SG90 servo takes about 200-300ms to traverse its full range, so 100ms will cause it to not quite reach the endpoint before the next command fires diff --git a/WEEK10/WEEK10.md b/WEEK10/WEEK10.md index 3839bfc..b99456a 100644 --- a/WEEK10/WEEK10.md +++ b/WEEK10/WEEK10.md @@ -1,6 +1,6 @@ -# Week 10: Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics +?# Week 10: Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand the difference between static and dynamic conditionals in C @@ -15,7 +15,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 1: Understanding Conditionals in C +## Part 1: Understanding Conditionals in C ### What Are Conditionals? @@ -30,7 +30,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 2: Static Conditionals +## Part 2: Static Conditionals ### What Makes a Conditional "Static"? @@ -51,27 +51,27 @@ while (true) { ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Static Conditional Flow │ -│ │ -│ choice = 1 (set once, never changes) │ -│ │ │ -│ ▼ │ -│ ┌─────────────┐ │ -│ │ choice == 1 │────YES────► printf("1") │ -│ └─────────────┘ │ -│ │NO (never taken) │ -│ ▼ │ -│ ┌─────────────┐ │ -│ │ choice == 2 │────YES────► printf("2") (never reached) │ -│ └─────────────┘ │ -│ │NO │ -│ ▼ │ -│ printf("?") (never reached) │ -│ │ -│ The branching logic EXISTS but only ONE path ever executes! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Static Conditional Flow | +| | +| choice = 1 (set once, never changes) | +| | | +| ? | +| +-------------+ | +| | choice == 1 |----YES----? printf("1") | +| +-------------+ | +| |NO (never taken) | +| ? | +| +-------------+ | +| | choice == 2 |----YES----? printf("2") (never reached) | +| +-------------+ | +| |NO | +| ? | +| printf("?") (never reached) | +| | +| The branching logic EXISTS but only ONE path ever executes! | +| | ++-----------------------------------------------------------------+ ``` ### The if/else Statement @@ -116,7 +116,7 @@ switch (choice) { --- -## 📚 Part 3: Dynamic Conditionals +## Part 3: Dynamic Conditionals ### What Makes a Conditional "Dynamic"? @@ -139,31 +139,31 @@ while (true) { ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Dynamic Conditional Flow │ -│ │ -│ ┌────────────────┐ │ -│ │ choice=getchar │◄──── User types 'x' on keyboard │ -│ └────────────────┘ │ -│ │ │ -│ ▼ │ -│ ┌─────────────┐ │ -│ │ choice=='1' │────YES────► printf("1"), move servo │ -│ └─────────────┘ │ -│ │NO │ -│ ▼ │ -│ ┌─────────────┐ │ -│ │ choice=='2' │────YES────► printf("2"), move servo │ -│ └─────────────┘ │ -│ │NO │ -│ ▼ │ -│ printf("??") │ -│ │ │ -│ └──────────────────► Loop back to getchar() │ -│ │ -│ EACH iteration can take a DIFFERENT path! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Dynamic Conditional Flow | +| | +| +----------------+ | +| | choice=getchar |?---- User types 'x' on keyboard | +| +----------------+ | +| | | +| ? | +| +-------------+ | +| | choice=='1' |----YES----? printf("1"), move servo | +| +-------------+ | +| |NO | +| ? | +| +-------------+ | +| | choice=='2' |----YES----? printf("2"), move servo | +| +-------------+ | +| |NO | +| ? | +| printf("??") | +| | | +| +------------------? Loop back to getchar() | +| | +| EACH iteration can take a DIFFERENT path! | +| | ++-----------------------------------------------------------------+ ``` ### The getchar() Function @@ -180,25 +180,25 @@ uint8_t choice = getchar(); // Waits for user to type something --- -## 📚 Part 4: Understanding PWM (Pulse Width Modulation) +## Part 4: Understanding PWM (Pulse Width Modulation) ### What is PWM? **PWM** (Pulse Width Modulation) is a technique for controlling power by rapidly switching a signal on and off. The ratio of "on time" to "off time" determines the average power delivered. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ PWM Signal - 50% Duty Cycle │ -│ │ -│ HIGH ─┐ ┌─────┐ ┌─────┐ ┌─────┐ │ -│ │ │ │ │ │ │ │ │ -│ LOW └─────┘ └─────┘ └─────┘ └───── │ -│ ◄──T──► │ -│ ON OFF │ -│ │ -│ Duty Cycle = ON time / Total period = 50% │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| PWM Signal - 50% Duty Cycle | +| | +| HIGH -+ +-----+ +-----+ +-----+ | +| | | | | | | | | +| LOW +-----+ +-----+ +-----+ +----- | +| ?--T--? | +| ON OFF | +| | +| Duty Cycle = ON time / Total period = 50% | +| | ++-----------------------------------------------------------------+ ``` ### PWM for Servo Control @@ -206,96 +206,96 @@ uint8_t choice = getchar(); // Waits for user to type something Servo motors use PWM differently - they care about the **pulse width**, not the duty cycle percentage: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Servo PWM Signal (50 Hz = 20ms period) │ -│ │ -│ 0° Position (1ms pulse): │ -│ HIGH ─┐ │ -│ │ 1ms │ -│ LOW └────────────────────────────── (19ms) ────────── │ -│ ◄────────────── 20ms ─────────────────────────► │ -│ │ -│ 90° Position (1.5ms pulse): │ -│ HIGH ─────┐ │ -│ │ 1.5ms │ -│ LOW └─────────────────────────── (18.5ms) ─────── │ -│ │ -│ 180° Position (2ms pulse): │ -│ HIGH ─────────┐ │ -│ │ 2ms │ -│ LOW └───────────────────────── (18ms) ─────── │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Servo PWM Signal (50 Hz = 20ms period) | +| | +| 0? Position (1ms pulse): | +| HIGH -?? | +| | 1ms | +| LOW +------------------------------ (19ms) ---------- | +| ?-------------- 20ms -------------------------? | +| | +| 90? Position (1.5ms pulse): | +| HIGH -----+ | +| | 1.5ms | +| LOW +--------------------------- (18.5ms) ------- | +| | +| 180? Position (2ms pulse): | +| HIGH ---------+ | +| | 2ms | +| LOW +------------------------- (18ms) ------- | +| | ++-----------------------------------------------------------------+ ``` ### The Magic Numbers | Angle | Pulse Width | PWM Ticks (at 1MHz) | | ----- | ----------- | ------------------- | -| 0° | 1000 µs | 1000 | -| 90° | 1500 µs | 1500 | -| 180° | 2000 µs | 2000 | +| 0? | 1000 ?s | 1000 | +| 90? | 1500 ?s | 1500 | +| 180? | 2000 ?s | 2000 | --- -## 📚 Part 5: PWM Timing Calculations +## Part 5: PWM Timing Calculations ### From 150 MHz to 50 Hz The RP2350's system clock runs at **150 MHz** (150 million cycles per second). A servo needs a **50 Hz** signal (one pulse every 20 ms). How do we bridge this gap? ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Clock Division Chain │ -│ │ -│ System Clock: 150 MHz │ -│ │ │ -│ │ ÷ 150 (clock divider) │ -│ ▼ │ -│ PWM Tick Rate: 1 MHz (1 tick = 1 microsecond) │ -│ │ │ -│ │ Count to 20,000 (wrap value = 19,999) │ -│ ▼ │ -│ PWM Frequency: 50 Hz (20 ms period) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Clock Division Chain | +| | +| System Clock: 150 MHz | +| | | +| | ? 150 (clock divider) | +| ? | +| PWM Tick Rate: 1 MHz (1 tick = 1 microsecond) | +| | | +| | Count to 20,000 (wrap value = 19,999) | +| ? | +| PWM Frequency: 50 Hz (20 ms period) | +| | ++-----------------------------------------------------------------+ ``` ### The Math **Step 1: Clock Division** ``` -PWM Tick Rate = System Clock ÷ Divider -1,000,000 Hz = 150,000,000 Hz ÷ 150 +PWM Tick Rate = System Clock ? Divider +1,000,000 Hz = 150,000,000 Hz ? 150 ``` **Step 2: Frame Period** ``` -Period = (Wrap Value + 1) × Tick Duration -20 ms = 20,000 ticks × 1 µs/tick +Period = (Wrap Value + 1) * Tick Duration +20 ms = 20,000 ticks * 1 ?s/tick ``` **Step 3: Pulse Width to Ticks** ``` -Ticks = Pulse Width (µs) × 1 tick/µs -1500 ticks = 1500 µs × 1 +Ticks = Pulse Width (?s) * 1 tick/?s +1500 ticks = 1500 ?s * 1 ``` -### Worked Example: 90° Angle +### Worked Example: 90? Angle -Let's calculate what happens when we command 90°: +Let's calculate what happens when we command 90?: 1. **Angle to Pulse Width:** ``` - Pulse = MIN + (angle/180) × (MAX - MIN) - Pulse = 1000 + (90/180) × (2000 - 1000) - Pulse = 1000 + 0.5 × 1000 - Pulse = 1500 µs + Pulse = MIN + (angle/180) * (MAX - MIN) + Pulse = 1000 + (90/180) * (2000 - 1000) + Pulse = 1000 + 0.5 * 1000 + Pulse = 1500 ?s ``` 2. **Pulse to PWM Ticks:** ``` - Level = 1500 µs × 1 tick/µs = 1500 ticks + Level = 1500 ?s * 1 tick/?s = 1500 ticks ``` 3. **Hardware Timing:** @@ -305,35 +305,35 @@ Let's calculate what happens when we command 90°: --- -## 📚 Part 6: Understanding the SG90 Servo Motor +## Part 6: Understanding the SG90 Servo Motor ### What is the SG90? The **SG90** is a small, inexpensive hobby servo motor commonly used in robotics projects: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ SG90 Servo Motor │ -│ │ -│ ┌───────────────┐ │ -│ │ ┌─────┐ │ │ -│ │ │ ARM │ │ ◄── Rotates 0° to 180° │ -│ │ └──┬──┘ │ │ -│ │ │ │ │ -│ │ ┌────┴────┐ │ │ -│ │ │ MOTOR │ │ │ -│ │ │ GEAR │ │ │ -│ │ │ BOX │ │ │ -│ │ └─────────┘ │ │ -│ └───────┬───────┘ │ -│ │ │ -│ ┌───────┼───────┐ │ -│ │ │ │ │ -│ ORANGE RED BROWN │ -│ Signal VCC GND │ -│ (PWM) (5V) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| SG90 Servo Motor | +| | +| +---------------+ | +| | +-----+ | | +| | | ARM | | ?-- Rotates 0? to 180? | +| | +--+--+ | | +| | | | | +| | +----+----+ | | +| | | MOTOR | | | +| | | GEAR | | | +| | | BOX | | | +| | +---------+ | | +| +-------+-------+ | +| | | +| +-------+-------+ | +| | | | | +| ORANGE RED BROWN | +| Signal VCC GND | +| (PWM) (5V) | +| | ++-----------------------------------------------------------------+ ``` ### SG90 Specifications @@ -341,8 +341,8 @@ The **SG90** is a small, inexpensive hobby servo motor commonly used in robotics | Parameter | Value | | ----------------- | ------------------------- | | **Voltage** | 4.8V - 6V (typically 5V) | -| **Rotation** | 0° to 180° | -| **Pulse Width** | 1000µs - 2000µs | +| **Rotation** | 0? to 180? | +| **Pulse Width** | 1000 us - 2000 us | | **Frequency** | 50 Hz (20ms period) | | **Stall Current** | ~650mA (can spike to 1A+) | @@ -356,9 +356,9 @@ The **SG90** is a small, inexpensive hobby servo motor commonly used in robotics --- -## 📚 Part 7: Power Supply Safety +## Part 7: Power Supply Safety -### ⚠️ CRITICAL WARNING ⚠️ +### CRITICAL WARNING **NEVER power the servo directly from the Pico's 3.3V pin!** @@ -370,35 +370,35 @@ Servos can draw over 1000mA during movement spikes. The Pico's 3.3V regulator ca ### Correct Power Setup ``` -┌─────────────────────────────────────────────────────────────────┐ -│ CORRECT Power Wiring │ -│ │ -│ USB ────► VBUS (5V) ───┬──► Servo VCC (Red) │ -│ │ │ -│ └──► Capacitor (+) │ -│ │ │ -│ Pico GND ──────────────┬────┴──► Capacitor (-) │ -│ │ │ -│ └──────► Servo GND (Brown) │ -│ │ -│ Pico GPIO 6 ──────────────────► Servo Signal (Orange) │ -│ │ -│ IMPORTANT: Use a 1000µF 25V capacitor across the servo │ -│ power to absorb current spikes! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| CORRECT Power Wiring | +| | +| USB ----? VBUS (5V) ---+--? Servo VCC (Red) | +| | | +| +--? Capacitor (+) | +| | | +| Pico GND --------------+----+--? Capacitor (-) | +| | | +| +------? Servo GND (Brown) | +| | +| Pico GPIO 6 ------------------? Servo Signal (Orange) | +| | +| IMPORTANT: Use a 1000 uF 25V capacitor across the servo | +| power to absorb current spikes! | +| | ++-----------------------------------------------------------------+ ``` ### Why the Capacitor? -The **1000µF capacitor** acts as a tiny battery: +The **1000 uF capacitor** acts as a tiny battery: - Absorbs sudden current demands when servo moves - Prevents voltage drops that could reset the Pico - Smooths out electrical noise --- -## 📚 Part 8: Setting Up Your Environment +## Part 8: Setting Up Your Environment ### Prerequisites @@ -409,7 +409,7 @@ Before we start, make sure you have: 4. Python installed (for UF2 conversion) 5. A serial monitor (PuTTY, minicom, or screen) 6. An SG90 servo motor -7. A 1000µF 25V capacitor +7. A 1000 uF 25V capacitor 8. The sample projects: `0x001d_static-conditionals` and `0x0020_dynamic-conditionals` ### Hardware Setup @@ -423,52 +423,52 @@ Connect your servo like this: | Orange (Signal) | GPIO 6 | ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Servo Wiring with Capacitor │ -│ │ -│ Pico 2 SG90 Servo │ -│ ┌──────────┐ ┌──────────┐ │ -│ │ │ │ │ │ -│ │ GPIO 6 │─────── Orange ───────►│ Signal │ │ -│ │ │ │ │ │ -│ │ VBUS(5V) │───┬─── Red ──────────►│ VCC │ │ -│ │ │ │ │ │ │ -│ │ GND │───┼─── Brown ────────►│ GND │ │ -│ │ │ │ └──────────┘ │ -│ └──────────┘ │ │ -│ │ ┌─────────┐ │ -│ └────┤ + CAP - ├──── GND │ -│ │ 1000µF │ │ -│ │ 25V │ │ -│ └─────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Servo Wiring with Capacitor | +| | +| Pico 2 SG90 Servo | +| +----------+ +----------+ | +| | | | | | +| | GPIO 6 |------- Orange -------?| Signal | | +| | | | | | +| | VBUS(5V) |---+--- Red ----------?| VCC | | +| | | | | | | +| | GND |---+--- Brown --------?| GND | | +| | | | +----------+ | +| +----------+ | | +| | +---------+ | +| +----+ + CAP - +---- GND | +| | 1000 uF | | +| | 25V | | +| +---------+ | +| | ++-----------------------------------------------------------------+ ``` ### Project Structure ``` Embedded-Hacking/ -├── 0x001d_static-conditionals/ -│ ├── build/ -│ │ ├── 0x001d_static-conditionals.uf2 -│ │ └── 0x001d_static-conditionals.bin -│ ├── main/ -│ │ └── 0x001d_static-conditionals.c -│ └── servo.h -├── 0x0020_dynamic-conditionals/ -│ ├── build/ -│ │ ├── 0x0020_dynamic-conditionals.uf2 -│ │ └── 0x0020_dynamic-conditionals.bin -│ ├── main/ -│ │ └── 0x0020_dynamic-conditionals.c -│ └── servo.h -└── uf2conv.py ++-- 0x001d_static-conditionals/ +| +-- build/ +| | +-- 0x001d_static-conditionals.uf2 +| | +-- 0x001d_static-conditionals.bin +| +-- main/ +| | +-- 0x001d_static-conditionals.c +| +-- servo.h ++-- 0x0020_dynamic-conditionals/ +| +-- build/ +| | +-- 0x0020_dynamic-conditionals.uf2 +| | +-- 0x0020_dynamic-conditionals.bin +| +-- main/ +| | +-- 0x0020_dynamic-conditionals.c +| +-- servo.h ++-- uf2conv.py ``` --- -## 🔬 Part 9: Hands-On Tutorial - Static Conditionals Code +## ? Part 9: Hands-On Tutorial - Static Conditionals Code ### Step 1: Review the Source Code @@ -526,23 +526,23 @@ int main(void) { Since `choice = 1` and NEVER changes: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Static Conditional Execution │ -│ │ -│ Every loop iteration: │ -│ │ -│ 1. Check if (choice == 1) → TRUE → print "1" │ -│ 2. Check switch case 1 → MATCH → print "one" │ -│ 3. Move servo to 0° │ -│ 4. Wait 500ms │ -│ 5. Move servo to 180° │ -│ 6. Wait 500ms │ -│ 7. Repeat forever... │ -│ │ -│ Output always: "1" then "one" (forever) │ -│ Servo: sweeps 0° → 180° → 0° → 180° (forever) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Static Conditional Execution | +| | +| Every loop iteration: | +| | +| 1. Check if (choice == 1) -> TRUE -> print "1" | +| 2. Check switch case 1 -> MATCH -> print "one" | +| 3. Move servo to 0? | +| 4. Wait 500ms | +| 5. Move servo to 180? | +| 6. Wait 500ms | +| 7. Repeat forever... | +| | +| Output always: "1" then "one" (forever) | +| Servo: sweeps 0? -> 180? -> 0? -> 180? (forever) | +| | ++-----------------------------------------------------------------+ ``` ### Step 3: Flash the Binary to Your Pico 2 @@ -567,12 +567,12 @@ one ``` **Watch the servo:** -- It should sweep from 0° to 180° every second +- It should sweep from 0? to 180? every second - The movement is continuous and repetitive --- -## 🔬 Part 10: Debugging with GDB (Static Conditionals) +## ? Part 10: Debugging with GDB (Static Conditionals) ### Step 5: Start OpenOCD (Terminal 1) @@ -580,7 +580,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -704,7 +704,7 @@ quit --- -## 🔬 Part 11: Setting Up Ghidra for Static Conditionals +## ? Part 11: Setting Up Ghidra for Static Conditionals ### Step 17: Start Ghidra @@ -716,7 +716,7 @@ ghidraRun ### Step 18: Create a New Project -1. Click **File** → **New Project** +1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** 4. Enter Project Name: `0x001d_static-conditionals` @@ -730,12 +730,12 @@ ghidraRun ### Step 20: Configure the Binary Format -**Click the three dots (…) next to "Language" and:** +**Click the three dots (...) next to "Language" and:** 1. Search for "Cortex" 2. Select **ARM Cortex 32 little endian default** 3. Click **OK** -**Click the "Options…" button and:** +**Click the "Options..." button and:** 1. Change **Block Name** to `.text` 2. Change **Base Address** to `10000000` 3. Click **OK** @@ -750,12 +750,12 @@ Wait for analysis to complete. --- -## 🔬 Part 12: Resolving Functions in Ghidra (Static) +## ? Part 12: Resolving Functions in Ghidra (Static) ### Step 22: Navigate to Main 1. Press `G` (Go to address) and type `10000234` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `int main(void)` 4. Click **OK** @@ -764,7 +764,7 @@ Wait for analysis to complete. At address `0x10000236`: 1. Double-click on the called function -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `bool stdio_init_all(void)` 4. Click **OK** @@ -777,7 +777,7 @@ movs r0, #0x6 ; GPIO pin 6 bl FUN_xxxxx ; servo_init ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void servo_init(uint pin)` 3. Click **OK** @@ -796,7 +796,7 @@ bl FUN_xxxxx ; puts - The hex `0x0d` is carriage return "\r" - We see "1" echoed in PuTTY -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `int puts(char *s)` 3. Click **OK** @@ -808,7 +808,7 @@ Look for a function that loads float constants. Inside the function, you'll find These are the servo pulse limits! -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void servo_set_angle(float degrees)` 3. Click **OK** @@ -821,17 +821,17 @@ ldr r0, =0x1f4 ; 500 milliseconds bl FUN_xxxxx ; sleep_ms ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void sleep_ms(uint ms)` 3. Click **OK** --- -## 🔬 Part 13: Hacking Static Conditionals +## ? Part 13: Hacking Static Conditionals ### Step 28: Open the Bytes Editor -1. Click **Window** → **Bytes** +1. Click **Window** -> **Bytes** 2. A new panel appears showing raw hex bytes 3. Click the pencil icon to enable editing @@ -874,7 +874,7 @@ Find the sleep_ms delay value: ### Step 32: Export and Flash -1. Click **File** → **Export Program** +1. Click **File** -> **Export Program** 2. Set **Format** to **Binary** 3. Name: `0x001d_static-conditionals-h.bin` 4. Click **OK** @@ -882,7 +882,7 @@ Find the sleep_ms delay value: Convert and flash: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001d_static-conditionals +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x001d_static-conditionals python ..\uf2conv.py build\0x001d_static-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 ``` @@ -901,7 +901,7 @@ fun --- -## 🔬 Part 14: Dynamic Conditionals - The Source Code +## ? Part 14: Dynamic Conditionals - The Source Code ### Step 34: Review the Dynamic Code @@ -958,8 +958,8 @@ int main(void) { | User Types | Output | Servo Action | | ------------- | ----------- | ------------ | -| '1' (0x31) | "1" + "one" | 0° → 180° | -| '2' (0x32) | "2" + "two" | 180° → 0° | +| '1' (0x31) | "1" + "one" | 0? -> 180? | +| '2' (0x32) | "2" + "two" | 180? -> 0? | | Anything else | "??" + "??" | No movement | ### Step 36: Flash and Test @@ -972,7 +972,7 @@ int main(void) { --- -## 🔬 Part 15: Debugging with GDB (Dynamic Conditionals) +## ? Part 15: Debugging with GDB (Dynamic Conditionals) ### Step 37: Start OpenOCD (Terminal 1) @@ -980,7 +980,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -1103,7 +1103,7 @@ quit --- -## 🔬 Part 16: Setting Up Ghidra for Dynamic Conditionals +## ? Part 16: Setting Up Ghidra for Dynamic Conditionals ### Step 49: Create New Project @@ -1120,12 +1120,12 @@ Press `G` and go to `10000234`. Follow the same process: -1. **main** at `0x10000234` → `int main(void)` -2. **stdio_init_all** → `bool stdio_init_all(void)` -3. **servo_init** → `void servo_init(uint pin)` -4. **puts** → `int puts(char *s)` -5. **servo_set_angle** → `void servo_set_angle(float degrees)` -6. **sleep_ms** → `void sleep_ms(uint ms)` +1. **main** at `0x10000234` -> `int main(void)` +2. **stdio_init_all** -> `bool stdio_init_all(void)` +3. **servo_init** -> `void servo_init(uint pin)` +4. **puts** -> `int puts(char *s)` +5. **servo_set_angle** -> `void servo_set_angle(float degrees)` +6. **sleep_ms** -> `void sleep_ms(uint ms)` ### Step 52: Identify getchar @@ -1140,7 +1140,7 @@ cmp r4, #0x31 ; Compare to '1' beq LAB_xxxxx ; Branch if equal ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `int getchar(void)` 3. Click **OK** @@ -1159,7 +1159,7 @@ This confirms it's a UART initialization function! --- -## 🔬 Part 17: Understanding Branch Instructions +## ? Part 17: Understanding Branch Instructions ### ARM Branch Instructions @@ -1189,25 +1189,25 @@ skip_printf: ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Conditional Branch Flow │ -│ │ -│ cmp r4, #0x31 │ -│ │ │ -│ │ (Sets flags based on r4 - 0x31) │ -│ ▼ │ -│ beq target_address │ -│ │ │ -│ ├── If r4 == 0x31: Jump to target_address │ -│ │ │ -│ └── If r4 != 0x31: Continue to next instruction │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Conditional Branch Flow | +| | +| cmp r4, #0x31 | +| | | +| | (Sets flags based on r4 - 0x31) | +| ? | +| beq target_address | +| | | +| +-- If r4 == 0x31: Jump to target_address | +| | | +| +-- If r4 != 0x31: Continue to next instruction | +| | ++-----------------------------------------------------------------+ ``` --- -## 🔬 Part 18: Advanced Hacking - Creating Stealth Commands +## ? Part 18: Advanced Hacking - Creating Stealth Commands ### The Goal @@ -1219,14 +1219,14 @@ We want to create **secret commands** that: ### Step 54: Plan the Patches **Original behavior:** -- '1' (0x31) → prints "1" and "one", moves servo -- '2' (0x32) → prints "2" and "two", moves servo +- '1' (0x31) -> prints "1" and "one", moves servo +- '2' (0x32) -> prints "2" and "two", moves servo **Hacked behavior:** -- 'x' (0x78) → moves servo SILENTLY -- 'y' (0x79) → moves servo SILENTLY -- '1' (0x31) → prints "1" and "one" (normal) -- '2' (0x32) → prints "2" and "two" (normal) +- 'x' (0x78) -> moves servo SILENTLY +- 'y' (0x79) -> moves servo SILENTLY +- '1' (0x31) -> prints "1" and "one" (normal) +- '2' (0x32) -> prints "2" and "two" (normal) ### Step 55: Change Comparison Values @@ -1244,12 +1244,12 @@ For the stealth keys, we need to jump PAST the printf calls directly to the serv **Original flow:** ``` -compare → branch → printf("1") → printf("one") → servo code +compare -> branch -> printf("1") -> printf("one") -> servo code ``` **Hacked flow:** ``` -compare 'x' → branch → [skip prints] → servo code +compare 'x' -> branch -> [skip prints] -> servo code ``` Change the `beq` target addresses: @@ -1279,14 +1279,14 @@ Here's the complete patch list: ### Step 59: Hack the Angle Value -Let's also change 180° to 30° for fun! +Let's also change 180? to 30? for fun! **Original:** `0x43340000` (180.0f in IEEE-754) **New:** `0x41f00000` (30.0f in IEEE-754) **Calculation for 30.0f:** ``` -30.0 = 1.875 × 2^4 +30.0 = 1.875 * 2^4 Sign = 0 Exponent = 127 + 4 = 131 = 0x83 Mantissa = 0.875 = 0x700000 @@ -1302,19 +1302,19 @@ Little-endian: 00 00 f0 41 2. Convert to UF2: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0020_dynamic-conditionals python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 ``` 3. Flash and test: - - Press '1' → prints "1" and "one", servo moves - - Press '2' → prints "2" and "two", servo moves - - Press 'x' → NO OUTPUT, but servo moves silently! - - Press 'y' → NO OUTPUT, but servo moves silently! + - Press '1' -> prints "1" and "one", servo moves + - Press '2' -> prints "2" and "two", servo moves + - Press 'x' -> NO OUTPUT, but servo moves silently! + - Press 'y' -> NO OUTPUT, but servo moves silently! --- -## 📊 Part 19: Summary and Review +## ? Part 19: Summary and Review ### What We Accomplished @@ -1331,38 +1331,38 @@ python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 - ### Static vs Dynamic Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Static Conditionals │ -│ ─────────────────── │ -│ • Variable set once, never changes │ -│ • Same path taken every iteration │ -│ • Compiler may optimize out dead branches │ -│ • Example: int choice = 1; if (choice == 1) │ -├─────────────────────────────────────────────────────────────────┤ -│ Dynamic Conditionals │ -│ ──────────────────── │ -│ • Variable changes based on input/sensors │ -│ • Different paths taken based on runtime state │ -│ • All branches must remain in binary │ -│ • Example: choice = getchar(); if (choice == '1') │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Static Conditionals | +| ------------------- | +| - Variable set once, never changes | +| - Same path taken every iteration | +| - Compiler may optimize out dead branches | +| - Example: int choice = 1; if (choice == 1) | ++-----------------------------------------------------------------+ +| Dynamic Conditionals | +| -------------------- | +| - Variable changes based on input/sensors | +| - Different paths taken based on runtime state | +| - All branches must remain in binary | +| - Example: choice = getchar(); if (choice == '1') | ++-----------------------------------------------------------------+ ``` ### PWM Calculation Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Servo PWM Calculation Chain │ -│ │ -│ Angle (degrees) → Pulse Width (µs) → PWM Ticks → Servo Motion │ -│ │ -│ 0° → 1000 µs → 1000 ticks → Fully counter-clockwise │ -│ 90° → 1500 µs → 1500 ticks → Center position │ -│ 180° → 2000 µs → 2000 ticks → Fully clockwise │ -│ │ -│ Formula: pulse = 1000 + (angle/180) × 1000 │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Servo PWM Calculation Chain | +| | +| Angle (degrees) -> Pulse Width (?s) -> PWM Ticks -> Servo Motion | +| | +| 0? -> 1000 ?s -> 1000 ticks -> Fully counter-clockwise | +| 90? -> 1500 ?s -> 1500 ticks -> Center position | +| 180? -> 2000 ?s -> 2000 ticks -> Fully clockwise | +| | +| Formula: pulse = 1000 + (angle/180) * 1000 | +| | ++-----------------------------------------------------------------+ ``` ### Key Memory Addresses @@ -1378,36 +1378,9 @@ python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 - --- -## ✅ Practice Exercises - -### Exercise 1: Change Servo Angle Range -Modify the servo to sweep from 45° to 135° instead of 0° to 180°. - -**Hint:** Calculate IEEE-754 values for 45.0f and 135.0f. - -### Exercise 2: Add a Third Command -Add support for key '3' that moves the servo to 90° (center position). - -**Hint:** You'll need to find space in the binary or modify existing code. - -### Exercise 3: Reverse the Servo Direction -Make '1' do what '2' does and vice versa. - -**Hint:** Swap the branch targets. - -### Exercise 4: Speed Profile -Create fast movement for '1' (100ms) and slow movement for '2' (1000ms). - -**Hint:** Find both sleep_ms calls and patch them differently. - -### Exercise 5: Complete Stealth Mode -Make ALL servo movements silent - remove ALL printf and puts calls. - -**Hint:** NOP out every output function call. - --- -## 🎓 Key Takeaways +## ? Key Takeaways 1. **Static conditionals have fixed outcomes** - The same path always executes @@ -1415,7 +1388,7 @@ Make ALL servo movements silent - remove ALL printf and puts calls. 3. **PWM frequency = 50Hz for servos** - One pulse every 20ms -4. **Pulse width encodes position** - 1ms=0°, 1.5ms=90°, 2ms=180° +4. **Pulse width encodes position** - 1ms=0?, 1.5ms=90?, 2ms=180? 5. **beq = branch if equal** - Jumps when comparison matches @@ -1431,7 +1404,7 @@ Make ALL servo movements silent - remove ALL printf and puts calls. --- -## 📖 Glossary +## ? Glossary | Term | Definition | | ----------------------- | --------------------------------------------------- | @@ -1449,7 +1422,7 @@ Make ALL servo movements silent - remove ALL printf and puts calls. --- -## 🔗 Additional Resources +## ? Additional Resources ### ASCII Reference Table @@ -1491,7 +1464,7 @@ Make ALL servo movements silent - remove ALL printf and puts calls. --- -## 🚨 Real-World Implications +## ? Real-World Implications ### Why Stealth Commands Matter @@ -1526,4 +1499,6 @@ A fast-moving servo is like a nuclear fuel rod: **Remember:** The techniques you learned today demonstrate how conditional logic can be manipulated at the binary level. Understanding these attacks helps us build more secure embedded systems. Always use your skills ethically and responsibly! -Happy hacking! 🔧 +Happy hacking! ? + + diff --git a/WEEK11/WEEK11-01-S.md b/WEEK11/WEEK11-01-S.md deleted file mode 100644 index a4e934b..0000000 --- a/WEEK11/WEEK11-01-S.md +++ /dev/null @@ -1,66 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Functions in Embedded Systems: Debugging and Hacking Functions w/ IR Remote and Multi-LED Control - -### Non-Credit Practice Exercise 1 Solution: Add a Fourth LED - -#### Answers - -##### Struct Layout (simple_led_ctrl_t) - -| Offset | Field | Size | Original Value | Hex | -|--------|------------|--------|----------------|------| -| 0 | led1_pin | 1 byte | GPIO 16 | 0x10 | -| 1 | led2_pin | 1 byte | GPIO 17 | 0x11 | -| 2 | led3_pin | 1 byte | GPIO 18 | 0x12 | -| 3 | led1_state | 1 byte | false (0) | 0x00 | -| 4 | led2_state | 1 byte | false (0) | 0x00 | -| 5 | led3_state | 1 byte | false (0) | 0x00 | - -Total struct size: **6 bytes** (3 pin bytes + 3 state bytes). - -##### Assembly Initialization Pattern - -```asm -movs r0, #0x10 ; led1_pin = 16 -strb r0, [r4, #0] ; struct offset 0 -movs r0, #0x11 ; led2_pin = 17 -strb r0, [r4, #1] ; struct offset 1 -movs r0, #0x12 ; led3_pin = 18 -strb r0, [r4, #2] ; struct offset 2 -``` - -##### Patch: Add GPIO 19 at Struct Offset 3 - -Writing `0x13` to offset 3 **overwrites led1_state**: - -| Offset | Before | After | Impact | -|--------|-------------|-------------|----------------------| -| 3 | 0x00 (led1_state = false) | 0x13 (led4_pin = GPIO 19) | led1_state corrupted | - -##### GDB Verification - -```gdb -(gdb) b *0x10000280 -(gdb) c -(gdb) x/8bx -``` - -Before patch: `10 11 12 00 00 00` -After patch: `10 11 12 13 00 00` - -#### Reflection Answers - -1. **The original struct has 6 members (3 pins + 3 states) in 6 bytes. If you add a fourth pin at offset 3, you overwrite led1_state. What is the practical impact on LED 1 behavior?** - The byte `0x13` (decimal 19) is written to offset 3, which the program reads as `led1_state`. Since `bool` in C treats any non-zero value as `true`, `led1_state` would be interpreted as `true` (on) immediately after the struct is initialized. LED 1 would appear to be in the "on" state from the start, regardless of whether the user pressed button 1. The `leds_all_off` function may reset it to 0, but every time the struct is re-initialized on the stack (each loop iteration), the corrupted state returns. The fourth LED at GPIO 19 would need additional `gpio_init` and `gpio_set_dir` calls to actually function — just writing the pin number into the struct doesn't configure the GPIO hardware. - -2. **How would you verify the exact struct layout and offsets using GDB's memory examination commands?** - Set a breakpoint after struct initialization (`b *0x10000280`), then `x/6bx ` to see all 6 bytes. Verify: offsets 0–2 should show `10 11 12` (pin values), offsets 3–5 should show `00 00 00` (state values). Use `x/1bx ` for individual fields. To find the struct base, examine `r4` at the breakpoint since the `strb r0, [r4, #N]` instructions use r4 as the base. You can also use `p/x $r4` to get the base address, then `x/6bx $r4` for the complete layout. - -3. **If the get_led_pin function uses a bounds check (e.g., if led_num > 3 return 0), what additional patch would you need?** - You would need to find the comparison instruction in `get_led_pin` (at approximately `0x100002a0`) — likely a `cmp rN, #3` followed by a conditional branch. Patch the immediate from `#3` to `#4` so the bounds check allows led_num = 4. For example, if the check is `cmp r1, #3; bhi default`, change `03` to `04` in the `cmp` instruction's immediate byte. Without this patch, passing led_num=4 would fail the bounds check and return 0 (no pin), so the fourth LED would never be addressed. - -4. **Could you extend the struct without overwriting existing fields by finding free space elsewhere in the binary? What challenges would that introduce?** - You could find unused space (padding, NOP sleds, or unused data) and place the extended struct there. However, this introduces major challenges: (1) Every instruction that references the original struct address via `r4` would need to be redirected to the new location. (2) All `strb`/`ldrb` offsets would need updating. (3) Stack-allocated structs are recreated each loop iteration — you'd need to change the stack frame size (`sub sp, sp, #N`). (4) Functions that receive the struct pointer as an argument would need their call sites updated. In practice, relocating a struct in a compiled binary is extremely complex and error-prone — overwriting adjacent fields is the pragmatic (if destructive) approach. diff --git a/WEEK11/WEEK11-01.md b/WEEK11/WEEK11-01.md deleted file mode 100644 index 6dcdb83..0000000 --- a/WEEK11/WEEK11-01.md +++ /dev/null @@ -1,156 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics - -### Non-Credit Practice Exercise 1: Add a Fourth LED - -#### Objective -Find the struct initialization pattern in the `0x0026_functions` binary using GDB where `led1_pin` (0x10), `led2_pin` (0x11), and `led3_pin` (0x12) are stored, locate an unused byte in the struct memory region, and patch it to include a fourth LED on GPIO 19 (0x13) by extending the struct data and modifying the `ir_to_led_number` function to handle a fourth button mapping. - -#### Prerequisites -- Completed Week 11 tutorial (GDB and hex editor sections) -- `0x0026_functions.elf` and `0x0026_functions.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with IR remote and LEDs on GPIO 16, 17, 18 (and GPIO 19 wired for the new LED) - -#### Task Description -The `simple_led_ctrl_t` struct stores three LED pin numbers: `led1_pin` (16/0x10), `led2_pin` (17/0x11), `led3_pin` (18/0x12). These are stored as consecutive bytes in the struct initialization. You will find where the struct is initialized in the binary, locate the `movs` instructions that set the pin values, and add `led4_pin` = 19 (0x13) by patching a nearby unused or default byte. You will also need to find where `ir_to_led_number` returns values 1, 2, or 3 and adjust the NEC command comparison to map a fourth button to LED 4. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0026_functions.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the Struct Initialization - -Disassemble main and look for the struct pin assignments: - -```gdb -(gdb) disassemble 0x10000234,+300 -``` - -Look for consecutive `movs` instructions: - -``` -movs r0, #0x10 ; led1_pin = 16 -strb r0, [r4, #0] ; store to struct offset 0 -movs r0, #0x11 ; led2_pin = 17 -strb r0, [r4, #1] ; store to struct offset 1 -movs r0, #0x12 ; led3_pin = 18 -strb r0, [r4, #2] ; store to struct offset 2 -``` - -##### Step 3: Examine the Struct in Memory - -Set a breakpoint after initialization and examine the struct: - -```gdb -(gdb) break *0x10000280 -(gdb) monitor reset halt -(gdb) continue -(gdb) x/8bx -``` - -You should see: `10 11 12 00 00 00` — the three pin values followed by the state booleans (all false/0x00). - -##### Step 4: Find the `get_led_pin` Function - -Look for the function that reads from the struct based on LED number: - -```gdb -(gdb) disassemble 0x100002a0,+50 -``` - -This function takes a struct pointer and LED number and returns the GPIO pin by reading from a struct offset. - -##### Step 5: Calculate File Offsets - -``` -file_offset = address - 0x10000000 -``` - -Note offsets for: -1. The `movs r0, #0x12` instruction (last pin assignment) -2. The byte after `led3_pin` in the struct (where `led4_pin` would go) - -##### Step 6: Plan the Patches - -| Patch Target | Original | New | Purpose | -| --------------------- | -------- | ------ | ------------------------- | -| Struct byte after 0x12 | `00` | `13` | Add led4_pin = GPIO 19 | - -###### Question 1: The struct layout has `led3_pin` at offset 2 and `led1_state` at offset 3. If you write `0x13` to offset 3, what happens to `led1_state`? - -##### Step 7: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions\build\0x0026_functions.bin` -2. Navigate to the struct initialization area -3. Apply the patches identified in Step 6 - -##### Step 8: Save and Convert - -1. Click **File** → **Save As** → `0x0026_functions-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions -python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 9: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Existing buttons 1, 2, 3 should still control their LEDs -- Verify with GDB that the struct now contains `10 11 12 13` at the pin offsets - -#### Expected Output - -After completing this exercise, you should be able to: -- Understand struct memory layout and member offsets -- Identify struct initialization patterns in ARM assembly -- Patch struct data members in binary firmware -- Reason about the consequences of overwriting adjacent struct fields - -#### Questions for Reflection - -###### Question 1: The original struct has 6 members (3 pins + 3 states) in 6 bytes. If you add a fourth pin at offset 3, you overwrite `led1_state`. What is the practical impact on LED 1 behavior? - -###### Question 2: How would you verify the exact struct layout and offsets using GDB's memory examination commands? - -###### Question 3: If the `get_led_pin` function uses a bounds check (e.g., `if led_num > 3 return 0`), what additional patch would you need? - -###### Question 4: Could you extend the struct without overwriting existing fields by finding free space elsewhere in the binary? What challenges would that introduce? - -#### Tips and Hints -- GPIO 19 = `0x13` in hex -- The struct is likely stack-allocated, so the initialization `movs`/`strb` sequence happens every loop iteration -- Overwriting `led1_state` (offset 3) with `0x13` means LED 1 will appear as "on" (non-zero boolean) — this may cause LED 1 to be on at startup -- The `get_led_pin` function likely uses the LED number as an index into the struct — trace how it calculates the offset diff --git a/WEEK11/WEEK11-02-S.md b/WEEK11/WEEK11-02-S.md deleted file mode 100644 index 7b81a3b..0000000 --- a/WEEK11/WEEK11-02-S.md +++ /dev/null @@ -1,62 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Functions in Embedded Systems: Debugging and Hacking Functions w/ IR Remote and Multi-LED Control - -### Non-Credit Practice Exercise 2 Solution: Change Blink Count - -#### Answers - -##### Blink Count Parameter - -| Parameter | Original | Patched | -|-------------|---------|---------| -| Blink count | 3 | 5 | -| Hex | 0x03 | 0x05 | -| Register | r1 | r1 | -| Instruction | movs r1, #3 | movs r1, #5 | - -##### Assembly Context (blink_led Call) - -```asm -movs r0, ; r0 = GPIO pin number -movs r1, #3 ; r1 = blink count ← PATCH THIS -movs r2, #0x32 ; r2 = delay (50ms) -bl blink_led ; blink_led(pin, 3, 50) -``` - -##### Patch - -The immediate byte in `movs r1, #3` is the first byte of the 2-byte Thumb instruction: - -``` -Before: 03 21 (movs r1, #3) -After: 05 21 (movs r1, #5) -``` - -File offset = instruction address - 0x10000000. - -##### Behavior After Patch - -| Button | LED | Original | Patched | -|--------|--------|-------------------|---------------------| -| 1 | Red | Blinks 3×, stays on | Blinks 5×, stays on | -| 2 | Green | Blinks 3×, stays on | Blinks 5×, stays on | -| 3 | Yellow | Blinks 3×, stays on | Blinks 5×, stays on | - -Total blink time at 50ms delay: 5 × (50 + 50) = **500ms** (was 300ms). - -#### Reflection Answers - -1. **movs rN, #imm8 can encode values 0–255. What is the maximum blink count with a single byte patch?** - The maximum is **255** (`0xFF`). The `movs Rd, #imm8` Thumb instruction uses a full 8-bit immediate field, giving an unsigned range of 0–255. Setting the blink count to 255 would make each LED blink 255 times per button press — at 50ms on + 50ms off per blink, that's 255 × 100ms = **25.5 seconds** of blinking before the LED stays on. A count of 0 would skip the blink loop entirely (LED turns on immediately with no blinking). - -2. **Why is blink count in r1 and not r0? What does r0 hold at this point?** - The ARM calling convention (AAPCS) passes the first four function arguments in registers `r0`, `r1`, `r2`, `r3` in order. The `blink_led` function signature is `blink_led(uint8_t pin, uint8_t count, uint32_t delay_ms)`. So `r0` = pin (the GPIO number of the LED to blink), `r1` = count (how many times to blink), and `r2` = delay_ms (the delay in milliseconds between on/off transitions). The blink count is the second parameter, hence `r1`. - -3. **If you wanted a blink count larger than 255 (e.g., 1000), what instruction sequence would the compiler generate instead of movs?** - For values exceeding 255, the compiler would use a 32-bit Thumb-2 `movw r1, #imm16` instruction, which can encode 0–65535. For example, `movw r1, #1000` would be 4 bytes: `40 F2 E8 31` (encoding `movw r1, #0x3E8`). For values exceeding 65535, the compiler would add `movt r1, #imm16` to set the upper 16 bits, or use a literal pool load (`ldr r1, [pc, #offset]`). The function parameter type (`uint8_t`) would still truncate to 0–255, so a count of 1000 would wrap to 232 (1000 mod 256) unless the function uses a wider type internally. - -4. **Is there one shared movs r1, #3 instruction for all three LEDs, or does each blink_led call have its own? How can you tell?** - Each `blink_led` call likely has its **own** `movs r1, #3` instruction. The compiler generates separate parameter setup sequences for each `bl blink_led` call site — the `movs r0, ` instruction before each call loads a different GPIO pin. You can verify by disassembling the full range (`disassemble 0x10000234,+300`) and counting how many `movs r1, #3` instructions appear before `bl blink_led` calls. If there are three separate call sites with three separate `movs r1, #3` instructions, you need to **patch all three** to change the blink count for every LED. If only one is patched, only that LED's blink count changes. diff --git a/WEEK11/WEEK11-02.md b/WEEK11/WEEK11-02.md deleted file mode 100644 index 74c60f1..0000000 --- a/WEEK11/WEEK11-02.md +++ /dev/null @@ -1,144 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics - -### Non-Credit Practice Exercise 2: Change Blink Count - -#### Objective -Find the `blink_led(pin, 3, 50)` call in the `0x0026_functions` binary using GDB, identify the immediate value `#3` being loaded into `r1` (the blink count parameter), calculate the file offset, and patch it to `#5` so that each LED blinks 5 times instead of 3 when activated by the IR remote. - -#### Prerequisites -- Completed Week 11 tutorial (GDB and hex editor sections) -- `0x0026_functions.elf` and `0x0026_functions.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with IR remote and LEDs on GPIO 16, 17, 18 - -#### Task Description -The `blink_led` function is called with three parameters: the GPIO pin number, a blink count of `3`, and a delay of `50`ms. The blink count is loaded as a small immediate value (`movs r1, #3`) directly in the instruction before the `bl blink_led` call. You will locate this instruction, find the byte encoding the `#3` immediate, and patch it to `#5` so the LEDs blink 5 times per button press. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0026_functions.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the blink_led Call - -Disassemble main and look for the function call sequence: - -```gdb -(gdb) disassemble 0x10000234,+300 -``` - -Look for the parameter setup before `bl blink_led`: - -``` -movs r0, ; GPIO pin number (from get_led_pin) -movs r1, #3 ; blink count = 3 -movs r2, #0x32 ; delay = 50ms -bl blink_led -``` - -Note the address of the `movs r1, #3` instruction. - -##### Step 3: Examine the Instruction Encoding - -Look at the raw bytes of the `movs r1, #3` instruction: - -```gdb -(gdb) x/2bx -``` - -In Thumb encoding, `movs r1, #imm8` has the immediate in the lower byte. You should see a byte containing `03`. - -##### Step 4: Calculate the File Offset - -``` -file_offset = address - 0x10000000 -``` - -Note the file offset of the byte containing `03`. - -##### Step 5: Encode the New Value - -| Parameter | Original | New | Encoding | -| ---------- | -------- | ---- | -------------- | -| Blink count | `03` | `05` | `movs r1, #5` | - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions\build\0x0026_functions.bin` -2. Press **Ctrl+G** and enter the file offset -3. You should see: `03` -4. Replace with: `05` - -###### Question 1: The `movs r1, #3` is a 2-byte Thumb instruction. Which byte contains the immediate — the first or the second? - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0026_functions-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions -python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press button 1 → Red LED blinks **5 times** (was 3), then stays on -- Press button 2 → Green LED blinks **5 times** (was 3), then stays on -- Press button 3 → Yellow LED blinks **5 times** (was 3), then stays on -- Count carefully — you should see exactly 5 on/off cycles - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate small immediate values in Thumb `movs` instructions -- Understand Thumb instruction encoding for immediate operands -- Patch function parameters by modifying instruction immediates -- Verify behavioral changes by counting observable events - -#### Questions for Reflection - -###### Question 1: The `movs rN, #imm8` instruction can encode values 0-255. What is the maximum blink count you could set with a single byte patch? - -###### Question 2: Why is the blink count passed in `r1` and not `r0`? What does `r0` hold at this point in the calling convention? - -###### Question 3: If you wanted to set the blink count to 256 or higher, the `movs` immediate would not be enough. What instruction sequence would the compiler need to generate instead? - -###### Question 4: The same `blink_led` function is called for all three buttons. Does that mean there is only one `movs r1, #3` to patch, or could there be multiple call sites? - -#### Tips and Hints -- Small immediates (0-255) are encoded directly in the `movs` instruction — no literal pool needed -- The ARM calling convention uses `r0`, `r1`, `r2`, `r3` for the first four function parameters in order -- Look for `movs r1, #3` right before `bl blink_led` — there may be one shared call site or multiple per button -- If there are multiple `movs r1, #3` instructions (one per case), you need to patch all of them for consistent behavior diff --git a/WEEK11/WEEK11-03-S.md b/WEEK11/WEEK11-03-S.md deleted file mode 100644 index 891d47c..0000000 --- a/WEEK11/WEEK11-03-S.md +++ /dev/null @@ -1,70 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Functions in Embedded Systems: Debugging and Hacking Functions w/ IR Remote and Multi-LED Control - -### Non-Credit Practice Exercise 3 Solution: Swap All Three LEDs - -#### Answers - -##### GPIO Rotation Patch - -| Struct Member | Original | Patched | Effect | -|--------------|-----------------|-----------------|---------------------| -| led1_pin | 0x10 (GPIO 16 Red) | 0x11 (GPIO 17 Green) | Button 1 → Green | -| led2_pin | 0x11 (GPIO 17 Green) | 0x12 (GPIO 18 Yellow) | Button 2 → Yellow | -| led3_pin | 0x12 (GPIO 18 Yellow) | 0x10 (GPIO 16 Red) | Button 3 → Red | - -##### Assembly Patches - -Three single-byte patches in `movs` immediate fields: - -``` -Patch 1 (led1_pin): 10 → 11 -Before: 10 20 (movs r0, #0x10) -After: 11 20 (movs r0, #0x11) - -Patch 2 (led2_pin): 11 → 12 -Before: 11 20 (movs r0, #0x11) -After: 12 20 (movs r0, #0x12) - -Patch 3 (led3_pin): 12 → 10 -Before: 12 20 (movs r0, #0x12) -After: 10 20 (movs r0, #0x10) -``` - -##### GDB Verification - -```gdb -(gdb) b *0x10000280 -(gdb) c -(gdb) x/6bx -``` - -Before patch: `10 11 12 00 00 00` -After patch: `11 12 10 00 00 00` - -##### Behavior After Patch - -| Button (IR) | NEC Code | Terminal Log | Actual LED | -|------------|----------|---------------------------|-----------| -| Button 1 | 0x0C | "LED 1 activated on GPIO 16" | Green (GPIO 17) | -| Button 2 | 0x18 | "LED 2 activated on GPIO 17" | Yellow (GPIO 18) | -| Button 3 | 0x5E | "LED 3 activated on GPIO 18" | Red (GPIO 16) | - -The terminal logs are **desynchronized** from actual behavior. - -#### Reflection Answers - -1. **Terminal log still says "LED 1 activated on GPIO 16" even though GPIO 17 (Green) is actually blinking. Why don't the logs update automatically?** - The `printf` format strings and their arguments are separate from the struct pin assignments. The log message "LED 1 activated on GPIO 16" is generated from hardcoded format strings or from reading the **original** pin value before our patch takes effect. The GPIO number in the log comes from a different code path — likely a format string like `"LED %d activated on GPIO %d\r\n"` where the GPIO value was loaded from the struct at a different point or is computed independently. Since we only patched the `movs` instructions that store pin values into the struct, the logging code still uses whatever values it computes independently. - -2. **If the struct initialization used ldr from a literal pool instead of movs immediates, how would the patching differ?** - With literal pool loads, the pin values would be stored as 32-bit words in a data area near the function code. You would need to: (1) find the `ldr r0, [pc, #offset]` instruction, (2) calculate the PC-relative offset to locate the literal pool entry, (3) navigate to the pool address in the hex editor, and (4) modify the 4-byte value there. For example, GPIO 16 would be `10 00 00 00` (little-endian) in the pool. This is more work than patching a 1-byte `movs` immediate, and you'd need to verify no other code shares the same pool entry. The `movs` approach is simpler because the value is encoded directly in the instruction. - -3. **Could you achieve the same LED rotation by patching gpio_init/gpio_put calls instead of the struct initialization? Which approach is cleaner?** - Patching `gpio_init` and `gpio_put` calls would require finding every call site that references each GPIO pin and modifying the pin argument. This is scattered throughout multiple functions (`process_ir_led_command`, `blink_led`, `leds_all_off`). The struct initialization approach is **far cleaner** — three adjacent `movs` instructions in one location control the entire mapping. By patching the struct data at its source, every function that reads from the struct automatically gets the new values. This demonstrates the power of data-driven design: changing the data at one point affects all code that uses it. - -4. **In a real attack, why is log desynchronization (display says one thing, hardware does another) dangerous for forensic analysis?** - Log desynchronization is dangerous because forensic investigators rely on logs to reconstruct what happened. If logs show "LED 1 on GPIO 16" but the hardware actually activated GPIO 17, investigators would draw incorrect conclusions about which physical device was controlled. In industrial systems, this could mask sabotage — operators see "normal" readings while equipment is being misused. In security systems, tampered firmware could log "door locked" while actually unlocking it. The logs become actively misleading, not just incomplete. This is a form of **anti-forensics** that makes post-incident analysis unreliable and can delay or prevent discovery of the actual attack. diff --git a/WEEK11/WEEK11-03.md b/WEEK11/WEEK11-03.md deleted file mode 100644 index 3d96833..0000000 --- a/WEEK11/WEEK11-03.md +++ /dev/null @@ -1,150 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics - -### Non-Credit Practice Exercise 3: Swap All Three LEDs - -#### Objective -Find the struct initialization instructions where `led1_pin` = 0x10 (GPIO 16, Red), `led2_pin` = 0x11 (GPIO 17, Green), and `led3_pin` = 0x12 (GPIO 18, Yellow) are written in the `0x0026_functions` binary using GDB, calculate the file offsets, and rotate the GPIO values so that button 1→Green (0x11), button 2→Yellow (0x12), and button 3→Red (0x10), then verify on hardware that the LED mapping has shifted. - -#### Prerequisites -- Completed Week 11 tutorial (GDB and hex editor sections) -- `0x0026_functions.elf` and `0x0026_functions.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with IR remote and LEDs on GPIO 16, 17, 18 - -#### Task Description -The struct initialization sets `led1_pin` = 16 (0x10), `led2_pin` = 17 (0x11), `led3_pin` = 18 (0x12) using `movs` instructions that store each value into the struct. By patching the immediate values in these three `movs` instructions, you can rotate the LED assignment: `led1_pin` = 17 (Green), `led2_pin` = 18 (Yellow), `led3_pin` = 16 (Red). This means button 1 will light the Green LED, button 2 the Yellow LED, and button 3 the Red LED. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0026_functions.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the Three movs Instructions - -Disassemble main and find the struct pin initialization: - -```gdb -(gdb) disassemble 0x10000234,+300 -``` - -Look for three consecutive `movs`/`strb` pairs: - -``` -movs r0, #0x10 ; led1_pin = 16 (Red) -strb r0, [r4, #0] -movs r0, #0x11 ; led2_pin = 17 (Green) -strb r0, [r4, #1] -movs r0, #0x12 ; led3_pin = 18 (Yellow) -strb r0, [r4, #2] -``` - -Note the address of each `movs` instruction. - -##### Step 3: Examine the Instruction Bytes - -Check the raw encoding of each `movs`: - -```gdb -(gdb) x/2bx -(gdb) x/2bx -(gdb) x/2bx -``` - -Each will have the GPIO pin number as the immediate byte. - -##### Step 4: Calculate the File Offsets - -``` -file_offset = address - 0x10000000 -``` - -Note the offset of the immediate byte in each of the three `movs` instructions. - -##### Step 5: Plan the Rotation - -| Struct Member | Original | New | Effect | -| ------------- | ----------------- | ----------------- | ---------------- | -| `led1_pin` | `10` (GPIO 16 Red) | `11` (GPIO 17 Green) | Button 1 → Green | -| `led2_pin` | `11` (GPIO 17 Green) | `12` (GPIO 18 Yellow) | Button 2 → Yellow | -| `led3_pin` | `12` (GPIO 18 Yellow) | `10` (GPIO 16 Red) | Button 3 → Red | - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions\build\0x0026_functions.bin` -2. Go to the first `movs` immediate offset and change `10` to `11` -3. Go to the second `movs` immediate offset and change `11` to `12` -4. Go to the third `movs` immediate offset and change `12` to `10` - -###### Question 1: All three patches are single-byte changes in `movs` immediates. Why is this simpler than patching literal pool entries? - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0026_functions-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions -python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press button 1 → **Green** LED blinks (was Red) -- Press button 2 → **Yellow** LED blinks (was Green) -- Press button 3 → **Red** LED blinks (was Yellow) -- Terminal still says "LED 1 activated on GPIO 16" — but the actual LED is Green (GPIO 17) - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate struct initialization patterns in ARM Thumb assembly -- Patch multiple `movs` immediates to rotate data values -- Understand the disconnect between logged values and actual hardware behavior -- Recognize log desynchronization as a security concern - -#### Questions for Reflection - -###### Question 1: The terminal log still says "LED 1 activated on GPIO 16" even though GPIO 17 (Green) is actually blinking. Why don't the logs update automatically? - -###### Question 2: If the struct initialization used `ldr` from a literal pool instead of `movs` immediates, how would the patching approach differ? - -###### Question 3: Could you achieve the same LED rotation by patching the `gpio_init` and `gpio_put` calls instead of the struct? Which approach is cleaner and why? - -###### Question 4: In a real attack scenario, why is log desynchronization (logs say one thing, hardware does another) particularly dangerous for forensic analysis? - -#### Tips and Hints -- The three `movs` instructions are likely within 10-20 bytes of each other — use `x/20i` to see them all at once -- The `movs rN, #imm8` immediate is in the lower byte of the 2-byte Thumb instruction -- Make sure you patch the `movs` for the struct initialization, not any other `movs #0x10/0x11/0x12` that may exist elsewhere -- Verify by examining the struct in memory after initialization: `x/6bx ` should show `11 12 10` for the pin bytes diff --git a/WEEK11/WEEK11-04-S.md b/WEEK11/WEEK11-04-S.md deleted file mode 100644 index 17629b2..0000000 --- a/WEEK11/WEEK11-04-S.md +++ /dev/null @@ -1,60 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Functions in Embedded Systems: Debugging and Hacking Functions w/ IR Remote and Multi-LED Control - -### Non-Credit Practice Exercise 4 Solution: Change Blink Speed - -#### Answers - -##### Delay Parameter - -| Parameter | Original | Patched | -|----------|-------------|--------------| -| Delay | 50ms | 25ms | -| Hex | 0x32 | 0x19 | -| Register | r2 | r2 | -| Instruction | movs r2, #0x32 | movs r2, #0x19 | - -##### Assembly Context - -```asm -movs r0, ; r0 = GPIO pin -movs r1, #3 ; r1 = blink count -movs r2, #0x32 ; r2 = delay 50ms ← PATCH THIS -bl blink_led ; blink_led(pin, 3, 50) -``` - -##### Patch - -``` -Before: 32 22 (movs r2, #0x32 = 50ms) -After: 19 22 (movs r2, #0x19 = 25ms) -``` - -**Warning:** The byte `0x32` is also ASCII '2'. Verify you're patching the correct `movs r2` instruction by checking surrounding bytes — `movs r1, #3` (`03 21`) should appear immediately before, and `bl blink_led` immediately after. - -##### Timing Comparison - -| Metric | Original (50ms) | Patched (25ms) | -|-------------------|-----------------|----------------| -| On-time per blink | 50ms | 25ms | -| Off-time per blink| 50ms | 25ms | -| One blink cycle | 100ms | 50ms | -| 3 blinks total | 300ms | 150ms | -| Perceived speed | Normal | 2× faster | - -#### Reflection Answers - -1. **If delay = 1ms (0x01), would you still see the LED blink, or would it appear constantly on?** - At 1ms on/off (2ms per cycle, 500Hz flicker), the LED would appear **constantly on** to the human eye. Human flicker fusion threshold is approximately 60Hz — anything above that appears as a steady light. At 500Hz, the LED is switching far too fast for the eye to perceive individual blinks. The LED would look like it's at roughly 50% brightness (since it's on half the time) compared to being fully on. The 3 blinks would complete in just 6ms total, appearing as a brief flash rather than distinct blinks. - -2. **0x32 appears as both the delay value (50ms) and potentially ASCII '2'. How would you systematically find ALL occurrences of 0x32 and determine which to patch?** - Search the binary for all `0x32` bytes, then examine the **context** of each occurrence: (1) Check the byte following `0x32` — if it's `0x22`, this is `movs r2, #0x32` (the delay parameter). If it's `0x2C`, it's `cmp r4, #0x32` (comparing against ASCII '2'). (2) Examine surrounding instructions: the delay `0x32` will be preceded by `movs r1, #3` (blink count) and followed by `bl blink_led`. A comparison `0x32` will be near `beq`/`bne` branches. (3) Use GDB to disassemble the region (`x/10i `) and read the instruction mnemonic. (4) Cross-reference with the function structure — delay patches are in `blink_led` call setup, comparisons are in `ir_to_led_number` or similar dispatcher functions. - -3. **For a delay of 500ms (0x1F4), the value won't fit in a movs immediate (max 255). How would the compiler handle it?** - For 500 (`0x1F4`), the compiler would use either: (1) A 32-bit `movw r2, #0x1F4` Thumb-2 instruction (4 bytes), which can encode any 16-bit immediate (0–65535). (2) A literal pool load: `ldr r2, [pc, #offset]` that reads `0x000001F4` from a nearby data word. The `movw` approach is preferred for values 256–65535 because it's a single instruction with no data dependency. For values exceeding 65535, a literal pool or `movw`+`movt` pair would be necessary. - -4. **The blink function uses the delay for both on-time and off-time (symmetrical blink). Could you make the LED stay on longer than off by patching only one instruction?** - Not with a single patch to the `movs r2` instruction, because `blink_led` uses the same delay parameter for both the on-phase and off-phase `sleep_ms` calls internally. To create asymmetric blink timing, you would need to patch **inside** the `blink_led` function itself — find the two `sleep_ms` calls within the blink loop and modify their delay arguments independently. For example, find the `ldr`/`movs` that sets up `r0` before each `bl sleep_ms` inside `blink_led`, and patch one to a different value. This would require disassembling `blink_led` to locate both `sleep_ms` call sites. diff --git a/WEEK11/WEEK11-04.md b/WEEK11/WEEK11-04.md deleted file mode 100644 index 1ce0b49..0000000 --- a/WEEK11/WEEK11-04.md +++ /dev/null @@ -1,146 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 11 -Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics - -### Non-Credit Practice Exercise 4: Change Blink Speed - -#### Objective -Find the `blink_led(pin, 3, 50)` call in the `0x0026_functions` binary using GDB, identify the immediate value `0x32` (50) being loaded into `r2` (the delay parameter), calculate the file offset, and patch it to `0x19` (25) so that each LED blinks at double speed when activated by the IR remote. - -#### Prerequisites -- Completed Week 11 tutorial (GDB and hex editor sections) -- `0x0026_functions.elf` and `0x0026_functions.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with IR remote and LEDs on GPIO 16, 17, 18 - -#### Task Description -The `blink_led` function takes a delay parameter of `50`ms (`0x32`) in register `r2`. This value controls how long each LED stays on and off during the blink cycle. By patching this to `25`ms (`0x19`), the LEDs will blink twice as fast, creating a noticeably quicker flashing pattern when any IR remote button is pressed. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0026_functions.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the blink_led Call - -Disassemble main and look for the parameter setup before `bl blink_led`: - -```gdb -(gdb) disassemble 0x10000234,+300 -``` - -Look for: - -``` -movs r0, ; GPIO pin number -movs r1, #3 ; blink count -movs r2, #0x32 ; delay = 50ms -bl blink_led -``` - -Note the address of the `movs r2, #0x32` instruction. - -##### Step 3: Examine the Instruction Encoding - -Look at the raw bytes: - -```gdb -(gdb) x/2bx -``` - -The `movs r2, #0x32` instruction has `0x32` (50) as the immediate byte. - -##### Step 4: Calculate the File Offset - -``` -file_offset = address - 0x10000000 -``` - -Note the file offset of the byte containing `32`. - -##### Step 5: Encode the New Value - -| Parameter | Original | New | Effect | -| --------- | --------------- | --------------- | --------------- | -| Delay | `32` (50ms) | `19` (25ms) | 2x faster blink | - -**Be careful:** `0x32` is also the ASCII code for '2'. Make sure you are patching the `movs r2` instruction and not a comparison value like `cmp r4, #0x32`. - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions\build\0x0026_functions.bin` -2. Press **Ctrl+G** and enter the file offset -3. You should see: `32` -4. Replace with: `19` - -###### Question 1: How can you confirm you are patching the delay parameter and not some other `0x32` byte in the binary? - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0026_functions-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions -python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the behavior:** -- Press button 1 → Red LED blinks 3 times but **noticeably faster** (25ms on/off vs 50ms) -- Press button 2 → Green LED blinks 3 times at **double speed** -- Press button 3 → Yellow LED blinks 3 times at **double speed** -- The total blink sequence should complete in roughly half the original time - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate function parameters in ARM Thumb `movs` instructions -- Distinguish between identical byte values used in different contexts -- Patch timing parameters to change observable hardware behavior -- Understand the relationship between delay values and perceived blink speed - -#### Questions for Reflection - -###### Question 1: The `blink_led` function calls `sleep_ms` internally with the delay value. If you set the delay to `1`ms (0x01), would you still see the LED blink, or would it appear constantly on? - -###### Question 2: The value `0x32` appears in this binary as both a delay parameter (50ms) and potentially as an ASCII comparison ('2'). How would you systematically find ALL occurrences of `0x32` and determine which one to patch? - -###### Question 3: If you wanted a delay of 500ms (0x1F4), the value would not fit in a `movs` immediate. How would the compiler handle this larger delay value? - -###### Question 4: The blink function uses the delay for both the on-time and the off-time. Could you make the LED stay on longer than it stays off? What kind of patch would that require? - -#### Tips and Hints -- `25` decimal = `0x19` hex — fits in one byte, so the `movs` encoding works directly -- Verify location by checking the surrounding instructions: `movs r1, #3` should be right before and `bl blink_led` right after -- The total blink time for 3 blinks at 50ms = 3 × (50 + 50) = 300ms; at 25ms = 3 × (25 + 25) = 150ms -- If there are multiple call sites for `blink_led`, each may have its own `movs r2, #0x32` that needs patching diff --git a/WEEK11/WEEK11.md b/WEEK11/WEEK11.md index 8203abf..dd5d933 100644 --- a/WEEK11/WEEK11.md +++ b/WEEK11/WEEK11.md @@ -1,6 +1,6 @@ -# Week 11: Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics +?# Week 11: Structures and Functions in Embedded Systems: Debugging and Hacking w/ IR Remote Control and NEC Protocol Basics -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand C structures (structs) and how they organize related data @@ -15,7 +15,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 1: Understanding C Structures (Structs) +## Part 1: Understanding C Structures (Structs) ### What is a Struct? @@ -34,25 +34,25 @@ typedef struct { ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Structure as a Container │ -│ │ -│ simple_led_ctrl_t leds │ -│ ┌─────────────────────────────────────────────────────────────┐│ -│ │ led1_pin: 16 led2_pin: 17 led3_pin: 18 ││ -│ │ ┌────────┐ ┌────────┐ ┌────────┐ ││ -│ │ │ 16 │ │ 17 │ │ 18 │ ││ -│ │ └────────┘ └────────┘ └────────┘ ││ -│ │ ││ -│ │ led1_state: false led2_state: false led3_state: false ││ -│ │ ┌────────┐ ┌────────┐ ┌────────┐ ││ -│ │ │ false │ │ false │ │ false │ ││ -│ │ └────────┘ └────────┘ └────────┘ ││ -│ └─────────────────────────────────────────────────────────────┘│ -│ │ -│ All 6 members live together as ONE variable called "leds" │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Structure as a Container | +| | +| simple_led_ctrl_t leds | +| +-------------------------------------------------------------+| +| | led1_pin: 16 led2_pin: 17 led3_pin: 18 || +| | +--------+ +--------+ +--------+ || +| | | 16 | | 17 | | 18 | || +| | +--------+ +--------+ +--------+ || +| | || +| | led1_state: false led2_state: false led3_state: false || +| | +--------+ +--------+ +--------+ || +| | | false | | false | | false | || +| | +--------+ +--------+ +--------+ || +| +-------------------------------------------------------------+| +| | +| All 6 members live together as ONE variable called "leds" | +| | ++-----------------------------------------------------------------+ ``` ### Why Use Structs? @@ -75,28 +75,28 @@ typedef struct { --- -## 📚 Part 2: Struct Memory Layout +## Part 2: Struct Memory Layout ### How Structs are Stored in Memory When you create a struct, the compiler places each member in consecutive memory locations: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Memory Layout of simple_led_ctrl_t │ -│ │ -│ Address Member Size Value │ -│ ───────────────────────────────────────────────────────────── │ -│ 0x2000000 led1_pin 1 byte 16 (0x10) │ -│ 0x2000001 led2_pin 1 byte 17 (0x11) │ -│ 0x2000002 led3_pin 1 byte 18 (0x12) │ -│ 0x2000003 led1_state 1 byte 0 (false) │ -│ 0x2000004 led2_state 1 byte 0 (false) │ -│ 0x2000005 led3_state 1 byte 0 (false) │ -│ │ -│ Total struct size: 6 bytes │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Memory Layout of simple_led_ctrl_t | +| | +| Address Member Size Value | +| ------------------------------------------------------------- | +| 0x2000000 led1_pin 1 byte 16 (0x10) | +| 0x2000001 led2_pin 1 byte 17 (0x11) | +| 0x2000002 led3_pin 1 byte 18 (0x12) | +| 0x2000003 led1_state 1 byte 0 (false) | +| 0x2000004 led2_state 1 byte 0 (false) | +| 0x2000005 led3_state 1 byte 0 (false) | +| | +| Total struct size: 6 bytes | +| | ++-----------------------------------------------------------------+ ``` ### Accessing Struct Members @@ -129,21 +129,21 @@ ptr->led1_pin = 16; // Using arrow with pointer ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Dot vs Arrow Operator │ -│ │ -│ struct_variable.member ◄── Use with actual struct │ -│ │ -│ pointer_to_struct->member ◄── Use with pointer to struct │ -│ │ -│ The arrow (->) is shorthand for (*pointer).member │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Dot vs Arrow Operator | +| | +| struct_variable.member ?-- Use with actual struct | +| | +| pointer_to_struct->member ?-- Use with pointer to struct | +| | +| The arrow (->) is shorthand for (*pointer).member | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 3: Designated Initializers +## Part 3: Designated Initializers ### Clean Struct Initialization @@ -168,29 +168,29 @@ simple_led_ctrl_t leds = { --- -## 📚 Part 4: Understanding the NEC IR Protocol +## Part 4: Understanding the NEC IR Protocol ### What is Infrared (IR) Communication? **Infrared** communication uses invisible light pulses to send data. Your TV remote uses IR to send commands to your TV. The LED in the remote flashes on and off very quickly in specific patterns that represent different buttons. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ IR Communication │ -│ │ -│ Remote Control IR Receiver │ -│ ┌──────────┐ ┌──────────┐ │ -│ │ Button │ │ │ │ -│ │ 1 │ ─── IR Light Pulses ──► │ ████ │ │ -│ │ ┌───┐ │ ~~~~~~~~~~~~► │ Sensor │ │ -│ │ │ ● │ │ │ │ │ -│ │ └───┘ │ └────┬─────┘ │ -│ │ IR LED │ │ │ -│ └──────────┘ ▼ │ -│ GPIO Pin │ -│ (Digital signal) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| IR Communication | +| | +| Remote Control IR Receiver | +| +----------+ +----------+ | +| | Button | | | | +| | 1 | --- IR Light Pulses --- | ++ | | +| | +---+ | ~~~~~~~~~~~~? | Sensor | | +| | | ?? | | | | | +| | +---+ | +----+-----+ | +| | IR LED | | | +| +----------+ ? | +| GPIO Pin | +| (Digital signal) | +| | ++-----------------------------------------------------------------+ ``` ### The NEC Protocol @@ -204,18 +204,18 @@ simple_led_ctrl_t leds = { 5. **Command Inverse** - 8 bits (for error checking) ``` -┌─────────────────────────────────────────────────────────────────┐ -│ NEC Protocol Frame │ -│ │ -│ ┌─────────┬─────────┬─────────┬─────────┬─────────┬─────────┐ │ -│ │ Leader │ Address │ Address │ Command │ Command │ Stop │ │ -│ │ Pulse │ 8-bit │ Inverse │ 8-bit │ Inverse │ Bit │ │ -│ │ 9+4.5ms │ │ 8-bit │ │ 8-bit │ │ │ -│ └─────────┴─────────┴─────────┴─────────┴─────────┴─────────┘ │ -│ │ -│ Total: 32 bits of data (+ leader + stop) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| NEC Protocol Frame | +| | +| +---------+---------+---------+---------+---------+---------+ | +| | Leader | Address | Address | Command | Command | Stop | | +| | Pulse | 8-bit | Inverse | 8-bit | Inverse | Bit | | +| | 9+4.5ms | | 8-bit | | 8-bit | | | +| +---------+---------+---------+---------+---------+---------+ | +| | +| Total: 32 bits of data (+ leader + stop) | +| | ++-----------------------------------------------------------------+ ``` ### NEC Command Codes for Our Remote @@ -230,7 +230,7 @@ simple_led_ctrl_t leds = { --- -## 📚 Part 5: Understanding Functions in C +## Part 5: Understanding Functions in C ### What is a Function? @@ -249,30 +249,30 @@ int result = add_numbers(5, 3); // result = 8 ### Function Components ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Anatomy of a Function │ -│ │ -│ return_type function_name ( parameters ) { │ -│ // function body │ -│ return value; │ -│ } │ -│ │ -│ Example: │ -│ ┌─────────────────────────────────────────────────────────────┐│ -│ │ int ir_to_led_number ( int ir_command ) { ││ -│ │ ─── ─────────────── ─────────────── ││ -│ │ │ │ │ ││ -│ │ │ │ └── Parameter (input) ││ -│ │ │ └── Function name ││ -│ │ └── Return type (what it gives back) ││ -│ │ ││ -│ │ if (ir_command == 0x0C) return 1; ◄── Body ││ -│ │ if (ir_command == 0x18) return 2; ││ -│ │ return 0; ◄── Return value ││ -│ │ } ││ -│ └─────────────────────────────────────────────────────────────┘│ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Anatomy of a Function | +| | +| return_type function_name ( parameters ) { | +| // function body | +| return value; | +| } | +| | +| Example: | +| +-------------------------------------------------------------+| +| | int ir_to_led_number ( int ir_command ) { || +| | --- --------------- --------------- || +| | | | | || +| | | | +-- Parameter (input) || +| | | +-- Function name || +| | +-- Return type (what it gives back) || +| | || +| | if (ir_command == 0x0C) return 1; ?-- Body || +| | if (ir_command == 0x18) return 2; || +| | return 0; ?-- Return value || +| | } || +| +-------------------------------------------------------------+| +| | ++-----------------------------------------------------------------+ ``` ### Types of Functions @@ -286,7 +286,7 @@ int result = add_numbers(5, 3); // result = 8 --- -## 📚 Part 6: Functions with Struct Pointers +## Part 6: Functions with Struct Pointers ### Passing Structs to Functions @@ -306,32 +306,32 @@ leds_all_off(&my_leds); // Pass the ADDRESS of my_leds ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Passing Struct by Pointer │ -│ │ -│ main() { │ -│ simple_led_ctrl_t leds; ◄── Struct lives here │ -│ leds_all_off(&leds); ◄── Pass ADDRESS (pointer) │ -│ } │ │ -│ │ │ -│ ▼ │ -│ leds_all_off(simple_led_ctrl_t *leds) { │ -│ gpio_put(leds->led1_pin, false); │ -│ ──── │ -│ │ │ -│ └── Arrow because leds is a POINTER │ -│ } │ -│ │ -│ WHY use pointers? │ -│ • Efficient: Only 4 bytes (address) instead of entire struct │ -│ • Allows modification: Function can change the original │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Passing Struct by Pointer | +| | +| main() { | +| simple_led_ctrl_t leds; ?-- Struct lives here | +| leds_all_off(&leds); ?-- Pass ADDRESS (pointer) | +| } | | +| | | +| ? | +| leds_all_off(simple_led_ctrl_t *leds) { | +| gpio_put(leds->led1_pin, false); | +| ---- | +| | | +| +-- Arrow because leds is a POINTER | +| } | +| | +| WHY use pointers? | +| - Efficient: Only 4 bytes (address) instead of entire struct | +| - Allows modification: Function can change the original | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 7: How Compilers Handle Structs +## Part 7: How Compilers Handle Structs ### Struct "Flattening" in Assembly @@ -357,32 +357,32 @@ bl gpio_init ; call gpio_init(18) ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Struct Flattening │ -│ │ -│ C Level (High-level abstraction): │ -│ ┌─────────────────────────────────────────────────────────────┐│ -│ │ gpio_init(leds.led1_pin); ││ -│ │ gpio_init(leds.led2_pin); ││ -│ │ gpio_init(leds.led3_pin); ││ -│ └─────────────────────────────────────────────────────────────┘│ -│ │ │ -│ │ Compiler transforms │ -│ ▼ │ -│ Assembly Level (Flattened): │ -│ ┌─────────────────────────────────────────────────────────────┐│ -│ │ movs r0, #16 ; Just the VALUE, no struct reference ││ -│ │ bl gpio_init ││ -│ │ movs r0, #17 ; Next value directly ││ -│ │ bl gpio_init ││ -│ │ movs r0, #18 ; Next value directly ││ -│ │ bl gpio_init ││ -│ └─────────────────────────────────────────────────────────────┘│ -│ │ -│ The struct abstraction DISAPPEARS at the assembly level! │ -│ We just see individual values being loaded and used. │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Struct Flattening | +| | +| C Level (High-level abstraction): | +| +-------------------------------------------------------------+| +| | gpio_init(leds.led1_pin); || +| | gpio_init(leds.led2_pin); || +| | gpio_init(leds.led3_pin); || +| +-------------------------------------------------------------+| +| | | +| | Compiler transforms | +| ? | +| Assembly Level (Flattened): | +| +-------------------------------------------------------------+| +| | movs r0, #16 ; Just the VALUE, no struct reference || +| | bl gpio_init || +| | movs r0, #17 ; Next value directly || +| | bl gpio_init || +| | movs r0, #18 ; Next value directly || +| | bl gpio_init || +| +-------------------------------------------------------------+| +| | +| The struct abstraction DISAPPEARS at the assembly level! | +| We just see individual values being loaded and used. | +| | ++-----------------------------------------------------------------+ ``` ### Why This Matters for Reverse Engineering @@ -393,7 +393,7 @@ bl gpio_init ; call gpio_init(18) --- -## 📚 Part 8: Setting Up Your Environment +## Part 8: Setting Up Your Environment ### Prerequisites @@ -422,61 +422,61 @@ Before we start, make sure you have: | LED | GPIO Pin | Resistor | | ------ | -------- | --------- | -| Red | GPIO 16 | 220Ω-330Ω | -| Green | GPIO 17 | 220Ω-330Ω | -| Yellow | GPIO 18 | 220Ω-330Ω | +| Red | GPIO 16 | 220-330 ohm | +| Green | GPIO 17 | 220-330 ohm | +| Yellow | GPIO 18 | 220-330 ohm | ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Complete Wiring Diagram │ -│ │ -│ Pico 2 Components │ -│ ┌──────────┐ │ -│ │ │ ┌─────────────┐ │ -│ │ GPIO 5 │──────────────┤ IR Receiver │ │ -│ │ │ │ (VS1838B) │ │ -│ │ │ └──────┬──────┘ │ -│ │ │ │ │ -│ │ GPIO 16 │───[220Ω]───(RED LED)────┐ │ -│ │ │ │ │ -│ │ GPIO 17 │───[220Ω]───(GRN LED)────┤ │ -│ │ │ │ │ -│ │ GPIO 18 │───[220Ω]───(YEL LED)────┤ │ -│ │ │ │ │ -│ │ 3.3V │─────────────────────────┼── IR VCC │ -│ │ │ │ │ -│ │ GND │─────────────────────────┴── All GNDs │ -│ │ │ │ -│ └──────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Complete Wiring Diagram | +| | +| Pico 2 Components | +| +----------+ | +| | | +-------------+ | +| | GPIO 5 |--------------+ IR Receiver | | +| | | | (VS1838B) | | +| | | +------+------+ | +| | | | | +| | GPIO 16 |---[220 ohm]---(RED LED)----+ | +| | | | | +| | GPIO 17 |---[220 ohm]---(GRN LED)----+ | +| | | | | +| | GPIO 18 |---[220 ohm]---(YEL LED)----+ | +| | | | | +| | 3.3V |-------------------------+-- IR VCC | +| | | | | +| | GND |-------------------------+-- All GNDs | +| | | | +| +----------+ | +| | ++-----------------------------------------------------------------+ ``` ### Project Structure ``` Embedded-Hacking/ -├── 0x0023_structures/ -│ ├── build/ -│ │ ├── 0x0023_structures.uf2 -│ │ └── 0x0023_structures.bin -│ ├── main/ -│ │ └── 0x0023_structures.c -│ └── ir.h -├── 0x0026_functions/ -│ ├── build/ -│ │ ├── 0x0026_functions.uf2 -│ │ ├── 0x0026_functions.bin -│ │ └── 0x0026_functions.elf -│ ├── main/ -│ │ └── 0x0026_functions.c -│ └── ir.h -└── uf2conv.py ++-- 0x0023_structures/ +| +-- build/ +| | +-- 0x0023_structures.uf2 +| | +-- 0x0023_structures.bin +| +-- main/ +| | +-- 0x0023_structures.c +| +-- ir.h ++-- 0x0026_functions/ +| +-- build/ +| | +-- 0x0026_functions.uf2 +| | +-- 0x0026_functions.bin +| | +-- 0x0026_functions.elf +| +-- main/ +| | +-- 0x0026_functions.c +| +-- ir.h ++-- uf2conv.py ``` --- -## 🔬 Part 9: Hands-On Tutorial - Structures Code +## ? Part 9: Hands-On Tutorial - Structures Code ### Step 1: Review the Source Code @@ -551,24 +551,24 @@ int main(void) { ### Step 2: Understand the Program Flow ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Program Flow │ -│ │ -│ 1. Initialize UART (stdio_init_all) │ -│ 2. Create LED struct with pins 16, 17, 18 │ -│ 3. Initialize GPIO pins as outputs │ -│ 4. Initialize IR receiver on GPIO 5 │ -│ 5. Enter infinite loop: │ -│ a. Check for IR key press │ -│ b. If key received: │ -│ - Print the NEC command code │ -│ - Turn all LEDs off │ -│ - Check which button: 0x0C, 0x18, or 0x5E │ -│ - Turn on the matching LED │ -│ - Apply states to GPIO pins │ -│ c. Sleep briefly and repeat │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Program Flow | +| | +| 1. Initialize UART (stdio_init_all) | +| 2. Create LED struct with pins 16, 17, 18 | +| 3. Initialize GPIO pins as outputs | +| 4. Initialize IR receiver on GPIO 5 | +| 5. Enter infinite loop: | +| a. Check for IR key press | +| b. If key received: | +| - Print the NEC command code | +| - Turn all LEDs off | +| - Check which button: 0x0C, 0x18, or 0x5E | +| - Turn on the matching LED | +| - Apply states to GPIO pins | +| c. Sleep briefly and repeat | +| | ++-----------------------------------------------------------------+ ``` ### Step 3: Flash the Binary to Your Pico 2 @@ -582,13 +582,13 @@ int main(void) { ### Step 4: Verify It's Working **Open PuTTY (115200 baud) and test:** -- Press "1" on remote → Red LED lights, terminal shows `NEC command: 0x0C` -- Press "2" on remote → Green LED lights, terminal shows `NEC command: 0x18` -- Press "3" on remote → Yellow LED lights, terminal shows `NEC command: 0x5E` +- Press "1" on remote -> Red LED lights, terminal shows `NEC command: 0x0C` +- Press "2" on remote -> Green LED lights, terminal shows `NEC command: 0x18` +- Press "3" on remote -> Yellow LED lights, terminal shows `NEC command: 0x5E` --- -## 🔬 Part 10: Debugging with GDB (Structures) +## ? Part 10: Debugging with GDB (Structures) ### Step 5: Start OpenOCD (Terminal 1) @@ -596,7 +596,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -724,7 +724,7 @@ quit --- -## 🔬 Part 11: Setting Up Ghidra for Structures +## ? Part 11: Setting Up Ghidra for Structures ### Step 17: Start Ghidra @@ -736,7 +736,7 @@ ghidraRun ### Step 18: Create a New Project -1. Click **File** → **New Project** +1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** 4. Enter Project Name: `0x0023_structures` @@ -749,12 +749,12 @@ ghidraRun ### Step 20: Configure the Binary Format -**Click the three dots (…) next to "Language" and:** +**Click the three dots (...) next to "Language" and:** 1. Search for "Cortex" 2. Select **ARM Cortex 32 little endian default** 3. Click **OK** -**Click the "Options…" button and:** +**Click the "Options..." button and:** 1. Change **Block Name** to `.text` 2. Change **Base Address** to `10000000` 3. Click **OK** @@ -769,12 +769,12 @@ Wait for analysis to complete. --- -## 🔬 Part 12: Resolving Functions - Structures Project +## ? Part 12: Resolving Functions - Structures Project ### Step 22: Navigate to Main 1. Press `G` (Go to address) and type `10000234` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `int main(void)` 4. Click **OK** @@ -783,7 +783,7 @@ Wait for analysis to complete. At address `0x10000236`: 1. Double-click on the called function -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `bool stdio_init_all(void)` 4. Click **OK** @@ -803,7 +803,7 @@ bl FUN_xxxxx ; gpio_init ``` This pattern reveals the struct members! Update the function signature: -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void gpio_init(uint gpio)` 3. Click **OK** @@ -816,7 +816,7 @@ movs r0, #0x5 ; GPIO 5 for IR receiver bl FUN_xxxxx ; ir_init ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void ir_init(uint pin)` 3. Click **OK** @@ -824,7 +824,7 @@ bl FUN_xxxxx ; ir_init Right after ir_init, look for the "IR receiver on GPIO" string being loaded: -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `int printf(char *format, ...)` 3. Check the **Varargs** checkbox 4. Click **OK** @@ -839,7 +839,7 @@ cmp r0, #0 ; Check if >= 0 blt no_key ; If negative, no key pressed ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `int ir_getkey(void)` 3. Click **OK** @@ -852,13 +852,13 @@ movs r0, #0x0A ; 10 milliseconds bl FUN_xxxxx ; sleep_ms ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void sleep_ms(uint ms)` 3. Click **OK** --- -## 🔬 Part 13: Recognizing Struct Patterns in Assembly +## ? Part 13: Recognizing Struct Patterns in Assembly ### Step 29: Identify GPIO Set Direction @@ -876,31 +876,31 @@ This is the compiler's version of `gpio_set_dir(pin, GPIO_OUT)`. Create a mental (or written) map: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Struct Member Mapping │ -│ │ -│ Assembly Value → Struct Member → Physical LED │ -│ ───────────────────────────────────────────────────────────── │ -│ 0x10 (16) → led1_pin → Red LED │ -│ 0x11 (17) → led2_pin → Green LED │ -│ 0x12 (18) → led3_pin → Yellow LED │ -│ │ -│ NEC Code → State Member → Action │ -│ ───────────────────────────────────────────────────────────── │ -│ 0x0C → led1_state=true → Red LED ON │ -│ 0x18 → led2_state=true → Green LED ON │ -│ 0x5E → led3_state=true → Yellow LED ON │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Struct Member Mapping | +| | +| Assembly Value -> Struct Member -> Physical LED | +| ------------------------------------------------------------- | +| 0x10 (16) -> led1_pin -> Red LED | +| 0x11 (17) -> led2_pin -> Green LED | +| 0x12 (18) -> led3_pin -> Yellow LED | +| | +| NEC Code -> State Member -> Action | +| ------------------------------------------------------------- | +| 0x0C -> led1_state=true -> Red LED ON | +| 0x18 -> led2_state=true -> Green LED ON | +| 0x5E -> led3_state=true -> Yellow LED ON | +| | ++-----------------------------------------------------------------+ ``` --- -## 🔬 Part 14: Hacking Structures +## ? Part 14: Hacking Structures ### Step 31: Open the Bytes Editor -1. Click **Window** → **Bytes** +1. Click **Window** -> **Bytes** 2. Click the pencil icon to enable editing ### Step 32: Swap LED Pin Assignments @@ -916,19 +916,19 @@ We'll swap the red and green LED pins to reverse their behavior! **Before:** ``` -LED 1 (0x0C) → GPIO 16 → Red LED -LED 2 (0x18) → GPIO 17 → Green LED +LED 1 (0x0C) -> GPIO 16 -> Red LED +LED 2 (0x18) -> GPIO 17 -> Green LED ``` **After:** ``` -LED 1 (0x0C) → GPIO 17 → Green LED (SWAPPED!) -LED 2 (0x18) → GPIO 16 → Red LED (SWAPPED!) +LED 1 (0x0C) -> GPIO 17 -> Green LED (SWAPPED!) +LED 2 (0x18) -> GPIO 16 -> Red LED (SWAPPED!) ``` ### Step 33: Export and Flash -1. Click **File** → **Export Program** +1. Click **File** -> **Export Program** 2. Set **Format** to **Binary** 3. Name: `0x0023_structures-h.bin` 4. Click **OK** @@ -936,43 +936,43 @@ LED 2 (0x18) → GPIO 16 → Red LED (SWAPPED!) Convert and flash: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0023_structures +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0023_structures python ..\uf2conv.py build\0x0023_structures-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 ``` ### Step 34: Verify the Hack **Open PuTTY and test:** -- Press "1" on remote → **GREEN** LED lights (was red!) +- Press "1" on remote -> **GREEN** LED lights (was red!) - Terminal still shows `NEC command: 0x0C` -- Press "2" on remote → **RED** LED lights (was green!) +- Press "2" on remote -> **RED** LED lights (was green!) - Terminal still shows `NEC command: 0x18` **The log says one thing, but the hardware does another!** --- -## 🔬 Part 15: Security Implications - Log Desynchronization +## ? Part 15: Security Implications - Log Desynchronization ### The Danger of Mismatched Logs ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Log vs Reality Desynchronization │ -│ │ -│ ┌─────────────────┐ ┌─────────────────┐ │ -│ │ Terminal Log │ │ Physical LEDs │ │ -│ ├─────────────────┤ ├─────────────────┤ │ -│ │ NEC: 0x0C │ ◄─────── │ GREEN LED on │ ◄── Mismatch! │ -│ │ (expects RED) │ │ (not red!) │ │ -│ ├─────────────────┤ ├─────────────────┤ │ -│ │ NEC: 0x18 │ ◄─────── │ RED LED on │ ◄── Mismatch! │ -│ │ (expects GREEN) │ │ (not green!) │ │ -│ └─────────────────┘ └─────────────────┘ │ -│ │ -│ The OPERATOR sees correct logs but WRONG physical behavior! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Log vs Reality Desynchronization | +| | +| +-----------------+ +-----------------+ | +| | Terminal Log | | Physical LEDs | | +| +-----------------+ +-----------------+ | +| | NEC: 0x0C | ?------- | GREEN LED on | ?-- Mismatch! | +| | (expects RED) | | (not red!) | | +| +-----------------+ +-----------------+ | +| | NEC: 0x18 | ?------- | RED LED on | ?-- Mismatch! | +| | (expects GREEN) | | (not green!) | | +| +-----------------+ +-----------------+ | +| | +| The OPERATOR sees correct logs but WRONG physical behavior! | +| | ++-----------------------------------------------------------------+ ``` ### Real-World Example: Stuxnet @@ -990,7 +990,7 @@ Our LED example demonstrates the same principle: --- -## 🔬 Part 16: Functions Project - Advanced Code +## ? Part 16: Functions Project - Advanced Code ### Step 35: Review the Functions Code @@ -1049,28 +1049,28 @@ int process_ir_led_command(int ir_command, simple_led_ctrl_t *leds, uint8_t blin ### Step 36: Understand the Function Call Chain ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Function Call Chain │ -│ │ -│ main() │ -│ │ │ -│ └──► process_ir_led_command(key, &leds, 3) │ -│ │ │ -│ ├──► leds_all_off(&leds) │ -│ │ └──► gpio_put() × 3 │ -│ │ │ -│ ├──► ir_to_led_number(ir_command) │ -│ │ └──► returns 1, 2, or 3 │ -│ │ │ -│ ├──► get_led_pin(&leds, led_num) │ -│ │ └──► returns GPIO pin number │ -│ │ │ -│ ├──► blink_led(pin, 3, 50) │ -│ │ └──► gpio_put() + sleep_ms() in loop │ -│ │ │ -│ └──► gpio_put(pin, true) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Function Call Chain | +| | +| main() | +| | | +| +--? process_ir_led_command(key, &leds, 3) | +| | | +| +--? leds_all_off(&leds) | +| | +--? gpio_put() * 3 | +| | | +| +--? ir_to_led_number(ir_command) | +| | +--? returns 1, 2, or 3 | +| | | +| +--? get_led_pin(&leds, led_num) | +| | +--? returns GPIO pin number | +| | | +| +--? blink_led(pin, 3, 50) | +| | +--? gpio_put() + sleep_ms() in loop | +| | | +| +--? gpio_put(pin, true) | +| | ++-----------------------------------------------------------------+ ``` ### Step 37: Flash and Test @@ -1078,13 +1078,13 @@ int process_ir_led_command(int ir_command, simple_led_ctrl_t *leds, uint8_t blin 1. Flash `0x0026_functions.uf2` to your Pico 2 2. Open PuTTY 3. Press remote buttons: - - "1" → Red LED blinks 3 times, then stays on - - "2" → Green LED blinks 3 times, then stays on - - "3" → Yellow LED blinks 3 times, then stays on + - "1" -> Red LED blinks 3 times, then stays on + - "2" -> Green LED blinks 3 times, then stays on + - "3" -> Yellow LED blinks 3 times, then stays on --- -## 🔬 Part 17: Debugging with GDB (Functions) +## ? Part 17: Debugging with GDB (Functions) ### Step 38: Start OpenOCD (Terminal 1) @@ -1092,7 +1092,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -1160,7 +1160,7 @@ stepi 50 info registers ``` -Watch the call chain: `process_ir_led_command` → `leds_all_off` → `ir_to_led_number` → `get_led_pin` → `blink_led`. +Watch the call chain: `process_ir_led_command` -> `leds_all_off` -> `ir_to_led_number` -> `get_led_pin` -> `blink_led`. ### Step 45: Examine ir_to_led_number @@ -1213,7 +1213,7 @@ quit --- -## 🔬 Part 18: Analyzing .ELF Files in Ghidra +## ? Part 18: Analyzing .ELF Files in Ghidra ### Step 50: Create New Ghidra Project @@ -1246,7 +1246,7 @@ With .ELF files, you get more information: --- -## 🔬 Part 19: Hacking the Functions Project +## ? Part 19: Hacking the Functions Project ### Step 53: Find LED Pin Values @@ -1268,14 +1268,14 @@ We'll swap the red (GPIO 16) and yellow (GPIO 18) LEDs: **Before:** ``` -Button 1 → LED 1 → GPIO 16 → Red -Button 3 → LED 3 → GPIO 18 → Yellow +Button 1 -> LED 1 -> GPIO 16 -> Red +Button 3 -> LED 3 -> GPIO 18 -> Yellow ``` **After:** ``` -Button 1 → LED 1 → GPIO 18 → Yellow (SWAPPED!) -Button 3 → LED 3 → GPIO 16 → Red (SWAPPED!) +Button 1 -> LED 1 -> GPIO 18 -> Yellow (SWAPPED!) +Button 3 -> LED 3 -> GPIO 16 -> Red (SWAPPED!) ``` ### Step 55: Export the Patched .BIN @@ -1289,23 +1289,23 @@ Button 3 → LED 3 → GPIO 16 → Red (SWAPPED!) ### Step 56: Convert and Flash ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0026_functions +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0026_functions python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 ``` ### Step 57: Verify the Hack **Open PuTTY and test:** -- Press "1" → **YELLOW** LED blinks (was red!) +- Press "1" -> **YELLOW** LED blinks (was red!) - Terminal shows: `LED 1 activated on GPIO 16` (WRONG - it's actually GPIO 18!) -- Press "3" → **RED** LED blinks (was yellow!) +- Press "3" -> **RED** LED blinks (was yellow!) - Terminal shows: `LED 3 activated on GPIO 18` (WRONG - it's actually GPIO 16!) **Again, logs don't match reality!** --- -## 📊 Part 20: Summary and Review +## ? Part 20: Summary and Review ### What We Accomplished @@ -1322,49 +1322,49 @@ python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe ### Struct Operations Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Struct Operations │ -│ │ -│ Definition: │ -│ typedef struct { │ -│ uint8_t pin; │ -│ bool state; │ -│ } led_t; │ -│ │ -│ Creation: │ -│ led_t led = { .pin = 16, .state = false }; │ -│ │ -│ Access (variable): led.pin │ -│ Access (pointer): ptr->pin or (*ptr).pin │ -│ │ -│ Passing to function: void func(led_t *led) │ -│ Calling: func(&led) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Struct Operations | +| | +| Definition: | +| typedef struct { | +| uint8_t pin; | +| bool state; | +| } led_t; | +| | +| Creation: | +| led_t led = { .pin = 16, .state = false }; | +| | +| Access (variable): led.pin | +| Access (pointer): ptr->pin or (*ptr).pin | +| | +| Passing to function: void func(led_t *led) | +| Calling: func(&led) | +| | ++-----------------------------------------------------------------+ ``` ### Function Types Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Function Patterns │ -│ │ -│ No params, no return: │ -│ void leds_all_off(void) │ -│ │ -│ With params, no return: │ -│ void blink_led(uint8_t pin, uint8_t count, uint32_t delay) │ -│ │ -│ No params, with return: │ -│ int ir_getkey(void) │ -│ │ -│ With params, with return: │ -│ int ir_to_led_number(int ir_command) │ -│ │ -│ With struct pointer: │ -│ uint8_t get_led_pin(simple_led_ctrl_t *leds, int led_num) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Function Patterns | +| | +| No params, no return: | +| void leds_all_off(void) | +| | +| With params, no return: | +| void blink_led(uint8_t pin, uint8_t count, uint32_t delay) | +| | +| No params, with return: | +| int ir_getkey(void) | +| | +| With params, with return: | +| int ir_to_led_number(int ir_command) | +| | +| With struct pointer: | +| uint8_t get_led_pin(simple_led_ctrl_t *leds, int led_num) | +| | ++-----------------------------------------------------------------+ ``` ### Key Memory Addresses @@ -1382,36 +1382,9 @@ python ..\uf2conv.py build\0x0026_functions-h.bin --base 0x10000000 --family 0xe --- -## ✅ Practice Exercises - -### Exercise 1: Add a Fourth LED -Modify the struct to include a fourth LED on GPIO 19. - -**Hint:** Add `led4_pin` and `led4_state` members. - -### Exercise 2: Change Blink Count -Find and modify the blink count from 3 to 5 blinks. - -**Hint:** Look for the value passed to `process_ir_led_command`. - -### Exercise 3: Swap All Three LEDs -Create a rotation where 1→Green, 2→Yellow, 3→Red. - -**Hint:** Patch all three GPIO values. - -### Exercise 4: Change Blink Speed -Make the LEDs blink faster by changing the delay from 50ms to 25ms. - -**Hint:** Find `0x32` (50) in the function parameters. - -### Exercise 5: Disable One LED -Make button 2 do nothing (LED stays off). - -**Hint:** NOP out the gpio_put call or change the NEC code comparison. - --- -## 🎓 Key Takeaways +## ? Key Takeaways 1. **Structs group related data** - Better organization than separate variables @@ -1435,7 +1408,7 @@ Make button 2 do nothing (LED stays off). --- -## 📖 Glossary +## ? Glossary | Term | Definition | | -------------------------- | -------------------------------------------------- | @@ -1453,7 +1426,7 @@ Make button 2 do nothing (LED stays off). --- -## 🔗 Additional Resources +## ? Additional Resources ### NEC IR Command Reference @@ -1486,7 +1459,7 @@ Make button 2 do nothing (LED stays off). --- -## 🚨 Real-World Implications +## ? Real-World Implications ### What You've Learned in This Course @@ -1526,4 +1499,6 @@ This is just the beginning: **Congratulations on completing this course! You now have the curiosity, persistence, and skills that embedded systems engineers and security researchers thrive on. Keep experimenting, documenting, and sharing your work. The world needs more builders and defenders like you!** -Happy hacking! 🔧 +Happy hacking! ? + +

    qr=F2_RW7JTVc8EtyI-l2CMv>mh` zbR2Z5WAgO+Ni7J;f7!(XS~k9`{9cA7T}A0b)o*$d+8EbN&M~}B~hm3B!=h`Nt5=u ze;QIwwHMLs98a6=1*67jG-mY{HC3Ck_maEFWl_7rl-A{P=}(UEk$iH5&wPJ!xm^B{ z5kq-7(T`S^ds3l4rGFW{t6Z)fO7?I#Yo~X1Y4qM0J@h56R>C@k^tPe5&E>Rm)0AW_ z#rU#PFW1yDqY$-PN|lm4PF{3cJ>$>Jf2Vn?D{fe^a$0sue32usvio<}{_3l`n=c>A zs+zv=2zm8}8sGHQlC37s;Tz}MwfwJ-&$(k`*V)C|Ciz2AQp6(<-$*)BEK!?~k(!p9 zCfd}5wRU_`s+WA8Ue_;>Zh;7U$u}_5%mI5II5o}g2b(P+rKNijB9HBK*hPJaf7~g> zCDm!P?K#~!eK|tTUeb?LdYNPlD0`F}mHkRFpxmgW$}~55jxK?Xy`Cv)Y(Or1_G`sLt)vZT1+B@om-xvoktXkLn{krs^i2Jiy=^l_jSEm6a45lM8?um3Y8z^G+ zNk=&R##_hd6<6n0)@T#fUA=zuRD)DP8`+p)_VQi%LvfD6!{0Feg;XVGeiG<9ys1wmbh3IW#O;r|cDsD-=MhBafqSL0`rc@~t zlFzlAk~~&_(TI$Ra#bbb*;E|X4UOgZZcu;&!p&yB5O&0Womr)>c;T&t6DC@VfRf@%!sXS*Z zpUtXAOl)k3{y{1-AkknzY(jhtU^EjCp=7&8Eyl+g462wO&7g*A(vs9r^{56_g36S5 z=brOpnHft%xd(o~Z^meE&4QL)L`o}Vqv4lnc0b|Xqs!Im)B6nNDf7nVk<{7I+ZqUAH57I zBp%uHvYkR&iG{@tBpz;h+0Ix~@%fo~#t64+3~`+>lzZBGN6O2I!C3BMe?H2*`9#x85dZuD+ zy(F0_6l*^|e+gwrM`Ti>GKXtbQXr&cFKu;`%cu}zOHNW zx^;`Y)}`LIWXWw;ZMb?J-BNjf+mc^&c0Rqh?fy!szwyD3K6-Fg{~s^8;)+XVTye$d z7qf1-VYbxX&UUNrl5>QBa5G|&gz`Pm)6XPbobZB1e`!_{7=_p?YMNv7nz zWI8pSb1+9vjQkCUm}X|a7MbxuAW(&x_b{(XwX*#R7MA9eu zOC(*Ef4{_S^RkGSMZ9jC@gXbGSqFLItAYjn)&^_4b=a!3O2$%ah+Zefx$@j< zmpe^O)6}|2l#rZ| zk{~JzoDOHPzR)4$rxrTMxR`7QvBzgSgd#(UgXld8ZU=H=a~;H~wK)*4gWkuck}>tn ze`6EHctf;5Ba?wDnJ*pKtQ_^761W@b&9++&*0Ipb7B(qR8anDN?dY(lWtZI5J^EO^ zUz#@Z!TQFs#oggkWZ|_XIotZfpAQMP@`8f$q1$WL7FXQAaAr+OR$eJz6n#~hTUj>i z%=^v^Z`D;GkmL`=Tg3M;9&bz5tHu+ve@&O@Uyfy@Gp956^6^)bbxCV-t{T6`v^z7_ zV|$JOE`U@@+Ju}^A?8;CP0w*@5TdP;PU(sF$2Y{c$9Ko~#Vg~VqpeUvMQ_;YOe;@$ zp0=V0sT>x{gS&M`uep#EhR7#7C#-yodzP-~G(6*^Z=@~iy8B0t>CgG^Hn%r1f33ii z@1e>hXGwONJ2el9-jqC;Jn4BzE>6fJQ8U0=xy^;hER&pc!E%fZcIK&bNB#V=O~o0w zOYbNtP8Oa>$WO~JFVD|4nc`GQxp&qt*tYiY3#%FmycS1FZdG1o;Q9x4|9I_VTZ#Iv z*89a<($cExpRV_(r1MCQ)I-r_>hSf2RAa!QYb@kByIs7nRx094A#84GD%sgP^q9EHPU_2Dci(lz!XLcam*puh$gd#wf*!l>q_0mjf6BCx4G{H85vQlQc{jr8r3| z#Y;L#FBvqdp~0#;lagtd!JL57VgF?FfQ4A^^%3 zRLt=~TGcq_4}ZlXm&2H-KNLe^m_Jmxa??frkgIpqj1iySH*(%5V#{f+R6f46cDcB( zN?dFojxBx+Y}u1j!2Fr4lneVb;svSBxk064TELYs$)8Z3??_8bH>BS>XTyAH`3nbcU-Mh031oS_-+x8cg-523_c&G_zVWW1hktLg zIjib#toJADmKZbhi=Cn6cRl)4>786BCKNczK-hOoMW?tQX8cu3k#tg;WRjdxwxm&> zHz(D`i-x*M9%Q?raLR+ojtqSyv*E8(rA93c$iJWGyLQHuHBHh2Ot0YM?f9AZzcsj+C1+j^TiG2J_d^nYBz0^mxnbg_$~$a#dA1eaRq}Y%tG3tt zM?I%Jae20i;`-v&;;U@yiO;L=$#=6OR(0atLw6e!EYTXrHqfHuD;q}>ko(FCBd461|@Ywd* z_WGWyJmgW>B(1@}+(V2GtF!7SxZnCru_DeFR~c6&*z&a6Ni9;L$Ai6*?vdhBDF28R zAAgb;`MT#7K~JB!pi|T3LAD-5f;l2*J_aT-P$^BH?e#G*kpX|DuUM1{Z4<>3lIt~j$Bj#+6%!}2`F|22 z@};DOwb8oK+HVzAR$>jw!GYWO>FgY0brDJH?>FR?KX%@!iR*xBtN-0~XrUT+o7=JzkZU#Iy zLyX@hall%h`JjbN(D;mqK%I%jH%jq3li$Yr&c+TPQyN&ni|*$pJJCQONLhkqw0r;OckX7f`Hxuc%@9j~7EJIHtj>&bFUs=uDiKQ-b0 zCC^S7&-{$N(j`^hGf42G?=h6&gQPrVT&AajOen~&2tPmZi=B+)zT0}2m_gW=w8eYH z{jlPslp@7QnlXPtd49E6t^c;;$tG>Y%7ciL2cczFAznFVXh5oCE`Q?Jjx7;2!grU5 zrmXr4y%gp7<>DBJIcpkq$EJJPGLNn63N@0ZN3&7WuTg2z?2!dqW&(_Qqs3Tgl#GqW z9^*!1zfn`jR&KT((ao{8$RibhZiC-H<56(%tqi6&Z>TAnv4 zbw*xOYFpmo)Ma_Y<22)>$4APc!GlEXP|H8Iq%X7A7cV_2|8<+d7e$q!LiG;|^ z&n&nUr&E6aD&zdO5-;!zna3z4FyB#e{;P@?cm%1)%d=FJ=6{9gds2!iHPK{BO(l7` zrY#_tT2YFPCSnT7At|k*)MU#`^`_XoR%;5)&C6p3HO<4xgF6%B{2Uu&{U+9%mfYOH zxSnwv#|h)4i9YYRG&d}S5GgUvPb6ckpLcnhPN$cOO1x&i;E)nhy<3?5b4gc5?!dU% z=8k^U6KUy*A=)Bo&8h}fJG*I-#3;@mR>+Q#)# z0WoQ^6;5MJq67N4cn3)q6CFsU@eY!pHaLh*YjBVxWr_nPlH$1NMg-gXB6={F+n{Hw zDhL)-Pw;isc06nX|DQ0hbjJ|F`&D^PDK{XivMYqJ(g~0&RSe+jrE;n<7iCd#q=dgy%w0~q2W=I*08G($RjEx!n8QU{7{TYK9 zG$SqF#TC_VfZn1n)JytCeL&x%-^iaVi0Ri4>JRD#3sYKmh)jvvsopU|^<`Td>kQwB z{}{Vj#Fj&&24gv4>z&BXd{$a+R;D@Ak|`*2({dcdY0Ytvap`#ulAY;rjO|16+d=_ z(E2%3mq+(^zY_N&9}}ojT9}kVt=pCpKG7z>awr4KkDA?{*7DL=l+qK7O2@$ zg+{*k>ag3*-|suW@NG?y;^P0uJ(deLm(8C18_cBHOw7zU*_>W;NDl2RsbKhl-JW9a z%Mp?!)y(#qug?EP{{DO+U#cn1x73y9yGTB>_W5p4WY5m+DPZ?J3kuY!A^Cxw1;t(-FR9>IO01df-Dux!f7veBhZN zIHr1o8H$X5R7@x+h;Cy>UBdFF2^ZfV(tp`DGV1Cb>E+KsM(rVcQi(f)P7d#qOJWF9&T2^sMQ3+L+rGI%Hq%h0tAf@T!9i$}F<3N^~-}NDp8xgDcgBbtA z@=wJc$%@_rx6_=Q$hJ7w$2-642^~Cgyr;LizF_7|Q+`$bm0v&d`u5f-msMZ0?yuy{ zaQIugd3amk!OHU1^7VT2g#2=H{mh|sM`KRKBKCru{Gr$+zK1E~x6kIJI)9we?G(Gy zOH%DlZxP$tR`O}!p%89AzV$y_Ei+|1OO=lq0;wko~M?ghss-@!ptL$6A+ouBuk^w zc=WO~Ga6|mS(Y@iB`1#U%*n$sHY7HLG!H(J6p}z7ZEW8yuuzIqO0r8}4Qwfp-b>QG zg%s$$NlgGHv^UwZrDeMdc8}1ECV`KQARq4|t%bO6`1(1rnfuL4qx$)}bI9lVa4z zu`@9$w%7sen*CL~#r{d}Ge@9iDyz;`hHGqXxHgi_8cM#}*~)NNZ8$rU&DMs2UYpcw z6}>iGAqY^tP$5+d)?j6Ep@KuQQLrRU5dlf=gn%HJoMKAFz<-b-PPr5o!qF)pSPe!} ziL0mfPa6 z^Qobm|LPyte6J*Ndf&bMy1Jef5lVHa%LH#&T(`gS*KaF{l-{?uUk~`U3To+wg=#PF zS=|5lS026Qwtox&aOU9DV>WeqD`)@-)ZoZLXAS~a*lP`Ws<8N@r}1K*WKV+v!C0_h zVm_T}ef+b%L_f2&PhULs7*0p)dYSbz?^qwT8~_=x0CuBtvkhu_XlobRm3F;Z&+0AR zxvzM>?xAf`qx6XLCHpJV@9dNI^X*OmX0NSX_m6z6&wuCFnis?Y+?9cu<^?4;$KY99 zh)E@u8DuELj4~7>Z)|}BEwH5}!=qeliQmGpa?FuoMoX|HTU`yHO07LCZ;Zn@L6JC@ z9uIc}c578?4dNVlc8U(kq2Wwrq5iyyC$F5UnK>O+N7sgRosb`17UeeREOxhSU0+hm zVsLq+Hh(-~l!wgB@n>@zbjD;|7!y2ZOz;@D{Y6)cf3N{&eE~)Mxx>3ghHyg=*)v_-^2~G;U3Q z=C-@skn7`Crq*+B^CuG@^6w`c;ZTDc*zEpLL~u8-G#i1DDwGe$!R;AOmHOjhR?ax+ zDu3)pG-Vg$xXZpORwW|M@=)wlj2eu+7NcU}oSzKdkP3k+shT>ZTGdd?ufJ{#-Z0KH zr$;K;m6HaZJ2lBpvb75Sh;e>nu4fDzAl8Yo69yX^n+P7AfXCp*422)OXc5;l%sFz~ zP@@6NYd@JxwRCjko1=}v{FUE$@Zb+#8h^b~`;yY!UAcGq{KxkkhKUc?JY=~+(fhvD zzc|S4h-goL^R_)Jj9RM}JVd zL2=GgpaN*2nB}3jP>~%YKKGNy`ncfFOu;m0F9uUR8D{&_X z8>Pm$Vv~7MfsMlKSv=?!SOLScxr9PiAut9vPzUnoOPZ|RN*~hu&#ZXts&}VP!}RY5 z_g+rcnKHg}bbS9q5B`nK_t}r}dTPxyL)Xt=gKDujg9-M}_uh5r(AS3_e18y7VCl?+ z^(M;!5CsYNUBpzmD*r;{=MifI#w`1qVx`U0cK+w~H|;0*6QOtQ@A2=2{*5|k|2OV) z{@=w<6>qz}*G_TU_-(y?ghEy&C)KnG$^nwBK zDzMC8jf>k`0>COGqVvHBnk+c1GV6*}sZHbHRu={=l@&T^FIRDU9J!T5>68n)!fN7H zSfw^0-j9^B=pXV^e$?PC`9sOR?PR)Su{)k5lA~;PrKxVqW^u_hOS?~b96 ztj9>jpEg=fFFK{8J3oCA>aX4To3_ge(mxj- z-FD-n8oYM!x+1@*C4b$NTn2?-o`BwUZT(-lV)HHQ)~;O#Ab1!6>tEY^pbf4>vLh0R zq#_F<*2h#xd0DOvU^I)mw5Dhzr0@X-ckasTwO|_@}g1#2j0Y%v>XN8=3E=toNH-egMV5O1qXwhf}=ru(C*z# z)6`}s1G3sVTNQqQ+>)%xlpHQ+p$}q5B8Az;+uYME24Qxv``Cl*G1dy$LG~E?Dr;p! zr7DC!s=N5?%CnPfSIv~7t(=@BUIa6}c$3Z)KB(2|uqj}%m+2~MU<4EXUtA`%nTgz- zMz*ohyeqW@CV%FrquZ~;_PSS&t(njlX8h`1*KJ)1y9k|hY}!+=4dB0GyK2{u#Dy(| zPDiLaw~8c56j(Zawe@c;Ph$lsydQOVQdE(0xC3sPD{@P@s#ukOA^t-CH1%oG#YV)W z6e%RX<31~XCjT+@S@vx1T+x-nUcE?sJnhv}ql~Lm#D7q71LGFPMVnqJMaOOXee^;482u`3 z#d6$Jv_+%~^Z;$4!)=4yCXV7>Zow{}7o`DdqqIXBl5EE$D1}=4ZkQD+pRN$~w^1HW zbxmTGihtfUsT&0$3CaJF`k0 zNI|h`O{xMT;R`&!Cy`DiGm0&pP!*U2=DB%pzg&0wKCEl4PmI>~^87GxfuQxWGsM?l z^W$6I!w3KS+8dYO-~XHG(=hy-Rrl)$zV@{P_iVt2Vc^z`(D5 z4FkF9zTqdI93FY%2^{rD0kB?f^8pKJ0xuoG*Km5))v%btL)qwRSUgBW3}I7s*qm=X zb}}m{W(&LiRja zSiRVue*#BRoA2bw={u&DT)2<`1U&#)AG7&D(e?-QJ>dV6|2qHI{GT50p^@ zJA{40gkae(91uOTV0;0+<)sRYJ9P% z#bpgO;XPZ}Tox+3i!j9B!r!7<{Gb@;WhJi_nKt7%uN7$+(vCrVg^urlBK$J`mR{=N z!yM-~T&9PiaSQ|WCPN`;kbShtHsTgBZdRv5t?{_Oc$E4h0PqtO@=Gy!b0`s0Hf#Ts zr8iT|W*?8a2>vMi0QjjVk$;Z^J`lEt?9EJ;fegjGegys_2x9HE@pE=EOGMbU8vbLa z&iXnE5GPRCtf52g>S9l`=W8DUoby0mpabVXS?BJ2)^;cRch=o`OibXzV3ut&N!-ft z2-{YuWJ#ullPuJbP$W4XSBgaq0C_j->~eMijPR|mGa5YhTM=UlyMH346NhzKIHDT_ zy@={etT$wmww{2_BX3COF|XQ$mw`8Aw4MM?-bg=Y_M>J$YWCA+KW+9^v#*-{l-W<2 zeZ_of(qb|fzXiXS*Hd`x6l~(en2*CPihBaOhTk}E7&otL#EiN)oyP`0&9g2JzYG~| z#cbmksiQH$8?W~~w0~FE;qS!PU-H=z0V$+0;icK1u6gFR^kNp4nSwE7k0CUFROuQIx z5OlIKX-sFw-K;KQaYDeO1N`Bcv^r^qhes-)GBPqeJUq*4&41-(z6E9&HaAYsZlNZ- zG*a+?ox#AZVt^a_LyP-Az(*aQ!U2+$ebleVPr^0R&k)4+RuYF-?#xCE(CY7}PZ)tF zr5*;%Aih0O zome=bQ#yV|+EZFc))MV0aftSmK&fm<2RpldLhZW{Yk#OS!d}l3&-`39_#ZSq4rUGQBy3}T!xON zVVP-`t+z6crS@{EluR}<4IXcmTKil;K&@qrN1zA}Rk1~-SA_}TV;sOX2}8oD@PJ_D zgep9Pe19=X)I>_eBQ4@F7pv6T=Tn@DTFWYaf`nRD$rGp(>c{GgYTcv`siW!xs#V30 zQSoEcDm*g|a(SGIcd?x$aZt8 zN0(vo(PfvHI!CX-x}(9XOP%PNN~trnOgD>a^M7Y#xRSm6s&&uq=!Bg|sA;f_JzH5% zV#WDvwo)-%{&On!EcneoD?~|)8aCt%7os8)F3Ya(BJ?*_tv@H=2at~|AVhTm-%-GK z6!3p2pt^cJyPmv6*HqUmYp&x|(npZGj-KV0<4fi2qxSV2N`HB|AuGo|qf(DF4kOaQ zd4G|{q=yY2DHwG&G$q~12px-pXw2ydxdKrbb%vvsU_&?xN%eqVm+WjaK>!_p+6{sp zAH{(Rn>g}vi;LLk1is}K&kAx3(AQx|i=Zhna$tgnkC6U2A2HxWFbweyR)ZKIR|#nJ z)$0v&-|z+fxvok58x3r3y|SEJ*IfQe$A3ugwP^9;{+HrPJen+%Lq$ofD5C#xfJd+j z0B`rO+_$KhY-wr9b`O4Yy1Xct>!5ZQ5?rWf`g)_2Pv({x$40)5j{pR1Shr(20Lrix zwb|{0{gJ3;f}Rj5de$E-T}PAEZ}L}Y&s>-rnCLrL2>!eY%Op-1xR34%a z;u6+NLpr=521Jss<@2KjC>CHL)IM;7i7$}LqI8j}b=ET*)3bKAc7b{W)@PnE@roKG zx`f7yM%Wy}Qpz0Iz`PhXH?)r|+_;r)KUt_25-0qxPW z;SCQ>-#uF+-MvgqFIYc)w>P$^t{69l5m4YuGZWT3EC+xWG=ZO@YhR$M_BWW5ojGEp${Y0KLp=sdY^jNewz8v^M5|)*c`m6 z=?U8b`bpQ*4L|TYwozN{TbP?YH*uQlH*&VeYVhw-1O1c8-Gg`n}SNZd>795#(aj7MYH&O75?+FU^uSb;o--4f>R zdaGbu9iooL-f{Qz)cyC(fPY4P-~*a`6u-O=5~tztbaZr9P0}O!LCGB zj)u>LZi_mC_EtH;&`wVZf69s`A!$&u0Ev|(>6BzWBta?M9=San4uydFuUa8b5|5B6 z4tdpt;vM@i6kopn>n1v5)CH%Bl5^64X^1KWWAbMw*&6#1agHW9128xfz8IW|wUyG% zF(sqM)#g}Agl$SngnwxVp4)B_Agb}Gp~l~1*ig$n9yY)LiQ zG(4N&jdu`bz{B$r%**y(`CFJi_|OXjdntbT{Tm{H-G=<@bn?F7<2g!3%TmX zilR3C&(&Xk>#KSASJ`{k|CfQjtG>GzK(HMEGTSonwihG_AGJe{Bw)#KnPK}`>L7d2 zM~TSlnbR!V<|^@vklYLOk%D#Z`-m^dOfO+pL$N-0gOl?~xkAZ@mh_f4mvkEhn)5YoX{E0LI8Xmo^if7 zkTJMBC~uO7WV;+{o`>9;l+P;m^hkvOMk~o>3$o^h;H&`!UgTc=*u54tV|sX5%ED3} z#pbp66u|l@2uT1Z6R0vwN>rZ38HW!Wl5zX6F;tbcDNn{tRd{u7um)wT2CC7Z8B z-C6Z&Is44$1u!sCjacp*tt{?uEwyxCv3>jWFE0YE00fWBOjx@t2S6|Nx2Q~W_Hu|5 z%3HNv+IO_?=MU#!%D+MXj(MYantr!<)_uOVlOT(}} zi~(NgRDTwL#hDerUI0oWT`sIB^zJS`Qv4Lmz<*a5&gQbX>4IAexOjIoD2Bosx9A?% z9__cTw+f!q9sjiG(}G0`KrIolwB_9lux1?zS#XCmDlciRB@G)l-a(#kEiq>6HU#L5 z(U7z49md)A4s!O{!POgV*_x>vsS(n$He8v^;{9bLkJfAWA`^GAe`iRU zxDM_@tvk-PeFpu^1v-Wa(~l=>nC!b;hRq6WdazlJP2Aknm@r$(Y-NMrZO}EGW)o2a z9q{OdxHp95MDNT38wS=u+Pd0ZB0iJx;eQwO>Al#jz^2FCp#KG>J;X2(CcxBLsR912 zOIT9#g)p-^7-Ktl+1TzDXrH%#Qnf5^{c6{(E5v4L$3F~i8~O5{ch*0md*hte(UDKK zdJ5nA(*3KF~jr;U?{}rG8s7JKINv|NfJg` z&QDn_s+EILK>2M^U|#sfXI}Sej&)Sa7tvO8TvaL3y#2r3(-uv4O2z4k>yI5HeyX2% zr8`WPYRl3_d0DtCn~oL+p12LZgijv90Fpp$zvqsaSbJ<{!upuyK9GS<6ldZdzfON+ zkc#nyJ=>UV(s{|2@htRwL!E#pyzhDK^=oBavVq<}jOXIgg(-f#0STxP@yL%j&-eBk>@atTwWvW;CvnjrumWpJhkT#Dv~YC zUUb45###DH>-Jx^<=a`&NE`Gei^sN^5o2lzPR$GH^qR}tuY}|ypL%>rcM-wAsYeX} zfc5v5`#>DN_Pmz`eu~3{*b6RC=`{d3Kk=Y6y>wk%!WQCw03WfWkLY=qExUiHs-mHh zOvv##sDHS4lxS$=rFisyV%$FWkW02q9FFxtK=5>zkL7(J?qlOdpX2;IhuNU!ohXf?;cn*wuX`Nh$ERZu= zK26$L3;#c8{fVv(5m;t5S}pc>8IY9ekveJbgBM6T??-M z6u#^c7a5tx)Dr5Lk#%&$y#E(7YDevt;eP@Xw+}x9`2m;CfdUMd6hQ+Zf8V&wxFAgc zZ9oMT7eq!K_Z4(-88wOyI69Er$GY8N8=ZHa=l$pTyzku5r>ah!dv8^pQ|FvIRo#F9 zFkmql=8ZYMv|{$OXYv5@Cjf0{3?1EE(KR|B2#y7ew@jbYK2LGG=3{`q3gE5j7tRkn zk~_n~9{{M9pFQuKIaB`7Y@Q3Ks{rLI=d^duLkt=KM*xWD%wBl*YKYSV>^8nP$oH?Ui`#22&f0TaqT?)@YmE=46kyqT1><7{eDD5#2QC{<8F_?7nR<6qe{x*>mn zBm(RT;mh7Dcnj${N#0=zVAF)vd}Lq+(C;_@Zp7#Ok61}5DJ9p^hv-A>DxpPaQK*mm zJM-i}WmNf#YMc52%_rJRv`nxZ zwEn?%iTz6Zcl^&W)cK_AW%q5K`JR9I-hsYb{dNAsfgeI|hu+T1&CAVuAn$=l3jiwf z6tHBuX@P(p0OANhfF1!9q8MeUL^THB6r75&n1HF6g?YFL3vnqf$6BmoSMbq600oGn z6csY{P@Ia>FdkFUj@h{2L~7};|H0pMY5I}1zacmO<`VYcoa6HU545yZ*h7DckCjPG z*n_Rvd%qC&;PY($QDG0B&*pdj_OnRsf6%sjg*|8%_Tau>+qPKPgY){{k*!~xO-qD5 zm?`YR#%!72vqjj0mBJpJ{vVD*U%E=zgW_x-uE@UkU11L{7xrL+um?{cch5Fq53Ir- z%og_GCVt;>{eMl^gVn+wO#XkBZh)`{wb{B`v;FT&Z{f-flek0)8i4w6M>bDj!&TWl zMK0!N^9)H;W%I&uGzvK2$>x>t0BFEmEWibrg&DX2r(p&z!dRS+(P+XMGOiP|Fc;?| zfEtvb4pkT}m*-+W7GfS|p#Mov31pwcrFS%DVLC3rTy$bC&c=KcVmyCl;2bQ#Y_#Ko z-?{f;1WPxtNEA zaxXIP3LNbLpX&ickCuP>$+}>?Jcs9DCIT3NcAPIiV>-^u(vHMj%#=rc1Qy^ddGs>< z;$tyO?#t}oZO_^Acmyy6voH;_Wo)}V8YlKK^PIWao(AN%a9&K8``gE{i)21=%mSQ` zv$A}ef0QSuph+H`S@M17%i}vhzJG>HF#~fjO&;yDWEjY{sE>a(Amck_IpKP6{!xkR z>j$r&k9N$$Y;>X|+0Z@mNt|L4Gun7Y+pjexKLl zb~zn(o7G}A8AU^Gj$WtLs8vdZz$ihyF+8j-kczgYglKrgh+{J3!HyQnQRZF&OV7UnW0P`r6gjY9`(iXKw~(N+A}m9NRvt9n!|zAilO0_ zK&o5LkCyYR)91jE<9W#dpQlu@=m>PEB%%zQOLyO~NgHGEJZkVAhj$?yX z*AQ;d6~~dXhv#h|_CZ9>P?Ngdl zti6T5!x&51!$VW{OZGdC6^r93Q$zFh$Je^q(niOu052|GdVL_Zc3kuEwLuPBS{%jk z;&_TihP8h!9hOSAFCS4HA9Z?QN^^={+tQpO*R~YL1H31^SDF6J2sd&}+qr?1COjlO zbLqKl?SYhQX$s>P2D@CYdv=8-cuwd!Jj&xrS^;pL2X>#?d-CCzJEssPRWfmhcvZPf33z+fsq)ffU9!hf_3C%fXCVES+BK z4)Uvo6vs!U&KlR;I4h-TXj>}w=Xid9N)Zvmfu)C#B5mRBZ%@RuXEDl%cnCbp<>aWS zrAT{UJ{60lii)_1s2WmA-h)AMxw<%hVVceg&l3Y_I;$~|!r0~%X>aLY>L`u}gPg(3 z(n)_zD~<eL1sZ9Ej>=1TI)9?pUPu~$9$E)ZjApyNtOUtA+ z(%rv$s|T64=Xt4Inu8`xKpPg|GAzPk+>1S=g$|_Kr6n+;88fg5PhvNT2@u*~!gx%; zHMj#?@C;tVd-$9XVju-%F?o}`r9jWl-ks7Z(lmc*E*fzf#$qus5HE?4!E_Rv#MZHQ zd;Z$HPx8TtCR~V%aVb_}6&}UAcpo1UMzyqwPGIZc#z0KMG~9%naW5XmF6v#k2;s^8+Mw}!@CXgxQa&j%Xk=#Na zB#(cQ$H_NTLEmGHT`9aMeAD}mq?PWH9)=rkc;uC09JM$VbFc?rlLAsi;v_--LSr<} zh@kK3?X8rCON*ozq<0ZUK58)#L(z!Qn22duh^w&;FJce&;LrF1{~&}gq9rEcB>@s9 zqJukf~^S1`I zXut%tVjenWj%~&^yny}q8x9ddl*CU8$OtluOdxlV$H-oCgo3K+74$JGv4LzA+a)-K zJ9?=VO;zF4)T4)m%3YRFLU`m_%)g$&Jb9$!r+|~1ZZ%Oaa-t&5w^*-DC zPVZ-uPTDSg4kgM^j~1MRPF#*fxDJ0e;yyf#NAM0l#h3U7Kj23kB8+H=i};9N=34_f zg^VU=kcp&)oK4OqGs(GR0a;8QC0*nxvV%NJc9GrWFXSWgJtfpiOK1rlKnKzZ^lW++ zy^B6dQ}liMK0QQ#VNn)m6|9mCVr{I0UC(Y{H?!N>N9=Qf3Ra<9I9*sIyrh3%inA2A zDb^@Bzhff!$agL9Ht}4cyb}z zL)X%&Y>lv57)0L1BKoWVnnQnn!e9(0gUG|=O?1$AXfaza{Fy&dp=L)Eb7+oqz3`=i zvcCYrKtkCoWD@BnW2uciO9s#z5hjy}NV*Xwr=Sk+V>GsqiKrF!vE_6m{SbASjho4{ z>{YrAv*|YS2mFXy^pXq6SaLTj#}%XlO{l}U^cIBZJQ~7fn1H{NtB8LU@8U3dl;qK~ zA+Q`e9dFSV)Z=wxq9x=CRACO5k)?=}9=6~4qEoWtWZ%9+Am#Z^4d-ed=*7Ae>} zRgv5K5iY^|7=aJTGHk>Md_ZjEOfpW8=qN#w&cLH|z3`D_CwdaZ8&VlLrFS!_CwWqU zbVxcf4%gvK9#<5W3D*h>gv$WwFfPS)SdF{z9NxwQ@F5>{I2C_Qn1X4TCC9jU)T$PP zFa$%hk*+f^32itFXXAWy;9}f^$FKoOjKTz*iD@_+=b{6hxCocx3S5Qju^czyHavtk z=p*z#7Nj@O7wCm_7CyiS>?M{YXW%ViiLeN#BM;+<8MDw2_3&dkmP>D95(?oa22zDZ zT<)cBq<5r0^}K(Ehwue7 z&bG;ztw^!0*ul2qb+#1(5-bhEo@7sS<@u9owrQg?ui}6E!7jED659yMZeq(2grA+6 zO{Zqlm24S`;Ag9{=?b>2Yk=P{Si_cq;Cr?V5?cl;?O=Cz4IfjnMb7lAmosbnFl#pU ztFQ16cCx#XVs~Q)yBn{wyCL9vb~gz8YzsUte4?h#$(zmWjIxaV`R8Uu3aSO=gRrH zay}vF6WKh6rN=?P3=JHz@$7UI!q3LBk#ahgH6j8(8^cD*>1pf~IUUW0%jv0XBpmRw zQLGUr_}NG{OfH|o8Zi`pHi8Y4)8TAb*HC}i;CX*+7^bpD?lUotABs{o6bUvIf{aE>JcU2e$U%(2nh!x^KRtN?ID@1=OD@5XG$Aq+AkXSw#=Kh*nbP|n1zT5w6sr0y~aBKleSplZ90xbG9 zzn&F9fxWCi7O{M}ek?1%N>+gF*}9M{%pqAgLm0zCzqYoNh2#p(&gy8W96^q^>jIuYzy1M3Rxk` zXZfsv6|fKsu^y+voWfYn zU?XWE6On^wWH>~I6*3IT&`TzE%3!dYTXE4!Bk{5hhAn;=Xc?>ENOU6~ZR8v(+Rh_CtRjevd<*ULfzsjOE zsYP|JTCdis)oP_$P*XM3mbA1l8RPqH7Ny7&rNE&e=S9jP&1}a}qNW&$l$nj9qfQ?} zMx}O4$Eaz6)K8~}(?mONQc8aj9zs&4Q5e-U#F6S38mU&QKvVj9`UxMDtJcnwv0*(gvZ{t&{|s4ICKl`$CH1S<}KRAw6<|P z$7>f4Z8=7V0Ih8tx&=X=$aDyBIs{Il^U;2sF2a)xolmCooj|u?V6buMhG4LdW}r+n z@I;z(PNX?Ura31|!!k6%<7ia-5R_?xs(t@LmfEk;##b;r5{|8;7?Stvlg$OZr~7p{V^g9@fquR>a>m zeBEzUujAFj`McKfcdg^^8lD_3ze|?-vCSLQ7}C-(C6jKXI<0@Hp}EZ+Y#Cw`=M9pj zc|g!{g?p>O_x^RUmXtm`B$X2$B3Bg;E*{LQ1jtpnJU*SRa$GSW=-x{Hl&uoOLsG`@ z5I7oV4Q-q?w6imt`49hf@@xK?ooC9a{I7HVg3iwQoKfgR=X^9wX&$VXwX&bCkhS$P zStE0;%{n_<=0ktxYUcv*=gsHf*yE4p7R>MLB%Q~L0Xk2OoffFvs z3Qi}9kyt0`1aD;aDf0d^Bm7b@Mkpb0D8AM0z|U$4YAB^%XrPgLpp~HxI;jVG=%pUy zKrbCZE^?$JFvw6uu5<)O7^K56$UDS8%)waVTW1zCmgUyzrYEb z^b1@vbi*$F0uSuc&+x(_{R|(R($DbAFaWpo4+Lcxf=BuX!thEzAy0-88AjogenLL{ z(jgScunF+3$VL77G-%){l=|@zeNcs^~ zh)F-98Zm$A2h<=g{eXTbmVQ934C_!L9YB8>4nV1N0QD%B4qzb4rSCBa71H-epi=rC zNmNSTVKAzs?=S?_(syW(;ZW2_-DpHVsT;#kD|KTy>ZERrK%Mk0PC06A# z0O=c?ihAiAjF#bP7$kjzF-S;XW2_9vAt`;0@fd$BeT~yGSo#~9Fhu$rCdlv%G)iA# zB8E#}p;?A47$JRyNjOFN5|d>(1tX;|(JI3;F-rOZQ*o;F1==uL`U34ZP5K0>Oy+0w^YjB})qait8e!c6HSTrINgv{R%$7dH4VWW+h$WaKeSoDnU;2Ll%VfA5bEOZk0`sKzaU(jU_puTeNbh46 zI;Hn<6FQ~$up0BF_i(ceZ@~iTUEGQbrFU_g3~$H9(!00=3#E5(rws4HWzsuXBg4CK zx%4*f!4=ZmxL1bvVUhF}*5XR(E&PuR|A4Ecw{SnMmfpkzGJFu%NN?gH8U7L1N`DN& zpKzV@7d(vXrN7{pe^~=G4&wFR(x0)H!C3=PfBz%x!fyOQdKs_Ea1S1k zUdEsCp!70c!-LXGcpVQ(FX0Ut{sn)OUc{UDlk_6qlHuEUSb7of;8E!Xyeq@^@R;-h z-k0GASSRhohj?7tiH~IXG1g1Z;}djA&toq(O3z~-Hc8LpQ*4%=!)G%5E1r;^!+sfl zjwhvO@deV-f3x^fhF@Wev;%*`HfaaGmf<&eO4@;M@szY3-FRBsj_>e{v>o5e@Bp?; z&)^5_keN%@LwH_#8b4vD^fdl~ozheI881jr;TOCtJ%xYD@Gy2s z+i*mNJ$OahhFvZk^FLipse|7qQe|7qQb^8AcoqorEb^3pG`u|lr z{r^jT`q2MPoj&TnI{n}3^p5}P^#A(l|5m4O{l7}5Q@%GVoTK2e85M?YP^!{Izljnk z1fF5gDivv>e}XaU(x^D@2?D2j%%zUlY2v~9(LMF2i9gkk7JKTEsPC!gpYpOwW6&50 z8iVHue>f6gJB}n3IE;X>1BABr9%1W+FX6`6WPYK(NTdpTu32lcDU}M*ZZlg4nH8fo z8uQxRJU|46)APz!qJV=qujOxS9o=)VUhEe4BT=8IH=63|2nXe5q?J^eO#NyqD{NMa zN=dC26F*<842SZgG)i0RAIaC}nw+Zh&ph*df0fgetB?FCNq+1kl#CDS97e7FmEQCN z5B8>a>9t0uE<{H5f{^0gBXm)=wS^k0aXG2eCGZw&OiH^=R4C1g(ORu_5O1#meo(l) z4{Rl)``Y^xZ}0wkv0HBL39YqIs#1nS(dw#xHKyt+njfvMs;R87+e|jP=r>#YLuaql zf4eTEcN(?&U1Y=q50VkD=(R?NF4X%3Z*8piE&2v2fd-XH$8-1#_Tc~oJRy+3(`WG) zgUYX>s;9^u&|(hp!VwdHYTe(nAEn)LgMuX69I}HLd*5|Oonb~wdfuxDJGFYgWw4d1 z1T$R(23Jy#9TYAFbqdoT<)W}(`~sz;fBA!~!D_*L32C9+HN4*7!oP4g4^S!35} zh%QZD-pq7^FjnyoOry}p4%@LgtT9I%8c%Y8nTuefHmB8TaVnG^x7Y1+``v;vKUxqij21-&rB1Ka zYxHWpO0Q6|XvmnCM8NDyl9)1*M6pnsBw<4^N!-q0l0^0KBuZ#JDF=s%e;leUDk>_9 zU5VQ4MQV?~8m2TStwx{OnXveb_JolGo6l!TgwoRCWYT9!Ch{##Ln7Z| z&rO6m$hX*X5@8OQ#b-(|pGlV})|zw)8_#(y&LDrtw@JG*m@ruEetwrfLA9cBkevha z8+#PI*)7B>%5y0{8qJSZe^-mL8nD}JcAKgynjg)NhC|e9wb<-7yREXqRL#D+a>iXF zuP*U68thljxNFo^CBC7et*N2NSx`58#oC6Lqo8iY^0oBC*L#1s_p$-i!PNuL=zN`s zJRe$Jf5xJV_6!U=!@c`W!gmV949SZ~qsVRC+L>bCvU)MFD0)CEN*$B+pz8LH`4`Y;sa zqbG?%LCG^}#nWUze>BjM91t>jlSZS}yVB&BO}tImMkYfCN+xeoe`*{U8Jt7sq8N5E z89tH&9i4+Xxv5V)#h(sx={(rYHClIfqF(ITFLo2LXP~LB)B*9(!JQ-)D=$OC!lcKa zXL8sgfv7d;NWvU8CW+l|NfJ|@B}uZPcIB05&B_%zNJp%te_v46f;Ou)Se@5z5Us9? zhC@n~GOH@HlUb=$LDfUAb(l?#BX1G>*wN&F{L=FuaVj->(P*EwrTw1IqLVM|eQ#@1 z(C2db7F_nlcXMZsDVY7x6|D}H)-IMkaOMX~`?q(_@BQe1K=8cunLrc@)Dq*y*|h{| z>BnScMMbr-e}CR7c_SkYwHH9SD0p4%t-{UKx79va{ZQ=|^H%$A^KQ!?`-kR_?cbXJ zX_rck{JzbWkUOu+n3g_Cdfa(cg=&K?R$yeML7&S3Mc4zUFHjJTJJV$H#z4RnPm>iJ zqXR2*(`3bF(?Df-U`?9jB(>Io%;TwJuKuN4Ne(>pf66Cy&bms4GUwZ^WO0TUNF)eX z7yI|0CVpY6D;+I%AM6HaNY8##U1_(`RL4~Z;X-Dz*BLVk#8XwB7cpA|MWia6BxZ#* zN%E?rNn#O9NkC@HmA_sj7OQRTs6}lDv1QC?^r(TVtf;B3ibgXGskF-_nMr--EW;ya zo`1=qfAs9HN(^>Uw5(aT`i1r!lC+Ce?b-LYba*(By&s>TjL37 z3Z4BOisHgk3#S&IUwB91F6W1iZyahTXN8Tkf5Pm}t8xdzYKs`iv-w@b?+xN>h`RT4m&juSWC2Q-Eo1{M8yfJ|tXtgLF`8@1da+vuTn3QUl!R-_6AH3m zmvm$UFDgRAjdoU>l8)AhF*`eh6|&K@S}k0K1~bUYU`0($b#)b&sc1Mzyu-P0m(64Y zA`aWlW_xq()N@DAnt$bwm;Gb|egVCgd}RYG9o}@n#7xebk#ikc&UN?H*Vpr0PrcaM z(S5MBgZr1nWdkUGw$0ebhof9F${M!1I(UpGiy;%}b$r;5v~!Mhba2QzIi}|!BF|Ze z$?Txjz5bthRqrOwlnkeO_j1gh-ceKKn(sKA3WECpVZN{$Rrn!!W}AW-H2Rn*dNo0} zuR0X+x+{wfW&Sc+7OSfA7E`sNh7hmXhr_VyqY{^4eC~*t`6Rs>Qb(-Dh(B+ zqNb#xqO`v5c*=2|m)E>jS9mX~2vN_YCGRNlBr&4aZNrEj6&@mJ|<6iQ#CK>B)fo-Jex+xpfU zEu^D=72Fnb6H!8|tE)`h3T9owKG!7UfLN^-p|YZ;U*7~%WSm8zv~By;>-XF^X32NU zcQ04jaygHTcA|Xa()ruQ)ewAo>QxgntRlDgT%v_^_1;lkGj>(ilDn1?#nQRu7K6+8 zjNfVZPMAI8#?}k(eB-A;0qJKqn;pb%&atU~KyV%)%oSFnfjpPgoBqf4cmKZM64l^ z7}DUa*D(1}${1BD8TD$MX1Q!DG}&xslh+xG$j>npkb+oVK|v(X8yir~Q4OdiwXv#y z+S=+W?|^W~2SPN?ifB9@3q)O!Xe{P3M_o=@KVX1Xt5H|_@~V7!4M~r`>b{2c4RmG0 z-Uix`rrVP4Mw2fXH2TVDlCGj`41Jwa1D#6eQbwPm+c1q47mt#Eqk)4{ATI*3;*tau9Kf3Yk&rRs;^Yqk<=J030u-&NtC9g9Z%+( z6SicoIT4c=ltE+VZ|RAe%09=%82lH^Nq4ZTd)}1Qb?-;=w6F5JT>f8V4ML0O`CLx_ zFC0@fwU5T>pGRwYeJ7|8yR67hC7b&4M{IrdApG|v*x!WJ@Z;TNaj8(E2lt$Hts79k!gZPYNL?Su^%lA5t`aqoP z-C{TAdiQ_A%HQJFN%}h2H?^~WXnIpdHTTSxXK$c)A5ZBmvbQ_v*kBzSOj-K^LbI?M zLCj9p8g;qV+(F^y5AeE~M)_gZAF1a42#xC8+{G|xh{hEL@tIA|(1Qz)3xIynibSG* zH1F#%`|~eWsl1FBgT~+U0J2W}+q6Vp)VA>sy!^7DyjmPPsFHxc+O1GQX+=9+1Gc>o*l$&cbd3BLkM&%Tcg2H$~K`ic#Xa$)> zRmoH;fqAtqi(IzH%yzrQ>~-b&csUfT^ag`IuQ$(4iHZ0;Zi~m`CT^Hx(MZG>&C8={ zddU-ROVsV6o;1BAsU1)Gr2jr z*)-KW*Sykvz$_Td#Oy5Yf8J43)WQ8TG2>gu>PL%TWJIh!D`NFxpPOBGeMyYRsSHGI zDM%2D(UTw+(VgIaa?ACX?{xf!68LXbNoxmMJAz^IyPATW#N4odKxg;dx`t2s-rXDy zlhwmVboLs~S5m`E!v*`1fhS7s;V;<>$E25HrnFa>DXc>doa9JS+GTjbNljnazHs~^ z{$e_4JLputWP4wH-}H{{UB}TlEjnhZPTN9?-v{ zd_}Fknl4wYP%qYhFEKB%-a^+X)cutG)RmfgeSfjiRB7w)P#4jdzEq5uBDPY;0IGV* zuwCpjb(y=YDcg3(R;PNM;c@Xn(;v+DTOY8kcRb=$Pc)CSwL0z-Z#Ca+yW4T6Q{8B8 zv^LsCI!<*?GE5T3o79Dl{)QTJKWm-iG{Z=-(WKTXwQ9G2(ycBuSt2UuMpwfnj!fK?FTE4piEcUMVdo3Y4*6>37dl#7 z8>TdGwrM@agefikw9#Wsh-vBPjV4FJmX>}_=33kdo5SW!I5^OxrF|O>PG0pjPZeqD zoug%)iI<;$XS1%^4fgIByvoFUqh@_>jHkzG@oNP*YDq0iz zZ0g`~ryQes5Xm)~2kApR_uCOqF2~?|2+D8>MiG@2Hj}D~@-U|bl@%so<_+I3+1sCMQvnjEx zP5EsbQf`f9ZAe_UAYu3-CPQ8#kLKk$G-`EW#NZ(wS7|Zv8AWHwPYaJu{=P*uUsLln zKr7^b8J?HanG$(PjUkbj)ET(-ZprRL{pUu82Os&e`F9oveG^!YLPq4Za}{4Ur%qlK zxP0WRbsr9|7&W&48NI&{ee3DDbU{~;qSdMR-^fNRt{3eeo zPvFsjV?6Q)ief=!s5l<>m!KxT2#dS0RL8c35w}| z+GGyUkNCvOhzC&;O_SEmi##hm)RQI!N&c0Yv7xo0*Fy(FLMTnWNrN#dl2Y-2NJVGu z$l1r%9+^ep{?`4iqP!B6cSdB5FNfC`5B3*ucV5@YH z9|_qM(^uR4Y3Zk~sz7;K`noSbon4B5@Ywb5>HMsq*lhMbuaHLbBb7%*WK;?sT6vM}I@|TGCGO>QcMj2>5*Rj^a*=p{c<`Tw zylwx&e#owJ^G=!_H9SN*HI^(KIKbsFC@diTax2Qhtfb1217_4YqxJPw#z=!MpwSGO zpj#%CEX%Ko1RIz@^VLC3ZdBdYFEZ6P*GGM>VU|d;JQ|KB2hS~BRJgM6zQXl|ib7}O zJzI(YScGi!{_bwEJF`F9!vidTne8sIJ0|uR<=8b}R@$?1Q+bJ5UdA`12-oAJZ;#-( z#h=yUqdd};jh0%oOZTemPEaOhnjbwHMrAi=OsdIF6!%}V?17R~+s=M;@Whrcp8xP_ zKDwEjZTH^$`wYb%jTaxb~W7_}A?Kp5)ktI+#E45ZStyYKAYbq+sIIqQjq__~p#bxjo8MT>J zcA+LGN2~D~3&XrTJX#sz!r?6}ixw4yqlJZzs7V_&8L2lSXhK0BA#<@3)POOV%D1&E zoGzbQJw`KCGgq@nvr?nbILnXoKU?J}2$$N{?2(7#9nb%x#j3npEi0E=k{R%5^|6pt z-^$WrlU2w`{v_)i`Sy?V9=~L`&y}n9WxU5V&s=r-l5^I`ilrvAY?teD0~vp5&=PG`?+NAIUtCG8c?V2e?J8Zs?8?h(}k z{zpn!R2A_L5aydNa$V?NY`NC8+H$MwQPo<@1FpwQH>;k?-C)_|+Tz=td$8Q9B~DUA z*j>h3T=deCr6p@h9?5;QY%IEzOpQ+B%DI0hmgo^9Fwn%DqaebQOi0pbuCr zNrNU~u*|jWwJ?jb@XQ;JX9s7({yw)bk*Ify`yJh4w{yQ^e>NidZyW%OO6jxANH(3T zA!WL zz>5!ZH7pF0!v`qX-8!2ep4X17Dc@l#J^PiI=P&Mc&Wf z=ie9nCh~Q@D$km48yXlL8J#~N&>ESPf3D$N=d8#Qr{2bwC7otVi}?)ed6Bd8e{w05 zE~jX96^ezXh-<01M!d~&tLs7QgHF9I95opYPK%p>sdJqkd&Yyn4aQ)hO1Du^dj4P! zhIP3E)GdE&{bZGYhoAagaZ51DnY=bi3{ih{Rg^`Yv7N{9xr4;yD0FMb=!2Pq2i=M8 z{n^-aW`nyfb4sSX3|ya*4%toX^AnWE`w8+)=sPDC4xzdVl@;s-9>FJev(ZkK>u=fi z+&hm<+dbYY8tpUge|dNBVWQjpEX(omS@MkEWp{rMU;Op$_rEn_ti^7O4LOgnmv-|X zTBf){+ABQDe=!S1`1FZWie?s3?qoln%!Ps|N@YJgr1m*DN_3an-EN0H_lw>85Au2N`{t;;Y*fmYodg?m)h0DpF~{b`78FU}b_Fc?++;_kFE@tO zdCsFc>Ztn=uFjY)IVx}O6J_&pqAbviidp^X1#c`|_(tbPx5?#s@7;Rad+*(L>wChN zhv#tJ^2e7K?z`yXy_dX9KFCP&+K)b3%O!uA%6lfIY%!b&;PvDzt?f=Lt)N5bcsiZF zNMAI+;{3q$f%7BxUmc(O|7pu{dWt+%wAMG$eX4(ody;>yd$#`y_j320o;!U{Dhvy3 zTRl73PSY;WE}v5Ug3%QSfDofMXjchAqfX!C8nBlC`ZhtDe4ez20t3i^wH7khvfY33 znq{v=usDN7j~yqXqr1B~1G?oslJ0D5yZZzs(`B1n{>t*T`Y!#Z*mJSB zVp_Y}pwYi9iXlx^3Cc-%nhH+Krhv1g*rC*@wV^aw zp48SLP6DpiWYN4enNw;_TIX3`w+dEg^@1(r)$F$3XnAY3Ui?CKQ0w{ft!IC~Y%Os@ zytMWBz-hz6WNuN+?J4ra{fM~>{e*w{_{uAPcR#PDvNC&EqVMzs7es4c(72SydbDRQ zhr6HP@QKH6yy*H$tHYu;-#+vFi^vjL(dP6F?{jeJ7A}vA&b`~FwwX+JW}n@-NIo(F zipzVi5Uya0k&jB^OO`iU=2?H}N5MBE-v;+b4hIkBDbFjMQ#`$NdgUcKmlbwYE-zeM zc~9X@m5&y#t=#I%rE0DXrpXFIqfn?dAqrot+z}A%0i#jO_1#<^3}|CP+#FS@2T&zZ zk^*ml1hiUFvsRPRFoTA>tm`$eX%re)bxCk>cvX09I29JQhhGct3m<<73t?wfQTqwP zDr*ZKv+k+q>Y_WbpR3eN!2U#y(Rz}p+y=LF5H9IpSCP6RE&bf(QzI=M?24<)cv7gZ z9M7AR?xZULaLAMmsnJ}G<@t7QNNmMu0?2dm8r7gc-6tK%-Fs>$Gj<{C1P?8e>b-kocJe^4{F3rxXo7vW1Y%n+bYH z-SX<5n{U~(2ZaCby)Z}k61C)lWbvJ@!vQJ~D>+NKK)H(CLf4W9Xo_s4+6R>nsWvG# zt6o&Sr`qdMxzt9xthWsozlB<+I4l;sBV;Trl^ve=l(Kldv@8`=C~7nMK8NH?k(VPO zG2_4LB2%*dmxp@;G=I&;y5a48T3jIJugVlDE76kTqGN*Qr0oPOd`c`{RypItf@Q`rKgbZ~P(@3&;UpO(z( zJ#(t*n2&mN>Sp{{)$avY$oR20PoB19%9(zr)8G3&Hy>wSy?!XG9%YVR3$l&y1tcZ=lDUGQ2w2Bhh{fq0 zx9HernAjt8seeB4Q};<5Lpc6?f;C)i{+B(k>;TYJmn|YAdB1xc@)B?4A)njjR~X-a zzjxe`ACJ>iCbNU<{B3|>5x#^2t;wos)=ulyR%X!Xo4JmsYDF{G=q88tR--ZGfJUta z2^d9jjJRE7qSJYN>v_ZfO{;&m#W$VU-XD2;`%L|DOn(63|IdQ3oh`;NT9m9e^fT1v z)*1R6>J0-8NkfC7QDchgYxJAkU2!3w)DSwsGfg$kGha2|qo`3;cp6oWo(U>NnY!OV zdG_t?Px=oV)W840L7{$D14sD+CNkFax@n*3fJuN!G$l>UG%VL-GUSG=5x+dK5fVc* zG|U$Y`G0+(NKIJ=St(Z1%3-CIm1U)&nqf(foUyloGz?2LG$a$D;!>qAT2fr#^(cv| zs9$mbhAE4J%oWsVn5th*O(bH~=Hv$Kwxqwh%(mD@ZAYSBUm!oq%hAPA8a*-yrGdmC zzVO7L?Soz$#0EKs7p-#~x5g0 z^5j2R31qcEprFv<)anI=E>bAu`-wv7)Y|=|KvCo;4!w(Og&2v6^_f$pXl=!)l>6B6 z53Tea1nE1dqz|B!J^+#4?6Vc5L*A%Y@fNrS$!ErFF204bqs!(RlsWd@YPQNNVA<|1#6U)bGmXp_9U!6C5@U&oUXaC7H!{xJZYfh^yIeYLhIXkAjI6kmJMt>&n z(8*agZ9-?`uwjh@PMy@VnM*UhJ=xSaqvuUIe^bLmZ{b;)!ZGIo1hWBQB3q1Fa(%Mj z+se1qbf*3(o6jt$tKD?{&W2lM4;5CHf7ch z2CLsnt;6JySjcp;4KnI7HYk_m4%6o5>a-za#s-Oqh!J{{A|{i;)?^cG7Q2n@ zBD-{N(+?FNtKQZr&r{7Z(iwDyFiSm4dv4Bb;|%lJcC|Ig3_%UkX;k_kq;HG#=+#1hc&w#wJ$3x5w7$3dxt+b=5!24+hpug0!DxUK5UpK~9QuB0p7_e-yfQPG``P)5=fh!&t*P!V|Gt|L z<;054H{k=*J$X~^IhEf_zZ;l1cjq&p*=5W~-PLZTWMGYJ@Eg-g2uVXOUMQMU4(U|A zo(k1lGceJ8-T&g$76LA|M-_u3Wq!zZFMa3;CT%Vzrl0em2pQ$?+Lzp`k23#{ZiS}d z(KVxXcnurlOioLcNSp4qryLiX3!1%dM3~{Rno{%-6W~%=x|wO!!xqr<-|Tw>hxd6~ z!Yje=KSwectN6g4@9s7>;2oQ>yOcBM&YL09#keC-_-u)@beemj7!PmY`_N>;%j+av z*E-4H!2_`n;Z)<(ZG>|x*^r#j&k|y+{Hp+s+tF?uk-OqNMg3OXgmJk@hC+!IYigAg z8m90APpwN^XBdaGYJVU-C8*${@QoSg2M#DWix>VNpdTrt{IwCgDc46BFZOx%39)w` zmYNH@Wo306be?*CG?_Mok6QmTqshLDR@3i;VJm= z#FUAg{nuJUXh2!{>JZ@&>;s;kG$e3?wB&kZvYyLnt4 zMbUVOX>IUwDG9BR-Tk_^wrt{4?3?VE_z+_L2=5)C9aTpe`Vd0gKLQFk>iNNz24wEh z4lwrr>g#z}_v?dYCVjj1U0>MLuYxgDxKB8C&Outk-@)bDg?ZZ(xa+~gxI>kh ztwS|I^fYq!9!g+<5|Zd&<%&pj7%-{V_qy+E>f>|8n7t%qFl81ADxRiTaiQZB6uw&> z=Z)M2J;HhsZxQlM#9k{PZ0D}GWB?KWdqe-NEf!|3)k1sYgWtw!;v#EwrJ{CSJD>Aq z5a}~+#*2dKcXrawj<9ia9c;f$_^A@8NZ20iX%3s_Cmmqk3~XytSp{yFViH*VEBn5a zMNX%tDkL3mW-#=T84}W00oc^&bf{mg;6^2EDFyhC$vBBR*ZdcfIrS^e($qd; zxdm@h@!Ciu1x`J%e~t**H-&F%(iX(KeUA#uP=?uZ*UX)ul>fNW>Nw}S5$gQp$Ewnv zpciz=HF5(|tJb2FxC%3ebxhRbMCb) z{5T_GJNNmRnqlB9V2}NCoE%<^Zao?D^j>5n%xDk1@7CRU|1-+WU_srR#0}^WTGHzH z?o+DHuCy;j-iw~6{@&u7?4CG*)^%XB9VfwSGZaY|ve^F*7D$$hy6}PH%ihQYUK+ce ztNKzvB;F#W6%_2jM5}%^!~j}FPn0Z3WEuY`0zLFNIbecb49~Z0j-y+`M@=@ zE$7(XSjTbTbI)A>ZPkqiZ@|U3OG+eLj1@W{g;1?SeyKC{N(gi6mTO|RPGl}roOo(K zCchCv=%8|6v>$~pJ?{e4c$3|qe^7*(9Sc)d3*~8HirSouXk&0+rxj>Y<{|c7H40K` zrOFY5eiizso$mT@xelPeAqbDNz^jG3dh*7%jp++t%*i0E?jW@}V|3E5W-C!(NtF5n z0Xg#53>1&lv*3KFUl!zN&03ppzizjf1 z+Z9Gxu*{=)ddZ~y1Kvzy$lG|672-(c&h}1CyyCy^8Tj^YwnD8h@TB@OW5XE@w3X~a zc^B4!G)Z(6+^{BCFeZ(V>@o^iG72~p2*uqxUKSiPh{>vn*K6_G5jmTQ^8B#Co`HYI z3hxM;Fw$e~)l7Y4=1ui-KKg~BmabxBeY}})L|u1_@|~h?&;A$85kBR}n}ODq>Z_{W z$89d(1HZSWk76zK4KO}R)wsSt4Zm4$9g>%bMu%j+!nZV|W+2L#?|?D)`by#|L_;NT z;9JlKHHpsyVbD>&2s_4Fxsf6Pv#+YU7KelzHJy2Xj*j0^$i=tAyDRDhB>EdXMH|rN zYoPsv6n7m8n6R7(JQSKxC@X@w$AFK-h9NA3YLvBek3T7Nch_OjvVOAvYySlI7tXGx zOUE?lH|n-(+$8ZI)aUR`kv}@VZQ#)7uNG`~JiZBnDkNop!H{?Lf&352KydIgleO$y z9%t2&l%n!Dwl7Vc^Ge(CJ%e1@{;k{T%EZQ%(;exa@gZs2tQ|_i3ce|6$@TMIl_ide zslVsceg@ShR6q0hDKpXE&Ey{xmNuIxzGzz)<6XI5+N>^TF^p_b7w}b&II|pQ6pzJM zBYNiCknwyIHE4%pIS>930^19G;{~GNCxK0Owz^iFCigD;r5Ap?cX=dtL7a15Nlrs>e`%L3^y!GFS1<1=LLk zjhq-7=h(y6mIv|I-~R4vk&YSfNKRk;M%y+3I$}#osg(=~0O6w^H<^tN2HP+fHVOB3 z@L#TLN9cZT9r&q-R&0JHnuD31XtHY|zrQJ|uIgcWufw$%TH51T<|jFBi#Dtw-9tMg ze9!b55_EnWh}I**uKCnkfn9B&G}-kk@j(zTqQ8=vM+PaRvoH@`W~OzCA*Q70aN6l} zOwK$kNBxxA0*df!=xnJs{Qli$dl*Bx->}6ka_Y8)0#li6HgUK_hWiWFNX3lM!c7J) zE|4;ZWp&MQq*Z4%U5`1tm1eDV7&#cR5C#Ubuh=OH3SELi0U0IwwjuL?0PYwD5$BX^ zCfbCqz!Vd5oJYYz39Jn!QCw7Vutl(q=RIY)Wq2mJ0G8bK;L2Sk4;_Qn)?vImc^h2! z3~LyhbzcK}CRu>%uC(cBfPO6}CLSiH2$MRhxwdCNIJ0*j#B6)AXFOaOqt4 zzJxqs1GynEF72n1GBjO&nACrN#s%TVT&?8Pk*nS_>1;C6B-v|68`5k{0B)e*L_aN=j=Lc zdtT`|uzp2mt{&NLI(+RN*)~24f&ZN73H0-WfR&wD4<;A$#eOforMJ>LgyO{=3;wES z4^Qd}be~2t>Q&u8DI88p-gLjd>_ua-)vWt<+tkPE8>NMOEINDEI4Yy{B+zEnQ~Vlc zdWVchuP&FD!NN^85P=wV*)B(v{wmV~_scx;+MB-sYt23tQ*!CwizRp2fa565VeufHD>}jwo0e}q- z4a}ZbI&igp5^8cxk12(IBhGfRq!1y?#uG7wu;y*UXT&`%4aCF-sr5y~zdvs*)rVH} zn9=_ewK9r_M#hEY%CIegW&k#qakmjGVNPfkezn)K)yJ`&q%G9c-gLDw8`;wDBb1XN zMYZNAls6uM9F31H4w}(h(U21=gm#|WCO@XOCcFzczWKg0`>$YUGe>yVW5)M$c@~}( zc%Y?#Xx2lA%)8_2dZ+m(!UT0-4pF4flR_LrbhZL9;sEhRdXwJl1*Gj_#eu$s2%nfzb|!t(g=`LgESHf&d`n)n%!91pdZDID*J{ z#&2zFMOA*iM-dl<#9=d9-6q;mdPhuDf;eC{YP7gxNNd2uAcGi-9wxmpkhzPBfcyn@ zHI=-)l=oLG^Ac8`5(sg&uuOCDHE9_jZVnR~JrjS(6z+aa7u2rrciebC)9d`U1Vf<) zUrGRhp#DP=nQ{`N?|IK1M3ZVsm0CF0A44nNLN^S7i39b>VYC9XRqwNjK4b};sLcV z66YmqQjlqTqB38^8;kX9hyCr<>1}g0RelCX@9A$7v*N6=cdR2ZReu_m2Uh-AN@Pvc z3$Ye|OnT%#BP@luD)?Pz!H0PDV&k5E?)jUz+VTVUh8X|-hi zSNo0}s}sv*1-SXMgX?GP4sg*h!euZTv-|kpAL+nZ&;!fQw$d7I69+~`?{7HPHs78a zd$?V8ALv?rHpCiN*1Xre4_{|Ggmu%tn;k?@iA@<^*4}3NNHLJBQ3&uRk7M*7*@;$T zB*8E>g8JwWN-!+de_Urqj%WU$osvMtE5fd-$1}VZG6#~LG^v(x)8_<=8MK@muITZ?47S1g|EUZoI|I4!+V*dy)Sat8-abY z9}<0<{s*+fo?Ll@zVI{_7jyryNoV1vVo~sVy5_}-{i6QmzDV(WFpncQur*=XH1R{Q zK`qemT&id_Lf@jmUl_0V^O9Q@04A6<_4t{gOtsdguwDbQeAUKo4yc6fEmX+J0WW3uvUg8 zreHme4h|K08N#cQvjcPQU2s=yFEmp<&CNskNq|Y5-CaPohr{nhD zY%i+LBS;ET(M$#!ub6cCpL`p5b8>FnoJnVBeQ?=|2G5eCIx}8IFDOj!$D#0__(P)w zMqqPEoQFNeY%lg)e1{%h6;LFj9tZW<$~ai38q{J8$%Iz|jqLNgIx_+dV1eo)qn&sBzZscR2X66i{;Kk`118_YLUdJKHD7ri)`J~3023*{)4d(On@!aB2b$z zB_}d!bUWVZWYEB|kCbArm>8<76f?p6kN%~lt2y4~$kroV0Q;^CphWGRz^bla7qxFaZ zLN>qjMoVu-!z(~FXsFYJ57x${5rZ>B#AFTCs`n}-d{64YUi2VIn(`82v0=4q5;Ty9 zrj!YG9uf-X8s&#ZAhug&AIYWy3?&BXIPLye3Ac)m%wzgl;dN%bfbA$0P}Bk)^hG%Q zf?pM?H1f|J(Ymrrk@v!J*v7EKu%}eW$%qz=G_|iZWy%-|nBF(7OR?#M2(KKg!;td3xVTjH5j6h`2&u7&)%_5?b<;&{+k<&DTdHbN~Q6;12nJ$SP0DTo82W5 zUKuXRh=bgQ{9A@naW8K#M(Vj}2Sp}4ezL_q#UHMO9iML(Z!>-exGUi}s45&2$eC{> zS)Qb%5Xnr#mt;6Db>Iso#62bHRB}Z!9xwpegH%DOCm1Wybxb;_Jm_1Z&2snSlZV8I zh6lYKE{mb_l~T~Gqm;~tfur_DaSn5FXAO{i;Fr-yhQNqCA1t*Z^nbftxs>+BUlgc6 z6>Abw6OlA!h{lnCU@CVu-=HozQA$${NtwUJ!vG{>ahIZpMf?+oTjL@LA7vi{9~B=J zWn8)#uHnST#K(3hq;B`>zlV#XGr}A`v%3LO0NX$6O(b;R#x*^&Ilu*TrC}6lF%62n9JwF`#HqH z((<9gD*3eC2M-4rz9A%E{w1Q1+i^-;{rwbvQa+x0y0w31-;yh+kdh2e{IUvLq0ZWj zY&_61Fg*}5U^!4Va6F)Ek<2d%h_)Q^y8gCTve&f7aouduWzo3DSZ4A>by%Kx#9ybD zX=$Pa4FHOkl_J7KoeZ%)Q{I_93v7Q(zvzH*(GnT`<>6*81D%I!+R?~UggJ9`QhGrW zui3G*VpI=WKU(*77Gi4JO?_g!BwYFuFr-CAWiUcnsh}4j zbR~#_ae0c>PN?!8v;8FkWA`)TF;x1Yz>JDxEWlE@m{a=IhTvOshBL@8YOG;v2;)9L zoe$lcP@A=T0cE~gY3u>LhY-Q*#rkFgp2RiCT@s68{_E+>|G$8{R&+Mw(lfC3x zwLS-fmH@n#zy|*cR!P(Zl3^8Kk^?d7@K>UrETS{%yI8s?9X}Hy&e(#Xnl6bmjVVkdOBY`63mWgE79h|pj|Fyxbo?=N8;GL{4aA|gSa+t;~$DKYX+j}tnn zvk1Wm$q=^Or?ae;8Aq`jL-66Q#^>{^4_=tF6PDMR$e73&Go2VcuzK?HJ)gsD1V-Ut z!oyvEF&Tl}jL-9dV490mNIZcl9>h>JhxoUL+7&C}L(sOz7|O1+7UahqhCS*k<;dGQ z7!=_O4dWOB>4EXte=uvA(26k0O77QCWGVmfZT567@1W4n0JlOr5{kxkWqmZP+WZ?mv)~0bt&iU7Hqahb$dD}( zA*`lm`Kmp}cVHRgTa(EYLyN)S%}1D4w7cRlf7FaYynDiifkRvPi~adBLI=R0WQ*wC zEv|cFs4b-#2{?e5tz+1lCs}sg?l5?IpS@l`ZZh}_1COMo#tHOuk;uV; z)3KE{K}h-6@!D~?c^#62aW3qVk+PmXY5cxLb&Q^eYmVpd-`@KPl!8;J9atOZPBk7x zgOU!|DMj94i|0I`<`!~-S$L7l`l8P3BV;YE(72Wn86CXM_G=plAK+Q@2(p$F3NH_# zi1X)FNcSa)N5jgN$s0_#{Y0FZsze8-(4e+o#2Z(ews?L%5Ofc(#Se+aix}l{4C%QlM8F`gO*GyoS|N`eLAwUEz%_d86bs z#b%XG<#+SE!EX+nvke7Q{IKFvn&SlvZ69gRl0*qhoM{Xn`&D(3V-hZ8ZrX4eIXwXV zld^Nn(9d!nS)gU4r;#3hHb$7rHSb1m76WC0SqHyh0gKMGYu4G`Rc6cp{#Q1)684{8 zm<3Nu!J!j;-$di2tI%SK1k)q^ho=pWbIkCh6%?s6aOEVN6vIf~eY8W#3c1y6Zgb zSeEVnAqN3%fdN4|z1dT3xdeq-`@-W!)ME&0BQ4U$`L{iiR{V5*KZhA z$SdgPSQoE9~(UkGV(MecguS zKB#Xzh$~`8T^r;A>-}2HHb-AfY#Jv*LjIEQJvYF}c7Mdp>#RMlD6R(6_s!_{*Ka%R za`L#Ed|u1p;rMpa+usdkeKr%a2Ri2@HILj}Du9*i&U9_c8>~r&Hb(31a`1XCcDCn5 zp*j)2vRjW64a<2h8=$Zf%9zt-8iUec*`t)Rw^yaU=89P+z*Haqq)gZa`C>wmRS?Bf zW#Sjj^BZd?rXVMabFfj$YL%KhW8P5yvfX^9e;6ZZL%N|9OmDoUn(6r1GdnJgH4_(X-=0b6v97?Iaz7rA3 zr}WCwM(DFonD(Qjyy7yG7$mWNs=06;umO{%i%9js34ObL ze^{W&4N{TIA%YM0=@08sOrH2h3dP^yCj>~4dtcGD3)RWQF=W6H)HsvSl|#0`CoXL_ zy*R8Vu0Ms^?GwK?=!yYrZmPzpu_tXg9nG00_N3`Q) zjFIngDyNGLk$g7dT;*fryFm9pljMc4T89sq1Kdvm%@&=nqDSuh=v)U6bK!7LBF!HB zKS-VKR^GPbEZ{kXQtJN;=StRrP$A-&+qgFxoPdT5V>KtQp6AhEG+(#{BH z=s{ZpNe$Sv0m|dB*MjC~960=$wvxzAS&k-MK=#bQ#GL^i5|bDiaE@LC z(*fW7G|110p*QNRUQaaqOrQ%=>A-R|s0^&JIR;WWNle(Y0gTJJB1g1YWckAoH)x6m zZ`5lBLW>PBKB2x6=#IPW(zPoFlIGMKd^QcTfuv%?22bpP;Z=u&?RkSju5tbZ-g^d5 zJe$LyEj_y4aNzejmfq;^0$u25hq~7uMr`=TXoSFKc){2?3@~LgLQcRR zCFd~XTIf|fkTAjH5ym;=Ba;0x@gwqrKA-kd?eo>oLq9LTz6c40%3?_k`{PXLu-PCKl1%ZW@R=ySD<4 z@rfTiz7Bf*-W9Yn(L4H2z#kL+b4`Ag_zH#Q>Vttk$+k=5m{KrGF5pj?Fg9C)o-jTO zQX}aB2JeiYOJBM@3A_>}OwR6o75*X?v%)VNTfZ5z(jav?OiV)7&+01{Z_(C8KFaTp ztv2y;jYkRQdPI%@4wF3*cExprMQ=SG(ejfYK*r}O1tZ@{dJ?`JR9r*)9ada_$xka7 z*tyDm#StC20c$-H%uas4Ml?x$*!%a`-GyHO+>`M|7ab%&5FzM;^hJOF5dtP78C7zJ zp}Ue32%Z&qg<_jj+bbZ+mo9jvRt4eu^7R~CF_9#D?>oHeZ^yY@ee=cd8Lk4e=8l;A z;?L~XcVUP47;i^?>H6|7G?oe+|DlwZe=9b3%3xGc;hvZO{0Un>=mbRy&H!vHrzQfm zivb_4s%#*^?$EPa&DzDuc2%~0!2pz%(?hYs#So(kC8G*m_dJtvPe0t1)1}W1k35q> zPrvC5igsvRDtJI=_!$6o3SfwL8fQx$;|Co!~$6j32i>CndA_X9OsrBKzRNDB!&nBmhsUjVI*g97v2@uZTFs)Sp?`x;IGHEqtaoEY^OWg$HUR68K6M3|jsrT3xyy1L&|9{^oGY!)ALR$4*4z66qQ<#G zqQk^ewP3&i85ixDV+57CrW8CSS@aar|a z-2;dw&f%`X87~}yVF?W;kC_=S*D@SApZMz|fjP+X7Kwa6@yab>-K-`x6!i*`xbI5a z99lXw^kt4=GvaO_V3m0j9+O|`H1x#`_cBDS9X;8Vyd3F40ue#35Ia6-j}*j{i(z6} zH-uCtLDvOWbp<5yA8<$vT`6p*r$(4v#B1)S6c*3__tk`?N(VeBTZ{fNLAb=7Z02zchPyL;`*t{z52 zgEYZa6=TIUQ+WPYNTQBd{>pR+9al<JDWzb+j%?G+smj448t%5E8vmqc8Ab-*WP) zR`vBRajQkBl>NyJzdObgB>j8%hwTWU9dX6mh+n^cSGNvMj8grAjng3s7mq+#=w6pN zueE!;#_0zfiA%s-w0UH@lO!^pvM!s`s_&zuUeqFhjbWz@XAwDKoFvm!ApY!-$|(%2 zB5W*kTr3ba))&O6Oh#%-YU*Mw`Jv~g)129I7m*w?(VXq?yl;t#?NsAtiIlfyYO0|0 z?puiXMd$@(`<5h@=zXM48DZ81mI1dP&PAgPTXn!qaygcX!bX|3qRmomy}e*J7B^D2 zoIM-~BAmZ=-4q7X%Z?7UOHQP9b6K9e#;vTn$IEfLt=g=`y1|8E@35ioVP2IG$jggu z;$~%|;=3iI6!Vtfjx8g}r06P^7cEz(e%9O)4CMYj++?2hBU{d!9OXx!xAci13+dbU zHSq(+vK}o|-_rZv(o_54K#3@lA2kU2!RSmZLxza@!C;95|GY(z_6yw}^(8BJp^)6^ z(|Cr1d4}uOgkiqD%MV)C6p%NqX!3cqe&&3mdZP-6>XAlY2)Tt2fnfRQ88Y<5=)R?} z@=ILf_JjE12a$IR!Mg~3QU+frjvR36xX}t+$jI_7W|Jyrqmni~dSx@m4nTZ4RhpVu zfWFE{h4s~ExurnpJmt|-Y6~gOsg>n34sq_p+q$)nJSk_IQ_=n8B>B3dM*+n-UPU>q zQhdfUmUtyOtP*_2(a!7rmUzWEte-nTZQUwHo)oSW=1rayR?SPS6o%Bwz-P=$0Chi+ zG`w*b8f!_2S8<3}Q3$Kle?Q=tgs@7$8%O`gvwrRnislC^*d8nBhl=p`#Qx7bPi2XN z#^_{S36r{{OyjO9&S5Z8x)PI;&mee>{uoK6#>s7E5!xMn{_XM|c|MPDj zJb7ZDI?qG@dHl#EknQsXvbx2wwUUHvy`Mq}v0g>7tWy7BR#`&hV9rh)>t@T}dO8e? zVe}<2>aum>g!sFMP+b6?E&ys5fThbQD5Lf>LNjWEGmx(qRDJC5y8wj$(X8PatUoeX z!!r2#l<)_X@cWhOf-*98W+(quRL!fc6c*IVhymGp3u?v1jH3cOk>0vq1J|Ph*TVuk zQU1f71aAPu=Tptw8}Q4iz8OmZj>G9b#+=G=QBLb;l;q4DpR$~k ze*rA&02Vuhk2nE~0w?9uC*>J8nQJHIaVO;}pBS7;cv6mfQqDE6^6k3FG>GX0SYmtZ zE_fmgnBxV^c>!DnNSk3vxkJ&`KRdo6#3UR|5T3M|kkm*OJ}(Y!JrZp_^gn(^9NtMB zJ}>GMhp~zyZ-pzJmiRYJNg+FZh8%LnqNL%Rq?Bz@jV;LC;KceH?h;A!oK3T<01JTE zz?SM$>f4|_7f%qHr5RYHDT|yJg~$3cpH*CBD_rms%t(nieTJM!hPIlax|&pFMNQ># z^50YI$_fv4wH%FEnx)0H%8Izk3YGumQT{B#{aMVaJa!KTKu(;L6e2A6A}sL2*a-z2 z$tJc^$V(wC=)iQuQgow82*OLO$5LcqmNsFQ#vv@w0{`Rleo#1xC(cMGPF^j*j_q@H z0m!AtbK6X@H&4~Ze-};n@cgwgy zhn&x+P+jBJw*{nW?@c8OKrij*j@bW?X5$sbGUor|KGDaT#_2KVCj$O26cb{6Gm`y} ztUx^x6QX@nhU*R&man5d1+b_t@;s*3j=bG6I+j({ht*0G8~<1X2#hRRSC$*oSL9vI zqxqa@wx41hEDXEOF(s+g1;w!jr?G}+u~MKfJW=Ph?gPs5T0w?_=nsn>tBQsVVc~PK zhU_^e@z>3Sz$F0M#Hsbwyb`EL#dT5kU}4R5PJgVN%e(}&et|G~+<#@oDc!KwxrzCu zb9&*JUu@-_)G^Gl?y8yAbarTZ{G^NwbB4_wnyd;`n%38u zZ47f@fBu9(@%t3YlO0`6OB zrbezP_4BzRsUX{X3a^_4fI8Qb;%anYR)8LW%&0^`4U?4nC z@abQ3gm8y&cZ9G;g*)Q(F12~2zG-8+X#>>VJnCwno@t*JaLZwF%W2w6{tB0-npUc) zJzS;DSf;40fvY`^`9wNC9r%_}{fDE}s<$w7%#PGLQ5Hxd9~E7UR@4pnOu?*P002Ir z>`|)O8ZxwD-;d1~j2s>(3GWf23cT#}%G4p2**#rBQ02dW4EuUrwO={JAGFCSg zq^b&&<@UV90`4#+BXd8c(83}PNh>^0OStcMF6amin~(b_;fKV)%|D@kzDiimsTZ-4 z>fVS@;DprPWLyi6Td5gS(HM{=Gy(sN=p*ej-}B>%*^Lk}xZUi#OoXH5l+_}GQUC+MY-C&>fnc;f3$gjb_aReR;8(IoW zrjB|+&PHOb@+UY+k9+$xexT-W{yTJgn_Duu3sJx~u|h9TdB3pKX=vk?x?jIf?B>Pk zaaxkJ{M7lW@7YHy(4@8oEW?LGkMCC`}PE^ky}ki7x7@@s3Jc6xQM z9G-gJ-h^@qR87sRjkP^M5p4D=NGo96+QZtkVYM|sOq3e84Kekizin)7E>~+{%GhJ{RRtxC`z5-zn{Yg zX-+x@rfu{eR?L`e!2)W$imbRw;&8S54^JF2&0sPazh(@d>tZA0oCmb<$0kipv}31= zf62$dsMF5HfXS|n$5zA0)K018?JPf0O;;mhE+~F!^lx;oC+P?GyWg{1;r?~g7vTu60rEy8iu_#rN z{sHt$cDzDk6&fh8fi%5zc#Jsm;zULSarWoQV3iTa-~0h5%<$^fRqYN!vOfq!}!eukl@=Ffk_PQ?L4}N)|u&{jA_(*jR&>;y;RiY32!t)<=bc&cO*48J8|Z@o8N~RrIc=+YmtI!!)%Fbuw5GxhmVeiwv@dZL;36bBz@n* zk@KoHwhc54_m8=h0hnYI9;4)VabYAd%E{~%_n!QwNhjg;LDq#BM<>9P7sy^n9OSJ& zngK+L`WlXhJvi5Jy9tmZQ6LjGO3W)(`Nk5M?axfRxFas!nJORi70{kc~v+Sc``90cXMr3-@ z8i-2q(2YDGpsvGl+`0wOO=jHMEAmwpuhyLsg{Yr+hJzcYw>MY zt2Y^a-G?SI2|CjH z*k>;mLeIX-z)8bNQzLD>BV$v7HQ|((*Up$Va>C4|iKuCe6p+ z`o|&kGW8M`z~a%-%CuH>TwSoe`g0j}&vOp9GaG>zXJIL})+S?cWXUqR2B9P-2Fkx2 zjp?&wKzoGYvnoSBVp`~Vs*KykcMVl3T@_GHgL`lgcj5E4e%wO_yul4PidOJQNDAT8 z&QLR8wbng8Oif_k>39S#M%cUq0)!BpKOY8~Fnr7F=F~!3_W8PTUD^pEmbe={7_@yB z>^LT_UyBoXSx4WO>6c5ZSucpHbgKR+Kw2fVSv_;w+1Mx;C8ri5Qq#~RBrMt@Gs89) z_VM&cn>WuY(ycz$|k7w5yOm50CP&D5@9)fZLzX^#x-c@bZ2 z>q%xUBgu~6t&N8#B6n?^;vX(imP^t~HJaD2Itd>s8AKLn(%uZ_F<1v&#?A1auJ)`KTa)4D?&jq;JX#U_ZT7XMpc&;?H2hib`5wQ^h5k$I-#S<3Bs$`koFCn9i=oEZ#6W z1`7TF*mO1-+(`ip z7p&m=cbW%|E{XV)?KyHDQk4(-e@t4hj*C#8@?ty9xz#g_xR+3|< z#Ix;eaXkOtD8~av>A#sI)eZrgSbK!)=2UJPTgD|0I%F~1CS}TSI30s#^b6^xv1uw& zzmzo&pb#mr&?si}8@7s!f~H6XkkUHo$)_^uA2_MtD>h?LI`DtGvtebKFVfF`;CQWu zo_-#gQ9TPy4djW2tvM|}xCNwaJ0TJL{K7^I=gr$3im}XQA}Jq=ril30F^5Ieq=xhE zl&V=lGo}`o^{@M>Y=gS+g6FBgDa)zFv(~N0LC8WmopGmI=P@9dRZ?sRv}R-hI926E zudgfmbKt~_hJy0XMAfS!dlLTFnp>>lVtyBLuhY8HFT7AXj(OJG<1C9g{2B< z^)rmA*(q;U2&Xg*txdr)_H|C1%mdaIpE9yEN!xrACr(;Xx)udO7!)r(=VGq6GifN! z!D3Ol|6`SsWN(;l%itZLcu@4aixeN5vnve0-4o7X!Elv1VP?pG6gOkcem|&xBR{wa zIVE2?=$FWF2-2s|K<=mT_~uDxJZ(Jrh*K|95yV3IAo`OB-bu47Kh9h0DF`?@oQu%? zAO=H^`roEKCvxbrpJT;-4Rw^#_1|pc`*L2acG{{i+@3BF~3NKJ}615VDq=31A?Ca5dIhPfAsp#6c4e+hx2)(2Pucp z(+xFpuDj4%9dB~2LW#Ng|L%N#at>>pD0>s%B$CKahK%PVMQDFS3S({9)tfkb6=g|_ zG$Xe*JFd)l5&4(61)c$kM+qO(sU!5k5pq5YB4uUy8njv#MiZ4AXGfcDf5+af@17tX zRM#t`yBdnl0vlewRgrb2R9@OXclapz`N?eUd-gXso0()+`23x5aPHcdi76TrET&|e z<#V>WE_J8e{Jx=+?7l+Zsx}EV#55c*CQY`Tw(ziuMoR`jYH|cNdAQ6Yw8*P)H4aC` z=pJ1S2={VgPh(GCHVb=`sAwJ5zb_A{=1}M9&=J;1ocMWaKQs!l#jxOtKqiD{x!aK#c_4qzTd zX{O__(I9A8k4>HTc-*(Jb}HN+d`Er_lNlbaRPJI&)&H~|J~Zi>R#e95b@1Rh63qR` zh|l-t$KsGG|FprD z+(Pv77E}SM+i|gEZ7WO6P-o#9@XY_L`K#Je7@t_C>EC0;IPoA~PKlmFt$MIX%P?-o za*wMttQ8|Qj3nh2T6#e%fCewV>Zm{l;&SAfQwe{AGjO4RTRb_PM{KG-%S~Pi7@x6I z89vvp@Co=utJfvU!tmJ$aOibyCt@_^`wyNibO2R(y#wYphrg{-H0?|;c@TLEP`B`& zMCzNzdlHg7oM`&I(>foNF|*&HFqmM&GzlgG2qokRWfCo72V0FN7;UPDV_PyC@VJ&O zMs%31afbCuD*Hy&vauWW(3~N(tC6ms3ke3@II3gKVLiqh_wFQ^_FLJ_Y$#%)nm906 zB!JjV68{%0{TOxTG`4z(L^{E=j{)$rDz>zKhJOat<_m=I2)syd=TXIzR7?prBso+@ z+Ds16vittLWpPZ2>UA7qTr!N$vXM?~|7=P1Q}kTk(~L>?7rHfo_vSI#9YxTfvpDG+ zGLzX#lai|_$Avi)tx~R#`#nlGH5r?MbyAcRwG@GCC5>*{~gR!zVhw9H96+AB+}hQ2*f;G9mBj++tAX-hhZ%r1IN+ zQ&To6hmgZKzHH8rfbpCK2e}NzxZagbABos08EautQmIlW4Bt zM~e`DIu<809l^W z`6%sdQ;YdzmvFQKp_piuVzK)F0dqi%ze%)s=ty)D)diz-s8W7Ud`^4|<>XQ+>r&19 z{Fi?;FF9Uz9#I`hI^udKUmcee=Wr@t%NIvP8K+J( zCLT)>oDuos9SKPR2V+Z0ND82MbV+I1m~w73AK=r#VxB0e*<@rJC@D$ON;*leX6{t< z4~2%OOPYCNJ~5iD0b=y}0|eseK(X5gFB^YR3)|30=CXiSO3w@gz4hJ}Z-@7|SN1Bs zUc1{6A!B#ibG1T7gb0#0nYwdDwZWX0Wll31y=+D$Y(*G!Dnj6gIn41vdc{cQ4<%p} zhw(9gD4xVKe`xH|4Hx-CuC8U12g-Hj1Lu7rcJ9I_Rr%lt+)?GeDsi!MM07P1JwJbf z$!Gq|=wh2cHSNMNje0?G=iH#8;aR{Zhj`^}&v*UurbTP!U;8kzHQZe@D%Vp|>d8q@ z&d_JvI&V_h&+yTFj; z@jD`m@A&PbMYr=gQIeli48s2TRdj!d`(VMRQktZd(j}ARkerfQd0w4V8ZKJurr1W; z5!>vlqnlkRQ5$EBX&R7!KhJmdjEQfKO;UQSCg0s8$D1dz-L6`t(lZ4B=;*B7Xd%6X z5;jxRshS{3x83y*e*EETE}zT?tUUNZbp8GC>WfCxz6%d|IZdzR>+SfNxBq`-aWPHK zyqp?9yhq#z8%|1TQoN)dp6klTYVGfIVB6TNZ1elA$d=j5pQg^D?t2e9T)amx9vyn9d2A#ob@EIh- zR70m>yakK<2GTF@3w;5{9CZacW=SH{>SmS@3Df%{QI%r_m1&|QP*B@h5yEa+x)i|+~@yI z!6W`R3Xb{X52yXb_?GF-f_}fkl$WTjYD|mBZ%A53owLx|i%xrnt+Um3!2=FHlu43S z%pEx@FKVeTHn>TA_56Q;l^$L%I_-tA!~fT2vku3q%@a+&g7F2UfE@#j^al!9-v-K} zI5;Cv5TS2LnMPBx(P&D8e}bR*tt0&bzZ577_@&^CfS)n=jcLh7W16YJ=T9R(X-3f& zAMt@<5Tq6ORa&FPNR38SS|Bx$9x%}Ye}sM^B@nl2WNt1q|Hgla{7z4(h@%-%G&PFG zMNv6NJF2P!3`?U+N&})X+1O^h!?@Gr4Y%p%%5ib}I8&x^RfU$vduwb0g zsP!>3vLiV$$jyn`kP!5GgI?<8Ubc0;?U0Sarn6aXKAUKhMitp2uQcUlrRoI{Qt5%c=F^2`ciMRft}4RbCoW05l)ugoX=RhV#i%EGWKTH@Z%Dr+$(7k zG6Fs+AtL||qHcBcvB~i17k5&O%s(0zG_u2+IW zMvY7k`lOM`K`_9Vp4Jpi%1UHOi7Y8GIp{Yg7=n-z3_%|QoI}HoS0ycD8$QANSGSsU zH811c;rfnC6x*q$5t0@?n$iD@&KB&%S;y7JKkI@OmBpijb?=fiVtBtUSW?7xuR~u< z32d?xUw}{ zE|LQPIe38dRJZ#hEaeJftJhwNW4P$=3$~f9>D&gnNc`g@QzV=x8_K5t89r^wM4;Pkk zEG1!A&j_ry@3y~S7wmmgT_M+cm*8R#zGf7;{uzkSMkzUz*_pXMb8}{IrXusJvXcD# z*w!~*@6!>TsdReD#b=7TFPjGjU0nlwZpY4{gX|3f=8U6(TuZ(3+Rh)^*!Sw9J(dzXFGNPcY$Y?Dq;w(k_oCp~!S&MRQLeNw1Y4LP; zHhKCzO0S1_o^w(uerkLuUWku>5TQp@mz~cA%sXs!mlj28d^N5^B@+wl;G}DBnPHDZgSrVo62}x{ZFBJ$B4X{G=R z@3uMuo0CXVgkHBx2P-I|2d5>pQ8MbxRx>?rK4GTjia02J%2$+v@~iQGkM1G9*xLjr zo4W>d16>15p+%p%oowzZALw!|bGZh(5FGd*IM5s%=xXM>hP2YC3XHw{1ec4MhAx+j zL`{Sv`d~ZiRHde+rpC^pbDeB6!DGK?E5TlaN=p@^r`YyvCmEArGkQx)y*UNxNm+L^ z-r87FJa*)54?ouSt06dX zV_neMq_ap;ZmF|6Rhw>U+}eEmU+p=$!HM_P1=IBNQ=NeYCC>55NfmX!T5`{2t4A?k z*ae6WGW{v)rOgi-9yD*WZu1;5AGQA7@S#W5Zoa~Lli?=wt=3zAJ<2-61oL=nt!IIG zq4g2-gH~0l*<_t<7XE}k>5t;5{(Z|A7NttxZdr}h`kO3!uty)4fcaVNmbDoxvpOvs zEca&Ik+m)3*OomQJ1qw?dM#QPT>5~e!Ll%;&2no-oX%pi_$<>bAxo!avn7rxyq@tz zT<;~76&b26Q!R9Vv*nP5axGauBap=wkIdh4Ths--QN2N=ziqn0x5C@HBLP;su*5zFkNaziTwK=7~}w z88#b+i;M12OZ@R^qDdJ3k6-IK8~J(djOfBHzeyVR=vR*4QIfU42u~a zvq5L|ScuLT$jvo5*={X!FZ~>5xp$||6fk?Zi=ZpjdS3BR4>K*E2wA#|7$jY(fjem0 zri<*Q4J#q(bYFt{(l<#68JcZGvBJ7o};@* zeNE4;?w+1Y8qFzbM$%ZayM4$;GPcC&gE!a#+hF6wlCuEtU;J#Mgy+J&M56IBH_3ku6{;Z1wm$iVy1%^eOn$sW7ic(6x$nja;1^d2V$U z-7{i%R%iA2$m*;fMNJGfjp#VFI;&^Vo>+o=;f=uZ-3@J1>u$Slbc(B`l*Xg%{#@Fw})>B2E+?}<*Tcqp#2m193 ze*O>Hq~8Cte%&|^PSoD4n@m`Mf0&cS!DDZ<_8(9YiqTvbv|>r{%w&j6*q;O*u+pI4 zc0-pN0yo1{iPc6B0tuqk<{3!ZS=V4Rt{B!BSvqv%yIo`R{C&Z1kS(e%qJks?nI(u6^e z&;+fm$-sdO%w$rMk!>qV>qTBuoGE&w2#XrYG=M6xVz0I)3ZwO4EE+2N?{_gUEOvWamE&_O)y@nK!Zi3W~0va59-$r*2j8mq?B2*}+!KD^b8 zedx(U&t+HZw3XqYEg7LLpq8G+GeE(YQ09M+vX3QYCn|8t0RFBI3@+Bgv1GAGdtr_#!fY8E=TAd`}WT zdy3QJ2F(=lUVvtbVS|i@jb=LO0w!=Jd42ww;Rcvm@qGqp*AQuF=0+fdqynNE>E!5U zjb>Cdpb~KMcr*>?pwqG236D9U6Mwfr>&{RHB-kpk!jSyH7x5K*Z}>)ipZF$y&K*AJ zt6$~|rmwsS&x5p?`0BxbQ(?HW3}dnSxGt231+m;!kBy&iKm-N^2%7pE(Lok|(+H(n zBAT7j?5YY=l&ZprBdWp{SF>tmOK-mUX3%%>Hw`}7#JH30<`~(;Bx1nb0QsIYNY~HC z;)E?uL}T`tEfE6*oH~oiCa?mAp@60Y@Jaw_18?k%$N|pat;2PHOCK9J0-I~cKe+JW zB_~j<5X1ArcFCTbNA^5^|NVbs7iz`U*4q1TzEV5Yl4`>d!gUx>dvx3G-8T*2cOQUY z>*P`LF56C!2A>$q-V=T;y%T@0=_B#DbUgl1)92FXG1?_jF``3UFI*+A_ikwZ-0fi8 zQ0x$g|5*Ac?hFMR+`#Ve1j9ae15fc`7_LHXZxq~+VynbwdwDJ8q^hvr zpa_Rgi!zSo*aGpv(vWgYAqJH<6+#JRJy@8Bk`N>#$wG1{NhX7t*Ke{wl4aw|`P$Y> zdfAwXrB96UWBhmpiJTzTivj>LEC%l~8hkp98VWVY3hwcLvw9svKmpnr&T#$FP7@0> z%!CApQ}AS>DN`=zT4Zk^cfq&s+x67TBNr4djkV0J+*v#Q$!&XK{NqdRw_O#}`)=)@ z7ZA6E3(tJ#`ny8>vUx3w=3aK?Z6Evwsu84F=S_~1A6fD@WaMea#oE2LlPu&J)vHGM zmI#yg<|C1Rmfs|Q(}JZ>n23B4=ORenTJY4SnPLRVBHjy7$eZvW>1&9&W-x%xaQ%Gn zY!M77ee~@vp9e{w$LXS*wFbuT^QjaPEe>pfLy$NGk3j;4G6^&?A(bEC*YI2TA%2wq zgrDSH2T{14?%R$>2uT)-V@zS=d#0p}|NWGR(MZI9d}oSSAlAf+F)^WnCN`mhxDZug zlA9r5rUa#07ZIDE{Yt727pA^b|1Y(SV~U!zi7M{Jf}alGSrS9&-2f#XBz!{8r@ zQ;t81Ur2veKaFu6jwKF4+$e1fYzl2sH^jb2>`?EG{Y3py?6V*vJMA{c6IUS4Ter+9 zx=a^5S{!k`=^{?JpsNaf&x?v7m$0;Pa-_(AE6`9z6k@vql`0GvC18j#1nHH4(O6Oe z>loxN#un?iUz$YyA;TSu7mqQJ z2_@s#!78!VkUU1Lq@NcPqq!Ed^n z!xfmWK+O!7Ex{+J=LT}l%s|;mZv5hf$luhlrxz#YafXPTk!PD7!qHX;$KX(p#5sW0wsrt#!-D4N zbHIZ0mA<&qyQCO5mR(eg8>KnLIC8||>zg$hi0iWLU|lwo;RA($5f}`t4U7bT903Qn zj-rTlE*hi@r|ebuJHw68a6$`}(old%kwikg_j-4YM}YVieh0scKgg4SALI}6Z}21^ zELI_WwyxsS%TA8*J>wP)aM{=x)*>j&KHS5jkZoKaAFsy|fJa)Ur?mjKBC^G~;kI@Q z5U~_J5^%3|DX|{Lr_**fT!GquD}HhCl2N@Y@O`or!4yTKv>*J>>eUd*ZO1@BD_GP$~7IT6d2tL`-tk^>XJSs7I2epej zNWDRkL)0Pa7-dtbJT*Yss8IW$xK<>@!x`*|sgZ%mn#h*OP{e*P0wck;zN_lWe&Tp# zIe&WC)c5>E&lq9|={;kAx(Tdell(ufu%-D!Nb`fUG=ED@iMB*DD#$4r6{NM43bShd zOwC_t4L7!i^D(l}n2f=2XqM(@UoU`~_0| z8l=RZ$>FU}Jc0175CG&)>;mWlzc+%T6m&RzjwXiD(KJY4U|a>sf}}d|whxQLdRDwi$Ps$-3!}0bO;Rrc-H_0hp1g>K2V`KKtl)FLSdv8s;#g!SRS~_5>#CIiez-y46RH^ zef;FOK22GvnEtHK=N0Nmw^=gc7jW4a%Fvu~yzc3K*SKZjrYFC;JW!a||GPfD5L_0| z|F1v1@DFrWh?egkK+jh@?v^Ya=s`nXWHdq6z?V zsa*gz&J#0k`?-S z|8K$t@!C0ljp>L@2RHyu9tFS-ZBKy(w!01ACp51t5`DWP2D{|C3egf<@)>2ICefe^BgV)5hf2I`aB}58E(#A ze|MUHs+{9m&b$uYW4J|ooh6ma9xyL8$7sQP1HGB8r`tNZN9p7C6FZ1UjYcKgQi9F} zA&qX)$m?k50!OJ>OeDN?1Ity370>&9Mq3Go*5PEyhe%cRn44Vd8}g0#?)8zPuL@5X zf)Y^+Dxsp0R?(QNRbs`yCNXKWl`vosPnME@_ydxo$xo7#Npfv+C^?e6H%TVZJxO#= zvI-Ye!P3M`&jphZu=W}!-h|0R%i8YW3FE8Hs&uVc8@Gv zQtUR)TUzWMIsc+!w=sBevD>(;QtS>c)Gg=J`iBziOD|mc+?H}qICxD#PYk%6p#xST=8FGJZCl5K&8kPNYvMc<2xdvCU!WgR{3 z2A>`sY4GW-sEHb!IIk5oI)=T(dDBQPz6Jdq4L%+H9jJGrgrF40`+KCY8FqtVSb^RS zGZBUB3%x?!E?YH)v-YQVt^B@a8(P{fC}mf+l)hTty5w?W-n{;oqp_%*DB;b2SS-G{ z)zJ0+{V2tclKQs0=d>m=nM``_;CE^zl({GF$j8NCZ|zERCzr@BG`CG%h_(O(?TDXc z+X+gr&1gpk`ytsjN{y-nHKh+0tfa8?o4Ns8^EIC;jY^GhZxm^A%YhHi(A>}&j zlnJCFiJxWCE#aQxK<-ic6lBnU1$Zi~kW1d94uL;oueQX z>QsP=&3i64l80&@=7Sxx&3g~_?xr-eIX%Zuj?bc#!1~NHCmt#ZtN?4AXN<5lgy**V zQ$zbu*Bt}&on&6IX4m;9P8<8*iGU( zpF`5z&X7hjJaU<708lc2_!uC;i^M6Q06%fb3#zN&8gkiO`-xLPMsx%oFLGhlq*f{w zj9M|_C`aicYP?8-I7$yzCy(yoD80@puRsZfr*W%-ne>?z_;u9c##?F=_uM@RZvV^4 zyY7azTVGr9l^@)7;HCe4=S%SUYkzyo%}2j^5sBq+jnjr@dqGCGl($et{mEIJ%vI!Wx)4r}kG-pPKLI-Yf?VLq7;N0OwNMe#`i z#U}^>Rtz~EHrnDD*O&59EXw!)FCQhO^aTUp_IO&8L#Kk*%g%tKO^ef%i)}(rIaY`m zk->-!MEFP~ax6lB?vB7ns3UwsC=?8W6EjoLPq5tZ`jGImVCkzsJha3Ss~XVnSyIF-m)}xkZVklF?*~(xk%nSd$8y)wBwW zT3bDonSm1*S`*1avMoloCh{?m1hb+UF_Q~7W)rz^I%dy*H0EQV9_^S=7FM?fv!tPb z4GhKUSyaf7LroUNkU7-U4GfBaDv2-ir`o+1F`Fyf@X7{@TMM=StiF2d*K+W$(zmVp z`as`>k39;1AlM85o^2_3{R2icK5RX|r zSRXn4M%h`O=~)@6pwj1VaEU@Bn=cB+{3S)f&=N&~4Poi)X4O|gd!8Pbw>l$)7?sY*|C=CG+L^R`ngebt2z(H-THl#VUV9N}I!-7Va z^T)SVurt4GeB5LjnXMTzpP^noW@)N9Jvg4Q@dO*Qb2cFccmXF8>Jz9kj3$U7@yO#4 zP=h^g0X3Ei8J^P3IO&Mh@t0sHM9<9+%wKo8F*lvOSWEwSWENb4SxUCMM=JCB+lraF z=WpJBTzmD5fC519(BvrDW7`Rq5I-|Yl;|i0MPF${;r7CVg&*bi=3dUdO}$0G-Flq* zp!KBtbY7sL)9$349nFP~{F2n-ybBdX7()z)xPqKc0}i@konT&SF>vHTEZ$toFU~Ky zqxGTIPr)SobBq@4jLl8u-331*x#fTw3>CzGIkz!)75&3U>24NIX6u{uuAzLw(K{iAz8`h!blKMv<4R?UD9EyR98#P+F|m z9z1Vgy9L&w(oTNd;wg<|aDRNbGL}YvH89wZ*2kyUXey`EVtIZ zNYP{s;o7i;s9B7fUeqi?P1Gv9id%ie>NPVD(x4ZRn~jsnl%Lh}Q7(w+Yex~~G-j23 zMXg@5dQ7_U(*pWJL0^KJ#i;4Eiipp}IYp2%0*aGUDO&Vjoif!llXx}7yE03ER;>jx z{2eoDyppy>ZC~rTZn4@D+49T5ja$ER*U?oE>0DGSl*_q98=JrN(tDOCN~I_NbkRkX zZ~t=1Ej=EMZRz48orx~uuT`~4ko-QLYivy1f5F%KuThl-R`2ia*HdlHsf;hs914k{ z{=RFz*0(O)$g+BW+rj`QNP_QwO^%WW$k#yz{A5qirB&e`LrwUAmP{mM2X)G>3CvIs z27^*Im4ZX=V{XEYAMKoyJCsYr%|JdWD_$TWgkn%yD-B7zr9;v&>4Ze{QUo6uk?c}1 zdjLXM0(BePV_Mne{C}q_LOG91V1T}CVoWzt-7#!NdC^0Vwj?P+84w?l$x-+&_aWz~ zuSaxNkuM@m$#B{(&35sBqYZ}7@EVfgF+@W!{6@fNG-QKw&oo)@)L|q|Nd+BFT0^cr zO`TFSH{*&%HI!oEz!2O8k3kzsriaqniv$HiAdH-QK^PICis~_1W;^%Cv9DtiWB~^5 z^d52A^6aGyhO<^gsDKJGOfyqwXlhRlfq=b*sls?NguL{ZS3Z7!-umyQRnu+I=g-@| z(Xtp5^O0+wZ*IP1X~zW+Kk|tm%%9t8z#rDF1^|FOV!Ine;hXz79(V{50mm;eZ1GJ1 zMGw}X6t!SwG=f@)_Wfv!$NL5azmx(;LDQMgqES$PxM-9pX!@mS^nPj{pT6a+(wMzU z9|VYyVlV30bcwOX13l93*6elG8rlfV4A#JGYFcXnBCrCl{DE0DET`yy&_IE^;m=x!{8^n3pkfBp z2-V4>FVtg{8H6tEc03P8I7-KBJ^8a{FE!(S3Il+ZgvVN6$P(BXjKP^JDmWc6;_BaC z=x@{eVGvE2Xzl5@YfsCV2kq(83xSJ1g@;*nj_GMk%qI?-UPoEsEGFqr+ufi{{KbAC zOnztx3rk#oL@(I_O0pP6O(&{8RFXvvu{JxEWYL%Td1jP5k|ECvFU}mXAEDoKzb77% zjs)Lte!uV;$1LSmb9ZsCa{rXEtAlz;HuMt4HS|)sI=R~@>!q^m!jcoXluo#jy`HsS ztv;+0UKo^v>aXGZ>{0os`s=dm4F(P{YnbiKF6JPAV`mr^7nRKO`iuE|7I>iH8T5>J z9{23_*gYOTWqAF?R0^bFna`wQR_0WeFDr6ZWg)AoBbTfzRuCDV*ldVtD5cY|oRwvC z_(B=V=kd#ae#z8xtlzHgqA2mTr06inif7>B+2e*G=!(+U}<}3 zM`%~*VCapIJv6n{6<)oiJzp8dgy|{P^j5?tL<@@j*MH%qI(vH1vM`nU!Z3J)<2Vks z2l8nF-`{R+SdkwWq4;73l@?L;$PaF{ie-SAuSV{>xrmm9cXT#6XYIm7(n>v{iSF-z zoZfLbZ2)$5bzz(%+w{m^=Tr0gKj_!Hx?rL9$5N->f2d#Yy6J{az5gHj_0A6XZtaw< zoX#Smb|-!7t?ss_JmRO6ZP0z3EVpFK=Fw+Ew%;t=;;?uXodu$Mc` zIY>oP?qDBeUs3FNm}67?gYx&3A1V9fSHWTVxI&9N0E}?0+#h1xFN0j8G9e!bIGWhP;^fs<5?rE@w(&)MK4&%Ba6|1wm6Oj0A{ne1l;Y0PRnwz+*#adYh@2vR%X`A^9DyG z>a^-vkj7c=!1HFAp7~9->6*KLGpaV(shWCQ9rIV@86HJek$H}VPG^$OW~;=%8I&SR ziXyWdhxTLuCBX3jTGs(r((m)RTuw(a!DbJ@r-4E|Z16H)y9`_d2yn;a9OP;&ax0i2 z8S?Tr`Iu~ztHeY5wm}FWgfGFzKo02e9kXs>c)T(^5jIg95zm>4*FS-&W)g^Zo@aH(%Sv)<=C$8s}&XaNT^*M#8asR`N7 z_)NcrL#xKo3enstHf!80*Z^Go!5JPRj3&}$MDPmvxV8t+{+we zoXi2@ZvlXsA6g>NS!Icj8Gg(wj6y9)eoWvg9-_0e0y|u zA)z_sTPq2zqrNmG)J!0x)Tw#lpW)TEa!aoK#jQkR?JzEcj3JDv-;E@J`0eg0BRO4oY$^-3L$&fL%-4FI=k97<2&90|=bczGR-XXZquS zDh@DlX-C(xfqYB>NSxO%J$K&HCwJOse*(5!0NslK7&M>=gUB)%cwe-$t8gmTLJbNL zrDy@z*SZ%WfPz6e20~~8QK(Nm2%vtr{|-Rtm9ymO!q5Li)2?9D2k*bTOn!K_q5iN& zt5GWMi%f3k>BrAbmgTH}tQCIN!~kfIUV#a{WGz(CsP0r%0>qn6Sv%%alS)Oif0&k1 z6%~YEXs;*R9{Xq>*8WcWJ6(saBfDJh(!2Ce@lTE~$Cqo(wdTH= z`=;T0ai_7~WHcGg`>c~s_;gx3F>M|85%$B5`<$bk2VJ|}dp-4@dhh4HVg4rqJAyax zPu|qf6X7!=mZ&cO+rm4F-intr2Lye8p9{S>AoSutLCl<9=q0uP zraeZX7t=ENdot<0zqD=T;609`9mJJn(oLDPS?I-9p%-g}UYwc1MTA~V`Vajun64Fi zQJi^(%lJKhY0o~P7ncgXm?HGz*$mwdp%>eQURZ@*EdHh4Hyw8^e(qkO7wd$7Ud;G~ zZkW)E+F#l}?-%-8gqaC;_CV8a!eJVh>+W%3LXsxo=u zI2sik@MQ98cmOn@1LxsfEW$jTi_<0n9}QmSVZ`6zO|^1&%&J87dJ# z^k``a;z~Q(u^3CS5CM!uJI+zAF&Dqe(2hd~7An0y7U$tCrT5a$#rtBB@+^!0ZF}Y` z{Sm+@EW#WtRFac4o;0A`h4W&r^1Oo_yFlR+$DD_Aa8`y-%Z~EoR5U5Q zvq(Ab9HoDUDd*2qDCS{*3FauheU<_PnHCMw1{8dkA}5Qm^e7jPJqNE}hITB%VsxQI zYG|I)Bqc@+uOBwFu69UuRb@qaS!qdeJXTa#kROeNLwUh~-{X_Tvz3$v}I5AUWnlnq;6&Aq$*H zDYXZZ^G~9b(v;FsN+Jg8QC}PnG=>7n-qE2zicFu}910|F7#(T}B>R;71SP*#$>)p? zwFHC3@j#%_v2b)CN!kL9$uZ|I>~3ruT^uJHvvm!jhIzW;I5z6C8$u1)#c?F30$Icaip<7js<*isx%l7_jVIZ1>@ zB@Ho!1P#hj1q0veE zMF$+mipBAysiFDW<7?flyV0>Iz>D48*9MXsCO02n8|1KmrNvPkFODZ^WK3K4n55Lc zdTeog{F#B7%}IK7OLLN3-BKJ6@F(FnlQ?5} zu*c<+w#uKt)fnh*Y7PaH33sTaeY9tz1>I*X-{h16&J$~j;~Pa|x??xy8ZsGu&heRf zN9&ZFLe6u4(*@%;RxDk6pg-G`ARZK1wzPQf-qMDY_`MR1Bo(qQ*cHlbVyHy=7>BsiQa^3~~mqN=cYg91kW}PHs+@ z1DNCPfm9l6Nzyi6vvaVbKUB|4 z*N;ClG=B2*=0Ib2Tc&TvH=R&Q*Vi7c%jA;ghGyobnH+U9r8a45n0b_#7n=1+A(9j# zYDK7j&q`%!CO4-sBrql^wvA207F{s-KRhWVALM5#$+6Qi%}frBomd`rLivQ|>ATtZ zrlb(1_xSI!9q#8CHE7G=@yrHyTa98JmFR=Ja7 zR<|U@wuNM9aeO1isEr|V-Q0&l#xS{Va`V;zASqbN zu^h<@0bam(GX9L_9;#93-CHGKrBW*>2&FtXMWEm`gE)e@DVoNK=^I6r8%dy;n-bDB z(jc{fxhYK=w=zv#kfGLKZc5}e+dv7RRHhHEH5!_lkCz8!kSPj-HZ&zkD0y+{!r(@K z(1zr>q2)@ZI~fSfYz_v4$+@1E?(RT$pgWWjF?VWn8YYEklFZ;x`BN^qu?8Vei#yoD zm3(sLoWRWH?wQ@wL%~om>Gia9r%^#(%=NS=S7=Ykw|hdtVnFy35Z1vhdkGoWvZ~ACL6K++1U=x{;PH`6A!4lkrU!#dslGpJtBp80Fc?XPu zG@~9j;{v>kDf0JdLJ;@iJH%0kh4KK5Sb+g@DefZ_6b97dZOp@3TF+v_UqDbq%Gjgi z3KXLrO}Gtq>?O@8l69!ZChDd2plHG#Hd_;y%j6%(PT^H~4t`7O>3hNxcny7*qYeZz zY_W&L1PE;~;S5Z{Rk$5n@f`NzeSA&`F^~eXlDtjcQK5g=z%Kbzd5+wHM#X1ZNeskG zB4i|;&Ze`+*}nci4SXW|U_=wn$A!2UYp@oNVjup14+*0>+C- z9>%NKPnSUt1R*Oo@Fw=*dkhdpoFqo3keTFCay7Y;+(I58kC7+HU#N<{<O0cv<+% zzd1l)JkJCM(5Hi=*@I9 z-9_J{2N>9yteJJPi`mU=Gkb%5C5S>?C=(_KZNhTlA{A6jZPUDV#C~K+|D66i`(GR= z85lkAtASMm&kwve@R^(~?~p%-8fB7z7B|3Lph57WQ1D2uZSR>?-NHrC0mW!JHr*{|70>~nz%R-s%t zQ&=IqqGGDERJWKPdw(R93jU&~&j&kG~iVr;-9%GlTREm}`5r9YG3 zQ7?I(9;RM4iA|ynbQmbvjy$s{D_elNk))|$=m3p@6lrRr0_bwqDsSm zj;NN<9Qj(|OBH2r0m5)X+3(48(nlsy8+o1#qc`sKa91OrB@2(d}4Fx0B!E2h?JKoJ%H=yI46cBb{hM9nPk=AdfDkdAI~q@KFOR$P`BTo9sPP|5MLJgV6o;%{~FQDW| zAKA#pVk7xkcvX0n3iz2kPram!Xo!SQaUa%W3SLH#Me#6dp`vjxw4x2C!AK92OXy-O zBDb?YlLzQXOvF6aMaPia1`Z1&StUkd8*!2bb)5#PdX-nG60E|P7=Z;mPNQCbDC}2V z!Sn2Gc1UiKg9EcwxdR{JBK!ek@gZ4-O&E(0h>gr5lLeWM7i4)V9;HtTAIWy2CqcX^ zmyuHkwvc)fmII_y&L)#_4QBE9qOeN1S~yR*1dxBm#kdCRa3@~CySN`dXv7vN%C zhAVI_R^ukzh6nK`eT3f2g7iB25QVTMx&Z~4NPZMtM70fnP4Z5*vu8@B zlwv!3hAPRX+;GK8o@VDLX^*xtF|w5H#8S2sPqLlZ%XUJ*Y_=0CG8hIw+ld6*sbJSA z^&8lBB-wWCWZUru+pb`?A<4F3C)o*Olukep_vb&IEcVQ>H3vaNyAmBT87YO`pJ(6racCz(&gRNKa>p_%D z1q(Bm%4F{9G1xK~gRNqujmQx(X|P!QJ}{?n$}|8YI#+QZ`M{1e-`F zGC@kQ!cFz{6-ruJlTJO}bgFk%7)GAU3bBF};$Bt=1_LWZDJw+cXvxnCLGdKZ#}1Z{ zy(}O5S-#SL;rW>OOKCRC#~PN8ds)6hrB>*^WBHI-J{UTF$*nkvMx~tX|D{xV+*LTX z0Hv$|vsnRF{E~l?6+ngktUwX5e5HO8E5I67fE}5-JVluE6yeOnM3(nUYfD+4QsRP= z2S3Z}p;|+VuIeE}4I>kDH73&4yprC4QhEat^aiefN+=)11_hR8@~crwS7Y#uHNTXf zq^qH3TiI4t$O>6L%V!0wfaS3~7GyydU;*Z5e&%C7x|Xh`Yv>w!BfXK{KyRR{>1w)) zu97TI#&*Q$?COr{71e91@2!5adPjBEcG^zcX&Y^mbgm*E!# zR{@c?IT!>20Y`$MLKDpT?H|LFt{fC2W#W?cb#)gY{;Ib{$IIk_# z*p^&%{z3;290azafxMTAX-3=T%w5RS_IWAtUbli71gQdlbIid+`E$%w;8~a?e~x*W zEFZvp1unoD@&PPV;3721f5O?ABL4}$Qs81tl|RE0Op`yuISTARv-}yBqFMeFooJCi z#krUve~K>5kUzmP%#=UDd1#eC!TAcj0JG%%xDajfek@13ydM`~j=UciW3K!$F2Pyy z$G8;p`XApa4UEAR>|lt03i3cLzu%OBxt{7U`^*Wg$3hqxAt zB2ItCuz*=<4f51)XlHbQV zER)~I%?i8)=gIqUE6$hq;Wh>S8W+m@a66XE@8J%A1>T8E%fp_6j`CZ(N%j9=) zj{@(-3i%yuz~%Bg_>BU8i!0=Ja38Le-^Tq4d;nL;Z{tA){tj2mZ{ZI0;n|Ku0%WvW_1wM{$`As~5Zut#7iB<9&NMg181~w|N2RF)lu?cJBz1Xb4Em$kR zj;9oV_%v>kUq=e-*QW+!_9Ipw&Pa07ti3=@@se&x67~LIou(?h8+sri96*z zcwT`oV7a9{`Ui^`yUucy{gw4o!NP0+yDqE9ymf*WLjIOrCOJhI$Z*9vDSa2 zw%bIN+N_$O(^*IG_8Q;^h0A;YHZozby+88y9;g@ll;)n$S_`FF>QG*^x@t&`sk(~h zN2{x9Dl6h!OYvG+ef#{OQfGdi;K2A<-rjSaj*-y|i_ zqEd3afVc1o4nn|F0{JU_9&Z`4{8@iA>lt!8bXY>XaKywPTMzUfKxv=SpdiUKhwLQA zfqm|%GsH+q|N9jor%un847SlM!Aw_x!6oUjlftE6+o zSS^^3{En`;@InyMD}TlazDEu`l8*FfvW54vow-Z45+4)^n$U+tUwK(XVVgRnG@yom zP6^jenmmMq?*=viM^k5(%+S>@(HX8BKM@x-?fC zmP^xVi5PV_?M|E1>a;jjYLDCN_PPCTL7g8hh!#eRqJlbGuhVPw8hw^trDoAQV^~7K z?2<@K9g$Ehlu9II2uj553`!)bk4q?_aY+f@5+#&cR8&+HyBxKdgVY{>G|X&&maImf z*_p8TjP`_)1DnrhO5~;FpC!p>O5|HS#zelwEhh3UPD3K!V$V&4ILNoyauOj9n8jyG zFrO(qQLHm%Cu}_DwK#+PBHu`MXE0%~*!}!0e}d{n;|Mzk*}YjxS)4<$Qc^= zWarikULT(443pqaF2M%?_LcAx+}PM-(zsLdPm;l?hDPg_+>=a`+=AABu#G+pJy|bl zMZMl2KBv`Cj!}{Il8LBPlsu=&Y~0T>xh>o1J{akOr=ikn^iFEoPA`WMcKW)c!vdp` zEPzPFXX#RS@Eh`aT7twMTl?z8{yy=Lq7?f2h|y%PgV;aZR9EUC;^9NPPAHU@p;h6s zF_<1BL1m0o292sg^)ZBht|bAV%jN4|%pnO3d~4AfoH~tD`03}FcC*RhFq!Q_*;KXD zXvopbD66nt~#eW7L$G0tY+yqo*@{t9q6kfEL*#2ZYSntkvrDt`zzEX5J=j zCo_-@N@i@R^39JWXxY7IIhm_tU1*!>oXn8Fr`WCq>km#5iKTU(1x(iv+R z5>)iH&1wx+hlh-y)m70@o;pjNQR+46nMke9LRLS$+F>?1j=V$gLuZr!iHpy9#HrTm zMWcPu*7mzUi_SQI;Qeh)LC(ALF8Siyj)fBo7C(4dt0PNdXBW%vpY=ia(Dtrn10Vec z1TV^;2}GqrEirCdTuYFWe~>CGDyoe`!>5MFMH*_)g?dHsn%Y~1o2zfDeW3cm+O6ho z_C4l3mR|dZ=0DoMG5^CZmm2wbTP%6*aFsD7e=L`fB?MR#9yoBi_=Tyibb{D-s1KYW z{Rd2!`y~W^0XCO&3qQ*0lI?1GKcSzfa^MteAGDLFsikJSwe6<&ua) z>yn6D?UjgAV?QRjs3oyjYbP-dY6@Six`BCq|HoT)|5P0r6116|rW;=U-HneoiVhns=4uF( znB~s|yGn%!D#;|NI7=fGWyMhPNO)UV9nG_Zt3q*0xGL9S30LLh`YNjQdA^FO3R`77 zKW^n3$1tP(bJO2Le=RyxqS^sco{~S_#Lr5}U-#tOfAY4;U!y|)N-FkMRH-dn%6FB& zT`tVhFff4kXgEsZp`Z>}gKq=a=M# z1Zz&Ne?FJ0jiO03ixyE(t0G0(xP*f2s6_IkdDd`>JSLe*iNH-QO`$~ca|_nE4Oy6DX_FS~Aff1S%=)Z6nb-z626>bn>H>bJk0Kdh@V zNMG(+cGmM}-`RiTwU2+^bN-~;N)vga!)VVolgclP-rsZc<{PfxBuO#QwDryAAmpiEfcm(mzBW*nXYyI~m)|M`L;-V`Br60#0S%XCD+EdbxR|EHHyECetC>6e2n1iAw-eqxtEEd-ze zYPaDn1RMbYW|#gh1d0JDmx(U~HUU$Yz%K+u6MlY1@4)!k%K6`NIGaaZR?7Q@mlrSu zo&f`wwlD;4fA_4;vgL9f8SO;<=EcjlPp%>O^t3CcrCCL8@wr3`=^41ax@OYap6l=I zCaUg^a*M&`d(Q8)d#5a(cVp}Mcf9#ypnwdqo6QblH|N;0K=^xX*q?=U@ME7;Tq=~P zLi#{Xz!I>QdP;pGRF(QNOPMv{N%&4zHRvUaWF7CBf9Rd)v+~~*+%IM8Yn0%cSL^gE zWls$}9zVR!w8qO;)nqiD!^F$^)*7SLYBG8q{;1Owbvh`GY79}WR>Msl<3y2&&cN#Z zj-#3m31yn$R!HB!Rd4@E@%{7I2@ZC122F1|DdP5tGL_t-cwi%r*iN((_*WSTfY2^-`Q57709P%zLQ9@L0`~i0FRvzl}mwhq>qXGSw zAu|MWf9z30F^b*u5na5V^Oe-_(kX)d$ncYF+b`Km$E26?H&h8Tgmnm^7zZVX;1b+f zKKRXUlRx6Fb~n1W#&kud{FMByB%bHG%0=@vMVgykxBBVexQ}JV{l6aP< z9)d4oGK3Rh8V)ShyyPC_F1(wAxtiGZ8fucvs_eS6Kza7{geYg0#sL>GB zmN)vx1TTzV?eC7?m56bq{JisK=F z32LHFrzz^7#qgDu@NO^RJzi3xaTJE4e?>)HSNpfoi%?8ANIAd|;u9+)9z;nrMOwG4 z@T~DrPl^;s{O44Y@;2nXk#{gp$V*YLWH3r1DHRWjRCLykTYRF2(b{>S^+2nrSWe2S zoH8mE&l9m2XEq<2$NL-qQ^wa~eA1MeyL&AWTvD?=!WAY=E&XquD)yf${QqJT6))`9Rr6y zKWEeAhnElRp}K)_CkoChmrlR8dc<8nDA8#9bJb0g7S}f24uY-ne!(I z@L?{8L1h6Ml3P(0VkK3E957?HGg@C?WsEdr2ejHzQ?geHC9CqQBEbeG(0ol$n;X@% z4T;S5b@-^yHO3N=%A=vEG_s>`Md6yldkdc|R24cK@7_lI$9$Cu2m1QNf4=nEc|Ug? z(@U*lUrg*bDys!{CAgQ4w<;!Cc^O{}C9T{a99)$-&RDWqe3bhfnJB9@W9nuCbeULd ze)MSgmED|HdnP+k-FMZh`%6x1oB!y@X)Ry8_~Dhjchfc7@44scF^y%nzd3W}+m9!O z5gyK@_k1pgyXl%W?GN?6&gGC>Z_jP zKg9%udPS?=C>0sB`fBc;$Jxe`nJWqP|do-RuM_%Yq7W+F7e`R9*2}KE>KReao&3;8bJepe z+YS%k&?o=Y;}<=AvED8JB;{S;KA`@>^R@r)^sxG{`zQa;0c|!F)Wn_bzuLWCtu{Hh zLK0yWt<+lSv|1fbf3K;iENx&Elj1@Y7ni|XWYj5&ET>SLlcUpmjfEjzJ|$Y2$A!aN zSQafR3PlSG9Z{1mYBEx9M9}61eS~yi4X6PVF`I9BsBpS`8qGxQY;A{jg?5crrFE7c zXCt&KUIUlf*35R8AgXrazlMY+_HbcaW)kGXJzf6FdP1i7aAq&c7UfAhPg zPh510&y}n9rDyo{&s}lm^$XT3ilruP+VzjxcyP`u7t-ex2adC?f7GfMPP=EWf*G{( zB7kteunq;xyiv_xTqHTH4r;Tj)B+JS1uly^8qia1m|6?dN|p;(y|O)rhv41PtPWR) zyTjArz0P)xe|@KFr{yb~woPm^wwc<@!d^;5n`oD8l3j36x83LTdwm6k_8MAaE4PoK zV{9YsEo6qR*?yhH zYKthEE#4f9HJHz_zHlJCG)xf|!;`{0!*7ID;k5qfF4`M}sc@7YLZ6 zIqGPRf1Z-(l=t;INGqHGX_YGWI*H#&oKjJ>Q>v<|a;_|`c1odel~ao5S2?4Sp}=1- zyI@7Znu2=^_7;3spefi+mxIDi;*#Aa6;<1$(rOz&)h4;B4Yu!W)RrR6o2eA7rYX9- zM-{L>OIrDBV@VtWDVD5$3)yKQmZ+#AP)$^=e^KpK394sF9EE5kO>mI2(&6B~*3LuU zI>iGnu|L+|sr+d73#ZuM>2ma?S4dh9IK=}F@mm}nAsKJ2Uaary@8h9j4UZM8N*u>B z$AZVP*oooee-#k^&xq1PyLdy&%gFd-^vvnpQbCR%kHwdGSm6^q$@N1Zv~aV zf9atbdrCgI(IyT~_uNr$ZEXpLcog|0i`#6jG@DPtv3*y4`{%1J@hbzcmg~V?9e=v~ z&r4oPk4TR2v&50-g%N{e??@giJ@O{|__(n+2@qBa>(D?erCUwaWN5H9RNWxyC)y^K zjI5okpKWU`nOxhhKgV`XNqg-*C2MPcf0vgsrGlxdRKsr5?%?jK-3{;Ko2u^;eGPxZ z_vCvq&jEr8Vrnp&8bV@TNDNk0R*+y-RfEZ7@&&6b!C+NINHmE)Qeh#af<{SHj2fak zbJP?KMgvjTsAxm9Dq0;KRvxX022%7w$rFke=`=3QFj_>vt0Gm=hK59KZ6XvZe<{gt z;AWmFF;XQ)2~p|wDz8^>vv~rf5}pi5c5pFgqWLSONhC8OCq!7i92^(Ive;e#!d1& zo17I1Q%Zhklf5{dS_*jj)h3fKUCyy7Y0rt5Fc=I5Me8fqsg%E$%(?c2(O~o>j4CS! zqBTKM@>i1C=t%?}x%NZ@2cpAZNnhV!NmQidubwto62@G+MtGX6Q2=vibm88wUNzTmh3 zoz~xfbj9Skfl=vvu1!rD`EpRs2U^K}$H_eU_X@oOA><%ubJh%!EtHm~_bi?ek`ZqG z`95VUE8-s}EHhu=I^Vt0a4k_Ax%m5*=3H@K3o?e7YN5T3MeafCkp0+3g_HN0jZZo= zDsKm}E52DTzp;{ zcGam*FF5^zbC+zNyZp{OIxc$3AYRuvzfR{c8FdC%(cN?Vf8S9&pWhnAiNnq~ZQ-=p z+;=XP_Y2d6FX2G}32)?v!4p!pSgIHWc{v^%FPojER;SZu&GY!O7|9Mq^{v?{GIvWf zs0{>3ip-UYmhYFAOH3HpH5!WU8vmJZ8)3$r*2XWe)_J2(>#42C5V ziF!Wi^@)AXe*=yKnF#WK+VnR*sn0M&YC2m>%CgJCrxZ*rIIG~{ya&Qhldaj$_@2t& zrP`x;NBBr{K=rl8XcNjwg=%FZU z*}N?g8%fCrd$PrXl>GHZpDn$ut(A1P5Mxbc1*{fue@7{Fk_$_!j%`{XMYr!u5%s{| zwtRH+OUHaxcFzav)_uUg!k7JTzdUgGg@rw1M$RF}Q@qZHhOXTbPtgtoTHaajNG9iCTpfxf* z|7^qAf6hgb>z#TV-;UB{wzQb1T7MOppZ}vvrFJ<*tE*5fG(}w9;(GBm$E~ghtPeQ# zwoue$G&n780;b7zdhBTr7S|brg<08~1hwb4_FyPGcbKMSgP*MR@AOl@D{cu!Ig>X; zi6QEbu8p#&Gq&qEK6jFsvTD%UIpI)xt6^WFfA2tMtsuRntuDPoxV#M9o+q73m|)OP zRUhxCrgwv6_OOTYP+f(}3ic9TaUpiI(N5J*-m?9L_a2$E=M1Z8w9mV5_nv{DN%o%S zS&oN~lIQ#`yZe-tU;p~Pcg9Y#*p0DKzas3FJ^Y_RP+TVO7arwr^F$Foed^Srg+-JH ze|esea-kxsQYFrlr|~&BN_3an-EN0H&!@BH6=+*^DKd9cK~Qhw!y%9twD_RUwq)^F z$=Lncz)Jp}OF~@nNN}Y{#1vV*DOR*{aECx=rhj;lhA(U-c#!6R*mvL%9|!;59V#yy zpR{EL!KPe|NyAmlv2n2#Me;X20ZTr2e;K3lmzzSGu=A*nI_kcLst5Pu@U@gdQ8phZ z$^uQRn023?`{wfHZ+3ljn^Io-{;jvY|Nd>azAt?F^AfIGez$x1Cl_3}|DxUGgR~@X z_~@ezT#~7>##PEz!ifOhkQV7|cUWl!9YxQebLq?UW%KWyADBLHe&qg><8%K%e{4BU zPm!mJ*80Y|PxH@oPxp7Y7yB=BuXf+zxx@Fg%5a`-n`al>WqQ@~s!y$X$><6MK#0*B zv}XxHW46A@HEaX_4Kf)gPYwJzmKNme{YVedeYiSg0>R`^QdGZE4>&c6d!rW_W8rJULR@B z6&+&P;mhA2*iQ_*Unjb0&UbIV`5hOz`@UC3R2rN{qgXMGxL;r`9!k4JR9w{Q}C#hDduGC*%zCquk-yC}(_D)P^*BG?=-J+PMttvq|e<@E<;VB@m zglbeNB1tYn@-*RsJVaUxgI>TCaF!H1)LM-$FGW^Mx*Ehuz_nKq&0D3MQmbTLYJI~h zSe@19Z6&W|mSHCx;@ef~#V?cqNj(oA_8(AY%Mz_7r*Ie#G2`e!^dj za{1-|cKx-cvNE#~Y;e~fe-}jS;KEWVQS@kk2Zwu};_#`*ZoJ^yN~^=7G5>nuITw)Y z6-ArVf6AaGMYnQ!TygeYHjT|>vNQYQ#uds|KTupcaG7u!TZw#B5}#DwXjy8Z9|hlz zd=oqn`8jwfto~KulH$3gb1N^(xumeOa&_U#%DW41s(iF?L*+JKe=gNgCTddP4Um9NCu%onlUiob@{q}s+Pzwp z)>T~+Tp3y$+7L>HgdL&1p-(~wLqf<|Rn&fhuqxVuuWR-HpVH0+N{Z^t6n1Mk-!50ez#^?x&s0YSJ;`&%{vnv{pj|53TlU?@s z+7(4I1F->JvWgmCF?#}TOm=0$A!;_D#4~H$;B@caTird)OfcEAoWs3U)ipeB)%V@+ z{=eUMJBQrGsr(7#Qu7sdq;H0ksCkPIf^caPsHMrVCU<9{fAslS)C~%y$+2d4JL(#J zUFc$q)HW^MmS1!fxxj1{W))olA~DSk_jG5G7a_6+-_=>`I>@{1xi2YiTzw%uiMFHhrK>ILUF&HG|Mg!}eEP+a`* zTW@cD`0cj=e?;HSL)}1q2zud-R?80cj7Cr}2-i4oaXtheCU(Ndi9K+fpr3F)>Dueq z=X%xkbJsD|rMkHg_S=jY6A5v(EQ%pn=Nj8^z|*|Cy}7xqU2kM*+u!@4e>IlFbk>ev zy{XmZ__enaohPzw9ocMWhu#Yjrb0EQ(;Ub40?NhGe{PSa9Fw73ARe>4b3k0{IMn`5 zJJDW%za8&ecx9CfLrw-;RN3WYZJs-)!~fE>*V!N0GSq&w$>Vr9X~05hVvJJ_kjbpX z2Fa>nhs&7?JCqnyT@l+P5pz4O>F)>5(&RqP7ZdI1XQizk+cfTUj9N8aJC1doOWcQ- zT(ou7f5^S7FOMlotoR9D`h4S-)$`h}ucaZdWm6wcomswc!GlYueqXg;a@B1u+SjK} zR%7N~dBemnc^$H!FXmxCB4DLKJns)8|>?aOgfMqHGHW z^$7V2QGgHsFyi$4XaEmFBw!M7!U|B7Lklhyf1#+JVa`tBrrIKN=T(xVM(_-uyMflLB$rfK6gks7Saa!}O6qR?EAt}kqCT%Brcf2>dG&8cK6nbfj|n9UjqQQ!p)Bt!rbK*%OV zM*`|*BoZ{k&U&-C%WP?BZYI1Y&jGgy30g#pNY91@OgxfGF3TQ(J3$IgSpJR1W`od- zcH;_zG>|>k^#}m)P@^|`HhT!xqj}mro3ST$dX(;i@cUr1E!0&RJ!F-W!=tEDe`azR zqnl+V4kHxh%yy`63)O0?8$#*Gcr=$6kctuMv3sS{?n5oO9~0Agd#|yTaEs&4!&?Ha za>jwn2)+dCoMrOoz87XPvu<|<*j%pS7=+TqxSBN3ZiwRyX9&naFr0yl(Xi?_9YZEc zC&xs03Ka$#rO#?9oW*;RmoDCOe^L3a&&N}Wq1m2d6leM})kORB%+A3Xs^1@xTwbVI zF1-TRX0W;Vk?CAnEWp3N5~l%AqpN1|yYOqpZ`LfH{s5bi0iomK$HkRZDdi>r!9f5h zk@^tGVAwK7f;R=f5hNLpZv~2)2)APeijjCZxQ*j<8F<_@fEvfLOW8v#f5|FJtv|qp zY3KF>=kx*JI@<$$iabCic&>440HSYKqYjaq!4T18<(M9(H_*q-VRFn|#$pDU1s=ZM z*X`RI9&4r=U^gU|MMhjBk(*sNM;zU*&d37Sg2*zLqut#z7u)BtIdINU|C~8<`}Lk6 zgDyoi9$v)%l%L>F^AzA&f8OFrekj26Oh6B&VtA?qI;#`0qxG#V>AHv$x|(_{6AU?<;-nh)ct}@IcXuik zr2PRcBw4X+yR=y%q%Z30qFO^eIO|UNcwEG}4c*yMEqCy!WO# ztGX9r&h*hGU9DHo8^VW6J6f9O4&uwlF&Bdm$&qC@Ef^YFU|#T*seR~eCcbN3wqWhl z&+zfL2A9`0uCY(1!*Kw?^#D-I$<3e_Zn1ifI*+=E!_LEQf8sIsm~+fcj=DCxh^t&{ z+-t(*qv0o<#O<+hxR)R!vGp+mK#CxuZr)yvGr?Gp2oB*Sr_Rre>g*{g00J;DRGyXW zsE!3GHbu+`?flsxJGARGd!6tAoB$fU$`b10l&dkF=6R0x(3*NofeM;XSRCLz)V{Nw zXjf2lHyt#Te`7oQ<(!&4l|S`oCN}>ck)0ThINUC`(@i)d4mAeD?m9cVYr@f8xJqn@ zuuyvc2Vv2Ey+$!8K0G`OgWct&*Q~eW?6+uEfVX_b11qms+PezB55K|~)nDIm>20I6 z@m={{*|c(gWAwiBr#_jE?^fPE__tHPoAH7G0(`4hlE~NL z>)xZpFCG8kI_h;^=em|7))H%}Yu(q<>;2brYlW*r?qHl`;vUlLarxo^*$boOaUTfb z-tq^tdjMoXJGcUnpg?S~WIpb+7$xtt0-^i{=OO1i&I#vfr^8u*$H(QSXRDDr%w$eY z4UeLrf4NfWeiqDn5J;s-AeJWgvSL6C9Vi_KLh1OpKgva?S5(7j8bxMpc_jqFiKyX_ zz$Y-#yjNtRc{j~O^DfkIs7$zy_vT%qm(P1qBZ*w7Uqp={qI5=~blBnVCbfBX^@mi=ny&R?P5@VOrqPebky+V_%$G-o)iDPz+H1!qo>mUPzmUu@1HhY%R>-oRr@8!Sa{J!9d*bArFkIT_wICy~A z4Phv**N72nqd?IhH1ui zf7(U3)D|FWNhWbo!d^0;PB;@v^V9=!4bYDOP@Dh6CC<3yrc(O`xxPOacluJJ1B>@? z<;T8H5Cak)sd#MLmZVzJ#&s^qgCHJ%Y{BBY6oC#12}9|5^boumhYB|!1o2G_B9bFV z9$vOq6%?0{P*?0K8kn`=xe)O}*`K~se>z4M$<1Is{GD}=n2*dO_zS>FaP9nOv}bz$ zq4zD}^?~<=ccpjxe>w15;e_$gz!$=#@%aGn6`Ycz-!l*sf>N+QJaC`B%{a(-mkVF% zy|#C~d0X#anfLbIYd#^4iSz^Jz8G<_JJXn`@37|P3{_?VuAr|E7@h42spR4MrFaEi*(l0aqs12r4%P4p{+#03@UJ|Qc&m_W6q5$*Go?`P-QBex2qj{dj@zd zk`hv({$LE4;l3E`(fVSL9|*>Pf0UPFASCzCol}>K!LVxPdSl%&AkO3P)Qudu-IUXY z*r!&W{$5iw=*SDD4?(DO63j219P1Z*3Z;|dx|EAdD=8>CE+;U1OD8RlU&@=JU&{9) z3zyko-W1tjem*kk`J#`_&lkN+K7#%nM!`2dj~tnZni`V^!|-gbtD&4be+o%8WS8iy zA-m9LHrv%upDfp7l6TnAGg8ufFWGYc5_72i?&s!T`PHAi_SzREWpPsE@~!|E)zoF^u-mgcn?*8|73~H z&2EoYAAc1@*oYR{7&#PiL<+>O$6HWfiS~KH!scY9r~z$2VW%c$f7Jllil!Q-y|7L3jXSmb}<|%jmLKdqh7g`?cSXZrzPBq({-i zAV-jKPyOrpBVC#w?N1TE@SC>~ZRjGd!$ae^s&tH6NsfR97_@vewNE0_5>(xc2YX;& zo7?B}xOK)(U3kMwf6A$ghB!KJ0ZEt~(vr!zrZ+%|5w*Ap8t9O0#-dTi?J-%#DaJ{! zrU4L=P|V|LWI4_Kjtjbwq?Mj2Y2|WuiEIv+=9G!zS-Rw(a<>)@E#z#qvxF;NK$Xb? z#l-;c6z!3>%}^+t;fo+xItirGaln_3mo<8va&4#?e*A2Df2L0>8P~g?`SI=6rS{5m z-IBL=;m7a^4qI;j-r$N`h$wy-_g}L91^dueZqPF@(YL{oBOn3qvU0oNF8&#T)M(AC zq0*0l#%SyuV8UL0j&L<`4R@`0ZQ?n&i+@_+tr$$m9v0(T?7%Vt<67*%GKg_4c3>H* zo!xB({lL%qf7|?|e+e#~)oG5mr&unAWSVJF2361QM%A;carLb3A)qb7r=xq~t# z2h&6&f0Yh4gnFso;Ca+}!R6F)aYb;2vLbyoypCEIye4#wa!vYn>ek?P={un(iCxq` z26u+`5eKP4a8KxY<@xmM(rck#N=HJ!kxqm%UMVbPh>Vm8ZBe$QpOFqquR2~8|6TeB zeiZtgI3s-?;%4K3Tm=W@Y#ea66=17rf13r|e{D5yOhS;SZ!;x7GMnjDC`c4_xXYKk>llFeFH#8XeCL3<>IGNN~5s)z!6OLQvNf zc^f7KON*?|3L&Uf2|=xf5Y%c2L9I*(9)c4f1aAg1oIuhEoUjrUxC}z_GKy|6 z(^LaK9j}YpJqT=4-rI6vUg4s=ue+L}|A_)n{i|{yTtg)%jhKH+j|0zTZ4kMT_ zlgUhBlyJC$5@sepKpz4*pQ}igI2xYJu_w^M{~0EnB}xttkB-j1Hv3`?QCL|e?Mu5A zH^oi|MexSBizFM!8AMerELgcl-m`9hVcqUVWUe2g=DKa;YYGppM~d19C~!_gepEVL;7>0Wl<~*^nS%LX$CBlNL1jgf%&*uOVL{Q)(jAMg? zKqz1VPK+lWY2fjF@kbg~GIecrHV){hQ|8mON;f%8=LZL%tGek>C73>eut0@9n++UB z5Fi2sF$joo)l)KiqCy6idlkqtxIo-EwzO7Izc*%}e$SLqzt6_`1nQ5YfAu(DD7`-x z&h^iN1+4_zjqt+eDqcwQi98!cOkWf+hI;j(*s< z@VMpSy?HL`+5H*8nUpR=G zI9;dp8%&+n-zh5Leip^F_u!BDL5KnQ%PogR#)Wf@qPbURNjr|(U zcxzx7)~!J%^lS8K624M=&?WiH5_(_pHCvzYOD;GH&vWBXkkI}Kf8=bd@=5Ohb->$- ze?@I4M?fc>u;$4?=4CzOkB71_%PsX=p)t2trSXiX5gX_3kg62i z{Z;+n^nfmVn1N*p+yXpZ1?+IhV(=vZ`A(ke6zsq#>i4%*BciY#-5iC{9eOmX>tQ{S z=|E|$)^@!73|ZdJf7aHHPCe5pcx9W#w**3$=$}s0~+F>Z;J$ltfo= zXlQ6lG&Cd=dQ(CdIy<$5E+!H>$MYJ1BH#r8I}^IVa}cw{B zv#G<(WSRmXdQp_v7@dfoMvGtLB1DU`4$ZOAG2uAva5|K(f2IT2(c^^wiQ!T9gW=Jt zj!_dqmGP-9?pB;U+G6|dFLT#_Zd6q{WoO>)a|RWx{^w(XP`={Ef8?|G;j2ACrFW>7D+7bDvNwS% zo`vyB)fV~g)O|!RMkuBLapTly_9Ale)ZCkK?eb#cr5n+~YXHJ+#VK+Q^&#j0+xH#i zkLrZ0P5_+CgXAK2vAv-P?gREkHYFJjM zx2Ni8$GMVGi1xzZ?5!`$I8c^D)oAE#LYtP9E4M{dVd_NNG!WgLd}yE}M*CG|X?Ed2 zS45H`#=KiElU2V*>ztQ{pVsRw{ly)9=Q~J`e~%YJoeQpl>v|Sbq$COwNiFVy>n^`j z=6N4YIu`X5x92Ye5I$V|g6zX%b<`4?ba9zs z7-~W|*lRI@X#1~Ji@gh5Jk?@E(GO5)gAhElj3auXbRp1OtE@cQ<_V8(W|f7;*{ZWg zf44lOYITqqHKr2k3&amW7d!~xw0Em5kE`9y9$ZCb@phV(0j|c7aCr1aSYH|0>PB4l zxZCBs&dLrL7*oc>PHgYuLIWL|$FC?C84Cxy!l6*u7`XLPMe)&v|Vaq{q+m za@YJd#qD^Y1rZN)ar@~Agi0we)|eR-Ou`B*QOZ7nP zZ$J=xrUXG8qI;o&Mzuv%0+5Ud7rL;J8dWN)j)|pIMMd$n?)B%IY?)DGhaGldoysuQ z!p@K`lGz0-tX{>vtY(k`p!n>E)P3)>iu{N?MV^16W%Oy`$6}r8;m9XuIsa^r*&cIJ z-N8PZW3gj#yW=m_CZGN2cIkE*jwPih-OE17BdO)4cvHMN^Lw9qbG>DPHE8`N?XT(I zWE{=>$`-aywNG_k>3q*Mmh)lm%Dl(&9?O4FS|pwF>@7I#GZt+tS?-_8FO>531d^jI znGAmsApm)>Lxcu)I8g{cCSnpQQHusNq6Kr&fhFj}RoI4K3F}y`a7_<{(L9feLwHOa z!g6s4H;Y5K_aAIMc23^AqOyE(2rXyj${T;;5YogU$l?$(#35wc1lnDaTkj z=cKWG{o)XsqdLF;@2^F9GMcwd98x|Lhp!i=DZ03KAr22cX79te1$f0L{cp(J(>3Q1v7G@;TYrqs6j6-$4V?g4_0C(dT<4rFdGG^MlY748#8#HW2vjK1ie@e zJIYXqa`^utw>_HQeokJd-;32)i$3(A;=j#dM;>Ni2^L@_da(+8?^FIbV zis3^MCc=&uEJhFP-?MJ#xmTi((=LCkj$Th8?5M(0EQKA-Sb{}ZjMZ4hV?9{KEv-Qh zy1Awnar`$8J(!P`(erQQ7M7#sjI9gMg|+-_SHq5_=*1#_U3M%$FZ!^SUq!^0{md2k zPy#!0&cr6b!_T7&OVNkLuwxp!u$-5%0GCB|>(PtFyk(~0a&+^0i(D70izR>jT9*FH z^I6F2gSEjD%*RqL?c%j@{xwF*>5X2gom*jTv4CIicw1e8E}p}V%ds5Y(RNyWrcI`! zh1bp!o^Ls?-$^`w57+3yGR)_--OZ^zdPd{Ab}nDVdkDk9)n|I;_;s-K)#$795C4DW8hT_Dh*9|F9j6~9FOY3;+1FcJy9iuf5Z3J+lo=_h{^I&cH-!4SsibINoy<3@knukk2PAO|v* z;Tqh52Z)YjDa)0^h(RjyQL8+p>_-=tVLQU)S3;9`t+Ex(n2qK5F?Nzdu~U3`^rNxs zm0slyB;Zy&OyY@yf35d#TTXhuKoz#aHC4&X~N zg}f=|s4zwpoARpi4%C0B#5`;!0uhLwWRa=lacUA?7yiyMs1D7ThaN2AE%pc=!7s5L zUl2bjB~$1W+D>nwo9PR}o#M6Py0KC8;~4@X5;u`a1DQ=8CvT89Xa-#?TssEDoE|^< zs6j0*Ks%OUBksn2e%6OEN(d3iLefjFCHIkSWQcq~UldxzY2trp%0lG^u*)?f6%OQL zGHTI+HavkH*o`54Kty68S)_yn$rSPfdI4P{_=P6nV&NKLlkkvmP`prlV$47GSLH_K zL1nMUwCF7i|IEAj-{OWq=5 zR7)Qh%7igiC!WVJsUsJV zS>z(pNtTnF$gSiN@&fssigX@*O2`pb2v-SL3!8-#qD#C={DW%ESo_$WW4jffvP!v8 zxkdR4_arTtfO@px5-h=T^kEII#MQV4{rCZHz>WO#L)?FXUtuSn#xoeg5qyplB$jAN zBFP{=;v*ADC8;K@WHq^++)I8=J|rKLZz!Q6m1r5ANf*&u=!5h{`X>EAXc2xX>=oV= z-V{^C8R8tVQ+z~xLIsr}X0qnBlZQ_|Ir@{)En{>nf2>_mD``r)Ql~tryr3Lb{)$Z4 z;lV`A#9V(|gH8A)!q|;haR3K!7=OaY_=2d2o)}0r$sseyJaQfR0lA6XMeZj*BR?aL zk;loCBuv6&FWE~5$#2L3@)kKnj*vf*lVpr2G>3X=8J$NL(yQsCbRT_zjtTKXn&1?2 zgn-Z^tPrjhZWbOEekr^md?|b*CW=X7jyOr|5r2OyJ}y2l9u`lk>QpmSSHu`%Zjad* zMUJ6!y#-QB{d6IvqzwcK=)+U=C0c;yGrIqqpIgZ{*iWkQCo+0^WpgWT#dY|ExXFdI zhWr^1+lhV$T!rCAz_I0;al<*`60eQGdgJs7LhkFk=#P2U@6Uq6RXJ(ma`gA$s$o* z4A4akd&SN4FLX2c0(EpNKj+&?7q*dn?8Fec7*En+u}s{D37858tm0De+<^P3 zh)3v4Xu)>0VkRELJ!r!=T#qUQk%!f&A+vu#$TuVw268JXE=#vE0ZDidAkqD%3-dRxr=4;VN{I`j_!C~ke%y(j_&HXi6%CN-G@{2CPGAHd;4Qp{-FOtY;tF(PZcGaru^c%# zjO(Mlu?I#xg6kpRF&HrqL2Ska$ih5OB9L5?ix=@r5}UCbx6xXaLG+SQjM856L*?SJ zi*Yrs#%}RXm;=Zcv|c!OPRs1(Sxt>I>!$}RCkG}~luw*c>MtoS@_7pjJd!&|OTI)bn*h_D-&5KVMVsvWFJ_gQgtOl+S1qy*+?HfyZ9!w1Wsw6x>O|=!G0#AV_L|s!mH%tx5UAMDZG`|9mR6@D6ijorbxld%o{SC6Yj=NGWV_}3lmgFoy&+PY z+Y@!sK!Wz%K+l;p9^&dO)X;pUIte=?=k$==8L}_1htS;W3{lraMtUY2!{Ke!iqDDv5FFPk;qk=Qz{BLZoXv z9FnAv+s*ogx+Z@V!>*u`$4d)5Yr=HM*{8RM=}@gbgr?RI>1wO+nhQJ*2W!>a!ZPL; zcpRbivsxo@JLabiK=w*)A==4O2FFuU=CG9Y<0)sdcRC#fo}GMuA|<5BIrG)&Qu-At-+NU(r@roknlq6l4uG?;nkD(k@N^- z5q@w1Xd{+!Z(h|tDMokA96)8nd&Pqb%P9v^qTRqiGl;8o)8UtE>svc#r}ou#g-FLELc3dBU>@9Gl=N?O_$=(Zi)E`2*Xw&+o`P4`x~ zwGlMzEiUr>g08)&vERy*v(H@V+(H=FmCj6o)*7BAu_XH51gPrJ@PACt0wukY)^^Wc+B81S5nUdE+g@U0+ov7~F_oW&>3EM;;cp z=H+U0a~|)o*JU%hqk%}kuk}I{Fk$FGtw*nSqTUs%`Cr8`Bp8j8REJ3AF(d?clT;`P z1vx=!OQP~_l8W-eh_%ir5a%h$Ov3d!q9_lOdx>zt_Z}sVSun--__C7fy}_9P6bF1rqn*6!)4I#m_{@riC37=9Ph+xUvR?vlzPPwz7rWVQiE3%az|Q& zK}0F;FlEma6RIQEpD-zmOvs^tNldD<=AZf}u(HC5_ZnbaxiQ8k^%bI#EI~xlsmSA0 zD&mTv(358sr_B(ksdLQWC*N4C;~u-LNca`bEu+LY%nFJMFyJby{u$)0N&^rArAbwA z0tuQd&j8VSMPuc*6HUE`&Qh%P4bsZtC>DRk0&?34)!s9o7RbM{o&ub`iOZ+~=Djud z7R`l1uc!=z;FI}|%;r>pLB46lxFUSk)Nj|X*hwYV0;yN1+>BD+5C%3{LL-54SSFoU zq#a8o0a3(qSZ0aWAJI%2-wn53kopM}gIKmRSh`au8YZ(57a{FJWp}(9;9Plk$a-31cj!d3pgWvBM?cX1B)%Pmf0D2k#! zoj}Ja*!jnnW3lrO#6yacAO2CB<*^rPfGe7oBwwtF4G@1{ZV^cr6&`_KPpd0*xU72WBTvuO@#j%)L!ZHMmSE| zJmZ#x_$sI6aXOsrv>Txcs02h_v6}F5;f#$>oiOKuv#`)>GCC zq~7@r$G@;UfcRbcmEC{r;_@YR(ET`1(LZ+Y2>QgUJCHKOUYGql-#%jL|#OGfyyczWaLdU^FIOt zF5x4+QK`rf}Vmf8#~tF!1(JjH(IORfi_ zlL#r2S)xJnhz89r9jqyYhl>R(LUqkKY1hN576>Z z2aoA2y_l+iTl|MXkA%>hc{1N{fdgJZ4Q8*1?5;vk~%Mr0ltdc8CvFE*O-8{Fp>`}%ozHzG1L06!Z z2ji4OrJ(U_yLXj&@{D4dI5afVM^%iDqff{d&;+t1T z<~iWvfEjC4n#xj#|r z<(fPbf4!orkGY>vB8a#@q+*P6)=04s>)@ZX1LOd>nYv6>)Ov5pp?E?S7ASqA9tX>j zz8{Zwo@w$ebt`l}37Kz{(18jbl7JW;MNYG#Z+0_6pU<7Mw1e+B?9{~~~G7lU6%SqG|bu5H)tT02o*$}O%NpS+a&@J@Fc$nNcdXtj#+aeI0GMY9x$d3pxG5D|1 zum2zl0wy~885)5HGPym#6sn`)} zt?E@=s6E6a*`e_zp09m?mCld$l9#h%9>|Ex*v*J#rpe~1_@nq-#aX2$goB1-RZO(W zdad=O+cl5&1k zpGN)lK(*LK!TAopPaHo$Y_GIIY5ly$`F8|OXa1k?xG((!jYk%Uiz&tPDO>sCe+yF2 z#qoc}C^`v)T?JLo3+lh$ZMz3{4*rETqNTNYDTAZ8dP7n_@VNzzbvl{nAs-%$V>7q; zbfI~L`T;dpUaGf?)bnzi1%-NH!5$ovw+risrKtslwSs*80dhaUc{%O8f<{q(-CS6i3jogY-}_4|!rvD#%S)*hXD4e*r4{8Qp z?+@OCg6>LBbFNmgf1)wJQc;jz98@O+&e#|9R2WqE3tTVqzd?FYFr9GduG}=1H|~u^ z(uL7VLg@uT`cW|U{ZsIs7pb?4Ew_u+`zH|HuI$}_2WQU<9M29A#_Qnpx`6b$kaXPJ z#nRhFv)jd!+k4pC#gW@Z^4mq3gOd})zxUx6saRz;%(C@^OpJhxx>2ScydhWkFt694 zX2c;^@URPMxc>$z!!4O%l}#~EPZ5?yGs~tMX6Q#5>H7=ng;bv(wMPknfPA=uyjgL+ zSpg8=E`;-T1N}E6{WnAXdGci##07K1{Ws(My`j@}Bm6g`{5Qk=y^+(W#Rctz1apJ^ zdD1yQNOYwMB@o+|WH1ZT-M>$uAbsni6#u+5_q`!qoM{BJ6^U z&VtO={C{}kyp;aD)a4ty&WoKF!~+gU-nasiw+hOVYP>gn= z>8%4(cAgiu9G+IN-L44T+oMc+As+3q2TQdqzMX1e3T=~2ZOs3VZZFiaPdWaR{f7j0 zXok`alfcjb&EP}jTc#Ns1#1c67c0Zk^@CEK7=Ut(Lm_YQ)&=%;X+{Z7y;#@_n&pMm zib7hX0>9e@eYE+L+j+C`QkjFIbmC}z7)ZUJym~RRoe_Mpm?*T@0~0iq*Q0wEKlvoj zOmMFU)i)#UHv?fW$SaDkD+>Q26<`iYFbad%1&6l+NWS-inHx>V1BtNtlQ)-Mhvnw8 zb<6#-ZKpML&wWeXcgv3Ut#wQN#jcHBw#K=#c*}ip!EWpHymf`U(+)(UZRYH}^@OL> zjzOZ0{?avTXTfgD)paW&3#Q+4eq4=$CzGN8TDvKJDK_UbVu_ZkCt!(3p4L<)+1()7 zT_hRM+9tKNP-17ZC~vo@&SsTQY@!KC|Ef8wS-#UP@3X{n-R-vd=C=9UZL`X4^WJT< z$xZu)$1XM3SN`XGQoge{XSoMcRC130)CICU;{jWLW$uzJ3f4Rchpapt7sb}#@k>DQ z0tN*sXxwWnlb3D(LEAMs;*gW~i6yBZp`$Lq7&bW{o-51FsL8Tl$r?5}6f}-RCqosH z%i7jRxn=19__2eG5m^KD+t;-68B%h9<({-dWZ4L?qg9A%t96xZB?#YI#YZ;4GGdRp zZjy87v!{)a%SL^iYUd;^1HIU zogZJj3R6j07Qh3mr9>aV#p&W;l}%x8J}dx5#v%qyT-XVC3e_*D+p4zsP4R-m`z zg5h<_jw93Pz&u3Gd5#~$nZuPN^cwro(ZTOE&U?%qL#5Y zZB1j*k;$wT??~LL(i;>vP`Px6uiCOc6?;LzA+)Hmx|VfmRxAJgkLDFAxQUu-gLi63mRGH_u!Vhj zIZ*z5`pR`)t$H)VkxVsQ23)gR6qgDX5UH1^+01s@Vz^GjRYi%u?#A>oU zMinT{M?u6O?k0;=!LCkEK-yr5Q^z60`Zxy4Dh|r}XaH$`E&&P!Ar5+_aZJn11;-FR z&?q@f-Noc7t$sjubw~tsN+pSARaKI@?Pj)UMm;;{vfkz!6Ap5GCN<0 zfwr#I8hIz;S@4zWouUVmpbs5?;@4J(%_MzZJ{^ro^bzn^ouTbM_1~d`e7snw^5A~H z8-)Nli_W#X=-Ym7}6P+E^Br zTJ!`c(sQkl51JeJH8kn3nz5d8CJ%D~#6QWbd)Mfq?n>R~$gFAV5FswBUF+Tq9la~H zR7bvJ&_S%vAjk4B$`Vb7g_9n^4!4Nrf@ zBL)RCr-kr~iopzo55*+9gGogB)*WY9`eByC2>)%inz?GLFg~4*ippf&pz>6GRh(Ax zDhvh{Ogt*1TqCbw`7K&|gzXLeT+ZMHL!@4wIbvc|n9f(aFs$A5XIqX33E%q-`9sq5 zwy_#9j%f;>SZ_(YBW6=YFOtDTURxdzGj%E*$tfeb_?tYbu1Rtn4G)ERgj{C0Kqf6h zEthyeo|Wv@>z2+^S3)_dl9e_*E$uCqe56vmMUZnWvouahN{XX24NZZH7TrZaz;)*6 z`SW#tC4TR@>uGWJNy;w$rR!AAx_Hm80dO@o6>)h+_@4H_fba8MC{b72W4Hof6!3h& z8U3}+`)ph{2}_%|4PVVdbx9vrFwr^h9jYeT*jclTqaFueqWx}UrYJ8-p0(co0%lhv z@31b?HvjMZqlv?XXSSD)l|gPI$NpS_V!~O^swwB>o^oo}7~q^i=L1uvDHn91wfTep z*V)hy;j^j6Fp3X~500LKJ(){DVi@m)(X9YF)}I@Q)JzXZ+VJdx}VCEj1%K%HSXc5A+>kYSr-T3&?bE|qtxR! z@Uae53o-|?39+5c$-bwz6W!>9kyq;%t~!K=D#S<3RAe{-2to%3wA^>2ZT^O9!CPciDPOHIN z7I=gQz_ENXDVVqztjVcJe^=*@HMkGxk7&(C<)qfJ2FMyM{+SSu~+&K@4>Rza!(cD@Xc(h{44_{x@jlb z=gaZBzOT0Hb+K@IGVC>cVrp#-3`c!Ji~Y~lFMY$a#W{jZm$5ejr0p7Cs!19~3X}Tp zJg}!55gzoadPZ^VYIKcsbeh%L+0JIKQ4@`gS?i*LO}}j~dR?>f z1e9{A#%w+!BPZMd*0pux>Y~w6C7qEp*|95oiTLuE^<%lGY=ZZL4@rSi$+AA@~swgoNJ*a*_NIL3y|9UO8+-btg?qzMF_5#ggKKj7R^}%1VMAbFzz0dLkx3 z(o&x=-y2lY^cLY{ej@HTnKBv1R^7Ipvz-%RD@@L>5|0d!j8!jo+#12uyE|9{^fZ|# z@eZ9%z|(Cs*7}(bn31FY4250sk`t>|-(g=$$uM?07bZh1=KANDHi_eN`rPV)%r&%j$03AIYOS*y2rqc;+e;BQXfO?-b_P zxU2-@-yXgfF7$F2u=HK@RV=U*3AECzgOhLgi#di6mmU*d$a(40FWwy|ML`9lRg(?c ze`{xBoNap4X3xjlx4kt+MX#V-m8akmbaK<4#FzgnMVZ`6=Q6|dH(p49_7cYQnUmQ2pPFk1Fk(|6lqdWGZ$Xnaj@FaRwiBcH%T_$3|o%xw|AbM(A#l&}rf>qQ%p4_%lG_6Cc!~Klh$$%>*8lO=Sox27oTO-<K*JRJ)5+70)L0CQ@Z4*#8t(O`q#eks4u0h zo%YJ2{AP=Eu3E`IXLfXLEZ6>EIw4~2t6PwAmCtr5R&nI%!FHRVamdxS*^yxkj3gro z*KZPONL$z1{)KW-n0^(}hL-<`Zyp11+%}7Og)a_scK8>Sc<;PA4@Xl%Vlbn>Z^>5{eTKW*{3UYC8%SSyE~)Swb{RTPXP;&9xTU{-^V@&g9Vt zVbjqx6KMpKV#@3XYI4$aKjlSEgQJa!$=nv_wqrwiW25`;#vY&emCxI#yig5*Zezn4 z%wM}`j2-tAH4OtHPWj$?zlHkFu6)gP|2dSjJ{+RQ~1mFD6k5f)?Y_a^KRcqp>>&OYVfz24+V2u;mSN z4lK$yM3gryGQlZc8Y&LJz~HXhS!*`vQ=Vg{?onEtAy4Xekw;g_V)Br?;K4%6ua)Pj zcmn^6kNl5_0N(?_D~r^s8H7s-^dgB>ZnKiNR+N+UvCg`4A!=F&T-;WF<~s*6G4Y z85q<}uvtQ^vhir8tI27k-h45lgVh{nTHQ6pE?FOB0BAvrt>xq&svq@_K?1UU+e!^q zMOur54unR6CLJSN_5?MEs)|b$45#K8^Z@isF4h;gSgHle2kfYL0Yl<%fbA} z;(3$C@Mn(VPMswFw$DwW^6@wWs}wt5H!&R;*jOP%yiEHvY7xPf1An=yr)+QDX(f8; zyjwb)0pw|%D&}qJ5LsPq=-TAR#JMz>rJ}5E&jM8a3Z{N98&Nnx?G7Y z(E^QTr{^bKGKYK>WUM`&zTgS(6J0F_lhOQ_2Jmcpr#rMj?xUP)UlDRe$SxjgTw%Ua zY&4u-I6rrU<2A->YFtJxyF3P)xL%MXs1DO+=Q+JFKYekVR*C+L{;!afCzp{@RwrLN z;pp)*q=Drng;^kj>3B;-$H=r-**2+fY2Bhk+$MAD;PziBQ!ecoG9eUQ>5M{rJ)^kS z7r^j^bOsAQwFLPTL_=2)*E`Qm5X_j1h)tmhFt2zG(UQpV9}9E9Q& z!xOWITrSSa(#qCJ)KW3ju4Y|PkG-~q{Z~^IUQXN_!T0S`(gW+wXeR40>fh;H4fTX; z`n~+!_3`_J8Bo6GM*3MpANr@(t75m9FDB}3*;Tvq&qiiX?I`jR-ZtK^MQDv=0Ijn6 znLf8so0*1qH|HhxPstydbT-M(GNJ7Tux#`iQQ)}qomdXWOpVNqq>Y@7g3J_m*qdQk z6&H`Zx~tAhz-D+cCYRqT-#S^0e|G%K;BhiOYP#UJGlDWv6Oj4H)3AiUvjrKCyGjt) zmw0kVsRP>su8)&^NHfvsJ#9}0_$Ozt*==QCf zgVmZmz{xUu6?vB`Z*Mw9nti>?m!)b*PsPYM-lmDNO#SMyI=9tyI`2Y@3;Xe8tKwhk z<9z1!eDijf70!t|qi6RV*``^W`lzrBDOXmorK-5v{5K2t#(Tn?u7y$!(7DrF>175F zLbC0%#gXLfA)s?)`s2{-P@rTe7SZ(5eryVw@eIlZAM( zWcnhLAbG2}j6#m1+5tbOS#I_6p=pC4#9vY2vEFMN+qMD=svT)}$%ZbPY!3;W8HJE# zVN!yLYw%5=`c|~H&~z#qAh$q4K{iS`N*=|`U8jo~%Z!r*HvvIBnrJpx#O&3$VQ(zs z)EP<3yeHQLmuWBB+PY)U=>XBJz$8lHspeEgo!qo)_=tb;n`RZkthCgBm2LK4W|y4* z%7<=f`OsP?^Lme4O_u-`*``NbRnE#)RlCW?mWVJ0H6s-r<>Ses=#GaT#}_2yvxWB* zEG$g~@K%Dhv$L!|XUP2@3y4!?JEECueNM?#;|W|kw0O)7Id<}BH50WQVq%0De%+u+0^7@-%&g9&V`qpL=K$D1(rhY zMI-e(F3_g8`i-|qWeOeFfu_gGO~Vau72^h5KWE_v+a6{C9-sS`vXbvi&-GlJy+O|n zN*sW;wP_o_$#j}3urfgOC~LbQd*lqFyMPOnpwaA?=Bj*dZFhmL10!wQ#rWRX?$t@% zXtZxO%b{q@bv{8&O`q-6HHC^&!{=X|mI;yl~=z-fR^9W?nJJ4 ziXRGZjfPBS(?iw4-J7xBAA} zqj5Y76fCYS#U$V>tup3=amj1k+dR2LT7i(?B7!Asbl!K8dJz>weXw_G&(m~w`Ohzmj_;Z7ruSZ?YpWYy)lcprcHb;vxJ7GD5S|JVH^M32Q80)7Tv^X zlcWg{zW=}g=;vjs%VweBRxc3A_NKKsvT?8Sa&U{b1al2aTNV_ibl8HT$J7!+Ik%cn z^c4tkFCbyMj&Cj(h{#LEy|_!I6$}|I$Zm=d7|xANIZ34%N?{BI*D$@V#OX8M-4j16rO{x?U;WZwNG|$J$p2C?xz+hKtnJvlS5EiWTF5v z&-W3cgDI~K*+)E^o3Mt_S!Zct?Zz+K-#(f!)(hMpOKqlchZPyHJaO!QviT&cGkGW1>DlGbBthW6w1oVvOAxOY07DGk7XA$ z-&Z=_B0N!{;IKWoOc0Q@*V3)Rrd!k0j_SHnTh?%&R%24gT2aaSt+(O*!2X%n z!A?0g>Ev8ggX%KIJnzxVn1UrVe#0oBm3YKezLrai|0T#D?x%~B&AoF-TSZGEW*eBP zam8rtc3B^ByKf6n%IKvn&!(R+2abdsT8)&f=Y994eV~6Db8~GO0H)ERX39)~8>ZCv z=-Ckpd3v2I6269bU}Z(dv9q?UDnKoh`|`J1e^`1Ngr)jp&%=e|lT(&+mhej5yWeLe0K%rrBREIF`VR9lJ=*|ay$7D7BG&^#*U%XfzO#QNsjNWaqyPGb zfSj{%!uaS5(HKj#KBdOmn_JV?(Ov~9N3Mp1TUt^&Vcf4Rn8;cbvP%AfFKufBWGuV% zl7JD-KYCsewT5x_(=q<|Py~YhDR%U@8+CiqmA<8-o(VfL07ELQ9mzb&)^Yg0J3n*;eseR&a2MA)c+^oNPKDk3aqmu*@ma6jijYAA7% zqVD5@_#KWPq^DH(w9F>w!@V1H}D^%B;UXN zv|etK*I%Ap0Ip657Gx9<;+6wKA{ob|94MHNS^-ThH4b9UFA!$rBZ$kKO?VU4BW zfeZM2c&Oe5$XSwj>!PlPoS0n^Msifx9aOdQUBW(QA+? zKf;$R!PYXQrqTOBTgp)|(HUW;u=K3yUDY$J+cT%`fM?;qD9?`iws|>O+B=g}{2tpk zydH4C(8U)DGyP9NTjk%y2&&4i$t*0pCZDgKg8$|+j+9kSU9}i-kI5iNs(@dG+<64) z+&ge>Tlz}B%}LiynJIPX%vqhzbU1~dv3EkSxHwPm@3Y;#-H%?vd3@CSb3pIUiI>LTuHGFL!wyUT9#k1AGe2-M z9f&5<|AI6N8&BEt6AH0zAmPOC*YFkyPIBa^r^wK*?_iM<(prd*z3ewoN#w;@kY*rT zy$g8qsy7+k^&nv8g328enu`P{)A5xT-)-2304N-h7gix@Pc%aB7rIFJr&XAHfiEz6 zD7nWlH1gQ%4C1}_g)a>+49yLO*;gB~9M!GEyVW~ITS=}8ll&NRptWi%qa0+-OWajy z>(Que$?zR_LDU)%a&Swl_zh*`;a1f(EtR+{_|`&pjq=*4J+CMo3T~$t7 zUEta9-TCKC+o1rOAxUiF*_mmYnfy!+Ap6y6fm4hbHL47w1#O02U$KV8Ozw8si{U}{ zrlWEHJFsNRed~Ga2&GgszH^;iD(^n1a`r8#V-~iQ;Ed)>Bu_7I&)fAQkI>7qP`q_q z9p`mz-L`z`X-iX+wLf=pUDh=O1 z^>&TFq7%uq>N2m}^z?44gZ#jS19erj4eM#?6C^=~5`M;WHc>o#!eTRFU|3J1@})(- z?*`~3t=~F}PkDr;{_{Y?_~+GK66C_&VcrVpaY_FxR=$sCoy1f6m_*bVPW0I~*$c)O zcR1Nsb#|4fw72A9)p>T6$d)Ao$Vz16*}le|SXZ7t2*$qxGhyOtEYXYmg%bUP0;I`Z zvYoRL2#Y28$uu$4`s-G5x1D@!{{cfw#mr`bWr1yGKG-cT*M$StFc-(o%d@z@5R9ua_+! zJ6o7XbXE#+D;CFC*BH`Zba9^Mp>pN&EmFS->OK6~=1*rCo8HuhHgFiHjAU3RO}N%E zBO5AQ$fh7AJ0&N%iLu3$Lx)tSc$SY4H`nRBl~R(t>3wN`T4onx)_0` zk%IiyH)V+Vo@QH7;2LwEfJOS70gdVv*qT{RLY z4rWRGB@?4H4C4tHC`d8rck=a9cN2DV2;{baRvDj_(&x)RTC$oH(JeR3ga}OH<(($H zN>JuTBR#?6E_yL`05Uf8@cIBF8(75ben;row2JiA^U2}F9en^u>~k1uC_P&V?J)jaBM}^wVZb*2u=CE?q){dpeSRXe zR~qQL%ag`6#y?2dzCOfLS@VsJ`*|#04z@5^Fj8UfR=#C^07nXreCcRd0EfFUF0GA; zh?(6Lm@@+Wb?Arau#gO~2`shu(77}g86_w|Qg@Q+C|r^?iwKrQ&(eYe>ibhfl138_ za=4~ysNO&XqYjPP(d!TVx2OAh#v98^tM;1aK{%CKv0 z6|iF7>U$o7U*l?R93-yp7hk{UbZP}5nAb}sT-6ZI^>@nux#94_FreMK>P^3+IvS=d zS5nttOxNXuj8~ceTIO{^$_yXh9FT;u3TW;(1CtcO2efKzV_tq+vNNjY^|~mg{FwXi zzTLkim+lq}1AdJL8+a^nJ^kxeEq_&L9Po~LA*x&`<*EHdJJu(v6ZQBZQpWuwA(V7} za8RfnoFF8;5WZ-HVuje|u(}JC@yHXZsW~=5tqPYjqlh(6+ReiQH|jU4YTQ^qScjBj z!pljICZNl(=l;<|(oR#YhEE>gYb%}jj#iyZ-@p@s;2%{px|ikjNL6zMYIvBjJLARv zLo)#sL;kc|J9{3ZC$C5T1*c2OGw%!h-Rl8gvV&+st5~28OvV;>ZGyK@KFK9bf_V=b z|Dt5#LKOK1wnns#TV-7MK^6~;2jcpQU6Niq8$b?LRfu&!Af4`t$Z^Hr>5;|m6=)u6H9+*#Jevxp(g|`iXBqy!9@5MG9PyzLeZ4x%Y1cd0-Fpv)Hr+m;^PQXlK@D)^7 zGXHFz5xx;d(|DlD0;h=qnz(jUOaU}*=*%FVVSR%42%S7QYL!x-`uiRx{Z0I2fFJ(GmhKI3w>r^!xAyjXv zL5^<(#|>kKa9PuRI4r_7p|M(gufq9he;I1@AC(_(817D+1V zfH~%=2&k7o9F50biaA<3F_r_{_0J?lEC4t^H3AynE?}m=Za1Wy*~=PrB@G+>pNq%l zeRS5ItbwD1?BmoIC{6SlvUorN;|&BHA>ONnXgQ9Isb4zT%NRCGS%bhg@Zl!n$1Y2PV34S5;8!3`J&CG|88x3eN`R8z@OQvC zh0gNM3lwt=#^E)Y@;3LF``X>TWLW(z){Sf=mK!pH30qmBWyiQcS#_nKId=G2N+WqfDfjwKifou2L_%HbE(Fm$#K|rw~W}J@XEQ@ zV1LzAB1a4T9i_Wzb&qcH{3=!Wgy4}+b-3JfT;be09!zwMbZM62tcu$jnyJx zdK3VcwU5E?Kq{H!tnRGuW>%g%drnSX~vx8oHT_AQKlC~LAtR_C(3R0o& zcV<>(E=|7dPLqD4y^DY`e87C*UUo5?L;*J0IZUH0W)H;0y_%IO551gZTrEn9HDdC6 zrA=?hn$RRvHuj%A#SKThX69I0cqiY=Vv6y(72-G0;ext@Ln9Zq`E|6o_3;QfB}39m zDkj@_nudvuf{aG>;r7d(_h_DK3O)Ok9V8%yUL=;|nouh*xN=K%BY?{&5_KVi-dt+< z2MA@oaTN?*F!6XHIS3y~gxE?6rF$SfY1u8IlluC@JuQ{@=PpY7MuLI;1;Urc;X)86@Jypn-S zZ->R(Hiy}F#S9&RR#Py$Xj9ZUmetvOQ}T&4EN`E@EoffV+>2>9*D-SQGLAde+DkY_kH zDR~UXA4|^;HgH*kIzmjfoKPVYv!|!8U40-rZr0wqY@wON2@U!`0WB;{6l*$cCpJ9jtDC5oD=odOumpNM&xiB3+K;Z|yY`BFDe%wdSKJynYGi0KY=NG~cW5jbf~TjLoR; zJWjbcVg2xvo9k_nwUcS_*I7&M?(g|)x$dZNKmuQs5A-`7=Px*6R)>IJ-ikDBm#XKsP1P8T$i#h`w_ri zWDARgRWZXPYhj#nz}w!yd*vteW5k5KW#@1>OG3TpWMb zzPF;d75Rk=dTQHNiBN!?NJ`;fo}8nhlEqz*Q7!v!k9juIC7=ve$r6KwkVE~lTG>ME zMIL|9$z5|P;4kpb_zeH$8M(bq%&7|Kcm?=AQY|9@UfXKZO^3cR{Y-Zr7~PCT9r3-UssFI}sWy6|@T1Cns>jLia}Xe` zYv8LzT!+aE>tq@+Qg0U#@}rMp2WGV-J6p?Ow)`K2Z?zw(K-b)C4Y8DQZ1T^_ZEhX# z-s&!;;ou0cDC%*c63Ic3RhR0nNs@VY(5}>-0RqF?0DMElhWaM;RfCFOFGE>T3iJX# zLDvMVQX$a_IsMut+4xI}FlSsmSh#>{kk0@y?K0kc(4mN`yNMr))fYwCQ3TNKW4=^Q z^f3x%aXU}k%l>~(Ks92l@neHJ?_6v!hwP`{coj=+W^vwGta>?#PhOXTtUibvV>#0)58B+{I1!Vm*JQ{__kr4pqsE8eN zG=yTGY422S9DWQp(j>Kc^;((}$djSQ7Np+zCp0e)nkI^KVa8zz;Y4I~>e)L7WR;um zV#oRm)%Qhc<6$M{Wy~lp0b5X(bK=4bVd@TnpD>NKnBccH!xgp12=_l;X{_+c5R=BF zqJ_;T{1=5Gv>{(s_y!2AN5cRaD1Q*^VH}_k!|WgjnXVizdg{uq#uU=h3w$v^UvO^( z0$;?mpP^?0-elJ*%U(ex{{~010aV1}IK;Bi6B56#C^j0VT2sd5_YU6%0mA9gnhtMv zh~Pl%to%4mGSpaR9TDBw0WhX|IhB7SS(|5y0-|f3ANV!1#(=>~|;*|F*QX+~-QW|2JP{ znEOG7N9OTeeH4O62rRe6r6Z9~^`7a5@zKBnhGtekf`!MlT^(Ya*WF#VII?MC~CO!+%k zfc{1&$ioCzL+^h8Z$Oa0q$VzT{O0OLOspzpIusVdzwZyHip#4b)6N;DFDerUfOV0L z0~SyZUfhSOE$(*J%_5Lkd0cg~21uya=`>NJDvF+&>eIlkh^d>#O`inot|v0vm~i=2y)Ao95Q zc=VCnzl!@~`*N>}f6ge1?K$ML`f_(I^^~@;Nb|&qX6Sy&h$TqvjHS(Vd5W@n-Sn zoJ9cns2GW5a(SxNIL_qqB=qMFKvYZXA&`fk1ptV|gL`;hFt#t6B9T1-$khhV)}RuQ zCW{L7I^||H(%%w|3i8iHEGi71XN?uYLJfp|*i zc))>x-EVKAQWT^J>a~6F55R{q7>vKOCsH_-VQdWjXUETSr7T3oY$|22xx2gBlkEAi z_W`m$A?Gb&(uDJ#Ov?6U_Geaudw~vpDYn%lr+16}1g{@wkXjvDJg(J~uET7K- z5V?nSe|9^&0aCFmYM7&l^j6SV!Uj)cG9fgAEQmTu%j-3U8RIv}XtY-ob;hrWh%Z); z#DMV|J?%w?G#<<5IAo4P=D5KeH<)A99INIyX^xZTIA*>z?h#21eFT9KwIrIm7;2)p zF`tKeJxU|qNS&mKMpGk(};4;##yeqDe-}MM(yI zUjaW*C*3T1Ro3`4>s^edBD!<~YLcjtQ4>NLa3=njf$EE)Fe^!Nu-tkpT8BusWLEE4DyQd(K<=Pl1U<(UewKMVH5`O(i%WN zf1b&T!QIf%a2b?`hlhrSCK(A+HZs?4nnY%algVNycwbJ!f13s{o!RD})%PwsDt!q1 zv4Q-4pB6m|uc&^13S$~yd`Bv10Ls6t9x*nWque}=!diDDuZ4&;1V0LR=kfBgwNrs3>QeL(;x zjsakUmZ!lS%l*1E%D|`W-w%Di`GwFv`Gw|RhhAxR@|b@fh+#}opYMqk_zlX2%tmEn zX0x(6vsKxe8C6CzRNkpzijRURJ`6t2;FiH>GPoV>7}W?3y&_2$I^u&cm79XBIPpY_)sjD)J{hmYHG_>2BUuyS;8E zz2A7KF-LP|>*x-=-CgF{U2-q8kJw5)rq|2qrXqCA2}G!-i1ilAF~?pk6cPy!RYx-w zV%c+ENpC4)_%?{PD!H>z!*#8ze{oLz7Rky>6?jJHZp2Jolvc-)j@Sc-J)7m^c)pEN3Fm!yFfaFyrOQl3mXnJrNRcuqo3z(1E)3TYC0poAVMp>HVZwH%Pt3j7w`Jn6V(}hRvtAP4z2LB%#ROD!lA>UOhc18 z?LagLF^I>z#GnD~f+1Ljo;D-=jw@_0R@Im>o*J68Ez|#Ke`@(mF}=L0`1#WC z!mIUJv-)0)#-gD_5g*24@dbJPe-+?9#Na~YK+FA|`9yPbbE;?HtJNZ60223Pw97!j=2|8*l7&hZX8mn5UC3^XAWUjzV|k999hPg3vE@9>T_z8mVF zv~4G!ay?u3e>CG*N36A9OWjD{z^{?)V#MtTM650r!7>!00))YFUsl&&VdjjVWIyfiw~B|WgHoC1)~h9@u>0OBm)vrE|2YENK=B4-!38uG;Y@L zu}Ve_sv0tW`<>PCZ`?ltHhpd4zWbr&u3sGGpMO;FbHKUCqB)dYW0|5O@s4P zP|Zj;j$>YbJ7&l{IL*Mkkb(c0x_ian_xCP+{4oH*dI0chYlOExABOM|JLItemIxFnwvQ!t zusb+H(XG??PPQpe`~p;cCTGcdF)s=0%ZpeKe!16O=j6F?I$PlM*$WGt9!V59I)JyY zTnpY#Q5rt#_lo`kY@}Tk7}6s&0_E%he?JABVQ0=c;9Tt-blSH#p)-(z0B}57aad0Wk9`QF#L($Ff+Y_>iARed7}G{2WPLjTJK4zf0sv6 z-yfL)$zyJ&<^GZKtiF~)bI+yg*H>S;0JH)SJUlUK?Y3+O3yGiTMUuA{{k&9Mo7dEd594hgnP53v+R=r8VQGfHmcaM6SZj^(PX(>=Cav4jc-J#6iIREr~3p2leKB3Hq^YvJwFkf#g&VQq)r`zt;gXx0z zRyHyiIUccqh!!CtZv?1hM0Du@1q5d=Ng<`lA%@l#b|-s~J2p* zC5M(Mt>M-jO6Ws=Ya~`^fAwF|zu623qT&PWn90r@!vW;6q4J58){PS5hY>gP9y*gk zC9&{Q=1cs{96n@ia|RWF_m+k*3kNOM0M1^Xi<$+fnU9)zsEL}X!Ev(>n|;KHwbyAm zWM*T+66vM2Y?SdM((bWIV8g%~a9_*f3uB#0ap(;>Z6RtFpl1HGfBIM#xb_giL?{@k zPSSwTzZy|AIh}4g$u>2LDwrkWylvC6kX6gPmM?VQvOsAHZ}`=~y5Y~>cWlMO8WZJn zrBWu*LTB%~@*7JM#o|*RTy|OcE5BNJXSWccn>yHVd!mE*Cq+qeqE}*>`ufBJpZP-H zjfz}HYkl+kw8oZ(f5v9X*ANKsfxg}wztFoTSWnYhU&~w{riFuVPmEgkTYm$Z!4G!% zoskOMr7H;uMASqgWGBzrBAjc`5B+{I-Pi~R-N)U88~?POMRy>Rh#QW)8j?LgL@4-x zxLO<(cZvtaD00E8T8J46mKziOdajry4@p{wHsRFQSY4(6xOg)-F$sS|7FC4;rCUk5W-u&`1PQ zQFMS_N39E=e-GOl=??lU>L@(IoMP;?ikugfp)e5RseNgti65;)Bu!n^1)bM9O!TeS zLptN0zGb~x3spqqM!(%bMUbgak>})y+vSW#BPfi|fI+we9)}i0*b1Z~FAyXMfFLsN zIc|i93aV4kG}E|0iESMtEdb!)kk-vl?L2!(-Nl$Se|vC|xmrm$gPwtw_7p;et%b?b zE!F_C(qCM@?UHN1ol*?5L7P2m^Ez|K7@v(y^K3)I6^q(F1MyEj{@vLQQZ#!%HqKwjkwr5&6{&*&6*t~4WS zP)Clt?oFGgylIW~p`w|u@V4~G$-l#qkGMKo%TF!Ubhwu=sbQ+e%_-x{UVRe*b ze+Iybj{&g$)^a~kEq~Q-+`@115G27^>#3}x5&&dS) z7<`C$NO)9yH1UvX=MVA+J)__-f7o*x9OsXFCcqi~&mI>T>0DI+Xx9ZJa<~9S>Wg3` zP!#n*QP2ZL4}!@Tt}5_mkEqwXJMkFze|YRS#`>N9RRu)l8R19Fw{j?e#D?Su2wE8$I$J`6{N!{R7Xs!>l-Kwm)B>x;;;eZIaZ$^Om)SDE4=QFFau^h+mC!U$5sukj>PI^Sq;}I>W=GuCl;yID$IRT(@ zYDe`3By+qFPc(?C$07j>kra4nf8hWRJQh_10xJ-LK#*bu-k`Ix912ksX;%{of`F8? zpLh#!#9Mkq2LoUbi`;Q=1~`xpk0fvl*okhk*O2_pKKOOuOZjo>*z$=Jwai{KzxM<_ z-;En9CdRvO*o$eIvFz72^qrcWEUASQhW{KdQI3ce^4O#Xs;&t z>Nr$u@0U8s$ePeLS$Qw*)r4r;Ye0^inXZ#SqRaabX{m!f0~xsa2X6kOU$B9#Y`Obm>{$YHML{bJ+{P%>;Lg5Kj#b`Qn-#>*jIf4F0Sr|^G)7DW63%` z8|_so0Ib_B_k$Ag5BmT&aZ2ar7MZYCwD@GT5JXLTW#SZaCnG4uf2>_r3sUn>n@5?~ zo2{1w7c{?ad!0J!KFYr?zV3gk;jP@?7}p|ZC37G13iDF4O&QRNAzi})yGtvUDib^P zl2$A^mlhqsDYwIQ^sTh*dgT#?@IZgaue=7|qK}1+DX*2BuexBrYn5xWYlrKA%jR;? zI30eL$6Lr|(?Ec_e=s172-}36f=v+EM&08rG&X`1EV0cgm<}-t&6ea)TA?AWC?i*_ zDU?ytBe7oRQ&3E$U@096q0>u4FoaJ3fGvqETY@wjlAT_vl-`%xr^qb{`!DI2*h8t8 z(;w4k*|VvS(#{7`-$_41Z)bl*?`HR;UP%9nev$oI>Xo#ce@n^fNGg+VO?9W|rY=q2 zN8iP6O5K}wUrDcIuS~5>ucdEb*QRbrKT1E$QeN7}im70_k6ysq)6PZ3bZ%jhb#@k6 z=iDM2UQ{flL##E>mTFm4R8o+(TBA%GoM?k>ZB~qkE-G5}s9NZ^Le{#|dJvWEL>UBp z!D{#v!GhJ=e-(`e@J2XL+#J{%*bz7ocr{=POqQ3%6%AXnW1`87b21Y4a z6Jc#nI%W)EV!9-F+h>RXfbAU}7+FmxAN{9n((V(bB1(a*{EJ_ecEzA zNLxJmU2~ZA;P07DjFmyuMSz+sLpRHtn7ic%LpEjvoqQ`{M(GY_0W(iN0$!I%K1_zGuq*5if7fOCtdJG69x}^moW^T{CTgC3pXi|7%_6BSxYU-D2Jx`Fljl&GBk8JR5qQi ze-MArNjW6Sa)@RaGzy_CF@^=ud>nA9UP*E~9dyvHTpHgr zcfC{guCbwFW`|ig!-1I@wXCnQS&#eFe{QdWSQNiAdmN`iwY8rYgBlxUO7!$P+o-~J zYN%`!#$>QLtZ1N*7BprAH8rCdobWRmgBz1r!Jy*aVo+oBX?vBC-hjn+IF$m!38+pF z?h8V6x`19-0TrIDey63N^}W!iY4iSkW{#%y{iIiGD^{BpqkXG78`;Reau5}Je@BB6 z-mf;oHx28!v1I-DbH>({&R`$whX7d9mivJO*XZ%J)CUydp@I_eI(3pF=D6ldhrr7& z>rwEoi{K^NU5DtQ$MmSHuHZs-`jbGVVy?@!{*3503UEy>$Uc{3 zcuEYaq)fS7fRaeJOO`6c`MoIRe**%lLY&u0AUjFQajQqFz=+N=F4ooW+Thyk+TuFy za=7*r{{jGv=psc4w`!zL4v>~n5|V!J#?7^qloQ?T*x54XzIKnD#D?0*@orRaxn`94 zjKwi!RWYLG8bR}kZ4#r$ycHKNvsdH)x<*I_g?DisDEz~q5-1dYdUR$9I}~Hehs%jb zTkUoXFk&X7wnsehukdD96Zzx@tE--RKXuIn z1b`9Cz_4)a#Nx7fGbZl<$io2I&TSaeT-G%v4+zHr(`_^6w=dMHb31`3XP+fQbtibS~=4!z6&jdHTXjW-Z*f+c6bz&H?n# zb0ug&kpm*jVBlr3nf)3gu@;wX;RG6gBfWP6Lbt4uCkw~_NoTVnQGfHmBR4kOGR;`? zy;i4H67J6(-_FB7Ju_aGHUC&E9M{GG=uX~&3EgBZRM4vKQI!M4n+jPwE}&+WifWjS zQWX`1Wx%zkKeA~|eE<>y0jqGN?`obyI$Po|ECX!1u#T4uYyhZI9)LAn5>^O*NC1c; z00CNrk&Ar9QGvl2f(DGm1e}K!Ov79(#1+`Ut`1oFT@gSoqKKmegA~nkFahT(n(df} zOZqkCzx*%fj1wCU{q|p!^DiG&>GKwRLVhGa(i8k-6WOE6`9bOwj;ofbr)tVI`%j%( zi*~Mdu6EPur*6qVpZbLvzvZWY;n~!g`Hb;eX=Lnb3^`LN~4w zx-m)U#xti~vs37XP3Xovp&PgG>(X+5?LMI!>x6Dh`AKiE(2Z*Tu0QGDE_9+7GN%It0Sd``&Bvhn%;WQl;oXAe|YGebb z#{w+IC76p@xCG~57B0g$OvD&8;ao-5iMd#SixI#86k#ALFh+?lz#=TcLd?RTpWP*p zzE1#AjKN&Yz$I9KPAtF$ScH5`z%0zhV$4H3F8PIPA3*?RC_yQIsu4gF=3o{A|McX5 za`h!xsL*ySO6Ro*0Sv`F%tHVZFc-5i2aC|D#AcyWdD5krg_(+GCiKc@1ZH76E=lKo ztn!45(RA`zXQLfUl-w>t0Q0Z_vz50CU)V$4)ZFZEu$EaocjGVd4jbAeJG0Sv=jOvgM$ z+OCwwneUjo&w})u29&4px|pH7Z-0$lrqmOcEXKu{nXacrC+lP+nv~L+t6X=nQoe(g z>t`t%voIgimC~N6&_Fsz{kj1~-l^CL_tJ|_T3r8o@bpC&XvbX4Lnn%)`sPVZQeEwk zn!$qxR##P*7Ucv$e{g#s5ote7(3S|a2NJ{2)JX)|6t%#ano@fpaly|trIe<0Qj>^* z8q^fV1C8N8qPrm+NRr9po5O*`>V|MjAkm}nV-$X^!e=&wTY|yDcp%W|oYN3UkhVZ$ zV)&(VRy4LX6voM>41ImLewMy4j!pWE`fzXpYN)b$CC@|eI} z{x(<{*c9KrVpUSa^tPB`W_V`%)aC?hZ{g1{#S)HiL&9iuSg8@Z(I!azb79u}Un;=;D}K*GHufeA~3U2eCuT|NYNV_-#7b2yl& z^MqU48?rZ9v0}oK%`Pe6Iy0p(zDYEt3U*VLG0hkplv*5cYlg) z5>HvypK|i@ws5d8zD4OQ+Y;Ky$v>lLw=~WflpywhlRPVxK6+w!^!UlmfyNbW>9QT& zbVe+dUVSnx%_S`L&CEm79Q80IHDRuwdQzE3f0_*mAvYo9suiQ2nbc^V^dFgzi) zjY!cJeK7bRUX+x-;a4fasms#YObm*h86SK`{EX}wRO*!Po@y*)<5qT~w>+ zd$vo!G9^_|1WJ5Hl0cDZ`(*?(k~Ad~QxA$L50XGJBPpa(q<(DyGm_erY*|V>n%350 zMpEP{J3tAbB&H6I8ud-hr`v8wZ{#9@jXno?6@Dhbtkq88)HV1>j z#Ek5g6)OTO0xQBv5i`zhPSJ!ANsuX=Du2oiHw{2IyTuc1;UJ$_Ha#%4dBxNflf%Jq zFyYN^S&SqUlA&}mo6MeI2YUa~e|Jds!GtDU zieKRhtif75h68vX9}-6Ow24k)Pr!pAn2hPT1-Ih2cm%KDAkmTvGKfgzdh$5ERA9Y( zz#zbeff%8b{w-LK`|%()Vh{G?4IIF?=p&4{NQ_J(Q^{52I&w3)jXX#mCr^?usEWSF z7+Ws9D16cPuB?~ukspBve;#E2)Pv;n7}Yo%^U;mZNt6_jIH@CV(in|1A{cu6`pV_A zJq{7k|bPe1UKA9lj@w=!l#6e~4eHw|X*?j3MWe^GFN1 zfLuW4kPFFTvWz@Ny2#UHH+hb{LiUn3$w%aCN~nz%(IPsS4xy9i1@szv4}FX#===12 z`aS)TMOd7bv2s?++E@p>f!)Y%Wp}cV*e3!NY(l9pQCKRxq++U>sykHcReMw~t3FqY z>M3cAXgYm-f5~2>&k40`9yVYcW$bhMCaob?(c|QQsFyrPzo%X{j*X-BbTBB{i4m9& zt7g4As18yqL`@sN2fdpXvh#!pGhoqA?G1D?y`Hw=A@Vei(-C9>xs-L&4Rjh?FRT-4 z$pI{-&k3NJEf|0bvNC>{T+E z^pJ7XPM#x!>CFg}$wVYQ2$PW*i1#rD+sS#T77nphbQJv%12GS`lIPfKbSLJ~o#glU z4%O%*mymJfURH{$Ne7xR5Es(h5TXld2v=ef{zk4LHXOil@)*gX7eHW{bOzq0EvUhM zVx~ppe`-`fyg?tO_pun1~#VCl<^_6>8weDy)*BOv+3v1M7o3nDtmhmtnQwh6t z<#j`g*={UkyRnh&#y++i0;aLuSelkF_}OmMvE7Pvjgr2B?L>m@#BR0|``J!KvI7aW z1H0J{>}NY5ppGR$*i&p#VV5+ZCp&Mq$?XOV)3$swwjib+LPq zVE1A-yBGV}y%6v}Ts0`FarLR>A!AtF3odV zd>ZvD)W|8Dz$PLeem0(sQo?bp5xMZQv22tQp2J2e;TU$75}wUQ!3jSb%^G2bpN(R} zmH0^3hz9uC2sT^^&tk*78vG?g7qa1)#u|B_iE()Yidh5dSOWw_vW7Kae*9jj%vFtQ;aYzP|yiPb3Y zSc76#gF04&v8)EuSPgcw8ti8^(6Aa-g8-{U39E#}Dlv{#qK#ET1tW{2n8mS%#lcvd z6(R?I7No0Sg`Wk|p`WgVe-D1 zu0}CkjXJuTLkZ=Lf7qzd;xxYs#dH<=uUPX_d?Q^2HQUa%vwW7%@>m{=vM39&5DT&( z3$Ot5Ge7e&A6-k=(lvAqy_w!jSJTyW6L;))XbNsX5KwD^Y*Ek z%~LbanVLC#YG(1&%p{pEIbxX~#xmE&GS7`=4v1w|#xl!enfbBIp(fHo&O;`iRp>B< zmMJu(P%k;JD-*h>$rJ>&1b&jYCAi%GNiZppF8{T`q?UB~uSvzGq=La*xXoV@ob8XN zB#~5*6MRM>5%6OYc^n!Nlj53JG}APaW}uf&^8_IQB$sgW1Rj53WOQQp42+&0NF19O zP7?k2$q7|>7)h8%V|3FnXQC=LI;oK-B&uVh6S{Fznl}-0b4#K+mY_E#37VRdMCPLF zJbW^3I|zwix7w2qTUz)v&6@u2%me~POIsF#)j>*iU%#t+x5$6b>jps*Dq^mIi-gHt!`}C zjvx;dJp{NO0zcF9(JHQ&%Y&4jPto(8p|@#Bu(4rNFxam%M9~>?rq1j$b!IC%v(q{( zr4u|&M{@{4MJK2^^iMjz|3D}AU+SDznzM$*{>?$QV-$aRcT@f4eB!b#+&HT(+}M^_ zdFdP{pEw9?M?HBrJ*OFIn?7R>58G!Y$-CiM4T<`2LtxXW%l|n&aXC*O6>ivs%Nv`T zH(f5xYUmmzjcN?HH?(X%tG(cfGah$S|Km0lwEv5nwey=5@MoR%#J@;>f+wHFpY;TP z))V|$XGwo&DbG@@eq8e=Erzw!PfdlJX@=fh-`wU2whXh23u_f?9vpOD?b#vleH|IG zmV_ZZERh)=rX&>(EgZ^|1Sm;ae11Be0FG?#UvI3S6rMnoK6xWu};znm(leE z69G4u<@E%Me@78RNIr@g3W{0)YnRQ?*ZD3iZN9m?geA)#FU z3PVvLe}!SFl)pl~LK`qZ?m;7}D!rr~V)Q?y}>{3+UTj{FIxW32oMW+-$f z#>t;xe-_5ehjD>IXJdkV7;_Xl7fteCa3Lnif5AlxoriPfk1-$T$sgllg)Ts|{4o}y zS^hIR&?5gCmtczgXLMqUdATGyr`5>;q z4EayE5;NsL;VR6M|AebCOa3F4;sW`PSccj1e;=`2q1RxJ{1L8I=&y01{1L9hMe;|u z9v8_U;s(r6&A=JU^N!X@8f24$nRqfE|K5IT6D_q z;}&$v?_nJl$?xG-h2Dn6@&VkAOXUN&L!o!#SMmYeg(dR4xLcw3;7a*jtXJs0xJrHp zf4{-i@;msgLhr*;`E6{#a`|oiPNBcYHS*iIAJ@un;Q@s{h+oTZ;UR_o53ZBn#KX8= zeiM)22Kh}qiW}uO@EC5A-@xMveF7`wH}E7@$osJoE9L!2V3oWdn-toGo8^7jj5YE; zY*FY|td(EKHibTgTjbY~#5(zPY{xpee;Ye+tIYSv+%9+HY1}ElhG%e>{2HFc-STVL zrO@5DN8XF)6#56Om-pg%+$-!f|s#Deg&^6^i}*$ zeg%8+d--L&rqFIYAis>)@u2)N_TfSKCG5vT@=JI_p>N`U|{4D;4KgiGEs6xNT^YSw|hCT8#_&fH1JuO=?Y&7`9LXmB1MWy;_wdhHZ>dw@$-l+X!6Ru~#@_=ZHsZ#`M;lBOa?6Blgyy zuBNw!e@aWrO+iy`&=j04;6#A!J|U@a906fBDEUJEn0~BM!300XO2&6HKFOe3jUFPg zEOHA;@|0xBgge9jq*zPzf3@Bx$rNaa=4m<-0rZh`;EajKT6+#377rgrU0sjZLrms@ zCiB4364F7KS{)8W@>ry@VnBJB-DYJ9RfoeNE}~CGsKaD-&|F#^4j0YJiw&tQ;6zy0 zJ2~KX2k1l2j8IWgSbsu0Bo?n3QczgK=gIZ-f7o-vo6y39woO^8erO$5Gk^@N62ey`I7ig*WX?i!z_?C=Iy~oiW zvG-VO&(R*#)zpYJ;?bJY5)w?m#VJNl^uyHwmn)zqvlZ6q4yc4T``i(~KSDlDg`n6e zUoDta!*CYg_a>E(f3u9szR!A}XQOqad!t8l7DhyJM-G*$;)MgIjFc>uBe#_fE~R92 zIA@erXZB`Wri@C;ySqY_N|2KZyh^amQ8{XxBh#@-&G)T&q#>#eq+x@Uzo9U&A%{#E zjVU9fDOGh-s%xt%MpTThFzct7bW=>VW~tzg3bPcdG)wkDe-&oQSUJs1%t<;vSQpQGOEJjnPOe*+~B0yQ^r}>S~pmkwbqi9cS{)scT|X$ zwU!MQW_g-^i?i`98PCh{Xlv}t)}B_eM?Bhk^yrsjPx?IC%BLN_RM?|OPxOlqr_L4> z7mK}Iqql}1f1*Ma+3AAP64FXenh~#&yhvrGrJt*^q)e;4{1h`_K)J(i)3DRH)aAi2 zD`x@o?|g2z?|*{SVKTXb&jzSdG`mP(BbRP9-|Kg~{l5>Uh0iEjZW7$gQ~Un*jOAH+ zxbFvt#p39T`<#N&Z6vRs;<%h>75cW> zlSaSnBI*#iNSoT49xKS#`2)dFI43ufr;GZWWBlQRVHyrsvd|dOwckZuE;hKTQXX1W zY^!3ju}WvCGJ-%hSE-Zah$J@nYSq!&>MCQL#O2zmvLyZ6Qw=&4XUura8ADwi5s&rs zw)XJ4e^3~RJ-t2rV;)%C+GA2EF_|3$9Ro{C>X%4Oh4sWyQ&AhmpaIoUB9+ueF|4RM zN<^(WiY&b$O00r83OhAK$&m8FQ8KVE(Lgd`t^C?AGZK3v^@w4kGv zSk-9@D6?xSBH@tQX0?}>4N$34@~QzLMGBbUaR&Ua%{C8eB_s%;myztH;{YvbId3W74Z{D4E&YQSs(Zq?17VYm9 zf6NBGUad}ted4@3@4AR9HFYkUIAQT35Zc;zf^8Izz=Ls8UcR9~q$)?2MQ^sN)hf|p zx7cbesxdm9WkXgDAcDe`{pt>)f|Ize}t5!zbwXr3XO0_xxWbGS^}bgYcIgfLo2H-0AG6O?d|zTQd1AAf z>ccza@4)1vU4`2Gp*s0HMCGH%f0O?XyZm?9Q|C%36pAGhHU=f)aRnt3F~lVl(YS+pMKO&ZI)~%pT$*Y^_d)XCQj@=pSdoSl#ff2&s>*h%{JBLSv_K1p4DZn z%dcX7lS?!s1VNRIUe`l^^K66H0q28QPXXl*P>I(9kd?`6x!8)VW;pbQR>!@Bd z)jBvKv41{zwp)lzRBSCT65)q*K#NJf(yTAfGo zj5Ck(2s+~q`UnhUy`&Qj2BY|_PD{B&Mb=AZqEb=vtTz1>CXLx+-9Zn)L}xz*l}>AL zQR_~+940vE>yjR`e@!Mb8zK>(p$n0X-;vi-7Q}mUHDYg%sC0npdQx}~v3H1hV6l^k z-yhv`Mx?X^tx7GMf@z1E0@0x96vooEB*1-T?>tUPpzkZI&gjx>UBVB?r#dWVr_*e4 z2qovLT_$6umiOQu1K0tT3Ncc(i8jZYB{4tKlq-bv9*=cMe@K;~!gewRdKCA*R$kXr zUd;1YQtH_byZk39?#ZbbVZ1!+`n>C-*XKVJeJFpYVM~E7)2z2w8mbF~{BVIUX3g_O z!v<>xHyGFF<{tY$%)NFYs*M(yox>)@6xv_7A3c>WTh%k$ZlT1Mde<+!8Yy` zdk>2}Bwe!LB}-zl(h}4!k+S_cW~V(j5U~ZF5-eepL>zvrM9eu>iKH9d^5v;&sIIO? z2kD5lR0Y%hZCkK1r>d4#DlScjtnW!N|M!E%|q1TAp?>mQ_|apuUH(*t zYhbxbo%!VsvMf~>yyL@x^YGzw#81rwi^qt(fA`NTr1!9SU@`Caa1d1*g4r?9l!DUi ziprc^i&aqNR)i(qeUV5`Wkli~9*Os12(Ogo%SkL&-P%!&>JDO0Io!xeS5{s&pt2$o zNq0LON=&Jw{+5%fBW782`S;0rpA{J$qG(ZF+9Y#U*0Z)iFgTksE2WGE{edKz z@)To&D(K7fCCQX7WFbkv>+*WDc}uXve@Lcu*=;OIua%5Ml{MSz^~2~R@Dbk*dNG1z zij)CDh$|!rHpB0BkT>BZIVY>5V@&U{)(+n1@2wFJL#*lH%vUvH4<7}HTx=Ssx}hj` zmAJsoU?nLx^^X$znKV3=n@nNCSnpfpt&PKZ_kOrS`(Ebse>d^I z^T@PzmUrScUUq%o_hS^9Mi2G|K}om#F(Yg`GJnGAQb}j*vS(L$cDNuA`__yM zmn(bzcH%>NP%fsLdL8dgoG}8noH-tzlv6!!eAStRO&?b^_#FP}T{E_N&^i1AN~+}o z1|=6xG)t!4S^Klz6AxwmRs1IFe@9W{uq4T&n@fzum?UmVr|p9AZ{l-yAxZ2~W=2KU zn?^gaf8c^TolDdaWw6#G_8x}VbF}qnswZ|v_E?bgTPJPGtsXnBDz|#<_^CwO_leDA zat73=W%aebl91VFGgx@)39Ak#d?G?tF$$wZg zF`A3bb!KLEWv8byT3b76#A7um9@Be_ms`JYNi~ZzVnXQ&#k;WEI6aN0PjPVLpT4*F zXp4V9`7bI6mkR6PMVuI<;LZA*GHx{AWVy+@%C^S8Ca@y7I&Ve(ngT;cl;j2Svx9sK zpYHCwtwCC^b$FBX0V%_s54YP3uYW^JdAw4Uueb@X)>LHl`|NhF&!LU^bUNzO(wvCV zNQ}mSks94aai5RyZ;Vs83U`u$M0>LH)|#HYY3&%pjipBHQ3&rA|2r34zeK7C6zFYP z#!REZm|+yuk=(r8Xl{P4pthK;W~vV67U*+|NWc~@BDuy`5eb?7MQNDg9e=j8{~#T$ zxu)>Ra^)Q!o6X9dMt{2rmJJwCSy{n*MUiljc+XN?`ko6n7LCpKUUJ=xYx-)qWIZXp zaC@sOXIRdv@qPQ6*yp_1o2#c?IA-pm<=;&n##_^h=gzJ% zl3h!QF58t&U!o*~s68HH_kRc(CZ*7`^37RUCbKsqH^$>xh>~c2JQ|I~y}5cpQPGq$ zjYeQzz1yn99Wjf;VYPVOIX)f_1E)81Wa#xo>&^C&B#BENATH%r8slT*)8Y%_YvKpv>VLSqh%%qq!__V3 zX_f_+HI{EIg3&@OuEIeVIg{xM?r5zU!-0&~aja&H_^C2SC-RD}>EY1UU)=+5D2nmE zvXN-5(K=!^W!Dj_=&9rN)pEmC9P)n29)2m(`cHP#+JV-NV3_<9IQGw*kkgDo0Re%| z>%D!w0+o9e*zDl7{eKaix8CP=`N;qtJ4ikjs(R|c?)TMsO{=WFW`Ca<~=U>IYnl*0GZMNC%PT?i^HjG4G+*qRFCK$FubaMRja+0u2QYmE;HO@xyg1LU9Zwsseh}q<+>WfAhFzBZXe{- z7SNcXSj;u&+KZiospe_pF0sqpW$Cgd?7N&hT-qm$Pl^wke{Z?p_JDn(^HG=fJj-}{ ztMfkbcFV2yd!2W?w2hWVTcdrH^K92-<79DyS)1=1WE^0rvJG^eV;m(mnzb2fz1E}l zX!DJEmOPtAZGUqSL2EH)3eY%m1)V8Z&$4p)$UT4(Y=8=vS#ve6&F=ckovE=KpLF3) z;^Zs~=}?YVexReZwSH>zR=YmiRA)}g$2Mo1>cph{!)CLy&d!GmSyoS--D&sMIXTfK zI|-IMVQGmrm)hq`oV;bEq!&c?4xg)B#X}W) ziRQs)zM{h)?)&ow(n7L`ku-1U`}mP=GQ97Vk3R1^KpMGiH3P!4!a5Y9iu`Ung7O~e zoItQPW_37gr&L~0y10~SVuMOYl}>gymo5q{ivOx|b>)KvkCyI>yyJf>a4_;t;nxw9 zF`_GfZS)Th{wjW*e?|Nj|L^^e#a|A*68tol>Dwv)03D1RTMRK}Am-Jjd_ab(JnaLV zW*#4Gi`vV2BpgL3-5BrNSAmVbFBTiZfUvZI?VXiBZGK_UaMOtTmI8soc z(`mK-9rSV((hX83P(^%Vd2Ti$B$6bpTbE{kugRv_NfMR#M)z@{4Wa#^Z$d&SNxhQM zB#ES0{6?grt9sPDlfcv3Q8T8uwc~K>VLmC_TT`RV5-7;S=ZT6Di}9rb4nInN_kS7o z{R~J*HAW}Q6Gta<#!qhU@*4s>cGD5+i!H_|JL9~2l zaHPaJ&Y5t2;}o1pQY&RRXr$OS&9=+NY)MkPS#}V|4stE*bpPgfBe$KI*Tux6pSB)t zX?2i+PD^H%#qm3Gy_ziF;Iw9DS)8Og z6-q*_&So&!bSZkm&OSdq&gWoq0pS5*9iq&VT3C^sHYc?^RBC|;+Nj&Ajsy%;mqTs& zsV2f#*J_l>Ru0!5>HG!m1)c@j3%obluXpTL?Y4eq*R_dlrZ#h%Mc7AwiD(xcl3j8L zPU>;^Tz;=Fn(r7u2iQv;!|8DQP)7@yVsCcb=y=%i3VqrBfx{Yga*KjORf?sVhfNX` zOEV9flxg9HVG_rQM69%mqQ&aXwAzAsTQom%BJsDyx3MySv#efRevf@gY6waw|Ns+t?S41*K{n2UBrO`Ff`=a}zUq`jkopcE(93(C| z>{3CcT`I1$^GofLyV7X?+D`3B(!7OAkxH7ROS)76+cTt<|4bl>Lm-8c&2J^Ut;8A; zRRpTBsx_*8Dna!Oi6bA4qzO)?X@4AR?dWOkIQo@KJnZIcR2|BfVLo+$H=FEYKUkx+gMYNPwgkhB zh1t*ggceJ=#qu*5JMinT{`%`H{R%EubEMw0;4jPnI{yVlFn|mEtnS2fLT!Jy@I;6e zpLm1)>0~#N@L#AC<_POhM(*8?kbGpb!_Q}Uk4TjkSKYP{(S>zouCS|YZg_5)db0U^ z`!w(5pr8%T4BZxbFeLmv_kS0G?qDcZ znxqeG7K=zxlKw%;C@U%|E%V08(C^wS)2`iR;j7Dbu4A^_EoQIFY%0j%I^}t>a9&LVM}QwmJ^8;1R@3QpxJDRxLs7I)rKSE%1Bv~?tj_}kcdf4(p{1< z7=d}Lc?};0m!CFnXdTmYw5GR)qp$+Py$THX@V_3hMgbpXkf=SwNo#-Ee{0Vi7yPoO zg2w2;=!7f10=F4Xle4%_5L@|I&m&QM;dBFc@5sPSY{ey)?mdo6idX`zQ zbFZ`B?tVOb=r?WO$x45_a_GTR|wdskA6cBcg>3=piy`pGE(fXoCvmPsY zq4b^7PfE4XP?A0=xpRwyxw)ZWC~Edv9Qgx+7?4j`xj`2nkR*qs$>hc;^yNX8p$j4| z#uvs}Jb$pk5VhVb2E7`dkcmJbC}rB~j6qTytP73}P7B@_+!)*yJQ&ml-PMjYB|$Y$ zU!cBEy-R&iEq|z8RRudwnGuPN>HSohU?4F**PskG`0{Q~acfUqPhHJXrTdq%CS}_5 z=d=AOJK#{U3mW+cRLI|;QvL=m`RHb|wn*E*`r67(CS&60gmwJn=AH1#-@qd8POr|qEwvU~#hRbmf9Ioz4u1@~aqO~X(>DclqC=lGNW<>YZkj-smp)&5Yi+mHyuEP2$+W z6V9G<-ZVa9D3lKh=LtuUjVQ_4#2xCBQifQpIMYyOww=ch@w9JS-X7In?c2gf+QX{PwI;hzO3GA2GJopH*o=|BbIBxCtEM$$Cb>X0FJm#i zLVtyCiT@_w4*xTut+{rRl)vf95Ti-?^G!Z`YH^{JbhHrDfbufftO$qlY~i1E+{tN+ z=cM4S14*Lp`}@|9ZhhfYPo4etgLUgZ;2+^g?^`eSegB6&ec!zJpt1~9tE@%5eBU4c zcz@r0fBYj~3z82CquDYP;G3;MeTI<_OOHwM3}f9(wvTe(&pYHl6#OFh^E^$CEzjN% z7?V3DZ&IK&cXHl^#tU6@b8m7P?0it#X|c9g&b3{XdqLhYw@U4Hi8gn>m~YN?uMpRZ zcQ|i%KWKZpHb( z3LUM=L>wO+^{?Tm)60`53-;tnemI263Y3?z7o28`lQ=9U2UTypZRa1}eRTTX34b=x zXT%~=4jAh=glDy z3R-pJbyR1OeA8GtlAtaSe7az@mNQ?eE86`hBpO1$~Y|c z96rk1!7oo~m6oLThVVwPIZJESa)>$AF1DjU{<14z&Eu==5&6jGur|ka5~EJKuCRhf z>4h;zzbRWzGi8CMAZFd4FL`6hk~ca(xvVf!bKod5bzOP1&qOTJ(JUf)4teED^vKhO2ft+&4ICcnA=rGMITqswFx%g!U7 zSDqs3zP~MB`Q+oPxraXh2$O{)sK8z+S2B!KEmK`I^T7 zVn|m}gi=zPq{22JR7AC^B#|UHAt7x}G=$vN{Gb;w2V6ykPPI;}4<*SeNk0H_5^(QR zO!Iarv)Crt7TWgP1b>^Wa`ATZT52JubN z&}S9IJlO@=aX(_7d_UpC@#V`&>(AHCPtCoi7YX}!>2O1|rFCgBQE;?(0jGPnak}mC zn=iYe+~%}uEqBhj_%d>n0<@XEXZ81<=yq<8OE0|FuC<%Z4u9sD*SM5Rc&opv?`q*{ zwhVbFCqAjP(Ynw|KMKB;`(^NO?(yK!9Q8%{^9yGb&nUk<^UC~=@>TiE%72r8OZj8@ z8_IY1vZ$7$!E^;6bSjlr7ozaRN}U1G5ips=EZ?oA!GJy%#H|sHb}&^FHHmryB%s%e zx(&L7ju~}hb$`=z8+H41DxJHsD7Y-VHoPI62n)Ny`@)C9--Ly*tD>O&3}aQ$f-kG} z)^ND!sXNRewN9CuI1@2if95K8!XqDrTRz%Vpe;+vKXm!DNXkdM;@T1(!0^Q>(XC11dR+(8>yPdD-dE!GD&gd|!@p;nXo-arWC$m*v@S zc;|`Z$DerThP|s-zxwLx)qCm7_b7<5y=hqd{HViXagwt~77RVHosg|t3HnCg_FDI? zw{>@e@ZbLz<_kwqO)ilN?{*&#P=VOUO!Z>*T5=oRKpvn8vYF~1R6nHIqS~r?QS+YW zpj+eCntvP$ZX2zBE45B_TCEOe$dq5Kba>)ZOXBh3l2E>=PvLzg$(*Xo%+%{bVygd| zkvlcrf2}U#@o;5vX=Px=ij0 z#9}QNcE^?bj}?G5`K*=E~OAu56+gK~Hy1e6;I!`W3ioHrL)zls9`Ppjw zDV!s%#1^i!{L@~bbOF${S1u)^_8#C$*%^c&YR@KaZ5#8*x-EK04oX~0YAOVvojum%_Omw+U&%Lsl z>6df;i#fjK%=~`G^V{$0PpbqF{{JR~U2GYK(*mi+SY@ov8fYA3tT7HTO2&F)qs|;L z3@~i*bj5`{GJw!Y+0!-CvlnR=Wvd2g%CZ|ZjoFhlsuFG05T*4U97F~UuN^dhXh?0S z%4XyuU%*VpnfIFynZGd$FpFl%%*?~H%w}U&$d>C@8a6^=h=zvyLLt8|lslj#B`g=q zY5DNt^74}6(176*7tT6ZPwI!))z?dPp~7OdFH%$(^=7Myrl3k1jN$5nAae(GI;N=_ zFd#SArq9d@IP8+Yvc$g3PVFauB3@r0FT&%IWf2-VQH$b0T`eDYqIOs9zFJo6I;-Fb z=V@aczVo~0WRO~Us7ax9T}@B_{DpZSexY^$+n6$u{4X27THd|ct~CCigFqSu0?~Y@ zOK%WV8M*mFo}Z}HF1^D~qN)NvaT?ql6=EbN)}(gxptTjF6P`3Y4CP;cw)+Z#{1r6v z2T;o&fXHw4`wG%g&wr{$!*k%SRVPy+&q==5N9=b$MA&Qez7*Pl~fbivT!3Oly6Fg~PS5r3?#&nhgNKB=>D`0&QT zXHV|k%B`8+DK$0D>U~Rp;cuxw&znCp6*<*;0Kq&!IFBtuHMv2mdPn_^mhMsS(bD_1 zUFt3^>(DII&>5PU+L<1<-t(ZEUg6(NwosPsztB%X1WJ8cb875hwE1n+Hr!>iIb9+1 z&wY?7Bjtm#NY-$DR#t{SWJ>uU5xHV6{h1@mtQ?+lL}i1k)no^MIfMY2Az8dZL6aYi zn$0G?P9Ja|bP*SKN2216)|PB2p(QTvi%vmY+7qRWv-fCEUC)2wdH&D*kkyl|(rUD7 zEmdc$+R)?LvLSD&uhkmH~qvo9q^+lSwCOV7G66R{>>MzWkXPRZXz@fDT znemtX9|e1V){2qwSR`Qqv|m`=!*f!_v(Lx_y8z_CLU0`*L7mv>Yl0Q_S=|f!N!1$< zzZ5G$JQYi-=?E+P#B*J3YF$5AT>|z=A@*g?rR`3L>qgolkXUrM1S)fma&8g2F2Y zpt$n=ZQI^Q|KQG_HcmqRC4{P<{M)~H@5qxsIC=yrU5$J2?(GKsaDngj)9g^5W`_nA zTn1Nv5@XEu@CM?B@GZ>k@UD65`{FN$e@ed-c_;R-`FHw{hd-dBIys-bEAlY8mE1vw zl{DV6dZ|m-(_OX_c&WJX+G#FniCt=WBgpiYSXWNFiXtaVR-Ep&;A2z-WZmv?kHtn| z)L1khB+U%lwW90VuJJCaOD}hdWoU=i+EUqnObrM8pBL|cajCj9oh>95qC)ioT&QMD zh*rJ7`R_l;J9BG}R~$((ax3V=qSraM)M?t+vK<@l{--}`%8t;(6p8VOC zty5E5|9pyEz4hvAZa=(!Pow#KBaHSFlB6jYBWpK*=kQzK{?1#6116gKD)}d%2xVV? zx;qKy$5zm5g+CP@6dn&hDMr#kh@O4T$!2ZGPN(F3#01cw@5dxflO;P<>_&I2C@jwv z3f(!o7*9(0Ph5l|3>1Ns8D_|A4dFc*w$KYR9-ws2ilMQ|h@2P#mGVM|>RZev6C@2tUU$zw-{P%Nx()|+ zlO`%+!N>h{&tl60Ze-<|=Uj2g62pR67 zt@zhknjFf=Fp4{N$thSwSZL6(GmHAdINaPf%eVMwb!aYx!MYA6c_&7mw5M&v9|JS_`UZTS52x@uXNGTd4sbBW zu2iAZFE)Px)aD7Ww0YvWVQH}5JTYl2we)8>J1$a<;Yh67JmJR}#d9S_@v6u=Yn<%4 z5+{30kvU!}B{*-X6lc9O`hQp*-}F3kLJ}G}%rO{)EoHX#wB=h>3KcVxEzL#>P}z3l ztEvRVcfKdr6O=y4yHTQlqhZaqdiln0Eq5br7Vvw3)sw{ZcxVt`i?jEZ`&M+9@nGV&-vnCJ@2TB3%RR%t+DkxDm?& zI+e(RKs&>wh%wlI-r>A-ru^75aJrVJ$Z#Kg4IAR>hIK0s4oVECG3I}+du-zSI8a85 zL9Rxdd-fl{yn2zzpneqVl0Vx(l+ejf&`s!jyt;XWT1Bn~c_{k{n%bif1qB*WHij*5 zq7+ReVo{q7MDloQc}pbETj+QJ$idu&W-e!$b{;CMWLhqN$kVFkW-}Q!8gn@|ELmjS zGyzZ*6tBj5Io^yOj=%^KPYP#>C$(AtmbYrcLBID|3fTW;Zhad1$k>{vNhE?ug+tvU z#b<#KmV$3S*oI4CUaWCKT_2ab}{Oqt@+k0TgYj^p-hyCHJ zYnK1RcDxLKAK{Smt{;qEwSmas#rW3cYhMgL1{wic0~h@r401Ja;QfAWJKQep5J{6Z z<7UES%%sVh+Uej{34v3LBRSAc$A;MvQlCWb0Ov&h!r?FaABedl$|0{_+ z0ih}Ik|6Ms1Ar+?k|;`|00E7Bt?Z^!oJ*4~9Sb|IREKN*xJbAq-s5-jB)<=?1tN_3 zj4!~2!nm+acuSy!{ctD9!ER`^n3Pjv>yBeyYX)>6#a`_TQLQtvlFwmC&cT!*j4xod zI`NNxfYa(cL+pB_@yzdI5yeI0L$J~f`yR$8YDf=TNiuCvfA&j3HqlmAs?8?#J#sZD zkjwpD1tqUOKt8MdP^}YtmECF-5FBx@@~E;?`5Wbk(omw?h+V{Cf{ap8S)(+$K=e`t zIj>f!s(cZ3k$fd}rF4~im3~#>MtBRgM!rdZy-B~Ra2IulyhV9j{SmR9`YU;xx`%jy zs>{37=k@0cuPcYtca4U)*rB|j91Ih!}17K?cp@HoJb3kiN`15beL69?ZevUkeK5fgrl_PJ<-IpT}zD4A6TQR$T zWw+R^3BUK+*uAkwk$j$wt%#8y#o$hiagl5c#$sDB#$~rKt_h#->MCJ|%QkgwGiJD& z7yIQl!)4AfTxJKuWp*%JW{cr^2_6M1yd7xpD3ZP4QQx7!6%dkFP;}n44A&H0ChR6G z(`1-LcwB?p%Q{3QmLBk!?k^nB{X(&SqWj(Xitcx1D!Q*572Rj~ithT?6=2~7_zZ@( z9`aRXCE@oERS0w+f$k%Gj;|1P_>9kl%#I3V7}TJ?w&$ak5b%cK@nVU zMMyGFp26mH;#_m@SlF~?Z+*=~?;NIc%jU`J>yNHQYUptkI2Rz1o}Gprd-z5|nms{0 z(YcRr0DxLct_GvTcm2&-J}VG^LY2RgCsHV<&)V0)TZM6J+_`S_W%x4prtqfqhVw@G zK;^(F8wDEJVw0c@g;8D@bvWDMtjeM?v?^tX6F3u=B?!xvQ9%$)t0Gxeg>a$Ex|~ak zuHag(=^FiR+0D6*J8#4tbqCyv>-wXkUbX5uPQI@%@2v_|>acIOIr@Zu#~~gk1z{** zSxO=i0t!@=F8Bl+8V?a69-VZa$P4&B>xuj-wyV@iTSHy?QkpjCd0{tvd>@R= zH5s;p>1q9xHluT=G+e{dFPYZRixv2xlFkp65Q~kjP8%~CH;qoB6Rp_*8aFdDGjqle z3VKEM0-^bLlX@Ao224$VsteG(V^S&vtpb9B=3_`p5$etNo=eq+TfuD0Cm>nF;TG#< zkDIS9@Hk&8cpNP_9+yd~9+zPhkF)1~3jY|(vTP7O?BO+rtt_fHKYWg1TLA?24S@){ zsCmqf32~3l#076ry?M;PI4*cRt*FC1%?rb$OEQ87(J(rg<~@jihS9+k=Rq`#qCRkl z28-@8hbwHCIb4?X)G&u)_c99BIT`&{cpj}cUzy}2q_n=`Gn_Q+)HrF_Lc=**5l}!6 z1D<#;SA_7iB!BTD2m?akTv%J!A-2K$dnDG#HhzOP#Y2s~jTf+sYkZV3Sg{A*-*`4B zvPSj;ll0i7+v-lK%LRsL;Vh|XAWf-P37ZIiG%zYV{*=lDp zwwxjf!W~++A(jzHIpN=$ z&zCSsY0qbPj*qRI(=j?C zs1~TRG1^xQwG1|HJ^kIorgL3xA982j9f@+aXbpY_#lv><_BkKH(;wPJ7V-7QoqEP# zWCin->)@5}avX4fkTp1|Z}!AD@$;F+fmnoOG=Y(SW7vSNAbt`&W{eW~^wqX5h3xnY z0OYU8)j$Qm^yws$EnzfC6Z@MV1E%>2paF&Qo=6F|;n}o;pPQv(i4{eTwUs0!1j1yJ z62l~!1d)UaLnL65HGvu?2{WFc;TYwzv`3HAByH%**mwdabZx_Z9XM=@nVX(_!&Qr< zLdwH`#=auNW`}4_A$v$5cdsr8W~qSYe|avcdTleNo!)ofd4O75P+w#b%COy0AF&3Y z6(s%x1LWJY4-r*dte*wM`q__zBy!p8`M0C5^tENgf%WLaApqg##w>Xr^$XAsw(R-2 z@N=7p)SK@;pBYf>v|Y)dPIoD7R~$Rn#|s>P$%f`%?RzfIuFK1ci6fii0F!b_&?}gu(V^whXG#;n9X`q)%1~;o2GrGaej%h~F zW){311lPINLDccd2d}zlfhPkzdI<)4ng$my9^fnO3_B7I%e)jO7MBHeq(4hDhQ4Bd z;7cQm(u$IeXQEsQehhReR|#Rj;1a-VWT7Q{&2W!za|evTY6J%`k*&n@C|ol^kOWUG@NYS!Z=cQ+?0(|E@W=I`5>Hz zgHM~JX@mmV=>(0CAv)cm5nIGf%V(+%tL$N4xne=aX=%Nhk@S05kbSf%YrSyxxr-M1YumxTfz$A zR$;BImf6V;nu^X+e%V0Lpe8bsiFhJlug&CpmZY6f$;) zRG|zw&+662oqUCcxihj$6WwuIue0vtE!5kc(S;qj^Ss_<+}U4P7Y+%-3f*~PXRq$) zF@G%E9a3Hh;LbC9tZ-+a0W0p5H1NlrsP<6hPG1An^n^BmZ+u-Zm$SfUejF(39t5~` zgL-6k69kC6r2y^Svb|$)9D)yVyo9rHZ1;W%5`qVFqJ*n+V)tIrsR$gXQzm#?r+7XD zayknC?X-FMdFZ_l2%L!^c5ueDVhm??K7Sfy654$z z)WWk+NT@`qcT7`AGiIO5Y2jHYBvf%J1QxaM7zznZZOlhPLYzN8rhJ5U9|^VaED{o` zV1d&PA*IxNb7~|sd8KXH6t0EGK&XYsKuBm35^U-iZVl_{acE-$i!2`Meg3xBb_ zwFyi`FM9uNZ~dvL)VfkRje0BbGULmRlWKoCp>Sc2US zRv{Mv@Dd+z8gllK4vhf%Lv!FJmWp|Y0$p6L2O0|(1>N@E3|0WY2V;SQoMyG93}An7 zy0BALoABw3pLB5La{HItzuf-i_Gd4*f4Tk3?f-h+{u|G&w3j)FE-iVxzNLCK4M{Ki zYy51DOw#K{CQY{PHF>R4O{>dovKg)JAYuId_5MB{s?Xl&{F!;=FSIu4bc z1r&ehg5{k(;!M>zfNB8jT(EYv?ZL}$sRuOU08RX&p2f?n{`liKKq?0`rp2ABdXNk) zfYSh^#mm+$dadR0SfJ(v5Nuttu(NA;($}W}(gUD$$&!Vgx&iVTKrRN5y=3|7E8lx9 z(F6!r0%XOq?ggD+grq+LbT5Ft%R8^^(Y}9Vz7HUA0BkEdmoKafcUl1PBS5I>>0Y&Z zGzY%}h=E+NU5Bcz;43((C zB(z`#W@9OOuo~;I6_2wLVM89gC_sNH=c+{ureiibaXD6EZG=nt^S`_oC=0%$Z@>F0 zirzo`=1pSx?IKgi6!JUTEaVA8sv1>|>WF#*zi*D-pRikVwRWSfQTKV=R{itwFG@c) z%IDvvBvVqt(!?j(owWbE?&K#^_NA^dFSD#ko1fm3QJV2$#*4Pk?Uy*N&JKTOA9v-r za&oNWKFD34yFTw8&w>0)3q0Z=7LPST9AqD|_un;E9K^%th4+esdI^#X+nP z2XV7Fi2I`Hhs8nMdoB+d{6={*&xMuO#X+QrgOJ5RWQc>v6bI2I4x&~ZgqO+q7xh{n z#VlXnd1e0oKO9Gvw@n;WJ`sNhu~HmFjW~!paS(S!vE@u3ZHV$Uii5aL98}&B2T?2z zVzxM_9E;MHiG#RD9K@Yt{i>XX8*VNl26LHai&}tY;-zSqAQ_=(m_mbX(XfCfTpA6F zu%RXzRv{IxXjlywfO>Re4OU_)7Gfo)Vj-^JbHj@|bYmI1Faw*2WaOezc}UrhPAtcEgvsMVi+GK)1=BGDEAW3K>?HYOP<(mh&!g8X-OB5T z!>xFj#1cCNg(^>(gLIT5fO+_Br1ium=8h<%e^RzX4L52r9eubRx8r#nz-Od^928wD zj1tAF{8o7jF{r^j+(iT;5Q$`w3FI-FBD^Mi&27*`OvgMd#9}^TkKhsf65DZ%_(=(A zpbfO0-a>!xqAv({h}VeMj*g%YPZJQ4Xk#2Gg`7zl_2FZK$MPa6Rk@$(SNVx&5xh5pTjvQ2@5i`+- zC$Iy%F^KnwNX#UQ6q5jHAm5`G)3t(MXb~hb3l9lzh;zgzM*X9IQ*KlqQ1&Ws zDsL;ppfDl}UQEUe%tR}$!VS0`KgSbz4u|k};vjWo1^FJill+`KPM#op$(v-9>gi)b zsc?s|OC+K!-X*>?Y8?H=Xn6FP(x|j4r;&^KxE{CQ4*UWS<5BFya~L8M$;D(EnM;CX z1-XBT+)5rHFOW~ENaxWf1((n(tQW2l?h;OlPI0~X2i4lq_R%{=cPjT}*GG573uQRs|;mJ97V*cUA>EfAT$Y z6StdBflbH5+-}eUNS&_O%9MZ$szJC`GA}vqeP)D>Z7G}9$iGQqTA>` z`T`vlVudupA-IGpVWH3~TqE2pJS_ZDcwP8R_(F^q6GWFdUR)^tNPJ9uPCO!>QcYA% zQC*=ns=u$^6tx@|crK)o`spG{e@Pn%;?RR9=}Xj$>1TQWZ{D|(FR-7~;R7;qW;b&y zZpC%@h~$wuw4VG0598;gjQof^Kn1!Gw~_&D#RI}G$(!_gd>;Yi;}Zlx=n|4oZlUQ| zgxl#3{2AZFAad{-orphUkbFT?F(?d@9(+muPJV!6n2sP#!ea6|%E>LHe*w#AE*w}* z2C;(mfJzpL>Jor1X0}(ni~g0~MUG)2-NNhqebR}oBo{j|NG`#z=#W?{?n4Lw10i1!EsW$=P+W>E+)5ho z7#<@d!YBqYLD|DUAJGEbe~7!dzquRP_#fqmc!tb}7dwd#Kf!yrSU4dj0m^YPL)ECz z(fK&6Ov5Xrgh;|WxCn2P+pq%{;VqJkA1ligKR(2u(uNyw1D0Txs#cYWPIS^`crIqE z`WA2>s4K<>8i=9dR3XKP?f8)tIR5cN+%u@|0Es|pAjDvf4?WL7xTp=F-~|# zcum+Y+$Y>7bPH32fRHb^gbYEXU(vtOkLe%jVLCt`rF|p>C~qtKmHU(yrCKRd5=KWy zPmaDY`o!puNADW_;pm3Zp3&gQi>Lo|`rzs9rynApj~rGWP@W^NjGn^7WQ{UcxmfvJ zIie&gcPQ1PhsY*Ue?puX!3TI1`*8<$;z6uND<(sx7ZC}gIEi7rhd1#mc4HfE#T5u* zwt6O-u>vj}!SzvXTnG~$!SxXEC`_1#0Pe!Y$ih5OB9I)CgBS5ji5kV6W{3KB~u#%;7wWfXm6 z1S7PY{6M*6^b%Z!tFT-A0J8x3;?_B{XU&{3eOgQN)TT*+n(C_Yl@;Y>CH~@~!UA8u z*W=F19hc*BW;?R%Hfv@^dYZ+Ynv$H9m|!wWhIoBktWK+mQL99O5_lRN6N0voD;N@8 zj*Bkxvbdwue-?6eo|g~|**a~Z2^aE&Y(dUuyO2}vw1pOZgHw)h%4a!=WUE4z*JEpR z*g}I14qKSao!08Gg?`ZBXtRZed3XvBi!L6~H#pktcCW`~YfN3zU<;9;tuZuV?UId+ z!3M8~Y>(B|JL(teydG@V#nwCOW4#`PQXD{S+fKGh^Y^$Sqo}-yu|BS8>WMf9?2G_gN?QjT3SP-v#rvX>h;*|Y*cRx zf6JKf_1HrjrnN@mHq1}!hwO8=g=mmb2F55!vlwN=80BpCpu_ILo`j`)R3uu z-dScAX^jhs&XDL-b4~6F$7rUtMpB4ve?mwKUKD|CI=lTp%oJ9Rvs@gV%NDI>sM395 zeEbFR3#u2lQJ6e4B)aJ2nR7R8)LmHhsqRpmGo*EfRL+pz8H(rO1ZRJ8{4BRE6d!at zY$3y0$N-UMwZ4&NZ?m=9LNoK)?DneE@bX7&QFZJEyj7{fc;td>XoFT~>GV*Y;v)^oFH8677rn8U%e5(em0#en#uY-aA zr8q-oXDXyB&1ppI!tFzdL^{8vHJH}f#%3P-Q#og~hSa=!?aYiu`zxM{koaGu*qM{3 zw}zVCp=S5=R!7@)k(p_aWIONje|kcKi%65kdp(Yj-~tcXTn?Md;q^F}Qrdzc5_E1X zPjlGY!io}PR+V=E4LWU%yfGM}K}Tpt9;3Q!X^s#Ly4q~PkP!5GCO9SpH*TEZuua$) z+}IgbHq3X}B*(_xLb8y&v8OROHc7+Ep4-ww6TaUTl7dS}rPs5aqHeo`f7~){yG(AG zF}HQM1lVqw+1gJDtq<0DUMgk35@Ae0cKsy>Y!z?T{Y8fcUeXrWa`po2~sK`dgG z5yT-*ISoCB@f;cur<{TWy>bdh7?e{mK~hd30h01H5@A%nMiPg~FezUl1&PX6NafIs zB;`w3kgR-(G^8kBBAvqwq$*z^6K3TLSUI%8qI?cJ(v;7U#i0Wkf67T@BU3pECxh2F1!S0w__2 zA){0oMlH&ePf^EVe?7{TPtkx1t^5^Ds8Rlk z$*562#>EIIA7ct+_&(r}A5D=dd4lDZj-I z+@-vNf1S8nc?D169_1D6!ad5%cnbF_FC&cml$Ws^_bdCc2R~N!<7xav*^j;WnX(`I zutoU|p21e-H+YuA0X(3*gy-;c{6b^5f0zNQ_8b=8)4-c{E@>yVYl)O-oYMaABH%57f&nu z@E-Old+|Ppf5tP)UL3`MvKJrVIpt~m1n4FsM9*lXy+ph0i(s z0tb{`_!7TYcHt}hUU?E<<8|dpoWdK*lQ@kxl${vCAC#RK#hc1bC^)3-_&>Di@&5~( zp2Tf>GPmi;{|lRL|9@iB^SMp;ahvYre>T0~Kep-R+@_avn_j_fdL_5%mE5L}=Qh3S zpV;&Ox9Kvs>9yRZ*K(U)$8CB&x9RoVrZ;e#-tb?W{$HE^|9hL>|6iMa)~3gB0K7m$ zzniZ6CpKNrZMvS@bp8L@rvKma)Bkgup2KZ=4!7y!xJ}RHHa(Zy^t}Jt^#9uQ|JwBb z+JE%_z@|U@e`M2N{(o!Jx6iTGR*M8ak)S{%?8OR^ARrPniv%4aLGVoYwKL%%k>Hp} zpn)yQyGbP25~ZkM6%_ac1qA|oRWcwb=s5EkIvd+0DA*z>*eWPEE+|kz7Dji(#ur&@ zCkmtR38Ux{MzKX0g@}&xV#j#Orf6)dFnj&X0_=FJ@2wx!}jBu{tnOvLC#Ge&LFn@3+ z=Yc49EM(3xf}k*hU!BPnI**HS92dTVRv8e!>K}i1(QY2l8+qX5j>@W{1GS05$un)+ z%%MRz37>Eh0pTQ?g_GEHCjKkoB-D_F6aCsap6^6|MP*SfYtji+p;*}4td6fcS5*-<kSF zmq={|AO`2~ZVqo}mu_tZH-9|XZ@<(UCco&nPq&82;(mLHHB1)u+Y7B>QrB; zR&ON56G@qspiR(j4wKz-am?o5#B2`6Y%Yk|?2g%-7qi(FvpG9vvwt;ab4E;}#-x!n z@tQb|PNUJNHKK-Uph*lX@5&zbZN5ac#E@EKP~>5WGDss|_M=2Y(S+b0T8$oBy`7eY z5`@Wg@{Bq%IW({Uljqw)pU-fFiEi55kjhaJhRTdDs^(mJY#Zb#+k@nD#sp)FJt4a*H}p~`4@Lql6=Vl+I^(AE|zb59P(DAPmb z?#Ur-%O$Pb3Hf1LsN5Z*w}c61wuXtql5R|6um0@@A=VpzkjAib;}6=}ki0gK8Zgxu zD<(922M9)?``nd!F34oJtdrxcPsCUoW30t7R!0m=pFCro9Dld@iI~leF`J8HHb)Xu zGeUPyp3xdoGTK5#(ZJ-eNM_jPweF??THV;No7OPY*1Frgl?EE8vvl*;hPHEjaMD0y z!*19a;(Ty2J~+R@mqlwBUk*bNzAVm{bphY@iT1{Z?RNVZ&qU5M@j{-h7xHZ7JX@nY zLWIYD9#29!?0=lco>2ZRo~-|XC+9nP-2d!aSocp!=U-$urjw!V7*B?xFL1ho^A{{(xN~8c3^^7ygvL7>Y}==={Wd+cmXW7B8n$C? z?jgHQSwjIrj1IsQDck7tA?SaMLQGeKCR#G5YG%#-$DC|M5xfUhQ7B+P%uX=4?T$-K=1&iYBaHxgJ8vhrL11PibN2rV*R|< zJ%Dg6$f`E7YV{ho+r0)6{2kXAA%YoPwR+8})qiILYux;s&g@$gi&gA>wHS<-Gu1K2 zDS=8nE z0lmy;nA#DXWH@!uQ(f(GS68uR?P1a{I)7C0D8Mq=l96CTeojJcPDVm3R2p}g{9uDF8OmRK4aCVO`jUUpxqTRPERH7rGL zUjGwS(#TO$N(C{RDohndQ$=9`$#LaG>Yb7jZA?;Gq)qCW81~Hp-qM^Hb)|MSgzy_JU;B_}rT9%g0saS#xd6S6K5h^Qy-Qnu^4fjO@H>sbWu4Akeg@ zLaNGh7AIBQQ)Y8lSv+^&?MbWlSj$+;_mYpqMEVN|u*h-L3s_XdEN-}uX~0qGFYrwn zE-WDS61$jqdYjNnK6)A;BN-bb_9kC z3!LYTjv!3G=%VTDv$%5V)XK`KQ<-LNQ{ER{Djy86<6c=eDRE+)Dr2Ikw?9oU<^IQ| zPXff^NM&&?%=FSHH5#os>yF)|15s6F{Txx&VQCnFVJ3NU$k4J*E~U0)XMeoYT99c2yq@=`@^T(h|}2;i0P^yYDZDu6pdpziTfEwvTVS)ZaO8d>j4h zz5Syf#qNX9+%e)?nj6Iq`*3Fp3CGM1W@Imy_U zND}3VC5dvD)1N5&iu{RTviwP?w3@h-XXs=|0G$sb2%Rr$jV;n_Z2IFNn7snO+0Qe7*;%3pV~ zfIh4Y?5GL&8I}!|C0pzR`U84lgN~?)5GF@=5J4be^65^sBO57U8oN`Pn5ojTTy+!u z9A7+xq%YSDY$T_usM6+`|X@(z+ zs?%z%noSz2F}wDVJISRHvp@P6HJ5Kr<@q(*7gIp+Z`AlHda&+X{5TsmkQ~m z^dfp!y4~B=?1g03PjBwjN`9RLso32{*r1T!cJ#Kpo%V<|v6rB%w8YOfbKIDd);X7CCRKm)Q+q%Yn;rcH0w8Jpd)Ez zHS}yhMt_WPv>S!nE}479`%nGt%KGtn8CFkD)zTeX+oyUjFD|RfUlcR0rEt}%JEx|^ zCt32U=H2x2GkcmW4eEY1x8k;FbsL1nF5z#Xxx3*)pIVQHs z(^%Va_}=DQnT=$>uwqih!-5RjE?fFCHf8)YLw~4BpKWeQUu52GR+XAbhFn>a5mq+r zaL)>4FuhA07s2Ba8Qvhzoa+r}EUFBPCD-D}sIW9y^-}l4v$tEE&nE8EH&!j8a-4Et6!%q^6|A$Z0Nr z%rkU4lA$3FBOdAW7FiFAXo!z9H>ZYDY3kE-8j>N>n`E7a#KdUQQc{xfG@XxhXy|;| zl8$6sazV13+>+drydimO@_}S6i_+x1w0{MexP#9_>GR%*k*kW{N7=+=2Cr&Z8mSs} zv$Ww6cNJT{D{jtri`Pgm!c@VwgpujEGd)i$`QdIWEFkr4AC{pE?5N7*BOq(b(gPWC zVjPRTv%`|+XLy&Z#3H*&I757z6tKvaG`}S)Hr~%iO=pa7OGzAWH&mSO^|kf3qko+R zm^11~-{77VNS71G1=8hliGlQ^bG?D|4ON+e^bKX{fpl4C42m~LQl3*ml9kn$9xwa-cCXBaukOvCUncg|R6^tKabElm+ejF$LK*~~idC|my3G3tcmsHt#d zsma4lH(mU|-`{)gfdiMlPSSsNO{2FeFV&l7p8xuk618pl!iCGPnOgG$y0@l6!E-zQ zbT=s<_zNlAR%kEwR;R{yuYYP8oqT2MWtS}3xSsiD_bQ`&&L`k5ITo64&bTKto1lx0 z4bwl$g+?SAjfhQ%*8wIg@exY4YBgefoY5Gg>(LHqsn(LDK}=7~K#UM$PP}9Hxz&d) z@7zEJs-}$e*3WC*Nn}e22`d9nSsVc(8xooBv{gw}#)^uYK02q`4z(Y(Va=f+3spdtgR}kY1%b-I=d#fDkr%Blng3=6a?Wm#3BVH za-8t2R-N>$K_|tLxG=HGI#XHHp-jEdp*+ETO6J><^SsK0^F2&5=3&yYfFMMD&5@ij zr;}hNMDb(sHYDI$Ie(h~UY#~khXkEAfrVoebs)Ofgjk{#rPu^L(Z+=7M%e(}A)8(& z8N_aJlPHK``kHLSbBX~w!U95~3rq?jW1f=`7+F$eugSBN3V%B7D7EC(*nf-YMWiR)ljW|-7i~EoZ54}ge+$|e211@)&d$Idk_a^ttZneWrwi#dX9KoC9ko2bU zu=%j%!@Mudx;f^>bg6NXc@?=bZ>{HMF{ExvZ0niIQYAyK{3{)Mha!S}bOx$Lvp~ro1eeJXtUhLRi1} z2q9rQBFAd8>~@__t1%B6!?aD-itg2J>UK-HET)4+vSeF2ETZLU`Wf;;Y1>n7X@c~; zBuHWU*?$i2=5oG=9A+O=h1u7hI?Vh+zBZlcb+=ay^F_v^46p^l!xjufW&}@mMew*p zj{74M*zInUB6;#6dGexp@}hb2qIvQz$P+j^e6uRwee*Rh-khJx5R4U(bI=&6sw$?c zD!Tf)^Ymk@AM>jC)!xpXQDTp|V3UwSqSIAHqEp6nY>|njLg#3FQ4w2NMn7!|)Ll&K zZekJgG`aVpl>8c=8fYrI>7j>7(>0NeM1Ca|vMTcPE68c1WG{^@KctD=J$e~C?MMT} zd&GVGSK9pKd$(791w;WRc8@&V6p$wkzqhWXbW!){NizSM;+*?8kA5~7QHQ}F)UPe7 z{PCB;e+3)?EtlSZ1yKTCzn3w91&4n})4coF9(s0VbH3k}oswIVR~@|WC%b;M_TjsT z=FYYsi?>)THBC=61yWK1c`4q~mYrAMc;`!2Q;991CNHmG!no4ORYbV&wyh-T?p(H) z$pFO5#eGOe9^R8JyX`N>z3dWZ+vnumq8A#GoRZ2WCoY_s-*SKCxXekJo|Kn2fdwc5 zhL>Q01!w_;m&t(z9e>-GA08C4NQF1Qf;3gQ@4oZ$`QLlFFVk0%@2w<`{2%sqc1~J3 zi+PTjfVfQDhf=y%PB6HvuAx%Fgt0RtQ^HsmCS*>MGi03{D@2STTW0s2U0<6bhfUsm zUtv*kNogr+~L;z4mo33lm$g6GpbpHP*1GGW1+DcL%KEHmo6yjB)!I< zC6d;r?a>O_Fj*n%@?~>LzE?Jvc$t#8kWbs>c$clTpj0kxDGipYOr>FxvWsLpod99l zl9*6n+G?VkOn=XsXtRl!%w^Lf3bV5JtdW&IXZt8~scbd`N;f3y1Em{M;sd1{65|4; z8%(j$)sycj-IDu6d+*WqUanyyZ2fMppV#`NQ`Q;+&gd%4v6RMfzm&xDxA8?@&Hyvd zkahY1*s23rN((?vD}fwk99!Gvj8ev0%2-PoYbj$bWq)j?a#~50HG&EY_)ai3gXQ20 zfF`=@6r(sMiq%o9VlG*R&KR&UZYu+s3}i5Ib_OCP=%Xd*qb2C0CFmn1m~?tpf}WM2 zXC>&z_NEtHZD=P(d-Pb`c=mX4%ylp(M)w}Z;^L`V?Pb z$}|vk0b;+n55?q3Su$i>vnjrP49mPsog7QYybF8Q`E$YT@#gyqii(Tz>;)6az~+KP zzwLZ5!*|YM{muy#`OzU~cD7?IlRLA??nyOedw+^e4o`6a&FDZkL<88b1VWQaC689C z(YTpHglXH8*&aEq#KRUbDcf4?D-IS96pO`jniMGBLsq~}+vHe_#cV0bayS6;G@T72 zBxPVnT(Vzc1M6^dEXSr<{g4VIDw+Lz$YbQs(H$o90M5E5qwIOo3Ff~tM}v8^!vW@{ zjDI<_j>vRyM5jXpCvm(zqQPTsY<7e*JIa|I<;=c-^Q^A7fBU5RU#U`5liqrr>qqT* ziu7xyDUpPz%D<8=ghs$58pP+9w-mBTB*`?p*iqXcU z#vMr#Tw&#-9kKC#Cu56`jrXIpth}Ofd=+0bALN&pg$0QL!8* zPf{IDe<53e_)8yV7Dy*G>bi_{V@-114QV$zHdfzRr>hAo$7Lxl-k&bT8T?vHY`R!2 zIM_qi$RhZT?23O&3|O+_5(C}Y3j*t`ecAVz@2%QZ{IcPt;=_hFi~mynRods(@oc@6 zi_M0Bg~_ZQpPD8nm8aUWoc=ThQfe_8}omZaJ$OE^o3F*{7EWm`#(T?lxay&c|e z?@AEDy>soX{ouCU7p5@4O(lqFPnd6hsm&9z{E& zj~4m%KRG2iIeI3X<6@3IPyG(JUY(SfoRTa?PLv&4E;2sNp6aWp@MRZT;xq1Sy|uNx zw0hia+kV;g`LCOAE*m$FopQR;laq}Zt1s@puB3lBi;RD?=kg!^an=KVn<+49V^hG@ zCRt@Ur@~dAY_M2cx3=H$Cr5TpVAB0fffVDSWS4(&xocu#d`;8Omfw5HmAL?6{{e(Q zlglFE-GK6rTxCoN01^ry7&DD2fzpK1tR>Rogj=MW5}q>cC%?)1nCN1O)+lDB8Y@VJ zRBC^$G--&e)z-CU@pmFvNY+N*`(jVazVR3=?wrqnBxL|Hvz969v!@Va)^bPYB$+*5 z*r}6~ z*q6Y^QCxXf^_<-^>U(ZYA9J)cnp>KYHIjeqZXdFdj4cHNKFDB)n9De^q%21uS<3;; zZh$qAV6M%Y><2g`+0Tw_jBH5kgg`<_f)irEWP`j}$DCUGm)Im69(`X`_vkRNzsNsV zb#?cgRj=NA|M!1yL;zwjUVt160Le#6WGNhW6FlcezyMO7yD{6-h4dy$I?&K3W1oK! zMq0~^pbMLYZNfp}q%bMC@&XhTbX9mp!Gt2ZwQL6>D1i~M8#uri(Yq&(qGTZiF@z_O z_lFt~)J>ZkXtO0jw|%U)4EOVDjZr4~|@!{HZEJ&eIUi(y-1rj6;hZWSKy5 z;tH6`Gs1b^w)U_GdpMjZ7N;H46ttIht zo>e7RiW(`wl4|!ffH7j_UUh8@;#EiT9z7PW1a2#g5f>Re_9llh;SR=beXOZ$`>l}iKG=h4DCx(X8*nOcU5ADgW(J2c9r7S3ivfLkP zRwNQlBv)bItxqaOb%x+jRV{y8>;pv3ut-`K)6I%;)U}t*q-PrHf;HWSj=@M8oF{} zEx`Ihk8Z22!GWbs!MRP%QC{tA1;pe#ljHX74h~451>R*89Rx{IUfX{@_jB$y+#is3 znP9zgg4Obb;>{-%?H%o%mXDktDU*qY1VV&0{N0m`o-im+36Fx5rxY>lv53)3Y3@&< zS%ImF<1-wE2Bo2y8G#VmB@k2XE{1AWDUXaMR0J*-&!*uTa5;Co;4v3;;n(IU-4)J& zBt1r~G{k^OpnB0i?mvI&pY*$S_@Tdkn?IEP{8#WgNSn~O=>iX7+jm0OCv>hd#POAm zy1+frfI^(e2{EM(1&kMd*$Agv6xBhh4q1jNQkJ3OjLERY-7H&n@RluGK<|ZLHdw96 z|83*15$abeex_&jDAZ!UD7I(yL$v7b3)KwgghE;zs1Ua-MfKLR7TJ4LU zW6!{nrAFFX+u{195A`2`&9xJ6TyX!AQ^7dUCCeWyQ29+uhZj&d@sMOX*K@`@o3^5@vVd_9BS|ahf@ee{N4tZ zWFsGzYWaAS%dBR<&6swo#a2Kx+>aQfAl$GKb@!&Kt(pma z0!`5h+Ms6FLYZHG#X>TcO)O_?!`1Y%<0jg6_BeZ-ov42zku&#GtgTV_!eHG-gI}jm zL!t(;_eKM>8M!cdsPG&WUH@vQLys!nRRM}RK9+3CR4Tcas4tlN%s<|}>pRbke5P=5 zyk&0n>$Uez-nthi-nr-=+m&&>_m;kSL4H%D@ZGQ7aC?|tHm_yT+)F-x>l?p^vVuI# zd6VPzw=9488#MBi$4xtYw$n6ZJ+e<$*cQc;_vIC(<@eg}Td?$TXO)i>xYNo@6Ik_d(mC;9@e=m>B|QN>HlB<8ARY$L%Sv9EToiwtOk7=u>>LxI-1? zIQ02HNxtg94&If4Ik|y4%qq-~FZ7QmVwb&mH}iyKX?(?CJ_U{%aj1Ho1h?4ld9@>*;UpfjS=fc z!Sx=*=Z!DcalceU{UO5}Pn3>%peL*)u7_j9IztqUcv%((1wt?yn351m_HHzHWu$+e zk7GheI*pm-6Z%=qhelM8bUHnOI|MvRMo85qi#CjVK5q7L9`~cobxr&~h~U%Bc3ay4 ztYT$OO#aRwxqvQbxB!aR{BD#BV6Bfff^-$CrV(!mzI}Ra_yc~QX}-JcSAX=R@_%k0 z{^4>d)gd+4ezEPn+EJ(<{_1bq&dYx*|DC`8>Z|TAz)J@%D~g?&=Emeg=zrl=$gFDX z`@;F_uUoZp-;ph1FR`8I$eBA-A5^Wo4PiLTmb z;8EULb~a_%*&Z|tUb~5>x3&Q|8>}!de*#!BU+PU5JxfXnW7&#Q!YFr^63BlLOI+Tp zMghM*+XmKWGZ{8m2pYkG;JV;Q&>3_x>q(MW@1{VyaKD4%h+qAp0U~XG5hi2!BxD;?v7cA7{HKETYh|9Zr{flYXPA^4cYzxT z=*+884?}C$!_XM9a+CsiR^rqSau<1!e37&x3hpt|CX;!xpR|$TwgG+}Pw>xWupuTZ z{mNQplQO6{4k}Oywf28rIYmxBQC*I>=_dGdw);5Z5a`{Z#(Z4-s>-U`nosK!5=TZYSB8KeZQ%lfZ^XPzf<3N z?X^46e_Q`t9B}n-{PsVft^bPU>oXY`_|>mrAY1DldhD^G;YS}uNIm)u+_&|Z1+^Fi z^g3L&m$7sN6t}{$1zZAuAMQLIAb$eTIjwnoTUp=u93WT#m~NW8sB4L^SFsDA&jHvo z_xz=S2Qs>?K*sxkYRy?o<}I4_hpr4jEdt6H=5_ThK@=JQ#{h`)7A`-_{r0(9plmlV z^3?g=U1#@aePN)c{+61CXT)7tie)@oxSV z096BcVo}$HOB4#D79e^6fpfbSb;nYPV4rE9f&dBz`4|ji3W!X7@<9OQ{R6iF z!d^)w%@Dr-51LtjGDdmio>LWXC}tb$zfo({a>d=*le&2N*T*MGlIq`Uh40l-0Gi`> zV8ULq77C~pw=2p4l9@_b7tW$)g@US>hEfF;1i4kijw$1t0*E7kjlw5`m-08H^Wwb0 z62RsN>v+$=2B129-hdm(z5j8(LB8ZC6WPr|k7A7CBgIF5Dx&I^&p*lMk)c!lh2~++ z!`jPIr!Movsc$u?PMjIapE`|#@pW;PsmAn{=`Hgn%OlpXd@i>gwhuU7bl&g0-*uk* z1<$$OlFUeE#P@1I8@NwyC{4HAnjT3j1SA0DA^-tu1QA9dDo~9PXh0KMFcuRr4c%CP zB{&}!VFNaQ@?JpzVHBVQRWju$nQ{WAp$qe{5a;2-6s7dH|M8qF&HV{J`I$r5i+RKH z5cZPK)A^nM^R*-@?8S~@*MB7J#UWuY9u)TCDPb?(Ow*Z#y?A}tb$f?h)BO|gG+o$> z73qB2kLo`9nRd(<_F~J=)QSI7TZYlD751Vq-G)nlf9R8yY5cE*y_hQO#pA(Y3B?JL4wtP}QP<_~mr$J=@{`T?jggL90a0jLkRrt<`LT%OKTWMFAJ z&k#pNIxh^PQNRgrI6w9#$-5Bwsy9Cnr2_P5au>f;%9u}h)i*Xi~A`g?%jd@sxh3LY0KXdK< z2%rolC`Andn1cD}M&Li59FVU*4@+d&g{A3tEkXbzu@DOpz+^1IJj};Z^vb1f^vX{< zAKf@prZhk+f5)I3b8uez-6zOTI2TinKkHO~bYZ#two4JfLM+BSxpe`|#bPYMa=8_$ zX9bS8pakUzAacA^jRN^Sy08#SFdqSoK^M-I?=ctWq-n=tG3Lv?J_gHhrrdj}cJaPg zAh%`V&%V!Da(@Ic3JWj?3uSDV+#4siF?FBC>6QlMr|_|uE4O!O#4eD>iDQ=GT%4JI z9;cr6t8hg$2?4yxg2fc2+nP4ETMSUXR=5 zbl7cHi`gU^GYop2R-;xa6#}CK1ufx!(Vc-rq%$Ez!eho1@^ZKyB(7@?w+9ma za(=v=Un}Pg&EfW7u&^KyXmQSO4kSotpd~T-{Q0X|I-3g%$Y!0kDcsbpEiAx)X05I% z+@vckK*AATvY9vmV`Up+>&sGoB10gSawU-nTd&$+FF`D!C-q~ zL4q{R4bMp+JSt&~$|Pu#ACpivB~-_cBsAes;rXl1 z?(7OA+^Z6pygbGw}lflyM}}A8myXI;|cPk zofHY3f`hj^KEHeL|5fh6Agp+2Y7Wd zjyZ(|!Nkf*ZK-kqb3A>B7f0I@w3FBD9;&fTh4s1>*?XvNi*64Evq`yecL+aq*AKB=6GE?m#{Q{wJ{G(=ctFtwFz_6 ztmDMI(56oa*$E+ADKqt%NtJq1TM9!0qZ4B1m=tW+27~|0i;~h2ewCb@xGepei4oD0 z%XKG}PkKH5D%LtBAw+2Flo_j5X-}#f9Uk4eYSrj)VDzfaRb5GG<(zOp46oYGA}q3M zNlWL@h$f{St38Q-(QDchV&{A^qOf2y#i-3;a?Pa8adOS+GupO`K;W7wZGDu`rp{6A zo3qF@liIcifVhmM9Ltfs5a0#0lGe#>eN-*ed$z}cm2#~hBjobjB!P@m58(*rCTR*M zrXCcL9~1}0+@z4Ii4Rc=n446ma4S>PxoK)O<|aj6vjdcW0CHvO;98?;O51RLkcCWE z7_@0hf`k(nhc66n25m~57hW!BRwV*~S#7~!FfrHLzG_uqRbW*(DPr!lwiHYVkp!8^ zq5P3=xVZ{pZ@VYh&Xs&(<($B*wpFuM%?Jm>!9=FFeN_q-q_bxgq&+$_T>WPB>cnb?m-xB*&T>TF;`w=OD-@CG0_RISNsaDYyj=yh7TLFKJPKk1aHl)`MaSUSzY?1yYIhHQ6mZ zFU`RpNIiX1co;9CpM(SqULmcP)=PK%;H@5InFCKrrP3ly!Bli&87}$3hhK@`VJ~T? z4Rn`uElg-bH&)$W7#4@(_7{n0!tZ^lir2Wx_MU=YwxbTIqJ_et6)4 z_XiI$4+W^fsaS-)_>AO|d{RJS_6>eHC`k`W3F#^6C3$?SP=h8+MF*CkS01r#*omic2!F>ngb*e1lUy=} zw34ahR`L)zK#oyRHNBKRL?zb1*0SdXmvHOgX@iRfZynqsRY>DOz@UH&6{x@n)MF~z z(TmG*1MbEHco19g65hlY#7TUlgp4JB(?}cXB=gB)vV`=Ii^(PAN^(EhN_LVr$$R7r zDo`c0(I}15x%6^+Bi%~(&^PHJ26j4YV?FF*b|c%$_OVX|Q78~fgz-YBuw1xE0R>aq z)h``$99uLnXW;gMrv{4#n+MMsTs`>Y;G2UVN;+wm^bwROK|R_r554#mR^Tds{04X7 zemsCT@c}-;=lBX=;~T<=hPa83_~mhHB4f#TGL1|p?c^+S7MV}ZCdaV4 zXaN{H(1}xFqTi59=t3+Yx3a&Jd+A6_KsW29qsc9U-v}dFIYwfC2XT=mWvv>DdPSyC zA=rdZ(1>|FE~A_;98g@&^XzqYRBD%kgR>PGgYV-ayn``#kF3TPjKRCaPR<~c1c|l^ zk~9qu(oMqql7r|;5U)xlWbEKJQctp^0O^r*WD>5z89ZhvtQM{mmI;>t()YL+S79A) z$Di>A?tu?EsKu#&n1WfDg9Ru=3Cd838Z=@QnlToq%5kh2=){>g3+JK-7vfGlgw2Sf z6;p8r=HM)xjUM#k0$hwsaXGHW8r*E#+4ZMQ;a39uTopKaDS2iIR z6UeuMn<#c*inN>U?weX3PqN*8BjjXDMpoHMp6U#8+NUXxjVxxnv4ri$Cbk=|u-yDX`VDL+5^N`Svz^$-cFLF?NU$B)&30fP+W`SFmIPssvPb%| z{P85)y2X`$RrcjbH`@YHCo!>Z8!&Zaf zOST#kTMa7hW_R?RGNEj{oT;vtGwX*i>$g6oS0Rlf; zj|5wf-E2MfvGp>3J&1g(U|#xG>C7E{Mtd4#w3m&4)UtLq4Q24Nwsbn3P3tT3?;6?3 zrh;IT3^y9zhAZUS6>@&DoL?;GV{$&0&U08i4EkkgRoY@D2)#>UF&cy@}Mp326-2|sIPEil8+#<9_Ic`R!|GyH4}8!e}&u+e?Z z{*sY@OW0`4W-Z)jVjSO$V%CfpYla|Wu4m2Iz?yMD#>{5TSizd{3Tp)yr+HM=`5MjMZZTtH*3skKL>u z`&d0xte({)z$#I~DiLRun8+&8$tt0MkrkkSm=)l9RshBdSRu0DXF<9KR`^*Uo%-o& z_~2(gy1LKjkB`*Qt(Zu+qLXgL61o*D>DE4l**MZlSA)|Q)76+jS7SC^jTJxO?)m|@ ziLQnku~bc5M`JX`CeR5?h$mUzmiqcKIW4bBrQXa`s&|(eN1n&>u!7~`E|v!dBg;d7 zG0Q{jc*)Q5K(UGCU>D25D=Y^GSdQG`IhgQ6X*SEj^(+T>u^gF7Dbsz)av-rBFf9Hd zx8g@M3i)dP52fN^cj4Gv6ti5+X1Q4LLw*y>g#rgyuFPUNa{WY>i|bh~cBSh=GBbx{ z<_uv13;po6#VjP3IHQE%XQ4i-F(&DM>OL~UI5I}pU;}xuj8tOav?U# zusEGxgJQY{Lswk?LwOTj10~zewzE8z$8uN>%VoJN#6m2{f-JxS%+LJH$9!}xT}!X0 z*VEt7-_Yymb#x6~Ls!$)aqFh&t|*;dxwvvg<@J?!Rc@->RjJxZyJ#2fq@8hpE$nsx zW|P`IQltWA!9e~k!;LaLPljJ zjTfk%SIt(%Rkf-jRiP?Zm7@x){3@&3tQOT7YQ0*kR;!h2K~2?ATa(hkc$BZDS(PGB zlmdr>oEIsFG_}-5iJD>@5*F4dEXe&?I5J!%IiGow7s2Q z)3#Y4*Im~R`}r|v%-m?I9o_sBpfe4lCk|(Hcp*_8%}m_VdU{*pfz0+q8P7gi7N2@tq zHcwJ?KAFyU65Zy8U`zAnU~q`0L8fUqnP%R}H1lMdd1)G!q6rS8Q5{53rU|MJ{s)ck ze?gP|lQhG6vwKwZ7Y?!=Ex+qaz3 zmA~<%$6Y)0xXt-pKXJ1zezSc3tW!4rMD<2qeF}fpM*ggg{8^{OPm!M`bN$4&&1#Hl zZ<>`#w@{td+|<^8=?S)vvWrU^Wp1tuIxqF?5cs;jF4~^Zhest0;Zbr`;mE>~yh?yv zmBHiF=_==?bwSS#@~3o_7#@`{g-5~JvY@$TL33|!I`hB$^zvir8NFx7sr>0(x~#W% zDIX~GqIW5pX0?sf%Uan_uamX)YFQ(5t<8FS+m}Kf)!t=);P+d~!HL@+&n;Wp+e>AT45%Z%_t!5E>0z^OQ_+l}wk z64X#igU~=D4L~bH9dyzF^w3KKFhDOILk0}eF&JeiB11X`6O7XLFw4*aQTiTMn56Gv zgGu@~>@Z7z|Aqq=>ECd|D*X#C*rk8LEkh3+(!bz^L;4Pxa7y372bc66{4xx{BmEOW z8HV7M{)sR$rEifX!)zHw;FG>Z4*b$L$dzFpg3>q0M^HM7C_>Uv6d)`eMWGCfkR|;C z#mJWaff5;(A|m|*Wyq1fMmh4OuTg=h^ff9GmA*oM6$+%UP>n+AE7Zua7Ddt#jF4d+ zilrl{N2zoK4JehqL?g20jTQt55nD8rkuOnM79<9z8Y+#y+=}JWo48Gex8oA&O{|yU9r%^>2JXbA(i`}l4DZ4UX+JjLGHE}4FT+3Ja%n&A z#ud`*xJQQf;@8saxKDrI+voZj)ZZE*b8|?b3^QQigxVdg(N|6lUcoBvj_<{P<#Bb}ziv#tD)eqG3Z)r)nDFBQ>bH8ZH4w{1V1RM*n z-N)hze2;*z87~s~~9~K*lwlVWz zG7~DIdW?=m0E6T-IHTgX9sP$6iH8m$7V8)LiOF1RGS`-tkRHO6%5W%>f5Re`6;al|6H8*35C0ja3z6D<+O3<0>qknbx(=4NmHve>u^**1EyUtc{kW zv^%cLzokO7thH>gFw0}~E1Zh2$Rys+M?0d2JNi4se(`9>(W8gO{`7gYgNO4D%h{tx zj}4&@rOtK~7mEX&VxXQMq6}r+a71Yd=^)34hYws%q_Wa7l&iL+hOE5&M5d~$++nw= z*sxsc@?e;ivw->ce?GU{_s1Z0m`twV69MWJ%`Oty#If7Vclh0I{~v;B-u{Z_`d``jWHj7Lm*pD<2v-e}v+Gxi^ADDYvzn>?Wqc zw>%M7n31A^x68sVt)4I0?4T;aLRWyn9oJ(wg|0&M)7!lBU`XiupIj% zU2)-sp!i7okbSD)JD7^e#w}*54eyY?29u8V6{_<_YNW4`D;-6S^iSBOf5ImH^AT@` zCPSS;cSzqsf0VxN%giX`SL91y$HRFFZ-zf3WL~89dCe#yISNB4oDpm=7c?l$3WdSl zfFynCk{D`2`>9u-|UaeQ@e-%m=37N9u2w2>45>;l$Q79D0 zN!S>S6OStxClP%?97VJsE(g4c9DdHv&(DuuhMM$2YK9+8v)bY|lh5LcS$!r)%*27+ z=QGDbN$LA|+-HvESiPoLj@2W^a;z?6EXV4|h=n=GvDyu>FbB-)Gsl?Etcw+D&AOPK z=Q6FXe;~if;kd&Uj2W#CKflT!qgv6_=-`0-#JUTA?RH`lRkAvZM7U^()m)`H>~@D; zRT0UFk&w_u|49)&`q*1M>6C%p_NIOxl9E#{d_WFAB!K2Ddwi{F!% ze^VU9b$-1#&@UeCN31^9&$Ygz7UDpIxwhCz#BYx7IjK-uf)06`2EVXsj4rL(C4Be&EQiJHbeb&=p=6rUWilGn{1;6R0_-h?0#Q=E znYKmS;$oh`lr4m`9*?ylq|hm_oy>$5f5ihYmB;$ai}^d2lzO(qF8wuL;K`~OW4tKi zs+_BGugbeG_rAQH`mOmIgIQ~@)Ys$-dEtCt)SBbV4ePBs&M>ae%>DL%n+NPdt~xj0 z>>M>UD#M}9egDyP-zpv_hoFIu7(mF(ts0G1?@p3`ZRPKTon$6-pk(G&^#`Vgf9#P4 zx)_CUkeToi19Wr|3djvZf+~J{l*{SSez701{{C3KIB-bpC+VIA?^zO!mX@GtdED#I zGCS?rfru^WjKdN(#figjjT3X0HBQn(ciCmBVW_F8K@aJPwpRz!mf04p%&Kmrl@*b2 zNU2h)QlnCpvf4_e3aSBmrPE?|e;(UU@O94=|HBub`+!TS(TgU>g6&;*ei)f~{@~j? zrUd!eExY97FBZ?Akh}1{OFNt@twSui=Ztq(jp*uKI{5zYLGYCHp+FQ0)DY8_g*608 z>FaoTSy`oNMAq1>aoJ5Z=Rvt5cva2K!i|-;)ZANnU(I&Q4#$g@7p;38fA3lT;y7&i zw?is6@$0r(L!PV(Q&ReC-0R7z$Wt42(OeTN4*J|qD8gR2e1Y6Zfh$R7ZV3d;1xa$< zmPkW+Mv`2&&D@|2H&i8wA+EJGFt4|kxknW5AO?8pWsmAywdD$>;qVT!GBp;6#RylN zhYp=4er&ES9xwJE?FS!_e}O~h+Twnbxt1$YSrE*QT2o4udMhfkvMp9YkzEmv6N|zY zCs~z|II#-mI3N$pWj`Dw8m;N*sXqeT$fZ;RzxCcv+Iyc@*oXKPHK#p zW$8uVBo}^KWORt4b^XS5Pj@}i;d8rOV|s49{gUbH3Ph96k53`v zAW6UO%gpq0NwC96e`faCZ7fNzh#QF_V_s&aA4VU6kN9@ba}gvn<2n#RTp>ZQ>3_e2 zyap%9IzAjd;|IR&=;2<>K)rYfVtqf)d{HmZ0hc#63=M+4*LF{ZMKw zE$Jb_N>Xkb@_U9dY4ucYGKC3a1Fw_UH;v{F%V-%6KF8sme+7fn$?PtcbL=JFcZ1&y z=_oRr9vBFM60`K7;8rLQMhST!t}hB%vnoQqs4wV??2x|Y+xFubl|r4mNoZA16=tZF z*-7cITRd46fpi*@({M#rQraKaa{l&3eOYQlQu;8yLJ$PCRj{ffLPVW!8DVL)%(R?s zS#G(;a%I*|f6KP4cXjWYKQ~x(M4?s%lo6LPE07)R4$KWM4=&H`EnZTxCA2gDP5p=3 zkM-sm>aZ~=n#=)<)o=6JGaW9`X$T?9pwHGtw4|h%78MA&>O566U*S+@7_v%{r1x$s zY+y{|Ns_+k2nbSO28aLC`3AY~T>f`Uafnv7;6Q|b*m1639X`Ee4k zgp%Z;xD63)Rvg(`x$68li7E=?Bxv;W8Xd_tf0vfR>PE`tP)2Yo51Z9tPm5(Zq*9WFr`_9q)xIbGxaje!rdY{_H!hh{L%(KC2v%#hT(K~cDJ(x)7 zJe}5L6t#k=*X)1iP;YW@btS8KjSQ(AcGHf9lD*Q0jIcQ{ zfBfL9l*Tp2KD$oc2c>x@vBL#{*th9)E|+)FcH%>N`YNVOU5q=r;Bj}8Rl)+Mm*1kgPnAWI^t-snmSxnr+?m1zGnrr} zMsu+_W@cuWH$9Q==;)~zzpY2{_7(3W^6%j5 zd``l@V3-aF?ZP^Ek%KaFR{Zfz`42{)(LSwvORKm(e^vC(!20aFq7P>)FV0$#-5Xt2 zc)j*|>*}oQv(;0@ZgGWniMYhH#Jt3!8W$KJ9Gle|y(&XdW~>X02#&~(<<~`9e~hPy zYE7{#;0=1RJ^7yEurWWXUM@bC^=vU49T=N^e&DLWs*;-n_Xf5F)CFp<-4z8g?NqIZ z5|XJd31qNvZbn%kCo?Z%&xxpgnZDApGP|1E)!}TT-mfp#$Mh5Qv-OMhDt(e%5zi~k zhDkJ0qiL;aw`rg0py`N7X>wQOf8_cIAc7tNfvbGna%XZ#=6lkSiVj(UbDlKU7S|8d z^YNEiGVM^FtgvNG;L9p7TeUh%B$}OXEi5G2+HfH$Fy|E_OBX35IPU9QhMo@6)6>(@ z(b17@3J)7Im26~>t9eVXth!2;=AbE9R+TchL4qDWlvKR)>3grZXyUzHe*m{}Lz8Z~EE>sAZC>}WL;XjGFC zQFjI-5%&mB#8~PtEiR3f3Z<^vtA`E3`2N$xZ^sV|@a~Tdg%eU*SDp-}e3@F=mqBYn zcY13gYtoFi?eI#6`%G5skPahLI=szpcX*xlv}4&$I(pF2Lxvp7f3zCSkyRx>Z8j^) z%c|0Ti|oea6tT+63UgI?8GAb=DJBP1Oj~+W*R*(KRF0R3TNge!(PT5*qm%b8n0dyS zGp;SW@{_Cg3H~}hB!Bn2ot`Np+oS%%(`JuuyYaEX&(D}`vzr{nvpT|_F%RA_{lQC! zyurN<5Q>F$s3hjNe|xrnv2ulynRFRZvpG{2^7<>o;Y=^nD3j9eEk<9Ar||-#E2f-A zX{N^Nc0?_fOm{^Q?@(GAt*p!}$|>a5j^;-rk<3DWk}QnZyD5q2!dVe_B_i2AKZjIYoy%RDg_-uTK^gVH%zDl04jQ~f9#7EsKW4hZvwjWEDPj>V`u+i z`g`d8e~SAx_vl|xzMxiLLDwj*Q?JxtYq{2T6J4)RS1YU4<(hi^2(jE;ZXe-P=hLXZ zSj;wO+l!rbRP~r~m)K|Sv-H^#_Fc{$F7-y^!{WW>KUnUz-DBV6e88oiZkc57aNZ@} zY`M{Xhx0aDBjr@c3e6$M zrsacMh7R;}bTrLs+h*5#O)+y)`gV)g6cdxucU#QPn4O1LGOV7M-D%H^IXTcIrGs0H ze=c728BY~S>CNM1otc;a%u`J|weZwnirM&esq|<(Lodc`0fV{G;xm{VNmBZBi^UZ) zq*KaM(H7IEQzxGx8%&l)l3}tm>O(yD(@`oOs6q#^Qe`*gYl}PhzT3DlE3Pxgvf>(JEGw=v#(2l1*F*mIV#>oLH8rH?$KqOkk~fix zmt?0shj5T2Qo=jvIiV5BryJiprL1-0h-riWBKnTITOYW5@C|ZsaOugC{L;0PF3+xU zTc(_TVdLE2$v+VQgeQb`h?0xre>p0soFzEbIWF3nxlY`d`7h_cqS`;| zLWZ1swrWhHrgFC0#xr^=@8S$mEVqfG)t0HZ*+cmpw4u{iW&yR#$k)SoAXAxZ}7}V=^6hzJUDo0A36P*d?5vSnfW>4p!kz(6y+b$ck zB}wBJ$w3@D$Q7{DeOn4z7CMvU%qyef(T_WhcJMWi{tg~_2uobOggB9EzkOV!^Vs_ZTMSKZT|DE*oqg z>986MRtKqdS_~N$$M4BiN^;o-r`3>Qagv%;8W$QhHoe}aNx@@w_Sx_ zcHfH`M@wy5;v)Hk-EO+cO)oB5RkXh7fs6->o-Tc(^rKRBZYW6~j=QsqgW1`kU?|s| zX>sIL1yPkpSh-$PP?aPH<1@%LxzLsenNAZ#fmpDlfEDD`>GiqRJH%k7idPsA2n6E> zd(0Rl#lcu`LU4BQf3D!B;I80-pgQQTaa>;#RPy@8%Da@iln0c8(p8fX zmS+PbnzFD%fq>$U{#bvk{-``DNKIGe`Rb3O%dH7l+B@9^mGm7dq$8-5j=&`y-C|Z3 zsnfnGI(pKMtaZ|iww>@vM_`e5^O~Lx(h;mo$31yuKRvr2e+o~hoSyV7lttt^o0W$F zs#)8k`+obt!M8?SGhyY*Ihz9-(V@+ld&k7P`j+rO(bILm9{cFL(=Iq~(ayQcZ@+Ev zMUNQ8Yg*2#)jG{4tSa=mHUahb~FxZi@spfgnkex$%7F1(-^s%M2Qo z2b5Il&JRz4K47!PjhdLzy4ZTa%B-%uGk!CCIQSqO8d9pUSiMU; zYrAEd?VRkha=vvdlx~-3bLWY9=4|&WalLqpfAePdy|#N@dV4rxHW^)3k392pc^!P# zXVT#sQ!r1Z+af5ve{clDx{Nw?`vyN*>)-9Ces_U27~zAwAwrB1e`IZhMO@K6!^XLX zMCB=9N6+}9sRf4qSpT8)1n|VsNoMeJDS5*0c6d%%`Ppyp-alrd z)nST`I)|`lU*vyp*E|zia8+{+mSCF z?h9CR_^NJ1`eaL3o#i^NqsZ}iw5*TP3o(u%R<;adWr3zt%(@TGdv*EpS9{;Te?=}Y zdHd#D-hTU*o8J~b`F;`CEq{D&`N0b=JaEx-RIEt&3l{gQH61teTR1s+hcy-fBU>oseanz4g^4mDKqF$2|<%iKgC_Qf&V`$L6UqF zcZ33Uq;7+iEVk~lzG6LK6|Amc{zJo9bbNn5AAtT;aCj(4bdr+kvs;x(>Bv@()$gN8 z>F{w?Pda)?&~E=xupz~nP|19&5(=@pKUBRx=bdqY&!8g|0q!o{^PRM4?lDr=geOXUMgJ5Rw4)G#1}7Zu`aRF z_k*uz9}XVM{yum#OLT$0yQz9w&F`JH(;ls}lap?rrggQ_{l&XJi| zqfn?dAqro#)EN*R0h3A0fAHN{8VqQoLEIQosq3hcC`oQ+fCRK!QL{ml&@iKBf@Zd6 zljaqTLgTJ13a$*V4Q~i1!osfbE8&CTBVi%zs>ts;sY7Ls=AqVsdd|}Qu|r(!V?(jG z+8;6Uu%6xtk8~7n>1bcRx-2Pu*XL6sDIM)AP?zu|PhZZFh4$j4fArb#<@}U&C6&jQ zS*)rI8a}b2Rb5rdIh|Hkn9IwCvp2gerJu8$OJmCKZC$xUt2)!V8AZk1bYa>%;H zX!TpEb(Yg=bvQ$&ykglX7tAUtC@3xo<%!yqPBIX~ERDgS)r7>9kEP3=mG-e}%6K_k zSzKCKSymdVA%Q$^P{_;8HJQX32r5yl)&yJ!oWz-=cgJ-je-I3m?kahugq9@9=UZw| z=^D~ZasWsU1EtlH>(?%o#UQp>ts#R_uW3^#LVCN` zb+gSD^0KFClHBx&S832|L3WbaV4&n+JVOu^0ow#Cf3dnUC#^UUFcJskQL2x9+yA40 z_KCnY=^(anrR6{3Lg@~mYcE+r#_@I!IOX}|xNm$Ow_jm;=bgbx$G$$^((T;d@_FM< zK(Gp*z=@7{#T;9&?Ft(+YV>WQ7}8L+qK%M{+U&I5Y%+zM(5ST_0h1_B5O;}8bh(DV zy}ZHWf9K!&XW#gSli&Ai{=P%zXxJct@PBI-cCnQhP4naR#%g0tMy+v#vEJBVj2oMb zEgEw~U!~vb=_?R&NEM+|y>nD^yh~L}y^1PTnYTsN;+?8el&Gs4Wa&FFf{Ym5IATOY zW2o9@XaZ`QdzjU;Xg}sVVRA5TwaGw1|hFk?vnC$&=on6n>?&dy8Eb{vRuWv=#{D<~dzj zy`a!#=LtD}qENcD4nN6N5c9Hc1NoTb@AWUZ~QA4hdSHGcrLrwQ6fA^^A z-ReGNpPKckR;uV+)tTxuJ#4+_UM0QQzlCh2%+xR9xB;rI>TzXn(B#e`9(6&+L%Z<5j3t zYNeVgy$ZLVc+{CGTa+)`q9JDM^IJ($`s-$oHN{>%^0Ht@M+dQ`xMvvq47W$WV2-A@ z{ieNhLd{H>A3l(GhFrer^ox3iTcb3utY~k}^Q|5`@Z||>)P8Z(l>=Y>e~3Xqaf5U~ zsAnsogM*BT*O={s-RiKj=gITBH|Tqczo_2ODbGEi6zk(4K8rXzI3{3`cCSa+mTIoA{v}qbDr~?u1=B3afNs6CqqH-<3~H;@qi(pfB4L)e}1t4&wB>HAm%-P zCYGrmY}oJt|B_9+2agcbF23dW$dkYO>w!D(ICy|ZV+Jpkr8gU;q%a;U)f#Jaw8q-X z!bxN*?J%54x@oua9K%v_asGKlx~G)8weP6j(Y%}UPU*+WkF;tRD_|F^*09^yLriJ+ z$|CD3&UCrFnIU`1e@f}h&z)qFMuv*h)`%GLij8$PZ=Kz4%P0=&w0S{tqo9JnE?XH1 z8r4MYE-yevz-P>ykU2YZai);zDjOcq;Szd0M&4g9JN!T8@BeZAF0iGYJ~=S+vm$j;e5UoGe`S}v);l=x_y=oVl0|Cq zurSS?uitvx{{6T8c0ZeQ+ss)@Upa5vp!DdVlFJj1p$m2LmWu^9ys~fY4f|e6?GqJd zunQ0+wz&0@3{s$(pgr5X+#^;i55q~~agEjKv{^%* zXf~&qkb7EIe{ODeRw$~=u*!cBu230>1=b8vo0VOMs8SmfgM!Ld=Lyw$y&kPmbwou~ z?m}1tS;p|haB6aPB&-a(3I=|2LV2Dhe$0c}^5z$Lo994%dIdgZ-D`hgXYEOaUsRZA zO_{`rLA;;?q&bEJrK88)ep6ly*gQqx}gA;tSeT#j}=N?@; zC0v(h3&y!dwHsZrc>Cf!lILn^QZZ#j8`PbVe~ugR8JWC2v19yE673fUQn6IN(}IsN z{|U!{DZOXZQG48lljCl+=G2C_n(9&JfH&Kc?P#?5QRk`klj=aNpO{D4{IJKIemI2P18wK^#s zf8G+Z*LzRQ+4(+>o(|a)tC0@JH3oaE&T6p7YPfcGindstRkX#LxjJsP>cv>IRcDNO z`F)Hondnh&gsdD4Q^)8aKeaK0Z>i&FdY7FwwbN|qXG25V?Q$YnkyLn|UBV|iPC2ev zGx_T4POBSTa@D5huGud?`|Jv}&A?TGf7#^--?sRk4U;AhK6}ln`)_=hMKj%Q|5~5h z?yAqJsf||F=X#A6XZVsa=lrodWX*8$QEi-VZ0f-sR58+G#FbbGwbpSEHs?Q792TsX7%%qgI!T2r5)SenuVc-E80eiZ1eV^xi{l2fF-!hfOz`wf5P5NJ2VL! zlJ(Dp=U)Ck3zX?*@N?9-SN`znxuzvijlO-~w-0j-y2z9t^f`Wh@NQxsKZoj22y5Px%q-OJ3%R;EA(|9#=e+O2q^zTxTqU6cgM)IWHj>Lv-CY_0^!yjS5{ukVaB7_ud zt#uR$Q4>jFlbTSfh$OY>$wy|W#%6dP6$bAieQ*_#!PS_tWCf`Dn#a%fX2*w@!}`-R zr!PMheunwOi~INd_7vNO8!Y5}>Ia?A9p+578Q*#Ez%Qe>5l2Axf54~zBF@ht7mkGO zQ*er$R(VUbvKAHDj!f49`-PWb$DqZFMpnR0?z{Fl3`@aK@h4 z|7xnj0a!%Q2vIZ_e<4fNG*#790!XC3w%}JP*cW+U%p_f3>%xIBt8#ur36wJmuPng< zq(UZ?LIPXKJb97)o+QY5ID=}i32bCUrRCX$>#Vj+g#B=XgY+}f) zd;y`v0e%j3xZ~l8s!}B!nN}WBxC+e$s?H4DwyTuiV9o(ABxI)o6*ZfUmN;(YLBAN!)}6W{hNzr4-& z{F?9j(-~H>cKvt)rF~7tj@^*(^_){K*-s)p34bH2VEb9 zld>=`a6W|z9!4E9Kp^x#gODyvpe|fSxJt8hn=a2JZTQDh8dC#6f;YLCT$qF zH%kIVf7FXJil~s8&fO*nfDWA5sqxu%ZFn1v8EQe+{!NtDE6S|D~ELm#f#Pr92817=4ry zk=N+m8eHsuFQrRy+s4lR8&OU!=_y!%Po>!%noHaOC9x2vmf>=PpVHkN7bXwtIBzG$+_hG$;mrLM&7m8 ze`OT0)5sD49SkzRfta{@$y81-D-f-*nn(K_aj_P@q z>u9d)D1=xDG(=Pcp6jSY0hBfclA*X;f2nAGxr}|0qqtl1$G7E5iFiQYbaYml)_qJqfc5`1>03~S^0 z|Kav_w}+Q_b#`v7O{h1<-m&b{y|ldRUc>OAH_e`iKVmw zuX?_}r<<(vRFTCqL35*UBvSZa{^9u3-}tTnH}4Hc zJkCUA@K^l$sV6~OEL7vcSfu$$H2h|E|ig%*vKAB^@M(>RQ8xd^X|^Oq66(6=s0$VI=9 z4;LB6^uZ=v4Dkr2XsHx3s6%yef6Zl_v5(O}vKiBvt7fPYFiInZc(}GO#-uEuSd1yn z`P)ke8CB-EmI^lX-RZ~_j!&%CeDV2Kl=CscZN-GcA6KRr6?-w$x~Rmp3PUU^nyJ84 zib`=x+oX#Md;;ne)rt{;ibWMDMRP6 z`3u6}&o{rz+3!y?De)$VU!Rczi2GxA-SQMNFnhl6WE8ehZ`LddI5D zOA`rt$W+2xA+-V{v>Xh~#d9?BwG7?mgCVvc5#)%mTzV{97L!r7Oqj>4No^R4 zF=JxyHi>7HZDR%HV2rJ3btPgbQm&h}G03(#x?0wRiaS5)tuu+KS7reG8DJ&+ZD>(^ zSYUm8{9vejs+(1Fs(=Y}@_GK!35^L%e`kp&Fr9N?ubs)8aW`=QN8n=P`Ae6tEr02v z2)@W=7TlJL_vYhV6Tl(5%7E{5?b;lzDUmQZ|_IT40r>z90pZm5COROA&EPS_|BVgc&Qn zE!Y@?i^i4)kFl&Wh+JwN1a9@bIy}=8@bG>tg}_)ns}HmC^gmDlD+NF;uPFdsy&eKQ zfPx6H%L*FKP&NU==~WZ4qDay7f4Y9IMH28SLs6tiratz)C?e}0M$A|gDU$n_3Wya& ziWUjtUKJ@)PRIkRB1Os$d8>*PDNy9TRYi&xGO#>V^J5vS7AuRCRTuI5pe|z1^SX$= zcdLuo2%#=wGl9B@&3P+~7rz>HTJ8k8S-JBo{rmq?xih{lCd;`0ih}3czU!^`*OzkE`j1vTgZzmPKp+OB*w8O@H-P%wXoGf4_R`md9)BSMQd; z%uUk*n7w37mh*0D#P&3K$uR%uZJMjhO;Z=^lVvWMOP}rXF>^`P_ube#8B_t-a+g$n z-;GU#LC()KoHSKU<NGNv<>PWWie?OmzbtPf;l0n;hvnbEtlk6qK57|pn zRZemtyE3TlyE6E*F97$4_*!v%pD!!-q4|CcpM&qm!0Fn43@425$8ZYzLU|;%FR6FF z_}Y7CpfA%$R{M&66AEAW@5197GM1br*pT4@>01t5a(#CKe+s$nV{mow{SK}-zB2+< z%r{ZEHu`Q0SKFfMEPFCo#c@xD835SdVI~4Lg0yEFGTiX^#*%5Da685{W%Anr_Nug% z>+{VRZXRtj1{zY>Bx5!g_R^SfhFv#c$6@R13Is2cK zvwvqz@_v^GfAo%0kclouu+HWu|9&bOzz-c@9CpJf*M~8EZK}T6>W>Rg~*q=Im7~ zrUvvPR02KeMM((?#gLHv(+yOw7hz61Ksgx`CW`8IDXdhv_VM zf8fPh<`L0jU%p0IRX|&`X;c;CIgK^lDgr;)4;f*qDn^Mwz^W=#$42VP>>jMW&XcMt znIrJ7s`3(TT&}9-ZGb#fH3tRdrmErKU`*vJx3$ACr2&Fi)etq5*D5BfMcO30s&OMw zfvPr;_xGEkRJE49phDGYRugER?>lr2f32#%vOAGA8h0nUzQfbZF09vX1_Z`urpBjX z1_|a1h6^ZTCJqQ_rVvOCMiZD~))km%Mi|%(<{AXT3_A#pIRFr`=_<hefjRocVE8yfAZaz z@4kHZ-;eKpxoT*6ANQ@{K5euiTnfDmjFeVlgp2vx6mZP#o zERxPU- zKv4t}BMAy6Y4F^o>EP15Tpxc?NNQXH7P*p$1@7}-DE>UN2J6Lnvm0xO5iAT$#SD?p z87vkM$84LE&@3R(8f+zS#jGlD&x|kd8O$_Dgc)>@95ehNV-T@`e>9piaiKMr1JVu7 z3ADi67$}RmJ5VcdjG%z#LP1e8SF|wQ@OFEgnQpke_T{xNuYGy#%WGd=`|{d<7hd~S zq9MKBo>W3OTjztnAlE>iYsfUWlZ3go;+whPfUkf3{v5;WtxPq3sT@P46|HoOR{9pL z^e53ue;TdyC(%lOe-f?qr_oA(60LOg7Y!w>t7l2Hg)3csP)Dil;;ZtMWR>o&UhOX5 z*46(>OZ25NUEO5spjmzT)41tipN=_KbxRT6(+{N=P*x>m(Gc3D)Fg!t;8pdwGw&^VVsCwDsgIKf2qXz;-wN}pI1tp&sZsOiSSB^ zOO97cT*k0c;?n4q5|>)9l$dy9p~SVo3ni{BUMO+3+A1ZcfKVwhMdeBf?Rkf{I?L-K zhs%#&e*E&|mmk0U_~pkhKmPaX$6sb5ULO@vSyQBK8)PCXWFp?!65$7CzdsxC`Vfin z#j+8@f1;Qudr-1&4NYnvm7MaCRjLEUV@%H?8G-LZ83CvHHipNT)Y5OFA!w!1FrO7; zQs;rvCg5W@Bk+AZBj9~N6JvT7(FjZ_f&vND>fpUerf33=-f3Tk6k`%+TtIsTyN_uE zq>{tf41&Ow_Zxxj5b!>%QSc$I5qLD`j@Y269nm-5mc=@#ZN~01}w%}c~Ii$mG7yfV4Fl*%{`V|u5 zkCEgcYXSHlBcLFFwE})#K!&(t03laqAyHwfkFsso+P6-S_{PeZx-n?*uec3VgmPBh{kNE!iVPaBO+r~Tifw>jX{%`W! z*y+RVRT!o9gAF9gd<)MCwM6F>aas|-@a8Yb>(S}o@Sb@htsGF?*oY5sw$vqhOt-0; zQ`59~ZLl!kZP&ow1%eR4Z(8-{4P!3``3ZT*LPDiT$* zk2UD^JCqXxZ!Os3l%JzmSC-gslrh{dF@6;|ZS(XKee2n#8iTSWULUEBoU%H1{)(Kk z>vld-iLsxLdzwm7yrTs$CX2E)V=J?cHKBi6MjD{MBr3T?W%pEwzNPZN+TTv#yiIZt zCG{#zYhQMf5l>m)i4}>l)#k|+{btVB>5r9QtDgFy^jZ62Rz9vJvt^z5Uf0A^lG7EOXON&*Qsb} zw!wP}_}oRBoCQ_@CLUz}n}5}GP@a|n-i1@NMOuhA8 zUy0(f7rX$tdytX&;aqINa1$s$BX>C!s_;mp#6-MxIu1Sl>dcrK@}SR@y=6WTw$iCu z*rmTtw~Tb@1g1L(s84G-KW|MlGkaxR-ua!yc;1@9v=TTO_l4sYFX3M+uvsLe{u&6F ztij|UfEl zYd_rnrJsJlcfLRV*-|+7JXI8;|HbdTI`d(x0E~wh*JUb?ip`=#1EArw*{7T4POp6hIp{K+q@*7}JU4lxE-nYz9z zTH))JsPX(6ub|4rjHaWfExIY0!U4D{mYOsu_6pa$lrZ&LI@mWca;0ydoxhUFVE_u% z^j60VHDPqM;#jwO$8dF0JLkcXxbcSZ1_V2{R9sg^s4O^zQDjp?5=&)Bjo+GC86ohp zS|I+2)&((_{_GP*7+u(XBybP3{V4gD{_tVY{E^!~8L)lTsiu0-NR!692tqKn`e0s- zK^(0WM6ut(&Pr*nR*#wF`&0h4HXopGFlx@{ij%BP`74^SQVR{3%_>yN_SG0?ACmEQ zq#tXP?`2+RTIUy43KM$l_;@Z2KhodAY$^*zXjJikLwk(cW~qmZ->m_mvfaH13y>og z(NLdC9wEBHc3%Y*B7QoRo+_EJAoRhr6Zg@xvrozXk(x5(lqMilj%$9EV~hJV`(hoz zYwT?=Zksu8CS@DpgJm~8o+C&t&bbsJ9MM^yBVZlzGUb+zZ3J?fC`2W^7Z+P5$mzkr zU$Dyt9c5Nmb6*lU$Nds{F=3)AVX;rNrcQu=|4oKhEP2^jf$lQmfy^@|k22r6|4Sas zoZ74LURHCn-E+2mZ-si(folt(b-b8bHAjtM4K7pAVn|xfimwxJ6eG6Q3)@e5>1ivT zV^iy@ch;lT-IwMat1V~IZcI}l11gA2{G69E(k&>54d$nY%DHZ6Q0N;qR(78*-m<4w zV=s?L@9dibXQu2^>35{4BTIU-hTa!4)inlcD5e`lpAYCOLSGe@((?cyROkt+ZAp|S zH85o%^x_WKAcI0V#eXV5WCtU$--aj<<~=G;7Bo6K2q-0B~jXErC*;`M? zciD>exjAJz5*&43*kZX%q9=eCUT&B;s$AZ+-z1!(B;WdDP_1z{oOW~gWG?T+D-&P{ z9Z?YU}5}6WbpwL@bJ5o72FAr@o0ugh9y=3X|H7 zdS0*g@<))Gqd_O;^c{SB(xm`*bP_>`39ahmzd)2EG(b=e3W@db-}`iAp>!A6J}0QL zu&R!9uc?>)Bw|PnM3d#e@$!Bivt^s#5`RF%a}ri{mP+wC1l_^+Rr+=;*APz**L~UB zKM}O=^nI`YM}73g=MqvD3j#?`1xNHdG*TC%-U@yBkX5;;sTc%fke6~2G&&8=5a;0l zYUGa4BN-s*<=0&27h9V%^b(c(eZY<`iP?hmrE-Shu`Rn6(emGBvfZBN&BcuX=WPNm zuW{}sP2r_~=ujOXN*3Elp>LSYm5y{<;+d-Ho+h||$~82KmQ*W$CsE}6t+wBq!h?PK zmoXv0m9U)1l>Q7!5Aj+%*vS3=OK>!l+g|LrcK*7tL|T;sk<2k z>>GXhO;O|BFf-f2P0rqY0D6i^1p?AOOl{#3WW;sIzwN@2x-W21Z zo0g%CKl7-S#iR;xVP$gS^|^LM?>cQtcms>9fGCbo==nr93M`{AepmhGL!b%TGP*1* zkfH1QEd~WS!L7Q@wae5jFbL5+5FS}$_>Hc30OPi5_lru1lS7|gwFLH(8CHi2d=`KO zJ5WKATdNR*ofQR9;xAvd1ou+kPqyy`1pUrnub~_MnTg5g&IY1vU&WQdLHr`xMvgA8c|6JIj4w+u3x{7qQ)P5H-TCbAL znA}~?#W4G9KWMo~+~k1oJH&iG#0jiS`gFkTFy zjvO~lds2;&=gBGTeN~)<=MHY>-I4D%|5m`+@t{wp(ON^OU%XX-> zf12=M+h0MRkwL3<-rXD%kJhSoq;jJsWM7d)kt-n}X!bOs;%0=RV(l*;gD@gexGQ7- ziLQR(>?$82xZB0r2tIO!$WPY0DLqg%jivDdYl6Lj1qd;&{HCF37~@o+u_BJJ?wKAm z9E}8ComeIYY{3Uqq5;5c1EjP}VoH*pp1l4^+^5X>*G|n2wGKOn?*TuegJdZ3$1Gqn z<%uYr6S-}uHiv2nAQ#F;l!@$AB5voR7gvJ$>x~y)J_TJ!V;RUd59Dsd8*`CdHSI>GiX zis|cr6@Zxg!%=l(+x+MtXrG*lk__j zUTW<2bxv1m%>7ctEOXs*-HL9kO$AF$$?#ZEu+1o!3SjYFX_-bbj|aV77;7;eA3yV| z2blz-%2+}luW{os2w4-Ml4KENNi!uX$28^@mXa@%I>!P34#aP$Zzw4>ejDjYSdO91?ShLL$5ZOAl5< zDdsX1P{18D-^iX0pF1l`m4)HwIU08|L21ly;$AsAlcyDxOA(m2sE~j8c~^dy;~~RW zSgAd&VfdS?s<&zjT|C~M0aHyn!~?ga7#iyOxF3LVNBMU&2h{bE{it{#e@3l-jfN}u zC#xNvd)Lli>}Fg{Ph4muhGtB7_ z#8bdH>e3aK$~d~JAp{Ui;8(JKl7Di30QdJq@b}C%CE<$FO+BLc!PmE7WO>VZA%!6h z9@Au}GWYTc%%w_z6*(~BnR@pLozp@q7i?^ zWy>%U4HsFY#F@f@Qo8qU;TeZK+YDFI{SpBo`Lx@k>=y8EE0T9lXhMC@XBjC_G}0vs znz>@5X*-0LTt=iNLql7GK0neoVsm*=ddbJ13LE9%_mpwe^gi#jVT37d&8kM=Pvj1S zS=*MXZFTL+m<0*X%u01mX-;v?qO5W{HE=~vB}b}iNqW2tAQ4$+R_0ND`xjF(LNS1X zHm`fs$eMp;^UP{#+Nu$i-h?P^oZ^M^AN{|S_q-l)*c0;RgwQWwL(5*b*7;%uRVunD zb93|2Q6n5b|Fa15)`S2+HK5wMI^b?N8Nl;=I8I1SOky0{Q?yYfAZ>)p{}Xl`#`2e2 z&rO({Oaomjo%#rJ5@T^n8*6mJ6&~PWU+Zk(pH70+RFJ|fIaTZ~kJQzdtr7c`kO)@{ zCQ*K@@}ojD`<;GL0}Rjzlg<@t?UzCFdJ|T$Ho_xv{1{Pq@^%Vr=DnkdZU-T!0c2Jk zqTh8GqbmVplwlU%qR82=q}9TN_h(na42#yUSctTQLj_lg0-;71g{`Pv_#Xf}R(fS@ z@?Y4ZRo4`I$_!Y%zA%k~SI7fGpM(4ZZwH`nkEV0kJ1bnZ2JciBQzphS!O2uu*O%>AM?L`Riw4p1yqJ_%=9pFpj@%{)T_;qPo;j#ldFfP7 z9(n&7#9yh@Ornv-SaEj}>|QQ*=n?Fq?dH?IB}qde{i($&16{iF{8iIl;2S93RK?C~ zaUDMFc+l%jIEw@=x7l^v1rmE5@7o!0x&{&t(AMS=Qj|o)p(s{Vt%w2&IiCVNO|z?7 zm~sv)!J2UF-iFfFZMI(ShK?Pe)xF0s*=e=qBo+hpL8&?u(Ku8Lt>sWou~>6T0KvxD z$}axK+h!!Z{95;QZtYC`@U-dD+<;|9_wILXM;>tFV1;#Xpz(?t$bWFP;>5w-@UI*! ziqn>V2zgh4*X?SBk`h2)Pwk&jFSEiXXpLJLaguNwT$6!!^-9q7@}~M5Wf5Gt&w7r{ zJHWTBu^c^({l}YUpk>;0YW0Aie)T|b;4g$4P0x{veAeZ5=QeUlPx9$k92lAQ+Wg zE4$L=q1KUX%s6zJjdqct4?GGmLGqf*?CG(Txou3`rAh{|aW&_q{W9G5CLC?-s(KOONOuISb zSXEYS1Ab0FZg_XyE3tbsr!%nA1UyE%B(u3sXKP*{YZFC zdzR6ZY`i-OO!sXk;8~}g1L-$c_iVgEkHD=wxv3S>kka&niblQ61V_m1++}pCX{stA zG#ulfrtz+2=<49{i5uFV3y%qIT;16*+z6GP5sDY}x=+cQkhWGvkWGn>yo$X2!V5v# zeHzc(%l$O(Y8$&8-gFA7Ysry|k~`uV68OCp?SkD!VF?27Wp1<1$W@ZJe7vzEYxJU# zEK$8S4YyWPw#eMRgK=BD)3s?;MdTpdX|E;lBOoj@BBNCK;nl$O@aGk;08_*$__4iB zjc;wRc(dC_tz&W(T{XokzVi1Mo6hzAWbW1o+fI4`?))-ef|FVn$H!)#wZZDm%k0Cf zr5>MKj&$?2!-r`?v=Ttnq^XcdtJQQpI5T75+Tbj8)Hmx{vX zE`W@CW{Wf#|A@(M%ls<=_l!MJLFiJmvg7J6ai^TkuF)@JWN9}#MB|XiM14qX=1R8^ ziwN&`f^0x$HA*zn0eNyLG9`W@>3R;aBG=M#k_1$W5Hnke=+d$M4fHgr=DD_an#WL_ zRxEjPs=P+*6bLd_-|MZK%w_)vRP1ih9ss)q29o?uja7<V`Ri(M2OzP6 zKpMF*W#0wy?@w{wcmoUiQ5I34KwFCWm~{M&_Ydg%{+c(!z#l2Sg(5%*x76N3RE$py zhmkU?8Y=*HPa!dWCJ_CRT0|43%p1)nNb;eNizM$ z&jJ08jX`~D7_3v<1&E=C>PDwe-QJ}$D1Ji@2!7Z%1ADjORi%hO#TP7_{BeU@HjBGK zuEn_X^`O7pfw`lDbuB93Hmz|(&2A9ojr^>9@VAGhz>fYX=`_y!uWb^~j4eBA;MSFB z#R+FuL?-pE0Th?^8!RWxJ1&F5uCR62k{hZE)H@}ElCCH~C$OyRXD9S#cp&)O8|t=d zU6aHFti$TSS(>CJl)a7dkC#}FZ z*lR=Z@(;Le^}x6Y=m4l~?eHsh2i5Sa@&e&eEik7*xPHp=Ra-%CU(G}n+&&jr^9qs?NWAw;I*#=wiJl!Oi4%U-<+6S32~eVJR3$y{r3YwSnXlo z_Dy0nA)rnA88ffn3#|P^3n;o#)fIYlr4FVPU_M4{Gk&Ht8iJf)zLpm?9tio|(+d=L zMg9x!iH%6bzD6KYHR`Jh?g`JQWj28m*3KKPg9Zc;CeZpzU$}yO-e3~wXLrB7iTNNq zBfMY@OppY|I>AmT=v5^Zh*(JEiOj-bm$PPra-BY&ic~ z-V(t49-N*c_=MD}_Fw|_nkx82Z>06G181a4#uKfb3MYhp=lny_2OWTYhZCMc?MhHb z-+3KYV7wR9h;O{hJ>ldZw@stGgWpvs@Dt;Qyw6wa>$FD1qNkchMDri|tI*J}sktBN z8F^R2eRmW;PsYE3l0RTGF5UpaC(vI(kY53x8wl~kQ6Zm#B_OHq&h6(3=2s9sRH-sn zhS4)Kiy#Gy;U{8b>DDuO(fE17`4wajRl1CzQ1=g|^aB?30Z2H3{OG>}Wz?c&)P7)R zIHCTpJQ16}e5B>RUz+>Y_T3r$Ji&k}J%U%5#mLC}AXfPJe`7;VJ^(PK!mog^6XuWJ z;X6Xa^F?)v;2;SV8nkz_FbUKoI6TT=uBd{4DIfRh@1{{ZkrD-AYIeT3DbTS)kW5gNqb?BCz4F!_~9i)w6C4j*t|d zR|C<|nkcc>W=8rn`m{o0l>sdxAPs&$3ss~Ps2hOaOs?%nv~J3^34(hq5+U+>c{n(Ng^qtvU~St#`9qr zD4lF$@zHLeRaMms>SNRVg8TroiGK$<88v4Z4%Yc3Q$qbDuTZcn)R25JMS51tzY`4+ zFSr`)Negow#ZlJ716#i7uX4%s(dI`vhJ-kZldi*LI*Mbg!*KQ?4-6p(?*%+i#W!+4 zpVpo!W&l>QUFx}2$F@SJwnG2rpqeuSxjY7DF3M^kb00)JvG7GAzZLxY7PK4ifEC}^ zDxvG#KeQDb(j6xDfMxNJMsunV*&qp74I(m~MOkn;YR{cf>TKwUT0 zP=f9!$&P+p)p%Dz%8rJ}MtIgx;LnaG;=-iUngw)S_07`iSrlG@H zod>{{E{+N`9bsu_>mnFZT2RjI*ALEA-|^g-SVyrg3ng+c_C#oa4u2}~SAui}6c~t* zu@c0vP%?*$qK1odhd+h;i#{}7mefzyl}jR&OHlIUg!}fqsdO0JLVE-f)!k-|I*6r@ z1AT-%dBz1R$?1F(JS2WU)|1C>i6^MMR0Cdgzx}Ba|I786(iNj;xg5&jnB_E$6-Or_ zUj2)UZTuH_%p8k>u{NSs!s_PI(*pX9&?( zQBpyuOd`ILg!4O8-_W{zq5-YlbtM#12LF)Y?4uKGQ_zWj&Mkys=;H|~3mWsyyg0xk zHSw_EvLLYsGP4I#YP%36Mh8O>4i>y01QPQ_WfP2~@q)|2#YCMEtP6Eq;QpUXZ4uJI&dw<{Gb)uzpg}FUcPsaUNF9>-hbyvD+7t%W# zG!zqdMa&@u2}VCBkC9dG=H%z3xeGr9^M!nQDemU(kBjhu(%iojjL6JAvQxHx{OaFdZhLD`^uZN~o6f%PA)O)8>I zF0xEQLiCA03)$xph@=QJOc0l*n`Jl+umHM|27kYqb`TAEK!%@4A;sK8*rJ5nGKZh& z{fAHJkU)z#rS>fUji6^y&^F633N=*?BsPqnJT7XB6+#Xd>i8bej1ka`7~qj9<19|> zC{27WLTpH8#`Iao3av#8`4&d%MhdNc;$Wc;nV~63;@k)!KH>n6pT{o%a9gBMG!toA zHj^axxdivQSZg9kaUH0*KBveJWIXTyAp#Y#i?UmO>yMq3BF-sh&nfEvk8eLNy#*>B z73q)J7ER7c5%-h5l;beS&q?vmNp%9L4w~nc^&V9)kXf`I5uNCiYeh6 zMslsia;*h(k(R{)W+d@*wQCCEW~8$d7i7|lehCG`kXHO+k|aNuAU_u?`XtwZGV60P z{6HEC&Ur+j40h44mfxSDfW?S>C!7`v2qGZHjM!GDk(KWAJm}@`8k5GKq9D34XNS zhH&t>q-)`*j?$4{Bor2*$Ix(d!*Fw2p`o#;hLNZMN2$n`|M3Q)#{!|p{+~RAVZ1*n zxkx&h2tQhZAsig;m$h&RN9iCh5)uoj&+))vIG`5PfBhmM9HoL<{zn@?9ScAm`+w4= z9R$4?Y~jlH6IT^RxI&BcgJL89hst~{b;fZ1<37=oMja9W5%>RK{@+wnQuF^vkk4lq z>OljT?qC5KW@;{9TqU65Q@ByI-wEZ4689ca$Cq3WL9BVt@-ll>aX(dAKNXqI-7@=~ zqN-o=+Wm^mQe53|N*(CP9ba`lczqI?$hp?SFcz8CqMVP_HssSy_|N+Un+bE9zaaun z!ph5P$_ryuWtl}t4WWb`e9xy%v>Zf=EQtZZPH2F;*I*;Ed#Hw(u$w5h4PwQcN8ihk<2=Z))KSo%pk6cw-gP&nl!v^m`0dT39$EJ-?8B%tKj^_QdXexU^TE?jHm78ZcM_8}tD z1SFo2hqCbympnb*wef$DGl=JCZrefb@q%J$C_M7#XpIhix)uqE6_7J{exVwdZdhx* zu2K|a_~*nt%WK;%Tq}b!Zm-<}PJMw1GSN+Sp1$XXGyZZU(*Hb zhf0*}10nLP=27Ht!v@-+$JWdURR-#^D{PSLhl=;L^0{bA+5F@J-VcD^hj6**7j?P2 zE<6Og&AenhI_u~UaL%CxEtCcXx08PuccU|Udp{e*wg-CIbkZ0S4xEpcQ!zuk`TI*^Exv`0bZAEBjn4`zR}W4mM79|Iyg? zX;aFk|Bh!WQpTdz-1U|S@3;D2yGJ11MKi~x?7EV;r~428wTHDdc7GR;is3mCPdoY3 z&Y`~xAci?x%eBYgLgKj*+W3LjpZ{;J=O6x@8P`1Desus7VD`b?rv)+ZoRtU*?3y>6 z%mc5~zps#Uha#~00i%2&48DG^s`nM<`8!RKYQ@1mcq*j-8rm!tf6i=CH08k&aTGj}qem9q2UVOjYJ{|sZ zvEBAgs1#dPr(C12>-Uh4v#@o)<$2nD+J&!#-Mlr4IMSgr^x|o>z~Gd&zwW*saDHDc zShXp;Tw}lc>(%6Y6;V$Q+3C`s#QQ5>*=pORI(+A1&r>s_tGzz+r8;Bj-^g`l(|d>A z5S<7Xh5$s}*1(YE)6JmrSLNF4(DKQXj(hy28sYQR9n5XK!|g1c+P%vvTNd3JHT!tA zuc;m>qIFt?ma%IdcqcTXSzaUHiY?tz^Hg?edh5)d@*G>d8i{hZ<|IHgg8YKZIfK+E7&(~!w2Q5yHX zF+3TT3wej1s5N!e9$5B{jz+FVI6QiSZ?uMIbz4`S4*2_KY>u6woR@>#rj&`x% z;z}oqfQRMg^J(Bi|Dd)DEK~x7S}h#}06(w+mdjFwtAtmaw#BkV-hpBKutim0f|oBb z2P>8)#Lb^=?(d!JbvRVfcvrepk#Mna(l=d@>)|ByeuJzoXgWa4EcH~r#;t|lCKYm6 z)IPL2@GD&|mk=1250WZ~=_hU|(=X3MDv%b)3xi!y5kE0rf1I?~SJAjxD?URCpb&vp zi4^yvduz$9uC*L>YfFonHT^p^weBL5bxRqCj+UC)Qn}#(|F52RUvZiR7GM6dI^h%f z8OGTCr)2dG8xp`j<0(iCCD7_8x zCbQM^-2-OiU$FN%*zax|5DaPVfyCdTptN6%qH>CZ=d(=HUhEM_Sdi{#6`|M{8~Q!78m=eUm0cVA?HJa zS-M|}J=eK(x>z6+BeIeU~?z#nai?+BGv%AKqwJG*dKB?(D#-v<`m^$ZQ zo!J!0PK6>WlwU_1GkrtJF#wzQj%a(Wy37k%S(=IQ{P}(Pxz;%`Xc5Ah(=&lDI(09)+T}La^=6-#hw0 zxZ~{T)I4c1=|O4F+!b7uhI(84l4YR3=)q&Pt=8YIfU&W%Sx~$)r~n0-`Xzg$5i&nC zM!K6NWwq7wu76wGCvGub8>v}DL!ofpE+#hzDcyHsES4%unMuL1VZr@vk!)@27T?I? zhoJSkDZjYO_VKHsujW;||zB`?*&D40R&C&%8nFUO9zhtyBc7D?X3a_fd4Gf9DEW2WK` zW6$%|RicqX50IRsJ`+#)@i$ouBW5#~Q;?C9oSj{a`PV+kVX2uTn~|NDlRft|ZZ(BS zZk9|pYa!)(T+Ri&U0$JkA`+tyD*RXh_XNym0-~6|p1B=QYN?Qqfc-Xj`o4T8_8{p>Q0CJp<2v9t(45G5w)nY|fH2#d(u4VHg zK7>q$Gy+H3HoHwt?n_B^rw%#LGWQnt(Hq+OqNTa@P(&h+8sa|lsiSVC{T5RjJik(~ zbg{NfJN}}}%}Sm^tH1Aa+@0HUN8;`6C+FB$rolo{oGr$+nnu)YIZ6p7S$8t6>ZG3J z;*B#o`x%L>@2fvIA-I9#YI)~(6v1Y38mba5(2qC4(=|psaa=crV0ouJ1!puw{E zUvG4m>DED?F%z}CF6OIW^dRF*uPZ;LDx%DXy)2(wLNTYXQnRQ@+TKC8z``})+HHHM zc#~dX4yy@Iy-ol4N`I*FRJ0>>q^jk2BY3lz0eDytyV3iJ0Y5g%-N?!qZv#sFWjEO* zyQ)W)Cq&CBBcxonJt4zQ?!f#E=1tS(J(8fMWnMrn_#Vb@{ zWNkBfK6CzQVeL1rRXmSqDc{*4y;-+anYOn0&#toNc}(4dxA9q9+S0IP9PEPGkr8vG z3~0vx8Xov*!>(bI`0X6VO6K;0lGM%odzPQRH4%m#Ys~5B)UUxBxHuwY&G=76Avw^o zjq~Z4sk5r-G!-xBDwVCHT4g$gy?Qr=V(JAYZ5D;|0z}t~-Tb;-(u7ubEmwnaxgcb7&0gSEri zAMSVthT55IHFKG+gB!){S@ucF<|uCA(OB;kl#=Jlpr?mhbGOtK%jwG2*#vzX1DoEV zAITnNucWO)$0VRVtfWXGvyD2y@RQd@{iVwW+IB;ms&Us$hLyvZUA_Fw8-c_z17J1B zcs64u=fy{=TQ^m`j{U&xyAl~Z{~|fekrAJIvx{7U&D?o-{cgGFH%MpQ&+~Ih`N!h+ z#EbCX7>BQpj$Kg%FG)gd1|wK9%mCU?UskueB6JwD`M^a1OVr7ug7fdt0f@1T3Wdu6 z@ZJr0-D&qjF}Q;ne;QBqe4lvJ004Z~lDMtXDnA2DJG6{>tN!}kom9F(&z`>x5?ajf zj20j7l37Oqx1x2rw`ReK%ra z8?@shXJQpa(K(|Kp;@g3$-!S+HA!t3;V-D>GRh()b5oxbneNBqT`7-ej_W>k>Ut);2#gwO1XE{ zs?O2W*Jx(x_i0g7s9hyW0QpUMjbai#P$qfJsFa>L7H7kVLS)k3!BEp%>=f^17w?<+ zs9>z-RFG+bxuxw$?1=L}}?0EG0B~iWn2Zf?m`B#3-Cr9-4G5HSw3g^&ddTjwYtt zkk2;Vy{%?qU2!^TP>HEw*gipm=|<}iSxOc|El!>BaogYm5MthvIvZY2&8gOThw3XE zF^iG*EU*#Ywmj5g-sY;~9=N9_SJku9AH*v1F{Y9mF>||2V>LLGuTm(xVxFqkM9D^t zN6|(lb@b)#GjU-avH;6HP)Zk_IoI z{xal;oJzO@6tIgRDtBQF7xv<&jibz>u&kFB|gI7qaWQ zxY%QX(GW&K3ctQZwU;P-2o#;P8xfK zq*&V^MkmtQ6n?&$*ubwL%9@7yH@eSf!46kW<7anR5mgb`#xcf-lSe3)Esw1B6fA0? zUcr_F_{I(Q8lKf|O}~{MkTWLcB^>Mx`J?MY-)cGClSNOB%d#?H9X8PGPiyy^p$V|I zv_J8Rnj7cJ>$X=>7Dnt_44&G44&bnu<8hvyV0 z@d852mS5+G=RchViHXNr1ZUFsjUVcvXTsXK@pK52)YYDMhT6$*iTe!WXS4Fa^5c)T zHql%Wt*vNGYh>B6RJ@C5!L~pN#k%Jk_GcAVj7S+MrPU)_qvy5b$m?iQ4151jF>(XI zqfZF+)im5IlwlGnsSqiXXg*1W;DrIVrv6lvRaIt1?rOY4WnRJLIQ0XCwva3J0XW&g zT}$YL$|fWZ~O}TAY6IoqK7Emq-l&2ek`k8tQN0Eq|vAQJnR;PpdWOSddmjir1C zxYYYHiqMIdn(M;GKzW0OP-irlisb{rr8U2{KiW1cHk7Ruc39lPyJ?;yiP_A=vAU|u zDNGw*)RV@x)p!TOEP@BwExLbZFX@twmENHq+^LPRO4YRvf45}ZueQtq{E2N!b6sMa z(V{9#AJHjNQZ3Xm9J0J2F#8G|(PC4ZS{yR)oYHiK6jpae=H+S4O=eJHYv-Y+oXOCL&mBp4rRfoP8# zacvXk&74I+W(By{cT!<~Pf4)6WLum32d0wNZQqpX!S!p(rjGBXX=xj(79Dv|M$zOn z5O`2hms2g@ZOTd!QJru=)u1Pqo0Y%(oy3sDj*Xj!*=6=)_+Qph!GpoBk+CU6Ay^6kv9!!(X zQ_*GSRszxWI*e0qt(flVZ!mG)D5{hg*C@+%`lNyL?>XtZAt{NoJE+)-H<*G`g@7WF z3TDzj4DQOR1;0t`3vU$}PNE}jze)is5bGG30G{THC&|u@E}6vylXmT|5^1>PIIX{v zsUB(7DN}&zl!XO|{Q12Wa-_9TuSi8QA=`c}&Y!cEu45P)#MzT~60=8*wDz@v)=ak# zwYj`%wv`0D?D^MVNaH>&t>}`_W%@IuJ@9L?zo03WK0mZSQ+q}V?<(ZB{s;cn zzJ;dvm^>3MekLnxV$yQa)TXZRAYNATG zaBo3(<;^IIciCkog}q|m0%YU!qmQxb#vNKTtmh(T#o7fdQJ+eIBwW+_)`(F8U=IRjzEc;G=+Lp7iPK` zs4!)#eso4U*f4B(sjJoW$k9Pgk)u*_a=usRrX+N)cKr@!N@#xH*azo-{5e302Mg_udeO{A^r1 z#>g|9j~xv4Nsh+#9fx^y7l(QE=O!~)M#D)>rzFsDw~;|V(Nv5po+-c?lI)@M{`>`N z`=?ucKKamtmbw|1k{rX*8G-bP4Ip-eU>z-TIIaGr0p{lfHJ+GcMbiXTINngXN8%>g z3-`CeD9bp4KxH^6YU5bKSRx69#%#DrEyW3J^Tq=IGseA`Z@@R%%H&IUkA#Z~)OW=C zB>gp5{&%vnF{xFmvT>(X^3w(D8H-BBBOOZH2@+w@Pkt`3r#8jIqW*GRVn8~{M_?Yn zK&jMHF+I*L%OPg*U@Ac=&i%Nlv|}t0)c$o$g`VV>}$Sf%o#M zN=M2)74u3DmyZBc58wgw!crQ3s+<-P?UrH3(B6!VKPnMFT8!%b5oxwyB-x}q55X8c z_^!)*I$}+AkDJ}NcIWu21RycWVT=4>i3+nt2LIR90kUE#f6y6+o5J&q_}h4Mb$HW} z_&sisTh3q}XYR}1e8>jQ!IE*I($f9$i>JOPUhXs|=P4V8DXT6)nplj3ZR4HJ3!^?` zhnUm039++Yy}5t1c1VBns>;Ck@ zFL=YwD9M+3P5j18o2Y(qC9qSPWOxGG?UtlbMq< zzN);M+ek_O)d1HdP*-kjztu&Kit#;Gd&UqZ?;QAhp8b|PuXz5M>wnz0@iVgh&2J6* zKi;>fsdB^Qp-uD8TNPWaeUlyr-ClUr@0#Z3tS7mU9NSm2YkDIzw#OT zeBbxc0xgF_8Z{MiTrT@LtNzof@a(rWL5@$L|8DQcXHB;U{MXpYJUg-Tc`w@?v`3W4 z&XNl5{%CigIQU|JG)b0g<_7JT`ycb~^E1C(Q|form-@ZL&*yf(FA!aU`2q!e*SDZR zn>x{#Hc6;azSpbMX|=9c`L2laqn!oCK@l#g5Uy;knH%hP?RLHBVy>YkZ@ahO%e?%! zbZ)8l??JAD)^XJv%ur=~Suv@gAhsygn+v&imCu=U?rxud>5JBpQE%@^uQ(No*)4}h zOni@?D;nR=Bf`|~E%$P!wY?C*nBqAK%WPT2B}FAvU1kgBkix8B4k=Bam_tf313AdD zi#E^+0?LVGU-cr8FWS`_OCs)rJO3!J^tyl`8{05Lt zazr7KJ%I9_Txm`T0VWiJnX}9(p|ZrX>=mZvi8q?APkhp{pZqHOQ=*R}IbQ!)P*@zct6jpPB7{k)#Yl=31F@dXCE;*UFt)(`CM^ zyGt)8%Sq8gG&x0mMtk?2U923hBhd-Yns|DG+nqICCML5vLNAu}AXb26Ct55#Sb%IR zkezKwBxVz!v!n-gL7PoWEoLoDg#x6)ruR)pO&X3*{Pj@}e=^exiT%Z;#>7x!U*eX; zXA_TqBr1uTKq5(W@YKW?9MJ>4;!+7#1ksN$REW^&J6&5RrFzr&_L*&juiH35YA9+g zb5!HUuF;d%8?JouhJsY?*u)E&<8MPid3zvEoWMrkglOgam0m*5K{B*2B;0N$gzN8d2Vp6Kv_hL>}wOPOFF}rBy_ebZHgA#8~Y6yW$N~o8A2Ez+jl# zT&;_#-?)htHLp~s;nH$8AdYYC<+#s|9XGQWJ!?Bb7+HMFAzpRnM^R(xPi9S*??R&0 z5mC~2S}1Wul#C~nJZ?vFj@vC1Gb!1Bnv|4mg~t;OTCGV*Rx_hi1TAK(#bQnbAv{=S zNwiuliSFb;4#`QPW(WTv@kEQ&lLQNrm?yE{O00)|{eMWQ`BGv#s%B zG54e;E=1(&w8V;9PB}VlG493#UHXnqHa=b&(RV){sFJg=}os*!hZ|c5uMC&Jrvl*qdga|3x@w3x^FC>bU4nI^q z`}j!u$%$>^jD6YkP}S(&T+H~HdW-U&bQgOFd6-D1$ffxzQdmG#Wyxi(vQU1=8}d!@ zuTHokL8o#gIquZHpnlo$min;zi!v>6`nQ3{hlVw4x;e2he_}Ss^?4*Oe_}A+qUSvr z$Z`Zt`X)V<_5FIPceeR|NTZMVe0f&cUmUb{Sxn9>O`g6#NPNYIOxz$b zjh{h}c=?gv+L7M1(Vo{UgFF3;Li$*b>tnmj`q(CgUTjkQpT@4Y^jQX21_WXBJj1t8 zUVma%Ev{3V59Cym@>SMgBMbuBx7UCew3Y z$(+gLnA~^BF#{o75dq~$2$2MgfD1wl=%TKmt{0%#^&B4B>D96;yOpL{SmX z74(bZs_|NM-Gxm5tey$iuKU~P_5Aa^o@cvfK2`OpPj^>W)#t350Rdpde{wJ^ns9bW z`7b`+J_;az1kg2g8KAoW?3#ViV*eu7Yt09gc} zdhXnwZtdeV3m|6z$ez1kfAKG0U6|Dju*8#$h023E2>|317#T0-P^7=&=_AFYz(=h|EcLCbx05GUQkqshAVBmc* zgZ&y~u^LKHh$uljz&_VL2LTie@{tT-GKfrl>OlbI!-IDL!X8N_e@z#T{u9j%8KeB> zf%`w)TQ$?z@V#22mMiYhnbghG51*PONveOW7LKYT05r$%z=S_-fKtQ8I?FXt_!b7K63C4kKmZs9!x8-SYhc{6S% z4<0{{(X-|As?^CIe-QE&3dIM?rOKtM+f{$(r@BEtf1Nrt4{09Ko|igx6Lb@FU+`0Z zHa`tlWHkQ&oyK}mD?VddXwEP{X}Qh1#-^6fbL_7>K6b`kH@a?gPxGwLJUh$g)p>Qk zE%Hm!^jllgqiBVIIDkC(AwZ1)LdZuUDp7-BXvAHI%e+*2-JS@UR_$Aiz9)TYr zjY`MJU#Z2V8( z`{xc}4^|6%e^8Wuhs*ghggtm$*n?jQdoV@VgQrfS-7f5bP1u9^KehX2eq9>RuYFC} zgIk0>==h1Q{-k$RVLG2Jf(D>o+?mc3*l}e#PmzJe={!RWmFc{25{&{*WTx{!*h%?cHi!l*rV>~8fs*LNyJS@Zo@S_^Vf2czx#>?e}Sd67ugdPk#?JoZG zef-G7c+A6WT!@9}!$O>g#mL85=)oK;!F+V%!k@YJVfaywQk0<Q8@V;<(C55=+OwkeZi(Wb_R z`eAjoHC2@rnQYr*S ze+dd(LZiC;@o-mM2#3auDdOc&w?7{4J_*qk_jmi_qfVuX`@3W^|EZL*Zh!o|(!n`>GHS4M_n{`MN8MnqC&Dkr)>^3fA?sM3b8?}YYsK*iV6{TgcfZejwT{!sH0`r z1`4&IsIVpO4vlPyyFw#*3*s!NrTg6Y#7S)}BRzpYdr@JWG|vvriX${4Zj8tzXqF!n zS2o90@?-q-_}gHme?#HU6{`{=W_3mM=Z4Php3xR(-R=Atrbyfo8X0$7a>#k2e^^u) zH#fIkdvdLZt!Q!1^Yh}071#RXYbUjxTpQr9z1>+Q+!g0{b^GJ)6>*%kG|=yM$F@ob z;coG-nA{c$#G{^2d-ur94OXl;e{1PRSIqA^wWg?WgJ?>1?1l_uI-@t7oas4UC+B2x zo@+hpc+V2vqR`lQtSj!H?T_QEwoshr)N;^MixsnLJpq2SlcK`b__>qXTIR(y&0Q$xs7>fI!8TBu8o_UXB;Qyg*JU$$cYO%N_kSB zn^37IwWTn`KPoPEjY+|FZ6NR;UX+l&;aADYiObT>j1P;PTCP8(d`k25D_HB~xDckT zlc%p(p*^K;RA^M!iWQ?m{!uHsR&*z%<+DP5F|=YU3$yTwMJ-)Je!)g&-m^6ZESGBq86lTvCkSMmdI(1_J3&)8G4-IZ{Gb>pW+#MHO>Br- z!0d!NgFU<0)sYBj+0RQ($Fsh8$g@m z7lxL~nH6!re@0s%5QxvtY+td$zrw#Fln^m{YFi4%g>am7a43J|8*ZpZD6`!YXy-yc zzI>K{M%#)RE2f76p+Gz-3jT=%ut{Re-I7>!Y%L!hv8+j;02@u z>F>wf1LF0`K}n)-bN49yO&yal8Mn)DG8vyraW3{@0dB@`Fqu@4SMe}nF#c4t4~&4c zp#itzV!VYZ(zlrWlc#Y%zD6PHFjq>#gk?yQU*Ud2L19EK-b4>p(*_n1z5qc1DP@n6 zD^Y|7OvW8>f8aIJh5|{825h8Rv;h>8v760Q7fPklcVwsVk~9myCk=GJ@Hk$<00|06 zUL~!R)=2mKWUU@yS%c3>Wzqsn#uRj62`>A|eqWB?Vh?GjjdX`}Jxpjr50>Ex>?RQb zLKn<93sdlG+=;Dt8n59Ud_o8@l034Uyh-*cFt{tZe@hxG&5{`PsWo3I*>;%&T(_X(p~I+;#k>)=5nrehXv#;y1*9>z;J zK-8p?3?nge4S9@SB(T92wLemscv*oD1#9dF}XBncxf5+PH_4Du^- zHMx=8e?}f8kCDg87gRytVT@fNydZp$+%IXRyQPQWfd`pCS&-ZZti>5vfIaw}QWfvO*dyEt8&?-bM(ys6``2q6OnI4YRNmS7AF|z#i%_6XC2#|JkhZOQ)R*GWlwREkT_ zNw3J`Ta8*YV+uO42z~O1ZN_#yk3;wiz9)nziI3!wF{G7DA$O9;$N_SUf~x7|^f4;2 zMz)&0B)Eh-lV>IuB=1aalq#k1AYf3yg-TRn7#c7I?dZdmxEc535j={Gcm@0M6>$wn$yCxty2xCzkSrp-gMFpy)HX5N3I-6ceZ>5{)F1nu{ zVqj;pHrC57Ww)|TY%lvv5QRdaR2VOG2}^}b6i_gwUH!^2$FT*2vj*=Td@fm>9GUz@ za%J+FuDpM zLeHaD(!1%SG)~{8@6zw--&vRyvT|0znphX>W!JLn*sbh0>;v|RKn0snCY&uSe-r+s zV2X1UcPQ23=kyKQKz>D!l0VQa@(lf+ zX0eHEB5kJipkzD7U;(VEHOhc8K&=o}UHl&OE?UH<31Ozk;-B~pbUM9;cHtrNB#zQC zg#xnYhe*kJAKVUe9lP2;oc@w>KKP_VGg;)6<6>4@&v49$+ zYlXuK%H9BkMnc)kWI7oj6RDj%L+a^`2$AVTBm)SMv8cnl7>})F8ft}uY!w|x-$xzh z<5uzvdxdVte7c?d9^auBNpc~XNbX@}xSaH2GU{+Xy$wOShz4;Prr@vSe@bG*+c-)d zCE4^m2+TldV;^lt1NIU#Ehd+v5(}`BtUw_dBs=j6y&2V{hdq7FHJC@qu>rDyjll+T zRCq~vi3&JMo}pQ!l&DDzAK`wi!4$lJ01M+`)IvcE!O)2=oBe~xX$MVgg$YA6~MSwf{?6Aq&Zb9hWfIafHKxRU4Do9u|x zE(MY^6&cA7a0%YU7`#tbVk5@jJz^*4kV%3>TLnp)ibv^s;RDG*^dx}SrBX6BxtTPO zY{^f0B^{ZBYj6&a6$&ebtA!=PWq@=Pm*N`Sg1hl7-ogX$A{TWye*=>-1G6v>MJPo% zs!)q2jKIir^lB=mqYLNaJY0ZY{1W%#F>F8#t(byyFbn75eDtCZ7voY~jw^93R^evc zfrs!qeT3e}0`xliJiUm{!+Us-{fWiMRO}P37nb2{WMdMsU><7F03TLimGma2BOe}O zB$Zgk=e_iWv|sw;f8c9)2oK>F+@c(TFO<#5!vyk!;3kS~m@MsNJNu_p#1d?0|1de( zn2}w+oToa2oc3!fqQgtrPApM<#f6Kof?q(Yyv5lbYX0{Rm z_}Dq=bY?oeiLFEdd~9_(y@9RlulE^;YuHKUq_1@Neseu z#@xh4Vl5kq12SeN8;NCXBwk}9!DLFpMzWEtnKiTFY&eW8_S5u6$`W0s5a4TI2PFq4(Vgg->nRF$V{e-*kC)|3v5^6+KH8CBH(kPoiComzFVEG#x z8p`FgqB@mkW~EZSyWBYZLY9wZEFbr=d@vYUe?CfBKBC7scNYIKcAcDV8hOPh@$xiREEOx-KYB=Ab+|gP6dAKee`m1?3W-C_(sGu%Bv- ze+jy>pA0h&kJ43`Kv(ffdIL)64T#bkxG15ViH$NWN#|Fggs#HS6*v7WtCm&WRCQm~`l=mOs_nF!cGE7}e-+chZU6VW ze#9``MB2$T81S?VN64^ThCvx-k!k$~Xr3e;2&f5sBzIHb3g0Jzgh2XzR|OJkf70)} zGF9qGCG{M+#a9}b<10*I!l@)X@RUH{!xZuuR3s8BRK28{sfwxURK=n`$oRO0Y@tR0h{EpVM+v1O8wa3eOM#^e$O$da?-nP00iMWo@N+u&PowkF8cvtPlN6m-rt_Xcx1ll6GIB#8FhtWR z(=?t+Gv`#AIWoP92)80Fz%9n zu8&{BtH*^#ZonliliN0266+b+KQ1<|CDc8#edFlvf_0}n?)ss}Z7Ase7dPwXH!I-J z8olmcRIlUJqxrMe@n@~$&l(*YEk8@1^%L7Rs4=3wc}6PTNOf9se{)-xC(u5^E-q@4 zXLEhPdAVnsz}NG2k@mPgG$L*YjgYH~h8GRzRRZLy3?83OS2-`Q4|ukbKc=h1(1^Gx zGy=|+c_UlqjqK}7Xa2)aA3qkK(|3-X%AdZ)OZxg2^MOJi`WB;kM%!?`ER}uq23cCK zlqE8k+N`gyeKF)wf9+cWe!s;WoVfk*+>*t8eWdT?X@I`d4?Z^{NPYX3pl=C@M8FA` zq$f@viI7Mi=>u%Bs9=SgV4%Q2c0wsJ@nEb z4A4u*kO6~q3`QA>$dHb~1fz5mW*J%_N=IRZNjeG}OwvDKe}`H62OO|S|9}%#>F;pC zF8v*D8G7K5{*FvIq#uz5r}QJda7jPHCqq9x(%%q}VGx8j92uMc|K~Oq^LWHCvD3W0@vZcSG1Ub@QQ7XeSgr&ct9J$hWs6c`A z9V!u#zC#rvf6}+8MxpdAYEUG7i&`1hp;-C`!(>>G66qT>piKG(jVP18Mia`VuMtIs z^fh9rkiNojR7ziA1gfO3&@97|sFnuMf*NT6qfjdiU^MEa0gOSN^d-h(nDiyapY%ikUb=`V?IlFMWz`oGE>RS(qSw zg4r@W7ZasV(1S_RA)F_}IXFu?gt;=Dhso0a;CxJx{s+I1;e1S$KE?t}lRm};GF*r@ z>0>NHf1C6XdeJU@gbUFjeS|)ANC&YPGo*u9f==lmE|THJI7d2wU!qGofTie`4&V~Z zk`CZf%$7dHWjI&*5Whl?^dT-skMw6O!+Fx5u^e-xKjR7+UWvKV2e?XxzsC8}2e=x) zkUqdQ_=WU7uEl)meO!kH()+j`3#9k30vAZ{e_^EzS7D*_9&W%Q>0R82Ug=%jgbSs2 zu^N5SySN#B(mS{Xi=}sPs|;_$66tN+j*FzXafb|lgI`K-<4!D<_Tw%Y-i^zo{a7Qz zd+;miE!>OCrMK`~8QzCw(mt%k71BQZPKLk7mC`=kkE^6N@qi2;#IL0{@sJGvfUBi9 zfAB|KBfWu#ajoI0e>v$B`ORwWG8Lq<$>2*Ag71Ca;$4Y50;#ei^#ReJn<3{N< zY{X5{YuF^i%~&nHiY+pH0yj&qB7s|^SFshhNPDmiw@Q3J$L-P{Jc-{(uiz=%DZPTH zahLQ8cF1ri?v{4r85ur{HPUW8hkK;mf7pe4rI+zMek;9<7jU2SGX8}7q?hm_)=Dqo zB^kbq-$^fFH-0a@h*xB|2Mg(k{G@$E98PK!$(Ddg(cQh<@og9Kc5De>oh) zCh0kRgw4{k_*jPjgDujtI3&YQ@PzaXK1D)$28U(%8MaD0@fU2DcH(mxet{>Yo%j+@ zN;@!sr=%VD3QtQr@U;xT!4BzZe2bmZ)A$b0NKfOhcvgA}M`ZXto|B%!57;F=g}-5! z^dx@7^U{;}J6@EY#6M(s6fa5Je{oEPgLqlmjwE(V+aSsCWSOp&WxDqNNtvGaUzz@2 znf_my{=Xs9@BFV!|F2B{KT4+m-(;tc{9lymt^bwj|5m2={#T~|*G~VpGJV_sQ8JzK zwOL_~g2!f57_~vEN)Y`fN}v#UhC!=TB#3?sW7MrtaoiRHmwLjb&d8bKf02gqgAHej zKQxRN2OAJ=7;NC*veF7uz?2g(1?C7i=4U&P#S}OSzpxXOd?9^IKUOGUf)5j7#{Ifa zbX2XOZXrRQh*=D9>+Fw`{AAw;7C z;s7z3>rCdlvQpAZm{J)Ee};2exT>`Z7vdL)qih8go{rf2CtwLfY9Mtdf)L zRFWkpTO3v6wm1xq4NATr%oA%=tR*AY#`4z|`PXKXj#hMxiFMROJ8GM1D#ui|R+_aP zCQXN_$s8-VqtYA;R+(e=VU^~Xv1+E7m=knjtZ003M^#Zrbxz0F?2d6&P1TiSD<_U4 z<0>tl4(n>?S|`oyf0$@pZCz_+)+S3r+8NUo+)*i7R$JCunB__OEzZEVWD@V^Bb|{i zI|n+&0r5!Zkt1J<1L^ZfClBX+DQAxyIW~kolsel{QX&p=iophch%%IMCnL&ANhdiz zJbd7C!&Oz5prV_WeGPMm{A|xk+FnuTB2-Da+IJQ1VBI#o|a7dYyvNZ6vRr$Z!Ngc@zP>=D3P*-TYql$u3ejP=*qSVg@fwX~ zZALaAg2I*gfATh>fRnhc=G@dde(*>G?@2@(q75c6MU^4NNUTbpc zf@EA0gcK!@(Pin@=4+_N?V>KXz+0>_D;;)Gp|mK*e`~e2Cf;5ne4ub=J+O_8A8PLp zyuF7S!~wavr?l2esY)piTursPs*>iWIMQJ^+v&1@+1hXWl2USAQ13En^)Hbz4?IZ5 zysX!noVs9g3vX>CxsSe1ilIS8%=s+dz(ITi0b2y}SNaUzFsghis(O;#2`v_otdy8I zGBmfe`)D*fFyqJ)za%2QzcfcV1z zqEXIK<~lCeOm(SVZC)CiPK(8`)8%m4T{f51rBG&ivOHdo&m$;v!+GKSa6wp5>hxN@ zMz7YZ^a>>l2Tj>A_$}@ji70boC=yCyBxDT4h{qL(k+8lnhGJS6lNSbv9HuWQC@6?r ze}UTcL26GvnrF1dY$mV86}5Uzj;M(PyVq-u1{2cJSj=mV=2|mN(Oj!XjOJQh#%Qk9 zkr54XkZZLYq9G2L)oYG2uUQu@(wcQqJI`fVT>*ZRFJlf@AZoNaeEce3lxjs&lY;~D zFV?4cv)hSHl;>J*ILt+eD6@&fZg<#Kf0g0faBeshq&Az??yx)T73JnC_SqFZcaOWO zIIG3zxT5Fo)+>v>BSrh<<^oq<-RK+EHbZ<~`G*0c?OGKUz z-qJ92*~NPrL#|Nr;LfcVzuFjdWs|^8zMy&tV4n#;!h;R{X0<0F{TMTvlu&Cte=*NQ z^F)uJF>a#|Lr>PkG@@Q_6ra|pDaRE33xn(yCp;k4I-XEM}+E zY;g#sQC?fOjx8iQGDuhQ2Re+c=Z0&m2c z>&*-4tvWtoT%VfwAz8Q`*SU?AEc z4jvK*NV;didzM5ZWu<6de;Uj5Wt*M$9DmpraK>N>nPSA@v&M)y+ZrQjrn};b)G*Z6 z)}oj6M%rrvX$!^{sLHNsqE(gQP*AB-riE&CN)srRDyRnO)lQ4qd2AoScfFH+k6(Jh zBQB*zFPa?lwszn9ak%56eaoL6Ut0d*kV;Jay3N+0C%e*=kUorMda^6?)ka+;&%{asUbhp9 zP$pbne_puIl^`7(fBk-QVS?PSG2B>@ksvp0Ha99mjnxTah-qz&EHkr?xrdc(BL-yB zE1uA~>M9gU!^W9rIy>6FlOz*9CUpDQQ zLeZo%Ij1eX`@UCZ(MKyc&-%^b8Kt6GbQ=4fSk$`uY|de1MaMa-8!D|DhnUwmWyh~4 z-vP>hi^|>>e-0xH0lXeFfWc3_0Y#QC)9y-;Pq$=cJ#9DI%n8yJGiPKxZSw~Lb11V? z%4opnPmqo$7!wo$ufdxj9sS5af_~SZm6gdk!44zo=(pQgf?gFf5=F+GtSldlUIH)i zZlf0fSWT~2V``F>x+P--kI?InRKQehgh4~H^o@l;_lg$QGVZ<06HkK%^iC>bVS zQgvyy0!q z5B%p1f3b`zpdR z2!h%wSk+-6tS+z&v$R?|EazL6TCTHPoxR<%Ir}}`d*&|;79CNjReojIWz6>H1bY0l z14{!-^ZH5_m2M1fFW9gDSo^8oJY5|!21JwDe{Zq+Y+ieo!zDTmL1Y{BIl8cxl$Oxq zLLpC`uZk2X9Lfwsb{P`%!OcaDjA=Xx@?p&GYqTnI8#M;!N6JPNhz0(F(gLC2DY^&c z$R^p)(}$i2HkM|P3|HB9QcJElZi;k{=K^l9bMO$N1JQv2&P<0=-j+lDrWh%w&>s*i zf1=T3G#i;xZ_pX2vQQ|95x*svAdkgt2y3%r$jQ!A7sN{;hfhiOGH`Ar(|P<42iuo7uGaU&WC9`I244<>aeHTG89xP$^0`P?73#| z(|=g-RCRN-bnRQ0O|Es?O$Kv*<8#R!f3EQT3m4tDwx@e~1GV&BaNvPE{(jBMb#MIk zx_S5Y1dT4ULu*ZLI2?F=%RTE?UG>=6H6VCXO0xaJVc4*IgNAYKq9k3h0;*Ip`m{!G zFwC*RYO}$n0ns~jHa(a~=p3EaWE8c6sMl>H9U%0Nn;aUK{mYZgzC+_>g&mbye`B!0 zmY4vtaniRw;{VjQw_0GYN1zU+1X*XX? zsk$h)rcd#yEvI_eQ?hF(PO3Q-f3R5-YwFMB-@%(E)DAn7e}A&Ld&ml59@ERMsOeW_ zlLY-S=CNfPbuM?7Fu_bFn2FI`Vvd@b*_D|NICOUQHi$nopk(~u54CIZ zj>#4ayN$z>^7IL=F!?w6CimU=7nJ`_U)Uksf&vtiEwMpr7! zRMAB9MEgwl%)*I9KNc7xC@3f_CX^Ow#RPpIW;fhqxX(Zj7>FU?WH5-PEUn2L%I8%X z;c!JkIGkUQ6)GsyFd3y(R>;#POGArX78zx?Pc_@^7IT)%Yzk&_)EFOp%YCbTY_E^_ z@;yFZrY9@tak~o(3cMb-f7Ro0n@uJ!EwWNtlpP9bHEIxV#8~Vrrp3h?S5aZuZ3(+w z)V+e^U+zHHZz@Dr7N# zZLu?Q?XPw@p+0Vbe%skwa%9)Zi2tRce6>n!XyD(Jo5xO56eO*l1LU*{#zKr;I`~en z95qP3z~OMx_oHm%{(;;*Tt@$iE0ndje&+j#T$|i8q)6E3e99bs_PAoXmd+l$m-_(A zqyxek!aCIAK^A#UN00Sf`@G^s);{|p=O%}?CbPP9oPAt%hohtF ze8=3Xt26H^(N>fh{hlBJQ)k#6HRb-0*JuDU>q46%=A0VcO2L~GsbK<*Xfnd;u0S~K z9_9%f%Y0=eWzjOB%vE>o($wIj1o)Za590?1xoC+Fg>O>Qf4eRnU2xQKFSD+!6s>XH z*{$*HNz>c5B2)UZ-(kS{&!fBA1^wn-vx1 z)yJb1TsjxCs;WwJbwxRQC&h6l2USd6d|UU_Sa?KkCJ{Hye{`bBX0}Jp+B2`?oH6HI zUw-xBYxfGie|kO)fAP7Up2@@8Bfg?DXO3#S^~vNH=ghR(O^%WoogvSdM{l0?=w(Fy zLBVqAfN-_24hX21kRl-@X!dOnqtBcFaONz6qv}#|je^_K8UWc;@q^P>UmnE`*ry*Qj z60Sb4s!Ff~ax$1FLFUE$R;z^;=OUP7G2iqLNkx=9B%n&XgmUDu}yI8NcCLh|-r(@Kr78bL2~(BTxE#bGAKb z4-JiCe{DPI?c~E~;^R|H)5GIPyB0&Enlfl@Hmkr#)Rbl(MauaQO1gH;ymrrx6R!Vi z)$Ua)u5X-XlY=Nc2a7j~J$E+?g7wK1&GsJUo0O%RFb@~=9OQbj!Y ze+@ov;sBR=13&9!|2zMibpEsNeTo_j(VI{6zYp@1%34imI%YprD#^->a{?f=3AZ4C z`LSA)E~Cn9&e8=u-YOu=!!*kGDb3PY-Hs}YCCg32I**&`)J6@_xI-Xbi`f-?aOp`Q z{!cp*ji$^1*+drykV;N5+{;RdDPT$oe+JWWTRn8j>yWo-vFxyR@fUdUMfs&Z8G0FV zrq}KACC@qSg(&7q2ZXu8IvC(0$70e;#^+ts{Hgs@=ikM@n~&I!xRiggzbn3L-fw@~ z`4{moW|doXn{9TxQ}~nlAI2Xn>|V|7`UmL4iib51=wDX8tX5w|S1E2#FV|mhf4Sav z8(pJN*C=b$6`BV9FtNg1VISsH7tn~lM9eYg*h`%CRQ05BhuClKxAfcM_8rb`F7-O& zf})dgUQlFGE9~xeURt=b)=66 z`@mz%%1{s{5f$Zjv#OHv@E+GVW?}AiUthmFxtmn&zW%H0r+oF)hNDFF;8S1GQGZN+ zw3f7!3}Pg0Ym*;8yoZcRf4=m==gGH83y=M71cVOZ7KBiQZ(>ftEqGL3_$(f?FUM2m zY4L20Xba4_3F)htxWxTyH_cTSsBd-O?xRCeCX$vi|5~b)*&=DFQYg!m5WG2NV|Fx~ zW@kG!YIS~&F_UDvONxlsB)W=!IHAJR>ua6kxnad^D!#`%X3UQ1f6USBn8p~*j_Hh1 z-ZAO5xBp!1@K952E$Ka7{G7(Ga?B|wP+l#2RRI!D38SQk!`@z*dp}$E{^;`7iNmHQ z|4#Is_qRTBW%4a@FuC|t$@I$gldjCEbz3H%{mZ7=zvcbDS~?(1Wy_I=YBDP}=@Hcf zzDJ5#Se4_e7ZzJCe|BHwS#G`BeT(&W_oJ${)(6~=muyx&nX$pT$-ULPJL5>1O-o#) zfUvtwx4G%1#Vd-}6hD&jXz}x9ZzfgIfa)CUQz=47t-K zodaC+ACZGpDW^|X^{2;ZTjQ>@Zr=fw^dl;zZ%`$D1DAAUqgh?7POEfu_NL7M>!j&z z+u@bIfkoQMe`|U>NoSxc9X;gn@wAUT6y!~b?6i%{!g8I>%AM&N*7n5S-#l{g?P1qV zSiXGL2ERshXftNtGx5IuMcg`mzW&!^pO|yz#TPEvK6~licP+eRi&4C;<-9tr(`?cj z-39l~9^5C#uzqh6C)A&H#@uN$`Pdgp2ZU+DVPqnYe`IekSom1!#1gA0TC71srk$59 zt`eKeWw!-0y(&g@{;Jz!;4SN=ISo;)0U5DpEoRW#b*5)U~C!~xeK=b^N{_3r}at#N&NFk+L>*N{?O zY4+&6f2n!r<~pIZ6~JcigMVj z2nBO(q0@Mk$f3v7fRTbb-%b!^@^70zxb^uHe_YCb``#_LyvM)7;lVdwNPhq9uH-i_ zJSYe6n`DLj;(dSq^L_XI`OiFpFC7qC*>V)%o6P~O&d3G(53xd>G5ROl2RZNN9`qdy ze3A2ct}5G>Yai(!pEEvpioY{wdhYqg^Ih|Du6OC}T&(w5tnHSmwqN9&m-~ZTp>(@M zf15jB%s1z_SBPuGJDj(>AGAH_(%VB}v&rbPdSt)HmFeIg{JkR( z(q+`E+t>QYYTr&D^|=eJfiNHBwP9im`@*ZkEbNNxI%%AHNkq1>JA20;NrmYLq63H0 zmh}nON8URC9&IAMojf2vwl>>u=ls?EXh) z?LNyUnjAg%zqmVjl<0Op!wi|6OP=<*9iGw4KmX1B`^HSPI!uufzaZ>SyNSH^c)4^y zc$ELk3JUPimazqM3n*74kH<2gAc_)Mmju;bCr62%5{Jj*bOgOxdoWMasZEgCe;e}x zdOK$ae=uP6La(!`_)q*CK8=4l|Njv}+=V%TN*^m2w{XewJyn#uxAiI`hHf4cDXrAuG$```|_yy%_V?|A2(J8pkRIDB*gmo0yI zap}Q}e|g}N7s-36nY{Lc57zRTOl6O-ge`{)e(a6S)7tN{(Q-P1o<(QV7w8L?mtF6f z-*bK7`5)&ezJJ&auFQhWN?Pk3=Q+bS!!zBt&@`zH^d^XhO*e}?E3OTWM3o#X*xeDPJHo#uM$)?4?v$-Vdgsj0%~GMU8k zX~gr=6GWN(>lG^>f9wYCMZ66N(}lyR#O_#5Og~YvTyd5Din6u(e*LD%vypuftwU|p z=wB4Ypr*1IWuz=Yg)Km^n5q>C5{tPB397U6g2?I24`cymzpJ>&f2q`{wZQ~g71LIu zkoeuN$y4+8n4!cLvn{giwFx#?)sn5`l~nk#bNmq=OllB6m3JC6a9d|k4n^0Ux^&Qa zvMbWOG?q~i@njZc7WxqJ;=uCI>d@LyJS6N0y%stc`X(fVT$Kggr%YB^ zT5vCLuz`zGP8}e;lMN7gBY6A;_xAprI3MZZ*|aT#C@DN^?c|$)bZ@k=GeNTT zwpaGtdfT2oApHN2g$2T4)RGHhMR&Q6`l&!{k)#c1c+po3dyd0`3DXXd~FALTZe|}~_$j{3&nZ#NMDp9M}_+1B_#F?P?$8^IG z@R#im!J*tYUN-{9+HBq1H_ zH@PbjiL}cMDY`uhl`_YpaQTQ^m6>8mzWm)9Hy>9XO6kaEzusp}SwHQBd$GhM2c}Ng zsK;41Wyh-i2|r{Roi*{+j#<~wILGI5`I29AfAw+BRZC_JFPT46_G9F!F;nJj;qc(m zX`@?inlSjcSV7QL?uxn2a?N%vcKzC= zvKYiRt2Jm)>NRZ&MNn_gblq;V1vA<6G(m3LlBqQ4wIJKcOfXP#FqR<*3cqcFl~`R_ zf0LG-2rr3)@+dT&1yCiu6X1cx-QC^Yb#aHq-QC^g;qLCT_~P!cxVytc7hjx*E^>VT zyPKpkolehG%}iC2>PddhB>}+YWm1l9G~8&o0YIx+H<#APn!g^2Buc@{}`uQ2~(QLE6Yjm)NbWfQ>mq&vsY;~ zS5l#qTj7dleCL9O3tn`&Ih$XA7ma5dCPf5KNBjeWkUV8zVj=y^8P9 zh@_8Bw%kwp%IFodv?kKuK=Am8D%)SxZm#ya;t{(hi7&t8E~hS+0~zy<9!?^B_<95t zhQ@M!93*nPjA1AW}73EdAh=~O?g*t0gtgSLsn3>{~|op6NzW6&T}{zV&({h7Ol^Po4_fdBWb(TtJ| zeS&Hq`In5GE7dF2rGG2$lYv}+HJAWe3md=OR!)4^@#jM2e5;%&HY9Y)ul-4&&}bii z&Cu-*Sl@3{I;2fmx^;ydFL@-%W-f~2QJST3Q;1g}<*4$@NF-#5E2~LF{8FKlR5vuL zrra7AeV(|;qGBMeyt}`fwoKJ5dFV#zh>ESIP|=jGmS4+QRK;17q><3q#V7+%pX?T z^*lCzyj5(toHM@CcyQKUjy~4GwG!R=Kg;ZNyB>u!vz!U(5R{!vHa#Z4?4+B)^a~fq zZ?ZV_`QB_TQNz+YW+1~N+4BM1os-xab(;+u^oTqk(S2l}umg;4tyc8-k66_26qn>fOU_-<9YL8`HYtgdJ9dqLqg9fOxp6~tX7zKiP;CW(QQaZZfFGjT z-8|KLrh&grmSl)Lpl4x^%SU+~kndj{)9j&O)gDt&nf?s}MOr&!++a{3U0eysvfQ9Ztl^;bI6vtj8Rkm+h`bZ?zB0({__` zdZG0Sv*tLnMy;t=<5<>W0bO%VHRaUNl%Q`P?mSKS)J!`6@=t{JD3u22O{g8QT(0r|vE_)FMwjQMw2Q-#qlw zXyf0f@TPy0KyC%g_9(!HhG+wGf#5AH(Kj1(g49{8mO=e88-khX;uHtd8<9MA$d$I33lF2IE7ewq=u-fX|F+r2PrzBTQ^;uVwWkl40-gwSG|8Y7D#*2RnMlw*nTn{KS78H z$tK?7e&x-h#9q?QSIXr&jXrdaf%CDlJUKcthoR^~tbPM%UBjmbYa7p?wr=n}MA5dY zu#r~UKNJ`TSe8rMsRxw&r1wIr`LH*$Hl;nv3&2o~&<_vgDL^f#3h!L*%IiVX*zrw< zH+8)0(N}x@{mxXY)xo%lC||j# z(QFB$!v@`*Oj&Opx=-$taw?8eT68qn*MuCUfU- z!EeXu#>-V0>^V*FlJ(h`v%At~>SHq;neqPku6UjJJm^|^*NisCC`}I_G+EV2^OQ`r z44X4;-pUcA(1doX2Rbe*HY?QUYxxDfQ?+KU85sfm0^UPc1FIiLUuT5*Wr-$G!lz8* zkJFwKrmA_QUc>A|E5Tsr8fxbd z7(E=l2))yPi8Z+S)C-*uhC3u$2@Dpr{|)-5T-(}cvRP;o%;%>jOt>T}?0nzg`+$u` zj0y!*@pA1B4UA=d;#$q8?W~+v3OEjyc_L(~>D}4dNoBof^JNf9r_MzBD(5FIKmYX~ z792bd6*>nE?AzNCW~}T{5PJoP*Vb>s{B=&X_jIAkgE*7q)geKS|0wshE91VGJ!2(Y z{9GH~7->_naCs|e%wIQCKAz40JK=q?&Or>|L2ikU{evE9=L1bB43$hv|6?HvJ-zz^g#m$(PO46NVC6TY^X<2dV zM1AVFAs1W;6!h@^*E4TUeq0uaqv)1$)%aU&Y7bcg!<*I~+H`0rFgzK)Y)SxteKSJK zzt2Qm&?J$cMmFL20%+uVePr6%=I-c1K@Fvigdt;%^V$HH0T)KjyCZ5x$Zcz-si{O= zD-k@tp&lHzsndYTh7f?T_N@Ej;(l+-G$S+Q0=xPw@UV@br>x`}o)h!FG{_NIh(JBb zi<`{Hd1chs6X-ao*%0%)^UMj*T?X$7Er@M6Ch+xq?UKhbc#DB@3B(+wY~N}+a$p6W zf1xXvq2K<*k2##UP*A315%BIoQ(3dSP@QOuwP00u6bMN>GEu|4^WiE$RVUh0qO{ox zLnPoeQq&jY68Lx_Mf~Z_-li#N!zo6HjsjuceBx8_Q4eRkyZy@kd}XpO)}rXAaTD7Dsq#!?{LOt zX}rvAQtc)Pp1f$bZvL7w`D*3r^S5h}LHYafpX;lz1 zIoU%*XIdR?lCPP!2dzC4`$Ze}j1{NdiVeo>@`^{gIo^^5_VJ2JAyVJhr~G^YX^24R z{GKgwa{9qK(0aYZXXM8Ew%rTLNliloX?vD!MtylxqWj;FisU6L?~B4U)7cOD zp&;6ao>l%Y+J?OydJY_dhqe7%Cv+qZV6kw4S^&>1FQ93fTju>`X-kWBEsimIfy_j`ivrMLh0Mp&i+ zm*{H^JPh_-M+eX6PY%0+8!kTK;9bxTHsfRfBen@@Om2a~r0Rum1WZ83 zO`Ed>@or#R8#(MWhh*CfAVR6=vWlmsVNb6=87_w4Jr=hZk1Fw(L2=mk9f$7|=ix+< zxESIxw;zWOAnx@zr>;E^IZ;BJM{Kc!xBr=DCGN3|fZI*Oqn@VVn3iR!GWiv$I;2if z7EyIW#ig+H!#0b$rfR^M>bWEMz#0yYhB7bdCNemz`{*DPd(E**T(uel5bCQ^=d=Eo zH^r~ZPyx7iyW)`pJh4oFZjfSpJxN`uaV^X&bCPH-9FVV$We>c*vZP9u-wIT+{WYq- z+34d|Yic&V#Wr)zyt@MT#$xrtAD$`72!oZ0x(ICp$R-ejg(M?`lnKg$qhy4qG*NSw ztr1ua(a>*TT3@Yg|~$tO}WjwWt{ZPxn3i}f(gA26jzwkwR=CLoalr3Kz?`rSk_@GV?xRWTcQfuuPdt- z@Wq4&e6R%}gL_+^jXtav8V1TE6%~M0Vq`op8eM+=dA|)}h5JE}=~eSr6rK}o77R6` zezWCb!BT_phX;DreJGXzQGN+WAK$kmVlWE^O?MCL$Z;I7PRJm$k@E+wzFOrsxZegy zNgCB%nVz7Q9enUg{O{f#W9dRUnTuE7WCX$f0&)^o4AcgREQ3CA_kQ_yt<@$T?zMy6 zj^7H|b^GpYKa`w(zfvLHfDH=8$Mi*&g@EZ~!gi@2Ol0~IA{K;G8{})$geFMK+rVHt z#tNI-_e>six6t?xERfeVT)pynzug?W5%nm#&`>2nPosMWAXlr>991~|w=UzwZ;sm~ z8Nkq&UGiLftVKGXHx>LR@{Hrh_uBPhT5uW5G&dq`srWBu5FJ+uuIm4G8Ta$~v z&jY>p%5t?Oyi8Q1N`_UezsQCC7&#A}cK{~)B&Q*!-L5CxM_dvaf6gk3PO35rk2ae| zo5nMi@_uu3bN$Q*vnj<@%&nS>>vbLh$&+h?ErTtZH*B!@6<)g4P}x1Qt$GB_n;(Pl z0LP0)}ck++W{ zuI9L(#|M$gvnb+moz2fC?sr3##A~-Ki-(5VmVvkdC))RpP{YbV#l8l7=p{!XHGc1ufzh@I5Ri;Qr zf1C(CV;WP~8W<-6%NP)n4t4~HX)B2C=2kgY#>Ruf@XOQ@O2K&qDAxhDTtq<7fX%QF z-kKH9tUtiWNTN0$uW>re$Y~}VYY>@!I*PBY5&@Am^n_AX+Xz}kSe(4u252WLo{Hi$ z?*j@4W8kvF)3sw-Pe=LP&G1$!p7h^Dls{=}Xr;(vSm87|&7iuB-!nWJ#9XT1}uNJ-J)ydBX zE7r99H5s9IZ$|6J)MS+80r)mVuaN(m@~wjorwvYz|EP2#7px&9(heuC3Bp=h2_dDZDbIPoG}=Kq#Zh|EmAA8M#C{bt!qUk-yYF=ZJyB=3y^g;;mT-Oy)s|M zXISW{Ne{0#!)`(sI`O^r7dm`?Kz!0PA%X|{pa}XDUVKSR8evKvOXo!Y7l_)KF+w9f z3g(OZ+xdc^H^U_B&^T+`>yH(#6hnl|7d(q6nG@TWhB!QqglCT#^>hIS`K$Xbq?p4Jna$t$D82Z0@zOnp0*>$&hCH>i>f;F5(=Ov&(cMgWyP zlTGe~1ETGYEA9*Brb-D&wbr6A*ONl!mVe^adJ}dxq6~Q#-cZJyr=p{is!e#EQn^!{ z{K4;(1g-$NuSBmD1HnJNhjCu2zoHKWf#N_Jpaf2M0Q|S6I*8l%l-?jw_Ejzh5OB#n4$;{o87W1ZB7hQ(R4A!96IN*zv1h4yv44-a-Lzb` zI@Nko0lU+mhK+2C*qt0r%JgZgvOIF_G60k6F-`>up&S=FO;aS_1~jb$di{7|e;A%U zDbL*mfg6O20X1*@A>Nod=NRj#1j-}@RT=mRN>$17BeIgK(jgmtTnOw67sQ}a!vSBjIlD&YI zIOg)HQwD`P;iR0l6}ezP0%?3{;7FOUm30~80&b@Ft~b@t!G`IBEC(A*omJ-v)Q z<2+Nm*+}M_W*oqmiM|*dt>U`sx7d=kE=y;s$mxorCK3zE8kN6T^V9qT-1nuw5y6aO zzGcVdZ_fZ@^jwI9seR1BYsp9s$N+Cy3Y5DvC_fTB_chtW47`K>@%h9WCSH>VLHNgj z!5WCdk27(8n{tNPju+V%z?DK4uJCxqh?v-|f*S&|o(*UnBDe}9l)#DR#2p1Ho^#QzD@oyd1cRG3&NfrE$M)%T@U}O5)VdgEMz-Qh1D}kpO|HpS#=l&MCyL}2o`PvR}9%HCux?fm2 zr{7@=!g18Q)2`{>C&{T)>^0r#b1*ruxMHGX$R+Cr%VpF~v2;IpKbZkZfP_!FPoh8$ zqu(_5w?IGOUm%zli5J1z%*+9VKKRK2J6}Pd;-{QQF`(3GiR_j3k^(^X-B+5Qbeo1t zE`3pgjtxCJFQy0AN6-~u?sw>y{2`-E$@{pN?KMZp&*6M5dUv$GwfJoj;c#W#Mo@xV z2BA#8l%kDupdc^? zoLif?ydJ~ukY=1L+#D&Ig5#D(HN1b1Wj$2LOyCBVSVcH4V7QS5__LsKRn>AkPQWu#YTq}V0aHK=Zi;b{tK{z{6+ts$}mZz$oP zKe2Vy5eZ4TRSz&^zMqHP&E@`2-LIO9a}wB`mFvZp==iI5#d7LNySB9)ORbg+y=66` z+(EywjQh(8Ck}nk!u6QL?9d1EZLxyxVKVcfn@ zmq4yrIXxEjAg`4uzj&07sa0*sp>5S)Ick})l?84+eDjnfHXwmovU4CogYwfL~0z+DGg;dOIMr= zIi4;GeOBLDCG^}#MM>O-|1!I~=f|2cQ!{s4a_8GAk!OwzQ&2*Sua>Q%=ICCKo##=e z*2%6nxvO?5_UX#@Sy@)PDal_>CY4inNLD5d9RWaO;c5+f?RjERke4Ne284@f2rB&H zYDxJ`E_oacsAsrdk-)1Th6VOGzjBgP>qN2cGmrhaBhDInr5hs7oNKwlMl(>)tZQ#_ z?u58=fz|Edl8h5i>tgS2x<3OMGD=azKwWy`oU~(z@ne*8sb;TZX0uc%n+`7pLKk7= ze1KBV{C}t6X~UaXSY#=8PCvVU-g2C5TFvULo7Qfl$F*KgAIJJHJjTgvl`2d)*y{_EufJn&RUg&DsrS9IFdlLFOH2a?^d(0Z$HB@X z=` z*{qAxM^PhrZ4hsxGH1V!Spy(Se23*L$iCC$M}YgDamJyRF3E(E282@LmO3R(Tf@gK zuE|KIfVdRm%E@$I;VnyLjL3+p7PZEWIWefuuE)i4KwjFot%HmKa0H8GEXgyKMA?gU zyh&8~A*m`jHH&nIqMO;fIb*=&%2c9gQ>9emqrW&1gVspYvV|t}lVx*1VqMSF6vV?pbmy!(ub4~wnI9o| zm1!R#zUs1o0R?s0Lckt6WT`SM!cP#KCC6rv?U@;;X$*+%m~}G@|BPbVq6M#YQ93J< z|4e+^${oC1o@CNa=S;lCwEPR@FiiD@a)50v6)|J8lpULo*jQxKkAXhJ-CUr3hZCJn z{s=?nlm!f;OJ$nYfx!6}7z2Wsr7}$lK*AYjeIQ{?)-H4=z@mzNgytD7vz0p*ww!b$ zerzdPjY$hZY#AD;NYNLi*E(}&NEfo~sR5a2v0FQlYO#AgsO+m4KgBvt`-oy#pn6Bk z#odmx_yRz{PkjL(xJuTH%Rn&tu~VfYMTrZ6`poa(YbNRLkh>-z-WGLM=W2j3DOmtYM zd?)rYZU#~J{YQv!p(*j&w>?v|ALCji1J0ZZb!hU3`7O}&2LHp|4h}p+0w!L|^beun zzLV8u21b(XL!WuAM-!BWu7?wpg?fYW$im#30f3af359!_XC7~udZlZ(q>ib9v5_|h zXYJm&?ehI26mh~a*Rn(Zp%sR_;}#0dazXfk!2+dgH@qdvdrD_Ku=~tsJh;a0s9R;b z#yoBE^`|)L&#@fkADKszzRlDO22tSi=-d} z_H-`N0^?5_M+ZVdXEEs_;k-lvK zG46~tFLFEwEr{&%o#7D;&4hUZpi}agyIu#eu6lKM`ITQ{X;TK-=7fzsV>JV zz912ib2oN2BvLNlHzWHGuxv;Y{%Fv}VLZoUj-JE?2CtP?-0(;#n`-;QR{(ChT5ycm zU%d#^9uFAals04QZw1a|{X=<5X5&JVANkiI8g_4}LH{StKXK z8Tk;%HsWjrajAk;p&nq8WjMqdKtBYk`Wyj$n!bKsvjyDrX9XfJX&^4OenKpHApS3Z z+9`bYw<>+ku?a<*_#zL1;1HMG@XAlv73Ti2lz-wZea4>scL%Vg!cUPwkk-ep>FaL@ zc@HY(y(2hyAM$?f0Srj*5a@!Ud>YsSkN&__p+OA769C+D!>D=t9i)I68@x6zoS~8! z8BISu-X3L3;d?^fy~7dZ#UbUz0cGAEB`v9I^0o`yNX9uoGXx8cC<@Mi5;FwxCC+m~ zb5bqaE;BO(vaca{=R7>5H&ojlJmCq}ou4)k4;2<@rzyaor{T-B+>j zJ0O(wAD}=gNg(v3bBT96e-!SDvt<$WY2}K~Emr07q%Y!k08;Wl{CMEn>3*M-$POE~DdMz?tyg&ev#|%d7vS7}yN&JFiPFGSzF3ezIP?`}Tfu|K zKz;~1xtHq?jJd^pLdJU9x{PXf^uRQkccARFWc0S3m2m;F5A1RsAc%hFSq1r_KGi|5|v3W6d_H=W3u-^#h(YZ3(`w@2y zh`%Kndsbu%G>fZ`zQtk_78yMm_11{f8to7njWz3`9nEJeAo{b4+s^v&vIk6YSm^|w zkixna7DfJpdwcQFvaSq?Rc6RhHL1n?j zat`Mkzm&VtX!ntnME=8l2aYlBCbGZ-Hbw*D41i;>E+l4A|8QYC6JfZd>{`dSgT$_& z$9s~y!39Hr$RKBd`MJyA+>S8bdo}WVp1&tAzmv6pBX9o}4@9N~zhZ^FVx>)RjdTtX zpzJ@NBntUW6p}6wCU%7?afOPB^TK;2xtXA(-BGyMHlP&S&L2x45kw&IjRzJPAl=F1 z65^M7^gs=HrKsJ>qcYwLm;6=t*co#{faz3{&-!;{96xQi?(nzev^ur}U%La}yAvO> z6Q7&8BFH!@H>3oJ`I3+82;T$5jIt6B0b+uj)r$7cd3p33oCEnu${L(g`FQ?dVWw25j)rY>g_XhYu2W0MwjxoysipB*x%Hr+DN(;}=%_`^OwWD!IjDL-byOr(x~ zum}?yqtgT$u<>9U%j+Cjfo4vxGwn(_qtiCtPdTMK92}$??XY0Ai?INZRFyM@=3}c@ zxZR?5cx!ihW4hj=c6xKV-om=xp6(wk0Jy)l7(N?V{SmkN6FECda(LiHgBx#})yIBH zyU|%l{M*I%d!BSHcaxfnzNpvTm`_)#!0bXkh_`Hxp-@XDmc7Vc%afs<9t&IJ`%2xp zrh^6@1m|zAdFX_8OPyvwEuUs$s}h+x95mv zE_iS{F}Nt15JWODpIxG;FQm})igKbcf!pOzX;jlXGHRxZGpoRTeSV!gQlXF%5G*hD z?BXJYJJynAnNvwpA5wB3QbM01iAgbp5F$hRSg-=ZnMo9g75@xiasy)B9xx{^b|O>Q z9ozyjIfIyd`B1b^uVDgwKE2doxV~vNaGbgAe^`erpRhnOQ+Uw05t## zJwUQx=@cCD3>-B7ZCwh*_$v|u#3g8@*<(x6D7Av-6<^{NKLo@@{Yl@psC6qCpiy9P z2JSug3c*##le^#_+_}!r@W0sif6w5Tm(nXMGK&k2 zj0W!Ni?n`*IEq1S$H8X+pbQe>yTGyBDd@F7uv%cST5z!3nf{aAvFJ~2)#m|Rl||d% z{3Tl@w2DINB%pc`u@r(c>24Mo_RDhj%5wKD;CtMKdfdPDxKs3ewLJco_uDVC`=1)C z$DOOk9jT`V!m#TrqZ|6-^)P;-WqiW+qEonINS#{7HM~im`o_&8;T99H4c?Iy3*i>` z;uhQePp)Pa(=r2u)eXQ-eU-mq4WiL}@uajr0^Iqym&O{hg^`g1-05DeXot4WkC<-hncF)g%+?PDvmq@#8V7jsk9J^q*-2rS}HU$5xfNi%xZMR@;D=72i z$2xAtIr5`?$pQump0Bjni(~7?Ix(J`(Vm;(p5+z!Z6*283rYg>v!IqGNvmL6woMy? z&FlitF0jiMsLK|t%dac*V?8(ZnTqpg#RZm@zh{;N3&;4DR|PXme!GT+`Vl80zI6tESEu?dr}VsMN8{z015#Rpa$2OZ%rqzq7Q+hN&Rv^I0=Gy8F)*j- z7e9&CWkXL(FSWn3ND?`SBN-ry7=(#+p}w?W5pRYNc7ZAJlWe#X+qd9p@@pwfbpifW zD^1lJdFZYNuGpNt|5{Q7X;hT$Rey~;StF`?6-O<#OHEU&HdW0Yx^Hbt^2N1FDQ16L zcpdUHE}C65^(v^o8b#&c!AeA#G%FV6@Drs@$D89EzhcP884jFM#jUdGl9h9x7dR|C z*erYSoNp3%)W&z&#COF=Z7)%V0PKn>NTRdX&fAQtyU%pD59~Z1*3QfItE>AowE}DF zE_CysbPZb5{iWXKlSw#yc}l#-F)Q%iV-`x{3@0lKRTxTihD9nvsTGuvHtCs6TwUi^ zjp0%kM7Pl8vjq9A?{x~uPzF3bPprvAh*}J6;Zh3`H**+Gn*8TAzbY1h&^B`UECsxl z745-N-^AMayLhH)3>7Dz-L}=ch}s?WrgS~xq#tF2RG>rQ=3|Ca;u3U{onUOBz2 zgF3=Fq(_f#wPtm?t)b!y;0H~3S;m#syT)9Kb#ca2Vr0nA2vaHTw{8!gHA%zw<>+UjtRxSF0g^D!cZf&&uP81P_u^@rs2wn!@%Kpn>oMbW_lNzr`{ zvAVQ;p7LorsoX_n3XE*m4oT59@|4LWN5<|Y&qbAJ>P4xi-0HkHe*a9LpQxl!lJSI@Fv^sOS46+b4%ABh?;mXGzJ88kuc@cXEeQw{X24mmmlFd)8=G8b|7i;0k zmTka>$4qb5{hitc-CkidgZE62ed9A&VOAvF<+HllZn7T`*L6ewZ(c$Qn%XICcM);Z zt~=y$)A+P4oUP&zn_b-|KE^AO=Z-{LJgC|q%Itc~R@g}%Ts5yW3)P3G z&^l}MUm2jI6}tZ0eWfl<+Q@7w2wzRt4qN)g5x;_KwFPp?p;k>btbm>yl6p&Ft^E4r zh(utlQ&0T%k&Y}s06uoIezrcN#Jiyq@&ya1op!c4(FS@yOx8{_E<|TvuOQ{T-C{Bj zc=-J2Eim}|5&BmodD#2SSM74L3MX*A$g|$7UJr0>c(UWnT=L+^XI2vnRbzA_HFJQ? zCY*%*etT^`0K-8 znY0PX8XaI0$zC0l&YIk6?e3muHxKFL=L8oq+7Y`!d*D#l!wDe)@B(M(uAVxB;qYli zJqy5SNvAs+vBxet$fCSv^me#$_6%vr+(;|eQXS7e&`Hlk$`_@8GT@5 zW#HOFSIije&Hjl?C*Y@`cgEKYlv!=mL4VnZv6~NjDOJ$7vu5vtQcP`>sdi+4Rkvo> zOq#~CY-a^Tbjk>LMQl{$2oLFtHkIoD2LU}c8RQQ4oUzIpJTt1IcW-=-#p{J?rA)Uc z&+4h~d{~qk*Q5!`z>tBY?CkXP%oFSfS#YnwWX+On5x`E*!2!9Cj_QS4)r#8*H&15T zvpKj?AQX7Ha(#8KppKC!y>O>Qjbjb6=94-}t*}aMO@a3)NjU;cMX&H5pDt8Ia{!b# zW)jwTF#-%zeeRHZaV1y5Lha)nc)^{?UFbH`UnvF0{i(K8nz24Y0cuuwr`%8TdL!Ka zG2qFz(Z~H>YH#4Xh`wZaX(=xipR7%L^(axEYMJ_Gvq4#3bTp2ixu&Kny9+Q`o4c_l zj!MmiD*BHSmX%hz^A^J2ZyFCjcK~D@h0&DO0ok3YRcFE&b7SecLa8>kE&-%JjB34B zVIVl<6nn_)mUB)js-AM5T@$yIJNmb)`!l=ydr14=Diz4Pm%-IMErR)DIi-kcS1kG7 zcX&Cn-IRhL1G*F<`+0@A?jYfm>MKFk8dYW_gix?EafmL3v=`%It+?&kGyr<>Un;ro zQY0A>o)u@`UReVaILAePu!KdC`W8v#l=+bOpiFabS;luNzoNlnVx@2&TvtZYJSFnMZlEtep3Xx>tM4L`t(%_e=v8E}FhNwGm|UflqF_Bt*ync9f^YA_ z1;H_uk4p~oDJRfO`lN>=#mtUVTbN^W!pL?(*SaWuDtjVf|kGbd~dn!hu5uz?b< zL0)t{^FtASl9zF%UEY$GMD@)=iYyj(1M-ELCr{AmxD=OB0}-tBaZ2PTFa6zYD2kDq-$Yko@8|dm`?rA-u)>m?!8n@70Y;=~u^gr(TSLpf!D*`8d`nwo zc^YW7MSl|;nK)%K+jwqf!^|Qa#D8bVz9R3zl~Xyv_aXog9*W{@j>)M!xvZ&yO-j}! zh$?!=)JQd}CJ-Gyo?rNZj~@f#d**L2vCJrZ@sb9`bt>mUjuzsxj#NVMzsjGLtn`H9 zze#XCy0;yU9KBS?fV~cmrct61Oc5~98ZGTp)Qf9InJ`c5p4ojLX*5(7g7s4SLhlql zd6Pztq9y=;jljA!Sn|)!1Z7q4eM+^biNwU=^R7k3RbjuvKeja2aZ|0`L>>vbge-PO zF={i*vqSXmd>Op$2l5q@SxoCtk$Zw!0rP?LF7s8Z$8dvb*k2Uni)12xAAc<o$46n z&5!8IRm-n%UL2?;?q@+WEpw4cy0knX07<~lD%KtPn){; zLuOYSL@o1@uNN^mp~9V_oY0hgJ?Gdiz{+n+%R)1#ZPB>~xu14}?z`5t{Y~!W$hk9r zXA@9@=C2Db7Tujbo-gLRHNSQ2xrxh3wI#>aShGCF=s}2ST3Pl*nHoBTs+bYDofgY! zuRC~Mv9s(@#fTyFN#E}8Kh88-+4kRX)?AsUk{)MRTYI*u!)Ug9E6dSWAskYJ}ic+*46fu2i|dlFOqp(YvlGs%kU3{v+CU@M`h|n#nzx zh-De_^ZK}+2l~?S+Q=-!P6#I;Jo~$t*jU#m9f}i1-?w$j_e7xA`?U-U=pJ|yOagjg z9NQrZ-oXw@s%>tWo#*q-dV2?)BDyDnXThHNL{r_ zBGf_uvy#HIV( zidRVn<6yVRwZ57H=DZ9k%oehV)UuiBZ1!fldcGRScZseU>>^?Wb4_mai<=`WTt z{cq$r`~|#KC)tMkBW16v_RbaCypYk+AUHo>YLn&_|r>GHq#$0&Lw;6_6IUz3d9lBR? zd0_f4#=#Q40vQIEkm3m`lpvs2cKKJdT$z%xqT;}kI~;paxx9oMv}z4qIGw4SnVhm5 zV6rYPln#GGUag=wetapqPB4Biw7a!3X?fi5K*7ekT_pA)s4_bXZ5%W8zyh%A*FAG4oPF() zp7X_w!H|)`fv{Z2yW+4Kqk7h^w?R^|AP}QT8>(l)@VOpKfC*x~hz^5>^=)lPOk?!9|^iz$zJqwU}k8dVg! zCw`&-2|a*>NQ0gf=_C=LOQ=#oHe^1_b-!UdXj^E1mpr%hx6P$AmjW1ghs4O~HeWE7 zL^)uO^4(BF+>tbFLcE*E(-1aQVC4CbKfX?=LZE^ra%w}lZ2%y_f)y`nk=SI^sW<_X z{x0{6({Fsqov-Pr&?Pp=rdiuIL4 zu18Ati2a7JWjwK+xbcPdZ;@lq?)SlUZKthMHZK*E8R~^J)8iG(okMCm+tl1ry2Wiu zjr5BI$I-g(1Q4Jt`LHR))XX(ykvoCo#8@f<3r`)f&AKG@-EOPk-ICGubtuv$vg zZe;eoUBAEQpPy!`6}tfqkDyV&BH9;~Ve}SiWTi8mt818{ZnMRrOO&xV-t~Se>$VL9 zE~30|@hNeG&=@l(H~Fi1I##d9$oR{9$pA>aH>p^)q5>=(U?(+j*N7AaXnbk{qfWGe zE^`wdY|1@Sh2`~gzuIrw1Yri<+pNc{|M12SfPAF#MfWS0PF>A0m8jvm(@Xfb0{LTG zoo!L<77V(QuELby@_|ix%uE20Y`L~PyR}9U1hcVqIfsiZ#PO06Xfq#`V*8L@hf>B> zb^DPc4gkNoLIP9$<%V23JKK@|6y1dQ1CPPoZ=CD?o8JRdJEV9bUFF=ng;tZw%6fOB zHL7JE9$IVXc9vS(N`+PQnKy%1Uf0yA5yF&`iI^L5cMOVf+kf#XIO^>??H6L0a*vuv zP0kVt$F?JQOMj}zofNFmrWUT*g?pouP-Cmuy|$1+_;n?C1p7bPrYi}X$2rEIxHr|g|#(sg3^Q;jAKQ0s{zZG8JWt^ z6nbf^_UH_kBf4s;rmm)PrncnujL!UdBVxs&Q#@Gw!r!J&4 z%xj`~UG^~OAk??JJz}GOCllgcKgm`j7xt^AuSIoSc$W5AJ`v63d3Xzo<|a<6RR{(nkH0d(`VDY z_6Hh=F^3O)T1vpoHXe@I+;>iJAONfi(<7R%EblRsP;t)1?klq3Ps1}sSV~UH78-XN z5EU&(L3!;DG0FPfOU}#+VQD=TNQ{#3#d*Wt1uHtraFe^+D_J{YQ$GkVL|m(UP-5E% zw?XiN*Rw zYDmt2>F60V)vLKDaKyqe&Si@fY$BHZBFAKAo}84IjZ~+&UDp`(nEly5S>wihu1Q!1 z{_2_B^AK78_a2YpKy%)$dwt@>mRo&JQjbzv4t=M3KZXCKAMnS3MK7*wb@*3L&!7#) zq~$A|*RDgi%-we9U4bCN9zg4M?q{4Z1@*ZB_L>Zy)$lX%bQZ5L2))@dD*LBq+@GJ~ zD;W-6f&}s6*ykm=?QalHDlW1%I(WbSu*9X}AdV+RtUuBSCy0EGA)So*3C(`?58a=j z&m~11dhHB*GsS;UNF+=h5h@>!|KiE;(Ue`6*WohQHrBB<4L6N88D|e_V^df8MGu`pMhRY| zq9eq2$Ne7whd_A0bgS`sBW*AeW7@=~8yEnr?L7wp!k6;8B&|$7=_u<@(FMx-QxgJZ z{YmkGvVLP+botWCCS$kYKH1iLtgRP;fH}N4ljoC~#Vt=dMU6h-l$TEWtSA@K86Omq zS^8H0sH`LtGI&7L>f~ibRsf=q9)Or$3Na?=cDD+bpach7e^0Jfv=M_XIuj)u&TZFY z$fhtvC#q7Lp(M7ok;fU^5|O)ToD4>1Cd=q$Ww^%OJE@?cJd(XfZz<0&7p!IF7CreU za;RI5jJ(9Q_YBiWSv-Qg50roC*xvVy2S^f zP@qDZZ$EjA{3&)`AkR zL@hXK>igh`N;+baj+mt5BFS^M-uCU2pMPgcF-!Wx8_YhcFEFHE$+j|fDr!jO1(Pg# z@^$3Re{*LA2htGZX6uelDZ4<{UU zA1%!r?@=yVv7?wU3&32csOgBx}Vz^iRhZ>$Q7~VN$uro}=f| z!-Ny{Nz{|WYm8Z`nOUhOlUKH=xLpW=HX;ai$Rbb6Fjq~GXX`lRGOCTu)>@*KXY0x} ze>Yq-Tf2ML&KmU#{?YR@w!HjiM&)NqakrbTq=;KS-;>wl26i-3AkVfF%WTCdsTcNX zbdFY?o1{y}t$-N^fB9`M_Wtmum7A7b^9Zpu-!nBgCx23TzQdf9Zb-j%-sXkks^<^h zzW#TzC6HD10XMlKGCFgj*RkgCjdu+{fAELwY-d&djrD;P{c>Ywez7yW>aGVLE4`E1 z#H0d88HoH}sl1ba78ZOeriyyeET)N0(Isk>=i#Kd!dvSx^SF-=qO)qET?f9AZ{$X&*NG|UebEOaX zhxm7(LmGC8p6z72Vu$8F-46YZ#CwwONmI|HwTfEJ%=k7sPtmMd6tAu{Euzk%YEZSSI8~Z?fAYrIlM}X1Jbx~)YuqFjkTi`;;WTQK91!9Y93+KL za==6r93)X~a1g!D;2_D$R0q;Xs^h}*`0Gd;+K2$z{0xGOFyPoukXc|E|4`(?W5W-= z_S%EP$H=1L54LUn;DfE(KA@LIjz_lN^EAmLdC%Mv*&g}p)2F`NzyH)pfB6|A!2gJU z7TIu<0x|V&*Mm;VTX+}ERbMbERVQ3z5qfC|ancat&rKeR|7pe<54B~@ux41@aCoxq zo@|J5`T#)O9@!*_N26Bf$PJlk%_z(eGa56389f>O8QU^;WoWi#3}w&^bH1A`tn3B| zR-sT3g+?JL^a%az^j^D7e;5)D3Y=9SLYgN`rVTt5+jY0ap0BpG$(`XJ4ICRYlzU}p z7&92li9GhBd#EgPZdRrx)0)XCbImyp; z@~$b`s<3oI6yg(n8A80?r!mK6@RgihK4?qR2P(tTd!j2oDPYcyPYQH9mIgLi`W*M9 z-Rs|5@{0cDlDGA5f0cY#`E~l2l?j!ymXb7mz%1*moNP+xlP8(1*-l@&OiWg9u`fMJ zDoRb(ic%(0YH)-}rD!e9v2lU?hWz&Y?)^N&C?U)2|YC-kPw#M-kqA}ll^Hy zqsIcHZGq9=e>OJDq{a>~iR_f0AGzgOr`PQ!(c?#F^Z`Y5iJFp{k`mih=eXp_CwgG^ z?Wso|^{FX*bWd*2c9F^HHj}r!-0LVZCuH8$a%;<^vdRg!J@WI;FMri=^TY`gq<+q$>c|SF8|&i=RM%F8Ur)7)CXLxe}Y96bIM&cDSES|Wmnss@7f(X zff+mM1F42(DK6jgNv^u2gsS=8ybqAx6a9wN03e_coFU7Q z8YoLF%U&TYPrOCADe)=e0rKnYPlz^-XbgO|$xu$pg)&2hQB6dRW=cyoI|r9tq9*pN zPcI0De`?_({E0t53n5t=f+%B9s`A`Qc^rdwXU!1h6Pi6*F-1&{9=D3A%JW$D?1kBi z@fs4{V_nqc_7)&J3CPYiCK7`HXpHGTjn8aWQ=>sG zFJ5I(3JFJr6M{;{Bl)F2ms~U9#l-&NQhj0|f3YudYvS{X#}lPQl{b+jTIJZp7p>8w z-{MjpN${Z`At(^0Gj`jzO)|ODOT1Sa{QUN|N%U)TYC^o;)IYhJp!z$7y> zdyQ`Vxf!Il2IJUSee{`Gn|$`*CgdXIQrd}~#7=5sld7FABe`CNTZ#37!qmFRqF+T8 ze@{;>4Ahfkd4XC;-1Mc`oI24eoH2061n{r8R-b7!#Q7iX_H_Pf1w2fLSYWuZRYiswA1`qLga+AdTVqa31QLtsH za<%?qy`;CzRvLRsDjzvta5C>J8$W#-UwCoR$N%i< zf7wLNGHd@O5B`>@K5pCG(7ou6f3mFH@+3$3B|j3MKV+AC?Zj0pu30!Ky?8s?3>?X|z=ogG!%DBmCV81G11uwuwaw zs?liUxxMO_)gP(9(eM^3#9JJK%S)~CUWe87sq53cGs-ho$)R(|ry(xZfA$)Ez#(em ze9ULk#`)4kK095UpmnML#UneM`zO&0mb5ynZi2p_5W;66+s3Q(+6gvooJH=?B&Y<| zo1&^wr3|UaQ58`!-3DzyW%j_C5T*;nq}1rcxYtugQjVucDXN_*BxPJICC$C`YGw!S z=&_KWnL=+{bm15n4H(LMe+|a+N#g_gNu7N7EH9U%qgj6RR(0IjzQb zla4q(P5Q*4GNjaIEPSV4~wkI2#a}&b!n>~UpSEUJ)dQn4_DYoo5 z(L!_>s)y;W&0ke{2YWgkF)92HHTD*uIy? zmS2l05OxbRlr68YyP>^6dTDo)nn#?_-K5KwmeLkl+K|A#*xStwk7CHSNm^QL?|x@S zekAGcI=_5p&Ws)-&G$P0@BfWXm@Cbx6U+%_vIZt+`e~8{0CZac1<*DW+wJ%Sf z{phY|ar)OA96UxK%-W^RE0=ugGk3l77M2s>S(na?+uyV7 zZ_p^YJuY8Ez;@b)8IK&06HIf$Qwo$4iRQP|x0;Fdf3Z`EPtyJb*jqDEZMUbA09z!p z5bf6^1`pQPm~x>%8H7cAz6plnz3!bZkq7JJoi2AyY4ij|QKrGP{AdRr#MBWyfhinr z$-tEf%S=DBnc2Y%GULog%nai?3`>H1@2+|kjxbJ4V`I8zt&I6#*2LUkV&b_b7D{D( zT#C!ce<Ik0;Tv9FYAUSIu21N+DCf;F`^ zHDk{YUc+j+Jkwq%&a*BGEuR^;UuWBkVknIte>2=;+?a46@`H%I5z?04XuPtO+AjRS z@rL7=a7=o~@viW$^jqqTTIpX1_2tV*oSA4^o2I5y%VacWl_ zf5*pg$fzQNgKD@^MMktLBkV{0=v8E!f!dJQUqQ&O7^FVt7j#7topy!s#K)*Dqv&Q2 za6?k7bTY0{VLW1ZQ|Zct2YbS5`er;vZ7~GiNL6Kikf(T~(O==EOz(EnD?@lbK}vP` zJYgwK>QjVU14X)gK0iqYK;q+ur08*re}Y0rE@h4>j*O$ZdL;g^HUzcwF3TO@8VTmq z%r6X@4eD|W8w9NK7o%*DM161s`5IQt#erq`_Bq`UgJQs37C7zOJ~@#1-}emv!@79W z;&^WQN4w5WAIJJ@U-((u>QdrgOOI^(+#?#kYT)X!(9x2MW>#SFm1Eeyv90gVe=gp7 z)5a^V*oZKC5Fz_tHL$1+uQe2BBpAs?E{fP6RWapfxHbf6Aa(xwK0sh=8jjlM;RoIY z`McZ7-#u^@ymo?Rms{HqUWiMZhc5tTFN^o4jqaXG+E}~3k~XRxl{6$`>1%RI3~^fv zZD?zurG*J;AtN*p+7cQGIYJKqe^#2Nwz}LXubpWa!|xm3grX^w60YVki@}j3!c5>6 z?=%B!l^x6;W*>8yu_I=HIn2Du*cquZhVggmE~*_%|Te?fj0sxTVzTl$I3Mk))YI%cn21f6w+b%Ahj7&uI5$sWRpC z2E7Vb=9Y6~@|f~N`G?BK*^kQ}CL(7Nky7R%?`ipu${(_S%%3itDSNWu)ywq^D?8%$ zRLW2yZ*+SqAtTikF-ozNe`(|~j47MF!Qph#?s*`P5L7uq43}bJi@!-pInn1S>?kQQ zkKd=>jHNN^icvQrS0&}%L+_&x)34I@LHY6}6kHxIHO?91s`kCH!LZ4)Sd|@q}f9jq;44xmI=lPq9 z@nmzdMMlMVi;VJ0lZ*>;>0HmRl_Sw|q?EF2Q8k4l;RT-Gm(FD~O{s=lT20{$vX0Gj z`_;PJXMvShSB%z0)%jsyzW2ASK1F=}r@njByRh-At3J2#zP_JLpTyyxt-DX(d*h9J z;lHha2`M&++rR$5f57!$yKZYs3l9F|r#M)c?j3sSsiEN~pM^u11Wni?f7k>mcI6YZG}5Wl7D}uS z!$Z^H=jX@+170gF6e~FT7lOoqsF%^TP4+|L5N;`=2iD=MM#+EgUNS6aW3d%R!f& z-yM9g@HqcOf8gohlLhBB{2;#zeL11+;}=Ie;bmW{$wUGAt^nPQ^& zcyWL6e^jvn6~~KI5k78md3C&qi$!gRxJMipZI6rl#c^>$w9Dcyai2IN+C^|(QMD=> zbX7E(TPmW_UKK~As%Ut;%QuRmu&mKKyZV{e&pI}9WHf5<#M80#+%HnpPs|tZRS+^( z_E(Uxz6!vALGyyZ^Fk__gjsu86Ut>Rsc1$Ne^}}uR!dcH8B4-V!cCfuN9ClTq>5VE z-DYkVwK9z*?J$O(2uQ%!w|j2e2Dr3Lil%v#3$m)Rw*4%ZPorIPj98%TUo*2Ji2fQzmIt8DTCz@i^2}c(d^E< zf3cf#zkU$^Ulan)lKFS~M4phBCMV%PGj*D6FJVZa0PrNab{BJ!IXn3Qf}97l!FI@j z@~*p!`Gzkr|7-`$Do-{;d8Vyo2G82iFw<75SRNS}@AR6T-1< zC<hTVtqFXf!usST`>HTE*QR`9tAV-OXlbc zLh?rDacds4<}quYv*tN#u3B@|nrE$f)|#iRw3guP2jUMo$2RF6h${e0k=R%);8x&~Oda zhKGlShA?|Bn9;^wWQAd?Rcy9te~ggfv-lt9ff}bCmzMUu4_oaY<9?EqebA>TkK+x~ z-fv4im!T7D9HrNzY&PER;Ra4e%ckg9MyJ^mR5+ z3$cd!?*;jN%Y5^Xk=g<~e{%#Voj_4By#9vzZw<-u3q00uJ`SE^c)5l;H=EYZG&@cZu>bUxmI-}aRsDtW=dcSH{;W;WiM;*hbMp2;%nRpk|NfHOOx~CKSJ0I^H@0{p7 z)!FbW*|3p=Ems!wPGgB)=`@xtuXK*A=&5uXtJhRIM=oAp=`;o|t8^Nls#Q9r6}q*k zw*H2PYWX#nZhU4(e<$udNKK;^%<0-D5-ZN;^R=4k@}E<|v%tweBgRZ@xADq?=|WV) zg3I!ofSz9K0zTbyB0Pb7T|qIXi|{}Z9w@>m6pcEsF29MqMb}gps6NCHU58YXB}iR+ z_sTVJbAUb6p6>m*Pp>oyZ{Ra(^+@A1BMqJxX>gq?wBpZ=e?%zeYK&&QnFt+^p;+AI zlsv&0j=91yTc|M{!({aU@0%xNc@qTC;oEK$_2dWyDiBG-&n+#3&<0Pk^njH>?hy1@pP7Y5J^%?l!kxQY~z3 zuKrp3aL-l7f6}FWFD6sTSf)xgQ>pZ-vhg1d@L-?5bQ$zZ*zWBpXIffX@=FH3G+l)@ z3F_`rnv=SxKVwdcnZgQl+swCN3t`lT5UK4{ajVhhaEOkFW43X6T&Cz*f3SQbO|0Ma z4Zu>O>Zm@z`ftoyo|?@yHRlV(V(C1%v7SuQuJaC=f5{wJ{QTEKmT}KApGM=o@iF{= z3>Ke>D0XMnkyTZO@wgtJYc1Y^vwvX%kndYap&`o~d|c4HK3~;G8RLUBXJ%y0F1{F>LPAKD_wu z{^zf|e+(`gxqj)=RXx{V+7H~b_xf}#)NfwUZcQ7y@`33)X4gn}tdMgTZJNHrAMdDh z+04s`D0KPExcye!UgSqn^iRfB2dFW}QTK7*o7^u0M?=4q-i#cJzT^8H^|7PzCF!LI z#ZB@j0w<+kN9=Egjz-_3-f^6C|JwH+=iC~)e=hoD!(RF+&(n?H^gFjv*E+6oU+=q) z+bTK)#p?_!b`JwkfE&us2{eK1=mqKwilZR4;ehPYT!Su~>mYRo#hA0TN%&vyTd37) z1daDZl73p}Km@>o{Io8O&AdJ8r}a9Mw1x$M-O^S+p^+frE>=j6PMe=ACB z9io|6|I*4CRa0A2_Hw3_LMmE-(r_)sNVJeCM)IkKmS`!3>L`v0(Gz#8nOU_)0u1ff z3qW5kf+zqsRs>NGFo5jTGJh(cY71DUG?T+oQLXAKshxf9R>B*4a9)DBdiNzi$GLqE z9O&Oo2`lg0{OFZS_TB!azaN_3e@~3DP;9r6KI2toZTerwUb*vzBK}JLu1){5zxUF| zb|VU{p1#cfp`~rF8`WddX>m#defzEU+lte}Ibzga>0t2X;PIxTg%6uf7EYF33@67D zTq$Pfnn33&pmQwIxd`Z-(BuNwYqn_HE}XQQEdd$zzv|&h#CzFRA+JQ7fAKR3+0m*9 zZU%3qT|VwNOk9?;45*YB?SN{}V4XDhT)B$Fi%N&64Jb5o#E6!wa;QJFIkY1*7#a_K z6q*US4u^0^s?OGb@@vgpt*yfGe-*AZWpCrNDa^48)h*W?jWwycSU%Oz9L=V1EPjr z9$o!!u>apye&wp&n~0uKhd;Txu4s6mSiIrRSH^HmE3bl`ADW7`e}4CF=pEUP5bjTaMjK9G1NY0A4|!G-8aWBZkWS-&Z!yH`GzLKXrKG7&jo9s^Ee$+ zyw}_4;@Cu?RAG%}Jr&kaG8NVrCW(^PN)k6{@q+PrL8{;;pJxom48^C|olTCg7G+RzC{pvh8iA!+>zI?nH3ChpowPK| zlqTqWP9W#aMp{!d{0wDdC||0B{y8XdrTdy*fj+S0z(e@e@ei??r|e&rl^6k+u6 z%(%VFwioqK-!rN-=cr1YSiM%;sXe4UQGB-eV(}>b3-{6TN&21gY46z*>&DIoC+%F6 z(-xI_npTxuK)5#sff5S5P&e{pSL!0Pv}qM`lu#<2tCm)kdhRYiT>co%;NPd*T!Y8v zrAuBd=n=fJe~>JNHLl|>&pq1DJ#UqKC)@v}GIrWMgEX;d+x zwN^9`Ug+^FwpQHM2!yfGj;h-n$k9dZ=Fvs%nm<+B***u&EtLj=Cga?*@w(w z!tku9YDKTxo<-dq)_cHc(BW*Qqs!)XyT_>QMz>ZJe>AOVQ!aAK-M4jr)NS*3_jglr zH|{o4nM${@sM>vW$&xNd(1;W&!CM$*P?=C{NYNEaIU06n6~SX5D0ePfmxu7onxxqM z%n@dSaWLUt=L^&Z)P~a37Q+*dt&`glZCabHjUXgSs?sK{?%!pVJE5_SnY4I~lcYR8 zIaE85e}^6mvSQOG@Aeh*&>0H;9!W zl2&6++8PtqsF+NGMqPsi9f>h?(5IJ@ehKKVZ_h$#CaOh7#TpYNI=fkTLsstru?j@@ zysq$bKqL%+BzRGEmgEHg>J-cDe4^$oPt$DJf3t3k5L`5`he)-pY`vlD=2dcYV#kjM zwhe#!p0_tWtoxIk*4|#swE9YSUVh)YOtt#d@7AxceeuUVcXaWJuX!<(xG1xj`fFLv zvO-W~{LyIUflF@ayIzhr`t-i;KE0_m*VH10a^Wx+?(4n&hTg4_sL!YOwXO&ii(rdi zf14S%AF}@xwV-d0N-kv#j~a4DM2ecp#2oaQ28HzuN?4MFLQ@kS^iFswFZpUas@`xh zlQtnEH5Lyb0qQLS!WLmr*e@IrCWKRhn-LOZ$B57%KzlRB)p~n#SC^U3tz$mS*Vy(F zX|X{1T4)|8bwQ*=?$w!!bnhe+@BYHH)*>J!R(V+iLZk0_j{;v=V9F{x^5E z#d4jA^7Qy;4j(3ds*iZ3TdjKNHOm9aif~sx7c2EYc?*6K4jzPK2d%13d}iGKsO?_V zgk46`o%HcK4REO27xry)Z%dp_G&K1Z`@X1-<757J{f_#5XwJI}gjt)Ii%Sa^f0M~Z zpr9Ip!5f^x8bKpuM2(o?_s$PlZ`6xoO1w#OINb^?D&6#%xZ?G=l1T+f3Vt+*_u&a_ z13Fqbue?CfD2yVojAYpn4$IJG*t~EVd6Hz+X6F=w^`owL&C76}r45hYx_<+?wL<+y z2qyUiRC^8!CF#O!Td+M0>%kW{e?GqYny=+$GeOmtE#0-viWpPNU=di#{{J^9e%spV{t3s_pm2_4jl42Pm5I+Z-8*l5JwTKx|zyk+NnjEUTRh5f3WMtFY)&Zui_t3FLVFQ|5$h_@cqmY^%*3;_d-+Bdq6};hT@7I~A7@yWJ48J>n=943bkmu` zW}nx>MIvXV=1`e^V)jWUGYkBo^-|Bqd()W=1Tc3%6aoQJK&m=Me;qgIfFJ|{f{mic zL5>wTj^z=?a4^U50>|;`OioY(HWAsVEYD#Zi#QapsRH5|p5l3m7RK;(1{06RVs1C> zP%{~d!fx>p^(JDeHx0!=189&Cq$kiRp}a(Hds91c z0?5(?L$PjjLiTr&e@YY=Y$uQ(8RiJoUtsDyYHK!+P5m4)=$NS|bd2c9C>?_ZLY-V) z4=My$5JSG8&W9RVT^O7BkwN?8I={#thuPbPuMpJvWFcrml&saRkQtkK`v4cxsSp>M z7p^u957p4{(1N&yOx!SFmX`^xvey|`WPJKU$IBmL`cdwyi#;*h5IeXmcyXwf(S5r2MqCw17? zo`=M=mr9y`_wY@@1mr(Nw+~P2kQX?I504mFD?fqf0NGEA%TRx z5P~cspnwSwNk9Y?3=v##8E}_?f;c)Vj^MbA%OFiaZ9pZCIO7(@aT}Kz&_Pr*Zi9@D zB=@myci431H}CWQ^L(CXZl_OGojUj4sye4mopY)hKmZu90t|~Mo)N1&@57yE0OUac zZPP|gXs+y@PzVGAfbo}ee-^bb7M@ob0jdG;X&uwzcU`L&YE0J@vMe^L7-i&cUle;Xir0D<${7tNJk zn!X7T4gpMD+_7ZoKq00AB+Ba-Uody^<{tY@z%~=eeilDI7#dLIgUB)%_*k^EYcLjT zp$3JB7+L^!F#A~upkPq0fe@yEDAXrj1W-TJe+MA+%31Ps;fJ5l%v3PyukQ06Ss9;Y zsQ*@@)hHGB7EEsEf9YSJnk>s%|6D8lposv`9(@86ddXU-pi$kasse~Now9bELrp3b z&0<cSA-~He;K+)oQl)Yjs;kV3vfxA zPX62f@R=je`I!;^SJ#kZA2R;v=Qreg{-MRRkv7sh*bX6~a;v^kugMzDKbmoxahe;I z&zr|S+FP?*b>+Hm^zY?bbGPu1!6{y2yv+2Fd9Hb`mJ+v_WPXY{`BLT?;hg* z!gH5*nD1*k{AJ4Ln!rEuGyXfkohNrv=%uYfFDX4%CJ~_*J2LbKgkF3k^kTozi${cBJS+6#Euj~?k9+3FnfrQ= z!_ED<0Tp_&Tl&nxdThF42v-rLr;22 zAoH96iZB5SFb5Z)1540>bFdV}I305_4;Nw~+Ht|Zxc4ChP>FI>pcVm4!F+5Wom5#6kpcIu>9a=3^5xeCQxEW&JMw9i&xAk(5j+JJ&zqR0u?%}b9;++aU={nCs^UV<{Iv3cqgDKWgE ze%R2u+9C1ks>+J;SXpT_Qc_%07%s>Uf8_-OexKLlb~zn(o7G}A8AU^Gj$W6o)nutv z0;2@crqJlNKr-Bx6vCk~V@i2B)E-EN+mA!EB?Ik&SMp=?snHEl9G0ruMUwlO{JejdBNrEv3;UX`B<9okVD4(hyNd(5Sp7 zscuYWDX$4E;Jv}Bz?NuF*Xoprf7xvj{n??j+h;Z>S$hkAhcS}0hejpsm+p5QE0#u+ zrpD&$kFRyJt|rHV055iRT^~qpoZNhTZIHv37Ds8cG@7IZquaVhC#Ck)V@jjr&j`$H zPSR^znv>+(meOc|_k{N<-M_h^CXQ)4H;~kZMuz5ho!izPNV>X`IDJ{Lf7|7fw#)nA zY6^5sX$}RG33sTaeUxX51zo2v+v=18&J$}&qgzB{dSJKY8ZsGu&heSKN9&ZFLe6vJ zPd_@cgtsU(HYv3w19JjNoZcKt(t=tJ=GLNXPOUr0uNG1o9iKdVa&yyyq_(lGOB~Aa z{Qjh>Knw-CzD1I>h59}}e-YE3!Ke$wZ^5%%PL7INlC%%zlaWZWq=bt|R%24ldoWxn z$4jFZrRajtVlj}S3z`B+OlnS&_LiYBM`<(|&KrF8b5h@ zbD*iKEi<;`r<_nq*Vi7c%jA;g#%AWGnH+U9r8a45oOzU(7n=1+p&%&~s1>0;JC&uG z+?>Xc!04pdHYN>QvV+0@@TQdf6~9YKj@_1NW^!oc#PYBc$|p2W-^IpHNeW>)e#-Q& zuIv-)Mu$eXb#;vne+5Q&wRN?p*_Y+%S2IL~b}^dh>P>2;4BGxtkK&*fz3dOFp?_a`W~8ASqbNu^h<@0bam( zGXC`DZmLn}-P@B%$PGp-X~WKpT@6gqA6p zu4EuEvpED$~j%6!w;6imUb3YmyN2oelG*1Q2mK$=mHTW~Sn z#8mlfOhFL$;!8wPhxzgVj988Vas}=s6ch&3;&sf$e_C44BEn}NC?VzS5poquQI9FO z4R*Xrno%NWqaItSm)3(~3SMHfG*P)+{)Y4jFUYg;8&Xf-5+23N=p%Uo2CkM@$?N62 zezaB(F>n8~a)rDIQ!o{6xDc0PIac6q^pY0ZKzGS2VMH_LVmY3`OC%ydXoCr-V=At} z?bwc|fAK2*jE@K*22w;;kk`o@D)jFj*e#EhXUiRE!fBX<6~sWiq=1Z|)7f;kiM`$b zw}E}K4@OMEMYsf)VGY*e5xk9e@E&0_n@*uq*(SKrfa#cxn{f;7#zS}kdx?frlc7W+ z*OA}Riv-rc8w>)hsKXd#^l!#`+>86M8N0Cuf3M+fe2oFZh?7LfR5FuXL9Qh?kzbPg z$?wRc2Dy;@j%*@dl74EVURp~R(r)?&i?CkdOySY~Z3EVU?tw1{Wcd*}DL*T}tnjx6 zwP?gtv|=%qC>(nXJMkR$<5PS~2vHM1DI#OYcrumTPJT!Bk|PvULw`YkM`hN)*0L7_ zr*QkgX#6hw%uu;$^&rFNlNqNI4lx zrjcgSM&^?avY2#|%gE*ATJjLtMs||7$a~}qDo{1G(g=;vIrJ)e3*AO{)3@k;26hH( zW}WOZb_?6a_OMR`QHToV!UUmBSSDPmf{LkanwO8*k1Xn+-G68Qvjb%VqXy0!e^@o} z%)na%AIds;m;4dbC`Ub7Fb_*`1(xGF+=LBy2oK{ee1MPf8NS9h_?9rDB`)G4euZz1 zWGtCLrjavA3pt0JL*|on$%SMEd4zP6CrJ-^hP*&tB7Y+9lP@WuR$4~O=rGzqr_yui zRrF5!2u;#==sWaV`aKJ?D63>ue{48wW1Z}Jb_2VG{ffQMJ`$*46)J=?gyq5?RZMlZ z>NeGS)o#`Es)K4#JtLzdrX26TvX|*I!f>__8!?G8c98yw){`sf59GJhOP-6?8|ZX;9c{w{f8IgveOb;T=rCc5)_ag?(%_9Y^0o9Twsi z@(g>K?!-d6ll%tXpcVtMXY!mKafXA zK0OBl%b|1d25mt-_7D>-Bfmg37GV|XLX`BA9=uF%Mh%(Eo<8F2FQVi~AKAjjU<>&{ zctLo93iyFML%pP&Xo!Rla4*(lD*k{V3*#ZwLPeusXhj=Ng^_+se=esBv4GspJ|*|l z5txX%YzZArZX5Vk7{RJA0y~J4G^*<~P}QrvLbYHOKE`m&<8c}Fd||KZDxPPrvqN%= z92}UX${lzgm*O3a!FyyCwqgw4B{p&vnJmb3ydcZd@Ce;3yf52{o&@olTu#OgJVxqC zz8oN(vW`r~bvTR1e+h+E!nMMM!sUSc11`gLScg0Dd%TJJ;6owma4M!?CT3#+N>PqV zCGs{LBQXkNaVjQZ8m6NSXX6~4k4{{IU*mV!0tw?W6=z{K&cV6p#1dSL%kT?ah3l~z zH{&)ufY<25bOQ_08|ZWNBDw(Y;$8MfCXs1)Ls%&+#~H}Se`I3D0t`Vt{8)|E^6Qw6 zVz`NcRAV`pd-*f@E&0LzSMdNIz&fl`kHlx{MigNpIV`w{Y6qssJ*=mDYL%2?J>5f< zWNU7ISmS->we%6Bo>rt?4l=_WqCz5O@ zde~0vVLKJfe-0$s4)m}c*u!=}K!T+}*c0sW?tH(LV%xSl^DDm`;bL1Mv#p@)X0{4J z_}N*RbXF!^!&adLezrD~-pE#U5Az#FXxS@M`MyRe7d1p!~OyFlP)>yc#Zf6>F%V-H)e;MapFj|vuN9+k=5 z)ork4Fa}%Yh-}uvrlAsk)|^StWYfAU{kulAv8f=~tiX+o$EepRaFzlmDsZ_{yIje4 zDESU0pHT9NOrFEoanP?o1BdK%b_R;!XOr1DC7r~YPyj!h$i^w@X>6>LPGF}f>8WfS z9PqR8f2;{6_}Mr%S}BiZO&A3~8^cB`=_zb<_b7k)h{bF)X0ax2Gck@Ig%}%!1RDiG z!K`7Uu#t_zUIjCYjlyy^3a_$JUi;Ji-NHzD@8v1EJ#6=E+dR0g~d z6MrntVue`43bBC|DpYEP?n_n(nH7Se3ELyE5I zCPNJ)5_B~t($&0@-iR2z5ea%DS0$8BVuJ!>nfz+R=xPk!vF69}X1W?`ww-Nf#jKbW zvO-qGidY`YV?h>V0Ty6>=4U?Uqig9}x`wWyH_@Bujr2ykny#j+=qkywIkGE4e`m!z z;>+V};v3?d&%?ynK`G;%o#m1CpI%DMP^I(NX~naoVAghX_1_oNKQPGQx(Z6j^vCm zk`{6%a`3bQM=G#Vfq4q_k~6z=f1rJm%s@~>;3tLKf>-)K3Z?|o?Y}yh(vWWdRq4`< zbTW)1ANQ9B=lP>)OgNq72cHrM{Fq99hb$72qFFCw&B~Ip>axnRO0$Zx3bR64{w#~e zq!Bf_8oef4qtU1}f`)3Kv83dEQiSiHS=1s=)B=Zsk{2n5G`+n>iH2evf0AZ4o{m3b zBpILVnS=4O1Ifc@gi<7X^7N!CG?FAu<1v29NJnx=WPB=1K0R3*8K2Znn$f(4kegbP zwUH#fAw@8yIYnfSy4KBuY1=_a^x7NUnY5*a-_yKBAUEFF0^3CiN5VARST}mq&w#cJ zj2ychk>d-=ArWu#w((~)e9hr_jvH(6BU3@Hm>ReF!Qv!K{5hq4E6(GzC9PbKGdoe;pb5Hy7ECapbKn zjhFJkWm~9eZd<6SExGEV`3@d92y90qc`Fms47bgmGoPpJb5rE4(A-hU#?Yw1mT{N< zv_5$$uO1f~wFQ?pO=;e8sWf*~_c&=>Q>cAZ%hprcOE#VGx|M^k+fvg0GY@O$4=dsC zI%U((RBz(dr|@@emnTC94u3Uo(O_gtTDV9Q9GxOliC&BKC@U$}P& zd@o-YX-VosBa=CykxEtRh|&?fN`O+8%j46TD#tH|1>HNygPAHZG%{%njfA6V!KkJM zqn0emWd6gyCHz`?){?W7RQX%7^ui@emU2d636?BH3@xiwqB)ZWUjT@ zk|ixmp>TD{h2YOy%E7V6AI)93bjcF3udbuAt(91`V ziyZj~3 zz+wdDZ&8Avd5oD3rfJ6-wl9P>qQE z4dRH%U!w+5`D+Y8sr)r+6t=xxGP$&0c4C>_1F&0DR&oK_esS2EiCixSbiBsfH z(5%1~jFCUVbc~fh#ta3{#5nn5v?}l{jF%5!7EYB9pbZn`18B!-@<*7BiSkF7qrkH< zN&X0PFUx5oSMgAMk#Z>ukI8T8KF@H_|5Q}i8{2|U)UT#DK9UR;Jb z@?UW|&X)g*D==67D}I5w@?WqV=g5D-3e1!Lf-4nx73RzD<7x$7gLCEgaV^f1-^X=0 zPks;AV}GIi9&W%Q`8}+}BKci(;e7dBtWw}=bja`GMl6=!!AIuFRp)@Gx$WU&A9hy5v3Bj8*a;B(YlFgDnc|#!d38 z*ormstJtQ%$FNp@1&=H63EV8df)v)tuV6dY$^4YYEiymTajV>mC-E!!Wjux3<(Kg^ z?vP)`E(L$~;7<7^JfpzhW4-(mp2c1AOW2KH%P-a@Dps8d+;fC$~`!!z|Zic+=I{Y zq`V7#cuL-dFYvUy3tuYmE9{b=#@FbPpT;+MMt&N9$M5B*a7cmQ;#v7A9L8?>Df|Pw z836wz;^1S)}N7_!x>6wyD<7u`^ zq528^^{0u4>nDi)^+?qB*Yj^hd6h9}EC?Ed^8_3Tu%0853O^tq^nhZg{0qUT8i`Z* z*(|AQl6jJ6gJpwzvt_euvpee)j0qQv9U%>gme$M|E1BbCAFqEHRzb=5Q2scL*5vh= zXN*h9J>7Y6CCN`GUL|?l9v}C(J;%O9&Cgc3r3TeTGHRn#ys4dTw@zNPJ1vAFx z&lndUUQ<1`deVP5GOpU}o?%(**yy018Ivq)EgLP>fY!dn8@SZPlWAt$CxFnV+Oz z<5YZ2Cc_aC54A=v6$G;Df;XA zB`Q$C9gnCeC#{54Robi;btuHt>QG@g9ybr>hL}Tn;dp;_O;y#gOifLd-Db^V$K}$u z2Scoi1x)w&TrS^lgVb&`I)hIKs6#Y4NnkU_K4!Yh?{fKn6U-o=Qm9-cxRuuq{QW8O z({%s9cXqScJ`nXe1cS>!UOATIc%o6@8(ya%I>dp>V>#un??7nlz!A1t_!w?Xk_wCU zB_dVXbIpI*CYxHV674p#b+}nIL8~=y%*_WxP&hp=?jR~Si1S)5nXME057qOLM4~=X zZ#31_5e}50sy3O1)F}PUQd6tNWLJ8gR~V*Y+FJi`p+48-%sT(9v(C?QnsW684@%^l zC4`dGLpp~sTmRxf>c0C2QZMMUjZR%288-kzN(X}sqHpV zr8cW3WM^B4^Y$9x2ZhUf-wrZiu)T+Qd-vCieM)mrXsw0PEVaV8AvLCWH7!(FSZTMJ zY;^h0w)X2K1Mt7vICJ`}_AJ)~7TmNHWbKJ;XThwma+$F;dq5 z=gN>XThF(acF-)rOqYYfCF#*a;ZjkjFy|4jGWLrH5SzdsWDUjz^O4`u<(FInf&=oI z?4W89L@bhqYPB}v)UsOCX-AW>+8NsOv=@JoOSCIBE48s?*{y5X3iO_6RXo6OKW6=Q_GZA_7!Tb@)VVt?PEzD!>_TU*J| z&eWtug6->{X>=Q%+4NqWCD-Uw<^Qv}z-iE1RS(*8odz8!K9WCVpQ!k$uo&62)kJ@@ zLp$Vez~n>SrJCXqTKO9k$%jxV{{uGpAF#^*c-)h#&DG@69rAY&E@>22-lH@Zb3N0REqR@Zh788XQ zry)^jvF9d2928n?If)Pl%;Ga8n9rn3lxCZB2^-IOEzTf+$mf#X8B7=~c0a$%pP<>I zak!lW@-ur`yxA?pDk^iSFdXJ8QdHD{-Db1fvZ}*{;lgkzk6Nu3o84x&RaKhe?2{|! z-Z}2-GH;W?e&yUd$6rT4kCVgX!i+)igL6nTs8(XOGSDy2^v*{>S+jFO9Ffq=wHYo2@HH;(HflD8mI8x z4>Rp%lfz*$+lBIJYNvnEkfY(h5_<$-Z>v;@kRe-WbEH`ki*t+xLSDApZE46;=~UQG zW*{4}{+Fu~eN{2u#_|gHcG%>O)y^%%pYxz`n5S9D$R14R!M@6>NA(dL-4ZE<~V ziBKFW@kK0!zM_!cqT>SNJZS2({nONM6N)rNB__wnsSyPZ4(@;ZPh`ec^%U6;Ep#LY zgv{8c)n@BmDf0a`-X`oMGoS+{Gq!0yFg6s7$e|r5g`LcRkK{l{7a>Y+9-OG+;X{0$ z9_r(|y{|7(FZS;j`$%SF!AF)vA{FImTqb$^`6h?0AP}|&9TLnTqeSd}i$qNM7Kvmg z-IZ6S*-%?si%x&i8EF|3RMrEV)f$ZF4;fD5)!|T{I!m2dG%{*Ut*-LxN&Iy*!*z?jkOm*y*zkb z?XAKs@!M+ek3Uem-Mqv8lKCY|ul+sqU+kZo|7n+FMt(xZGE*x zYZr?ertZ3C%59){i_bFQV|Wq7Yf=sv0@N2&dHo)nGer(O?)5%xGgwV2(k7X5bDy>b zg28`zlvyZcH0Tec$c!f#6I4N8jxR-KbR!oj`c1dj>)|uO1_PPVZL_izy;?F5Rqi~m z*AIh_z(;&L==lhe8Ilf!5NDnsSoQbpAb)~`&;AlS|2T=*DK{8h@+xwW1=ZLxEx zLseRQYVoY%^NVjUe!=;k<1>fG$%WX)h1l%QuXYDQ8jBdnxA|Sf?+xN9G6Mx%l^{Y$ z_DfoCgCJxhTwqR-ze!qqL$<3y%pzGk=(Q-O3m+>0nOBgXB7b>8be0wf*@Gf{Y|JJc zs_(BC`}$kc;>!)(SeHdp2QhznX>Bs7`pNQfH#FS+=2zP;KL0c+>=2FSUv=No^T3L$ zuMXsxY;+vgAi}zVxqkm&AAA10c)^gM&Ez!Q_`+{*+SDXEY_ycCAuxO_f5<*oEU5xi zkn5#Urr+khh%fMkUT_IsYozqd$Xu$@!VQ0syGkD-_ZB`z zcV+L;?}+qfzZfwuBlibsg{3qlf8Om0`BL&Du1`ls3|JS=eUxhydCoA zD3A|!7v=@|s$hx~Nt#eYak1LlU{=K%)H$IPc}Eh9i)~`Kfqmd=NZ2OYs4YeMBwbaY zLHr=vpmkQBWQ-l+-dum*A56Vj`+>JXeF(k=xpT2lOpmbTYaWPFeQJo)t;-QQn@WB zp>o)B6Do%-Cqa0QI24>kpRhW7ri7K_tQ=?MxDyPfmZSPBUR{4PWKa|oZ)u34wyYK| z7Utvf%)H>deH%CKJMY|?B}3o5?N@IMEzY^;!ln0Yxai^y_TQ~o@w-jSmv5r0s(#yc z>$~sXI_tO9@w&;gyIy^@Yxbm}pDtW~*SWKAxn&@$_KK}oOtAtP)ya(=Xs zDkQC;+oscWLv4TBNo;UJAhySJI;YdKXgl#C6NnJg3v7bh^@FNF>4Eu#5}le~J8ANe z69Jn&X~?kC__u$}#M+^!@$Zjz{#?=}EMR)26+^nS@=1z*C%LWp2A$L86(*X|Mw%N0XcxuYW*~Zn( zu+NB}Yo8y#)^kTJyQ;zvaOV*)O|H#8q%sil8FIi(y3n?WsbGk1mEbFg3}FI|Xmi7w zwqQ8y8tQ)z8!G%2v5G{6P~oh*ewibc5%|^#eW!_sC-nDo7bGzl(BLa4cSO=2ti6u= zC3O|$7@yRgF+Q0;d3y79c;wH!jTZ1p=#@Wz%x1HD9JY*Pw{XF3?IeRHO=cM_R5TF( zSgjURRn{E!-?_FbWAS*ksivxu{W(2aMmtqaTl#;?_GwahWTA(M+ZH}D$!Im%BB%E* zm~qyavsPAK`|H1EfIg|X|qN*-}25%p*6S z`N-vjA5zENfN+tp4qilwUJBlny;66BX{C9kWwmvUe@&n(cw=E#@tP97u80%{iakMo z6jOhDN8w{Z+NiO6Q}jMb=PHKF<%QR-p}ZVd6)Og(S7R(Q_tAj=C7VS@ahzHkTbKncGkHQ7A(E;o9QF@y4>~5S+}3o&@w4H76i?J5EIrRPE3E2 zYnH!5ytR}TO77We@FjREMGek`dK#r(t;J=Jn9W{Sbr~0M zS`mrIy=8@^C=p9&NhBQhmikjv+VJ6jeMIbo_-*SO^+z)q<3}k*B7+r2@!VA-#zDWpc+?Ua zkLOxEEdz^NI`)&nimQ?t5J|22Aq_HwN9$lR2P&Mgb@{^lcFrj z$2*#z9|8%Bd11H%ZaT@m(Y=4iz0duXTjf687!V1>72;a)D^U=g@x$BsJW^QESwEq_ zwUb+(3O~5%$wMps^~ZQ|^62AuF0}p(6G-dHzH){IL;gJv?n*n+1MWc{7<4}NYd-M( zSDeU%L335%Ku-40vj7AuFbUs=j%W?`{s+~~peDDAvitrmf=MS~Mem3Fj+ zSlg~y*Z1Buapf1QUs|1I%jG;W+KKwL%a-n(Tto1|saKtuW)*+=rOzc=NcX_)@tR3% zyI0=XMO0lK6&8cb_q5+>_fB0n_omj1?s)BRpok2yo6QblH|N;0KyV%)bO`IvNPaKr zP50Oyjcv8kS0Gu4tu#LX5SVq~MYUdxn6sUuXaX4I>7nw7Gx*krSrOJ zy^&#Yj%q|Lsf|?E*2b&7!$NsJ5TbQfhNIC)AnYm#MIsDnS8;Z(N|6-x|XtubPs=}20Dv&P)47mJ28qMPET*H zw080(k5A)By^!JV2xr#AQ#%t?2!tNUM9)b+so%CxWM{_XdQ z2BD>keJ+2e|9g(9o;670^e?701HKbfh+=6DoJzJ0=8xD0>p}RxR>eLQ*1?arrP7#C zrV8l;IRQ(+8uP?_!&O!Ka!a{2;Ys*TQ#I-(i)0<|ndqJ9v+`dO-6!evHA*Pct9AO7 zvZn?fj~`xV+7{BOYBIKv!^F#l)*7SLYBG8q{;+@36m~i&4QmWxtyZG}@fjzIM05sL z?{yrtfjHOu#6HgTzW;=kKgX?~#5PYb*hBQ@lj58EcuE!fT^N3Bu#OF;qJ06OSy+c4 z7D}~7U2dEkD17+?yl$pdzn8H`;@lpgVV#?s7zQoTx!sE*qdE|LT{ljTziV=OwWV9?Y=kg26@AKkbL6J zY4#DKH=0IHMM~cH7|-Yxo|`vti`Q?UhGKuS!C*3b^?pUmh{&6iNArrqd3gn4uRo^f z8C_*nO=V@g#v9YAl(MEu&}dYGSLe2-ALbwihu=XR#TJLdYVo?uiqfhtGATkM#f6bb zQK7diC9je^UV?zf>-7<8AsqT@0iV}r@p^qoQLm))6@>kMpU>kB6J8$Y@wjV;P-cG( zyJ=ahuqGUf>2!L*9M)^Xg|)R_pU*p_##boeRpKw4RoGFuxo}sZs!%E{t}c{JaYNyn z!aari3co5;6{hG1lGW=cvj|;7UgbZF5Ii1%Qo);|%OsmQzyyonn`nO3yx07tSui{6 zexETPCvYppAhnf{I5@I z$m>;Qk?XJ6eZ8j45m8+s?v6PAwU+Dr-&2*Hhj#NgH@Tp*6`dqRej2D7)Nq9S%UE8B z-rY9vl(=3|VlQ%dN}R)2$Z%5kilX4s;k}o9ZkK<(iO2Cyo|gSl`o@X6jU9gkK^Y)i zDXc@3bVxQ0C0dWuL;pyLj;P&kVsi^RqatOw#ira`qsgl)h@_>dh!hn^i;5yqZ$Y-8 zkYrV{tSo_fvt1UYY>$}jc8l5T%J=bdUa-m=4Ens@d^aT~;`6vI9*>*2VUC0g3Vh-G ze43({KJK=J-7e}$(MzRlqRW5ICK|8DM^Ypzxq+xu5I008MrTDkqHCgiqw1)uj543e z&B@KCS>_J&8uM3X!C)q4XX()Mjv82<-0Kk29%H0_f_NaUIO{WtQ;E7N&STy6Wf8uI zXCN9&QG!^Eo&>RoZY5UKa{U#%9si+T{kIFG;_U}RU-e=qFc-W~q(>&SM>ewLOYQDvGm*Wnnrper7 zZL*DXoa&rzm@b}f(iA&}8fwf#taXml4CBNmlSZe`*0|MfO|gHW&|GNEQd^xw(3lN5 z0PUw%c}SUu(UkCwogYEyRIXNjp|iEM zac1*lwrr0vVM@t|w|a~TF(rSu)#OOn_%>#)#htJ@Y~F-}18qv)x7Fa}RR?*hO37~> zE$d9Y{Cl2iGpT=>r#Z%imEV_64@tRtF<}kln1-8uIi}%+2RhBpL{289JQb}8eI|AA zov0k6c{s^6nuqK2c<$$SgSi}opRZ7d@?aEERcSM2Ra3qN%wtR@Vg3zYu6$|WB@%yW zhyMLbf(J=<0& zGdy3?nG%2blGc#OmvjbhleT2ea{cF~6W@;H!JvQP@(xa5WnZ#Di3nBmU{La8U)SX$ zpKN;Xl*;jwhE5y!p6FZe9slrE182R$vU zLn(%kd$uDe@0Lyr1cyf~cE|7;@pCFJtYBG@p%s7QDyF-dE0zY9MlXrq7{9;d;fhzo zZ~9*k>b%lu$X|wmecHbNxAncbK6kxX^}!!dx98DER>NmItd?)K{gJLE(B zSoOAuK5p};E8S~l8T!|(b=*)6p{9iK93 zVeORLL9kukD_De07=;g|l7^~N-4m-?t1h-(XS?3D(!ILwj*;181EWV!E)oxocyNE@ zoAv|tZ|zxb-bu5ghHw4Nib%x`!(0x7$^tSZx3WCM%Bp#c-KcYh>+7qH1&z9ZRy%U4 zZk15Bs<65s*vJH0s0k_o_aOzdd>uaObB(qXNEP8wSQ^n$yu5f#@rL5f#j0Xw)30|B z|FO95g#CSeVqf~~SUL)y3ByOkexrY~o6UnI_RM~u5;&+zFA?CH%MALa4e z%r0PN6DUn+w`KMM3&TgZ2iYy@CDmjns(Y_lbzj-3ZRb2P;>?x<&%SpxAKi4#&b#k^ zVsuma?XS(8`TC}$FxJuK2pZR~QyBCg} z=d-#(W5!&2&C~p!tN?_1MXTN3CcejXr>+NQV>F}(qfdBmcv_O%udISinV_^IoVpTu{gxb zr-ZBWxNvxj%flrlp>T1rBW%hJn~c<3AZYV~K0-RM2GoFwn8lC$RXSZhjb@^DmbOE? zT)RfA(mE@Svp-vv*dCYK*37Zt;|!2&4Y*g07PqHUj z|L4D5{OF~p_*}VqU)q0qT>tb{XRMs3xEN`KFuZ@{mak_2@e=y95@uDLh>@#)f9lN8b?m$ zX3b+fqqn3Zc4C!P6fIV--fGJ$;V2Kni^CLQG29m36BfeZ;z)luToUo-MW9ncb&ifK z!q0AYWU;KQVw#o3s8>fx(8(*udc9Q+uh;4D1|4=QCB$d5T5L9}BLevB4vXFHu-i() zdCqXq64tY@E-x6=>va@F!++-=E_Y0FBpqKl1P2eY>+Ccfv(B>avNCIm4Bsl-iG2sT z8aBFTYqW{4J!gMk8xap3Xg$=b?25N4GilJ-BpA^|*P8?01xnK~3ARX>NN_g^^BGQw`j$+6f;ox_}yYqsA*u2YjM zH##gixn>8cO{bDDTx-?qt=cp^Vq*u7FY_o*0U+EbtV4ehGpCQBOAf1p+UzQ|Km<*Z z%c2ek^i-Qqt;OjjmaCR}{ho{4PgY7zdkE+M=iA~!kwi(+@ZD!$B zN<^Dzmu!+Jlk$7=_vEYc z*B0gH7Z!PgMbN7i60Je&*HVLamv*oAORcO`Y1gW>TD8inR|x?ZC$V^Ed5Jgf^m<)R zZ@}pQwb=uyfqzQXR)Ga9DnamBEf%ZQQUv%MPK$rT;iQBz;&a$74u_pGN|?`TvskS* z8n&nCMUu}E1|iHEW`d?L9CY!&K)@W%QHOK%lsv8c?-UNw3MW8XrOH>G#P1|dsU+@{ zs%xs9D`Ih{6w0r5O5wt4XIL^6`HN;1EiYPAw4vzLqA!ayMLX#-P}oUSvfHGRxJ`=1 zZTx>$o8*ccY+owJK$^EvDIBLMx~y9jus%gv`G534q7X=_Wc6D}kA+ymqKZH@QME?( zs!C8jMWQH16PW^sGBpmjcJ{S)9{R#5?sxIi{GG}_ZF9gW_IJ7*eTr|=*}C5;?ste^ z;HZAgL^tcj`o4Z8WTUx4+O%yBHk)AWCgibPJBQ>`aWs@Bf`5pir*jZcQp7@sVe zJiYk|x`MjwE}JW3%#BaFj&AHz`SWh7v8Uv(w%Ei$V~=m9w6?YcLyU#kNxr<&j`bh#;EgH?8s~EuSYd8#ae%P zuP}|RKoM%lY-#etS@-!LE@R=W0{<{!srh2pMeY@rYhCLsx4It5+Gx4Y^=Ry|tS57~ zShl&g`(DaDRAJ2~PEtbHoyK3f=w)SHW$Vix&V8ipxr#R{KB~|Z<)!GOlB*yVEGWne z<`tQ|W_xi>5H-bwRq3_SniSb5O(%ah6d}7R$aLBu-=AC@WzphcdVP`QE-~oM;uSdv z1cFkIEnx_fSTGTs7@QT{5ZoNx72F%t1YNcEHRVAyukTQAQ14RjRSRn8kdmFpmQoU# z(0@SL`X`Ze1iUZNryM(qwf6CKRXL4x)C8z?Vc#xf$={(`{tAC_`71c( zLt9OnGEHVv46U7+jWo;T>CHRglfQyl?%_3^t)w*=&zu(GcH(iz#rTonbO1VIA+fMh zmp(K!gf&00=T{H!dwb{&6IZO5y(OR(?b*3=?wYirdogG8bHlC~`^3D{F1}#V&N<8O zyrbjN#|`2QP3P2QJ50uGgR6h!*K_*cP;B_$7{!UhPCs@2nX|YTSSs%o&J;d|2Sp@* z3s-WFN;)y7D7d^FkByhj&Y0Edv{~~!zAQ#`fv~<+mm+f>3kS7hVc^h8fb7bG4*gSDt@L(X^toiyq3mKmQ4`UH7E#@xtAzmo#q(?`!s}4r+`x zp@LMZ8gz|hqHe5j8kwqU&1%)1P0mp*)Llp~%f8IF%)ipN!~ay?V+A&nlE3QKiA5>- z;1-`PeSo-?bhZ#@TvA$o+BmnT>~v_<--8 ze)7rF=*RKN@H>Zde>iY3ck%Fx7V6z*l^2eF?}HD%_q`83K)iQ;z%c{w0SRz%w@P{` zl;Zi!toBlwBf^=o_v2^fv+8fkejRs}3UP6&GP7)Ee6G@2c5{3wwNzSvQue6i6H$Wa z9*$qYeN|Xic1QfPu#*T&v=FYOE7`K}x9R8Ur$d{fV6iUeGJU4f1O;CWotewHz&SZ#ksOXc)3({uxOpTVU<;- z?(Cj<$%eXzGDCxf+VmKI_GHIf$TNlAR=_(FaS_E4msm_Q=^AKCfyN|$2vzu@MKTdP zp4xZd-5+%wpCiyraPgL-$8(pV_xMk7e-!PKf04t%$n>6HKeOfJH8=1+1cuTT+sy!QLT8{_t)L)_cM6?|gP32?2=jC1K@VKDtQF_qH))0oP%hVnk(pk8!zbesVe@OIa-G$Ew zr5n-~AeN?w2I--}OK2Zl-LY?|pRrRcY=ZuPn{^`-`2!F9{GKyUTlXv9+w}B%?>)WgJ;x`P z??Sre2S*<`d;d2E9y|(9+mhUS=1eb=WXxhJ>hK;Q0R_BmE+NIu0+z(4U~{lV*kSB2 z_queNJuRJy{9EX}{9mG9iYB5dtTlFB} z=l?98|KZnv-kQt>=n!51hc)lz1|W6xElAFjPHo(HG7MkXa-^-1k{E_g&V!L-uRtRA z?`t00zHL47mVW_&<7USvAO((_Wv1^2XOHunzBLWKzCPcsssmLgtH_|6^7xL@wB||G zf(F=-#T+jKpw(h-XBL`f7(&fmTA_im&Pufe09KKIYHLD-$4zQkxXvV-K{ZsuCoIw2 zWcup_Q&=gyEjR?J>ApSijRN*F(?YM(^v70!l17QJ;X%tJN{|Fk z{7N1>qrOviK^-i+tX?W5mQ~(Wv#4%S<-y|Do1M%tju zQV<@e)9ukP5UXkkDRfX_7&;K!*q|z8l?pb0mb=^rMnD2qlqgUkN!ruv+3CS44+{Qw zcushno^VsG+M{pKd-a{VW50evKdWEV9lDfC+%`^FEp35n+QVt2E`~CLNTu2Z{qY*3 z^9obB4@B~pKsbM?FX2vR^Z(HobAxRDQeU;Z9$hMZjcBq)tQ$*076cu6F0g5|)X2Mk z0+>G5q0!RZgtQ3Olwuo`<5=f4w(Tnotz0AUETwH{RU%)SGVt41EiiLv%6#2T`!v zOlVS4GNn1vBI#b~ZzUJ!r|0v$<|llAp7~Cv<`bjRCPC1m_#rF{pL#h;_?~7!Uig@DIR0;n)FJ)7Q7JvXP{&|0oo_9pKk9jEQSp@(b z`|%#ofhEi|)k3ufCQuWpG&PAbsdj3bhb{Lt`*ub8svU9I46(V~CdUe~=*XR|9A zo#vVro$GSeyIUq%_H|$)oY>KSHgV#lHmyaV&{Rxe;SKED>{<3A>i{gxnk>$C1Xz{| zXhNB6nP8yN8m4u`G)<0aWzF^WWFy^(HFnfBHrCf^%^fD1Ts+VY+dDGt?Pf-+sUu?L zwKWwbQ3ARWEv5lFh=huVRgVXEwKO-El?kLjpaexzZmJi1L`?j=ydbwFe_@6Cq zXHfP4BL7;ySek-};f+|=vwciBWi@kJidd z$JhGAaGTvu+Q|u4%wzc(V_}ZY*zH~8?_EU`SD1%iEn7ahOKrVp;w{b7Ejs%7S&g-K zOzyB=&Tgowp44tlpR=ml)=Ru=?mg2wI;I)d-#ok8L>93m$6!yW!tmAs_$)Pvi$2 zX}kw`K@eVJwz8r_;TGbKtSz;oDCzOSJI`)Dd2;hJC-JV$ zw=BH(#NE4d`B!p;UH0UH4#R5STJpq+w>LcT_6fVw-ElL1Kd6F&$v+%`)t=epQuYCV z_EGj};swqXwbY|mKB~*IrfboNuov47LeMll7QLuN5OBTSoLw=?qOG+mZ-BSHHqz zYICJlqxx{V(8*<6_X&S46!4`A6U^9u$rP4vH^&D=HacQ$3oA4ZvA{GHu2h zi6aA?o|0Og-w*G#+`PLG1a{m)!SJq=Pt9E%<|G%Vhv#q2rL3i4nIQI)f-O9eAHZ{X z510ynXFkGbqLVT9dawX2nYvBc*76UnZ*a$^e8{~kzT5W8DZk+cQ@@(>Id>_4^&eAM zFGq;ZHqR896GWjcGUYLCQ)(aOoyXnWx}?K%)+K!xKayiv+!v%THdUxz;Ml- zpw5mVH~^1@I~s1%jY>f^kwz7NDJf$vSWyWprD^RhoG2$%@7D@h7>fvic9aXNhUnqJ zQC0x0u|5Dc|V znpl#SVI*v%TjgdM@RJ$K?LtP_9tr@KWe-PIf0x0h$mmbe!+{8J5v0v{BM_y?XS;vdlOYyu))URqw@A09@5PRPpAwa!_)ewNWu z|E(QUZ~OXNM~U+N$RpRE+_)XDDhY?>4Y9B&rQ@v=s+!Uj zQHl%c4_~wF2a7d65RSbR3rj++T%UPx>a4mtC3RG~>$IQ~p5$KPE zBiQ%J-Q)rC9deL#{#D>xflYyb3LN&n>m`D2)K9)0IN;r;;C48FTy720yhmUtnqhgT zfF0{Fae|~LOqvA)WjHoleeIHhbCasP& z^f}&=A8;(dyFeTYrjK;&7O@HuhTW9M(!jntx6kKsYm}W9^+skD(xPz{-PeFpSlXeK zma2*tha$x*ssZ9;Fl5NF80GdDG)3?#?o|{3f+F%)J(VL*`d3dwA&1S#NH&mf=&&<$UNn?ep)$ zV%B1;pR@FTC-zG_M}XGAK;JEicL5!)G1FV&R(2bQE2QF8P)kWbp%i)|FkmY?k-G!? z3uXzwMBf3ovOnTjQ-=B%01A2pprEJBMJ-U(7)1R8+s#bK?jD#`u)jQi$6ydDEW@)b!|MPj9M5wc&#@4Y z$kqx*Btjb`Zjc^AH~1`EYI-@$sADqB4hCoT!li(N9@B5Ku%2DP_OfrY4)#^J1C+ut zs1_>2mpZ#Ywy23AP{hS#(q9TpTv^=x6P4VnRCW=JXA={}MOd4bD4xM~KA!u*SFI$9 z)iwQp7)+JH+I7}MT9zbvF76*`S|6TnM-wBNmBj!!mf~HY9edK;Br`ILv8~KJ28*Cr zK-O-Bcd;wf75c61KZ8G`-(ufV-_YMk9!MQ%r`#X}p4D)Wgls#*w(GQ}(`u?Q3Ds0m zr&(HoNgl#vs-0z7MNRRln!*fdPzG&~oWUA@s-YO+1|w;d8oH5~Vze7gM#?bE_V!F` zYev`OwYBlg0%s}R^r@=o^ErVCMX>}vM>$tGF=u#MG7Hc4>(9km z>wW5T@dZ>#UBTUTmPk`cGE622gZOwabd4T4Gh&1XrAwh9iM|xFvYpb*!4M*FnF)1& z66(@GOEZLUfT0jQh$hiQ;Ti@ZdT0pIe&YtGP3Z3dZ2t9rDT#pWll{RObluj^SJ;3y ztE1~V6oawZ{D*y!bX&m)7Gw#9Lpt3oB{Ot&uqH#Bd_{&PSv^C?0>KO&^NSf;8~rQm z&nSwbY_+qS3Hhm1V>bV*K0j4ZJaz|vrS)Kq`E#a+^=6oum(4V0^XJU#yljRc#b6sl zGHhG>M}-X;1A2hU8%9kF9_zvzP9@EW)E8x%`?3K@G>`9wE>U{h|D<5|25B;i?eatMUj zkXGeagH5oBne8`&m%0DcydG|U26vryC%lvS2KNo^5$+Lf5A!OwS39izLJMdi4>e`3 zZjHcFqXAounv^vKAe&^FBxftsnBQMFs!1bStS1Izo3&U>(;}K))sV%u@2ai0+}5D! zP1e>nB(dDeN+NjRm(#9mA3TG8oXXE*(EXZL9QQ>1wdCEc~|TB|c^ ztqs|H8L#%|YU7bx`pS1wyWDizorYsb8yq>x>#8C+UT7OtYT9d3g^K& zmZ3f`hiSfc_`)|W`LtME=)(OW)-QN08 ztiEeyN7tXX{QM#y=QSYF0ziNc6h;tLg#adt%Y;`^j*ZZQ!UQjx0Nt)c3q()|;Ma%? z10bCG!ixaf$A<3(#DS5us!#L4cWCDD677j!f0pPDj%hKLpVH}dyyBtRofQnfvv-Ct zvi6(lng{g10fGKp4}v&A_do-k<~|LZp|mg-+OUvXG#VPE)l;gWqR2;e-Zg7#l@sjm zNsW1A7P~{bNMQq30pW+@9wr$i0-%wW2@y#oKtwOEbwcDgA0;S56((UarlJ9}u>@VX ze;QlxBegB{SEl?MHk37G775+DWQ?VMWaf+;= z(*>>Ap>b-S(>$lWF{&hL?fHLtU360PAEN&ddyU}%_7_(fS7|zC?u~zy{UvNp*qr$H zMh7Ae{2QbFhf5s59&v!Y9!YN%2k@9UfaT%CviZ1LmWVgH~=NmCS4pr`+5AfMlhqP76;U~&a1mRg44tSe{_oj zm>~`z>Hp(+n#2M16LA15#Q{td2T&;v;I0U^pOsNhgsw&$zzyPn`i?k&B5?q7!~ykq zq;4th!JSA4)H9GFV;g`dT*6kds0U~|UXG**k`RofDRkHxNeigMWs$T9CniSH8d#AP zNo$b>pbDM15-YI;9axEJ=)hVue_$r^P>D_~MLVWq7UuBURak;fEQb>%$VVys|IpeQ zY41F*Eu-(mYOF&SI{04u*DahFgQ-|VeFae7&KGT4v_Nrpm*VcUxVyU+cjrSwad&rj zcc;jQySqCSDDFIdZ{C02%$?26+07)A*<^QfbIBS5Te2~Vt1UF2Y~0nEfEqg z>OWju%<$pUpAX$ycs))Nk9KOlm6Pob2cuzVgcaHwK_?lYU>dWl{nLR_bC9!|`t2$Q zSo~yr*9kxz8yp#WU35YmWj@8P4xbKkd9hXR3oShAClz3z!puR_)ff~Y-;tsd_cX~;%TA9UP5~Fz z2Q+I>?DJ+dUu>ZhXaqg#to+62A#-DsI^EkZe}FSw0o}H$a`Panb>rG-_!Vjddi{Js zMh5)Q{|OhsUq4RZMtE)DwPr0+MIk`kAp8CvqVl5e|1>=C>AfBAJ@7M|;U~Nr;P;x0 zb;k`NA9NA#!mb=L_Vl;UdNUzZF-}QOuqIkn8IhHdq!Je z65T^}#Aiz&&>`~hU_!q82+{TSX$ZFsZw6vk4Dw_Df%O*5jKFF6`eW8(t~dq?YSf7)WgzTYYj$EzGX$);@#O>opK(23%p^xJO?1?oh zdqdQ=U_{4YlPW5hJI=RCfVm)}+Qcs5zx5XOHVRc=*4Qg#&`vF+ei4E}w9%IXd03YZKHSBd*j%G;B>g1;j72sCFqrl4GD8kez*$p*vpNb8ggh9vr(EPhPieiv+W^phmGE12G0J3W0N=T8L?#Q z2x$#FIt#>(Rd{)|(c1>_x@umdWcDZWL_f zy(M~vaYTp`m~OMs^*A~keyi$bZ^2xD_`I-7`F2mX7DZJHF}cHyuthBZrpcp%Mirk4 ziGCR3Vu@9W6RS&m0b53E-1}TKTOl`J-t|aQo{OWhcrHkx!2gke`v;QugAt&A)%d!`lchc44r8atP!% zx)VX{Nn3(_nSQoiVmxNNzz#A)RI;Ij58+{p+mg&{08&m{y_PJ#`!Zi}Mak2oKevS( z>-}SRQU_siM`^XCZeAlv;x)zKpZ)pNiY`AZSSzv?UYi2>)%70(kH6(GPsQM5Nr?FI zXiA`sc|RLpkmpnYeG3W(tO0^rewYjli9Ra-*q)k#P7uPHRM|f+LaM%ASZF56_3 zibS@(y1)aCukKJkQ2Jxw+C<>0#$ROD%pD60o(e4Tlb@u>!cv8Yg(!Ib*gX*)E&dXb zp?7tU!+KEEJ)C^o$EEaSFc@1Qy@v3#7Q3DuBh9%XH*TN{cID4=p7YQyemrWCL^wFy>{q9;#bW0~tyX)3 zWc*~hWR-o4nUB}05N1u89w}bTUK-vC-mx7#j=0e=wDZz);q#1hWR`xQU>?Igws69Sw2X(R)$Ea?>+Wp!!e20pu%p;)y*Ngq+zVPW3n8H$I0anXcuv2>C-YV z&6$i}?|Jym@t3;n7Uay_2~&!eb58D>G*1Sh5`M%wf)X3_&Jj*@6RW^@jCM9o(0}p# zQ)=Z->Q@tWPZXD|GVsjU+X@Vb!Si!!nQio+@yse#ZIv^c;H|FsR%H%q*qXsOWT6^; zkD*acE_~o&P0Nu8ryX+OEJ`QdU&?B#^$$*egqV6v+aU84Ga?>VgmmoEyvP-wvftlX zJgX$gTh&TD*5)b7qC>%4GRkvr$3_8Oq+@`OD*zPN zQL3_8X4!u|QAAFpMOLCL%cZ&qGU)s`*U=@%h^V$iS28CTRfg2VYfu^I6(3`XtQDLl zKwsDDidz*{Z2Mqa+eY2VKxb>zLl2Ujj=QnrfGefappELX!E7BjNcA%Gd4YO_w`FwA zXZoe4FqWrms$1t^d=uC#Ad5KA<_~gH*hR!$>*30Za=WJhk0)jJw5T zK1U$E@4Xd{2?*SrT1uN)=yxT2UTiVrgl^R7Kvm91@c=tuQoa$LyDlW)MD~EVH5ez& zo!QrsH&OwmmSqq1EGlXfl-a$19)#)&Lto^%>vbmR)UyV`n1%K15?bqcgM}>xMKNVf zER`crKegB8)H-X~CA4*WQd=uHMpJj-W)>wY*$U3P=qb34gJlJkPmKVjq{C$~#ny3A+te;ulIF3F0*Bf zz`Cc}HbfW*h6Ihu7>a3T#C{2bB4O6ak5CHNK%NO41@+Dulg{zb!KP}A+bVpy9JvIW zHd_K}yN}u#lXA+0_w10c0lK(?#0kh6?AZf1yR?~b1kNW+H&f+(Az}?Y5!n4DeIcS1 zAZTdBT`o3KHU4jC2qzXPhAQ%XU*bWy|CmZQi9eg(;*mS1K!!iD$HnIOe4`EKATQJJ zi6XzHEg;r>g)7A`>M8RHbzYid+}@h{+WrJUkr$Nc6Z;Ee&CDqeiL`;>Y!U0XROCtU za84v6wwYiUZpj^EOWz1sf(cvZyUCC=PY#C;r^2moogSFPUh$!@^L>JZ_CDt3u&pO% zm%?iDIoO1^kWyUu;e5AT10?$VQA&uTTdL8 z>6A7H8u9glDNeLo2$Re0a?|?=b#l7`@oH4~{fO+{$&yONYY0c@`&vT#(x*!a2cRny zkhU=q?Z8sE$Q(N#g>7HrN%{lHLW$juxJG$bD3NjHlel%S>Iu;S8%Q3e2~$;{)vaMxANrlfr6u~de?BR=#4OXEBNH%AGJ@x8=*G0 z7s3xUm`nYo0>mu`#O$BdPq)T6fGJs``Sk_hr=vSm(<3hMec>_uJerGV8(o53OxTp0%2<^jU+L zx6SUq`+WFHx+1Xt!QcLR3G36}O+K-^L?u)M{5S0%SO^tAwmXWq6lc4a7}l!#z2)vQ zuk1d9+g1;Zw~N@oAGDL|OHV}o!T9gIv7S<|7;nDCb6EeNv()taKO-WMmfY<|FIC;` z$|53d~w56FEK+n4lw|Q!`6bXcPJGrAmoYZp#F3x8@`1LW?>aT}ZU&6Rhbqx^BnO%O{P{{7F zz*ouc!NFH?Gr$Hu3P`&$-khD7+5d0fGT(aN6Xk&Y_e!}6L86XW7&P_viZ;s@AfaCXAG^lDLE1AyjlWT zE|Wl;F<5LHy`z@~G5}C6!ICqaU4EJEr7_QirFy=p?N}e~nyKrB<0y!y7LQ#a%jlOu zuYI{YW`!fbIPR5%42b_Y#834cOHK%)+8(vCSMmmqswXXs3682(k}Gt)R}$Zh;^X8V z`jR+@S00-Unt>Rz8gMWk7umZ%Aul4f^hGYmQM{BP8Kbwr016+KpPATYKWr9q&pwI{ zb`KQFS=3eptgBd!|L)|IDdw%(9&GmS9MuPG-QK|?6oDXL=^=`;I{D% zJdtttCG*V@hA48QKKiovSN)mRlyAW+j2T<6MX*%v-9)+453u~b;vJjO4AjRM0=<~q zWRQW;Q;c2#z-zC#Hz>Sb2xXyvr;7txys z3qMfUoLjlM)6N76Kn4iR!Fwayt8j&&^$Kn*3Z?}31NLw*+h~YFD2P{GUE^PSDZGW+ z$;e;Is>5=znx+3D8jJo`fC^TCs#XY8%MH62l|sIOPvrWpQs-tAAmtt?MQtXn6)5HW zHE{~I(Jz9IE5MNl25b+z3zfRd($nW)0U3?9*JTu3OZt)2Py0|KdC8nfY|=+-VjLec z?v#272c#~Mn+PF$2~o0aBi9AWpl1?*infeA8ujh(z^e~Du6L5>5~STV_SMAG%h;2W z1%KHa11m9@g}%21s3@4g({Pa&_?Ep2N$Crc*d@(ymU6_U2-Mf~(vi;=W~h_$L&4w+ zec=zp=L&d$b-gK6=W&gNTUlB>|0x=V3?GjS4-_NAXCuRlhKTwjhpUlb>I%_;CKm3q zDmNXQ1l*gt-mPDKNL)QLz29;$Typm`^`*+B>Fk5-&h_p(1?hpiU)E)! zm7o0X0;x}?pd08{jByilkX5Pi2u= z1}LLT)mD{i1N1)oVLnkIKT)leLf{|e+WG&HjQ0H_9{n>{e4=Vl4FsvnH!mEWlU&?1 zMFxAN@}t<)2IRisTt$$-CLg^;&Hv?h@^#Yak z_t{?n1PjL>01bjA)bu8dMdGMv98uJMbw(YpFCCwH>l(Q3V9dIUS zJDxu(TKp-(sT*kvqG&tDb)IePD1cvghH5*Oa-LP~FrjHXW^ta~KPt-XFkx;xMs=PY zotCZk4Uq%U^KeDWfiQTEd7Nj;r-wb9XXcLz)brx21gQ?ECEKSY)pO#jME>)W^WqtV zsdS^{Ci3GM#He)rs!EKY6V=7}+ll+TO9Q-% zGt|kE)ZD+f(<7z1>0c%Jql$yi)%oFy;>kHtdQm(Z0M12sgkB&^8{)4U%Y=V#qeqqr z)3l0Wi#ZYZ`eN-0V(K{&RU-d2Vi3jA4Pt4-|JC4>uA!DY1E$WG1{A~?#c|BG_7OU6 zzPlguxF647IzsEU;p%}XI-I|CWc*Hc?U7dhBdy*$isOE)MkJ4ka@vS++6ZxW1|)wZ?_>tr^5CsIBW6E|wqyuIAx;#>GyJ5o z5vTh5lj?9*QhQ2Lds=dJYWUH4MtWNEFgKnfKmPi-z-d|%z?+s#|GyQfM+Nm$l4c(j z7P;Y5LPUKOHx6Bzm^pz>`GKxEfgdQnd2Xe7u8sM&m)23C8OA(c!<1=*y#T#4gO)j& zmN}XhS2iXO8ojexU>GJ39({%~zit5N3HyYr7}WOZwt?Wb0pj)p{7~(%5#_fL=08-C zX9Ps~GlM}Z5ul0Etced)gx^N!zY4RwtO+6h%t+7#)laP42m!>fPrAOJY{Y$CiT`*& zn!|r-!1%lp^yv^KCzD&7s4H-HbQ1n(HKk!1?17M#nb=cb&*JW?2F)G)KW}nkg!qv8KkUQXTGqtbpxEZs7aRtU5UT*WKr&Z(1E2n0&kW9b`t*Oc1HcC9m&E!_$} zh9>gbi++tUp282cmz-L2-`{8Z_GrOB4(#cJv79tU4O8RR43<_6mX-{TteG0vu+wl6 z;&BmveG57qf~^Yv?Nw5sYu9oLfcnN4@eXwDO4>IRJUVlCK*GnjL2;+wHcr1`$X(IU z1pj{V>ucxk$P~;txTHmlc67%H-pA+RmZ94BhCUMBQ^{uQK_R7jE&z##Alyn`6OdeK zWbe71kwpLG!Q^a zMe?u-E~ID)>?B;Ga#T*-V-jzbm`}%2c*^eijp%9Jyk z;_x?nE>HK<*pq)x{R$d zo8}i7+n*34Vajs|u%G9B=E*GrVPy^}DDN_?V&ayh_KetQm!)?V`lmx%mbnQUh0OMh zA8ozCv?1`sPXA&>FB;u)#=)AhDNnR4YnGg$mZdK)?Tj%U4P?{i8c%|aL@tV*$PXog z37wVrx7#Hg|Icp91YnGOnXHN$0kmA+L|qM`an?9|zIjRm_4BH;(l>|CumdeKAuzeSr$cu|0*26;u~@vF|8fX|)+hyI6o(tU1A{I4$)nxR1J9&)E8SfTqA9O3>quhJlg6nA6=q$R zY4*D63-59O1mDxk4g&wV;-cA(M5a2#Aej2mS3i?W8@edlI_t@|24H$ zwx{ZW;ek;h1z8$q!d9>*3qiVk^)qsG+h%%2zDQhd&^5RA{b6LB@qcT<5 z3VX%~z7xZL7@Cb`p%p=N@ge4F)wmclWva2{8g2#@hW)m+mU_FkKU)Y*RM9jW zpQJRCsztDYNp>xi0fZ_o@BOm*Lsa#V7wz#gZM1NdZbFxoK+ZA>nnN z;bh9$jkXwLSqPeJ6_Ly;xE~1@kw6AvAJPaK_wf`4@Wih<*h;HOB`y55ry9`s)sF|r zut?4?nH0ds$;9QOnHX_U4)qfzQuayCn%L9d{7qQ@iHcT2OBRla^-TY9X-OZPh)J|$ zQt2rvF&Qc6~4mKCkCpvDtKF=lWgG z+B2=rdw+w8I;#$LRNrsU7p!o;^cVxaDV6_vql(>ns_tkh)6pfG7#pe^;X_@UGgpL9 zLc7S*e-zx&)=G*LM@NOS_v6SOtltQLe!Qj{Nn}UZb(b+|rKJcguVwy3O<381r0DxA zuh0?r7J#gIhrkBXwZ6J`hLib}iNp$I=3^_*^R(I=R!Onf#1aF;Ag5v6= zoyyrZW`8h_PtyJ(GOS{BHPVY({LgDU&;K? zuxZe{n6jBs%%r#CY>n5!)aw|xo*t>Q<{4JAzn+U1_PX#P9(6P@AJWm1lIcT}>QqaS zOV#TQORVdV9o4h@L-q?%g=usi(MB$(@5oJ|l8?_C!Y3>&(#Wt1>d-W<5vmj$t zM$M|DruRtbI7;d;p40(^oYWK7TdW`VD)w6Z#@4=O0v+e-`t!CeUc}xz36J7Kw47>* z@|uMvD*L8M(KMU2H}T?Tn;WyA{l1-e=H>k}`f^9j4Eloi8s=q@Z#^|aZuk40c%x~$ zgr!`d)jHJ1aD!*Ot-oAKU1sXk<%#PDizPv6mr7b155sr4Q050Cb{8e3BhCzY_^dAEON58yx2dOTKk_8o>F*<3c8DT$n|DY_myI`YuKoK_T z7|491KtPv&K+uF zLD_s(aaLi!yc7!DWZ<`A4~q3uuelymSZ#XV*{Q2WPRcsD*NrAyZ_e=1Uxek=?mxok z53r$EXt^9V?6rt^+CFxq>wCO0&fg4&BDv75&MPHrAEd^_5E3l%@!A*8qEaLrfJQ=( zQqz>DSq3pNl+Q~`&ADG@pR`k>OuEMnr~7-N*j6f*+GhcdLjD-agyM->_5y~6zjYQ; z*5tA@v~uvJ{Hy!RzuB73Q3nG4r9cLGCTJ$_K{>n1rmbfgyA>v`oSsQ(Nv|Z{@y-&; zt)||YYU!A239gh|_<`fn4CVh7f7b+;;xL0tU6`TY8%z6B52V`%82SrP;PXh!4zzXq zKGItyk{*D7{(`-0Y4L7}!tk(!bD3=G`l6!3z#}b+1ylK&<+Hm6aw{!3ZBA2VDPoGu z0&&gw`22(fI$-YF89FY9ESeax^ad0Bsogvxym4OJU(M1xN=_VA1XPb&Nv5dSmaw-+ z&L@6IhQY(5Ut3H%oVq8i6o(tv76*!JBL6EtQxDL|t_b7BMDacduzA;#R_u+C0fS2e zCUDhWLu@(%r1f>VhOHSX^o50ZSHJ%8%u3fJ)O{lBAaE-x<-QVrZpD^brv z(-u-;quIT_beypmWdXb>)B!ZOvI2t>r$ zDpB||{h1!cY>d^`Vw!pyt&{FLB?8xokAS6!8wZ{4Yu`xNj^~$2Mm#|vg+p1h@2}Jp;_Gq zC7n&2om-Q5avldJ>J@2dHR`Sq+Ejl;yYI|P7tTp0r$vVh^hH!}K3;dT`%YgO765?_ z!%JKcLMQaJnF2y3bdN#2Tl}Y1ii$LKHhKQxWH4KkKoKH=m6*YUMvj+8(!S&D6D_B!-}DfOPL+p&~wv^0s7g8&O=IvIP!{PbDL(?sV|7 zH58o)_%8giVzpq?G4vs+0!`^t#EMvc5n9i#_ojP7l^ALS5&~5kyN>DX>I`b_R_^eh zi?2`nP^F@?CI{pR4|q>k<8DUa+~9|EpL64|o`ufi*$lMZ@B~xuo05tY12hL~T7pyQ zmDz<0Y3!+uAYqQ#-cWMecGn@|zeUQe0rBlEBF)%-L1@tQ2r_kkJxR^!D)Etrdps|{ zEgrD%=Ypb{1NqoYni4P{mQZ!3Wu!>+b_kO<mT7^SqIj&fd&b<3$VK}GWxYysox%(DIQ-3@tY(+|u&^Gf|Y@73xGwap`docF8 zs`0|X2Im1)>kjld=yi5kesqv+@J8RfYw9#@fNfuo1irD2i(>d3h`vsFd~%^&ewCOI z(vh?249C_*T%=6ia`c$BL}S}nq4xJi>O>eON7THj`|H;^G<;=>3WL;X?HN&dsr|$4 z1o<8Xdnb-H8I-P$keI|$*gvM_PXBZbr-YwG&a8E@U{W~9`>TL*px=kf%QIh;5>tl7_)tSKh(m(wy8WsOJ34@UYmE&WXg z_tz(Xg4r@RAkD_+bh-S!&e%G)NGi|m{m z4!+B`XC#@6*K4r4j>Eq>+A8cfuct`P2^B4^rSAd-T~rg(fcy4Oh7I+!Z#bozZ`}hv z<}c*;wByH1j1k37`5Z^Kp`EJ_A^&O)?9YfIi7cFhZW?aF@gt)|2SklI%=3h5C%Nvy zZ!~vE6U_y=OLj&sg|#lVvL4OD7beMI)`Ed4Jr2XF&OI)!x-YmvHZE`O%V}BkoAM1RZH5PH<<+I#K;#PTAnLmGz21F4D_QgfuE*nJ zHo6o=*1v%Oh`ql=)twfPWkmI?y`OL8{fO6su*vf^LNWBFtkCqC#L|r3ixXmC}?SYZg${maOB@P0?e`-3sJG8-JP2$Dq>%)OT^r2(6SQpek8ZQW#h!b0bZKtL9S(nOG^mlH3wdFi_0f zjYvq|rsLGq+VFntWm}KtY98pMubxi~kI-`fk@YrAqREGt9_F^ttP-t`i2sIIR8fb` zC0rROJvqGV;tC6>B`a9N1*d6i!$_n??0>b@*A4FF^r9CD^H7$*(wzw>twf_Y5=mPA zFw!hBoAP;vx=~CX$q>+F{to^0mves7t*KYvM80;_W^*IxjCnL6=m_FbtN4{W@((A(l-dIXw-^wE2UdCmW`hpgyXS zB+E^Q^{st4%fhZU{O<6`YzU@Mc53?c- zzomJ3^tmwF3^lVrI$1n;agC_x5vuAD{@dNt=_?@`+=1|6=e({7lTgG8Xdfo88)GLo z$`M;H#Qxq8*^hzAqRf9~p__AMq~yUm8gn=#&nPvKJtPg`63F@E1r{i6XTV22Ojabx zXZz8ekinc@5LZJcdNQ<5mdrYu@FnCv#B*DO;bjjdjOKgP*i?_HyritO8<*hQt)Xw6 zz%un?IJ&Y?PRO`jELGnmi%-%&PZqj#3Zn#krSJw#+ypi{oS2hBObdk>sjxx~xareG z4erJKcz#!c#?uHo4ryTW3QyA-LV;)KD+)g z=Aq%N))-FqMc4bHB=HwmNFj_Nt+G{qjG?QqNz(+^Xl87Ek7xoY`>6(~z*K|bD_(9z z?NfWB=vNh8GAxulwDB!Fbu58joD?aUJ$Ct1hoXju$!&$jD0d>55?PDw=0pxyl5H!v zSzZmB>BDeF?K228q5r)Y3}x@fjm?;!P*A12NePR;f^BRVJk_Q%Gy9_Fpc00KFRHAl zHJ7*@!^XO+sGotZjo3-(-ciFXaaAk0(evydm1WfY%_)pw)s%ZO)TurP1a4)(jw-Rj z+C4Ek|dZGX?)tP&l`-{rsD$+-t$YkO_>(V8xe=F#1JNaMj?|7 zn0WxjRD!i8Qd4fEmYoi9l|U6m6>Al*9Ns;?jUT4s%>eM%*3;tZy5TESjpLE>vl}kG zPjK{u&|d!E-J~DAlVN)yeSEhjj|xtEObkrUW6tLy41K%uHHV(p9V+QZ3?p@(6|EAN zRENC>vcsZEhF%PzEu=Cd<1D>z21-W#5PO2Hw8Enk8xPZ~OGB|@TpW{#L^HowR_oaX zCbQJF(vkt=daxM9!I~oHMHhRpo`z=jg_|kmq0Ct36sT{~_043Q%nfBdQ}#Z*dFe0O zX;v9LITeg!{IwLWtB&VvCL=E$c;X?nwY5vqSgI%iZF^(2DW<>OY3bO4hnNB5J}=;0 zaVJtUs-g$A$8WlxTl(c_AzVJYqJU;vDgt?D0_X;pyLpGsS;%>SlnLKXYknmQlDoQnP>6PELT@wx0WBtGJ8r#kwpj3r-_-r zx{cU!x=w#SelF;SK3Z3BWU4LTk9-p9;Bm$#W+vlO08)lxPb`pQI|-G%m~%UZ@(!U> z&jYS8v>kl1jA$o}r77Vb8ze(V9g`lU65@j57EmJ#$wlJa;$)ifh^<$t`k(2v>73*D zq2McgDJk!$lT$!N!l5u@92$D$N?0&V z`Dk(-W;{-d3|o_v3C2;q#?5x11sVS#s0C2))0Mc+KNO_yWY-{REDS~c^<5(eTJp@7*H6=ItZA@+Z^O-MHlz2N`**1&)tTWsm3XbuA@3 z5vLR!>&5Dr6OY%M{7`GR)E{}4j-R681|HfD+VlIlUaUI2;kS28e5TF^7I0t;8)6L` zPB|VbcsO_9y#Ae+h|OaOJQqY<-}{{nkKRAQg@;}CLg5V$-T8(3EV8lqKUVVIcH&XL zC<~sC$t;?aad*mHY0#%;k%o^dqyOaBn)*5od$;N{rCBj1=8^N1qPvA_T+@T+lUst8zn7l10_zvQsxQ$|LAXW{z!tRPh zH3zC+mc%FG6pckFn2J%eGUo6#FQj)ri)`uB7Y<2*PQP^te4o&k=r*+a^`PQTl6Vm9 zggv}S1~bXe8$y={Y}Sc3IPWRAqs&9~TA9-lw}CtDx6mj)22WRTQA;A7X!WZrjj9Gi zim7%#l$-dPz4y{Lb)!hdg`w{dkN2xyZjs9^AAfnC#qvH@JriaMq&{wgGAG6;iI}Fj zd8dV*zU~*BJdq3gE)}-F4-`Gax3+qH2NqNbxiFJne~czk1=!>1}8hN zk^FwOr)Y8=I1!@W3!wlN4V8>-4lhq%o6XjaJ15=Drt{JChuzuj=R8O7($f{yG}M<= z+*JqKgy=h-LctrQIPu>8ICdWSGB~BbPboLfp11qk;Rvzcf3`9xYL#`66C^}Q7L!+Y z5%VZeR3_g6(&AsVLObV_c4@A)SrV9ky)H~Dip5KE0X{zQiS1aF;2x{!jvs2#ifDYyRMgr z1B`o|lA%)-+0hji0KYKtXf0#N5dvSYVx;VHSe;$DnV)}`1x!k1$PO3gcbg=U{4MhI zKr?9N7+8GD9kVoxF04}Ekiz+j8edk>4~7XVlvIj$4xIat zR|EKo`59j2K-y0tJoI4P!i4(IJ*RQhk~nA?t-szJp$Ax*dT>hqC9^VR{r);qpapP4 z?Bb;4$fO=Kni=px{QkNhn71>E&4?L`-#z}rG$Ju6l4#PILTC>j{Hav%Bo;)$EJdm$ z@$F8Q#`N4E^HMYqak>XAGD<>QDR8nCfE zVbT+5B!!TmpM;N<5)+F*7=~!uEZJen8;{w>Rpb*L^~TqoKXV;&65V`lQ#t{Se3{d29W8DhN-bDEtdQlkRj!F0YvBF zFUw2C4;FZg4z;{=)WseS0$rJkYo4oNqKL>U5IgeV&KP?oNwqwTPSn0AzXYzo&9S{d z@S%_U&IOEmVFa0&Dv^r`RN06zrm?2*#QGpQFV`>sBXiWa7VbCvUtff9<&H$}Up`qCcA&5?|%rJyWc67h7* zqvu?4VC${&5geyyQRQFA|J$A)h*$Rpw8 zEcQ+sJr0m`loF6kNXRgv5fM<5@!?w5v=FlPrA|uuv`NVkuUJ~~4=+(C8iO;YYzL0i* zCXr=Z@(wahGkM6+lpKc{FaNH$?2a}l1-)B7R1)~-?{BYx>mzG&V;x`aOdHNf300v( zB8~Amn^YC@k8k2?e8--z{IE2l?{E9*lmOpoersrmg%GhrRg2n+?@6j)N=Ud$=A=&v z*wTLnKNT}w7PpFtaexG#qtmh~%=L!BBmh+blQqUEkIPE2#fZ^yMvA`ssnOwowaOaS(%vIuEdp)76@-&I*H2(S{!>=_c-Wm5SN~GZUw08z*0{X-m zDqiJG78ZUS26^ZNY~xSFEI(?f2s`DH3G#qQsWjI4@ol0n-7VjL%n=!8)ey(Fo2($H2`iEL zr9N{*=v{jIyJ%_Jv71i(y~)M~ABlYF_X(#3%)?>w=nskiRV^zN%6SWSoiJBd)MLil4Ha zUi=YyNH>dnbI*$@kpsF4XKO`1KN*L9Y0|FY#Q6ymS+gm?xi)kg?sS2$j?vzJk?vIb zcCv?)=`tHAwlI!9lv6&vViroGE%3+Oo4T#E4T>Jy1%4&y;jn>mBz*@7itv1W^X-dM z!7KK)<#TBllF;Gvk-!bZ-_K(3dG}|h|AH$v7y$A#>Hvk^XcJ%+jwJt>;fZWr^d*KA ztGZW!UrFXWCOvSwImy|m9qZ7Jo94>e}*xaW-dfWD-0tA^3-o^+EkJB zgz_m)^4Z&XJgk9gMunfdudyPAc;Ak{J3O<}g?##g{W*fcDDd2@FhnFHX+k1k?&8y3 z#w$fT`0Xw4g20zM{t(o}$1@QX9hF}RQ_nm&nI!HxD6WjBT>4KjCo+3(V07idTodm{ zXa=`&eXkFJQGd}Cr9hgLpfRgFc7k-@3x;=|`G9|%C5teSf}WH5GX-bq5-v}^0e8AU zLnV-(1e{HuSohB>1`%)qFRD4a+_0}-e+aZ^y)RECO%ze0Z!6%5#=^g^7vkA6Hi;Wf z&XRGy^j%ax$dU9~LAW7Vo=B-J+?q&cQn3hnfTONB-;l$p8h?w!uoJmOmS9%>Rl@rE z(S4eKyk7#vc0IL`zkvDdW(@$+s774fSrzF-V7(f~8MKmYuZu7SvY$$yD?OHgNtxw> z4^)+%8{_oAP9?w=&Hpich_a4#I&yrUQnjGhO)2Tm{O6y<@;`~$f71%cB$hqC=S2=W z@0zuO@EzbFTxKEv0x>MShJofSwxc5WPd_o$asq)sGJ8BeglHi=zpXn`$SNr>7rPxO z{8J&!43sFD+Z|{$Xey=Bjg1ZY{yhXO<=FII;ZXgx$VT`DTKztW3{~)mF(yOsD{;%W z1+nQK`Dy&nc%Xr>;SJVg+wQLG!dJ(ot}dHl;Jfp5a13f2H7=WK#0F|FLe@GANJUdE^}d^k z1>NaP7et%W#M6Is-~2hvJ;ZX;xlVT@OLyhu8`g&{J3%w(gnfFk#RhX3XzLI=VjWtG zmeN}L(x0clM3c6NH}a74dHV~I-`Y>w&v!Thf0*$*8?z%w1Dq$<(isJCb2Dsi=`6T; zyqL05q`*?c6rocUilCI$t#GInwzf74db+J3T+OqJ$;M#7%3$`@4Ei>e?JKMOn1DYClgeCtT*t)*4ipe7uewMOE!gh zrMnFflkZNBSs%1i!xtLLv>3h9;&0e<8F= zAgWj$4ArDiE*VXz030lyP2Dli5PGh}NyGpFr>>$EREA|R3OTeSfENkBn)JpluvFm;swG^z__3i^U{meXo68as7D@O}~~jz}jYe_~iVDiKmJ?ZLu4qC%iX)SNn^TGc@7ufJ5MPmV8TYa7d{ zB_|DD$;3(aBs*S4B8U7^(+)#`xXwCJRDePai5iq$u*XMhb#wta1Q!@z^`CZ{P-1Yk z0pgN8nMk&lN|~0h*Pr>+SH8aMspl)7%3T?2=_}t|JAeAFeK7v+e--yzu8nB}cMkUZ z`3<4mcfWeeJwbL!f6M&7Pk-*NH-87^2-2+mlVjGmP5B$qvy{t8+q{;uG-O?}SB|hP z5m(lmjYL|0r~a-5OCL88`6$jrki50vrA@gC5hROv1Vm|s7d>3brI z$;Be*mjV$PnUXU0y(tl+kcf#FikLr^r1==1kU^48$RN%|WvDVU z1k8}2<`$Q`#nlwEHoN5*bWyYAE20SAh&LLuDS{k>Uh(7Pf2$q^z*-p?lj|#*@->sn zZ0(B;=-S|!g^w(IvvvwLy)yjhVk}=VL%hEJPd4tuA0laLYi@zApC5&4K0jGXXJ$wj z0p?DQS+BS31Yr<|kLgsEuL{qGejc(mAhdFzQ7Wt@)(bzkzh*xs91FZ@e@l2P@IS;k z`~UDC34fM9e~2+1_C&B*k1y!u)}6?dEyepjF6V@ zf)iV{foP%PJnAIQIH9u&#bca1iw@&HI6&P z;*s=#qDf|26Ylw#(Z_h)?`f*<#Q%+9R<_qv2hfO*5tF~wNzSLqt(*_>9Dcip^Wj|| zDS}iPe=3H1W(vM_dToe4(Q7zn4(qy)o{jwTJsW?tRBG;$nrgq;dcJlXYDd5PoAyhx zk^js-yzaV(bMUI+&*p{h)~3e9JSe_+3^FU)2S0!5+M8A^U%moB@BjeTZ`e4{4wvYP zBjgJuL!BY(BPt{qmTw2hxB3`zuNPBZaO}uBe*faecv}LR?>RSs|_$y9;q-h{dmNQo?{=n{Eed)2*$nKj+u|!~Qk?ir?O zgS?9k$%#lPn|RQDR{l`=OY+0i+4Q-*D~YsvzHVV9E0haGTq=44^@5R)TAk=2n6k&%e)Py|K-Z3EX%rSY69 z3%)|==(iMV%K?@7%7^6-}YS5w&3{6VDo!9|+CB_l;!qOCH>NUbtRDa|rW%h?Mx ze=Z+t%!jfuYpzj^!BB9P=BMLLf5}91%+?fFV=w{CYcte-v3<&avfE?zh0)egoVg9m zN@Tg@4A%9Z{^3n;p@TnOb=~~?27gmK1%tm?dY`uQ#v6B{|CXUXOjHurf9LOz>c3{` z+SXR+`_-?ZFI^iLee%iCjZZv*e06kp_wU;{&;{Pp17jq#+eLfQZb7~(e_@!*KEFS3 zka%r6Du>kJ?n9W`7l1Hv6Y zJFZQW!ODg`D~evOj;tEVf3rTWVB~ULbiQusenY=w-t|v@eyKm#KlsjomJ2M2Xa8pY zx|KtS>h<=ZmiI5kyRnU{EmjkkJa$uU(-c>Xh462OBB|nvT4lyL!}LW30RgZswsF7$ z8o~1iki);%)zD8MvGTea`iDt~0_8+KI4^i-t4{-&BBpN-ICB!Le^WORoWbkL5*jf? zScrqfa-6l?K$kQNw17r?gPXEFM=S>dAc*CA;4M~cczL}MAt$U6EJ7f>>hY;G@rko0 z<4YS&jh798sf?t=8!LVyxJ~Rn3)%Bn$t^4Bp^G^Pp z$3jNEN>1sBUaf47z7Tyc`cCZq93{lI#R#BSbC)SM2%GaSf5iSR_p)+MA%XIk@L2TW z+`kA1V+V3C3C<{r052*cIAG79!4ew8Bi(=Ll7eu>WksF=bY2FH`7B6y&U+jlWHF@X z6%YuvcX%1<5ARuA#HZ&Eq2Ykuaal1MSyYTDb0YJVrMY2cb#7~DYvb1NR%xs367aoKv2nbXRnDfV!B%iZHG)oW28P{k%^a z$molTY$lS~k=dO&ld*x!Scb@;uN$3P9LvB=CbvP{E{=(o9pY|rOgtf4WpS&xOPmy~ z2ny62)uO1AMG-}(MZHuMD}kb@yWDeEh@vp3!Tfafe@|Zj)M3nf^Wa^FBd70~S^r?P zG@t;W&mStF&^`ibbkZXT9*+=0c3wd z&R4>rcITE%%JyaUU#&*O9v%8qY`aMnE01nuf7`R=6t;SCQg=f<7Ez+nSU#TvK-t1N zd!4-iso0hE0Kb6rR>)YwMs$BF`CLI3M1!d1^*Y~+37FI{+NTLR6VL?2-fBc*zyyq* z_8~(Wk0o;)HpgLe++>cM%&}^YRdbv)$4PS>Gv6Bbh%$ygf`<{bB$~SzYNEI?pND!q ze@Y{^L4&9XMpLH~Y|!$ki6XQyj~WRzVbnAl!vLd& zQPYST6*Wz$NuuWCs1E->e=9ep%D`MPf5|MNp8#M{5B6cqW$u zccY^l%b>h*CQX2>S;48Z8W9a=KpTLHVf0>K? zB2pUg1JY^Qv_XzV^MpMO#CKT3?m!MkpuUM36nV6T{+}t+#IHVP$26S%=`RT2Mth5jy4u6{+KYukeTN{~--gguC3P3-xUO{#uHUguwDMvVp3yleBIjg6Ml&s=IhU)%^8HC()!T{~ zl#Z)K6~BNwrk++ORqGmcM6IaXRI7@fqoU`iRd{9(NN12&)XVl@!$B=>?}1Fuj-Iie z6Fp~oY%k#h3%=O8Dy{YCe|=h^N1rpd&{LU*D9)EGF7#9`MeOF`%L_gFr^|(&z&yNFlt&_Fn=*B zU$~vvzF>FLXXYD;OGsyw>pP9Z*lFO5oyJUrG`JZ4u(P2t;ZB4|DGb7r(-Cm_!Z7R% zhAsYvU>IUg4!tj~E?@#O8v3;xL@ioD8x?AzI>YzpQKR9|3g2&jd|=Yl90q|InnY#? zA~^^lJl-RO3}_dOe?nAi!w9b9ta&e2_x;QYKC{NtLz7)*`X4QApDLzTv=l#I+PLT{ zy}y6(`DiQ}P89KBEEZpw*Z-;j4)ZF)O$3Lgqv#>g?5AgA=ff7}%$mVQGwV2`mLVL>65 zX;)9hoX~V8lfB4etQ(W0^P)?JF^436mfL6wcQ#{c+C9>Mgq%hWo(m~fN70^CRhDHa zpNIt4N$TMuHoEvg(R3df5|Y7A3CP%7%Va89C}&|d&@tPE?8OMelx8-T=lEFzDT#J zys!FS3A`RU*7zp}h~URPC%vZv?}n_efBRo;e4BXFeu{dRew%l!^l#5MM-sT=6)`L&{5P~487Vs)_ymZ1PZ1eX)Q3Z5g*0SWksE1s2| zIp>Je;ygf{17Sq5LjUU(8p`D|j*PfMQHIob)Oa!FpVR_~^3RZ_1R=j&KoDr$tQTe# zje2)=e`Nf&J8Bd6-8%_3|NZ1W_d?5^zgqN}Z{Kt9hhMw;x((z+-xLLOvUvXr4%)&7CdS?IB7f_A5t}W6iIn z-)cUUw#y+_&4wbXl}{rK3?~YpD5Io@Qz5-Af8Of+M2?-Au=oGUu?wPNRA6&FrG$g$ z0=I-6etVk|r${HAM89$@7ttfb5eta0kx1l3#JW2IBf*Z)t-)X*0MtL_vKef61WbbE zOJ-Qau^oj)ie~iD3_kXr!ucX64af{LD^Yyp>`8WB;7AYyi_E=JeO>#(l^;5vc} z^SRo8R$sjH3mNzisk>JG?a;uo#~uX`tOo$Ewq|(Cvk?d%wnH8pV2NOnVh34b7rToi zWZgQ0&19SQ#4kYAXETzl7qgDAzPyO_5ReAk4Njhmq_YK1pR=gI=}Mx&(Lua@f92Zn zc8Urppnks)D8OdgRfS<)p%Ex&4+bdUj5u@7Vdom>h||8!37x?d1c2kwisPaH6Viv3 zHOh!$R{||FP;@i=wv;`!v5WzuCAiK^$}EVGGGN&Y)T_rRdtodOh9xX4LC0*2g^K}} z!@=tM0xFMU7gb=9#lfKlTihIKe@qoJI;ER2%?YdHPr&Di-rFCTv-T>zFQs0tq`p^~ z1<7Ojisjx)xqq;&(AszD`t`LJF959o1P@J)S$i!z!6M=(dXePq#Q-lBugPuBJ(znu zvoG^}=2h~y)T{YZY!s!av6--sZBn$*eo)a|!OSUk(IweD__hdvgEo`dyYj zRr-(a53-hs59Z=NOMAvm0c*+;S44LpM`R+own7dyZj`x@X)91>?>5rhD5JwyJ4(jY zjuO7QclfdbW%l^`;E-{Be{jfn_9FD`gGP5kcg-v2GH%M61Pi*&_dvZ)29t&EUW=Qe zs>FJIK`tZYav6)#>5vy}T5x)Sg;_APfRGo!1$rz|SfF)A_3#*JM zClm`%G=)%J4N^%(aOnUA1m`SGA*IO~1oPeOVfF-TXM+Qd=ZGsne>;d1Yjl?sUMjao z+H)wq4*9K0tk52~WN51y5JY7o*m0A4IgSI!#JrU?3o*o15W?`-Gct=niHQal?^U!;%*W2n8P&)(9iQZsD+S zLO3H(tPsH`e=34aKt<&sEY^$4_4XRO>{9l>Q)RA{MNINC(3YT*eK>M>5^tj{?;)%f z)yl&#AUw7(FiZ4tW+mV02(VhbAcQy_H!Or&)_?1+_Ha{ABwri*+@V8QPYq(NbekD5 zyn3!znHTI$HHEW7Puv2ZM;8yEYX?lMU78%TK4Q5Se>6j<9;KqRMRwEbqDeCDnOoLt^-zT( zH3#etNZ_I zY?uw&oc^ur%pGH54l>QNO-)xU?)VhMKl#MB=k(=u_)qm+0{~!s#d0r*!lU~c7I+9A z1t*_%(S@S`@*b=~NpkLrXauzojeY2d#bceEe^H3}0e`Y9JBX6};)Ai#LKi(>^2L^(EUjCtN8@aQuFJ`@a+q|*+n@acU#&rz@npWd$z zvu9X>tr8BMif~)b@Q~jEqUa&|Y7g|F^K4`oKr0ZyFsOjtzy_+sj=ix>Tm7j3n!Vse ze>vzMXUEIq!2muqYDi%Bj4y3*8esMoXU1N`O}L-J0AM-cF{|d80vm&| zda*9Wknb3A-5-|u+O$C!Kno^Xd-~Pdf74-1mh}v1IsauJz$3KWZCDx;bBIHR)lrfd z04F~J!1^1@y+F16S-)W$zs*aK1Y@x$0)%W46AyVF7LF6g_}9FzCf*_5;@|Y1O0bW@ z2Z;wgj|h(>9#rl8Vg9gp3>@W;dQXEB{0Z+QIK%(R>jIVT)dhfdT~LuC1yE@$e}YP| zDCohWM-O5K_ufUT3%uET(UXy1XdRim8Zg2%(rsLfaO{5YB0c?i1%lS!|Dfck`qX1C&+|d4M2(D z5~A7z+toohU%e9E2MeTE7f|)aBC>3sZ7hmXpu50TC;zxN(2eq2 z{-~3I?gD|%BB9zxQgc^u$UZ>_Sj+j%dU`C!@dt?~rmXCG^`v;>5b^lMP9JZ2eJIlU z_|%gO)*ISM&6nCI4a5@(WcpBEQSf?20jO$~IIfdkLGXG73#yj4UZ;3Yf8cq}15hEn z<9ZX4Io=abGzqHLA_5DM^zhKa0UmfQssKE!hwyj^QmDe~bykwXVTvN{Y9c`pkP;6P zuLF*FT~~B43`VfXod9Qm1Nrbs0=I$P=yr-t$zLCUUjzPB0GFvQpFCO52Q{-oakbRZ zUL0BCeI*Rx;cm-RZ962Fe@2Nrb2LLZp8+}~1;P5TVUku#HV5=eA;zef0Z{|rNCB}&2CI6BMX0R|4} zH9|$a88X73jrM4~+2e5oXN(&-V=OcoW1-0yqkIpu$1;*OUoY)5f5uF}7&8Im@t%P3 zc#k>e{l=L02@QYXy3n#TEwznhun}5f7Iivi;;_d&o_0@N?U*&zEivM{fB4Dw zyGq*Np+PMk8d|z(e`WYme@+|x$)MKR@zjsut+ma>AxkNRD*#6PwddfH+FrQ8mw=P{-ZJ`B#Kj0aAH^Ohoe=nDuFS+25Yqe{uYnSVg z%jR;?IElL7>nmilY2bmnXV_Em?C|XN*gPJ#S@-%1&CMVMOKfWjro)U(vn45vK8(tFu`sprzaq@QR1HT7cJ&84KYlFFppQ@!bV zsY}!M(08(%Q+KD`SJJE4D^sh|*U;Cq*QBmbKSDpmQa;+x3aLl#fk!o99lv9wlTBA${oa}%de;rngh%PQ#^{84HvO?Cn+j`h) z!G*h6zF;+cicrC7?TJQ%cq1GxZVhe^?g}0Xz7(_tr%Ku5T9obC@+eL_o60>y;XLHw zPyE+^;oE)m_M#$}<+||W1BPK3*zV7!IQ;x}^T1RHOoU_$t%yiL*0CnI(M%2p1`87b z21Y4he-mNtOgd%_VPd8v_&R5a0DzrcT^LzSCm;F8Y;*tMn}b?c7tGcEr`V|t9v;-X zzI1D+Huz&C5b#*-oFNR^cqet|o$j_|7O}2N7U(`@Ew!XerPiLrwd<1YIYTyb-B0$ZR;hUt*f6QId17RCeK_?$fw-uNQD)jJRG*K8~ zzQOzxa{%mPjxcsqCVLD0ApLX6mW3I*nSC()P3duIfA~dkBz#Ju`0W5jm^?FwS;nkq zc7cCkPJ`178DomfCa{UQpZPtoGiV}jbQN1!HQY-tWR^3l*yYj$v}bSt=(ei}T@ zf4mFcVLkv{i1kP@7^Sff;LYU*{BWZh+${|U^>kjd2Y~Q+Nv~jfvM_-DE|tX zt6^zoeKl5Rh=giZnV1ElUgUs0W0a*Zf8NP5U1Q>cDkbz(4K_nA9K2dZ!9dbD| zz?K~hWNI{WWLzU*$c8tCPlPSuD)G?%O%MVI;Sb?sAOke`nvwlEI$j=~2%IhZf5*!w zS$rD~)7qnn8wyv~MLF@+rSksn!fe6>?@oT8}DZ)#IMB)|d6h+K+ zEf9}@7hKlk;2jsii?q7|(L>+RqppU63*8eW2~;ZPx*S|7UhTSCbX>gje{jJ+Bf5l9b~XuULhO&N436HRRgh z+UnZoI^lA-4if(i0915=qCB@~q)rZ#mN62N0pF&rQx&~?+3~Yw%zf=0KZOmoQxm;> zsRZjrncr9((^eHDXs!yHUr%h47(M2#xNr%|I{(*IAsH0j#Z{T`4}%J4Q26Q5*@ZKV zDc@L5C>`}%zd*%IHSJWq@Xzo%OQ|JO`shxgv33M!`dNm5RVrzN`@c(g1yl~>Kc4!l zL;Sx1{|`IYm$7sN6t@Tn2>1biNFdM`LJ){ZP{0HTBp?C~7$Ugf1}?Y+6vT1H5fx@e zol!)ZfZBjc9C6gqD6Wj7GpK{RQFPGJk>tMC?GBsHe4gj`{`331@7zwGI(6#Qy|?OA zojT`KHGlxnVHFsbPCl!w@@MbuISU}a2hcu!?4*{;o=Js(UjyiWK5t2X$5Np|xE7!q z01wW)Xu0o!{P`vzKLup1J$LDXC9{6hkq=~j2B`nEpkvumM4$z56o9y3@rrX7tr{^K zsJs*Ca4ekPaZbPbt;Yef6hO_wh4VYIAEH)(oDLwkaLMvZz9Qa>0k#|<3m13J>zMuf z@qY#AP5@6V>9}O6N~Ozx21qUd-}xO&=1b4d*a`@5158}nxor7hA*KN&%FCBtFn{T` zUh6EtG8V{w3IKx!6hRPK1_SSl+3Z?OzKb^&!b97*R&SB>kC`x;M$SL+jfSNN_d2p3#`9{3`J(2L;*!w(i-SkzbC zRZncf3(TANKsa1`B<7Pw2yXp^rp_KI|6yNMDBjzR-t5 zLLasWeRwKE+xO%8r0=Kho8i|BeK=d_!%CqKcME-J5&E#{hj&{g^x45d;-%e1LdV${g`5yR_hhsCR_Dl5v%N@LMTNpVqOI1~&N_{6MO}VgZcesVlciP(j1oi}1LN9#$#8p82nWWGkMVq2U!`40peY#_} z=j$>^Zr+K={9|Pbrm%CY>C9t2OZXcFCM2cyq;H-ti8EUQNgAr{Awk! zXjAf>DJ_kQlG=v$ZgDuL^ZH3uNDTP8zebX@2l_udnbMJ=s6*n{;3yw|C&z|bl5`B= z$w(wwQo@HwRzp(FTQEw=$79ipQgl&Zspw15MUB2Bnp={jqjh+hEf)3rxq#QCB+QLP z{mE5RTGDwR<~n;Il|@>Uw4Imq4waav@sd?TCC93_2mG<%}(Y+N`z zNi6@Ncz(LP>8wE0lo>65zQ*qMOy4$5Jt>ziuRT_l!IH*?7UrZGj5?W8nlv=bI>yX1 zExAb{loUd0Wl*1!%F;|}NmGb#TvBWwpN6g3e*gclQc6C|YbnX`YMIwe4v(CiA8}It zq}R*sW=&I*LYOv9ozdN$eNx%Dz_|AA?r{O%xbF7uj+DG=Zonsh2D*2#Fbj7tZEPQs zXiDC_#+e+qwlyiXFC@cb(d`stwg<=!Q?^UwhO=h0>=FUr4O3fsD4`AQV_LTd$qiFl zcKHBFp;AueM4s{S44O#OnJqn3qwqU-Nx&+lR8R;?eqM?|p=pL_1oKifO%u}(3M&ti zKrt^Rq)VhBZUOUuQkpbvRhqjf!>z%*l*mhVgAza~OkZ4UG)!$daXcuKOi>uLVQP{D zl9vT8@oxuhNL~MO4 z2)J6E{#LH!ldI$B>Yfqs2mDF5tF=2#^7CxIt5vywLq|%!-4*c10O3PG*Z`;S zAv|m@Jb-*K^L>wdIlO#uK$htN?gC}L>1!&c;x+|NC6m%A&cSO~f?M!QOeIz1McfYw zx*tkj10x_UsK>3i7_VcR{3WKskKf`8L{W!@@*wnBi9vD&eoH7Qbg0Fvn2+_eo<)RD zK~O@<*%oqtHDaj8RQv)~yhK`1B4?u>JE)u1gJLS4XLB@Bxm^B=^a{_(bMYHePu~z8 z!VBmp1p)@Ik=Mu@r0;VLUt5lV z?7$0n1D_Kc@sM&dflMbYq@64zon$HLBA1cN$!c;x*-7@0H^^J$b1G0ZHPZ-<(0TM~ zdMn*Y_t7`#AqI99YhhjNGIlH5$@a641W||z<-#PPU05Mps)CBCEt(gOT8}Onm^*OC zz*B>zgJTDOHn?W+$-y@U-;;CXz4H5iP@^36XvG37!xdPG>u@tR;eI@TH}Eb##HaWY zU*T)Qh?Y2rhj@+5hVJWpOBZ<8-5 zp=Mf2OX&zYl1`)N(yQqmbPG+=H|d-7Yx*4vvnZ=%RcsV%XI<=ib_2VW{gSkGUsE@0X3eyLjsPWlFdj=_%G#**tNqjjF{_>5gZ_%f*x5puLd!ApNA7TF8@R1icvnGJ}Yu9|1A}b$An#u#23H zTHzhGmQJK^p$?02D|wQ=K=)uV-9vtZuTYCYasg>3cd`mxNxCoB62(XnA}T8V>0G{vt@J~`NiPZ!e~~7(b!Gwq(NP$fvR5R7ODla@F7NF0guI~ z7YYYeS96@b%8tmbvVU-nDu3{8T#7d_9&eE~*n#o*3$c*dWQriuCP9{`V+-9Tye(Tv zF7e}KxtvTGe3;aepzI@Eat@h->oA+g1BErhYT-iRazOqbm*F}>Y``7(1762H@SqTN zI2}_l3v;muF_fbcanxcI#$YTa;B+)&I%c39=ipqNk1kw-yYL{kLqZd#VK(OCT%3n4 zEW?+o7zi7Gi|`lxg+0S0G99l8Hwr6p7J`^Uj97$WsD~G8u~vQ+Gf)gC(UEGbl?D%3TUFtX@Gj4pBDl7*=2D9c^cK zBFXN5L@&D&``Mik@CCaQ1YWigNwyKaY$NuwjS77uh;l1`apqPT;&jlppHX!COZqo@UkgvqLMbVMugyHli5UnB|U>pP|`{4G$lQqO@s|z*2EfNfR{~V zkzivXD3o<RCN}ERJ#(hs5G&W^uH$I8@NFD9TtA>sSGB^t`nHBu-wq>k9$?<_w052=(p;}#vuIVAeb)yq>Ehf{o zypZ06GI|pd^d_!KD4)bS1(s#-wJ4)&F;rvS5BY6$E!1om+r^4mF)L(+tcVq{0#?BM z%+Gwx$GptTJj_Ga)Ae*6T}N+!rZ>}@=uLDjT}#){HIivtWN(DdiFd|V#@EF+#ka-x z#?XXX8BR^Dy1 z@>*u)oiQtK+^oE^S$QckSF%R(-iqX{kK|2{|BqBw#p39n(C1urRm1f1Vin0o`0$JWHlg6MCHTjxcO}0j( zQELPZ)j(rP$?r%JzE5UaF@dK--r4aGzxjjV|_oi&CuC41+gX|6B% z%~^pI$(}MJsS1oCNkbEwrjD^CheeuFS@N05+DKDU+dQ*nJ0Ul>CTk-}dP9m}YDgK4`!NObj0&P>|c%Imaj7syRFwZd{y!j>?M($|d}`xBslJp&`hFI(iqOmbMn zo%}`9SuM#2+^xwzuTrj$T<>}?mVr8SLXchO-yX>Hk+y^7X0p2_LitH!n-=Yx;d zHjdo|KTi}s_&6VYr|@~`FwPg^Nt(~2@Oe(++dk6YICi_=Kg2Uq;Td@{&w`VA7AQOm zGCVBJ<3E8X>mB%i6&`=qJ3r#_{113SKgn}KZ_XbR`41P_g^A>i?G2amz-4=&aejNC zu|2uwqJ=gdIPmR419>A8(+s!Iowtyu9rIJ6VZ0nBGI!d;l^tc;`9=E-u<0o!^*1>O9!k=~8)}JWe%8O6q z&)UkLwUs~XH0d2wFp$u=~!v^)K+V=Us*QOal@;kRAs+%51u z`M(KPiKm3SB~&Icaz^|ip0Q}q&_ePw#G$c8yAgT zwk(7E5C4{b@oV|)WwVu3`CGR9!ez^rb3tJlmMuratd`NaidOd0n-p!mM$yPzYqMp` zT9-qS>aq*L@3)+Ta5X&wkkq9{Bg_(h~j6_Ie z8CeGYl9{_Gd*6)kOT`$WgutfyETD~$5LV1r5i4t7}N@8D3N z6IS^#0r?1G3M@rX{s+nslK+8n1y&#|{{xjMl)pk1O60Fljfnge z;)uv!q6SgGvz~AsK7;-D*qklVVeAR{7iw1F6_kK8Q=uE+51SbjSyBDdx%taT(^x zf5YWCNB$eGzNyzzm4ng zGx;rCkHzv^xB*M#w{Rnt$bUgM&X@m!H40pdPWdmm2}|WSaWlH)H?a;E$ZujjmdS78 z7A%whj15>W{~5O`@aMQtK7iYBk$eEZP~b0diF^RJV}<+%ex<-WaJl>jHY)IcPFx|s zj=ONB{5tMd;3lk;U&CfxCBKGWEAThCT7C_`#WnJ)xJQBa;#&Dt+^4|bVYU1Uevj+q zS8zYBmtVmHxIumyTX3WNG9FamR&>iR;~{j*`>_pc*SZP zQ-Kd-z5F5`QQ)JvMSc+}Y>;1n#4c=*`>-3g%KRM1ZE_zT!!P9*@HlRlU%(UimHYzs zDzF!K$j{?R1^xjW<>&Df?v$U$KHMe$2~Xp0`A_&GHpzd&GuR|Qhi9=_eh$wm@K5-) z{2ZRgZ{%n3f&%++kNhlN#J%#fcnSB)&tO09lb^xM3Va2>lmCcU@q77yk9bXiuj79C zk9Y%H^3!-zfq%hPc^}@wL-Ibnt-!xxoBS01h93DT9K;U!DZGQ7@>6&h z56geRdkXwJ9+CfmLkfH!kIGNt1El09@u31g!Y;WNA7hW)i%%5zDISx1@fjYI_o5$< z%X{%To{;zA3k4p=Uik@se2HH934Dbo{;9?!{pa8!W<_>;T`gLq!v4OxLF>hx?yr)U5FQl}UFSEv71r~g-{ z|G&`bxBpkC|5vB~U!~LkzhtM6{a@nBhIpiY(m?$g;y3k^ z#DRJw>Idrix1zjC@7IU?djA3eM}4gKsHDR8@Cm)3*dt#l=v8BI8b6yQRW%!%U7Jjs zoZC#>9NU~(r(t}5I5c6jG%OmcnK?l+#wR>dF`|N!ra*9_Mr&}pj58;u9F|&5mu1L9kxZ;MI%k^J+cw*%Yi6@)y=k+FnMN5?a<7zA@{4NGxZb$g$c&HCFL64)BvW9E zh)3EYpSAV3iT&b{wj)PA6ZKq!GAn%e1aYt{MKqT zS_h*Zo1k;($cx7@PA3`#zUHsEJdP=~z6HU1G>iRRfA|nFQY~F$a)|-S^|j;M zpsK-sy>XR^d7a+i=|NT!Y|lH#xFq<3^&f^K&ci`Xw4{KcDBF~;G5HPAl0sd!N(dnq z3x%LCZo}y)o6kSy~$wE$3nq?ONAnb(V*9=@-;yi zv@rpp6l0P>f1hQTsnH-SILYZVJdS*lpCWfiI*sI|(#eCib`WbIgWBJx>yc5_NTYLmkl@tabb=TwfZ= zze3!1eSWDeqWKXbTp{j*!dq2E^oBa64j&3_=xQVSAL<$|QGKW;E!ZrTRgrH&VPTe9 z83x0Kg~G~csI<~rmqjNCNq+`mq%a9y%#S5;SGw&GI4T|*I3(6{tfHLgO-fVr{`9c+ z4>j7K9?SF=-mJm3d|Z;{N)wlJoO%amDYSc(VfY(m+|K4WKuBcpHJ1!12q6edh?`ID zZ`ux*H7E!re*}X=%0(}QLq+Yvye(Xz9uhx5*(81=vp+5vkN%FXyyOxP(kH*i2);xf zTv9ga(c}n!&avk&*+o21^zfv9B>F4LLqj@1=?^+BSlc{h7zbZYt{r{`|AOLu`91cL zil1pKBU^VEXm((?{1updq$j2+9<7zXLXms~h4MdPf06$Qv;5CTT>093O+MW%e+yCm zs>hul<26d;ucSb+%9ZcUFEA|8cw7dQl0sEpK_K5h(hwb~GN@E}j*&>w7apkyj?A~0 z|9Ur3!$zX3)2}Rk(~m@g>pNxe*6BH@t0-?+At-b46UrnK(D^0ewEHCz&W%ba zrBO-Q0wKzVL`g|WN#rWjW-d~D;?*##MKbF>Mtj2K(OVOG4lEvzAyJT$zn3JBAyH^@ z=@W$}r#CRlQlmP;GocC$x8${U?z_tf5AM4oJ1_!kdv@*%x$v!`At5Ptag7w zXR>;EEpLKmi~3Pk4#-dJ#PQc|C1z2XyM^H}SMcI6KH9Aoi`9}<9WD$Ph64rEY&Kb} z7OSPI(hz4KT{ZuXiPx068+F#J=HJnDb*X2pXqnnjVlS#Y?WWBQ5nEB+__dqqTl)vU zf4uwh5pn;9k<*v$CnCoSHq=jFd2!#!fITqyPVcUZUmRIr4-$VbAHjzJ_L1-{oY>xD z&^S}_w~|h;hDPg@oXv)2r=ZpCruQS4Y?QQOZmv#zLaU*iq9Pk515v3cc|w!<`Ae3; zY1&N>Ku;Gu3YAuqYp13?^eX6Kr7ud^e^{W`lLZio_&8k(7k*7%OphS(o3{RXaiCv3 z(vL)aqQ75Jn-B*^8tTeyMEv^5zLPQ)xqx+f`P?~cJK{; zZqn-P*&4g>?f0{+MuW{}Fj|H3>0JBeY4~s4wgBvaN`(j+ww<;_S|qVJPahHrf3lrU z)5roA`mVX%rEJBf{sKj6!GcBUPq0W8#(M;c} z9w&#OMGnaWAv1Sswb{9j6!~r^e}58l6Ww5rdV?goorIhb}>s z+%hy##cz)Ad3vN@v>0k@YtcozBCW&x@wC!5`{Ti3qiDQ394Js{sWXdIe@$ljQfDD+ zfUf2`{OD^0Uv*9OK6Kgn57^b(Tv2abw5#K;_rfzT8vOI_seUfI3orlR^Uj5nix%H^ zWt%N4+bWjdGy5;y!#kEOAAI}QAb3iCParB4YKeZw;#z`~{FPKySsB+44^9Y93^mkV z0QE}$b+xw%x5j@_dvE-{f7)Hf-PY%g&zt(JZyEn;{ml3;t6Zk%^&U1AID^&tl>9fz zd_o~U6o3m_t|c;DlH2n5`0;lbm-6-f8qy*y0S@P|B-%h zfeain)Rpz?4Ru_JDieX51!-04s*VRkMw6flRR<(uRGB3bjE5y+5)2Zch~=suE)t2< zwsqB_wu@NOh62|yigjSAs;r4uhr=1;(W>MWAq~x(w2YW>`K4c{7JpQ#vx=f=7F@zeSNh_YZZ$|PTPC!)L(#LAD5Q!A)@%3RFLD;x(c+#_Te^FtoZceImPD}-(LKj z{Vm(4HjSN&!oo#ibOx)PzJSIg`hpg(gLvJ3JWggJ#3uy&f8>y)b&nK;Y=lF`6#2WP zwT{eoj1;p-)^55Q#dPt*A&>>3V2b?pQPCa?3E4w}2p$*2k@|spv45Z~ErfbK7s5cl z*q=7y>J(`xGO*cPDy>W9kcds|kcd<5mWW+rJ>LJQC6P#57ts%m_dr46sr?@)$jVqd zX%4b-;teD3e}4V&&Wq1KLkinOz44blxAxw*>Y8hOc?Jue$mfBuVQ{|J`?rUm{WcyN z=C>H^hMS)I-OXDYMVp1j_+$c2+ZJpt@_x|g6_QrhW69C~`02 zW21hOm{teelcG+W(CG>Ell5QdWxb$Jk?4-H#>KW&e`W#fB9RE!%xQE$SqZs+!3ScS;*8ge z_1CLPBiv;uwMDMKVxJ9~W2@qqZCzzY_MJ%hUuBirSz>)X|E5jfV@_no%_JF>;U}jQ zFcx6!vVlK$DSqbQA2}RNmVK+NyT2oMj8@3caBpMttsi;cCD#x34K2Xz6K<)0|A(PG zf4QE{8@P+dFU|&pR$&8NC`2VWS9*L~$(G0;v!Bj6kgZx*(jB?Ww=uLS@=!>9S#V`& zS>(dly6knPHNkZu%`|boxH5aGxKzK?u+*3}(KpFIA=nhTE?-rt8{r%7A0A4SjEFSq zP7^iSGP}>^cZQrL&a!~6B%)a%J{EkYe~gXuO$c4&yUy2Lew*)J-@`slRO7PPBY@jN zHL3_9ZcVu_p9PBYD}9CT;;^MKtns)#6_u414YgLf78Y- zY(rg{qNv353Xw6C`ic1UYxP5^qNY5-sKJz-V+=<^C8k)6gt7xM5;YXZ5X=e32#&4c zS8)%stE;Q6t*tGj9}+Sbah9@p922zBUpcHsQC@z%zp^I1jQ9z<6gNz~>*;&1xwQG- zjse9*dzuu_nLKjr&o3U_LGGV&f61uUyVnf9GBqvkhcCTjPT8Har>>dHMNVr1uJeXX zUVYRu{=7Qrl2QB=wtP@HUD%3R9F#7JnMfHDm<*<}m@U(-^G)Yi7L_hFEwe1O?X+eO zbJdhjv`nm-X`LBA&$=+a+V!il?5YZ#&sjjgH2D_muu5ORqss#`I_IAuo5F1X~+dh{mjmOq1A{_J6k#p<$IG6qvCY3o8;7a1~`GK+Mf zvNG_G*=#~pWld&1R+i_&e^M5YR~u@oD%qcTKU$4?D^*Qj{_~FMQg}?Ei- z4VK86eT!z!9zXlW%GDoUzhCf<;3E0h>##Yej&6;3V`t16*K+G)gP+cxW47q6WwY7> z&hcArIeW|HgdgC?-GFeBumNsFNv`C-Is3+(8w@uZZ#1nnuk)_+8+H3{D(o&^SCX4k zL<)VyEz8RX2qAwx@9M#NPT5E*&fC>y4~_}0oig}RW>U1&&N*+=qUBe8HDe5)72QwHzWt1m ztfZm{y&Vdw1wO37$$(ojswR zPN`dKa#$lqquWtk$_F^Dh{WUW(!v-@#1dK(35S2(F>i`2mg*gpgmVJHup^Fe$OGg! zXpW{JtaFhsT(XP0Mzb)qq*=RJyI=c`_OMo^jfcafh>0;8OOa8MB@_yRc(i94%M4!_ z4jY)kUNf=NmXTaPk8yHrpk8e2>Oa!fmCBnV3@Cf1D>nA=Bt}yxWg)rNn6vcmHF)faSLhfimAZ)KjC>RFpl!Uc*s?}77 zVxcgiVzfERqP)MO!C(L+EEa^}^f_s>bF*{5Vuz@lXXJ(H{S17oSJR zmXx+GZdoYu=&u*+dEjQC{tSFl;;vsH-EBcIEdxwrMFLjw%u;P83q~_YvdM=$2_noxzjLwEAe+Cub z370=XvHS^&m2|c71xU|VmQtEoSgaW*eP}&OyM|`7N#K8L(a;1_ zrQLX;tbOmC>-%n=eB%cCTZ#JR%a-q%QbX|W=~thf78Uuq$03?X&*1Ix zn&$OAH{Q`rRNb8wCY{6cgx79$Pg^|y=C+G|_3}5qA~MWsG}?&Om}kiX!OsApQ`mq8 z@&_r`@N3IMWjic;%Y?M6kduEG$#@73pJMroZsLyk-EN=X?TA(?B$Sb|;;OQ;$|`rX zehepxx`a1D6Oo2QVoZa(KJ7>3s3RFSBJD)vSc)?~L?oo#M^{9OBEh1fP|zJ25$B`^ z)RNjrb!~0D+C3sr-~l08du2EpjrhWjP&g7v`waCXMr3DeHC3KqwI_erAi2ENn;Nz? z&~*(58)!p{?vb3029Mvb_moqKuBU7=-A}2G&Y_)@(Z}c>jO7RS(;H81T}u4?NLyE= zUh&)bjIHOMf?^YLsLz;)rw)~$%>Db!f2wurJroVlz<*y+CihBOohf0Fbf!dEO749$ z-**)1~=D)JKN6N{qQ38LZZmr#`O<_+5oVY`jeutpcwYBk&m)lU|QX!or>Xgg*DajEx< z{aot({}WOEl(c>nIrX1l`19SCQ=+HuC`SIzl{mzx(7r? zCBAiZe6#3O3m_9-d7YLj;l_5}fM=go8uk8AW5^kNkPOZ~r9lKXKJ4M2Atk@_Fh_C~nHx88i`T28x?-bFXE3^Ry^59*QP5mK3yQ-91);FpTc+rloXV=2 z%F1|+yDUegW;UX;d2Q5IY_i$RCbzS+D6RS;%@G#C3)13ilVj zQ+T*gRhXjhN@lm0%pr6gd5QmIL~ywTN(Fa{u8@B$MjsPQf@iYvCF4Qk7e>KoulqyB ze4NCs6lHr=Ussm?YwNO${cVv*mreY@!NVj9mD@6k5u@0X^@)M>zB=Dps84H19znVO zihb8>N^KF<72>{#?cZy;uKzPt*>z+ekD`+cy4ui10^~;;?3jilo)cY2ucCrDq#bn zq*JnJDABs?F8T~5IYjMr5{pyF(JP}Yzu1tUuQ#}JLXq@nDk4S2(W0VA)E&we6qc+i zmX#$icecZ%l|pe{baHe~v@^OcdN8VvI!Yf&C9nD!VW^^?R8(u%V_qd3z$(TaU_eQAX65bB7=RFr=p zCcP^`OrkTvy}wo^%=W)lvOiuR6>r}kApd?WoT9P<0$n_C+s3qvIUJ`fdT-Ok8@aY3 zHOiO}tVc(l5=;A#J$+m!Q!JDZ3JZm;$b+36mE`AiPur>C1Iq`t@5Jv6M=VF|>Sru( zif`EPiara)=It*;<;EW>S@5*o=Z6GMiOrOY;hW<93cEA|+Aj6LS0 zWv^|wU9(m9ka(}*H^$$Z@3CyNJz&?IZJc6hvuzS@Gu~>s)AlR7rqS4FZnS?)w4H9B zp_?I|Y0wnghU;pK!_0NIGjtQhMuR3tovm@Iotk1@p|Q}Mr8e7%pfT$51Y}u5f>s~O zX89o=R`a18o1wzRrcjoBhoj-r%qBYz_4BZ|624ImTXZQGkAv}37i|r*S{}A!yYvY| zO8#btOP>%^^0zw-wuFUmlIDM#oC%A~;!fB&(5B>fcIfQ9=o6l*Qt}(e@;L^c{{v68 znbgSBJbl8<>!s5pQhu(OF#GZhql}(B!zhxHKiXlmC-O2W<*8^+V1-0mpuNubGcyv=I|k2MVAUQB`R%WK~nX!OUY!24Ue1U)=co;PZbZ{``%f-#G2_ z$G3k^vhIESb2{$#gYRx8tt6l5NXzEI_wMf_;|8C5`;)-~q>+!U9e^-X*nj|HI4s!& zhv3Zez-x3Gydh`Y+34IA$u2PzrsU5h@j}P74qB)w(cJ2|%}a+YrAWq7`f1Ck!W_w1 zMp4Bs3cwRG=z@tL4F-R0T8*YSq;nCMqbx=|deL6`&GDe!P^gGUinwRn24#i^r5r;d zC~0+xpp>KIHfd|-oZJ80bmE(xJQ(zET;8Dxtn7M*GI7#?pCnK9bsZk^(bl(4t88i> zK7H^zlH2y%rU$Mbe4V^AxcuZ9{lbk?t`5~Yj8o6LWYoO7dB1=2c+eBV2E;Io{CXGs z@;>PdpMO-uWVMZ&89%q;!U~oZ8D255VuquoV!3a5^pf~Z@q0@isCX&-y7yJz!SL&` zFT#3VSXo%mTGLpfpAF)w{E?=>7|I#%~BpPjCjPVkPBfF zPLZ~USGv}@s4GQ^B>t29=7P-y`wI>i2nF0E(di|Tl!=E$D%xu&E(Ude~JnSBCu5W+0e1so4-x^1I1#o4w(ToTo|f4He{xywg2W5M$FN>4y?X&#;Thno?Ck7 zmd?Si-#>rHl>1iVfj>U4kS|HB<>&m`!TOuKd^pn&2sWa8f`Uv zOLk5~Djqq)VbiHhAj9%2%LA;mn#b7nIreaUeYHN+kmJ*8$4tvvBb2TwtPc4bm_Q3P zekI^OEHuZ{>7gFSI8#Wf2nWK_=+5Gm#p{YU6>onlRu$VD@7hhg$K$?}4)yno{mOLC zMBy`G_=q^5SN6)&XYA7Zv`XNlqMRQEBFgExQ$p-Kq+vFBD39M}c4y6*fK+wn3{HBF zwlI8b+m_v$UQ!KKqWbN%YwjsMz5U!Rqt9;r;HkH+;k}zK*>m^ZkB)0Bzy0M|vtHer z6h?o!xRBoP@TmKB>pCjWtn%tz?!xZb>z}`|oELq>1M;(edH3Qm3p{2=VEp*i*FM4j zIS)XnSG4NQQi)ER8|Oj90++Xjhk2<+73Xn7quo+tFu3gjgU9KhT8+k@BAt(jqTU0L z6zP z2QL1j5c%64ujt}O)tvITQo+T}L+TG)pLoBcU#q`%e(U|-r_G^)nmBX3tDPIwYJ-0* z?LwJFGc{M)&1Re3Z73;E8?P}ED@H6<4tI$@I~_YJ*5>79Yu)BKrv9VTNAKk!#+cX%|K$=W&EPVGwVI;~1;uQW)SV7QIarYL`x+RSmuaQt|nb;y-4Srip=iap5&KKtF$hb}$M zf}TBMS=MJkJ1cvXw!i0dq0Sg0jMT6R(?9H%L|qDSR3KTg{C ze|JEl5J*fidrhR*L`;8SQAMDdtXijfNhPQrCs7omkxYe+oRdD<(BIZ|nwnKLDkWKs?$7V<-zEv;Q_YWveyK+=oHFRd0BgYRyL?S02 zh4`t%4gZ-?#(j3hYi~-1&uU7ROqtR0C|yMzR)@urSpjG68G39^BXY_p3f$@^pGea)Os7 zjy@@jIu@lYU}Z;NW`8?jF1`-1L16>z#4FXUV8qa&?J&1nmS%V5EVZap>?8V-j%lcl zX>?v@)fLe)R?C0?c`UY)U97uEypi6(bm>u^qn(}^)aeL#iKQkJ0T*?Y=>?T1KaU#p z9uSRA^2K$MJFb)Lu4-La;J$dkp4N<=5a4j?!?~kNvnS4_$8?Z~8$TJsZ> z>Adyn&~uyLA186Yd1%El6Z25mkPRL^Kpz-*nTH7J>jTs2wY+mLWshh5Q(2vwEY03jx_jn&DW#O!lcZ9Iqc(LOm=PJ``m(fQEDSv5q>BiCr z^0$;eUGaLw`xTm^f)ss7a)iqKp-_Rppvd4hT8nG^s3|6_Dpwn=Ns)J?8RUi{WLNoF zj@Hlj1eZoxw0J~rZjtFu(eKXU1$prK{8FAJq4Se6f5Jc6KgYkxzs7d*7E57Uq0~8f#EkyUP!fS?slJ6v}Whe zyR&&y&r&YOr$<~n;n4+WTztWjJ@Z!F@vF{DAJK_7G@e_RZ8PYzb&is|<_)~2*v-Gu zi<3v3dHTY$=Wv%mNeC?s%Sn-W4~P9)pP!`2JePV&2pb8f>7a?3?8UQhm!3%o9DkdV zxfx+dQ_s_q@|^PEX+_hE&MCUT;NIY)WLM5(o<|Dzsh-!oCcLdVr20gow+I!aQZ+KC zflSVs;F(UQsoJvIa?bgGI{O;F&2-nG`)*LUG%d-!JFPy}1c6=RD8(KmX_dJOgjAt#Gd<*3fGrw@2@Z?2f*q z?M%opUpPJBW|R5CZ+;SyElF@U>|F@CmZl7lM1WwnJ}Cf#SqqG#1%uU3{C_eJ?PGu3 z`N4))%X0Gn@ctu@ypO)9lcR4P82iJ%{bQ#OJd4HK9hlNT^n(vS{J{@C{17R)3&*J0 zWFM#or+3C^H-l)EFU%S@lRGGVka(|ZC^{7TZQ?goj<{4M&r~l-Tv9bp?M_@-wTxM& zEKS^_cw|JX+#-kzg};%OCx33J`XXqv2NhNdrq~pp2!4-!ihV4wG5D6Zqb37+4-X`wGVaLhA>!@i1o3M&BOZ! z)75WU{XrpqI~HZNv%@FY;S(ds4$cpz8yjYCmy1R)=yUQ; zg*QcBv@xsY-GAZzH5~C3!UpO`H>S1>; zjLGsOX`8h(fx{9UP_G{gr8#Wvb!l$1( z*wMr&9LHwn!_aFlLi^Z%th;yXmitj2@|OTmS5hZI792Jcrsq;ypY1!Ib&dU=0nd)~ zzVy*F?RPRR&mor8T-iF%2pjVR^#TA|9pSX)p=kyo)SU681`^$=SOoyQs?^m6>@Fv* z<>7rM-G2gVpc*`ax8_FETQ8Z?D(Ov$l9cAvyWs0Zsm&!=?$pkHg2U@}1an4D;M4MK z#b);;>87tb9ST>6YoZ_>N<|@R&9-jcc{MgIO-)5ztt#|Z-Qg}}6LVx>l?XvI7PMPQZq<_V%wOC*d2=I4f zcTsndeV__7!HC&7OI#%qAH?2DoQj=DoQaLZ?aNa))m~SBUDF-jJ5#+)_oe!po=!d7 zv^mw^v^(M>oX8vWUHYe4o!YA((TDWYI;AVw>TA#1tk_$iJo0Ee zau>t76Ue3JN-Em6Nlv0{7w-X~!UzZ!Mh2>#nS9~Pfru023nK$H&IUB4JWc3ktz17r z{1rDkLN2g*JiRA6e1twxb1|i*8F>++Ie*JHWy)O#xz0NK;(=9*F2S;<-(7TDmAwA# z=g*vZ{_XXL@4x?NKfC|_!^EK{vB%hT#f+M(lUOfv@i(fcf3*w3ojV~IoBinPKi}}^ z&wu`>_+TCY)J@b$&!73Sw&G-i9L$L_;3_ zcChV&YsVGx$jM-fD!P2k>~iOI_g7*sZjl(fP@Cz&P&^Csg`oj1m<8$dLTr$1 zFl2Ms6Cs-tg+WKyGD%eFF~JD$0`|hlPSq0?E%dX{;vTIUkO_=BZn_qZb)1hHhL>Nu z;i{f{7F``xl<3&!==iw$JF6E>uU}EFc*B-Wog6(g|AJW$&K>>Zxc!n>-G5Q5-Zpw_ zyw0t|st-Y*3rEQ|4v-)W)|%Ctl2J_Ma^*VZR^@*y4#CSV5Jk;v_qZ0=Y??<7D;p(A z3zM%BdHCoHVY}Bu1Gonw`ip==rjMd*sx()GqEd0$+6jRQJBnASJ@>`%B(Vl4*9=N} zvv7_MrT7LA58b&IUWESNqkjP$4qx;Kl<2l`@4Yv6*;l_W^HjVLKt6vj0MrKRBxok` zyFjY&@}TU^rH~?4^x)Z?%e!+o3O^Ev{aIKoRwwFG)!AfoTRfMTmda(9iOY2N4Fc4K z7J*2Mb5rjn-pig!oXVa_oXI+;CZ=YW#g{d27B}nmc(bkp%aOUqy?#vy!o9e=VK|#AMFOV}CA$>urB$Rm>ytM&RoT zT+T81^FIsI>2n@;_}KRLl4B4GLxaJ1R>WCeE-N4h!Ejkz$cveY2@I(hP7R381S+b| z7QQG~TF%}c|K{xNmlmJ;axkG})$vLIl)4?408E_h9Gt`%!O7J(5dO3*TzVBQPGfWN zBGb8cEDwKhEq_iTokn+!vB%-xj(x8zc=|6`gA53l)_*p(aJ&rX768#_Yf>V05(GfE zneCBok-j65jLWkCp(es#=vFu!SFH5qDQtl6MQSbTvzxyVvG@>P18mya5Y!lJcRo~RqP_MOg znds)?V}G5nvn$uxY38)rdV8d@t~OZ_wnInt6w?4*_UafJjJaH-V@gX)A|cUUpX!&* zXmf+yClm5ll@$@SsuEpS_Ei#EvUzcz>>{$y7k0J(SIzNKsW$XtOJ{KMIq! z>L?6&f>EnViEX#4T0wU=n7utTA#$b*p8=}y8E_Qd2lm4I02baVp)c5ror?qg3xXZE zGC~d_NyW=QGQ?F{d09SlG zHGik6?uO}I_~qQj+L~#d`1WzE*ugK!o_V*->gt+hTzuu|PPChe$IUBdEgpRfzkaxL zenskf>tX_q0|-_CK+PxnKr38tPI=q@wv*Uz-|r-zaSqrAoMf+~&p}-0xZZhvho=yQM!t!l7;G6kYE$U zBxvVt?y{g=#%Q&}-Eat~@H$hdh*6GIGRgBC?V{D-F$F5|jNo=-*v94urz-L2rbMOhi=O=om$2ZMtP7&lAzWA%ag}B7Zrz$V75Z znu+8bXy8zbg$mxCbBJy}=SG7pa{dkx4T8vs=!yL%&xkpi_OLl88gQ}zmLyZ-e-=W- zUX~b&a-OGsYr z*yu|i-S;{+sg-4<^3!iUvFYg1O^+WXdp2FQ=++}Q?;I<QxJVJ zA1fDFW>i^sF-FslD)44D)V6!q&rB-b(fyeRSU9prAMe zJ-A@=SQal0&-sa;7SF;Xg=6Fx*#~CA-aCqyD<`LEu1o4UO8uoUOCr_ymNq+ za)!uCxtYiv&lEjuZl>sFa$)p)7zID{B07XbG?ckx&<+1w(X=G`C$ zuBys-u~8a%rxp32EJ*9+>+hdqbTxc;+stdf^?$~}gKM3V7puAyzrJbZ5Bo2>eC*)e z7a!fQl}uLzgVBc~L0M_9YHdq5wK?pi#?OSHHxvvJKcsik`{=jm6SVDbec$zM^!>m9dtzj9r8qh z#YW@gUN|bQ$#Nt@T!08-LMr4ke)(|LG~cy z9{t5PdYV)(>dO?nRFdQT?iR}0l9D- z@P*^W{0dH&SCzf}cx|RkT$Zxs-`#R(jrmQBHCQs|=bP~|e2yXKn(ucmSWQImV%&fE zvY%QnE!GXKfq_0tnCt;MTxYg#hMV~<0;$rfTSaAZK9y0~slb4({8Zrv;zn+%xK!T; zH}gLhcryz1fQ!XKEq2B{0t>Z&*ctO67HY9G=Ap9At)}D!Ue;UhCB1WSd8bBmymiEK zQADv#5NfD)b1Uirvj`V&YAym=1X?a&F=%tf2{ev?P__C(iaG$QAc}$@3OodKktz$Z z22C2Y%dQ(@9xgN80%6p1Ic^(Aa=YO&AV8PtHF?;;ujKprH+hPG32p;_ahQOyqSk4o zyZ4ik?qVOaajjpjy}rIwcl75vxBL&SS zfMAKW@`Lg=`CsH?@|f&@>?gJpM+nkMIi&yNDGt& z$s6EuYKe5C|3>A;yt|10^Z|KH^k z{T$!Q`jr~T`d^~o*r9{GUnfcSy@Dg4y`C2>an($AeM1msG8LO{+E0&X>Z?6_pZ zQUPu?YgWY}h^uikPM$`u`r~iL$yM>bIDuq=L_EF;YXY^RCUC2n`W6;_l1Ldi*F}Er zg4?h>kVN&2u1#1;r4{9YTTQN_q8@7lHB||0#M;2ZMP{a?4OGXqfohpHP%YC2szq(! zUN{8&@Kz9jLx}c&fD@wLvs&h*oK6M$=$xTNYoYt;<9ez8tK7h*&erS+f$vv&qZ;tj&~~ z*V-Pm5lBNw*j|FiL8{EAzUb~AKl_J~POv*zY@>@sgxw_(VS3~f^i2@RwU_8-jD|^is_@;HSi{WWo)H>P3J4{74{AOjo9n@>zRGoeVvRG1i%v-2{MrH zhbQ9eu&Os1hhlf!m!dZiDeKC>27k-8k z7kn{s!RHHG2F0XRJjUy2K90B)K419tK&ZW=2xg0C0-`l^wnfS0*cyLrjy1((j-`1$ z$3}eq92@b3LD zR6-pr!tNOa)>#StukhTNFYF&=MZ~o3H@&Rbp|`VQM+^<;Elxv#9%kf8S&g%T{FWwv z2rbRcxK%)SmYLXfq93lS6q#Uj?Dxnh?j74Twg(?^W1mNYj8F;Jjr}+-Fu~}@=)}7o zhG50@$b>#d-;Kjp#~yUZ-eUTrZS0`Mt$Ae!?1dLP@plj>@HylxtMbUsKRMuyV|P(c zkUby+hs@~#5a0t^+8gsX!)9)-*Yux%5&lziyM)=oMcNX$g!{JeZS8L1ZfzI$lCWDl zp#4(wX#p2AW1fyjfR8Jm1&2%q-vW@&@LWc)fKkNjtsh53AuZAufssvGB%)~{O;0zX z6l7fk4nO^-J5yKJn9T`eeNs^jQ??oCxy z^?FrRT-T~~O~_LPz1aHU`E#jo`b*{vGFd1pF$zg2nJb$CJ=s#8`X_Q zI$iApkxL`Qs>o2}GzxyRmm-}wYg28jY(uuwHoHw}s@{zqJ!Y9sboa8KboY+)7-a~m zD1BS+tiy@F^_JiMI(Pk-qN>t=B|G_Phm&o0w!?9#6@#TFrsv&)lX7!0V#U}UN+jr& z09$ z(d+ejJ%kU+Ucv)?j0*gAl2F|q8g^3#L+9v~G)V^)xqBsQ2DG`~CG^XE!#Ebz6OZ`|cK4JBCW9ps2L!;*%(nS5vT zUZNGtUq%6O^XL~=5IK7kbQ*3AerPta?`HJkAOQaj*a$GTm$7sN6t{3?2m>sCLQ5-+ zf^+}+9Op5QS&{Frai#u~e74oX`YjGKl8vN&Ov&4PevwUYt&65`+qcZtExmPTJI!`M zcI%Gcw9{#^J(X2&IwbJ_Q~CdaSB~EhbQrX#m|w+Bv12tMj6q@*-HYvqj_` zN?PUb2gJ;L66bH@-zS6P(?)WCI2-1p$!ttXe-vlMq_{bF)kwN=F^scOHY=EzBUrj+ z)Sc!(&n6&>NO8Ag>$V#F&phUnOLj358C;3^bn`kYTc=|-O;I0gXM$@rQjZ1R&?)YO8m0OO{ zkox5qv|%|$Ln>AZmF~{kfAlM0%EAT=VNI3v&X~ghn3&!$HVJ~-4Nt%*C4lRLH_@(AF2M9%ZJ^1J^yUw z!)@qH+^(I8+vP&_^_}XInv%V)AMQ)tqpV)l4{KKS!`hAY!@5=da1XtIxbOFmN7N6$ zA%MGyr+(WphR(OB6j65l=C=Hv0sIj{KtM?|!-VGunh zf(#94LJQi^fiCo52!@#`sb7dN@ojyM!WfJ*S(}KM_U#gX+n=rwD4A%%L(z>1MOsBH|&AEun%ToKa<}HR-8Mps{xpU zgUtEOk{*8|p4_dSJRE|&$H{!><;tGX(}5*%k<4Njho;tsL&K|5twffKL_ zYp@O*Y;2oGw55!d+jG-3Z~hz7A0+e7iVv2rwe9aH|&AEun%V0 zI`LXoU$^V39}d7ATi-qgsone`wk~OB5a!_!9EKx*umDHd-g8V=k6!6&3>IOD?Z copied to RAM at startup) | +| Contains: Initialized global/static variables | +| Example: int counter = 42; | ++-----------------------------------------------------------------+ +| .bss Section (RAM - zeroed at startup) | +| Contains: Uninitialized global/static variables | +| Example: int counter; (will be 0) | ++-----------------------------------------------------------------+ +| .rodata Section (Flash - read only) | +| Contains: Constants, string literals | +| Example: const int MAX = 100; | +| Example: "hello, world" | ++-----------------------------------------------------------------+ +``` + +### What Happens to Uninitialized Variables? + +In older C compilers, uninitialized variables could contain "garbage" - random leftover data. But modern compilers (including the Pico SDK) are smarter: + +1. Uninitialized global variables go into the `.bss` section +2. The `.bss` section is **NOT stored in the binary** (saves space!) +3. At boot, the startup code uses `memset` to **zero out** all of `.bss` +4. So uninitialized variables are always `0`! + +This is why in our code: +```c +uint8_t age; // This will be 0, not garbage! +``` + +--- + +## Part 3: Understanding GPIO (General Purpose Input/Output) + +### What is GPIO? + +**GPIO** stands for **General Purpose Input/Output**. These are pins on the microcontroller that you can control with software. Think of them as tiny switches you can turn on and off. + +``` ++-----------------------------------------------------------------+ +| Raspberry Pi Pico 2 | +| | +| GPIO 16 -------► Red LED | +| GPIO 17 -------► Green LED | +| GPIO 18 -------► Blue LED | +| ... | +| GPIO 25 -------► Onboard LED | ++-----------------------------------------------------------------+ +``` + +### GPIO Functions in the Pico SDK + +The Pico SDK provides simple functions to control GPIO pins: + +| Function | Purpose | +| ------------------------------ | ------------------------------- | +| `gpio_init(pin)` | Initialize a GPIO pin for use | +| `gpio_set_dir(pin, direction)` | Set pin as INPUT or OUTPUT | +| `gpio_put(pin, value)` | Set pin HIGH (1) or LOW (0) | +| `sleep_ms(ms)` | Wait for specified milliseconds | + +### What Happens Behind the Scenes? + +Each high-level function calls lower-level code. Let's trace `gpio_init()`: + +``` +gpio_init(LED_PIN) + ↓ +gpio_set_dir(LED_PIN, GPIO_IN) // Initially set as input + ↓ +gpio_put(LED_PIN, 0) // Set output value to 0 + ↓ +gpio_set_function(LED_PIN, GPIO_FUNC_SIO) // Connect to SIO block +``` + +The SIO (Single-cycle I/O) block is a special hardware unit in the RP2350 that provides fast GPIO control! + +--- + +## Part 4: Setting Up Your Environment + +### Prerequisites + +Before we start, make sure you have: +1. A Raspberry Pi Pico 2 board +2. Ghidra installed (for static analysis) +3. Python installed (for UF2 conversion) +4. The sample projects: + - `0x0005_intro-to-variables` + - `0x0008_uninitialized-variables` +5. A serial monitor (PuTTY, minicom, or screen) + +### Project Structure + +``` +Embedded-Hacking/ ++-- 0x0005_intro-to-variables/ +| +-- build/ +| | +-- 0x0005_intro-to-variables.uf2 +| | +-- 0x0005_intro-to-variables.bin +| +-- 0x0005_intro-to-variables.c ++-- 0x0008_uninitialized-variables/ +| +-- build/ +| | +-- 0x0008_uninitialized-variables.uf2 +| | +-- 0x0008_uninitialized-variables.bin +| +-- 0x0008_uninitialized-variables.c ++-- uf2conv.py +``` + +--- + +## 🔬 Part 5: Hands-On Tutorial - Analyzing Variables in Ghidra + +### Step 1: Review the Source Code + +First, let's look at the code we'll be analyzing: + +**File: `0x0005_intro-to-variables.c`** + +```c +#include +#include "pico/stdlib.h" + +int main(void) { + uint8_t age = 42; + + age = 43; + + stdio_init_all(); + + while (true) + printf("age: %d\r\n", age); +} +``` + +**What this code does:** +1. Declares a variable `age` and initializes it to `42` +2. Changes `age` to `43` +3. Initializes the serial output +4. Prints `age` forever in a loop + +### Step 2: Flash the Binary to Your Pico 2 + +1. Hold the BOOTSEL button on your Pico 2 +2. Plug in the USB cable (while holding BOOTSEL) +3. Release BOOTSEL - a drive called "RPI-RP2" appears +4. Drag and drop `0x0005_intro-to-variables.uf2` onto the drive +5. The Pico will reboot and start running! + +### Step 3: Verify It's Working + +Open your serial monitor (PuTTY, minicom, or screen) and you should see: + +``` +age: 43 +age: 43 +age: 43 +... +``` + +The program is printing `43` because that's what we assigned after the initial `42`. + +--- + +## 🔬 Part 6: Setting Up Ghidra for Binary Analysis + +### Step 4: Start Ghidra + +**Open a terminal and type:** + +```powershell +ghidraRun +``` + +Ghidra will open. Now we need to create a new project. + +### Step 5: Create a New Project + +1. Click **File** -> **New Project** +2. Select **Non-Shared Project** +3. Click **Next** +4. Enter Project Name: `0x0005_intro-to-variables` +5. Click **Finish** + +### Step 6: Import the Binary + +1. Open your file explorer +2. Navigate to the `Embedded-Hacking` folder +3. Find `0x0005_intro-to-variables.bin` +4. Select Cortex M Little Endian 32 +5. Select Options and set up the .text and offset 10000000 +6. **Drag and drop** the `.bin` file into Ghidra's project window + +### Step 7: Configure the Binary Format + +A dialog appears. The file is identified as a "BIN" (raw binary without debug symbols). + +**Click the three dots (...) next to "Language" and:** +1. Search for "Cortex" +2. Select **ARM Cortex 32 little endian default** +3. Click **OK** + +**Click the "Options..." button and:** +1. Change **Block Name** to `.text` +2. Change **Base Address** to `10000000` (the XIP address!) +3. Click **OK** + +### Step 8: Open and Analyze + +1. Double-click on the file in the project window +2. A dialog asks "Analyze now?" - Click **Yes** +3. Use default analysis options and click **Analyze** + +Wait for analysis to complete (watch the progress bar in the bottom right). + +--- + +## 🔬 Part 7: Navigating and Resolving Functions + +### Step 9: Find the Functions + +Look at the **Symbol Tree** panel on the left. Expand **Functions**. + +You'll see function names like: +- `FUN_1000019a` +- `FUN_10000210` +- `FUN_10000234` + +These are auto-generated names because we imported a raw binary without symbols! + +### Step 10: Resolve Known Functions + +From our previous chapters, we know what some of these functions are: + +| Ghidra Name | Actual Name | How We Know | +| -------------- | ------------- | -------------------------- | +| `FUN_1000019a` | `data_cpy` | From Week 3 boot analysis | +| `FUN_10000210` | `frame_dummy` | From Week 3 boot analysis | +| `FUN_10000234` | `main` | This is where our code is! | + +### Step 11: Update Main's Signature + +For `main`, let's also fix the return type: + +1. Right-click on `main` in the Decompile window +2. Select **Edit Function Signature** +3. Change to: `int main(void)` +4. Click **OK** + +--- + +## 🔬 Part 8: Analyzing the Main Function + +### Step 12: Examine Main in Ghidra + +Click on `main` (or `FUN_10000234`). Look at the **Decompile** window: + +You'll see something like: + +```c +void FUN_10000234(void) + +{ + FUN_10002f54(); + do { + FUN_100030e4(DAT_10000244,0x2b); + } while( true ); +} +``` + +### Step 13: Resolve stdio_init_all + +1. Click on `FUN_10002f54` +2. Right-click -> **Edit Function Signature** +3. Change to: `bool stdio_init_all(void)` +4. Click **OK** + +### Step 14: Resolve printf + +1. Click on `FUN_100030e4` +2. Right-click -> **Edit Function Signature** +3. Change the name to `void printf (undefined4 param_1, ...)` +4. Check the **Varargs** checkbox (printf takes variable arguments!) +5. Click **OK** + +### Step 15: Understand the Optimization + +Look at the updated decompiled code. This will look different if you resolved your functions however do you notice something interesting? + +```c +int main(void) + +{ + stdio_init_all(); + do { + printf(DAT_10000244,0x2b); + } while( true ); +} +``` + +**Where's `uint8_t age = 42`?** It's gone! + +The compiler **optimized it out**! Here's what happened: + +1. Original code: `age = 42`, then `age = 43` +2. Compiler sees: "The `42` is never used, only `43` matters" +3. Compiler removes the unused `42` and just uses `43` directly + +**What is `0x2b`?** Let's check: +- `0x2b` in hexadecimal = `43` in decimal ✓ + +The compiler replaced our variable with the constant value! + +--- + +## 🔬 Part 9: Patching the Binary - Changing the Value + +### Step 16: Find the Value to Patch + +Look at the **Listing** window (assembly view). Find the instruction that loads `0x2b`: + +```assembly +1000023a 2b 21 movs r1,#0x2b +``` + +This instruction loads the value `0x2b` (43) into register `r1` before calling `printf`. + +### Step 17: Patch the Instruction + +We're going to change `0x2b` (43) to `0x46` (70)! + +1. Click on the instruction `movs r1,#0x2b` +2. Right-click and select **Patch Instruction** +3. Change `0x2b` to `0x46` +4. Press Enter + +The instruction now reads: +```assembly +1000023a 46 21 movs r1,#0x46 +``` + +### Step 18: Export the Patched Binary + +1. Click **File** -> **Export Program** +2. Set **Format** to **Raw Bytes** +3. Navigate to your build directory +4. Name the file `0x0005_intro-to-variables-h.bin` +5. Click **OK** + +--- + +## 🔬 Part 10: Converting and Flashing the Hacked Binary + +### Step 19: Convert to UF2 Format + +The Pico 2 expects UF2 files, not raw BIN files. We need to convert it! + +**Open a terminal and navigate to your project directory:** + +```powershell +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0005_intro-to-variables +``` + +**Run the conversion command:** + +```powershell +python ..\uf2conv.py build\0x0005_intro-to-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 +``` + +**What this command means:** +- `uf2conv.py` = the conversion script +- `--base 0x10000000` = the XIP base address +- `--family 0xe48bff59` = the RP2350 family ID +- `--output build\hacked.uf2` = the output filename + +### Step 20: Flash the Hacked Binary + +1. Hold BOOTSEL and plug in your Pico 2 +2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive +3. Open your serial monitor + +**You should see:** + +``` +age: 70 +age: 70 +age: 70 +... +``` + +🎉 **BOOM! We hacked it!** The value changed from 43 to 70! + +--- + +## 🔬 Part 11: Uninitialized Variables and GPIO + +Now let's work with a more complex example that includes GPIO control. + +### Step 21: Review the Uninitialized Variables Code + +**File: `0x0008_uninitialized-variables.c`** + +```c +#include +#include "pico/stdlib.h" + +#define LED_PIN 16 + +int main(void) { + uint8_t age; // Uninitialized! + + stdio_init_all(); + + gpio_init(LED_PIN); + gpio_set_dir(LED_PIN, GPIO_OUT); + + while (true) { + printf("age: %d\r\n", age); + + gpio_put(LED_PIN, 1); + sleep_ms(500); + + gpio_put(LED_PIN, 0); + sleep_ms(500); + } +} +``` + +**What this code does:** +1. Declares `age` without initializing it (will be 0 due to BSS zeroing) +2. Initializes GPIO 16 as an output +3. In a loop: prints age, blinks the LED + +### Step 22: Flash and Verify + +1. Flash `0x0008_uninitialized-variables.uf2` to your Pico 2 +2. Open your serial monitor + +**You should see:** + +``` +age: 0 +age: 0 +age: 0 +... +``` + +And the **red LED on GPIO 16 should be blinking**! + +The value is `0` because uninitialized variables in the `.bss` section are zeroed at startup. + +--- + +## 🔬 Part 12: Analyzing GPIO Code in Ghidra + +### Step 23: Set Up Ghidra for the New Binary + +1. Create a new project: `0x0008_uninitialized-variables` +2. Import `0x0008_uninitialized-variables.bin` +3. Set Language to **ARM Cortex 32 little endian** +4. Set Base Address to `.text` and `10000000` +5. Auto-analyze + +### Step 24: Resolve the Functions + +Find and rename these functions: + +| Ghidra Name | Actual Name | +| -------------- | ---------------- | +| `FUN_10000234` | `main` | +| `FUN_100030cc` | `stdio_init_all` | +| `FUN_100002b4` | `gpio_init` | +| `FUN_1000325c` | `printf` | + +For `gpio_init`, set the signature to: +```c +void gpio_init(uint gpio) +``` + +### Step 25: Examine the Main Function + +The decompiled main should look something like: + +```c +void FUN_10000234(void) + +{ + undefined4 extraout_r1; + undefined4 extraout_r2; + undefined4 in_cr0; + undefined4 in_cr4; + + FUN_100030cc(); + FUN_100002b4(0x10); + coprocessor_moveto2(0,4,0x10,1,in_cr4); + do { + FUN_1000325c(DAT_10000274,0); + coprocessor_moveto2(0,4,0x10,1,in_cr0); + FUN_10000d10(500); + coprocessor_moveto2(0,4,0x10,0,in_cr0); + FUN_10000d10(500,extraout_r1,extraout_r2,0); + } while( true ); +} +``` + +--- + +## 🔬 Part 13: Hacking GPIO - Changing the LED Pin + +### Step 26: Find the GPIO Pin Value + +Look in the assembly for instructions that use `0x10` (which is 16 in decimal - our LED pin): + +```assembly +1000023a 10 20 movs r0,#0x10 +``` + +This is where `gpio_init(LED_PIN)` is called with GPIO 16. + +### Step 27: Patch GPIO 16 to GPIO 17 + +We'll change the red LED (GPIO 16) to the green LED (GPIO 17)! + +1. Find the instruction `movs r0,#0x10` +2. Right-click -> **Patch Instruction** +3. Change `0x10` to `0x11` (17 in hex) +4. Click **OK** + +### Step 28: Find All GPIO 16 References + +There are more places that use GPIO 16. Look for: + +```assembly +10000244 10 23 movs r3,#0x10 +``` + +This is used in `gpio_set_dir`. Patch this to `0x11` as well. + +```assembly +10000252 10 24 movs r4,#0x10 +``` + +This is inside the loop for `gpio_put`. Patch this to `0x11` as well. + +### Step 29: Bonus - Change the Printed Value + +Let's also change the printed value from `0` to `0x42` (66 in decimal): + +```assembly +1000024a 00 21 movs r1,#0x0 +``` + +1. Right-click -> **Patch Instruction** +2. Change `0x0` to `0x42` +3. Click **OK** + +--- + +## 🔬 Part 14: Export and Test the Hacked GPIO + +### Step 30: Export the Patched Binary + +1. Click **File** -> **Export Program** +2. Format: **Raw Bytes** +3. Filename: `0x0008_uninitialized-variables-h.bin` +4. Click **OK** + +### Step 31: Convert to UF2 + +```powershell +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0008_uninitialized-variables +python ..\uf2conv.py build\0x0008_uninitialized-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 +``` + +### Step 32: Flash and Verify + +1. Flash `hacked.uf2` to your Pico 2 +2. Check your serial monitor + +**You should see:** + +``` +age: 66 +age: 66 +age: 66 +... +``` + +And now the **GREEN LED on GPIO 17** should be blinking instead of the red one! + +🎉 **We successfully:** +1. Changed the printed value from 0 to 66 +2. Changed which LED blinks from red (GPIO 16) to green (GPIO 17) + +--- + +## Part 15: Deep Dive - GPIO at the Assembly Level + +### Understanding the GPIO Coprocessor + +The RP2350 has a special **GPIO coprocessor** that provides fast, single-cycle GPIO control. This is different from the RP2040! + +The coprocessor is accessed using special ARM instructions: + +```assembly +mcrr p0, #4, r4, r5, c0 ; GPIO output control +mcrr p0, #4, r4, r5, c4 ; GPIO direction control +``` + +**What this means:** +- `mcrr` = Move to Coprocessor from two ARM Registers +- `p0` = Coprocessor 0 (the GPIO coprocessor) +- `r4` = Contains the GPIO pin number +- `r5` = Contains the value (0 or 1) +- `c0` = Output value register +- `c4` = Output enable register + +### The Full GPIO Initialization Sequence + +When you call `gpio_init(16)`, here's what actually happens: + +``` +Step 1: Configure pad (address 0x40038044) ++-----------------------------------------------------------------+ +| - Clear OD bit (output disable) | +| - Set IE bit (input enable) | +| - Clear ISO bit (isolation) | ++-----------------------------------------------------------------+ + +Step 2: Set function (address 0x40028084) ++-----------------------------------------------------------------+ +| - Set FUNCSEL to 5 (SIO - Software I/O) | ++-----------------------------------------------------------------+ + +Step 3: Enable output (via coprocessor) ++-----------------------------------------------------------------+ +| - mcrr p0, #4, r4, r5, c4 (where r4=16, r5=1) | ++-----------------------------------------------------------------+ +``` + +### Raw Assembly LED Blink + +Here's what a completely hand-written assembly LED blink looks like: + +```assembly +; Initialize GPIO 16 as output +movs r4, #0x10 ; GPIO 16 +movs r5, #0x01 ; Enable +mcrr p0, #4, r4, r5, c4 ; Set as output + +; Configure pad registers +ldr r3, =0x40038044 ; Pad control for GPIO 16 +ldr r2, [r3] ; Load current config +bic r2, r2, #0x80 ; Clear OD (output disable) +orr r2, r2, #0x40 ; Set IE (input enable) +str r2, [r3] ; Store config + +; Set GPIO function to SIO +ldr r3, =0x40028084 ; IO bank control for GPIO 16 +movs r2, #5 ; FUNCSEL = SIO +str r2, [r3] ; Set function + +; Main loop +loop: + ; LED ON + movs r4, #0x10 ; GPIO 16 + movs r5, #0x01 ; High + mcrr p0, #4, r4, r5, c0 + + ; Delay + ldr r2, =0x17D7840 ; ~25 million iterations +delay1: + subs r2, r2, #1 + bne delay1 + + ; LED OFF + movs r4, #0x10 ; GPIO 16 + movs r5, #0x00 ; Low + mcrr p0, #4, r4, r5, c0 + + ; Delay + ldr r2, =0x17D7840 +delay2: + subs r2, r2, #1 + bne delay2 + + b loop ; Repeat forever +``` + +--- + +## 📊 Part 16: Summary and Review + +### What We Accomplished + +1. **Learned about variables** - How they're declared, initialized, and stored +2. **Understood memory sections** - `.data`, `.bss`, and `.rodata` +3. **Analyzed binaries in Ghidra** - Without debug symbols! +4. **Patched binaries** - Changed values directly in the binary +5. **Controlled GPIO** - Made LEDs blink +6. **Changed program behavior** - Different LED, different value + +### The Binary Patching Workflow + +``` ++-----------------------------------------------------------------+ +| 1. Import .bin file into Ghidra | +| - Set language to ARM Cortex | +| - Set base address to 0x10000000 | ++-----------------------------------------------------------------+ +| 2. Analyze and resolve functions | +| - Rename functions to meaningful names | +| - Fix function signatures | ++-----------------------------------------------------------------+ +| 3. Find the values/instructions to patch | +| - Look in the assembly listing | +| - Right-click -> Patch Instruction | ++-----------------------------------------------------------------+ +| 4. Export the patched binary | +| - File -> Export Program | +| - Format: Raw Bytes | ++-----------------------------------------------------------------+ +| 5. Convert to UF2 | +| - python uf2conv.py file.bin --base 0x10000000 | +| --family 0xe48bff59 --output hacked.uf2 | ++-----------------------------------------------------------------+ +| 6. Flash and verify | +| - Hold BOOTSEL, plug in, drag UF2 | +| - Check serial output and LED behavior | ++-----------------------------------------------------------------+ +``` + +### Key Memory Sections + +| Section | Location | Contains | Writable? | +| --------- | -------- | ------------------------------ | --------- | +| `.text` | Flash | Code | No | +| `.rodata` | Flash | Constants, strings | No | +| `.data` | RAM | Initialized globals | Yes | +| `.bss` | RAM | Uninitialized globals (zeroed) | Yes | + +### Important Ghidra Commands + +| Action | How To Do It | +| ----------------- | ------------------------------------- | +| Rename function | Right-click -> Edit Function Signature | +| Patch instruction | Right-click -> Patch Instruction | +| Export binary | File -> Export Program -> Raw Bytes | +| Go to address | Press 'G' and enter address | + +--- + +--- + +## 🎓 Key Takeaways + +1. **Variables are just memory locations** - The compiler assigns them addresses in SRAM. + +2. **Compilers optimize aggressively** - Unused code and values may be removed entirely. + +3. **Uninitialized doesn't mean random** - Modern compilers zero out the `.bss` section. + +4. **Ghidra works without symbols** - You can analyze any binary, even stripped ones. + +5. **Binary patching is powerful** - You can change behavior without source code. + +6. **UF2 conversion is required** - The Pico 2 needs UF2 format, not raw binaries. + +7. **GPIO is just memory-mapped I/O** - Writing to specific addresses controls hardware. + +--- + +## 📖 Glossary + +| Term | Definition | +| ------------------ | --------------------------------------------------------------------- | +| **BSS** | Block Started by Symbol - section for uninitialized global variables | +| **Declaration** | Telling the compiler a variable's name and type | +| **Definition** | Allocating memory for a variable | +| **GPIO** | General Purpose Input/Output - controllable pins on a microcontroller | +| **Initialization** | Assigning an initial value to a variable | +| **Linker** | Tool that combines compiled code and assigns memory addresses | +| **Optimization** | Compiler removing or simplifying code for efficiency | +| **Patching** | Modifying bytes directly in a binary file | +| **rodata** | Read-only data section for constants and string literals | +| **SIO** | Single-cycle I/O - fast GPIO control block in RP2350 | +| **UF2** | USB Flashing Format - file format for Pico 2 firmware | +| **Variable** | A named storage location in memory | + +--- + +## 🔗 Additional Resources + +### GPIO Coprocessor Reference + +The RP2350 GPIO coprocessor instructions: + +| Instruction | Description | +| -------------------------- | ---------------------------- | +| `mcrr p0, #4, Rt, Rt2, c0` | Set/clear GPIO output | +| `mcrr p0, #4, Rt, Rt2, c4` | Set/clear GPIO output enable | + +### RP2350 Memory Map Quick Reference + +| Address | Description | +| ------------ | ------------------------ | +| `0x10000000` | XIP Flash (code) | +| `0x20000000` | SRAM (data) | +| `0x40028000` | IO_BANK0 (GPIO control) | +| `0x40038000` | PADS_BANK0 (pad control) | +| `0xd0000000` | SIO (single-cycle I/O) | + +--- + +**Remember:** Every binary you encounter in the real world can be analyzed and understood using these same techniques. Practice makes perfect! + +Happy hacking! 🔧 -## 🎯 What You'll Learn This Week - -By the end of this tutorial, you will be able to: -- Understand what variables are and how they're stored in memory -- Know the difference between initialized, uninitialized, and constant variables -- Use Ghidra to analyze binaries without debug symbols -- Patch binary files to change program behavior permanently -- Control GPIO pins to blink LEDs on the Pico 2 -- Convert patched binaries to UF2 format for flashing -- Understand the `.data`, `.bss`, and `.rodata` memory sections - ---- - -## 📚 Part 1: Understanding Variables - -### What is a Variable? - -A **variable** is like a labeled box where you can store information. Imagine you have a row of boxes numbered 0 to 9. Each box can hold one item. In programming: - -- The **boxes** are memory locations (addresses in SRAM) -- The **items** are the values you store -- The **labels** are the variable names you choose - -``` -┌─────────────────────────────────────────────────────────────────┐ -│ Memory (SRAM) - Like a row of numbered boxes │ -│ │ -│ Box 0 Box 1 Box 2 Box 3 Box 4 ... │ -│ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │ -│ │ 42 │ │ 17 │ │ 0 │ │255 │ │ 99 │ │ -│ └────┘ └────┘ └────┘ └────┘ └────┘ │ -│ age score count max temp │ -│ │ -└─────────────────────────────────────────────────────────────────┘ -``` - -### Declaration vs Definition - -When working with variables, there are two important concepts: - -| Concept | What It Does | Example | -| ------------------ | ------------------------------------ | -------------------------- | -| **Declaration** | Tells the compiler the name and type | `uint8_t age;` | -| **Definition** | Allocates memory for the variable | (happens with declaration) | -| **Initialization** | Assigns an initial value | `uint8_t age = 42;` | - -**Important Rule:** You must declare a variable BEFORE you use it! - -### Understanding Data Types - -The **data type** tells the compiler how much memory to allocate: - -| Type | Size | Range | Description | -| ---------- | ------- | ------------------------------- | ----------------------- | -| `uint8_t` | 1 byte | 0 to 255 | Unsigned 8-bit integer | -| `int8_t` | 1 byte | -128 to 127 | Signed 8-bit integer | -| `uint16_t` | 2 bytes | 0 to 65,535 | Unsigned 16-bit integer | -| `int16_t` | 2 bytes | -32,768 to 32,767 | Signed 16-bit integer | -| `uint32_t` | 4 bytes | 0 to 4,294,967,295 | Unsigned 32-bit integer | -| `int32_t` | 4 bytes | -2,147,483,648 to 2,147,483,647 | Signed 32-bit integer | - -### Anatomy of a Variable Declaration - -Let's break down this line of code: - -```c -uint8_t age = 42; -``` - -| Part | Meaning | -| --------- | ----------------------------------------------------- | -| `uint8_t` | Data type - unsigned 8-bit integer (1 byte) | -| `age` | Variable name - how we refer to this storage location | -| `=` | Assignment operator - puts a value into the variable | -| `42` | The initial value | -| `;` | Semicolon - tells compiler the statement is complete | - ---- - -## 📚 Part 2: Memory Sections - Where Variables Live - -### The Three Main Sections - -When your program is compiled, variables go to different places depending on how they're declared: - -``` -┌─────────────────────────────────────────────────────────────────┐ -│ .data Section (Flash → copied to RAM at startup) │ -│ Contains: Initialized global/static variables │ -│ Example: int counter = 42; │ -├─────────────────────────────────────────────────────────────────┤ -│ .bss Section (RAM - zeroed at startup) │ -│ Contains: Uninitialized global/static variables │ -│ Example: int counter; (will be 0) │ -├─────────────────────────────────────────────────────────────────┤ -│ .rodata Section (Flash - read only) │ -│ Contains: Constants, string literals │ -│ Example: const int MAX = 100; │ -│ Example: "hello, world" │ -└─────────────────────────────────────────────────────────────────┘ -``` - -### What Happens to Uninitialized Variables? - -In older C compilers, uninitialized variables could contain "garbage" - random leftover data. But modern compilers (including the Pico SDK) are smarter: - -1. Uninitialized global variables go into the `.bss` section -2. The `.bss` section is **NOT stored in the binary** (saves space!) -3. At boot, the startup code uses `memset` to **zero out** all of `.bss` -4. So uninitialized variables are always `0`! - -This is why in our code: -```c -uint8_t age; // This will be 0, not garbage! -``` - ---- - -## 📚 Part 3: Understanding GPIO (General Purpose Input/Output) - -### What is GPIO? - -**GPIO** stands for **General Purpose Input/Output**. These are pins on the microcontroller that you can control with software. Think of them as tiny switches you can turn on and off. - -``` -┌─────────────────────────────────────────────────────────────────┐ -│ Raspberry Pi Pico 2 │ -│ │ -│ GPIO 16 ───────► Red LED │ -│ GPIO 17 ───────► Green LED │ -│ GPIO 18 ───────► Blue LED │ -│ ... │ -│ GPIO 25 ───────► Onboard LED │ -└─────────────────────────────────────────────────────────────────┘ -``` - -### GPIO Functions in the Pico SDK - -The Pico SDK provides simple functions to control GPIO pins: - -| Function | Purpose | -| ------------------------------ | ------------------------------- | -| `gpio_init(pin)` | Initialize a GPIO pin for use | -| `gpio_set_dir(pin, direction)` | Set pin as INPUT or OUTPUT | -| `gpio_put(pin, value)` | Set pin HIGH (1) or LOW (0) | -| `sleep_ms(ms)` | Wait for specified milliseconds | - -### Basic LED Blink Code - -```c -#include -#include "pico/stdlib.h" - -#define LED_PIN 16 - -int main(void) { - gpio_init(LED_PIN); // Initialize GPIO 16 - gpio_set_dir(LED_PIN, GPIO_OUT); // Set as output - - while (true) { - gpio_put(LED_PIN, 1); // LED ON - sleep_ms(500); // Wait 500ms - gpio_put(LED_PIN, 0); // LED OFF - sleep_ms(500); // Wait 500ms - } -} -``` - -### What Happens Behind the Scenes? - -Each high-level function calls lower-level code. Let's trace `gpio_init()`: - -``` -gpio_init(LED_PIN) - ↓ -gpio_set_dir(LED_PIN, GPIO_IN) // Initially set as input - ↓ -gpio_put(LED_PIN, 0) // Set output value to 0 - ↓ -gpio_set_function(LED_PIN, GPIO_FUNC_SIO) // Connect to SIO block -``` - -The SIO (Single-cycle I/O) block is a special hardware unit in the RP2350 that provides fast GPIO control! - ---- - -## 📚 Part 4: Setting Up Your Environment - -### Prerequisites - -Before we start, make sure you have: -1. A Raspberry Pi Pico 2 board -2. Ghidra installed (for static analysis) -3. Python installed (for UF2 conversion) -4. The sample projects: - - `0x0005_intro-to-variables` - - `0x0008_uninitialized-variables` -5. A serial monitor (PuTTY, minicom, or screen) - -### Project Structure - -``` -Embedded-Hacking/ -├── 0x0005_intro-to-variables/ -│ ├── build/ -│ │ ├── 0x0005_intro-to-variables.uf2 -│ │ └── 0x0005_intro-to-variables.bin -│ └── 0x0005_intro-to-variables.c -├── 0x0008_uninitialized-variables/ -│ ├── build/ -│ │ ├── 0x0008_uninitialized-variables.uf2 -│ │ └── 0x0008_uninitialized-variables.bin -│ └── 0x0008_uninitialized-variables.c -└── uf2conv.py -``` - ---- - -## 🔬 Part 5: Hands-On Tutorial - Analyzing Variables in Ghidra - -### Step 1: Review the Source Code - -First, let's look at the code we'll be analyzing: - -**File: `0x0005_intro-to-variables.c`** - -```c -#include -#include "pico/stdlib.h" - -int main(void) { - uint8_t age = 42; - - age = 43; - - stdio_init_all(); - - while (true) - printf("age: %d\r\n", age); -} -``` - -**What this code does:** -1. Declares a variable `age` and initializes it to `42` -2. Changes `age` to `43` -3. Initializes the serial output -4. Prints `age` forever in a loop - -### Step 2: Flash the Binary to Your Pico 2 - -1. Hold the BOOTSEL button on your Pico 2 -2. Plug in the USB cable (while holding BOOTSEL) -3. Release BOOTSEL - a drive called "RPI-RP2" appears -4. Drag and drop `0x0005_intro-to-variables.uf2` onto the drive -5. The Pico will reboot and start running! - -### Step 3: Verify It's Working - -Open your serial monitor (PuTTY, minicom, or screen) and you should see: - -``` -age: 43 -age: 43 -age: 43 -... -``` - -The program is printing `43` because that's what we assigned after the initial `42`. - ---- - -## 🔬 Part 6: Setting Up Ghidra for Binary Analysis - -### Step 4: Start Ghidra - -**Open a terminal and type:** - -```powershell -ghidraRun -``` - -Ghidra will open. Now we need to create a new project. - -### Step 5: Create a New Project - -1. Click **File** → **New Project** -2. Select **Non-Shared Project** -3. Click **Next** -4. Enter Project Name: `0x0005_intro-to-variables` -5. Click **Finish** - -### Step 6: Import the Binary - -1. Open your file explorer -2. Navigate to the `Embedded-Hacking` folder -3. Find `0x0005_intro-to-variables.bin` -4. Select Cortex M Little Endian 32 -5. Select Options and set up the .text and offset 10000000 -6. **Drag and drop** the `.bin` file into Ghidra's project window - -### Step 7: Configure the Binary Format - -A dialog appears. The file is identified as a "BIN" (raw binary without debug symbols). - -**Click the three dots (…) next to "Language" and:** -1. Search for "Cortex" -2. Select **ARM Cortex 32 little endian default** -3. Click **OK** - -**Click the "Options…" button and:** -1. Change **Block Name** to `.text` -2. Change **Base Address** to `10000000` (the XIP address!) -3. Click **OK** - -### Step 8: Open and Analyze - -1. Double-click on the file in the project window -2. A dialog asks "Analyze now?" - Click **Yes** -3. Use default analysis options and click **Analyze** - -Wait for analysis to complete (watch the progress bar in the bottom right). - ---- - -## 🔬 Part 7: Navigating and Resolving Functions - -### Step 9: Find the Functions - -Look at the **Symbol Tree** panel on the left. Expand **Functions**. - -You'll see function names like: -- `FUN_1000019a` -- `FUN_10000210` -- `FUN_10000234` - -These are auto-generated names because we imported a raw binary without symbols! - -### Step 10: Resolve Known Functions - -From our previous chapters, we know what some of these functions are: - -| Ghidra Name | Actual Name | How We Know | -| -------------- | ------------- | -------------------------- | -| `FUN_1000019a` | `data_cpy` | From Week 3 boot analysis | -| `FUN_10000210` | `frame_dummy` | From Week 3 boot analysis | -| `FUN_10000234` | `main` | This is where our code is! | - -**To rename `FUN_1000019a` to `data_cpy`:** -1. Click on `FUN_1000019a` in the Symbol Tree -2. In the Decompile window, right-click on the function name -3. Select **Edit Function Signature** -4. Change the name to `data_cpy` -5. Click **OK** - -**Repeat for the other functions:** -- Rename `FUN_10000210` to `frame_dummy` -- Rename `FUN_10000234` to `main` - -### Step 11: Update Main's Signature - -For `main`, let's also fix the return type: - -1. Right-click on `main` in the Decompile window -2. Select **Edit Function Signature** -3. Change to: `int main(void)` -4. Click **OK** - ---- - -## 🔬 Part 8: Analyzing the Main Function - -### Step 12: Examine Main in Ghidra - -Click on `main` (or `FUN_10000234`). Look at the **Decompile** window: - -You'll see something like: - -```c -void FUN_10000234(void) -{ - FUN_10002f54(); - do { - FUN_100030e4(DAT_10000244,0x2b); - } while( true ); -} -``` - -### Step 13: Resolve stdio_init_all - -1. Click on `FUN_10002f54` -2. Right-click → **Edit Function Signature** -3. Change to: `bool stdio_init_all(void)` -4. Click **OK** - -### Step 14: Resolve printf - -1. Click on `FUN_100030e4` -2. Right-click → **Edit Function Signature** -3. Change the name to `printf` -4. Check the **Varargs** checkbox (printf takes variable arguments!) -5. Click **OK** - -### Step 15: Understand the Optimization - -Look at the decompiled code. This will look different if you resolved your functions however do you notice something interesting? - -```c -void FUN_10000234(void) -{ - FUN_10002f54(); - do { - FUN_100030e4(DAT_10000244,0x2b); - } while( true ); -} -``` - -**Where's `uint8_t age = 42`?** It's gone! - -The compiler **optimized it out**! Here's what happened: - -1. Original code: `age = 42`, then `age = 43` -2. Compiler sees: "The `42` is never used, only `43` matters" -3. Compiler removes the unused `42` and just uses `43` directly - -**What is `0x2b`?** Let's check: -- `0x2b` in hexadecimal = `43` in decimal ✓ - -The compiler replaced our variable with the constant value! - ---- - -## 🔬 Part 9: Patching the Binary - Changing the Value - -### Step 16: Find the Value to Patch - -Look at the **Listing** window (assembly view). Find the instruction that loads `0x2b`: - -```assembly -1000023a 2b 21 movs r1,#0x2b -``` - -This instruction loads the value `0x2b` (43) into register `r1` before calling `printf`. - -### Step 17: Patch the Instruction - -We're going to change `0x2b` (43) to `0x46` (70)! - -1. Click on the instruction `movs r1,#0x2b` -2. Right-click and select **Patch Instruction** -3. Change `0x2b` to `0x46` -4. Press Enter - -The instruction now reads: -```assembly -1000023a 46 21 movs r1,#0x46 -``` - -### Step 18: Export the Patched Binary - -1. Click **File** → **Export Program** -2. Set **Format** to **Raw Bytes** -3. Navigate to your build directory -4. Name the file `0x0005_intro-to-variables-h.bin` -5. Click **OK** - ---- - -## 🔬 Part 10: Converting and Flashing the Hacked Binary - -### Step 19: Convert to UF2 Format - -The Pico 2 expects UF2 files, not raw BIN files. We need to convert it! - -**Open a terminal and navigate to your project directory:** - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0005_intro-to-variables -``` - -**Run the conversion command:** - -```powershell -python ..\uf2conv.py build\0x0005_intro-to-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -**What this command means:** -- `uf2conv.py` = the conversion script -- `--base 0x10000000` = the XIP base address -- `--family 0xe48bff59` = the RP2350 family ID -- `--output build\hacked.uf2` = the output filename - -### Step 20: Flash the Hacked Binary - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive -3. Open your serial monitor - -**You should see:** - -``` -age: 70 -age: 70 -age: 70 -... -``` - -🎉 **BOOM! We hacked it!** The value changed from 43 to 70! - ---- - -## 🔬 Part 11: Uninitialized Variables and GPIO - -Now let's work with a more complex example that includes GPIO control. - -### Step 21: Review the Uninitialized Variables Code - -**File: `0x0008_uninitialized-variables.c`** - -```c -#include -#include "pico/stdlib.h" - -#define LED_PIN 16 - -int main(void) { - uint8_t age; // Uninitialized! - - stdio_init_all(); - - gpio_init(LED_PIN); - gpio_set_dir(LED_PIN, GPIO_OUT); - - while (true) { - printf("age: %d\r\n", age); - - gpio_put(LED_PIN, 1); - sleep_ms(500); - - gpio_put(LED_PIN, 0); - sleep_ms(500); - } -} -``` - -**What this code does:** -1. Declares `age` without initializing it (will be 0 due to BSS zeroing) -2. Initializes GPIO 16 as an output -3. In a loop: prints age, blinks the LED - -### Step 22: Flash and Verify - -1. Flash `0x0008_uninitialized-variables.uf2` to your Pico 2 -2. Open your serial monitor - -**You should see:** - -``` -age: 0 -age: 0 -age: 0 -... -``` - -And the **red LED on GPIO 16 should be blinking**! - -The value is `0` because uninitialized variables in the `.bss` section are zeroed at startup. - ---- - -## 🔬 Part 12: Analyzing GPIO Code in Ghidra - -### Step 23: Set Up Ghidra for the New Binary - -1. Create a new project: `0x0008_uninitialized-variables` -2. Import `0x0008_uninitialized-variables.bin` -3. Set Language to **ARM Cortex 32 little endian** -4. Set Base Address to `10000000` -5. Auto-analyze - -### Step 24: Resolve the Functions - -Find and rename these functions: - -| Ghidra Name | Actual Name | -| -------------- | ---------------- | -| `FUN_10000234` | `main` | -| `FUN_100030cc` | `stdio_init_all` | -| `FUN_100002b4` | `gpio_init` | -| `FUN_1000325c` | `printf` | - -For `gpio_init`, set the signature to: -```c -void gpio_init(uint gpio) -``` - -### Step 25: Examine the Main Function - -The decompiled main should look something like: - -```c -void FUN_10000234(void) -{ - undefined4 extraout_r1; - undefined4 extraout_r2; - undefined4 in_cr0; - undefined4 in_cr4; - - FUN_100030cc(); - FUN_100002b4(0x10); - coprocessor_moveto2(0,4,0x10,1,in_cr4); - do { - FUN_1000325c(DAT_10000274,0); - coprocessor_moveto2(0,4,0x10,1,in_cr0); - FUN_10000d10(500); - coprocessor_moveto2(0,4,0x10,0,in_cr0); - FUN_10000d10(500,extraout_r1,extraout_r2,0); - } while( true ); -} -``` - ---- - -## 🔬 Part 13: Hacking GPIO - Changing the LED Pin - -### Step 26: Find the GPIO Pin Value - -Look in the assembly for instructions that use `0x10` (which is 16 in decimal - our LED pin): - -```assembly -1000023a 10 20 movs r0,#0x10 -``` - -This is where `gpio_init(LED_PIN)` is called with GPIO 16. - -### Step 27: Patch GPIO 16 to GPIO 17 - -We'll change the red LED (GPIO 16) to the green LED (GPIO 17)! - -1. Find the instruction `movs r0,#0x10` -2. Right-click → **Patch Instruction** -3. Change `0x10` to `0x11` (17 in hex) -4. Click **OK** - -### Step 28: Find All GPIO 16 References - -There are more places that use GPIO 16. Look for: - -```assembly -10000244 10 23 movs r3,#0x10 -``` - -This is used in `gpio_set_dir`. Patch this to `0x11` as well. - -```assembly -10000252 10 24 movs r4,#0x10 -``` - -This is inside the loop for `gpio_put`. Patch this to `0x11` as well. - -### Step 29: Bonus - Change the Printed Value - -Let's also change the printed value from `0` to `0x42` (66 in decimal): - -```assembly -1000024a 00 21 movs r1,#0x0 -``` - -1. Right-click → **Patch Instruction** -2. Change `0x0` to `0x42` -3. Click **OK** - ---- - -## 🔬 Part 14: Export and Test the Hacked GPIO - -### Step 30: Export the Patched Binary - -1. Click **File** → **Export Program** -2. Format: **Raw Bytes** -3. Filename: `0x0008_uninitialized-variables-h.bin` -4. Click **OK** - -### Step 31: Convert to UF2 - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0008_uninitialized-variables -python ..\uf2conv.py build\0x0008_uninitialized-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -### Step 32: Flash and Verify - -1. Flash `hacked.uf2` to your Pico 2 -2. Check your serial monitor - -**You should see:** - -``` -age: 66 -age: 66 -age: 66 -... -``` - -And now the **GREEN LED on GPIO 17** should be blinking instead of the red one! - -🎉 **We successfully:** -1. Changed the printed value from 0 to 66 -2. Changed which LED blinks from red (GPIO 16) to green (GPIO 17) - ---- - -## 📚 Part 15: Deep Dive - GPIO at the Assembly Level - -### Understanding the GPIO Coprocessor - -The RP2350 has a special **GPIO coprocessor** that provides fast, single-cycle GPIO control. This is different from the RP2040! - -The coprocessor is accessed using special ARM instructions: - -```assembly -mcrr p0, #4, r4, r5, c0 ; GPIO output control -mcrr p0, #4, r4, r5, c4 ; GPIO direction control -``` - -**What this means:** -- `mcrr` = Move to Coprocessor from two ARM Registers -- `p0` = Coprocessor 0 (the GPIO coprocessor) -- `r4` = Contains the GPIO pin number -- `r5` = Contains the value (0 or 1) -- `c0` = Output value register -- `c4` = Output enable register - -### The Full GPIO Initialization Sequence - -When you call `gpio_init(16)`, here's what actually happens: - -``` -Step 1: Configure pad (address 0x40038044) -┌─────────────────────────────────────────────────────────────────┐ -│ - Clear OD bit (output disable) │ -│ - Set IE bit (input enable) │ -│ - Clear ISO bit (isolation) │ -└─────────────────────────────────────────────────────────────────┘ - -Step 2: Set function (address 0x40028084) -┌─────────────────────────────────────────────────────────────────┐ -│ - Set FUNCSEL to 5 (SIO - Software I/O) │ -└─────────────────────────────────────────────────────────────────┘ - -Step 3: Enable output (via coprocessor) -┌─────────────────────────────────────────────────────────────────┐ -│ - mcrr p0, #4, r4, r5, c4 (where r4=16, r5=1) │ -└─────────────────────────────────────────────────────────────────┘ -``` - -### Raw Assembly LED Blink - -Here's what a completely hand-written assembly LED blink looks like: - -```assembly -; Initialize GPIO 16 as output -movs r4, #0x10 ; GPIO 16 -movs r5, #0x01 ; Enable -mcrr p0, #4, r4, r5, c4 ; Set as output - -; Configure pad registers -ldr r3, =0x40038044 ; Pad control for GPIO 16 -ldr r2, [r3] ; Load current config -bic r2, r2, #0x80 ; Clear OD (output disable) -orr r2, r2, #0x40 ; Set IE (input enable) -str r2, [r3] ; Store config - -; Set GPIO function to SIO -ldr r3, =0x40028084 ; IO bank control for GPIO 16 -movs r2, #5 ; FUNCSEL = SIO -str r2, [r3] ; Set function - -; Main loop -loop: - ; LED ON - movs r4, #0x10 ; GPIO 16 - movs r5, #0x01 ; High - mcrr p0, #4, r4, r5, c0 - - ; Delay - ldr r2, =0x17D7840 ; ~25 million iterations -delay1: - subs r2, r2, #1 - bne delay1 - - ; LED OFF - movs r4, #0x10 ; GPIO 16 - movs r5, #0x00 ; Low - mcrr p0, #4, r4, r5, c0 - - ; Delay - ldr r2, =0x17D7840 -delay2: - subs r2, r2, #1 - bne delay2 - - b loop ; Repeat forever -``` - ---- - -## 📊 Part 16: Summary and Review - -### What We Accomplished - -1. **Learned about variables** - How they're declared, initialized, and stored -2. **Understood memory sections** - `.data`, `.bss`, and `.rodata` -3. **Analyzed binaries in Ghidra** - Without debug symbols! -4. **Patched binaries** - Changed values directly in the binary -5. **Controlled GPIO** - Made LEDs blink -6. **Changed program behavior** - Different LED, different value - -### The Binary Patching Workflow - -``` -┌─────────────────────────────────────────────────────────────────┐ -│ 1. Import .bin file into Ghidra │ -│ - Set language to ARM Cortex │ -│ - Set base address to 0x10000000 │ -├─────────────────────────────────────────────────────────────────┤ -│ 2. Analyze and resolve functions │ -│ - Rename functions to meaningful names │ -│ - Fix function signatures │ -├─────────────────────────────────────────────────────────────────┤ -│ 3. Find the values/instructions to patch │ -│ - Look in the assembly listing │ -│ - Right-click → Patch Instruction │ -├─────────────────────────────────────────────────────────────────┤ -│ 4. Export the patched binary │ -│ - File → Export Program │ -│ - Format: Raw Bytes │ -├─────────────────────────────────────────────────────────────────┤ -│ 5. Convert to UF2 │ -│ - python uf2conv.py file.bin --base 0x10000000 │ -│ --family 0xe48bff59 --output hacked.uf2 │ -├─────────────────────────────────────────────────────────────────┤ -│ 6. Flash and verify │ -│ - Hold BOOTSEL, plug in, drag UF2 │ -│ - Check serial output and LED behavior │ -└─────────────────────────────────────────────────────────────────┘ -``` - -### Key Memory Sections - -| Section | Location | Contains | Writable? | -| --------- | -------- | ------------------------------ | --------- | -| `.text` | Flash | Code | No | -| `.rodata` | Flash | Constants, strings | No | -| `.data` | RAM | Initialized globals | Yes | -| `.bss` | RAM | Uninitialized globals (zeroed) | Yes | - -### Important Ghidra Commands - -| Action | How To Do It | -| ----------------- | ------------------------------------- | -| Rename function | Right-click → Edit Function Signature | -| Patch instruction | Right-click → Patch Instruction | -| Export binary | File → Export Program → Raw Bytes | -| Go to address | Press 'G' and enter address | - ---- - -## ✅ Practice Exercises - -### Exercise 1: Change the Delay -The LED blinks every 500ms. Find the `sleep_ms(500)` calls in the binary and change them to `sleep_ms(100)` for faster blinking. - -**Hint:** Look for the value `0x1F4` (500 in hex) being loaded into a register. - -### Exercise 2: Reverse the LED -Instead of GPIO 16 → ON → OFF, make it GPIO 16 → OFF → ON (start with LED on). - -**Hint:** Find and swap the two `gpio_put` calls (the ones with values 0 and 1). - -### Exercise 3: Add a Second LED -Patch the binary so that BOTH GPIO 16 and GPIO 17 blink together. - -**Hint:** You'll need to find space for additional instructions or modify existing ones cleverly. - -### Exercise 4: Change the Format String -The program prints "age: %d\r\n". Can you find this string in Ghidra and figure out where it's stored? - -**Hint:** Look in the `.rodata` section around address `0x10001xxx`. - ---- - -## 🎓 Key Takeaways - -1. **Variables are just memory locations** - The compiler assigns them addresses in SRAM. - -2. **Compilers optimize aggressively** - Unused code and values may be removed entirely. - -3. **Uninitialized doesn't mean random** - Modern compilers zero out the `.bss` section. - -4. **Ghidra works without symbols** - You can analyze any binary, even stripped ones. - -5. **Binary patching is powerful** - You can change behavior without source code. - -6. **UF2 conversion is required** - The Pico 2 needs UF2 format, not raw binaries. - -7. **GPIO is just memory-mapped I/O** - Writing to specific addresses controls hardware. - ---- - -## 📖 Glossary - -| Term | Definition | -| ------------------ | --------------------------------------------------------------------- | -| **BSS** | Block Started by Symbol - section for uninitialized global variables | -| **Declaration** | Telling the compiler a variable's name and type | -| **Definition** | Allocating memory for a variable | -| **GPIO** | General Purpose Input/Output - controllable pins on a microcontroller | -| **Initialization** | Assigning an initial value to a variable | -| **Linker** | Tool that combines compiled code and assigns memory addresses | -| **Optimization** | Compiler removing or simplifying code for efficiency | -| **Patching** | Modifying bytes directly in a binary file | -| **rodata** | Read-only data section for constants and string literals | -| **SIO** | Single-cycle I/O - fast GPIO control block in RP2350 | -| **UF2** | USB Flashing Format - file format for Pico 2 firmware | -| **Variable** | A named storage location in memory | - ---- - -## 🔗 Additional Resources - -### GPIO Coprocessor Reference - -The RP2350 GPIO coprocessor instructions: - -| Instruction | Description | -| -------------------------- | ---------------------------- | -| `mcrr p0, #4, Rt, Rt2, c0` | Set/clear GPIO output | -| `mcrr p0, #4, Rt, Rt2, c4` | Set/clear GPIO output enable | - -### RP2350 Memory Map Quick Reference - -| Address | Description | -| ------------ | ------------------------ | -| `0x10000000` | XIP Flash (code) | -| `0x20000000` | SRAM (data) | -| `0x40028000` | IO_BANK0 (GPIO control) | -| `0x40038000` | PADS_BANK0 (pad control) | -| `0xd0000000` | SIO (single-cycle I/O) | - ---- - -**Remember:** Every binary you encounter in the real world can be analyzed and understood using these same techniques. Practice makes perfect! - -Happy hacking! 🔧 diff --git a/WEEK04/slides/WEEK04-IMG00.svg b/WEEK04/slides/WEEK04-IMG00.svg new file mode 100644 index 0000000..2b2aae1 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG00.svg @@ -0,0 +1,79 @@ + + + + + + + + + + + + + + + + + + + + + + + 4F 70 65 6E 4F 43 44 + 10 00 02 34 08 B5 01 + 47 44 42 20 52 45 56 + 20 08 20 00 FF AA 00 + 52 50 32 33 35 30 00 + 0A 0A 0F 12 12 1A 1A + 41 52 4D 76 38 2D 4D + 00 FF 41 00 D4 FF 88 + 47 48 49 44 52 41 00 + FF 00 40 C0 C0 C0 00 + + + + + + + + + + + + +Embedded Systems +Reverse Engineering + + + + + +// WEEK 04 + + +Variables in Embedded Systems: +Debugging and Hacking Variables +w/ GPIO Output Basics + + + + + +George Mason University + + + +RP2350 // ARM Cortex-M33 + diff --git a/WEEK04/slides/WEEK04-IMG01.svg b/WEEK04/slides/WEEK04-IMG01.svg new file mode 100644 index 0000000..5331adf --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG01.svg @@ -0,0 +1,96 @@ + + + + + +What is a Variable? +Labeled Boxes in Memory (SRAM) + + + +Memory — A Row of Numbered Boxes + + + +42 +age +Box 0 + + + +17 +score +Box 1 + + + +0 +count +Box 2 + + + +255 +max +Box 3 + + + +99 +temp +Box 4 + + + +Anatomy of a Declaration + + +uint8_t age = 42; + +uint8_t +Data type (1 byte) + +age +Variable name (label) + += 42 +Initial value + +; +End of statement + + + +Key Concepts + + +Declaration +name + type + + +Definition +allocates memory + + +Initialization +assigns value + + + +Important Rule +You MUST declare a +variable BEFORE you +use it! +Compiler needs to know the type + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG02.svg b/WEEK04/slides/WEEK04-IMG02.svg new file mode 100644 index 0000000..8933406 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG02.svg @@ -0,0 +1,86 @@ + + + + + +Data Types & Sizes +How Much Memory Each Type Uses + + + + + + +Type +Size +Range +Description + + + +uint8_t +1 byte +0 — 255 +Unsigned 8-bit + + + +int8_t +1 byte +-128 — 127 +Signed 8-bit + + + +uint16_t +2 bytes +0 — 65,535 +Unsigned 16-bit + + + +int16_t +2 bytes +-32,768 — 32,767 +Signed 16-bit + + + +uint32_t +4 bytes +0 — 4,294,967,295 +Unsigned 32-bit + + + +int32_t +4 bytes +-2.1B — 2.1B +Signed 32-bit + + +Size Comparison + + +1B +uint8_t + + +2B +uint16_t + + +4 Bytes +uint32_t + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG03.svg b/WEEK04/slides/WEEK04-IMG03.svg new file mode 100644 index 0000000..0cbcf5a --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG03.svg @@ -0,0 +1,63 @@ + + + + + +Memory Sections +Where Variables Live After Compilation + + + + +.data +Flash -> copied to RAM at startup +Contains: Initialized global/static variables +int counter = 42; +Initial value stored in flash, copied to SRAM by data_cpy + + + + +.bss +RAM — zeroed at startup +Contains: Uninitialized global/static variables +int counter; +NOT stored in binary (saves space!) — memset to 0 at boot + + + + +.rodata +Flash — read only +Contains: Constants and string literals +const int MAX = 100; +Lives in flash permanently — cannot be modified at runtime + + + +.data +RAM +Writable +Initialized globals + +.bss +RAM +Writable +Uninitialized globals (zeroed) + +.rodata +Flash +Read-only +Constants & strings + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG04.svg b/WEEK04/slides/WEEK04-IMG04.svg new file mode 100644 index 0000000..82437d2 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG04.svg @@ -0,0 +1,79 @@ + + + + + +GPIO Basics +General Purpose Input/Output on RP2350 + + + +Pico 2 GPIO Pins + +GPIO 16 + +Red LED + +GPIO 17 + +Green LED + +GPIO 18 + +Blue LED + +GPIO 25 + +Onboard LED + +Software-controlled switches + + + +Pico SDK Functions + + +gpio_init(pin) +Init pin + + +gpio_set_dir(pin,d) +I/O dir + + +gpio_put(pin,val) +Set H/L + + +sleep_ms(ms) +Delay + + + +Basic LED Blink Code + + +#define LED_PIN 16 +int main(void) { +gpio_init(LED_PIN); +gpio_set_dir(LED_PIN, GPIO_OUT); +while (true) { +gpio_put(LED_PIN, 1); +// ON +sleep_ms(500); +gpio_put(LED_PIN, 0); +// OFF +sleep_ms(500); +}} + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG05.svg b/WEEK04/slides/WEEK04-IMG05.svg new file mode 100644 index 0000000..c6a0ef6 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG05.svg @@ -0,0 +1,79 @@ + + + + + +Ghidra Binary Analysis +Analyzing a Raw .bin Without Symbols + + + +1. Import + +File -> Import +Language: +ARM Cortex 32 LE +Block: +.text +Base: +10000000 +XIP address for RP2350 + + + +2. Analyze + +Auto-Analyze: Yes +Ghidra finds: +FUN_1000019a +FUN_10000210 +FUN_10000234 +Auto-generated names + + + +3. Resolve + +Edit Function Sig +Rename to: +data_cpy +frame_dummy +main +Fix signatures + + + +Decompiled main() in Ghidra + + +Before Resolving: +void FUN_10000234(void){ +FUN_10002f54(); +do { +FUN_100030e4( +DAT_10000244,0x2b); +} while(true); +} + + +After Resolving: +int main(void) { +stdio_init_all(); +do { +printf( +"age: %d\r\n" +, 0x2b); +} while(true); +} + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG06.svg b/WEEK04/slides/WEEK04-IMG06.svg new file mode 100644 index 0000000..156aeeb --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG06.svg @@ -0,0 +1,77 @@ + + + + + +Compiler Optimization +Why Your Variable Disappeared + + + +Source Code + + +int main(void) { +uint8_t age = 42; +age = 43; +stdio_init_all(); +while (true) +printf("age: %d", age); + + + +Compiler Thinks... + + +age = 42 is NEVER read + + +Dead store -> REMOVED + + +age = 43 -> constant fold + +Replaces variable with literal + + + +Resulting Assembly + + +1000023a +2b 21 +movs r1, #0x2b +; 0x2b = 43 +No age=42 instruction — compiler removed it + + + +Key Takeaway + + +Source Code +age = 42 +age = 43 + +-> + + +Binary +movs r1, #0x2b + + +Compiler +Optimizes dead +stores away! + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG07.svg b/WEEK04/slides/WEEK04-IMG07.svg new file mode 100644 index 0000000..2041444 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG07.svg @@ -0,0 +1,86 @@ + + + + + +Binary Patching +Changing Values in the Binary + + + +Before Patch + + +1000023a +2b 21 +movs r1,#0x2b + +0x2b = 43 decimal +Output: +age: 43 +Compiler-optimized constant + + + +After Patch + + +1000023a +46 21 +movs r1,#0x46 + +0x46 = 70 decimal +Output: +age: 70 +Changed program behavior! + + + +How to Patch in Ghidra + + +1. Find Instr + +-> + + +2. Rt-Click + +-> + + +3. Patch Val + +-> + + +Done! + +Patch Instruction: change operand + + + +Export Patched Binary + + +File: Export + + +Format: Raw Bytes + + +Save as *-h.bin + +Exported binary has your patches + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG08.svg b/WEEK04/slides/WEEK04-IMG08.svg new file mode 100644 index 0000000..eada6e7 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG08.svg @@ -0,0 +1,99 @@ + + + + + +GPIO Hacking +Patching GPIO 16 to GPIO 17 + + + +Original: GPIO 16 +Red LED on pin 16 + + +1000023a +10 20 +movs r0,#0x10 + + +10000244 +10 23 +movs r3,#0x10 + + +10000252 +10 24 +movs r4,#0x10 + +0x10 = 16, three locations + + + +Patched: GPIO 17 +Green LED on pin 17 + + +1000023a +11 20 +movs r0,#0x11 + + +10000244 +11 23 +movs r3,#0x11 + + +10000252 +11 24 +movs r4,#0x11 + +0x11 = 17, all patched! + + + +What Each Patch Controls + + +gpio_init +r0 + + +gpio_set_dir +r3 + + +gpio_put +r4 + +ALL pin refs must be patched + + + +Bonus: Change Print Value + + +00 21 +movs r1,#0x0 +age: 0 + +-> + + +42 21 +movs r1,#0x42 +age: 66 + +Changed value: 0 to 66 (0x42) + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG09.svg b/WEEK04/slides/WEEK04-IMG09.svg new file mode 100644 index 0000000..6743432 --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG09.svg @@ -0,0 +1,78 @@ + + + + + +GPIO Coprocessor +RP2350 Single-Cycle I/O via mcrr + + + +mcrr Instruction Breakdown + + +mcrr p0, #4, r4, r5, c0 + +mcrr +Move to Coprocessor (2 regs) +p0 +Coprocessor 0 (GPIO) +r4 +GPIO pin number +r5 +Value (0=LOW, 1=HIGH) + + + +Output Value (c0) + + +mcrr p0,#4,r4,r5,c0 + +r4 = pin number +r5 = 0 or 1 +Controls GPIO output state + + +Output Enable (c4) + + +mcrr p0,#4,r4,r5,c4 + +r4 = pin number +r5 = 1 (enable output) +Sets pin direction to OUTPUT + + + +gpio_init(16) Sequence + + +Step 1: Config Pad +addr 0x40038044 + + +Step 2: Set Func +FUNCSEL = 5 (SIO) + + +Step 3: Enable Out +mcrr p0,#4,r4,r5,c4 + + + + +Pad: clear OD, set IE, clear ISO +SIO = fast single-cycle GPIO access + \ No newline at end of file diff --git a/WEEK04/slides/WEEK04-IMG10.svg b/WEEK04/slides/WEEK04-IMG10.svg new file mode 100644 index 0000000..23741fe --- /dev/null +++ b/WEEK04/slides/WEEK04-IMG10.svg @@ -0,0 +1,119 @@ + + + + + +Full Patching Pipeline +End-to-End Binary Hacking Workflow + + + + +1 +Import .bin +Ghidra: Import +ARM Cortex 32 LE +Base: 0x10000000 + + + + + + + +2 +Analyze +Auto-analyze +Rename functions +Fix signatures + + + + + + + +3 +Find Target +Listing window +Find movs rN,#val +Identify bytes to change + + + + +4 +Patch +Right-click: +Patch Instruction +Change operand value + + + + + + + +5 +Export +File: Export +Format: Raw Bytes +Save as *-h.bin + + + + + + + +6 +Convert UF2 +uf2conv.py +--family 0xe48bff59 +RP2350 family ID + + + +UF2 Command + +python uf2conv.py file.bin --base 0x10000000 -o hacked.uf2 + + + +Flash to Pico 2 +1. Hold BOOTSEL + USB +2. Drop hacked.uf2 +3. Pico reboots hacked +RPI-RP2 drive in BOOTSEL + + + +Key Sections + +.text +Flash +Code + +.rodata +Flash +Constants + +.data +RAM +Init globals + +.bss +RAM +Zeroed globals + \ No newline at end of file diff --git a/WEEK05/WEEK05-01-S.md b/WEEK05/WEEK05-01-S.md deleted file mode 100644 index 59eb48f..0000000 --- a/WEEK05/WEEK05-01-S.md +++ /dev/null @@ -1,63 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 1 Solution: Analyze the Float Binary in Ghidra - -#### Answers - -##### Main Function Analysis - -| Item | Value | Notes | -|--------------------------|------------------------|------------------------------------| -| Main function address | 0x10000234 | Entry point of program | -| Float value (original) | 42.5 | Declared as `float` | -| Double hex encoding | 0x4045400000000000 | Promoted to double for printf | -| r3 (high word) | 0x40454000 | Sign + exponent + top mantissa | -| r2 (low word) | 0x00000000 | All zeros (clean fractional part) | -| Exponent (stored) | 1028 | Biased value | -| Exponent (real) | 5 | After subtracting bias 1023 | -| Format string | "fav_num: %f\r\n" | Located at 0x100034a8 | -| stdio_init_all address | 0x10002f5c | I/O initialization | -| printf address | 0x100030ec | Standard library function | - -##### IEEE 754 Decoding of 0x4045400000000000 - -``` -r3 = 0x40454000 = 0100 0000 0100 0101 0100 0000 0000 0000 -r2 = 0x00000000 = 0000 0000 0000 0000 0000 0000 0000 0000 - -Sign bit (bit 63): 0 → Positive -Exponent (bits 62-52): 10000000100 = 1028 → 1028 - 1023 = 5 -Mantissa (bits 51-0): 0101010000...0 → 1.010101 (with implied 1) - -Value = 1.010101₂ × 2⁵ = 101010.1₂ = 32 + 8 + 2 + 0.5 = 42.5 ✓ -``` - -##### Decompiled main() After Renaming - -```c -int main(void) -{ - stdio_init_all(); - do { - __wrap_printf("fav_num: %f\r\n", /* r2:r3 = 0x4045400000000000 = 42.5 */); - } while (true); -} -``` - -#### Reflection Answers - -1. **Why does the compiler promote a `float` to a `double` when passing it to `printf`?** - The C standard (§6.5.2.2) specifies **default argument promotions** for variadic functions like `printf`. When a `float` is passed to a variadic parameter (the `...` part), it is automatically promoted to `double`. This is because historically, floating-point hardware and calling conventions operated more efficiently with double precision. The `printf` function with `%f` always expects a 64-bit `double` on the stack or in the register pair `r2:r3`, never a 32-bit `float`. - -2. **The low word (`r2`) is `0x00000000`. What does this tell you about the fractional part of `42.5`?** - It means the fractional part of 42.5 can be represented exactly with very few mantissa bits. The value 0.5 is exactly 2⁻¹ in binary—a single bit. After normalization, the mantissa is `010101000...` which only needs 6 significant bits. All remaining 46 bits (including the entire low 32-bit word) are zero. Values like 0.5, 0.25, 0.125 (negative powers of 2) and their sums always produce clean low words, while values like 0.1 or 0.3 produce repeating binary fractions that fill both words. - -3. **What is the purpose of the exponent bias (1023) in IEEE 754 double-precision?** - The bias allows the exponent field to represent both positive and negative exponents using only unsigned integers. The 11-bit exponent field stores values 0–2047. By subtracting the bias (1023), the actual exponent range is −1022 to +1023. This avoids needing a separate sign bit for the exponent and simplifies hardware comparison—doubles can be compared as unsigned integers (for positive values) because larger exponents produce larger bit patterns. The bias value 1023 = 2¹⁰ − 1 is chosen to center the range symmetrically. - -4. **If the sign bit (bit 63) were `1` instead of `0`, what value would the double represent?** - The value would be **−42.5**. The sign bit in IEEE 754 is independent of all other fields: flipping bit 63 from 0 to 1 simply negates the value. The hex encoding would change from `0x4045400000000000` to `0xC045400000000000`—only the most significant nibble changes from `4` (`0100`) to `C` (`1100`), with bit 31 of r3 changing from 0 to 1. diff --git a/WEEK05/WEEK05-01.md b/WEEK05/WEEK05-01.md deleted file mode 100644 index 1122c79..0000000 --- a/WEEK05/WEEK05-01.md +++ /dev/null @@ -1,271 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 1: Analyze the Float Binary in Ghidra - -#### Objective -Import and analyze the `0x000e_floating-point-data-type.bin` binary in Ghidra to understand how the compiler handles floating-point variables, discover float-to-double promotion, and decode the IEEE 754 double-precision encoding of `42.5` from two 32-bit registers. - -#### Prerequisites -- Ghidra installed and configured -- `0x000e_floating-point-data-type.bin` binary available in your build directory -- Understanding of IEEE 754 encoding from Week 5 Part 2 -- Basic Ghidra navigation skills from Weeks 3 and 4 - -#### Task Description -You will import the float binary into Ghidra, configure it for ARM Cortex-M33, resolve function names, discover that the compiler promotes `float` to `double` when passing to `printf`, and manually decode the 64-bit double `0x4045400000000000` field by field to confirm it represents `42.5`. - -#### Step-by-Step Instructions - -##### Step 1: Start Ghidra and Create New Project - -```powershell -ghidraRun -``` - -1. Click **File** ? **New Project** -2. Select **Non-Shared Project** -3. Click **Next** -4. Enter Project Name: `week05-ex01-floating-point` -5. Choose a project directory -6. Click **Finish** - -##### Step 2: Import the Binary - -1. Navigate to your file explorer -2. Find `Embedded-Hacking\0x000e_floating-point-data-type\build\0x000e_floating-point-data-type.bin` -3. **Drag and drop** the `.bin` file into Ghidra's project window - -##### Step 3: Configure Import Settings - -When the import dialog appears: - -1. Click the three dots (****) next to **Language** -2. Search for: `Cortex` -3. Select: **ARM Cortex 32 little endian default** -4. Click **OK** - -Now click **Options** button: -1. Change **Block Name** to: `.text` -2. Change **Base Address** to: `10000000` (XIP flash base) -3. Click **OK** - -Then click **OK** on the main import dialog. - -##### Step 4: Analyze the Binary - -1. Double-click the imported file in the project window -2. When prompted "Analyze now?" click **Yes** -3. Leave all default analysis options selected -4. Click **Analyze** -5. Wait for analysis to complete (watch bottom-right progress bar) - -##### Step 5: Locate and Rename the Main Function - -Look at the **Symbol Tree** panel on the left. Expand **Functions**. - -From previous weeks, we know the boot sequence leads to `main()`: - -1. Click on `FUN_10000234` -2. Right-click ? **Edit Function Signature** -3. Change to: `int main(void)` -4. Click **OK** - -##### Step 6: Resolve stdio_init_all and printf - -**Rename stdio_init_all:** -1. Click on `FUN_10002f5c` in the decompile window -2. Right-click ? **Edit Function Signature** -3. Change to: `bool stdio_init_all(void)` -4. Click **OK** - -**Rename printf:** -1. Click on `FUN_100030ec` -2. Right-click ? **Edit Function Signature** -3. Change to: `int __wrap_printf(char *format,...)` -4. Check the **Varargs** checkbox -5. Click **OK** - -##### Step 7: Observe the Decompiled Code - -After resolving, the decompiled `main` should look like: - -```c -int main(void) -{ - undefined4 uVar1; - undefined4 extraout_r1; - undefined4 uVar2; - undefined4 extraout_r1_00; - - stdio_init_all(); - uVar1 = DAT_1000024c; - uVar2 = extraout_r1; - do { - __wrap_printf(DAT_10000250,uVar2,0,uVar1); - uVar2 = extraout_r1_00; - } while( true ); -} -``` - -**Critical observation:** Where is `float fav_num = 42.5`? The compiler optimized it into constants! - -##### Step 8: Identify the Register Pair - -Look at the **Listing** window (assembly view) for `main`: - -```assembly -1000023a 00 24 movs r4, #0x0 -1000023c 03 4d ldr r5, [DAT_1000024c] = 40454000h -``` - -Two values are being passed to `printf`: -- `r2 = 0x00000000` (low 32 bits) -- `r3 = 0x40454000` (high 32 bits) - -Together they form a 64-bit double: `0x4045400000000000` - -**Why a double?** The C standard requires that `float` arguments to variadic functions like `printf` are **promoted to `double`**. So even though our variable is declared as `float fav_num = 42.5`, `printf` always receives a 64-bit double. - -##### Step 9: Write Out the Binary Layout - -Convert both registers to binary: - -``` -r3 (high 32 bits): 0x40454000 = 0100 0000 0100 0101 0100 0000 0000 0000 -r2 (low 32 bits): 0x00000000 = 0000 0000 0000 0000 0000 0000 0000 0000 -``` - -Map the 64-bit IEEE 754 fields: - -``` -Bit 63 (sign): 0 -Bits 6252 (exponent): 10000000100 -Bits 510 (mantissa): 0101010000000000...0000 -``` - -##### Step 10: Decode the Sign Bit - -Bit 63 of the double = bit 31 of r3: - -``` -r3 = 0x40454000 = 0100 0000 0100 0101 0100 0000 0000 0000 - ^ - bit 31 = 0 ? Positive number -``` - -IEEE 754 sign rule: `0` = Positive, `1` = Negative. - -##### Step 11: Decode the Exponent - -Extract bits 3020 from r3: - -``` -0x40454000: 0 10000000100 01010100000000000000 - ^ ^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^ - sign exponent mantissa (top 20) -``` - -Exponent bits: `10000000100` = 2 + 2 = 1024 + 4 = **1028** - -Subtract the double-precision bias (1023): - -$$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ - -##### Step 12: Decode the Mantissa - -High 20 bits of mantissa (from r3 bits 190): -``` -0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 -``` - -Low 32 bits of mantissa (from r2): -``` -0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 -``` - -With the implied leading `1`: -``` -1.010101 00000... -``` - -##### Step 13: Reconstruct the Final Value - -$$1.010101_2 \times 2^5 = 101010.1_2$$ - -Convert to decimal: - -| Bit | Power | Value | -|-----|-------|-------| -| 1 | 25 | 32 | -| 0 | 24 | 0 | -| 1 | 2 | 8 | -| 0 | 2 | 0 | -| 1 | 2 | 2 | -| 0 | 2 | 0 | -| 1 | 2? | 0.5 | - -$$32 + 8 + 2 + 0.5 = \mathbf{42.5} ?$$ - -##### Step 14: Find the Format String - -In the Listing view, click on the data reference to locate: - -``` -s_fav_num:_%f_100034a8 ds "fav_num: %f\r\n" -``` - -Note that the format specifier is `%f`, confirming this is a floating-point print call. - -##### Step 15: Document Your Findings - -Create a table of your observations: - -| Item | Value | Notes | -| ------------------------- | ------------------ | ---------------------------------- | -| Main function address | `0x10000234` | Entry point of program | -| Float value (original) | `42.5` | Declared as `float` | -| Double hex encoding | `0x4045400000000000` | Promoted to double for printf | -| r3 (high word) | `0x40454000` | Contains sign + exponent + mantissa top bits | -| r2 (low word) | `0x00000000` | All zeros clean fractional part | -| Exponent (stored) | 1028 | Biased value | -| Exponent (real) | 5 | After subtracting bias 1023 | -| Format string | `"fav_num: %f\r\n"` | Located at `0x100034a8` | -| Float-to-double promotion | Yes | C standard for variadic functions | - -#### Expected Output - -After completing this exercise, you should be able to: -- Import and configure ARM binaries in Ghidra for float analysis -- Explain why `printf` receives a `double` even when the variable is a `float` -- Identify the register pair `r2:r3` that holds a 64-bit double -- Manually decode an IEEE 754 double from hex to decimal -- Locate format strings in the binary - -#### Questions for Reflection - -###### Question 1: Why does the compiler promote a `float` to a `double` when passing it to `printf`? - -###### Question 2: The low word (`r2`) is `0x00000000`. What does this tell you about the fractional part of `42.5`? - -###### Question 3: What is the purpose of the exponent bias (1023) in IEEE 754 double-precision? - -###### Question 4: If the sign bit (bit 63) were `1` instead of `0`, what value would the double represent? - -#### Tips and Hints -- The **Listing** window shows raw assembly; the **Decompile** window shows reconstructed C -- Double-click on a `DAT_` reference to jump to the data constant -- Use Python to verify: `import struct; struct.pack('>d', 42.5).hex()` gives `4045400000000000` -- Remember: r3 = high 32 bits (sign + exponent + top mantissa), r2 = low 32 bits (bottom mantissa) -- The bias for doubles is always 1023; for floats it's 127 - -#### Next Steps -- Proceed to Exercise 2 to patch this float value in Ghidra -- Try computing the IEEE 754 encoding of other values like `3.14` or `100.0` by hand -- Compare the 32-bit float encoding `0x422A0000` with the 64-bit double encoding `0x4045400000000000` both represent `42.5` - -#### Additional Challenge -Find the data constant `DAT_1000024c` in the Listing view. What raw bytes are stored there? Remember that ARM is little-endian the bytes in memory are in reverse order. Write out the byte order as it appears in memory vs. as a 32-bit value. diff --git a/WEEK05/WEEK05-02-S.md b/WEEK05/WEEK05-02-S.md deleted file mode 100644 index deafe4b..0000000 --- a/WEEK05/WEEK05-02-S.md +++ /dev/null @@ -1,73 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 2 Solution: Patch the Float Binary — Changing 42.5 to 99.0 - -#### Answers - -##### IEEE 754 Encoding of 99.0 - -``` -Integer: 99 = 1100011₂ -Fractional: .0 = .0₂ -Combined: 1100011.0₂ -Normalized: 1.100011₂ × 2⁶ - -Sign: 0 (positive) -Exponent: 6 + 1023 = 1029 = 10000000101₂ -Mantissa: 100011 followed by 46 zeros - -Full double: 0x4058C00000000000 -``` - -##### Patch Summary - -| Register | Old Value (42.5) | New Value (99.0) | Changed? | -|----------|-----------------|------------------|----------| -| r2 | 0x00000000 | 0x00000000 | No | -| r3 | 0x40454000 | 0x4058C000 | **Yes** | - -##### Ghidra Patch - -``` -DAT_1000024c: - Before (little-endian): 00 40 45 40 → 0x40454000 - After (little-endian): 00 C0 58 40 → 0x4058C000 -``` - -##### Serial Output - -``` -fav_num: 99.000000 -fav_num: 99.000000 -fav_num: 99.000000 -... -``` - -#### Reflection Answers - -1. **Why did we only need to patch r3 (the high word) and not r2 (the low word)?** - Both 42.5 and 99.0 have "clean" fractional parts that can be exactly represented with few mantissa bits. For 42.5, the mantissa is `010101000...0`; for 99.0, it's `100011000...0`. In both cases, all significant mantissa bits fit within the top 20 bits (stored in r3 bits 19–0), leaving the bottom 32 bits (r2) as all zeros. Only values with complex or repeating binary fractions (like 42.52525 or 99.99) need non-zero low words. - -2. **What would the high word be if we wanted to patch the value to `-99.0` instead?** - Flip bit 31 of r3 (the sign bit). The current r3 = `0x4058C000` = `0100 0000 0101 1000 1100...`. Setting bit 31 to 1: `0xC058C000` = `1100 0000 0101 1000 1100...`. The full double encoding of −99.0 is `0xC058C00000000000`. Only the most significant nibble changes from `4` to `C`. - -3. **Walk through the encoding of `100.0` as a double. What are the high and low words?** - ``` - 100 = 1100100₂ - 100.0 = 1100100.0₂ = 1.1001₂ × 2⁶ - Sign: 0 - Exponent: 6 + 1023 = 1029 = 10000000101₂ - Mantissa: 1001 followed by 48 zeros - - Full 64-bit: 0 10000000101 1001000000...0 - High word (r3): 0x40590000 - Low word (r2): 0x00000000 - ``` - Verification: `struct.pack('>d', 100.0).hex()` → `4059000000000000` ✓ - -4. **Why do we need the `--family 0xe48bff59` flag when converting to UF2?** - The `--family` flag specifies the target chip family in the UF2 file header. `0xe48bff59` is the registered family ID for the RP2350. The bootloader reads this field to verify the firmware is intended for the correct chip before flashing. If the family ID doesn't match (e.g., using the RP2040 ID `0xe48bff56`), the bootloader may reject the firmware or write it incorrectly. This prevents accidentally flashing RP2040 firmware onto an RP2350 (or vice versa), which could cause undefined behavior since the chips have different architectures (Cortex-M0+ vs Cortex-M33). diff --git a/WEEK05/WEEK05-02.md b/WEEK05/WEEK05-02.md deleted file mode 100644 index 83868cf..0000000 --- a/WEEK05/WEEK05-02.md +++ /dev/null @@ -1,173 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 2: Patch the Float Binary — Changing 42.5 to 99.0 - -#### Objective -Calculate the IEEE 754 double-precision encoding of `99.0`, patch the float binary in Ghidra to change the printed value from `42.5` to `99.0`, export the patched binary, convert it to UF2 format, and flash it to the Pico 2 to verify the change. - -#### Prerequisites -- Completed Exercise 1 (float binary imported and analyzed in Ghidra) -- Understanding of IEEE 754 double-precision encoding from Week 5 Part 2.7 -- Python installed for UF2 conversion -- `uf2conv.py` script available in your project directory -- Raspberry Pi Pico 2 connected via USB -- Serial monitor software (PuTTY, minicom, or screen) - -#### Task Description -You will convert `99.0` to its IEEE 754 double-precision encoding by hand (integer-to-binary conversion, normalization, field extraction), determine which register words need to change, patch the data constant in Ghidra, and verify on hardware that the serial output now prints `99.000000`. - -#### Step-by-Step Instructions - -##### Step 1: Convert 99 to Binary - -Use repeated division by 2: - -| Division | Quotient | Remainder | -|----------|----------|-----------| -| 99 ÷ 2 | 49 | **1** | -| 49 ÷ 2 | 24 | **1** | -| 24 ÷ 2 | 12 | **0** | -| 12 ÷ 2 | 6 | **0** | -| 6 ÷ 2 | 3 | **0** | -| 3 ÷ 2 | 1 | **1** | -| 1 ÷ 2 | 0 | **1** | - -Read remainders bottom-to-top: $99_{10} = 1100011_2$ - -##### Step 2: Handle the Fractional Part - -The fractional part of `99.0` is `.0` — exactly zero. There are no fractional bits. - -$$99.0_{10} = 1100011.0_2$$ - -##### Step 3: Normalize to IEEE 754 Form - -Move the binary point so there is exactly one `1` before it: - -$$1100011.0_2 = 1.100011_2 \times 2^6$$ - -We shifted the binary point 6 places left, so the exponent is **6**. - -##### Step 4: Extract the IEEE 754 Fields - -1. **Sign:** `0` (positive) -2. **Exponent:** $6 + 1023 = 1029 = 10000000101_2$ -3. **Mantissa:** `100011` followed by 46 zeros (everything after the `1.`, padded to 52 bits) -4. **Full double:** `0x4058C00000000000` - -Split into register words: -- **r3 (high word):** `0x4058C000` -- **r2 (low word):** `0x00000000` - -##### Step 5: Determine What to Patch - -Compare old vs. new: - -| Register | Old Value | New Value | Changed? | -| -------- | ------------ | ------------ | -------- | -| `r2` | `0x00000000` | `0x00000000` | No | -| `r3` | `0x40454000` | `0x4058C000` | **Yes** | - -Since `r2` stays all zeros, we only need to patch the high word in `r3`. - -##### Step 6: Locate the Data Constant in Ghidra - -Open your Ghidra project from Exercise 1. In the Listing view, find the data constant that loads into `r3`: - -``` - DAT_1000024c -10000248 00 40 45 40 undefined4 40454000h -``` - -This is the 32-bit constant `0x40454000` — the high word of the double `42.5`. - -##### Step 7: Patch the Constant - -1. Click on **Window** → **Bytes** to open the Bytes Editor -2. Click the **Pencil Icon** to enable editing -3. Navigate to the data at `DAT_1000024c` -4. The bytes in memory (little-endian) read: `00 40 45 40` -5. Change them to: `00 C0 58 40` (which is `0x4058C000` in little-endian) -6. Press **Enter** - -**Verify** in the Listing view — the data should now show `4058C000h`. - -##### Step 8: Verify the Patch in the Decompile Window - -The decompiled code should now reference the new constant. The value loaded into `r3` should be `0x4058C000`. - -##### Step 9: Export the Patched Binary - -1. Click **File** → **Export Program** -2. Set **Format** to **Raw Bytes** -3. Navigate to your build directory -4. Name the file: `0x000e_floating-point-data-type-h.bin` -5. Click **OK** - -##### Step 10: Convert to UF2 Format - -Open a terminal and navigate to your project directory: - -```powershell -cd Embedded-Hacking-main\0x000e_floating-point-data-type -``` - -Run the conversion: - -```powershell -python ..\uf2conv.py build\0x000e_floating-point-data-type-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 11: Flash and Verify - -1. Hold **BOOTSEL** and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive -3. Open your serial monitor - -**Expected output:** - -``` -fav_num: 99.000000 -fav_num: 99.000000 -fav_num: 99.000000 -... -``` - -🎉 **Success!** The value changed from `42.5` to `99.0`! - -#### Expected Output - -After completing this exercise, you should: -- See `fav_num: 99.000000` printing instead of `fav_num: 42.500000` -- Have a patched binary file (`0x000e_floating-point-data-type-h.bin`) -- Have a UF2 file (`hacked.uf2`) -- Understand the complete IEEE 754 encoding and patching workflow for floats - -#### Questions for Reflection - -###### Question 1: Why did we only need to patch r3 (the high word) and not r2 (the low word)? - -###### Question 2: What would the high word be if we wanted to patch the value to `-99.0` instead? (Hint: which bit controls the sign?) - -###### Question 3: Walk through the encoding of `100.0` as a double. What are the high and low words? - -###### Question 4: Why do we need the `--family 0xe48bff59` flag when converting to UF2? - -#### Tips and Hints -- Always verify your encoding with Python: `import struct; struct.pack('>d', 99.0).hex()` -- Little-endian means the bytes in memory are reversed: `0x4058C000` is stored as `00 C0 58 40` -- If you patch the wrong bytes, use **File** → **Undo** in Ghidra (or re-import the original binary) -- The bias for double-precision is always 1023; for single-precision it's 127 -- A clean fractional part (like `.0` or `.5`) means the low word (`r2`) is all zeros - -#### Next Steps -- Proceed to Exercise 3 to analyze the double-precision binary -- Try patching to different values: `3.14`, `100.0`, `255.0` -- Compare how many register words change for clean vs. messy fractions - -#### Additional Challenge -Patch the float to `3.14` instead of `99.0`. Since `3.14` has a repeating binary fraction, the low word will **not** be zero. This means you need to modify the assembly to load a non-zero value into `r2` as well. Can you figure out where `r2` gets its zero value (`movs r4, #0x0`) and change it? diff --git a/WEEK05/WEEK05-03-S.md b/WEEK05/WEEK05-03-S.md deleted file mode 100644 index aa3fd6a..0000000 --- a/WEEK05/WEEK05-03-S.md +++ /dev/null @@ -1,70 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 3 Solution: Analyze the Double Binary in Ghidra - -#### Answers - -##### Register Pair for 42.52525 - -| Register | Value | Role | -|----------|-------------|---------------| -| r2 | 0x645A1CAC | Low 32 bits | -| r3 | 0x4045433B | High 32 bits | - -Full double: **0x4045433B645A1CAC** - -##### IEEE 754 Decoding - -``` -r3 = 0x4045433B = 0100 0000 0100 0101 0100 0011 0011 1011 -r2 = 0x645A1CAC = 0110 0100 0101 1010 0001 1100 1010 1100 - -Sign bit (bit 63): 0 → Positive -Exponent (bits 62-52): 10000000100 = 1028 → 1028 - 1023 = 5 -Mantissa (bits 51-0): 0101010000110011101101100100010110100001110010101100 - -Value = 1.0101010000110011...₂ × 2⁵ = 101010.10000110011...₂ -Integer part: 101010₂ = 32 + 8 + 2 = 42 -Fractional part: .10000110011... ≈ 0.52525 -Result: 42.52525 ✓ -``` - -##### Float vs Double Comparison - -| Item | Float (42.5) | Double (42.52525) | -|--------------------------|---------------------|------------------------| -| r2 (low word) | 0x00000000 | 0x645A1CAC | -| r3 (high word) | 0x40454000 | 0x4045433B | -| Low word is zero? | Yes | **No** | -| Words to patch | 1 (r3 only) | **2 (both r2 and r3)** | -| Format specifier | %f | %lf | -| Assembly load instruction| movs + ldr | ldrd (load double) | - -##### Key Assembly - -```assembly -10000238 push {r3,r4,r5,lr} -1000023a adr r5, [0x10000254] -1000023c ldrd r4, r5, [r5, #0x0] ; r4 = 0x645A1CAC, r5 = 0x4045433B -10000240 bl stdio_init_all -10000244 mov r2, r4 ; r2 = low word -10000246 mov r3, r5 ; r3 = high word -``` - -#### Reflection Answers - -1. **Why does `42.5` have a zero low word but `42.52525` does not?** - The fractional part determines whether the low word is zero. 0.5 in binary is exactly 2⁻¹ = `0.1₂`—a single bit. After normalization, the mantissa for 42.5 is `010101000...0`, needing only 6 significant bits, all fitting in the top 20 mantissa bits within r3. In contrast, 0.52525 is a **repeating binary fraction** that cannot be represented exactly—it requires all 52 mantissa bits to approximate as closely as possible. The lower 32 bits in r2 (`0x645A1CAC`) carry the additional precision needed for this approximation. - -2. **The assembly uses `ldrd r4, r5, [r5, #0x0]` instead of two separate `ldr` instructions. What is the advantage?** - `ldrd` (Load Register Double) loads two consecutive 32-bit words from memory in a single instruction, completing in one memory access cycle (or two back-to-back aligned accesses on the bus). Using two separate `ldr` instructions would require two instruction fetches, two decode cycles, and two memory accesses. `ldrd` reduces code size by 4 bytes (one 4-byte instruction vs. two) and improves performance by allowing the memory controller to pipeline both loads. For 64-bit doubles that are always loaded in pairs, `ldrd` is the optimal choice. - -3. **Both the float and double programs have the same exponent (stored as 1028, real exponent 5). Why?** - Both 42.5 and 42.52525 fall in the same range: between 32 (2⁵) and 64 (2⁶). Normalization produces `1.xxx × 2⁵` for both values. The exponent is determined solely by the magnitude (which power of 2 the number falls between), not by the fractional precision. Any number from 32.0 to 63.999... would have real exponent 5 (stored as 1028). The mantissa captures the differences—42.5 has mantissa `010101000...` while 42.52525 has `0101010000110011...`. - -4. **If you were patching this double, how many data constants would you need to modify compared to the float exercise?** - **Two** data constants—both `DAT_10000254` (low word, r2) and `DAT_10000258` (high word, r3). In the float exercise (42.5), only one constant needed patching because r2 was zero and stayed zero when patching to 99.0. For the double 42.52525, since the low word is already non-zero (`0x645A1CAC`), any new value with a different repeating fraction will require changing both words. The only exception would be patching to a value whose low word happens to also be `0x645A1CAC` (virtually impossible for an arbitrary target value). diff --git a/WEEK05/WEEK05-03.md b/WEEK05/WEEK05-03.md deleted file mode 100644 index 4b99d37..0000000 --- a/WEEK05/WEEK05-03.md +++ /dev/null @@ -1,277 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 3: Analyze the Double Binary in Ghidra - -#### Objective -Import and analyze the `0x0011_double-floating-point-data-type.bin` binary in Ghidra to understand how doubles differ from floats at the binary level, observe that **both** register words carry non-zero data when the fractional part is complex, and decode the IEEE 754 double-precision encoding of `42.52525` from two 32-bit registers. - -#### Prerequisites -- Completed Exercises 1 and 2 (float analysis and patching) -- Understanding of IEEE 754 double-precision format from Week 5 Part 3 -- Understanding of register pairs (`r2:r3`) from Exercise 1 -- Basic Ghidra navigation skills - -#### Task Description -You will import the double binary into Ghidra, resolve function names, identify that `42.52525` requires non-zero data in **both** r2 and r3 (unlike `42.5` which had r2 = 0), and decode the full 64-bit double `0x4045433B645A1CAC` field by field to confirm it represents `42.52525`. - -#### Step-by-Step Instructions - -##### Step 1: Flash the Original Binary - -Before analysis, verify the program works: - -1. Hold **BOOTSEL** and plug in your Pico 2 -2. Flash `0x0011_double-floating-point-data-type.uf2` to the RPI-RP2 drive -3. Open your serial monitor - -**Expected output:** -``` -fav_num: 42.525250 -fav_num: 42.525250 -fav_num: 42.525250 -... -``` - -##### Step 2: Create a New Ghidra Project - -1. Launch Ghidra: `ghidraRun` -2. Click **File** → **New Project** -3. Select **Non-Shared Project** -4. Project Name: `week05-ex03-double-analysis` -5. Click **Finish** - -##### Step 3: Import and Configure the Binary - -1. Drag and drop `0x0011_double-floating-point-data-type.bin` into Ghidra -2. Set Language: **ARM Cortex 32 little endian default** -3. Click **Options…** - - Block Name: `.text` - - Base Address: `10000000` -4. Click **OK** on all dialogs -5. Double-click the file and click **Yes** to analyze - -##### Step 4: Locate and Rename Functions - -Identify the main function and standard library calls: - -**Rename main:** -1. Click on `FUN_10000238` -2. Right-click → **Edit Function Signature** -3. Change to: `int main(void)` -4. Click **OK** - -**Rename stdio_init_all:** -1. Click on `FUN_10002f64` -2. Right-click → **Edit Function Signature** -3. Change to: `bool stdio_init_all(void)` -4. Click **OK** - -**Rename printf:** -1. Click on `FUN_100030f4` -2. Right-click → **Edit Function Signature** -3. Change to: `int printf(char *format,...)` -4. Check the **Varargs** checkbox -5. Click **OK** - -##### Step 5: Observe the Decompiled Code - -After renaming, the decompiled `main` should look like: - -```c -int main(void) -{ - undefined4 uVar1; - undefined4 uVar2; - undefined4 extraout_r1; - undefined4 uVar3; - undefined4 extraout_r1_00; - - uVar2 = DAT_10000258; - uVar1 = DAT_10000254; - stdio_init_all(); - uVar3 = extraout_r1; - do { - printf(DAT_10000250,uVar3,uVar1,uVar2); - uVar3 = extraout_r1_00; - } while( true ); -} -``` - -**Critical observation:** There are now **two** non-zero data constants — `DAT_10000254` and `DAT_10000258`. This is the key difference from the float exercise! - -##### Step 6: Examine the Assembly Listing - -Click on the **Listing** window and find the main function assembly: - -```assembly -10000238 push {r3,r4,r5,lr} -1000023a adr r5, [0x10000254] -1000023c ldrd r4, r5, [r5, #0x0] = 645A1CACh / 4045433Bh -10000240 bl stdio_init_all -``` - -**Key instruction: `ldrd r4, r5, [r5, #0x0]`** - -This is a **load register double** instruction — it loads two consecutive 32-bit words in a single instruction: -- `r4` gets the low word: `0x645A1CAC` -- `r5` gets the high word: `0x4045433B` - -Later in the loop: -```assembly -10000244 mov r2, r4 ; r2 = 0x645A1CAC (low) -10000246 mov r3, r5 ; r3 = 0x4045433B (high) -``` - -##### Step 7: Identify the Register Pair - -| Register | Value | Role | -| -------- | ------------ | ------------ | -| `r2` | `0x645A1CAC` | Low 32 bits | -| `r3` | `0x4045433B` | High 32 bits | - -Together: `0x4045433B645A1CAC` - -**Compare to the float exercise:** -- Float `42.5`: r2 = `0x00000000`, r3 = `0x40454000` — low word is all zeros -- Double `42.52525`: r2 = `0x645A1CAC`, r3 = `0x4045433B` — **both words are non-zero!** - -This happens because `42.52525` has a repeating binary fraction that needs all 52 mantissa bits. - -##### Step 8: Decode the Sign Bit - -Convert r3 to binary and check bit 31: - -``` -r3 = 0x4045433B = 0100 0000 0100 0101 0100 0011 0011 1011 - ^ - bit 31 = 0 → Positive number ✓ -``` - -##### Step 9: Decode the Exponent - -Extract bits 30–20 from r3: - -``` -0x4045433B: 0 10000000100 01010100001100111011 - ^ ^^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^ - sign exponent mantissa (top 20) -``` - -Exponent bits: `10000000100` = 2¹⁰ + 2² = 1024 + 4 = **1028** - -$$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ - -##### Step 10: Decode the Mantissa - -**High 20 bits** (r3 bits 19–0): -``` -0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 -``` - -**Low 32 bits** (all of r2 = `0x645A1CAC`): -``` -0 1 1 0 0 1 0 0 0 1 0 1 1 0 1 0 0 0 0 1 1 1 0 0 1 0 1 0 1 1 0 0 -``` - -With the implied leading `1`: -``` -1.0101010000110011101101100100010110100001110010101100 -``` - -##### Step 11: Reconstruct the Integer Part - -$$1.0101010000110011..._2 \times 2^5$$ - -Shift the binary point 5 places right → `101010.1000011001110110...` - -Integer part `101010`: - -| Bit | Power | Value | -|-----|-------|-------| -| 1 | 2⁵ | 32 | -| 0 | 2⁴ | 0 | -| 1 | 2³ | 8 | -| 0 | 2² | 0 | -| 1 | 2¹ | 2 | -| 0 | 2⁰ | 0 | - -$$32 + 8 + 2 = \mathbf{42}$$ - -##### Step 12: Approximate the Fractional Part - -The first few fractional bits `.10000110011...`: - -| Bit | Power | Decimal | -|------|--------|---------------| -| 1 | 2⁻¹ | 0.5 | -| 0 | 2⁻² | 0 | -| 0 | 2⁻³ | 0 | -| 0 | 2⁻⁴ | 0 | -| 0 | 2⁻⁵ | 0 | -| 1 | 2⁻⁶ | 0.015625 | -| 1 | 2⁻⁷ | 0.0078125 | -| 0 | 2⁻⁸ | 0 | -| 0 | 2⁻⁹ | 0 | -| 1 | 2⁻¹⁰ | 0.0009765625 | -| 1 | 2⁻¹¹ | 0.00048828125 | - -First 11 bits sum ≈ 0.5249. The remaining 36 fractional bits refine this to ≈ 0.52525. - -$$42 + 0.52525 = \mathbf{42.52525} ✓$$ - -##### Step 13: Find the Format String - -In the Listing view, locate: - -``` -s_fav_num:_%lf_100034b0 ds "fav_num: %lf\r\n" -``` - -Note the `%lf` format specifier — this program explicitly uses `double`, unlike the float program which used `%f`. - -##### Step 14: Document Your Findings - -| Item | Float (`42.5`) | Double (`42.52525`) | -| ------------------------- | -------------------- | ------------------------ | -| r2 (low word) | `0x00000000` | `0x645A1CAC` | -| r3 (high word) | `0x40454000` | `0x4045433B` | -| Low word is zero? | Yes | **No** | -| Words to patch | 1 (r3 only) | **2 (both r2 and r3)** | -| Format specifier | `%f` | `%lf` | -| Assembly load instruction | `movs` + `ldr` | `ldrd` (load double) | - -#### Expected Output - -After completing this exercise, you should understand: -- How the compiler loads a 64-bit double using `ldrd` (load register double) -- Why `42.52525` requires non-zero data in both registers while `42.5` does not -- How to decode a complex IEEE 754 double with a repeating binary fraction -- The differences between float and double handling at the assembly level - -#### Questions for Reflection - -###### Question 1: Why does `42.5` have a zero low word but `42.52525` does not? - -###### Question 2: The assembly uses `ldrd r4, r5, [r5, #0x0]` instead of two separate `ldr` instructions. What is the advantage? - -###### Question 3: Both the float and double programs have the same exponent (stored as 1028, real exponent 5). Why? - -###### Question 4: If you were patching this double, how many data constants would you need to modify compared to the float exercise? - -#### Tips and Hints -- Use Python to verify: `import struct; struct.pack('>d', 42.52525).hex()` gives `4045433b645a1cac` -- The `ldrd` instruction always loads the lower-addressed word into the first register -- A repeating binary fraction (like `0.52525`) can never be represented exactly — double precision uses the closest 52-bit approximation -- Compare data addresses: the float binary has one `DAT_` constant; the double binary has two consecutive ones - -#### Next Steps -- Proceed to Exercise 4 to patch both register words -- Compare the mantissa of `42.5` (clean: `010101 000...`) vs. `42.52525` (complex: `0101010000110011...`) -- Think about what values would have a zero low word (hint: powers of 2, halves, quarters) - -#### Additional Challenge -Using the 52-bit mantissa `0101010000110011101101100100010110100001110010101100`, manually sum the first 20 fractional bits to see how close you get to `0.52525`. How many bits of precision does it take to get within 0.001 of the true value? diff --git a/WEEK05/WEEK05-04-S.md b/WEEK05/WEEK05-04-S.md deleted file mode 100644 index df3491f..0000000 --- a/WEEK05/WEEK05-04-S.md +++ /dev/null @@ -1,70 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 4 Solution: Patch the Double Binary — Changing 42.52525 to 99.99 - -#### Answers - -##### IEEE 754 Encoding of 99.99 - -``` -Integer: 99 = 1100011₂ -Fractional: .99 ≈ .111111010111...₂ (repeating) -Combined: 1100011.111111010111...₂ -Normalized: 1.100011111111010111...₂ × 2⁶ - -Sign: 0 (positive) -Exponent: 6 + 1023 = 1029 = 10000000101₂ -Mantissa: 1000111111110101 11000010100011110101 11000010100011110...₂ (52 bits) - -Full double: 0x4058FF5C28F5C28F -``` - -Python verification: `struct.pack('>d', 99.99).hex()` → `4058ff5c28f5c28f` ✓ - -##### Patch Summary - -| Register | Old Value (42.52525) | New Value (99.99) | Changed? | -|----------|---------------------|-------------------|----------| -| r2 | 0x645A1CAC | 0x28F5C28F | **Yes** | -| r3 | 0x4045433B | 0x4058FF5C | **Yes** | - -##### Ghidra Patches - -**Low word (DAT_10000254):** -``` -Before (little-endian): AC 1C 5A 64 → 0x645A1CAC -After (little-endian): 8F C2 F5 28 → 0x28F5C28F -``` - -**High word (DAT_10000258):** -``` -Before (little-endian): 3B 43 45 40 → 0x4045433B -After (little-endian): 5C FF 58 40 → 0x4058FF5C -``` - -##### Serial Output - -``` -fav_num: 99.990000 -fav_num: 99.990000 -fav_num: 99.990000 -... -``` - -#### Reflection Answers - -1. **Why did both r2 and r3 change when patching 42.52525 → 99.99, but only r3 changed when patching 42.5 → 99.0?** - Both 42.5 and 99.0 have "clean" fractional parts (0.5 and 0.0 respectively) that are exact in binary—they need very few mantissa bits, all fitting in the top 20 bits of r3. The low word (r2) remains `0x00000000` for both. In contrast, 42.52525 and 99.99 both have repeating binary fractions (0.52525 and 0.99 respectively) that require all 52 mantissa bits to approximate. Since the low 32 bits of the mantissa live in r2, changing from one repeating fraction to another necessarily changes both r2 and r3. - -2. **The multiply-by-2 method for 0.99 produces a repeating pattern. What does this mean for the precision of the stored value?** - It means 99.99 **cannot** be represented exactly as an IEEE 754 double. The binary fraction 0.111111010111... repeats indefinitely, but the mantissa only has 52 bits. The stored value is the closest 52-bit approximation, which is 99.98999999999999... (off by approximately 10⁻¹⁴). This is a fundamental limitation of binary floating-point: decimal fractions that aren't sums of negative powers of 2 always produce repeating binary expansions. The `printf` output rounds to `99.990000` because the default `%lf` precision (6 decimal places) hides the tiny error. - -3. **If you wanted to patch the double to `100.0` instead of `99.99`, how many data constants would need to change?** - **Both** would need to change—but for the opposite reason. Currently r2 = `0x645A1CAC` (non-zero). For 100.0: `struct.pack('>d', 100.0).hex()` = `4059000000000000`, so r3 = `0x40590000` and r2 = `0x00000000`. The r2 constant must be patched from `0x645A1CAC` to `0x00000000`, and r3 from `0x4045433B` to `0x40590000`. Even though the low word becomes zero, you still need to patch it because it was previously non-zero. - -4. **Compare the Ghidra Listing for the float binary (Exercise 1) and the double binary (Exercise 3). How does the compiler load the double differently?** - The float binary uses separate instructions: `movs r4, #0x0` (loads zero into r4 for the low word) and `ldr r5, [DAT_1000024c]` (loads the high word from a literal pool). The double binary uses a single `ldrd r4, r5, [r5, #0x0]` instruction that loads both words from consecutive memory addresses in one operation. The `ldrd` approach is more efficient (fewer instructions, single memory transaction) and is preferred when both words carry meaningful data. The float's approach works fine because one word is a trivially loaded zero. diff --git a/WEEK05/WEEK05-04.md b/WEEK05/WEEK05-04.md deleted file mode 100644 index 462b882..0000000 --- a/WEEK05/WEEK05-04.md +++ /dev/null @@ -1,217 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 5 -Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis - -### Non-Credit Practice Exercise 4: Patch the Double Binary — Changing 42.52525 to 99.99 - -#### Objective -Calculate the IEEE 754 double-precision encoding of `99.99`, patch **both** register words in the double binary in Ghidra, export the patched binary, convert it to UF2 format, and flash it to the Pico 2 to verify the change. - -#### Prerequisites -- Completed Exercise 3 (double binary imported and analyzed in Ghidra) -- Understanding of IEEE 754 double-precision encoding from Week 5 Parts 2.7 and 3.7 -- Knowledge of integer-to-binary conversion and the multiply-by-2 method for fractions -- Python installed for UF2 conversion and verification -- Raspberry Pi Pico 2 connected via USB - -#### Task Description -You will derive the IEEE 754 encoding of `99.99` step by step (integer part, fractional part, normalization, field extraction), patch both the low word and high word data constants in Ghidra, and verify on hardware that the serial output now prints `99.990000`. Unlike Exercise 2 where only one word changed, this exercise requires patching **both** registers. - -#### Step-by-Step Instructions - -##### Step 1: Convert the Integer Part (99) to Binary - -Use repeated division by 2: - -| Division | Quotient | Remainder | -|----------|----------|-----------| -| 99 ÷ 2 | 49 | **1** | -| 49 ÷ 2 | 24 | **1** | -| 24 ÷ 2 | 12 | **0** | -| 12 ÷ 2 | 6 | **0** | -| 6 ÷ 2 | 3 | **0** | -| 3 ÷ 2 | 1 | **1** | -| 1 ÷ 2 | 0 | **1** | - -Read remainders bottom-to-top: $99_{10} = 1100011_2$ - -##### Step 2: Convert the Fractional Part (.99) to Binary - -Use the multiply-by-2 method: - -| Multiply | Result | Integer part | Remaining fraction | -|----------------|--------|--------------|-------------------| -| 0.99 × 2 | 1.98 | **1** | 0.98 | -| 0.98 × 2 | 1.96 | **1** | 0.96 | -| 0.96 × 2 | 1.92 | **1** | 0.92 | -| 0.92 × 2 | 1.84 | **1** | 0.84 | -| 0.84 × 2 | 1.68 | **1** | 0.68 | -| 0.68 × 2 | 1.36 | **1** | 0.36 | -| 0.36 × 2 | 0.72 | **0** | 0.72 | -| 0.72 × 2 | 1.44 | **1** | 0.44 | -| 0.44 × 2 | 0.88 | **0** | 0.88 | -| 0.88 × 2 | 1.76 | **1** | 0.76 | -| 0.76 × 2 | 1.52 | **1** | 0.52 | -| 0.52 × 2 | 1.04 | **1** | 0.04 | -| ... | ... | ... | *(continues — repeating fraction)* | - -Reading the integer parts top-to-bottom: $0.99_{10} \approx 0.111111010111..._2$ - -This is a **repeating fraction** — it never terminates in binary. - -##### Step 3: Combine Integer and Fractional Parts - -$$99.99_{10} = 1100011.111111010111..._2$$ - -##### Step 4: Normalize to IEEE 754 Form - -Move the binary point so there is exactly one `1` before it: - -$$1100011.111111010111..._2 = 1.100011111111010111..._2 \times 2^6$$ - -We shifted the binary point 6 places left, so the exponent is **6**. - -##### Step 5: Extract the IEEE 754 Fields - -1. **Sign:** `0` (positive) -2. **Exponent:** $6 + 1023 = 1029 = 10000000101_2$ -3. **Mantissa:** `1000111111110101110000101000111101011100001010001111...` (52 bits after the `1.`) -4. **Full double:** `0x4058FF5C28F5C28F` - -**Verify with Python:** -```python ->>> import struct ->>> struct.pack('>d', 99.99).hex() -'4058ff5c28f5c28f' -``` - -##### Step 6: Split into Register Words - -| Register | Old Value | New Value | Changed? | -| -------- | ------------ | ------------ | -------- | -| `r2` | `0x645A1CAC` | `0x28F5C28F` | **Yes** | -| `r3` | `0x4045433B` | `0x4058FF5C` | **Yes** | - -**Both registers change!** This is the key difference from Exercise 2 where only r3 changed. - -##### Step 7: Locate the Data Constants in Ghidra - -Open your Ghidra project from Exercise 3. In the Listing view, find the two data constants: - -**Low word (loaded into r2):** -``` - DAT_10000254 -10000254 ac 1c 5a 64 undefined4 645A1CACh -``` - -**High word (loaded into r3):** -``` - DAT_10000258 -10000258 3b 43 45 40 undefined4 4045433Bh -``` - -##### Step 8: Patch the Low Word - -1. Click on **Window** → **Bytes** to open the Bytes Editor -2. Click the **Pencil Icon** to enable editing -3. Navigate to address `10000254` -4. The bytes read: `AC 1C 5A 64` (little-endian for `0x645A1CAC`) -5. Change to: `8F C2 F5 28` (little-endian for `0x28F5C28F`) -6. Press **Enter** - -##### Step 9: Patch the High Word - -1. Navigate to address `10000258` -2. The bytes read: `3B 43 45 40` (little-endian for `0x4045433B`) -3. Change to: `5C FF 58 40` (little-endian for `0x4058FF5C`) -4. Press **Enter** - -**Verify** in the Listing view: -- `DAT_10000254` should show `28F5C28Fh` -- `DAT_10000258` should show `4058FF5Ch` - -Together: `0x4058FF5C28F5C28F` = `99.99` as a double ✓ - -##### Step 10: Export the Patched Binary - -1. Click **File** → **Export Program** -2. Set **Format** to **Raw Bytes** -3. Navigate to your build directory -4. Name the file: `0x0011_double-floating-point-data-type-h.bin` -5. Click **OK** - -##### Step 11: Convert to UF2 Format - -Open a terminal: - -```powershell -cd Embedded-Hacking-main\0x0011_double-floating-point-data-type -``` - -```powershell -python ..\uf2conv.py build\0x0011_double-floating-point-data-type-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 12: Flash and Verify - -1. Hold **BOOTSEL** and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive -3. Open your serial monitor - -**Expected output:** - -``` -fav_num: 99.990000 -fav_num: 99.990000 -fav_num: 99.990000 -... -``` - -🎉 **Success!** The value changed from `42.52525` to `99.99`! - -#### Expected Output - -After completing this exercise, you should: -- See `fav_num: 99.990000` printing instead of `fav_num: 42.525250` -- Have a patched binary file (`0x0011_double-floating-point-data-type-h.bin`) -- Have a UF2 file (`hacked.uf2`) -- Understand that patching doubles with repeating fractions requires modifying **both** register words - -#### Questions for Reflection - -###### Question 1: Why did both r2 and r3 change when patching 42.52525 → 99.99, but only r3 changed when patching 42.5 → 99.0? - -###### Question 2: The multiply-by-2 method for 0.99 produces a repeating pattern. What does this mean for the precision of the stored value? - -###### Question 3: If you wanted to patch the double to `100.0` instead of `99.99`, how many data constants would need to change? - -###### Question 4: Compare the Ghidra Listing for the float binary (Exercise 1) and the double binary (Exercise 3). How does the compiler load the double differently? - -#### Tips and Hints -- Always verify your encoding with Python before patching -- Little-endian byte order: `0x28F5C28F` is stored as `8F C2 F5 28` in memory -- Use Ghidra's **Bytes** window (Window → Bytes) for precise hex editing -- If `r2` was zero before and needs to be non-zero after, you need to patch the data constant — not the `movs r4, #0x0` instruction -- The `ldrd` instruction loads r4 and r5 from two consecutive memory addresses — both must be correct - -#### Next Steps -- Review the complete patching workflow diagram in Week 5 Part 3.95 -- Try patching to `100.0` — since it has a zero low word, you'll need to change `r2` from non-zero to zero -- Attempt the practice exercises at the end of Week 5 - -#### Additional Challenge -Patch the double to `3.14159265358979` (pi). This requires extreme precision in all 52 mantissa bits. Use Python to get the exact encoding, then patch both words. Verify the output prints at least 6 correct decimal places. What happens to the precision if you only patch the high word and leave the low word as `0x645A1CAC`? - -#### Verification Checklist - -Before moving on, confirm: -- [ ] Serial output shows `fav_num: 99.990000` -- [ ] Both data constants were patched (low word and high word) -- [ ] You can derive the IEEE 754 encoding of `99.99` from scratch -- [ ] You understand why messy fractions require patching both register words -- [ ] You can explain the difference between the float and double patching workflows -- [ ] You successfully converted and flashed the UF2 - -**Congratulations!** You've completed all Week 5 exercises and mastered floating-point analysis, IEEE 754 decoding, and double-precision binary patching! diff --git a/WEEK05/WEEK05.md b/WEEK05/WEEK05.md index 2b75625..059411c 100644 --- a/WEEK05/WEEK05.md +++ b/WEEK05/WEEK05.md @@ -1,6 +1,6 @@ -# Week 5: Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis +?# Week 5: Integers and Floats in Embedded Systems: Debugging and Hacking Integers and Floats w/ Intermediate GPIO Output Assembler Analysis -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand how integers and floating-point numbers are stored in memory @@ -13,7 +13,7 @@ By the end of this tutorial, you will be able to: - Reconstruct 64-bit doubles from two 32-bit registers --- -## 📚 Part 1: Understanding Integer Data Types +## Part 1: Understanding Integer Data Types ### What is an Integer? @@ -22,15 +22,15 @@ An **integer** is a whole number without any decimal point. Think of it like cou In C programming for embedded systems, we have special integer types that tell the compiler exactly how much memory to use: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Integer Types - Different Sizes for Different Needs │ -│ │ -│ uint8_t: 1 byte (0 to 255) - like a small box │ -│ int8_t: 1 byte (-128 to 127) - can hold negatives! │ -│ uint16_t: 2 bytes (0 to 65,535) - medium box │ -│ uint32_t: 4 bytes (0 to 4 billion) - big box │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Integer Types - Different Sizes for Different Needs | +| | +| uint8_t: 1 byte (0 to 255) - like a small box | +| int8_t: 1 byte (-128 to 127) - can hold negatives! | +| uint16_t: 2 bytes (0 to 65,535) - medium box | +| uint32_t: 4 bytes (0 to 4 billion) - big box | +| | ++-----------------------------------------------------------------+ ``` ### Signed vs Unsigned Integers @@ -125,7 +125,7 @@ uint8_t age = 43; int8_t range = -42; ``` -The variable `age` is a `uint8_t` — an **unsigned** 8-bit integer that can only hold values from `0` to `255`. Since age is always a positive number, unsigned is the right choice. The variable `range` is an `int8_t` — a **signed** 8-bit integer that can hold values from `-128` to `127`. The signed type allows it to represent negative numbers like `-42`. Under the hood, negative values are stored using **two's complement** encoding: the CPU flips all the bits of `42` (`0x2A`) and adds `1`, producing `0xD6`, which is how `-42` lives in a single byte of memory. +The variable `age` is a `uint8_t` - an **unsigned** 8-bit integer that can only hold values from `0` to `255`. Since age is always a positive number, unsigned is the right choice. The variable `range` is an `int8_t` - a **signed** 8-bit integer that can hold values from `-128` to `127`. The signed type allows it to represent negative numbers like `-42`. Under the hood, negative values are stored using **two's complement** encoding: the CPU flips all the bits of `42` (`0x2A`) and adds `1`, producing `0xD6`, which is how `-42` lives in a single byte of memory. #### GPIO Initialization with Inline Assembly @@ -133,11 +133,11 @@ Instead of using the Pico SDK's `gpio_init()`, `gpio_set_dir()`, and `gpio_set_f The initialization loop configures GPIO pins 16 through 19 (our red, green, blue, and yellow LEDs) in three steps per pin: -**Step 1 — Configure the pad.** Each GPIO pin has a pad control register in `PADS_BANK0` starting at base address `0x40038000`. The code calculates the offset as `pin * 4`, loads the current register value, clears the **OD** (output disable) and **ISO** (isolation) bits with `bic r5, r5, #0x180`, and sets the **IE** (input enable) bit with `orr r5, r5, #0x40`. This ensures the pad is electrically active and ready to drive output. +**Step 1 - Configure the pad.** Each GPIO pin has a pad control register in `PADS_BANK0` starting at base address `0x40038000`. The code calculates the offset as `pin * 4`, loads the current register value, clears the **OD** (output disable) and **ISO** (isolation) bits with `bic r5, r5, #0x180`, and sets the **IE** (input enable) bit with `orr r5, r5, #0x40`. This ensures the pad is electrically active and ready to drive output. -**Step 2 — Set the pin function.** Each GPIO pin has a control register in `IO_BANK0` starting at `0x40028004`. The offset is `pin * 8` because each pin's control block is 8 bytes wide. The code clears the `FUNCSEL` field (bits `[4:0]`) and sets it to `5`, which selects the **SIO** (Single-cycle I/O) function. SIO is the mode that lets software directly control pin state through the GPIO coprocessor. +**Step 2 - Set the pin function.** Each GPIO pin has a control register in `IO_BANK0` starting at `0x40028004`. The offset is `pin * 8` because each pin's control block is 8 bytes wide. The code clears the `FUNCSEL` field (bits `[4:0]`) and sets it to `5`, which selects the **SIO** (Single-cycle I/O) function. SIO is the mode that lets software directly control pin state through the GPIO coprocessor. -**Step 3 — Enable the output driver.** The instruction `mcrr p0, #4, r4, r5, c4` writes to the RP2350's GPIO coprocessor. Coprocessor register `c4` controls the **output enable** — with `r4` holding the pin number and `r5` set to `1`, this tells the hardware "this pin is an output." The `mcrr` (Move to Coprocessor from two ARM Registers) instruction is how the Cortex-M33 on the RP2350 talks to its dedicated GPIO coprocessor, bypassing the normal memory-mapped I/O path for single-cycle pin control. +**Step 3 - Enable the output driver.** The instruction `mcrr p0, #4, r4, r5, c4` writes to the RP2350's GPIO coprocessor. Coprocessor register `c4` controls the **output enable** - with `r4` holding the pin number and `r5` set to `1`, this tells the hardware "this pin is an output." The `mcrr` (Move to Coprocessor from two ARM Registers) instruction is how the Cortex-M33 on the RP2350 talks to its dedicated GPIO coprocessor, bypassing the normal memory-mapped I/O path for single-cycle pin control. #### The Blink Loop with Inline Assembly @@ -147,7 +147,7 @@ Inside the `while (1)` loop, the program uses two inline assembly blocks to togg "mcrr p0, #4, r4, r5, c0\n" // gpioc_bit_out_put(pin, 1) ``` -This time the coprocessor register is `c0` instead of `c4`. Register `c0` controls the **output value** — setting `r5 = 1` drives the pin HIGH (LED on), and `r5 = 0` drives it LOW (LED off). Each toggle is followed by `sleep_ms(500)` for a half-second delay, creating a visible blink. +This time the coprocessor register is `c0` instead of `c4`. Register `c0` controls the **output value** - setting `r5 = 1` drives the pin HIGH (LED on), and `r5 = 0` drives it LOW (LED off). Each toggle is followed by `sleep_ms(500)` for a half-second delay, creating a visible blink. The GCC extended assembly syntax `"r"(pin)` tells the compiler to load the C variable `pin` into a general-purpose register and make it available as `%0` inside the assembly block. The clobber list `"r4","r5"` warns the compiler that those registers are modified, so it won't store anything important there. @@ -160,42 +160,42 @@ pin++; if (pin > 18) pin = 16; ``` -This cycles through GPIO 16, 17, and 18 — red, green, and blue LEDs — creating a rotating blink pattern. Finally, `printf` prints both integer variables over UART so we can observe their values on the serial terminal: +This cycles through GPIO 16, 17, and 18 - red, green, and blue LEDs - creating a rotating blink pattern. Finally, `printf` prints both integer variables over UART so we can observe their values on the serial terminal: ``` age: 43 range: -42 ``` -> 💡 **Why use inline assembly instead of the SDK?** This program is designed to teach you what happens *beneath* the SDK. When you call `gpio_put(16, 1)` in normal Pico code, the SDK ultimately does the same coprocessor write — `mcrr p0, #4, r4, r5, c0`. By writing the assembly directly, you can see exactly how the RP2350 hardware is controlled, which is essential knowledge for reverse engineering and binary patching. +> Tip: **Why use inline assembly instead of the SDK?** This program is designed to teach you what happens *beneath* the SDK. When you call `gpio_put(16, 1)` in normal Pico code, the SDK ultimately does the same coprocessor write - `mcrr p0, #4, r4, r5, c0`. By writing the assembly directly, you can see exactly how the RP2350 hardware is controlled, which is essential knowledge for reverse engineering and binary patching. --- -## 📚 Part 2: Understanding Floating-Point Data Types +## Part 2: Understanding Floating-Point Data Types ### What is a Float? A **float** is a number that can have a decimal point. Unlike integers which can only hold whole numbers like `42`, a float can hold values like `42.5`, `3.14`, or `-0.001`. In C, the `float` type uses **32 bits (4 bytes)** to store a number using the **IEEE 754** standard. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ IEEE 754 Single-Precision (32-bit float) │ -│ │ -│ ┌──────┬──────────┬───────────────────────────┐ │ -│ │ Sign │ Exponent │ Mantissa (Fraction) │ │ -│ │ 1bit │ 8 bits │ 23 bits │ │ -│ └──────┴──────────┴───────────────────────────┘ │ -│ │ -│ Value = (-1)^sign × 2^(exponent-127) × 1.mantissa │ -│ │ -│ Example: 42.5 │ -│ Sign: 0 (positive) │ -│ Exponent: 10000100 (132 - 127 = 5) │ -│ Mantissa: 01010100000000000000000 │ -│ Full: 0 10000100 01010100000000000000000 │ -│ Hex: 0x422A0000 │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| IEEE 754 Single-Precision (32-bit float) | +| | +| +------+----------+---------------------------+ | +| | Sign | Exponent | Mantissa (Fraction) | | +| | 1bit | 8 bits | 23 bits | | +| +------+----------+---------------------------+ | +| | +| Value = (-1)^sign * 2^(exponent-127) * 1.mantissa | +| | +| Example: 42.5 | +| Sign: 0 (positive) | +| Exponent: 10000100 (132 - 127 = 5) | +| Mantissa: 01010100000000000000000 | +| Full: 0 10000100 01010100000000000000000 | +| Hex: 0x422A0000 | +| | ++-----------------------------------------------------------------+ ``` ### Float vs Integer - Key Differences @@ -204,7 +204,7 @@ A **float** is a number that can have a decimal point. Unlike integers which can | -------------- | ---------------------- | --------------------------- | | **Size** | 1 byte | 4 bytes | | **Precision** | Exact | ~7 decimal digits | -| **Range** | 0 to 255 | ±3.4 × 10³⁸ | +| **Range** | 0 to 255 | ?3.4 * 10++ | | **Encoding** | Direct binary | IEEE 754 (sign/exp/mantissa)| | **printf** | `%d` | `%f` | @@ -233,7 +233,7 @@ int main(void) { 2. Initializes the serial output 3. Prints `fav_num` forever in a loop using the `%f` format specifier -> 💡 **Why `%f` instead of `%d`?** The `%d` format specifier tells `printf` to expect an integer. The `%f` specifier tells it to expect a floating-point number. Using the wrong one would print garbage! +> Tip: **Why `%f` instead of `%d`?** The `%d` format specifier tells `printf` to expect an integer. The `%f` specifier tells it to expect a floating-point number. Using the wrong one would print garbage! ### Step 1: Flash the Binary to Your Pico 2 @@ -260,7 +260,7 @@ The program is printing `42.500000` because `printf` with `%f` defaults to 6 dec --- -## 🔬 Part 2.5: Setting Up Ghidra for Float Analysis +## ? Part 2.5: Setting Up Ghidra for Float Analysis ### Step 3: Start Ghidra @@ -274,7 +274,7 @@ Ghidra will open. Now we need to create a new project. ### Step 4: Create a New Project -1. Click **File** → **New Project** +1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** 4. Enter Project Name: `0x000e_floating-point-data-type` @@ -293,12 +293,12 @@ Ghidra will open. Now we need to create a new project. A dialog appears. The file is identified as a "BIN" (raw binary without debug symbols). -**Click the three dots (…) next to "Language" and:** +**Click the three dots (...) next to "Language" and:** 1. Search for "Cortex" 2. Select **ARM Cortex 32 little endian default** 3. Click **OK** -**Click the "Options…" button and:** +**Click the "Options..." button and:** 1. Change **Block Name** to `.text` 2. Change **Base Address** to `10000000` (the XIP address!) 3. Click **OK** @@ -313,7 +313,7 @@ Wait for analysis to complete (watch the progress bar in the bottom right). --- -## 🔬 Part 2.6: Navigating and Resolving Functions +## ? Part 2.6: Navigating and Resolving Functions ### Step 8: Find the Functions @@ -347,7 +347,7 @@ For `main`, let's also fix the return type: --- -## 🔬 Part 2.7: Analyzing the Main Function +## ? Part 2.7: Analyzing the Main Function ### Step 11: Examine Main in Ghidra @@ -376,14 +376,14 @@ int main(void) ### Step 12: Resolve stdio_init_all 1. Click on `FUN_10002f5c` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `bool stdio_init_all(void)` 4. Click **OK** ### Step 13: Resolve printf 1. Click on `FUN_100030ec` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `int __wrap_printf(char *format,...)` 4. Check the **Varargs** checkbox (printf takes variable arguments!) 5. Click **OK** @@ -412,7 +412,7 @@ int main(void) **Where's `float fav_num = 42.5`?** It's been optimized into an immediate value! -The compiler replaced our float variable with constants passed directly to `printf`. But wait — we see **two** values: `0x0`, in `r2` and `DAT_1000024c` or `0x40454000`, in `r3`. That's because `printf` with `%f` always receives a **double** (64-bit), not a `float` (32-bit). The C standard requires that `float` arguments to variadic functions like `printf` are **promoted to `double`**. +The compiler replaced our float variable with constants passed directly to `printf`. But wait - we see **two** values: `0x0`, in `r2` and `DAT_1000024c` or `0x40454000`, in `r3`. That's because `printf` with `%f` always receives a **double** (64-bit), not a `float` (32-bit). The C standard requires that `float` arguments to variadic functions like `printf` are **promoted to `double`**. A 64-bit double is passed in two 32-bit registers: @@ -421,7 +421,7 @@ A 64-bit double is passed in two 32-bit registers: | `r2` | `0x00000000` | Low 32 bits | | `r3` | `0x40454000` | High 32 bits | -Together they form `0x40454000_00000000` — the IEEE 754 **double-precision** encoding of `42.5`. +Together they form `0x40454000_00000000` - the IEEE 754 **double-precision** encoding of `42.5`. ### Step 15: Verify the Double Encoding @@ -436,11 +436,11 @@ Laid out as a single 64-bit value with every bit numbered: ``` Bit: 63 62-52 (11 bits) 51-32 (20 bits) 31-0 (32 bits) - ┌───┬───────────────────────┬──────────────────────────────────────────┬──────────────────────────────────┐ - │ 0 │ 1 0 0 0 0 0 0 0 1 0 0 │ 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 │ 00000000000000000000000000000000 │ - └───┴───────────────────────┴──────────────────────────────────────────┴──────────────────────────────────┘ + +---+-----------------------+------------------------------------------+----------------------------------+ + | 0 | 1 0 0 0 0 0 0 0 1 0 0 | 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 | 00000000000000000000000000000000 | + +---+-----------------------+------------------------------------------+----------------------------------+ Sign Exponent (11) Mantissa high 20 bits Mantissa low 32 bits - (from r3 bits 19–0) (from r2, all zero) + (from r3 bits 19-0) (from r2, all zero) ``` **Step-by-step field extraction:** @@ -455,11 +455,11 @@ In IEEE 754, the **sign bit** is the very first (leftmost) bit of the 64-bit dou sign bit ``` -But we don't have a single 64-bit register — we have **two** 32-bit registers. The high register `r3` holds bits 63–32 of the double. So bit 63 of the double is the same physical bit as **bit 31 of r3** (the topmost bit of r3): +But we don't have a single 64-bit register - we have **two** 32-bit registers. The high register `r3` holds bits 63-32 of the double. So bit 63 of the double is the same physical bit as **bit 31 of r3** (the topmost bit of r3): ``` -r3 holds bits 63–32 of the double -r2 holds bits 31–0 of the double +r3 holds bits 63-32 of the double +r2 holds bits 31-0 of the double ``` Now let's check it. IEEE 754 uses a simple rule for the sign bit: @@ -472,14 +472,14 @@ Now let's check it. IEEE 754 uses a simple rule for the sign bit: ``` r3 = 0x40454000 = 0100 0000 0100 0101 0100 0000 0000 0000 ^ - r3 bit 31 = 0 → sign = 0 → Positive number + r3 bit 31 = 0 -> sign = 0 -> Positive number ``` The topmost bit of r3 is `0`, so the number is **positive**. If that bit were `1` instead (e.g. `0xC0454000`), the number would be negative (`-42.5`). -**2. Exponent — bits 62–52 of the 64-bit value = bits 30–20 of r3** +**2. Exponent - bits 62-52 of the 64-bit value = bits 30-20 of r3** -Extract bits 30–20 from `0x40454000`: +Extract bits 30-20 from `0x40454000`: ``` 0x40454000 in binary: 0 10000000100 01010100000000000000 @@ -490,9 +490,9 @@ Exponent bits: `10000000100` Convert to decimal: $2^{10} + 2^{2} = 1024 + 4 = 1028$ -But `1028` is **not** the actual power of 2 yet. IEEE 754 stores exponents with a **bias** — a fixed number that gets added during encoding so that the stored value is always positive (no sign bit needed for the exponent). For doubles, the bias is **1023**. +But `1028` is **not** the actual power of 2 yet. IEEE 754 stores exponents with a **bias** - a fixed number that gets added during encoding so that the stored value is always positive (no sign bit needed for the exponent). For doubles, the bias is **1023**. -> 💡 **Why 1023?** The exponent field is 11 bits wide, giving $2^{11} = 2048$ total values. Half of that range should represent negative exponents and half positive. The midpoint is $(2^{11} / 2) - 1 = 1023$. So a stored exponent of `1023` means a real exponent of **0**, values below `1023` are negative exponents, and values above `1023` are positive exponents. +> Tip: **Why 1023?** The exponent field is 11 bits wide, giving $2^{11} = 2048$ total values. Half of that range should represent negative exponents and half positive. The midpoint is $(2^{11} / 2) - 1 = 1023$. So a stored exponent of `1023` means a real exponent of **0**, values below `1023` are negative exponents, and values above `1023` are positive exponents. To recover the real exponent, we subtract the bias: @@ -502,25 +502,25 @@ $$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ This means the number is scaled by $2^5 = 32$. In other words, the mantissa gets shifted left by 5 binary places. -**3. Mantissa — bits 51–0 of the 64-bit value** +**3. Mantissa - bits 51-0 of the 64-bit value** -- **High 20 bits of mantissa** (bits 51–32) = bits 19–0 of r3: +- **High 20 bits of mantissa** (bits 51-32) = bits 19-0 of r3: ``` -r3 bits 19–0: 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 +r3 bits 19-0: 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ``` -- **Low 32 bits of mantissa** (bits 31–0) = all of r2: +- **Low 32 bits of mantissa** (bits 31-0) = all of r2: ``` -r2 = 0x00000000 → 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 +r2 = 0x00000000 -> 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ``` Full 52-bit mantissa: ``` 0 1 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 | 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 - ← top 20 bits from r3 → ← bottom 32 bits from r2 (all zero) → + ?? top 20 bits from r3 -> ?? bottom 32 bits from r2 (all zero) -> ``` IEEE 754 always prepends an **implied leading `1`**, so the actual value represented is: @@ -547,9 +547,9 @@ Now convert each bit position to decimal: | `0` (bit 2) | $2^2$ | 0 | | `1` (bit 1) | $2^1$ | 2 | | `0` (bit 0) | $2^0$ | 0 | -| `1` (bit −1) | $2^{-1}$ | 0.5 | +| `1` (bit ?1) | $2^{-1}$ | 0.5 | -$$32 + 8 + 2 + 0.5 = \mathbf{42.5} ✓$$ +$$32 + 8 + 2 + 0.5 = \mathbf{42.5} ?$$ ### Step 16: Examine the Assembly @@ -583,7 +583,7 @@ Look at the **Listing** window (assembly view). Find the main function: ``` -> 🎯 **Key Insight:** The `mov.w r2, #0x0` loads the low 32 bits (all zeros) and `ldr r3, [DAT_...]` loads the high 32 bits (`0x40454000`) of the double. Together, `r2:r3` = `0x40454000_00000000` = `42.5` as a double. +> ? **Key Insight:** The `mov.w r2, #0x0` loads the low 32 bits (all zeros) and `ldr r3, [DAT_...]` loads the high 32 bits (`0x40454000`) of the double. Together, `r2:r3` = `0x40454000_00000000` = `42.5` as a double. ### Step 17: Find the Format String @@ -601,41 +601,41 @@ This confirms `printf` is called with the format string `"fav_num: %f\r\n"` and --- -## 🔬 Part 2.8: Patching the Float - Changing 42.5 to 99.0 +## ? Part 2.8: Patching the Float - Changing 42.5 to 99.0 ### Step 18: Calculate the New IEEE 754 Encoding We want to change `42.5` to `99.0`. First, we need to figure out the double-precision encoding of `99.0`: -**Step A — Convert the integer part (99) to binary:** +**Step A - Convert the integer part (99) to binary:** | Division | Quotient | Remainder | |---------------|----------|-----------| -| 99 ÷ 2 | 49 | **1** | -| 49 ÷ 2 | 24 | **1** | -| 24 ÷ 2 | 12 | **0** | -| 12 ÷ 2 | 6 | **0** | -| 6 ÷ 2 | 3 | **0** | -| 3 ÷ 2 | 1 | **1** | -| 1 ÷ 2 | 0 | **1** | +| 99 ? 2 | 49 | **1** | +| 49 ? 2 | 24 | **1** | +| 24 ? 2 | 12 | **0** | +| 12 ? 2 | 6 | **0** | +| 6 ? 2 | 3 | **0** | +| 3 ? 2 | 1 | **1** | +| 1 ? 2 | 0 | **1** | Read remainders bottom-to-top: $99_{10} = 1100011_2$ -**Step B — Convert the fractional part (.0) to binary:** +**Step B - Convert the fractional part (.0) to binary:** -There is no fractional part — `.0` is exactly zero, so the fractional binary is just `0`. +There is no fractional part - `.0` is exactly zero, so the fractional binary is just `0`. -**Step C — Combine:** +**Step C - Combine:** $$99.0_{10} = 1100011.0_2$$ -**Step D — Normalize to IEEE 754 form** (move the binary point so there's exactly one `1` before it): +**Step D - Normalize to IEEE 754 form** (move the binary point so there's exactly one `1` before it): $$1100011.0_2 = 1.100011_2 \times 2^6$$ We shifted the binary point 6 places left, so the exponent is **6**. -**Step E — Extract the IEEE 754 fields:** +**Step E - Extract the IEEE 754 fields:** 1. **Sign:** `0` (positive) 2. **Exponent:** $6 + 1023 = 1029 = 10000000101_2$ @@ -657,7 +657,7 @@ Look in the Listing view for the data that loads the high word of the double: 10000248 00 40 45 40 undefined4 40454000h ``` -This is the 32-bit constant that gets loaded into `r3` — the high word of our double `42.5`. +This is the 32-bit constant that gets loaded into `r3` - the high word of our double `42.5`. ### Step 20: Patch the Constant @@ -671,11 +671,11 @@ This changes the high word from `0x40454000` (42.5 as double) to `0x4058C000` (9 --- -## 🔬 Part 2.9: Export and Test the Hacked Binary +## ? Part 2.9: Export and Test the Hacked Binary ### Step 21: Export the Patched Binary -1. Click **File** → **Export Program** +1. Click **File** -> **Export Program** 2. Set **Format** to **Raw Bytes** 3. Navigate to your build directory 4. Name the file `0x000e_floating-point-data-type-h.bin` @@ -686,7 +686,7 @@ This changes the high word from `0x40454000` (42.5 as double) to `0x4058C000` (9 **Open a terminal and navigate to your project directory:** ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x000e_floating-point-data-type +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x000e_floating-point-data-type ``` **Run the conversion command:** @@ -710,34 +710,34 @@ fav_num: 99.000000 ... ``` -🎉 **BOOM! We hacked the float!** The value changed from `42.5` to `99.0`! +? **BOOM! We hacked the float!** The value changed from `42.5` to `99.0`! --- -## 📚 Part 3: Understanding Double-Precision Floating-Point Data Types +## Part 3: Understanding Double-Precision Floating-Point Data Types ### What is a Double? -A **double** (short for "double-precision floating-point") is like a `float` but with **twice the precision**. While a `float` uses 32 bits, a `double` uses **64 bits (8 bytes)**, giving it roughly **15–16 significant decimal digits** of precision compared to a float's ~7. +A **double** (short for "double-precision floating-point") is like a `float` but with **twice the precision**. While a `float` uses 32 bits, a `double` uses **64 bits (8 bytes)**, giving it roughly **15-16 significant decimal digits** of precision compared to a float's ~7. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ IEEE 754 Double-Precision (64-bit double) │ -│ │ -│ ┌──────┬───────────┬──────────────────────────────────────┐ │ -│ │ Sign │ Exponent │ Mantissa (Fraction) │ │ -│ │ 1bit │ 11 bits │ 52 bits │ │ -│ └──────┴───────────┴──────────────────────────────────────┘ │ -│ │ -│ Value = (-1)^sign × 2^(exponent-1023) × 1.mantissa │ -│ │ -│ Example: 42.52525 │ -│ Sign: 0 (positive) │ -│ Exponent: 10000000100 (1028 - 1023 = 5) │ -│ Mantissa: 0101010000110011101101100100010110100001110010101100 │ -│ Hex: 0x4045433B645A1CAC │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| IEEE 754 Double-Precision (64-bit double) | +| | +| +------+-----------+--------------------------------------+ | +| | Sign | Exponent | Mantissa (Fraction) | | +| | 1bit | 11 bits | 52 bits | | +| +------+-----------+--------------------------------------+ | +| | +| Value = (-1)^sign * 2^(exponent-1023) * 1.mantissa | +| | +| Example: 42.52525 | +| Sign: 0 (positive) | +| Exponent: 10000000100 (1028 - 1023 = 5) | +| Mantissa: 0101010000110011101101100100010110100001110010101100 | +| Hex: 0x4045433B645A1CAC | +| | ++-----------------------------------------------------------------+ ``` ### Float vs Double - Key Differences @@ -748,11 +748,11 @@ A **double** (short for "double-precision floating-point") is like a `float` but | **Precision** | ~7 decimal digits | ~15 decimal digits | | **Exponent** | 8 bits (bias 127) | 11 bits (bias 1023) | | **Mantissa** | 23 bits | 52 bits | -| **Range** | ±3.4 × 10³⁸ | ±1.8 × 10³⁰⁸ | +| **Range** | ?3.4 * 10++ | ?1.8 * 10+++? | | **printf** | `%f` | `%lf` | | **ARM passing** | Promoted to double | Native in `r2:r3` | -> 💡 **Why does precision matter?** With a `float`, the value `42.52525` might be stored as `42.525249` due to rounding. A `double` can represent it as `42.525250` with much higher fidelity. For scientific or financial applications, that extra precision is critical! +> Tip: **Why does precision matter?** With a `float`, the value `42.52525` might be stored as `42.525249` due to rounding. A `double` can represent it as `42.525250` with much higher fidelity. For scientific or financial applications, that extra precision is critical! ### Our Double-Precision Program @@ -779,7 +779,7 @@ int main(void) { 2. Initializes the serial output 3. Prints `fav_num` forever in a loop using the `%lf` format specifier -> 💡 **`%lf` vs `%f`:** While `printf` actually treats `%f` and `%lf` identically (both expect a `double`), using `%lf` makes your intent clear — you're explicitly working with a `double`, not a `float`. It's good practice to match the format specifier to your variable type. +> Tip: **`%lf` vs `%f`:** While `printf` actually treats `%f` and `%lf` identically (both expect a `double`), using `%lf` makes your intent clear - you're explicitly working with a `double`, not a `float`. It's good practice to match the format specifier to your variable type. ### Step 1: Flash the Binary to Your Pico 2 @@ -806,7 +806,7 @@ The program is printing `42.525250` because `printf` with `%lf` defaults to 6 de --- -## 🔬 Part 3.5: Setting Up Ghidra for Double Analysis +## ? Part 3.5: Setting Up Ghidra for Double Analysis ### Step 3: Start Ghidra @@ -820,7 +820,7 @@ Ghidra will open. Now we need to create a new project. ### Step 4: Create a New Project -1. Click **File** → **New Project** +1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** 4. Enter Project Name: `0x000A_intro-to-doubles` @@ -839,12 +839,12 @@ Ghidra will open. Now we need to create a new project. A dialog appears. The file is identified as a "BIN" (raw binary without debug symbols). -**Click the three dots (…) next to "Language" and:** +**Click the three dots (...) next to "Language" and:** 1. Search for "Cortex" 2. Select **ARM Cortex 32 little endian default** 3. Click **OK** -**Click the "Options…" button and:** +**Click the "Options..." button and:** 1. Change **Block Name** to `.text` 2. Change **Base Address** to `10000000` (the XIP address!) 3. Click **OK** @@ -859,7 +859,7 @@ Wait for analysis to complete (watch the progress bar in the bottom right). --- -## 🔬 Part 3.6: Navigating and Resolving Functions +## ? Part 3.6: Navigating and Resolving Functions ### Step 8: Find the Functions @@ -893,7 +893,7 @@ For `main`, let's also fix the return type: --- -## 🔬 Part 3.7: Analyzing the Main Function +## ? Part 3.7: Analyzing the Main Function ### Step 11: Examine Main in Ghidra @@ -925,14 +925,14 @@ void FUN_10000238(void) ### Step 12: Resolve stdio_init_all 1. Click on `FUN_10002f64` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `bool stdio_init_all(void)` 4. Click **OK** ### Step 13: Resolve printf 1. Click on `FUN_100030f4` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change the name to `printf` 4. Check the **Varargs** checkbox (printf takes variable arguments!) 5. Click **OK** @@ -963,7 +963,7 @@ int main(void) **Where's `double fav_num = 42.52525`?** It's been optimized into immediate values! -This time we see **two** non-zero values: `0x645a1cac` and `0x4045433b`. Unlike the float example where the low word was `0x0`, a double with a fractional part like `42.52525` needs **all 52 mantissa bits** — so both halves carry data. +This time we see **two** non-zero values: `0x645a1cac` and `0x4045433b`. Unlike the float example where the low word was `0x0`, a double with a fractional part like `42.52525` needs **all 52 mantissa bits** - so both halves carry data. A 64-bit double is passed in two 32-bit registers: @@ -972,9 +972,9 @@ A 64-bit double is passed in two 32-bit registers: | `r2` | `0x645A1CAC` | Low 32 bits | | `r3` | `0x4045433B` | High 32 bits | -Together they form `0x4045433B645A1CAC` — the IEEE 754 **double-precision** encoding of `42.52525`. +Together they form `0x4045433B645A1CAC` - the IEEE 754 **double-precision** encoding of `42.52525`. -> 🎯 **Key Difference from Float:** In the float example, `r2` was `0x00000000` because `42.5` has a clean fractional part. But `42.52525` has a repeating binary fraction, so the low 32 bits are non-zero (`0x645A1CAC`). This means **both** registers matter when patching doubles with complex fractional values! +> ? **Key Difference from Float:** In the float example, `r2` was `0x00000000` because `42.5` has a clean fractional part. But `42.52525` has a repeating binary fraction, so the low 32 bits are non-zero (`0x645A1CAC`). This means **both** registers matter when patching doubles with complex fractional values! ### Step 15: Verify the Double Encoding @@ -989,30 +989,30 @@ Laid out as a single 64-bit value with every bit numbered: ``` Bit: 63 62-52 (11 bits) 51-32 (20 bits) 31-0 (32 bits) - ┌───┬───────────────────────┬──────────────────────────────────────────┬──────────────────────────────────────────┐ - │ 0 │ 1 0 0 0 0 0 0 0 1 0 0 │ 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 │ 01100100010110100001110010101100 │ - └───┴───────────────────────┴──────────────────────────────────────────┴──────────────────────────────────────────┘ + +---+-----------------------+------------------------------------------+------------------------------------------+ + | 0 | 1 0 0 0 0 0 0 0 1 0 0 | 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 | 01100100010110100001110010101100 | + +---+-----------------------+------------------------------------------+------------------------------------------+ Sign Exponent (11) Mantissa high 20 bits Mantissa low 32 bits - (from r3 bits 19–0) (from r2) + (from r3 bits 19-0) (from r2) ``` -> 🎯 **Key Difference from 42.5:** In the `42.5` example, r2 was `0x00000000` because `42.5` has a clean fractional part (`.5` = exactly one binary digit). But `42.52525` has a repeating binary fraction, so the low 32 bits are **non-zero** (`0x645A1CAC`). Every bit of both registers matters here! +> ? **Key Difference from 42.5:** In the `42.5` example, r2 was `0x00000000` because `42.5` has a clean fractional part (`.5` = exactly one binary digit). But `42.52525` has a repeating binary fraction, so the low 32 bits are **non-zero** (`0x645A1CAC`). Every bit of both registers matters here! **Step-by-step field extraction:** **1. Sign bit** -The sign bit is bit 63 of the 64-bit double, which is bit 31 of r3 (the high register holds bits 63–32): +The sign bit is bit 63 of the 64-bit double, which is bit 31 of r3 (the high register holds bits 63-32): ``` r3 = 0x4045433B = 0100 0000 0100 0101 0100 0011 0011 1011 ^ - r3 bit 31 = 0 → sign = 0 → Positive number ✓ + r3 bit 31 = 0 -> sign = 0 -> Positive number ? ``` -**2. Exponent — bits 62–52 = bits 30–20 of r3** +**2. Exponent - bits 62-52 = bits 30-20 of r3** -Extract bits 30–20 from `0x4045433B`: +Extract bits 30-20 from `0x4045433B`: ``` 0x4045433B in binary: 0 10000000100 01010100001100111011 @@ -1023,33 +1023,33 @@ Exponent bits: `10000000100` Convert to decimal: $2^{10} + 2^{2} = 1024 + 4 = 1028$ -Subtract the bias (same formula as Part 2 — the bias is 1023 for all doubles): +Subtract the bias (same formula as Part 2 - the bias is 1023 for all doubles): $$\text{real exponent} = 1028 - 1023 = \mathbf{5}$$ This means the mantissa gets shifted left by 5 binary places (i.e. multiplied by $2^5 = 32$). -**3. Mantissa — bits 51–0** +**3. Mantissa - bits 51-0** Unlike the `42.5` example where r2 was all zeros, **both registers contribute non-zero bits** here: -- **High 20 bits of mantissa** (bits 51–32) = bits 19–0 of r3: +- **High 20 bits of mantissa** (bits 51-32) = bits 19-0 of r3: ``` -r3 bits 19–0: 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 +r3 bits 19-0: 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 ``` -- **Low 32 bits of mantissa** (bits 31–0) = all of r2: +- **Low 32 bits of mantissa** (bits 31-0) = all of r2: ``` -r2 = 0x645A1CAC → 0 1 1 0 0 1 0 0 0 1 0 1 1 0 1 0 0 0 0 1 1 1 0 0 1 0 1 0 1 1 0 0 +r2 = 0x645A1CAC -> 0 1 1 0 0 1 0 0 0 1 0 1 1 0 1 0 0 0 0 1 1 1 0 0 1 0 1 0 1 1 0 0 ``` Full 52-bit mantissa: ``` 0 1 0 1 0 1 0 0 0 0 1 1 0 0 1 1 1 0 1 1 | 0 1 1 0 0 1 0 0 0 1 0 1 1 0 1 0 0 0 0 1 1 1 0 0 1 0 1 0 1 1 0 0 - ← top 20 bits from r3 → ← bottom 32 bits from r2 → + ?? top 20 bits from r3 -> ?? bottom 32 bits from r2 -> ``` IEEE 754 always prepends an **implied leading `1`**, so the actual value represented is: @@ -1083,25 +1083,25 @@ $$32 + 8 + 2 = \mathbf{42}$$ | Bit position | Power of 2 | Decimal value | |---|---|---| -| `1` (bit −1) | $2^{-1}$ | 0.5 | -| `0` (bit −2) | $2^{-2}$ | 0 | -| `0` (bit −3) | $2^{-3}$ | 0 | -| `0` (bit −4) | $2^{-4}$ | 0 | -| `0` (bit −5) | $2^{-5}$ | 0 | -| `1` (bit −6) | $2^{-6}$ | 0.015625 | -| `1` (bit −7) | $2^{-7}$ | 0.0078125 | -| `0` (bit −8) | $2^{-8}$ | 0 | -| `0` (bit −9) | $2^{-9}$ | 0 | -| `1` (bit −10) | $2^{-10}$ | 0.0009765625 | -| `1` (bit −11) | $2^{-11}$ | 0.00048828125 | -| `1` (bit −12) | $2^{-12}$ | 0.000244140625 | +| `1` (bit ?1) | $2^{-1}$ | 0.5 | +| `0` (bit ?2) | $2^{-2}$ | 0 | +| `0` (bit ?3) | $2^{-3}$ | 0 | +| `0` (bit ?4) | $2^{-4}$ | 0 | +| `0` (bit ?5) | $2^{-5}$ | 0 | +| `1` (bit ?6) | $2^{-6}$ | 0.015625 | +| `1` (bit ?7) | $2^{-7}$ | 0.0078125 | +| `0` (bit ?8) | $2^{-8}$ | 0 | +| `0` (bit ?9) | $2^{-9}$ | 0 | +| `1` (bit ?10) | $2^{-10}$ | 0.0009765625 | +| `1` (bit ?11) | $2^{-11}$ | 0.00048828125 | +| `1` (bit ?12) | $2^{-12}$ | 0.000244140625 | | ... | ... | *(remaining 35 bits add smaller and smaller fractions)* | First 12 fractional bits sum: $0.5 + 0.015625 + 0.0078125 + 0.0009765625 + 0.00048828125 + 0.000244140625 \approx 0.5251$ -The remaining 35 fractional bits refine this to $\approx 0.52525$. This is because `0.52525` is a **repeating fraction** in binary — it can never be represented with a finite number of bits, so double precision stores the closest possible 52-bit approximation. +The remaining 35 fractional bits refine this to $\approx 0.52525$. This is because `0.52525` is a **repeating fraction** in binary - it can never be represented with a finite number of bits, so double precision stores the closest possible 52-bit approximation. -$$42 + 0.52525 = \mathbf{42.52525} ✓$$ +$$42 + 0.52525 = \mathbf{42.52525} ?$$ ### Step 16: Examine the Assembly @@ -1135,7 +1135,7 @@ Look at the **Listing** window (assembly view). Find the main function: 10000258 3b 43 45 40 undefine 4045433Bh ``` -> 🎯 **Key Insight:** Notice that **both** `r2` and `r3` are loaded from data constants using `ldr`. Compare this to the float example where `r2` was loaded with `mov.w r2, #0x0`. Because `42.52525` requires all 52 mantissa bits, neither word can be zero — the compiler must store both halves as separate data constants. +> ? **Key Insight:** Notice that **both** `r2` and `r3` are loaded from data constants using `ldr`. Compare this to the float example where `r2` was loaded with `mov.w r2, #0x0`. Because `42.52525` requires all 52 mantissa bits, neither word can be zero - the compiler must store both halves as separate data constants. ### Step 17: Find the Format String @@ -1153,7 +1153,7 @@ This confirms `printf` is called with the format string `"fav_num: %lf\r\n"` and --- -## 🔬 Part 3.8: Patching the Double - Changing 42.52525 to 99.99 +## ? Part 3.8: Patching the Double - Changing 42.52525 to 99.99 ### Step 18: Calculate the New IEEE 754 Encoding @@ -1202,15 +1202,15 @@ Look in the Listing view for the two data constants: This changes the full 64-bit double from `0x4045433B645A1CAC` (42.52525) to `0x4058FF5C28F5C28F` (99.99). -> 🎯 **Key Difference from Float Patching:** When we patched the float `42.5`, we only needed to change one word (the high word in `r3`) because the low word was all zeros. With `42.52525 → 99.99`, **both** words change. Always check whether the low word is non-zero before patching! +> ? **Key Difference from Float Patching:** When we patched the float `42.5`, we only needed to change one word (the high word in `r3`) because the low word was all zeros. With `42.52525 -> 99.99`, **both** words change. Always check whether the low word is non-zero before patching! --- -## 🔬 Part 3.9: Export and Test the Hacked Binary +## ? Part 3.9: Export and Test the Hacked Binary ### Step 21: Export the Patched Binary -1. Click **File** → **Export Program** +1. Click **File** -> **Export Program** 2. Set **Format** to **Raw Bytes** 3. Navigate to your build directory 4. Name the file `0x0011_double-floating-point-data-type-h.bin` @@ -1221,7 +1221,7 @@ This changes the full 64-bit double from `0x4045433B645A1CAC` (42.52525) to `0x4 **Open a terminal and navigate to your project directory:** ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0011_double-floating-point-data-type +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0011_double-floating-point-data-type ``` **Run the conversion command:** @@ -1245,11 +1245,11 @@ fav_num: 99.990000 ... ``` -🎉 **BOOM! We hacked the double!** The value changed from `42.52525` to `99.99`! +? **BOOM! We hacked the double!** The value changed from `42.52525` to `99.99`! --- -## 📊 Part 3.95: Summary - Float and Double Analysis +## ? Part 3.95: Summary - Float and Double Analysis ### What We Accomplished @@ -1276,62 +1276,40 @@ fav_num: 99.990000 ### The Float/Double Patching Workflow ``` -┌─────────────────────────────────────────────────────────────────┐ -│ 1. Identify the float/double value in the decompiled view │ -│ - Look for hex constants like 0x40454000 or 0x4045433B │ -├─────────────────────────────────────────────────────────────────┤ -│ 2. Determine if it's float (32-bit) or double (64-bit) │ -│ - printf promotes floats to doubles! │ -│ - Check if value spans r2:r3 (double) or just r0 (float) │ -├─────────────────────────────────────────────────────────────────┤ -│ 3. Check if the low word (r2) is zero or non-zero │ -│ - Zero low word = only patch the high word │ -│ - Non-zero low word = patch BOTH words │ -├─────────────────────────────────────────────────────────────────┤ -│ 4. Calculate the new IEEE 754 encoding │ -│ - Convert your desired value to IEEE 754 │ -│ - Split into high/low words │ -├─────────────────────────────────────────────────────────────────┤ -│ 5. Patch the constant(s) in Ghidra │ -│ - Right-click → Patch Data │ -│ - Replace the old encoding with the new one │ -├─────────────────────────────────────────────────────────────────┤ -│ 6. Export → Convert to UF2 → Flash → Verify │ -│ - Same workflow as integer patching │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| 1. Identify the float/double value in the decompiled view | +| - Look for hex constants like 0x40454000 or 0x4045433B | ++-----------------------------------------------------------------+ +| 2. Determine if it's float (32-bit) or double (64-bit) | +| - printf promotes floats to doubles! | +| - Check if value spans r2:r3 (double) or just r0 (float) | ++-----------------------------------------------------------------+ +| 3. Check if the low word (r2) is zero or non-zero | +| - Zero low word = only patch the high word | +| - Non-zero low word = patch BOTH words | ++-----------------------------------------------------------------+ +| 4. Calculate the new IEEE 754 encoding | +| - Convert your desired value to IEEE 754 | +| - Split into high/low words | ++-----------------------------------------------------------------+ +| 5. Patch the constant(s) in Ghidra | +| - Right-click -> Patch Data | +| - Replace the old encoding with the new one | ++-----------------------------------------------------------------+ +| 6. Export -> Convert to UF2 -> Flash -> Verify | +| - Same workflow as integer patching | ++-----------------------------------------------------------------+ ``` -> 💡 **Key takeaway:** Hacking doubles is the same process as hacking floats — find the IEEE 754 constant, calculate the new encoding, patch it. The only extra step is checking whether the **low word** (`r2`) is also non-zero. Clean values like `42.5` only need one patch; messy fractions like `42.52525` need two! +> Tip: **Key takeaway:** Hacking doubles is the same process as hacking floats - find the IEEE 754 constant, calculate the new encoding, patch it. The only extra step is checking whether the **low word** (`r2`) is also non-zero. Clean values like `42.5` only need one patch; messy fractions like `42.52525` need two! --- -## ✅ Practice Exercises - -### Exercise 1: Patch the Float to Pi -The float program stores `42.5`. Patch it in Ghidra so the serial output prints `3.14` instead. - -**Hint:** `3.14` as a double is `0x40091EB851EB851F` — the high word is `0x40091EB8` and the low word is `0x51EB851F`. You'll need to patch **both** words since the low word is non-zero! - -### Exercise 2: Patch the Double to a Whole Number -The double program stores `42.52525`. Instead of patching it to `99.99` (as we did in the chapter), patch it to `100.0`. - -**Hint:** `100.0` as a double is `0x4059000000000000` — high word `0x40590000`, low word `0x00000000`. Notice the low word is all zeros this time — but the original low word (`0x645A1CAC`) is non-zero, so you still need to patch it to `0x00000000`! - -### Exercise 3: Change the Blink Speed -The LED blinks every 500ms. Find the `sleep_ms(500)` calls in the binary and change them to `sleep_ms(100)` for faster blinking. - -**Hint:** Look for the value `0x1F4` (500 in hex) being loaded into a register before the delay call. - -### Exercise 4: Find the Format Strings -Both programs use format strings (`"fav_num: %f\r\n"` and `"fav_num: %lf\r\n"`). Can you find these strings in Ghidra and determine where they're stored? - -**Hint:** Look in the `.rodata` section. Try pressing `S` in Ghidra to search for strings, or navigate to addresses near `0x10003xxx`. - --- -## 🎓 Key Takeaways +## ? Key Takeaways -1. **Integers have fixed sizes** - `uint8_t` is 1 byte (0–255), `int8_t` is 1 byte (-128 to 127). The `u` prefix means unsigned. +1. **Integers have fixed sizes** - `uint8_t` is 1 byte (0-255), `int8_t` is 1 byte (-128 to 127). The `u` prefix means unsigned. 2. **IEEE 754 encodes floats in binary** - Sign bit, exponent (with bias), and mantissa form the encoding for both 32-bit floats and 64-bit doubles. @@ -1347,7 +1325,7 @@ Both programs use format strings (`"fav_num: %f\r\n"` and `"fav_num: %lf\r\n"`). --- -## 📖 Glossary +## ? Glossary | Term | Definition | | ----------------------- | ------------------------------------------------------------------------------ | @@ -1364,14 +1342,14 @@ Both programs use format strings (`"fav_num: %f\r\n"` and `"fav_num: %lf\r\n"`). | **Mantissa** | Fractional part of IEEE 754 encoding (23 bits for float, 52 bits for double) | | **mcrr** | ARM coprocessor register transfer instruction used for GPIO control | | **PADS_BANK0** | Register block at `0x40038000` that controls GPIO pad electrical properties | -| **Promotion** | Automatic conversion of a smaller type to a larger type (float → double) | +| **Promotion** | Automatic conversion of a smaller type to a larger type (float -> double) | | **Register Pair** | Two 32-bit registers (r2:r3) used together to hold a 64-bit value | | **UF2** | USB Flashing Format - file format for Pico 2 firmware | | **uint8_t** | Unsigned 8-bit integer type (0 to 255) | --- -## 🔗 Additional Resources +## ? Additional Resources ### GPIO Coprocessor Reference @@ -1395,19 +1373,21 @@ The RP2350 GPIO coprocessor instructions: ### IEEE 754 Encoding Formula ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Float (32-bit): [1 sign] [8 exponent] [23 mantissa] │ -│ Double (64-bit): [1 sign] [11 exponent] [52 mantissa] │ -│ │ -│ Value = (-1)^sign × 2^(exponent - bias) × (1 + mantissa) │ -│ │ -│ Float bias: 127 │ -│ Double bias: 1023 │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Float (32-bit): [1 sign] [8 exponent] [23 mantissa] | +| Double (64-bit): [1 sign] [11 exponent] [52 mantissa] | +| | +| Value = (-1)^sign * 2^(exponent - bias) * (1 + mantissa) | +| | +| Float bias: 127 | +| Double bias: 1023 | ++-----------------------------------------------------------------+ ``` --- -**Remember:** Every binary you encounter in the real world can be analyzed and understood using these same techniques. Whether it's an integer, a float, or a double — it's all just bits waiting to be decoded. Practice makes perfect! +**Remember:** Every binary you encounter in the real world can be analyzed and understood using these same techniques. Whether it's an integer, a float, or a double - it's all just bits waiting to be decoded. Practice makes perfect! + +Happy hacking! ? + -Happy hacking! 🔧 diff --git a/WEEK06/WEEK06-01-S.md b/WEEK06/WEEK06-01-S.md deleted file mode 100644 index 27c771b..0000000 --- a/WEEK06/WEEK06-01-S.md +++ /dev/null @@ -1,53 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 1 Solution: Change the Static Variable Initial Value from 42 to 100 - -#### Answers - -##### Static Variable Location - -| Item | Value | Notes | -|---------------------------|-------------|--------------------------------| -| RAM address (runtime) | 0x200005a8 | Where variable lives at runtime | -| Flash address (init value)| Calculated | In .data section of flash | -| Original value (hex) | 0x2A | 42 decimal | -| Patched value (hex) | 0x64 | 100 decimal | -| File offset | flash_addr - 0x10000000 | Binary base subtraction | - -##### GDB Session - -```gdb -(gdb) x/1db 0x200005a8 -0x200005a8: 42 -(gdb) find /b 0x10000000, 0x10010000, 0x2a -``` - -##### Serial Output After Patch - -``` -regular_fav_num: 42 -static_fav_num: 100 -regular_fav_num: 42 -static_fav_num: 101 -regular_fav_num: 42 -static_fav_num: 102 -... -``` - -#### Reflection Answers - -1. **Why does the initial value live in flash AND get copied to RAM? Why not just use flash directly?** - Static variables need to be **modifiable** at runtime—the program increments `static_fav_num` each iteration. Flash memory is read-only during normal execution (it requires a special erase/program sequence to modify). So the initial value is stored in flash as a template, and the startup code (`crt0.S`) copies the entire `.data` section from flash to RAM before `main()` runs. This gives the variable its correct starting value (42) in writable RAM where subsequent `adds` and `strb` instructions can modify it freely. - -2. **The static variable wraps around at 255 (since it's `uint8_t`). After patching the initial value to 100, after how many iterations will it overflow back to 0?** - A `uint8_t` overflows from 255 to 0. Starting at 100 and incrementing by 1: it takes `255 - 100 = 155` increments to reach 255, then one more to wrap to 0. So it overflows after **156 iterations**. Compare to the original: starting at 42, it takes `255 - 42 + 1 = 214` iterations. - -3. **If you also wanted to change the `regular_fav_num` constant from 42, would you patch the same area of the binary? Why or why not?** - No. `regular_fav_num` is a **local variable** that the compiler optimized to an immediate constant (`movs r1, #0x2a`), just like Week 4's `age` variable. It's encoded directly in the instruction opcode in the `.text` section, not in the `.data` section. You would need to find the `movs r1, #0x2a` instruction in the code and patch the immediate byte from `0x2a` to your desired value. The `.data` section only contains initialized static/global variables. - -4. **What would happen if the `.data` section had TWO static variables — would their initial values be adjacent in flash?** - Yes. The linker places all initialized static variables contiguously in the `.data` section. Their initial values are stored in the same order in flash, packed adjacent to each other (possibly with alignment padding). The startup code performs a single `memcpy`-like loop that copies the entire `.data` block from flash to RAM. So if you had `static uint8_t a = 42;` and `static uint8_t b = 99;`, the bytes `0x2A` and `0x63` would be adjacent (or nearly so) in flash, and both would be copied to their respective RAM addresses during boot. diff --git a/WEEK06/WEEK06-01.md b/WEEK06/WEEK06-01.md deleted file mode 100644 index 5043b7b..0000000 --- a/WEEK06/WEEK06-01.md +++ /dev/null @@ -1,157 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 1: Change the Static Variable Initial Value from 42 to 100 - -#### Objective -Use GDB to locate the static variable `static_fav_num` in the `.data` section of the `0x0014_static-variables` binary, calculate the corresponding file offset, patch the initial value from `42` (`0x2A`) to `100` (`0x64`) using a hex editor, convert the patched binary to UF2 format, and flash it to the Pico 2 to verify the change. - -#### Prerequisites -- Completed Week 6 tutorial (GDB section) -- `0x0014_static-variables.bin` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 connected via USB -- Serial monitor software (PuTTY, minicom, or screen) - -#### Task Description -You will use GDB to examine the static variable at its known RAM address (`0x200005a8`), trace back to where the initial value is stored in the `.data` section of flash, calculate the file offset in the `.bin` file, patch the byte from `0x2A` to `0x64` with a hex editor, and verify on hardware that the serial output now starts counting from `100` instead of `42`. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0014_static-variables.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Examine the Static Variable in RAM - -We know from the tutorial that the static variable lives at `0x200005a8`. Examine its current value: - -```gdb -(gdb) x/1db 0x200005a8 -``` - -You should see the current value (probably `42` or a count if the program has been running). - -##### Step 3: Find Where the Initial Value Lives in Flash - -Static variables that are initialized get their starting values from the `.data` section in flash. The startup code copies these values from flash to RAM before `main()` runs. - -Examine the disassembly to find data copy references. The initial value `42` (`0x2A`) is stored somewhere in flash. Use GDB to search: - -```gdb -(gdb) find /b 0x10000000, 0x10010000, 0x2a -``` - -This searches the flash region for the byte `0x2A`. You may get multiple hits look for one that is in the data initialization area (typically near the end of the code section). - -##### Step 4: Confirm the Address - -Once you identify a candidate address, verify it by examining the surrounding bytes: - -```gdb -(gdb) x/8xb -``` - -The `0x2A` byte at this address should be the initialization value for our static variable. - -##### Step 5: Calculate the File Offset - -The binary is loaded at base address `0x10000000`. To find the file offset: - -``` -file_offset = address - 0x10000000 -``` - -For example, if the initial value is at `0x10004xxx`: -- File offset = `0x10004xxx` - `0x10000000` = `0x4xxx` - -##### Step 6: Patch the Value with a Hex Editor - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables\build\0x0014_static-variables.bin` -2. Press **Ctrl+G** (Go to offset) -3. Enter the calculated offset -4. You should see the byte `2A` at this position -5. Change `2A` to `64` (100 in decimal) -6. Click **File** ? **Save As** ? `0x0014_static-variables-h.bin` (in the same `build` directory) - -##### Step 7: Convert to UF2 and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables -python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive -3. Open your serial monitor - -##### Step 8: Verify the Hack - -**Expected serial output:** -``` -regular_fav_num: 42 -static_fav_num: 100 ? Starts at 100 now! -regular_fav_num: 42 -static_fav_num: 101 -regular_fav_num: 42 -static_fav_num: 102 -... -``` - -The static variable now starts counting from 100 instead of 42! - -#### Expected Output - -After completing this exercise, you should be able to: -- Use GDB `find` command to search for byte patterns in flash -- Distinguish between RAM addresses (where the variable lives at runtime) and flash addresses (where the initial value is stored) -- Calculate file offsets from memory addresses -- Patch initialization values with a hex editor -- Understand the `.data` section copy mechanism at startup - -#### Questions for Reflection - -###### Question 1: Why does the initial value live in flash AND get copied to RAM? Why not just use flash directly? - -###### Question 2: The static variable wraps around at 255 (since it's `uint8_t`). After patching the initial value to 100, after how many iterations will it overflow back to 0? - -###### Question 3: If you also wanted to change the `regular_fav_num` constant from 42, would you patch the same area of the binary? Why or why not? - -###### Question 4: What would happen if the `.data` section had TWO static variables would their initial values be adjacent in flash? - -#### Tips and Hints -- The `find` command in GDB can search for bytes, halfwords, or words in any memory range -- Static variables with initial values are in `.data`; without initial values they're in `.bss` -- The startup code (`crt0`) copies the entire `.data` section from flash to RAM before calling `main()` -- HxD shows both hex and ASCII the value `0x2A` is the ASCII character `*` - -#### Next Steps -- Proceed to Exercise 2 to try a more complex hack (reversing GPIO logic) -- Try patching the static variable to `0xFF` (255) and observe immediate overflow behavior -- Look at the startup code in GDB to find the memcpy that copies `.data` from flash to RAM diff --git a/WEEK06/WEEK06-02-S.md b/WEEK06/WEEK06-02-S.md deleted file mode 100644 index 113ff3e..0000000 --- a/WEEK06/WEEK06-02-S.md +++ /dev/null @@ -1,63 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 2 Solution: Reverse Engineer gpio_set_pulls with GDB - -#### Answers - -##### Function Arguments - -```gdb -(gdb) b *0x100002d8 -(gdb) c -(gdb) info registers r0 r1 r2 -r0 = 15 ; GPIO pin -r1 = 1 ; pull-up enable (true) -r2 = 0 ; pull-down disable (false) -``` - -##### PADS_BANK0 Address Calculation - -``` -Base: 0x40038000 (PADS_BANK0) -GPIO 0 offset: 0x04 (first pad register) -GPIO N offset: 0x04 + (N × 4) -GPIO 15: 0x40038000 + 0x04 + (15 × 4) = 0x40038000 + 0x04 + 0x3C = 0x40038040 -``` - -##### Function Behavior Summary - -| Step | Instruction(s) | Effect | -|------------------------|---------------------|-----------------------------------| -| Load PADS base address | `ldr rX, =0x40038000` | rX = PADS_BANK0 base | -| Calculate pad offset | `adds`, `lsls` | offset = 0x04 + pin × 4 | -| Read current config | `ldr rX, [addr]` | Read existing pad register value | -| Clear pull bits | `bic rX, rX, #0xC` | Clear bits 2 (PDE) and 3 (PUE) | -| Set pull-up bit | `orr rX, rX, #0x8` | Set bit 3 (PUE = pull-up enable) | -| Write back | `str rX, [addr]` | Write updated config to hardware | - -##### Pad Register Bits - -| Bit | Name | Value | Meaning | -|-----|----------|-------|-------------------------| -| 3 | PUE | 1 | Pull-up enable | -| 2 | PDE | 0 | Pull-down disable | -| 1 | SCHMITT | 1 | Schmitt trigger enabled | -| 0 | SLEWFAST | 0 | Slow slew rate | - -#### Reflection Answers - -1. **Why does the function read-modify-write the register instead of just writing a new value? What would happen if it just wrote without reading first?** - The pad register contains multiple configuration fields (drive strength, slew rate, Schmitt trigger, input enable, output disable, pull-up, pull-down). If the function wrote a new value without reading first, it would overwrite all other fields with zeros or arbitrary values, potentially disabling the Schmitt trigger, changing drive strength, or disabling input/output. The read-modify-write pattern uses `bic` to clear only the pull bits (2 and 3) and `orr` to set the desired pull configuration, leaving all other bits untouched. - -2. **The pad register for GPIO 15 is at offset `0x40` from the PADS base. How is this offset calculated? What would the offset be for GPIO 0?** - The formula is: offset = `0x04 + (GPIO_number × 4)`. For GPIO 15: `0x04 + (15 × 4) = 0x04 + 0x3C = 0x40`. The `0x04` initial offset exists because offset `0x00` is the VOLTAGE_SELECT register, not a pad register. For GPIO 0: offset = `0x04 + (0 × 4) = 0x04`. So GPIO 0's pad register is at `0x40038004`. - -3. **What would happen if you enabled BOTH pull-up and pull-down at the same time (bits 2 and 3 both set)?** - Enabling both creates a **resistive voltage divider** between VDD and GND through the internal pull resistors. On the RP2350, both pull resistors are typically ~50kΩ. The pin voltage would settle at approximately VDD/2 (1.65V for 3.3V supply), which is in the undefined region between logic HIGH and LOW thresholds. This makes the digital input unreliable—the Schmitt trigger may oscillate or read randomly. While not damaging to the hardware, it wastes power and produces unpredictable input reads. The SDK intentionally never sets both bits simultaneously. - -4. **The compiler inlines `gpio_pull_up` into `gpio_set_pulls`. What does this tell you about the compiler's optimization level? How does inlining affect binary analysis?** - This indicates at least `-O1` or higher optimization (the Pico SDK defaults to `-O2`). The `gpio_pull_up` function is declared `static inline` in the SDK header, and the compiler eliminates the function call overhead by inserting `gpio_set_pulls(pin, true, false)` directly. For binary analysis, inlining means: (a) the original function name `gpio_pull_up` doesn't appear in the symbol table, (b) you see `gpio_set_pulls` called directly with hardcoded arguments, making it harder to identify the programmer's original intent, and (c) multiple calls to `gpio_pull_up` with different pins each become separate `gpio_set_pulls` calls rather than referencing a single function body. diff --git a/WEEK06/WEEK06-02.md b/WEEK06/WEEK06-02.md deleted file mode 100644 index 81f781c..0000000 --- a/WEEK06/WEEK06-02.md +++ /dev/null @@ -1,187 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 2: Reverse Engineer gpio_set_pulls with GDB - -#### Objective -Use GDB to disassemble the `gpio_set_pulls` function, trace its register writes to identify the PADS_BANK0 hardware register it modifies, and document how the Pico 2 configures internal pull-up and pull-down resistors at the hardware level. - -#### Prerequisites -- Completed Week 6 tutorial (GDB section) -- `0x0014_static-variables.elf` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- Understanding of GPIO pull-up resistors from Week 6 Part 2 -- Understanding of function inlining from Week 6 Part 3 - -#### Task Description -You will use GDB to locate the `gpio_set_pulls` function (remember: `gpio_pull_up` is inlined and becomes `gpio_set_pulls`), disassemble it, step through it instruction by instruction, and identify the PADS_BANK0 register address it writes to. You will document the bit fields being set and explain how the hardware implements pull-up and pull-down resistors. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0014_static-variables.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find Where gpio_set_pulls is Called - -From the tutorial, we know `gpio_set_pulls` is called at `0x1000024e` with arguments for GPIO 15: - -```gdb -(gdb) x/5i 0x10000240 -``` - -You should see: -``` -0x10000240: movs r0, #15 ; GPIO pin 15 -0x10000242: mov.w r3, #0 ; GPIO_IN (direction) -0x10000246: mcrr 0, 4, r0, r3, cr4 ; gpio_set_dir via coprocessor -0x1000024a: movs r2, #0 ; down = false -0x1000024c: movs r1, #1 ; up = true -0x1000024e: bl 0x100002d8 ; gpio_set_pulls -``` - -##### Step 3: Disassemble gpio_set_pulls - -Now examine the function itself: - -```gdb -(gdb) x/30i 0x100002d8 -``` - -Study the disassembly carefully. Look for: -- Address calculations (base address of PADS_BANK0) -- Register loads and stores -- Bit manipulation instructions (AND, OR, BIC) -- The write to the hardware register - -##### Step 4: Set a Breakpoint at gpio_set_pulls - -```gdb -(gdb) b *0x100002d8 -(gdb) monitor reset halt -(gdb) c -``` - -When the breakpoint hits, examine the arguments: - -```gdb -(gdb) info registers r0 r1 r2 -``` - -You should see: -- `r0 = 15` (GPIO pin) -- `r1 = 1` (pull-up enable) -- `r2 = 0` (pull-down disable) - -##### Step 5: Step Through the Function - -Use `si` (step instruction) to execute one instruction at a time: - -```gdb -(gdb) si -(gdb) info registers -``` - -Repeat, watching the registers change. Pay attention to: - -1. **Address calculation**: The function computes the PADS_BANK0 register address for GPIO 15. The base address is `0x40038000`, and each GPIO pad has a 4-byte register. GPIO 0 starts at offset `0x04`, so GPIO 15 is at: - -$$0x40038000 + 0x04 + (15 \times 4) = 0x40038000 + 0x04 + 0x3C = 0x40038040$$ - -2. **Read the current register value**: The function reads the existing pad configuration -3. **Modify the pull bits**: It sets or clears the pull-up (bit 3) and pull-down (bit 2) bits -4. **Write back**: It stores the modified value - -##### Step 6: Examine the PADS_BANK0 Register - -After the function completes, examine the result: - -```gdb -(gdb) x/1wx 0x40038040 -``` - -Document the value you see. The relevant bits are: - -| Bit | Name | Value | Meaning | -| --- | -------- | ----- | ----------------------- | -| 3 | PUE | 1 | Pull-up enable | -| 2 | PDE | 0 | Pull-down enable | -| 1 | SCHMITT | 1 | Schmitt trigger enabled | -| 0 | SLEWFAST | 0 | Slow slew rate | - -##### Step 7: Compare with gpio_set_pulls for the LED Pin - -Continue execution until gpio_set_pulls is called again (if it is). Or, examine the pad register for GPIO 16 (the LED pin): - -```gdb -(gdb) x/1wx 0x40038044 -``` - -Compare the values. The LED pin (output) should NOT have pull-up enabled. - -##### Step 8: Document Your Findings - -Create a table documenting the function's behavior: - -| Step | Instruction(s) | Register Changes | -| ------------------------ | ------------------ | --------------------------- | -| Load PADS base address | `ldr rX, =...` | rX = `0x40038000` | -| Calculate pad offset | `adds`, `lsls` | offset = `0x04 + pin * 4` | -| Read current pad config | `ldr rX, [addr]` | rX = current register value | -| Clear pull bits | `bic rX, rX, #0xC` | Clear bits 2 and 3 | -| Set pull-up bit | `orr rX, rX, #0x8` | Set bit 3 (PUE) | -| Write back | `str rX, [addr]` | Updated pad register | - -#### Expected Output - -After completing this exercise, you should be able to: -- Disassemble and trace through a hardware configuration function -- Identify PADS_BANK0 register addresses for any GPIO pin -- Understand how pull-up and pull-down resistors are controlled at the register level -- Explain why `gpio_pull_up(pin)` becomes `gpio_set_pulls(pin, true, false)` in the binary - -#### Questions for Reflection - -###### Question 1: Why does the function read-modify-write the register instead of just writing a new value? What would happen if it just wrote without reading first? - -###### Question 2: The pad register for GPIO 15 is at offset `0x40` from the PADS base. How is this offset calculated? What would the offset be for GPIO 0? - -###### Question 3: What would happen if you enabled BOTH pull-up and pull-down at the same time (bits 2 and 3 both set)? - -###### Question 4: The compiler inlines `gpio_pull_up` into `gpio_set_pulls`. What does this tell you about the compiler's optimization level? How does inlining affect binary analysis? - -#### Tips and Hints -- PADS_BANK0 base address on RP2350 is `0x40038000` -- Each GPIO has a 4-byte pad control register starting at offset `0x04` -- The `bic` instruction clears bits (Bit Clear); `orr` sets bits (OR) -- Use `x/1wx` to examine a 32-bit word; use `x/1tb` to see individual bits -- The RP2350 datasheet section on PADS_BANK0 has the full register bit map - -#### Next Steps -- Proceed to Exercise 3 to reverse engineer the `eor` (XOR) instruction in the GPIO logic -- Try enabling pull-down instead of pull-up by modifying the `gpio_set_pulls` arguments in GDB: `set $r1 = 0` and `set $r2 = 1` before the function call -- Examine the PADS registers for all GPIOs to see which pins have pull-ups enabled after boot diff --git a/WEEK06/WEEK06-03-S.md b/WEEK06/WEEK06-03-S.md deleted file mode 100644 index ed4a6d2..0000000 --- a/WEEK06/WEEK06-03-S.md +++ /dev/null @@ -1,57 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 3 Solution: Make the Overflow Happen Faster - -#### Answers - -##### Patch Details - -| Item | Original | Patched | -|--------------------|-----------------|-----------------| -| Instruction | adds r3, #0x1 | adds r3, #0xa | -| Address | 0x1000027c | 0x1000027c | -| Hex bytes | 01 33 | 0A 33 | -| Increment value | 1 | 10 | -| File offset | 0x27c | 0x27c | - -##### Instruction Encoding - -``` -Thumb adds rD, #imm8: - Byte 0: immediate value (0x01 → 0x0A) - Byte 1: opcode + register (0x33 = adds r3) -``` - -##### Serial Output After Patch - -``` -regular_fav_num: 42 -static_fav_num: 42 -regular_fav_num: 42 -static_fav_num: 52 -regular_fav_num: 42 -static_fav_num: 62 -... -regular_fav_num: 42 -static_fav_num: 252 -regular_fav_num: 42 -static_fav_num: 6 ← Overflow! 252 + 10 = 262 mod 256 = 6 -``` - -#### Reflection Answers - -1. **The overflow now wraps to 6 instead of 0. Explain why, using the modular arithmetic of a `uint8_t` (range 0-255).** - A `uint8_t` stores values modulo 256. Starting at 42 and incrementing by 10: the sequence passes through 42, 52, 62, ..., 242, 252. The next value is 252 + 10 = 262. Since `uint8_t` can only hold 0–255: $262 \bmod 256 = 6$. The wrap value is non-zero because the increment (10) does not evenly divide into 256. With increment 1, the value hits exactly 255, and $255 + 1 = 256 \bmod 256 = 0$. With increment 10, it skips from 252 directly to 262, bypassing 0 and landing on 6. - -2. **What is the maximum value you could change the increment to while still using `adds r3, #imm8`? What would happen if you needed an increment larger than 255?** - The maximum is **255** (`0xFF`). The `adds rD, #imm8` Thumb encoding has an 8-bit immediate field, so valid values are 0–255. For an increment larger than 255, you would need to: (a) use a 32-bit Thumb-2 `adds.w` instruction which supports a wider range of modified immediates, (b) use a `movs` + `adds` two-instruction sequence to load a larger value, or (c) load the value from a literal pool with `ldr` then use a register-register `add`. Each approach requires different instruction sizes, so patching in a hex editor becomes more complex—you may need to shift code or use NOP padding. - -3. **If you changed the increment to 128 (`0x80`), how many iterations would it take to wrap, and what value would it wrap to?** - Starting at 42, incrementing by 128: 42 → 170 → 42 → 170 → ... Wait, let's compute: $42 + 128 = 170$ (first iteration), $170 + 128 = 298 \bmod 256 = 42$ (second iteration). It wraps after **2 iterations** back to 42. The variable alternates between 42 and 170 forever because $2 \times 128 = 256$, and $42 + 256 = 42 \bmod 256$. The value never reaches 0—it cycles between exactly two values. - -4. **Could you achieve the same speedup by changing the `strb` (store byte) to `strh` (store halfword)? Why or why not?** - No. Changing `strb` to `strh` would store 16 bits instead of 8, which means the variable would be treated as a `uint16_t` (range 0–65535). This would actually **slow down** overflow—it would take 65,535 − 42 = 65,493 iterations to wrap instead of 213. Additionally, `strh` writes 2 bytes to RAM, potentially corrupting the adjacent byte at `0x200005a9`. The proper way to speed up overflow is to increase the increment value, not change the storage width. The `strb` truncation to 8 bits is what enforces the `uint8_t` modular arithmetic. diff --git a/WEEK06/WEEK06-03.md b/WEEK06/WEEK06-03.md deleted file mode 100644 index d770f2d..0000000 --- a/WEEK06/WEEK06-03.md +++ /dev/null @@ -1,183 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 3: Make the Overflow Happen Faster - -#### Objective -Patch the `adds r3, #0x1` instruction which increments `static_fav_num` by 1 each loop iteration to `adds r3, #0xa` so the variable increments by 10 instead. Use GDB to locate the instruction, calculate the hex editor file offset, patch the binary, and verify on hardware that the `uint8_t` overflow occurs roughly 10 times sooner. - -#### Prerequisites -- Completed Week 6 tutorial (GDB and hex editor sections) -- `0x0014_static-variables.bin` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 connected via USB -- Serial monitor software (PuTTY, minicom, or screen) - -#### Task Description -The static variable `static_fav_num` is a `uint8_t` that counts from 42 to 255 before wrapping to 0. Currently it increments by 1 each iteration, so it takes 214 steps to overflow. You will change the increment value from 1 to 10 so that it overflows after only ~22 steps. This exercise teaches you how Thumb immediate encoding works for small arithmetic instructions and demonstrates the real-world impact of patching arithmetic operations. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0014_static-variables.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Locate the Increment Instruction - -From the tutorial, we know the static variable operations are in the loop body starting at `0x10000274`. Disassemble the loop body: - -```gdb -(gdb) x/20i 0x10000274 -``` - -Look for this sequence: - -``` -0x10000278: ldrb r3, [r4, #0] ; Load static_fav_num from RAM -0x1000027a: movs r2, #16 ; LED GPIO pin number -0x1000027c: adds r3, #1 ; Increment by 1 ? THIS IS OUR TARGET -0x1000027e: strb r3, [r4, #0] ; Store back to RAM -``` - -The `adds r3, #1` instruction is at address `0x1000027c`. - -##### Step 3: Examine the Instruction Encoding - -Look at the raw bytes of the instruction: - -```gdb -(gdb) x/2bx 0x1000027c -``` - -You should see: - -``` -01 33 -``` - -**Thumb encoding breakdown:** -- `01` = the immediate value `0x01` (decimal 1) -- `33` = the opcode for `adds r3, #imm8` - -##### Step 4: Test the Change in GDB First - -Before making a permanent patch, test the change in RAM: - -```gdb -(gdb) b *0x1000027c -(gdb) c -``` - -When the breakpoint hits: - -```gdb -(gdb) x/1db 0x200005a8 -``` - -Note the current value of `static_fav_num`. Now continue a few iterations and check how it increments. - -##### Step 5: Calculate the File Offset - -``` -file_offset = address - 0x10000000 -``` - -For the `adds r3, #0x1` instruction at its address, calculate the offset. - -##### Step 6: Patch with the Hex Editor - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables\build\0x0014_static-variables.bin` -2. Press **Ctrl+G** (Go to offset) and enter the calculated offset -3. You should see the byte `01` followed by `33` -4. Change `01` to `0A` (10 in decimal) -5. Verify: the bytes should now read `0A 33` encoding `adds r3, #0xa` -6. Click **File** ? **Save As** ? `0x0014_static-variables-h.bin` (in the same `build` directory) - -> ?? **Why this works:** In Thumb `adds rD, #imm8` encoding, the immediate value is stored in the first byte. The `#imm8` field accepts values 0-255, so changing 1 to 10 is safe. - -##### Step 7: Convert to UF2 and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables -python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive -3. Open your serial monitor - -##### Step 8: Verify the Hack - -**Expected serial output:** -``` -regular_fav_num: 42 -static_fav_num: 42 -regular_fav_num: 42 -static_fav_num: 52 ? Jumped by 10! -regular_fav_num: 42 -static_fav_num: 62 -... -regular_fav_num: 42 -static_fav_num: 242 -regular_fav_num: 42 -static_fav_num: 252 -regular_fav_num: 42 -static_fav_num: 6 ? Overflow! 252 + 10 = 262, but uint8_t wraps: 262 - 256 = 6 -``` - -Notice the overflow now happens much sooner, and the wrap value is no longer 0 it's 6 because `252 + 10 = 262` which wraps to `262 mod 256 = 6`. - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate arithmetic instructions in disassembled code -- Understand Thumb `adds rD, #imm8` encoding -- Patch an immediate operand in a hex editor -- Predict the effects of changing an increment value on overflow behavior - -#### Questions for Reflection - -###### Question 1: The overflow now wraps to 6 instead of 0. Explain why, using the modular arithmetic of a `uint8_t` (range 0-255). - -###### Question 2: What is the maximum value you could change the increment to while still using `adds r3, #imm8`? What would happen if you needed an increment larger than 255? - -###### Question 3: If you changed the increment to 128 (`0x80`), how many iterations would it take to wrap, and what value would it wrap to? - -###### Question 4: Could you achieve the same speedup by changing the `strb` (store byte) to `strh` (store halfword)? Why or why not? - -#### Tips and Hints -- In Thumb encoding, `adds rD, #imm8` has the immediate in the first byte and opcode in the second -- The `imm8` field is 8 bits, so valid ranges are `0x00` to `0xFF` (0-255) -- Overflow for `uint8_t` is $(value) \bmod 256$ -- Use GDB to verify: `set *(unsigned char*)0x200005a8 = 250` then continue to watch the wrap quickly - -#### Next Steps -- Proceed to Exercise 4 to learn about inverting button logic with XOR -- Try changing the increment to other values (2, 5, 50, 128) and predict the wrap behavior before flashing -- Consider: what would happen if you changed `adds` to `subs` (subtract)? diff --git a/WEEK06/WEEK06-04-S.md b/WEEK06/WEEK06-04-S.md deleted file mode 100644 index 9464c45..0000000 --- a/WEEK06/WEEK06-04-S.md +++ /dev/null @@ -1,60 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 4 Solution: Invert the Button Logic with XOR - -#### Answers - -##### Patch Details - -| Item | Original | Patched | -|--------------------|-----------------------|-----------------------| -| Instruction | eor.w r3, r3, #1 | eor.w r3, r3, #0 | -| Address | 0x10000286 | 0x10000286 | -| Hex bytes | 83 F0 01 03 | 83 F0 00 03 | -| Patched byte offset| 0x288 (3rd byte) | 01 → 00 | - -##### Logic Table Comparison - -**Original (EOR #1):** - -| Button State | GPIO 15 | After UBFX | After EOR #1 | LED (GPIO 16) | -|-------------|---------|------------|-------------|---------------| -| Released | 1 (HIGH)| 1 | 0 | OFF | -| Pressed | 0 (LOW) | 0 | 1 | ON | - -**Patched (EOR #0):** - -| Button State | GPIO 15 | After UBFX | After EOR #0 | LED (GPIO 16) | -|-------------|---------|------------|-------------|---------------| -| Released | 1 (HIGH)| 1 | 1 | **ON** | -| Pressed | 0 (LOW) | 0 | 0 | **OFF** | - -##### Hardware Result - -- Button NOT pressed: LED **ON** (was OFF) -- Button PRESSED: LED **OFF** (was ON) -- Behavior completely reversed by changing a single byte (01 → 00) - -#### Reflection Answers - -1. **Why does XOR with 1 act as a NOT for single-bit values? Write out the truth table for `x XOR 1` and `x XOR 0` where x is 0 or 1.** - - | x | x XOR 1 | x XOR 0 | - |---|---------|---------| - | 0 | 1 | 0 | - | 1 | 0 | 1 | - - `x XOR 1` always flips the bit (acts as NOT): 0→1, 1→0. `x XOR 0` always preserves the bit (acts as identity): 0→0, 1→1. This works because XOR returns 1 when inputs differ and 0 when they match. XOR with 1 forces a difference; XOR with 0 forces a match. This property only applies to the single affected bit—for multi-bit values, each bit is XORed independently. - -2. **Instead of changing `eor.w r3, r3, #1` to `eor.w r3, r3, #0`, could you achieve the same result by NOPing (removing) the instruction entirely? What bytes encode a NOP in Thumb?** - Yes. Removing the EOR instruction entirely would have the same effect as EOR #0—the value passes through unchanged. A Thumb NOP is encoded as `00 BF` (2 bytes). Since `eor.w` is a 32-bit Thumb-2 instruction (4 bytes), you would need **two** NOPs to replace it: `00 BF 00 BF`. In the hex editor, replace bytes at offset 0x286–0x289 from `83 F0 01 03` to `00 BF 00 BF`. Both approaches yield identical behavior, but the EOR #0 patch is "cleaner" because it preserves the instruction structure—making the modification more obvious during reverse engineering. - -3. **The pull-up resistor means "pressed = LOW." If you removed the pull-up (changed `gpio_pull_up` to no pull), would the button still work? Why or why not?** - It would be unreliable. Without a pull-up or pull-down resistor, the GPIO input is **floating** when the button is not pressed—there's no defined voltage on the pin. The input would pick up electrical noise, stray capacitance, and electromagnetic interference, causing random readings (0 or 1 unpredictably). When the button IS pressed, it connects to ground (LOW), which works. But when released, the pin has no path to any voltage, so `gpio_get(15)` returns garbage. The pull-up provides a defined HIGH state when the button circuit is open. - -4. **The `ubfx r3, r3, #0xf, #0x1` instruction extracts bit 15. If you changed `#0xf` to `#0x10` (bit 16), what GPIO pin would you be reading? What value would you get if nothing is connected to that pin?** - You would be reading **GPIO 16**, which is the LED output pin. Since GPIO 16 is configured as an output (not input), reading its input register returns the current output state—either 0 or 1 depending on whether the LED is currently on or off. This would create a **feedback loop**: the LED's current state determines its next state (after the XOR), causing unpredictable oscillation or a stuck state. If GPIO 16 had nothing connected and was unconfigured, the floating input would return random values, similar to Q3's scenario. diff --git a/WEEK06/WEEK06-04.md b/WEEK06/WEEK06-04.md deleted file mode 100644 index 211d41d..0000000 --- a/WEEK06/WEEK06-04.md +++ /dev/null @@ -1,193 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 6 -Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics - -### Non-Credit Practice Exercise 4: Invert the Button Logic with XOR - -#### Objective -Find the `eor.w r3, r3, #1` instruction that implements the ternary operator's button inversion, patch it to `eor.w r3, r3, #0` using a hex editor to reverse the LED behavior, and verify that the LED is now ON when the button is pressed and OFF when released the opposite of the original behavior. - -#### Prerequisites -- Completed Week 6 tutorial (all GDB and hex editor sections) -- `0x0014_static-variables.bin` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with button on GP15 and LED on GP16 - -#### Task Description -The original program uses `gpio_put(LED_GPIO, !gpio_get(BUTTON_GPIO))` which the compiler implements as an XOR (`eor.w r3, r3, #1`) to invert the button state. With the pull-up resistor, button released = HIGH, so `HIGH XOR 1 = 0` (LED off). You will patch the XOR operand from `#1` to `#0`, which effectively removes the inversion: `HIGH XOR 0 = 1` (LED on when released). This exercise demonstrates how a single-byte binary patch can completely reverse hardware behavior. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0014_static-variables.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Locate the GPIO Logic - -From the tutorial, the GPIO input/output logic is near address `0x10000274`. Disassemble: - -```gdb -(gdb) x/10i 0x10000274 -``` - -Look for this sequence: - -``` -0x10000274: mov.w r1, #0xd0000000 ; SIO base address -0x10000280: ldr r3, [r1, #4] ; Read GPIO input register -0x10000282: ubfx r3, r3, #15, #1 ; Extract bit 15 (button state) -0x10000286: eor.w r3, r3, #1 ; XOR with 1 INVERT ? OUR TARGET -0x1000028a: mcrr 0, 4, r2, r3, cr0 ; Write to GPIO output -``` - -The `eor.w r3, r3, #1` instruction is at address `0x10000286`. - -##### Step 3: Understand the Current Logic - -Trace the logic with the pull-up resistor: - -| Button State | GPIO 15 Input | After UBFX | After EOR #1 | LED (GPIO 16) | -| ------------ | ------------- | ---------- | ------------ | -------------- | -| Released | 1 (HIGH) | 1 | 0 | OFF | -| Pressed | 0 (LOW) | 0 | 1 | ON | - -The `eor.w #1` flips the bit, implementing the `!` (NOT) from the C code. - -##### Step 4: Verify with GDB - -Set a breakpoint at the `eor.w` instruction: - -```gdb -(gdb) b *0x10000286 -(gdb) c -``` - -When it hits, check what value is about to be XORed: - -```gdb -(gdb) info registers r3 -``` - -- If button is **released**: `r3 = 1` ? after EOR: `r3 = 0` -- If button is **pressed**: `r3 = 0` ? after EOR: `r3 = 1` - -##### Step 5: Test the Patch in GDB - -Modify the EOR operand in RAM to see the effect live: - -```gdb -(gdb) set $r3 = 0 -(gdb) si -(gdb) info registers r3 -``` - -Or skip the EOR entirely by advancing the PC past it, then observe the LED behavior. - -##### Step 6: Examine the Instruction Encoding - -Look at the raw bytes: - -```gdb -(gdb) x/4bx 0x10000286 -0x10000286 : 0x83 0xf0 0x01 0x03 -``` - -The `eor.w` instruction is a 32-bit Thumb-2 encoding. The 4 bytes break down as: -- `0x83 0xF0` opcode + source register (r3) -- `0x01` **the immediate value (`#1`)** ? this is what we change -- `0x03` destination register (r3) - -##### Step 7: Patch with the Hex Editor - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables\build\0x0014_static-variables.bin` -2. The instruction starts at file offset: `0x10000286 - 0x10000000 = 0x286` -3. The immediate byte is the 3rd byte: offset `0x286 + 2 = 0x288` -4. Press **Ctrl+G** and enter offset: `288` -5. You should see `01` change it to `00` -6. Verify the surrounding bytes (`83 F0` before and `03` after) are unchanged -7. Click **File** ? **Save As** ? `0x0014_static-variables-h.bin` (in the same `build` directory) - -> ?? **Why offset `0x288`?** The 4-byte instruction starts at `0x286`, but the immediate value `#1` is in the **third byte** (index 2), so it's at `0x286 + 2 = 0x288`. - -##### Step 8: Predict the New Behavior - -After patching, the logic changes: - -| Button State | GPIO 15 Input | After UBFX | After EOR #0 | LED (GPIO 16) | -| ------------ | ------------- | ---------- | ------------ | -------------- | -| Released | 1 (HIGH) | 1 | 1 | **ON** | -| Pressed | 0 (LOW) | 0 | 0 | **OFF** | - -The LED behavior is now **inverted** from the original! - -##### Step 9: Convert to UF2 and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables -python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -##### Step 10: Verify the Hack - -Test the button: -- **Button NOT pressed**: LED should now be **ON** (was OFF before patching) -- **Button PRESSED**: LED should now be **OFF** (was ON before patching) - -The LED behavior is completely reversed by changing a single byte! - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate XOR / EOR instructions in disassembled GPIO logic -- Understand how XOR implements logical NOT for single-bit values -- Patch a Thumb-2 encoded immediate operand -- Predict hardware behavior changes from binary patches - -#### Questions for Reflection - -###### Question 1: Why does XOR with 1 act as a NOT for single-bit values? Write out the truth table for `x XOR 1` and `x XOR 0` where x is 0 or 1. - -###### Question 2: Instead of changing `eor.w r3, r3, #1` to `eor.w r3, r3, #0`, could you achieve the same result by NOPing (removing) the instruction entirely? What bytes encode a NOP in Thumb? - -###### Question 3: The pull-up resistor means "pressed = LOW." If you removed the pull-up (changed `gpio_pull_up` to no pull), would the button still work? Why or why not? - -###### Question 4: The `ubfx r3, r3, #0xf, #0x1` instruction extracts bit 15. If you changed `#0xf` to `#0x10` (bit 16), what GPIO pin would you be reading? What value would you get if nothing is connected to that pin? - -#### Tips and Hints -- `eor.w r3, r3, #1` is a 32-bit Thumb-2 instruction (4 bytes), not a 16-bit Thumb instruction -- A Thumb NOP is `00 bf` (2 bytes) you would need two NOPs to replace a 4-byte instruction -- Use GDB `x/1tw` to view a word in binary format, making bit manipulation easier to see -- The SIO base address `0xd0000000` provides single-cycle access to GPIO it's separate from the IO_BANK0 registers at `0x40028000` - -#### Next Steps -- Review all four exercises and verify you can patch any part of the binary: data values, arithmetic operations, and logic operations -- Try combining multiple hacks in a single binary: change the initial value, speed up the overflow, AND invert the button logic -- Compare your patched binary with the original using `fc /b original.bin patched.bin` in the command prompt to see all changed bytes diff --git a/WEEK06/WEEK06.md b/WEEK06/WEEK06.md index 71caf77..f8bc966 100644 --- a/WEEK06/WEEK06.md +++ b/WEEK06/WEEK06.md @@ -1,6 +1,6 @@ -# Week 6: Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics +?# Week 6: Static Variables in Embedded Systems: Debugging and Hacking Static Variables w/ GPIO Input Basics -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand the difference between regular (automatic) variables and static variables @@ -14,7 +14,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 1: Understanding Static Variables +## Part 1: Understanding Static Variables ### What is a Static Variable? @@ -25,26 +25,26 @@ Think of it like this: - **Static variable:** Like writing in a notebook that you keep forever ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Regular vs Static Variables │ -│ │ -│ REGULAR (automatic): │ -│ ┌────────────────────────────────────────────────────────────┐ │ -│ │ Loop 1: Create → Set to 42 → Increment to 43 → Destroy │ │ -│ │ Loop 2: Create → Set to 42 → Increment to 43 → Destroy │ │ -│ │ Loop 3: Create → Set to 42 → Increment to 43 → Destroy │ │ -│ │ Result: Always appears as 42! │ │ -│ └────────────────────────────────────────────────────────────┘ │ -│ │ -│ STATIC: │ -│ ┌────────────────────────────────────────────────────────────┐ │ -│ │ Loop 1: Already exists → Read 42 → Increment → Store 43 │ │ -│ │ Loop 2: Already exists → Read 43 → Increment → Store 44 │ │ -│ │ Loop 3: Already exists → Read 44 → Increment → Store 45 │ │ -│ │ Result: Keeps incrementing! │ │ -│ └────────────────────────────────────────────────────────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Regular vs Static Variables | +| | +| REGULAR (automatic): | +| +------------------------------------------------------------+ | +| | Loop 1: Create -> Set to 42 -> Increment to 43 -> Destroy | | +| | Loop 2: Create -> Set to 42 -> Increment to 43 -> Destroy | | +| | Loop 3: Create -> Set to 42 -> Increment to 43 -> Destroy | | +| | Result: Always appears as 42! | | +| +------------------------------------------------------------+ | +| | +| STATIC: | +| +------------------------------------------------------------+ | +| | Loop 1: Already exists -> Read 42 -> Increment -> Store 43 | | +| | Loop 2: Already exists -> Read 43 -> Increment -> Store 44 | | +| | Loop 3: Already exists -> Read 44 -> Increment -> Store 45 | | +| | Result: Keeps incrementing! | | +| +------------------------------------------------------------+ | +| | ++-----------------------------------------------------------------+ ``` ### The `static` Keyword @@ -70,26 +70,26 @@ Different types of variables are stored in different memory locations: ### Stack vs Static Storage vs Heap ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Memory Layout │ -│ │ -│ ┌───────────────────┐ High Address (0x20082000) │ -│ │ STACK │ ← Automatic/local variables │ -│ │ (grows down) │ Created/destroyed per function │ -│ ├───────────────────┤ │ -│ │ │ │ -│ │ (free space) │ │ -│ │ │ │ -│ ├───────────────────┤ │ -│ │ HEAP │ ← Dynamic allocation (malloc/free) │ -│ │ (grows up) │ │ -│ ├───────────────────┤ │ -│ │ .bss section │ ← Uninitialized static/global vars │ -│ ├───────────────────┤ │ -│ │ .data section │ ← Initialized static/global vars │ -│ └───────────────────┘ Low Address (0x20000000) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Memory Layout | +| | +| +-------------------+ High Address (0x20082000) | +| | STACK | ?? Automatic/local variables | +| | (grows down) | Created/destroyed per function | +| +-------------------+ | +| | | | +| | (free space) | | +| | | | +| +-------------------+ | +| | HEAP | ?? Dynamic allocation (malloc/free) | +| | (grows up) | | +| +-------------------+ | +| | .bss section | ?? Uninitialized static/global vars | +| +-------------------+ | +| | .data section | ?? Initialized static/global vars | +| +-------------------+ Low Address (0x20000000) | +| | ++-----------------------------------------------------------------+ ``` **Key Point:** Static variables are NOT on the heap! They live in a fixed location in the `.data` section (if initialized) or `.bss` section (if uninitialized). This is different from heap memory which is dynamically allocated at runtime. @@ -108,29 +108,29 @@ This is called **overflow** or **wrap-around**. The value "wraps" back to 0 and --- -## 📚 Part 2: Understanding GPIO Inputs +## Part 2: Understanding GPIO Inputs ### Input vs Output So far, we've used GPIO pins as **outputs** to control LEDs. Now we'll learn to use them as **inputs** to read button states! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ GPIO Direction │ -│ │ -│ OUTPUT (what we've done before): │ -│ ┌─────────┐ │ -│ │ Pico │ ───────► LED │ -│ │ GPIO 16 │ (We control the LED) │ -│ └─────────┘ │ -│ │ -│ INPUT (new this week): │ -│ ┌─────────┐ │ -│ │ Pico │ ◄─────── Button │ -│ │ GPIO 15 │ (We read the button state) │ -│ └─────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| GPIO Direction | +| | +| OUTPUT (what we've done before): | +| +---------+ | +| | Pico | -------? LED | +| | GPIO 16 | (We control the LED) | +| +---------+ | +| | +| INPUT (new this week): | +| +---------+ | +| | Pico | ?------- Button | +| | GPIO 15 | (We read the button state) | +| +---------+ | +| | ++-----------------------------------------------------------------+ ``` ### The Floating Input Problem @@ -138,18 +138,18 @@ So far, we've used GPIO pins as **outputs** to control LEDs. Now we'll learn to When a GPIO pin is set as an input but nothing is connected, it's called a **floating input**. The voltage on the pin is undefined and can randomly read as HIGH (1) or LOW (0) due to electrical noise. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Floating Input = Random Values! │ -│ │ -│ GPIO Pin (no connection): │ -│ Reading 1: HIGH │ -│ Reading 2: LOW │ -│ Reading 3: HIGH │ -│ Reading 4: HIGH │ -│ Reading 5: LOW │ -│ (Completely unpredictable!) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Floating Input = Random Values! | +| | +| GPIO Pin (no connection): | +| Reading 1: HIGH | +| Reading 2: LOW | +| Reading 3: HIGH | +| Reading 4: HIGH | +| Reading 5: LOW | +| (Completely unpredictable!) | +| | ++-----------------------------------------------------------------+ ``` ### Pull-Up and Pull-Down Resistors @@ -164,25 +164,25 @@ To solve the floating input problem, we use **pull resistors**: The Pico 2 has **internal** pull resistors that you can enable with software - no external components needed! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Pull-Up Resistor (what we're using) │ -│ │ -│ 3.3V │ -│ │ │ -│ ┴ (internal pull-up resistor) │ -│ │ │ -│ ├──────► GPIO 15 (reads HIGH normally) │ -│ │ │ -│ ┌─┴─┐ │ -│ │BTN│ ← Button connects GPIO to GND when pressed │ -│ └─┬─┘ │ -│ │ │ -│ GND │ -│ │ -│ Button NOT pressed: GPIO reads 1 (HIGH) │ -│ Button PRESSED: GPIO reads 0 (LOW) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Pull-Up Resistor (what we're using) | +| | +| 3.3V | +| | | +| + (internal pull-up resistor) | +| | | +| +------? GPIO 15 (reads HIGH normally) | +| | | +| +-+-+ | +| |BTN| ?? Button connects GPIO to GND when pressed | +| +-+-+ | +| | | +| GND | +| | +| Button NOT pressed: GPIO reads 1 (HIGH) | +| Button PRESSED: GPIO reads 0 (LOW) | +| | ++-----------------------------------------------------------------+ ``` ### GPIO Input Functions @@ -208,8 +208,8 @@ This is a compact if-else statement: - If `pressed` is **false (0)**: output `1` (LED ON) **Why is it inverted?** Because of the pull-up resistor! -- Button **released** → GPIO reads `1` → `pressed = 1` → output `0` → LED OFF -- Button **pressed** → GPIO reads `0` → `pressed = 0` → output `1` → LED ON +- Button **released** -> GPIO reads `1` -> `pressed = 1` -> output `0` -> LED OFF +- Button **pressed** -> GPIO reads `0` -> `pressed = 0` -> output `1` -> LED ON A clearer way to write this: ```c @@ -218,7 +218,7 @@ gpio_put(LED_GPIO, !gpio_get(BUTTON_GPIO)); --- -## 📚 Part 3: Understanding Compiler Optimizations +## Part 3: Understanding Compiler Optimizations ### Why Does Code Disappear? @@ -254,7 +254,7 @@ This is why when you look for `gpio_pull_up` in the binary, you might find `gpio --- -## 📚 Part 4: Setting Up Your Environment +## Part 4: Setting Up Your Environment ### Prerequisites @@ -273,46 +273,46 @@ Before we start, make sure you have: ### Hardware Setup Connect your button like this: -- One side of button → GPIO 15 -- Other side of button → GND +- One side of button -> GPIO 15 +- Other side of button -> GND The internal pull-up resistor provides the 3.3V connection, so you only need to connect to GND! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Breadboard Wiring │ -│ │ -│ Pico 2 │ -│ ┌──────────┐ │ -│ │ │ │ -│ │ GPIO 15 │────────┐ │ -│ │ │ │ │ -│ │ GPIO 16 │────────┼───► LED (with resistor to GND) │ -│ │ │ │ │ -│ │ GND │────────┼───┐ │ -│ │ │ │ │ │ -│ └──────────┘ ┌─┴─┐ │ │ -│ │BTN│─┘ │ -│ └───┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Breadboard Wiring | +| | +| Pico 2 | +| +----------+ | +| | | | +| | GPIO 15 |--------+ | +| | | | | +| | GPIO 16 |--------+---? LED (with resistor to GND) | +| | | | | +| | GND |--------+---+ | +| | | | | | +| +----------+ +-+-+ | | +| |BTN|-+ | +| +---+ | +| | ++-----------------------------------------------------------------+ ``` ### Project Structure ``` Embedded-Hacking/ -├── 0x0014_static-variables/ -│ ├── build/ -│ │ ├── 0x0014_static-variables.uf2 -│ │ └── 0x0014_static-variables.elf -│ └── 0x0014_static-variables.c -└── uf2conv.py ++-- 0x0014_static-variables/ +| +-- build/ +| | +-- 0x0014_static-variables.uf2 +| | +-- 0x0014_static-variables.elf +| +-- 0x0014_static-variables.c ++-- uf2conv.py ``` --- -## 🔬 Part 5: Hands-On Tutorial - Static Variables and GPIO Input +## ? Part 5: Hands-On Tutorial - Static Variables and GPIO Input ### Step 1: Review the Source Code @@ -412,7 +412,7 @@ Keep the program running and watch `static_fav_num`. After 255, you'll see: ``` static_fav_num: 254 static_fav_num: 255 -static_fav_num: 0 ← Wrapped around! +static_fav_num: 0 ?? Wrapped around! static_fav_num: 1 static_fav_num: 2 ... @@ -422,9 +422,9 @@ This demonstrates unsigned integer overflow! --- -## 🔬 Part 6: Debugging with GDB (Dynamic Analysis) +## ? Part 6: Debugging with GDB (Dynamic Analysis) -> 🔄 **REVIEW:** This setup is identical to previous weeks. If you need a refresher on OpenOCD and GDB connection, refer back to Week 3 Part 6. +> ? **REVIEW:** This setup is identical to previous weeks. If you need a refresher on OpenOCD and GDB connection, refer back to Week 3 Part 6. ### Starting the Debug Session @@ -432,7 +432,7 @@ This demonstrates unsigned integer overflow! ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -511,17 +511,17 @@ c GDB responds: ``` -Breakpoint 1 at 0x10000234: file C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0014_static-variables/0x0014_static-variables.c, line 5. +Breakpoint 1 at 0x10000234: file C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0014_static-variables/0x0014_static-variables.c, line 5. Note: automatically using hardware breakpoints for read-only addresses. (gdb) c Continuing. Thread 1 "rp2350.cm0" hit Breakpoint 1, main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0014_static-variables/0x0014_static-variables.c:5 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0014_static-variables/0x0014_static-variables.c:5 5 stdio_init_all(); ``` -> ⚠️ **Note:** If GDB says `The program is not being run.` when you type `c`, the target hasn't been started yet. Use `monitor reset halt` first, then `c` to continue to your breakpoint. +> **Note:** If GDB says `The program is not being run.` when you type `c`, the target hasn't been started yet. Use `monitor reset halt` first, then `c` to continue to your breakpoint. ### Step 8: Examine the Static Variable Location @@ -531,16 +531,16 @@ Static variables live at fixed RAM addresses. But how do we find that address? L 0x10000262: ldr r4, [pc, #44] @ (0x10000290 ) ``` -This loads `r4` from the **literal pool** at address `0x10000290`. The literal pool stores constants that are too large for immediate encoding — in this case, a 32-bit RAM address. Let's examine what's stored there: +This loads `r4` from the **literal pool** at address `0x10000290`. The literal pool stores constants that are too large for immediate encoding - in this case, a 32-bit RAM address. Let's examine what's stored there: ```gdb (gdb) x/1wx 0x10000290 0x10000290 : 0x200005a8 ``` -That's `0x200005a8` — the RAM address of `static_fav_num`! The compiler placed this address in the literal pool because it can't encode a full 32-bit address in a single Thumb instruction. +That's `0x200005a8` - the RAM address of `static_fav_num`! The compiler placed this address in the literal pool because it can't encode a full 32-bit address in a single Thumb instruction. -> 💡 **Why did the disassembly at `0x10000290` show `lsls r0, r5, #22` instead?** Because `x/i` (disassemble) interprets raw data as instructions. The bytes `A8 05 00 20` at that address are the little-endian encoding of `0x200005A8`, but GDB's disassembler doesn't know it's data — it tries to decode it as a Thumb instruction. Using `x/wx` (examine as word) shows the actual value. +> Tip: **Why did the disassembly at `0x10000290` show `lsls r0, r5, #22` instead?** Because `x/i` (disassemble) interprets raw data as instructions. The bytes `A8 05 00 20` at that address are the little-endian encoding of `0x200005A8`, but GDB's disassembler doesn't know it's data - it tries to decode it as a Thumb instruction. Using `x/wx` (examine as word) shows the actual value. ### Step 9: Step Through the Loop @@ -568,10 +568,10 @@ After stepping to `0x10000262` or later, check the registers: ``` Pay attention to: -- `r4` — Should hold `0x200005a8` (static variable's RAM address, loaded from literal pool) -- `r1` — Used for `printf` arguments (holds `42` or the static variable value) -- `r3` — Used for load/increment/store of the static variable -- `pc` — Program counter (current instruction address) +- `r4` - Should hold `0x200005a8` (static variable's RAM address, loaded from literal pool) +- `r1` - Used for `printf` arguments (holds `42` or the static variable value) +- `r3` - Used for load/increment/store of the static variable +- `pc` - Program counter (current instruction address) ### Step 11: Watch the Static Variable Change @@ -613,7 +613,7 @@ TRY IT! --- -## 🔬 Part 7: Understanding the Assembly +## ? Part 7: Understanding the Assembly Now that we've explored the binary in GDB, let's make sense of the key patterns. @@ -658,9 +658,9 @@ Look for the load-increment-store pattern using `r4` (which holds the static var 0x1000028e : b.n 0x10000264 ``` -Note that `r4` was loaded earlier at `0x10000262` via `ldr r4, [pc, #44]` — this pulled the static variable's RAM address (`0x200005a8`) from the literal pool at `0x10000290`. +Note that `r4` was loaded earlier at `0x10000262` via `ldr r4, [pc, #44]` - this pulled the static variable's RAM address (`0x200005a8`) from the literal pool at `0x10000290`. -**Key insight:** The static variable lives at a **fixed RAM address** (`0x200005a8`). It's loaded, incremented, and stored back — unlike the regular variable which was optimized away! +**Key insight:** The static variable lives at a **fixed RAM address** (`0x200005a8`). It's loaded, incremented, and stored back - unlike the regular variable which was optimized away! Verify the static variable value which should be `43`: @@ -706,7 +706,7 @@ Look for this sequence: | `0x1000028a` | `mcrr 0, 4, r2, r3, cr0` | Write `r3` (button) and `r2` (pin 16) to GPIO output | | `0x1000028e` | `b.n 0x10000264` | Loop back to start (`while (true)`) | -> 💡 **Notice how the compiler interleaves the static variable increment with the GPIO logic.** It loads the SIO base address (`r1`) *before* doing the increment, and sets up `r2 = 16` (LED pin) in between. This is called **instruction scheduling** — the compiler reorders instructions to avoid pipeline stalls while waiting for memory reads. +> Tip: **Notice how the compiler interleaves the static variable increment with the GPIO logic.** It loads the SIO base address (`r1`) *before* doing the increment, and sets up `r2 = 16` (LED pin) in between. This is called **instruction scheduling** - the compiler reorders instructions to avoid pipeline stalls while waiting for memory reads. ### Step 16: Find the Infinite Loop @@ -716,21 +716,21 @@ The last instruction at `0x1000028e` is already covered in the table above: 0x1000028e: b.n 0x10000264 ``` -This is an **unconditional branch** back to `0x10000264` (the `movs r1, #42` at the top of the loop) — this is the `while (true)` in our code! There is no `pop` or `bx lr` to return from `main` because the loop never exits. +This is an **unconditional branch** back to `0x10000264` (the `movs r1, #42` at the top of the loop) - this is the `while (true)` in our code! There is no `pop` or `bx lr` to return from `main` because the loop never exits. --- -## 🔬 Part 8: Hacking the Binary with a Hex Editor +## ? Part 8: Hacking the Binary with a Hex Editor -Now for the fun part — we'll patch the `.bin` file directly using a hex editor! +Now for the fun part - we'll patch the `.bin` file directly using a hex editor! -> 💡 **Why a hex editor?** GDB **cannot write to flash memory** — the `0x10000000+` address range where program instructions live. Trying `set *(char *)0x10000264 = 0x2b` in GDB gives `Writing to flash memory forbidden in this context`. To make **permanent** patches that survive a power cycle, we edit the `.bin` file directly with a hex editor and re-flash it. +> Tip: **Why a hex editor?** GDB **cannot write to flash memory** - the `0x10000000+` address range where program instructions live. Trying `set *(char *)0x10000264 = 0x2b` in GDB gives `Writing to flash memory forbidden in this context`. To make **permanent** patches that survive a power cycle, we edit the `.bin` file directly with a hex editor and re-flash it. ### Step 17: Open the Binary in a Hex Editor 1. Open **HxD** (or your preferred hex editor: ImHex, 010 Editor, etc.) -2. Click **File** → **Open** -3. Navigate to `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables\build\` +2. Click **File** -> **Open** +3. Navigate to `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0014_static-variables\build\` 4. Open `0x0014_static-variables.bin` ### Step 18: Calculate the File Offset @@ -742,29 +742,29 @@ file_offset = address - 0x10000000 ``` For example: -- Address `0x10000264` → file offset `0x264` (612 in decimal) -- Address `0x10000286` → file offset `0x286` (646 in decimal) +- Address `0x10000264` -> file offset `0x264` (612 in decimal) +- Address `0x10000286` -> file offset `0x286` (646 in decimal) -### Step 19: Hack #1 — Change regular_fav_num from 42 to 43 +### Step 19: Hack #1 - Change regular_fav_num from 42 to 43 From our GDB analysis, we know the instruction at `0x10000264` is: ``` -movs r1, #0x2a → bytes: 2a 21 +movs r1, #0x2a -> bytes: 2a 21 ``` To change the value from 42 (`0x2a`) to 43 (`0x2b`): -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables\build\0x0014_static-variables.bin` +1. In HxD, open `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0014_static-variables\build\0x0014_static-variables.bin` 2. Press **Ctrl+G** (Go to offset) 3. Enter offset: `264` 4. You should see the byte `2A` at this position 5. Change `2A` to `2B` 6. The instruction is now `movs r1, #0x2b` (43 in decimal) -> 🔍 **How Thumb encoding works:** In `movs r1, #imm8`, the immediate value is the first byte, and the opcode `21` is the second byte. So the bytes `2a 21` encode `movs r1, #0x2a`. +> ?? **How Thumb encoding works:** In `movs r1, #imm8`, the immediate value is the first byte, and the opcode `21` is the second byte. So the bytes `2a 21` encode `movs r1, #0x2a`. -### Step 20: Hack #2 — Invert the Button Logic +### Step 20: Hack #2 - Invert the Button Logic #### Understand the Encoding @@ -778,15 +778,15 @@ From GDB, we found the `eor.w r3, r3, #1` instruction at `0x10000286` that inver This is the 32-bit Thumb-2 encoding of `eor.w r3, r3, #1`. The bytes break down as: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ eor.w r3, r3, #1 → bytes: 83 F0 01 03 │ -│ │ -│ Byte 0: 0x83 ─┐ │ -│ Byte 1: 0xF0 ─┘ First halfword (opcode + source register) │ -│ Byte 2: 0x01 ──── Immediate value (#1) ← CHANGE THIS │ -│ Byte 3: 0x03 ──── Destination register (r3) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| eor.w r3, r3, #1 -> bytes: 83 F0 01 03 | +| | +| Byte 0: 0x83 -?? | +| Byte 1: 0xF0 -+ First halfword (opcode + source register) | +| Byte 2: 0x01 ---- Immediate value (#1) ?? CHANGE THIS | +| Byte 3: 0x03 ---- Destination register (r3) | +| | ++-----------------------------------------------------------------+ ``` To change `eor.w r3, r3, #1` to `eor.w r3, r3, #0` (making XOR do nothing): @@ -800,30 +800,30 @@ To change `eor.w r3, r3, #1` to `eor.w r3, r3, #0`: 3. You should see the byte `01` at this position 4. Change `01` to `00` -> 🔍 **Why offset `0x288` and not `0x286`?** The immediate value `#1` is in the **third byte** of the 4-byte instruction. The instruction starts at file offset `0x286`, so the immediate byte is at `0x286 + 2 = 0x288`. +> ?? **Why offset `0x288` and not `0x286`?** The immediate value `#1` is in the **third byte** of the 4-byte instruction. The instruction starts at file offset `0x286`, so the immediate byte is at `0x286 + 2 = 0x288`. Now the logic is permanently changed: -- Button released (input = 1): `1 XOR 0 = 1` → LED **ON** -- Button pressed (input = 0): `0 XOR 0 = 0` → LED **OFF** +- Button released (input = 1): `1 XOR 0 = 1` -> LED **ON** +- Button pressed (input = 0): `0 XOR 0 = 0` -> LED **OFF** This is the **opposite** of the original behavior! ### Step 21: Save the Patched Binary -1. Click **File** → **Save As** +1. Click **File** -> **Save As** 2. Save as `0x0014_static-variables-h.bin` in the build directory 3. Close the hex editor --- -## 🔬 Part 9: Converting and Flashing the Hacked Binary +## ? Part 9: Converting and Flashing the Hacked Binary ### Step 22: Convert to UF2 Format Open a terminal and navigate to your project directory: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0014_static-variables +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0014_static-variables ``` Run the conversion command: @@ -833,7 +833,7 @@ python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --fam ``` **What this command means:** -- `uf2conv.py` = the conversion script (in the parent `Embedded-Hacking-main` directory) +- `uf2conv.py` = the conversion script (in the parent `Embedded-Hacking` directory) - `--base 0x10000000` = the XIP base address where code runs from - `--family 0xe48bff59` = the RP2350 family ID - `--output build\hacked.uf2` = the output filename @@ -848,7 +848,7 @@ python ..\uf2conv.py build\0x0014_static-variables-h.bin --base 0x10000000 --fam **Check the serial output:** ``` -regular_fav_num: 43 ← Changed from 42! +regular_fav_num: 43 ?? Changed from 42! static_fav_num: 42 regular_fav_num: 43 static_fav_num: 43 @@ -859,13 +859,13 @@ static_fav_num: 43 - LED should now be **ON by default** (when button is NOT pressed) - LED should turn **OFF** when you press the button -🎉 **BOOM! We successfully:** +? **BOOM! We successfully:** 1. Changed the printed value from 42 to 43 2. Inverted the LED/button logic --- -## 📊 Part 10: Summary and Review +## ? Part 10: Summary and Review ### What We Accomplished @@ -890,46 +890,46 @@ static_fav_num: 43 ### GPIO Input Configuration ``` -┌─────────────────────────────────────────────────────────────────┐ -│ GPIO Input Setup Steps │ -│ │ -│ 1. gpio_init(pin) - Initialize the pin │ -│ 2. gpio_set_dir(pin, GPIO_IN) - Set as input │ -│ 3. gpio_pull_up(pin) - Enable pull-up │ -│ OR gpio_pull_down(pin) - OR enable pull-down │ -│ 4. gpio_get(pin) - Read the state │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| GPIO Input Setup Steps | +| | +| 1. gpio_init(pin) - Initialize the pin | +| 2. gpio_set_dir(pin, GPIO_IN) - Set as input | +| 3. gpio_pull_up(pin) - Enable pull-up | +| OR gpio_pull_down(pin) - OR enable pull-down | +| 4. gpio_get(pin) - Read the state | +| | ++-----------------------------------------------------------------+ ``` ### The Binary Hacking Workflow ``` -┌─────────────────────────────────────────────────────────────────┐ -│ 1. Analyze the binary with GDB │ -│ - Disassemble functions with x/Ni │ -│ - Identify key instructions and addresses │ -├─────────────────────────────────────────────────────────────────┤ -│ 2. Understand compiler optimizations │ -│ - Some functions get inlined (gpio_pull_up → gpio_set_pulls)│ -│ - Some variables are optimized away │ -├─────────────────────────────────────────────────────────────────┤ -│ 3. Calculate file offsets │ -│ - file_offset = address - 0x10000000 │ -├─────────────────────────────────────────────────────────────────┤ -│ 4. Patch the .bin file with a hex editor │ -│ - Open the .bin file in HxD / ImHex │ -│ - Go to the calculated offset │ -│ - Change the target byte(s) │ -├─────────────────────────────────────────────────────────────────┤ -│ 5. Convert to UF2 │ -│ python uf2conv.py file.bin --base 0x10000000 │ -│ --family 0xe48bff59 --output hacked.uf2 │ -├─────────────────────────────────────────────────────────────────┤ -│ 6. Flash and verify │ -│ - Hold BOOTSEL, plug in, drag UF2 │ -│ - Check serial output and button/LED behavior │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| 1. Analyze the binary with GDB | +| - Disassemble functions with x/Ni | +| - Identify key instructions and addresses | ++-----------------------------------------------------------------+ +| 2. Understand compiler optimizations | +| - Some functions get inlined (gpio_pull_up -> gpio_set_pulls)| +| - Some variables are optimized away | ++-----------------------------------------------------------------+ +| 3. Calculate file offsets | +| - file_offset = address - 0x10000000 | ++-----------------------------------------------------------------+ +| 4. Patch the .bin file with a hex editor | +| - Open the .bin file in HxD / ImHex | +| - Go to the calculated offset | +| - Change the target byte(s) | ++-----------------------------------------------------------------+ +| 5. Convert to UF2 | +| python uf2conv.py file.bin --base 0x10000000 | +| --family 0xe48bff59 --output hacked.uf2 | ++-----------------------------------------------------------------+ +| 6. Flash and verify | +| - Hold BOOTSEL, plug in, drag UF2 | +| - Check serial output and button/LED behavior | ++-----------------------------------------------------------------+ ``` ### Key Memory Addresses @@ -943,40 +943,13 @@ static_fav_num: 43 --- -## ✅ Practice Exercises - -### Exercise 1: Change Static Variable Initial Value -The static variable starts at 42. Hack the binary to make it start at 100 instead. - -**Hint:** Find where `DAT_200005a8` is initialized in the .data section. - -### Exercise 2: Make the LED Blink -Instead of responding to button presses, hack the binary to make the LED blink continuously. - -**Hint:** You'll need to change the GPIO output logic to toggle instead of following button state. - -### Exercise 3: Reverse Engineer gpio_set_pulls -Using GDB, disassemble the `gpio_set_pulls` function and figure out what registers it writes to. - -**Hint:** Look for writes to addresses around `0x40038000` (PADS_BANK0). - -### Exercise 4: Add a Second Static Variable -If you had two static variables, where would they be stored in memory? Would they be next to each other? - -**Hint:** Static variables in the same compilation unit are typically placed consecutively in the .data section. - -### Exercise 5: Overflow Faster -The static variable overflows after 255 iterations. Can you hack it to overflow sooner? - -**Hint:** Change the increment from `+1` to `+10` by modifying the `adds r3,#0x1` instruction. - --- -## 🎓 Key Takeaways +## ? Key Takeaways 1. **Static variables persist** - They keep their value between function calls and loop iterations. -2. **Static storage ≠ heap** - Static variables are in a fixed location, not dynamically allocated. +2. **Static storage ? heap** - Static variables are in a fixed location, not dynamically allocated. 3. **Compilers optimize aggressively** - Regular variables may be optimized away if the compiler sees no effect. @@ -996,7 +969,7 @@ The static variable overflows after 255 iterations. Can you hack it to overflow --- -## 📖 Glossary +## ? Glossary | Term | Definition | | --------------------- | ---------------------------------------------------------------- | @@ -1019,7 +992,7 @@ The static variable overflows after 255 iterations. Can you hack it to overflow --- -## 🔗 Additional Resources +## ? Additional Resources ### GPIO Input Reference @@ -1061,4 +1034,6 @@ The static variable overflows after 255 iterations. Can you hack it to overflow **Remember:** Static variables are your friends when you need to remember values across function calls. But they also make your program's behavior more complex to analyze - which is exactly why we practice reverse engineering! -Happy hacking! 🔧 +Happy hacking! ? + + diff --git a/WEEK07/WEEK07-01-S.md b/WEEK07/WEEK07-01-S.md deleted file mode 100644 index 6c8de05..0000000 --- a/WEEK07/WEEK07-01-S.md +++ /dev/null @@ -1,91 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 1 Solution: Change Both LCD Lines - -#### Answers - -##### String Locations in Flash - -| String | Address | File Offset | Length (bytes) | Hex Encoding | -|---------------|--------------|-------------|----------------|---------------------------------------------------| -| "Reverse" | 0x10003ee8 | 0x3EE8 | 8 (7 + null) | 52 65 76 65 72 73 65 00 | -| "Engineering" | 0x10003ef0 | 0x3EF0 | 12 (11 + null) | 45 6E 67 69 6E 65 65 72 69 6E 67 00 | - -##### Line 1 Patch: "Reverse" → "Exploit" - -| Character | Hex | -|-----------|--------| -| E | 0x45 | -| x | 0x78 | -| p | 0x70 | -| l | 0x6c | -| o | 0x6f | -| i | 0x69 | -| t | 0x74 | -| \0 | 0x00 | - -``` -Offset 0x3EE8: -Before: 52 65 76 65 72 73 65 00 ("Reverse") -After: 45 78 70 6C 6F 69 74 00 ("Exploit") -``` - -##### Line 2 Patch: "Engineering" → "Hacking!!!!" - -| Character | Hex | -|-----------|--------| -| H | 0x48 | -| a | 0x61 | -| c | 0x63 | -| k | 0x6b | -| i | 0x69 | -| n | 0x6e | -| g | 0x67 | -| ! | 0x21 | -| ! | 0x21 | -| ! | 0x21 | -| ! | 0x21 | -| \0 | 0x00 | - -``` -Offset 0x3EF0: -Before: 45 6E 67 69 6E 65 65 72 69 6E 67 00 ("Engineering") -After: 48 61 63 6B 69 6E 67 21 21 21 21 00 ("Hacking!!!!") -``` - -##### Conversion and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants -python ..\uf2conv.py build\0x0017_constants-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### LCD Verification - -``` -Line 1: Exploit -Line 2: Hacking!!!! -``` - -#### Reflection Answers - -1. **Why must the replacement string be the same length (or shorter) as the original? What specific data would you corrupt if you used a longer string?** - Strings are stored consecutively in the `.rodata` section. "Reverse" occupies 8 bytes starting at `0x10003ee8` and "Engineering" starts immediately at `0x10003ef0`. If the replacement string is longer than 8 bytes, the extra bytes would overwrite the beginning of "Engineering" (or whatever data follows). The `.rodata` section has no gaps—it's a packed sequence of constants, format strings, and other read-only data. Corrupting adjacent data could break LCD line 2, crash `printf` format strings, or cause undefined behavior. - -2. **The two strings are stored only 8 bytes apart (0x3EE8 to 0x3EF0). "Reverse" is 7 characters + null = 8 bytes. What would happen if you patched "Reverse" with "Reversal" (8 characters + null = 9 bytes)?** - "Reversal" needs 9 bytes (8 chars + null terminator). The 9th byte (the `0x00` null terminator) would be written to address `0x10003ef0`, which is the first byte of "Engineering" — the letter 'E' (`0x45`). This would overwrite 'E' with `0x00`, turning "Engineering" into an empty string. The LCD would display "Reversal" on line 1 and nothing on line 2, because `lcd_puts` would see a null terminator immediately at the start of the second string. - -3. **If you wanted the LCD to display "Hello" on line 1 (5 characters instead of 7), what would you put in the remaining 2 bytes plus null? Write out the full 8-byte hex sequence.** - "Hello" = 5 characters, followed by the null terminator and 2 padding null bytes: - ``` - 48 65 6C 6C 6F 00 00 00 - H e l l o \0 \0 \0 - ``` - The first `0x00` at position 5 terminates the string. The remaining two `0x00` bytes are padding that fills the original 8-byte allocation. These padding bytes are never read by `lcd_puts` because it stops at the first null terminator. - -4. **Could you change the LCD to display nothing on line 1 by patching just one byte? Which byte and what value?** - Yes. Change the first byte at offset `0x3EE8` from `0x52` ('R') to `0x00` (null). This makes the string start with a null terminator, so `lcd_puts` sees an empty string and displays nothing. Only one byte needs to change: the byte at file offset `0x3EE8`, from `0x52` to `0x00`. diff --git a/WEEK07/WEEK07-01.md b/WEEK07/WEEK07-01.md deleted file mode 100644 index ade4e69..0000000 --- a/WEEK07/WEEK07-01.md +++ /dev/null @@ -1,205 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 1: Change Both LCD Lines - -#### Objective -Patch the LCD display strings in the `.bin` file to change "Reverse" to "Exploit" on line 1 and "Engineering" to "Hacking!!!!" on line 2, using GDB to locate the string addresses, a hex editor to perform the patches, and the Pico 2 hardware to verify the changes on the physical LCD. - -#### Prerequisites -- Completed Week 7 tutorial (GDB and hex editor sections) -- `0x0017_constants.bin` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with 1602 LCD connected via IC - -#### Task Description -The LCD currently displays "Reverse" on line 1 and "Engineering" on line 2. You will find both string literals in flash memory using GDB, calculate their file offsets, and patch them to display custom text. The critical constraint is that replacement strings must be the **same length** as the originals (or shorter, padded with null bytes) otherwise you'll corrupt adjacent data. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0017_constants.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Locate the String Literals in Memory - -From the tutorial, we know the strings are in the `.rodata` section: - -```gdb -(gdb) x/s 0x10003ee8 -``` - -Output: -``` -0x10003ee8: "Reverse" -``` - -```gdb -(gdb) x/s 0x10003ef0 -``` - -Output: -``` -0x10003ef0: "Engineering" -``` - -##### Step 3: Examine the Raw Bytes - -Look at the hex encoding of both strings: - -```gdb -(gdb) x/8xb 0x10003ee8 -``` - -Output: -``` -0x10003ee8: 0x52 0x65 0x76 0x65 0x72 0x73 0x65 0x00 - R e v e r s e \0 -``` - -```gdb -(gdb) x/12xb 0x10003ef0 -``` - -Output: -``` -0x10003ef0: 0x45 0x6e 0x67 0x69 0x6e 0x65 0x65 0x72 - E n g i n e e r -0x10003ef8: 0x69 0x6e 0x67 0x00 - i n g \0 -``` - -##### Step 4: Plan Your Replacement Strings - -**Original strings and their lengths:** -- "Reverse" = 7 characters + null terminator = 8 bytes -- "Engineering" = 11 characters + null terminator = 12 bytes - -**Replacement strings (MUST be same length or shorter):** -- "Exploit" = 7 characters ? (same as "Reverse") -- "Hacking!!!!" = 11 characters ? (same as "Engineering") - -Build the ASCII hex for "Exploit": - -| Character | Hex | -| --------- | ------ | -| E | `0x45` | -| x | `0x78` | -| p | `0x70` | -| l | `0x6c` | -| o | `0x6f` | -| i | `0x69` | -| t | `0x74` | -| \0 | `0x00` | - -Build the ASCII hex for "Hacking!!!!": - -| Character | Hex | -| --------- | ------ | -| H | `0x48` | -| a | `0x61` | -| c | `0x63` | -| k | `0x6b` | -| i | `0x69` | -| n | `0x6e` | -| g | `0x67` | -| ! | `0x21` | -| ! | `0x21` | -| ! | `0x21` | -| ! | `0x21` | -| \0 | `0x00` | - -##### Step 5: Calculate File Offsets - -``` -file_offset = address - 0x10000000 -``` - -- "Reverse" at `0x10003ee8` ? file offset `0x3EE8` -- "Engineering" at `0x10003ef0` ? file offset `0x3EF0` - -##### Step 6: Patch String 1 "Reverse" ? "Exploit" - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants\build\0x0017_constants.bin` -2. Press **Ctrl+G** and enter offset: `3EE8` -3. You should see: `52 65 76 65 72 73 65 00` ("Reverse\0") -4. Replace with: `45 78 70 6C 6F 69 74 00` ("Exploit\0") - -##### Step 7: Patch String 2 "Engineering" ? "Hacking!!!!" - -1. Press **Ctrl+G** and enter offset: `3EF0` -2. You should see: `45 6E 67 69 6E 65 65 72 69 6E 67 00` ("Engineering\0") -3. Replace with: `48 61 63 6B 69 6E 67 21 21 21 21 00` ("Hacking!!!!\0") - -##### Step 8: Save and Convert - -1. Click **File** ? **Save As** ? `0x0017_constants-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants -python ..\uf2conv.py build\0x0017_constants-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 9: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the LCD:** -- Line 1 should now show: `Exploit` -- Line 2 should now show: `Hacking!!!!` - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate string literals in flash memory using GDB -- Convert ASCII characters to hex bytes for patching -- Patch multiple strings in a single binary -- Understand the same-length constraint for string patching - -#### Questions for Reflection - -###### Question 1: Why must the replacement string be the same length (or shorter) as the original? What specific data would you corrupt if you used a longer string? - -###### Question 2: The two strings "Reverse" and "Engineering" are stored only 8 bytes apart (`0x3EE8` to `0x3EF0`). "Reverse" is 7 characters + null = 8 bytes it perfectly fills the gap. What would happen if you patched "Reverse" with "Reversal" (8 characters + null = 9 bytes)? - -###### Question 3: If you wanted the LCD to display "Hello" on line 1 (5 characters instead of 7), what would you put in the remaining 2 bytes plus null? Write out the full 8-byte hex sequence. - -###### Question 4: Could you change the LCD to display nothing on line 1 by patching just one byte? Which byte and what value? - -#### Tips and Hints -- Use an ASCII table to convert characters: uppercase A-Z = `0x41`-`0x5A`, lowercase a-z = `0x61`-`0x7A` -- The null terminator `0x00` marks the end of the string anything after it is ignored by `lcd_puts` -- If your replacement is shorter, pad with `0x00` bytes to fill the original length -- The 1602 LCD has 16 characters per line you cannot display more than 16 characters per line regardless of string length - -#### Next Steps -- Proceed to Exercise 2 to explore finding all string literals in the binary -- Try displaying reversed text: can you make it show "gninnignE" and "esreveR"? -- Use GDB to verify your patches before flashing: `set {char[8]} 0x10003ee8 = "Exploit"` to test in RAM first diff --git a/WEEK07/WEEK07-02-S.md b/WEEK07/WEEK07-02-S.md deleted file mode 100644 index f288ca8..0000000 --- a/WEEK07/WEEK07-02-S.md +++ /dev/null @@ -1,68 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 2 Solution: Find All String Literals in the Binary - -#### Answers - -##### String Catalog - -| Address | File Offset | String Content | Length | Purpose | -|---------------|-------------|--------------------------|--------|-----------------------------| -| `0x10003ee8` | `0x3EE8` | "Reverse" | 8 | LCD line 1 text | -| `0x10003ef0` | `0x3EF0` | "Engineering" | 12 | LCD line 2 text | -| `0x10003efc` | `0x3EFC` | "FAV_NUM: %d\r\n" | 16 | printf format string | -| `0x10003f0c` | `0x3F0C` | "OTHER_FAV_NUM: %d\r\n" | 22 | printf format string | -| Various | Various | SDK panic/assert strings | Varies | Pico SDK internal messages | -| Various | Various | Source file paths | Varies | SDK debug/assert references | - -##### GDB String Search Commands - -```gdb -(gdb) x/s 0x10003ee8 -0x10003ee8: "Reverse" - -(gdb) x/s 0x10003ef0 -0x10003ef0: "Engineering" - -(gdb) x/s 0x10003efc -0x10003efc: "FAV_NUM: %d\r\n" - -(gdb) x/s 0x10003f0c -0x10003f0c: "OTHER_FAV_NUM: %d\r\n" -``` - -##### Scanning for Strings - -```gdb -(gdb) x/20s 0x10003e00 -(gdb) x/50s 0x10003d00 -``` - -##### Literal Pool Reference - -From the literal pool at `0x100002a4`: - -| Pool Address | Value | String It Points To | -|----------------|---------------|---------------------------| -| `0x100002ac` | `0x10003EE8` | "Reverse" | -| `0x100002b0` | `0x10003EF0` | "Engineering" | -| `0x100002b4` | `0x10003EFC` | "FAV_NUM: %d\r\n" | -| `0x100002b8` | `0x10003F0C` | "OTHER_FAV_NUM: %d\r\n" | - -#### Reflection Answers - -1. **How many distinct strings did you find? Were any of them surprising or unexpected?** - At minimum 4 application-level strings: "Reverse", "Engineering", "FAV_NUM: %d\r\n", and "OTHER_FAV_NUM: %d\r\n". Beyond these, the Pico SDK embeds additional strings — panic handler messages, assert failure messages, and source file path strings used for debug output. The SDK strings are surprising because they reveal internal implementation details: file paths expose the build environment directory structure, and error messages reveal which SDK functions have built-in error checking. A reverse engineer can learn the SDK version and build configuration just from these strings. - -2. **Why are strings so valuable to a reverse engineer? What can an attacker learn about a program just from its strings?** - Strings are high-entropy human-readable data that reveals program behavior without reading assembly. An attacker can learn: what the program displays or communicates (LCD messages, serial output), what libraries it uses (SDK error messages), how it handles errors (panic/assert strings), what data formats it processes (`printf` format strings with `%d`, `%s`, `%f`), network endpoints or credentials (URLs, passwords, API keys), the build environment (file paths), and the overall purpose of the firmware. Strings are often the first thing a reverse engineer examines in an unknown binary. - -3. **What technique could a developer use to make strings harder to find in a binary? (Think about what the strings look like in memory.)** - String encryption/obfuscation: encrypt all string literals at compile time using XOR, AES, or a custom cipher, and decrypt them into a RAM buffer only when needed at runtime. This way, scanning the binary with `strings` or a hex editor reveals only ciphertext — random-looking bytes instead of readable text. Other techniques include: splitting strings across multiple locations and assembling them at runtime, using character arrays initialized by code rather than string literals, replacing strings with numeric lookup indices into an encrypted table, or using compile-time obfuscation tools that automatically transform string constants. - -4. **The printf format strings contain \r\n. In the binary, these appear as two bytes: 0x0D 0x0A. Why two bytes instead of the four characters \, r, \, n?** - The C compiler processes escape sequences during compilation. In source code, `\r` is written as two characters (backslash + r), but the compiler converts it to a single byte: `0x0D` (carriage return, ASCII 13). Similarly, `\n` becomes `0x0A` (line feed, ASCII 10). These are **control characters** — non-printable ASCII codes that control terminal behavior. The backslash notation is just a human-readable way to represent these bytes in source code. By the time the string reaches the binary, all escape sequences have been resolved to their single-byte equivalents. diff --git a/WEEK07/WEEK07-02.md b/WEEK07/WEEK07-02.md deleted file mode 100644 index 9a3224c..0000000 --- a/WEEK07/WEEK07-02.md +++ /dev/null @@ -1,157 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 2: Find All String Literals in the Binary - -#### Objective -Systematically search through the `0x0017_constants` binary using GDB and a hex editor to locate every human-readable string literal, catalog their addresses, contents, and purposes, and gain experience identifying data structures in compiled binaries. - -#### Prerequisites -- Completed Week 7 tutorial (GDB section) -- `0x0017_constants.elf` and `0x0017_constants.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) - -#### Task Description -Compiled binaries contain string literals in the `.rodata` section format strings for `printf`, LCD messages, library strings, and more. You will use two techniques to find them: (1) searching with GDB's `x/s` command to examine suspected string regions, and (2) visually scanning the binary in a hex editor for ASCII sequences. You will document every string you find, its address, and its likely purpose. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0017_constants.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Locate the Known Strings - -We already know about these strings from the tutorial: - -```gdb -(gdb) x/s 0x10003ee8 -0x10003ee8: "Reverse" - -(gdb) x/s 0x10003ef0 -0x10003ef0: "Engineering" -``` - -These are the LCD display strings. Now let's find more. - -##### Step 3: Find printf Format Strings - -The program uses `printf("FAV_NUM: %d\r\n", ...)` and `printf("OTHER_FAV_NUM: %d\r\n", ...)`. These format strings must be somewhere in flash. Look in the `.rodata` section near the LCD strings: - -```gdb -(gdb) x/10s 0x10003ec0 -``` - -This displays 10 consecutive strings starting from that address. Examine the output you should find the `printf` format strings. Try different starting addresses if needed: - -```gdb -(gdb) x/20s 0x10003e00 -``` - -##### Step 4: Search the Binary Systematically - -Use GDB to scan through flash memory in large chunks, looking for readable strings: - -```gdb -(gdb) x/50s 0x10003d00 -``` - -Many results will be garbage (non-ASCII data interpreted as text), but real strings will stand out. Look for: -- Format strings containing `%d`, `%s`, `%f`, `\r\n` -- Error messages from the Pico SDK -- Function names or debug info - -##### Step 5: Open the Binary in a Hex Editor - -1. Open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants\build\0x0017_constants.bin` in HxD -2. Switch to the "Text" pane (right side) to see ASCII representation -3. Scroll through the binary and look for readable text sequences - -In HxD, printable ASCII characters (0x200x7E) are displayed as text; non-printable bytes appear as dots. - -##### Step 6: Use Hex Editor Search - -Most hex editors can search for ASCII text: - -1. Press **Ctrl+F** (Find) -2. Switch to "Text" or "String" search mode -3. Search for known strings like `Reverse`, `FAV_NUM`, `Engineering` -4. For each hit, note the file offset - -##### Step 7: Catalog Your Findings - -Create a table of all strings you find: - -| Address | File Offset | String Content | Purpose | -| -------------- | ----------- | ----------------------- | --------------------------- | -| `0x10003ee8` | `0x3EE8` | "Reverse" | LCD line 1 text | -| `0x10003ef0` | `0x3EF0` | "Engineering" | LCD line 2 text | -| `0x10003eXX` | `0x3EXX` | "FAV_NUM: %d\r\n" | printf format string | -| `0x10003eXX` | `0x3EXX` | "OTHER_FAV_NUM: %d\r\n" | printf format string | -| ... | ... | ... | ... | - -Fill in the actual addresses you discover. - -##### Step 8: Identify SDK and Library Strings - -The Pico SDK may include additional strings (error messages, assert messages, etc.). Look for text patterns like: -- "panic" or "assert" -- File paths (e.g., paths from the SDK source) -- Function names - -These strings reveal internal SDK behavior that isn't visible in the source code. - -#### Expected Output - -After completing this exercise, you should be able to: -- Systematically enumerate string literals in a compiled binary -- Use both GDB (`x/s`) and hex editor text view to find strings -- Distinguish between application strings, format strings, and SDK/library strings -- Understand that string literals reveal program functionality to a reverse engineer - -#### Questions for Reflection - -###### Question 1: How many distinct strings did you find? Were any of them surprising or unexpected? - -###### Question 2: Why are strings so valuable to a reverse engineer? What can an attacker learn about a program just from its strings? - -###### Question 3: What technique could a developer use to make strings harder to find in a binary? (Think about what the strings look like in memory.) - -###### Question 4: The `printf` format strings contain `\r\n`. In the binary, these appear as two bytes: `0x0D 0x0A`. Why two bytes instead of the four characters `\`, `r`, `\`, `n`? - -#### Tips and Hints -- In GDB, `x/s` treats any address as the start of a null-terminated string it will print garbage if the address isn't really a string -- Use `x/Ns address` where N is a number to print N consecutive strings (useful for scanning regions) -- In HxD, use **Edit** ? **Select Block** to highlight a region and examine the text pane -- Real strings are typically 4+ printable ASCII characters followed by a null byte (`0x00`) -- The `.rodata` section is usually located after the `.text` (code) section in the binary - -#### Next Steps -- Proceed to Exercise 3 to trace the IC struct pointer chain -- Try the `strings` command if available: `strings 0x0017_constants.bin` will extract all printable character sequences -- Consider: if you found a password string in an embedded device binary, what security implications would that have? diff --git a/WEEK07/WEEK07-03-S.md b/WEEK07/WEEK07-03-S.md deleted file mode 100644 index b3af2d1..0000000 --- a/WEEK07/WEEK07-03-S.md +++ /dev/null @@ -1,91 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 3 Solution: Trace the I²C Struct Pointer Chain - -#### Answers - -##### Complete Pointer Chain - -``` -I2C_PORT (source macro: #define I2C_PORT i2c1) - ↓ -i2c1 (SDK macro: #define i2c1 (&i2c1_inst)) - ↓ -&i2c1_inst = 0x2000062c (SRAM address of i2c_inst_t struct) - ↓ -i2c1_inst.hw = 0x40098000 (pointer to I²C1 hardware register base) - ↓ -I²C1 Hardware Registers (memory-mapped I/O silicon) - +-- IC_CON at 0x40098000 - +-- IC_TAR at 0x40098004 - +-- IC_SAR at 0x40098008 - +-- IC_DATA_CMD at 0x40098010 -``` - -##### Literal Pool Load - -```gdb -(gdb) x/6wx 0x100002a4 -0x100002a4: 0x000186a0 0x2000062c 0x10003ee8 0x10003ef0 -0x100002b4: 0x10003efc 0x10003f0c -``` - -The value `0x2000062c` at pool address `0x100002a8` is loaded into `r0` by a `ldr r0, [pc, #offset]` instruction before the `bl i2c_init` call. - -##### i2c1_inst Struct in SRAM - -```gdb -(gdb) x/2wx 0x2000062c -0x2000062c : 0x40098000 0x00000000 -``` - -| Offset | Field | Value | Size | Meaning | -|--------|-------------------|-------------|---------|-------------------------------| -| +0x00 | hw | 0x40098000 | 4 bytes | Pointer to I²C1 hardware regs | -| +0x04 | restart_on_next | 0x00000000 | 4 bytes | false (no pending restart) | - -Total struct size: 8 bytes (4-byte pointer + 4-byte bool padded to word alignment). - -##### Hardware Registers at 0x40098000 - -```gdb -(gdb) x/8wx 0x40098000 -``` - -| Offset | Register | Address | Description | -|--------|-------------|-------------|---------------------------| -| +0x00 | IC_CON | 0x40098000 | I²C control register | -| +0x04 | IC_TAR | 0x40098004 | Target address register | -| +0x08 | IC_SAR | 0x40098008 | Slave address register | -| +0x10 | IC_DATA_CMD | 0x40098010 | Data command register | - -##### I²C0 Comparison - -```gdb -(gdb) x/2wx 0x20000628 -``` - -| Controller | Struct Address | hw Pointer | Separation | -|------------|---------------|-------------|-------------| -| I²C0 | 0x20000628 | 0x40090000 | Base | -| I²C1 | 0x2000062c | 0x40098000 | +0x8000 | - -Same struct layout, different hardware pointer — demonstrating the SDK's abstraction. - -#### Reflection Answers - -1. **Why does the SDK use a struct with a pointer to hardware registers instead of accessing 0x40098000 directly? What advantage does this abstraction provide?** - The struct abstraction allows the same code to work for both I²C controllers — I²C0 at `0x40090000` and I²C1 at `0x40098000` — by simply passing a different struct pointer. Functions like `i2c_init(i2c_inst_t *i2c, uint baudrate)` accept a pointer parameter, so one implementation serves both controllers. Without the struct, every I²C function would need either hardcoded addresses (duplicating code for each controller) or `if/else` branches. The abstraction also enables portability: if a future chip moves the hardware registers, only the struct initialization changes — not every function that accesses I²C. - -2. **The hw pointer stores 0x40098000. In the binary, this appears as bytes 00 80 09 40. Why is the byte order reversed from how we write the address?** - ARM Cortex-M33 uses **little-endian** byte ordering: the least significant byte (LSB) is stored at the lowest memory address. For the 32-bit value `0x40098000`: byte 0 (lowest address) = `0x00` (LSB), byte 1 = `0x80`, byte 2 = `0x09`, byte 3 = `0x40` (MSB). We write numbers with the MSB first (big-endian notation), but the processor stores them LSB-first. This is a fundamental property of the ARM architecture that affects how you read multi-byte values in hex editors and GDB `x/bx` output. - -3. **If you changed the hw pointer at 0x2000062c from 0x40098000 to 0x40090000 using GDB, what I²C controller would the program use? What would happen to the LCD?** - The program would use **I²C0** instead of I²C1, because all subsequent hardware register accesses (via `i2c1_inst.hw->...`) would read/write the I²C0 registers at `0x40090000`. However, the LCD is physically wired to the I²C1 pins (GPIO 14 for SDA, GPIO 15 for SCL), and those GPIOs are configured for the I²C1 peripheral. The I²C0 controller drives different default pins (GPIO 0/1). So the program would send I²C commands through the wrong controller on the wrong pins — the LCD would receive no signals and would stop updating, displaying whatever was last written before the pointer change. - -4. **The macro chain has 4 levels of indirection (I2C_PORT → i2c1 → &i2c1_inst → hw → registers). Is this typical for embedded SDKs? What are the trade-offs of this approach?** - Yes, this is typical. STM32 HAL, Nordic nRF5 SDK, ESP-IDF, and most professional embedded SDKs use similar multi-level abstractions. **Benefits:** code reuse across multiple peripheral instances, clean type-safe APIs, portability across chip revisions, and testability (you can mock the struct for unit tests). **Costs:** complexity for reverse engineers (harder to trace from API call to hardware), potential code bloat if not optimized, and a steeper learning curve for SDK users. In practice, modern compilers (with `-O2` or higher) optimize away most indirection — the final binary often inlines the pointer dereferences into direct register accesses, so the runtime overhead is negligible. diff --git a/WEEK07/WEEK07-03.md b/WEEK07/WEEK07-03.md deleted file mode 100644 index 6f0cc58..0000000 --- a/WEEK07/WEEK07-03.md +++ /dev/null @@ -1,206 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 3: Trace the IC Struct Pointer Chain - -#### Objective -Use GDB to follow the `i2c1_inst` struct pointer chain from the code instruction that loads it, through the struct in SRAM, to the hardware registers at `0x40098000`. Document every step of the chain: `I2C_PORT` ? `i2c1` ? `&i2c1_inst` ? `hw` ? `0x40098000`, and verify each pointer and value in memory. - -#### Prerequisites -- Completed Week 7 tutorial (Parts 3-4 on structs and the macro chain) -- `0x0017_constants.elf` binary available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- Understanding of C pointers and structs - -#### Task Description -The Pico SDK uses a chain of macros and structs to abstract hardware access. When you write `I2C_PORT` in C, it expands through multiple macro definitions to ultimately become a pointer to an `i2c_inst_t` struct in SRAM, which in turn contains a pointer to the IC hardware registers. You will trace this entire chain in GDB, examining each link to understand how the SDK connects your code to silicon. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0017_constants.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the i2c_init Call - -Run the program to allow initialization to complete, then halt: - -```gdb -(gdb) b *0x10000234 -(gdb) c -``` - -Now step through to just before the `i2c_init` call: - -```gdb -(gdb) x/10i 0x1000023c -``` - -Look for the instruction that loads the `i2c1_inst` pointer into `r0`: - -``` -0x1000023c: ldr r0, [pc, #offset] ; Load &i2c1_inst into r0 -0x1000023e: ldr r1, =0x186A0 ; 100000 (baud rate) -0x10000240: bl i2c_init ; Call i2c_init(i2c1, 100000) -``` - -##### Step 3: Follow the PC-Relative Load - -The `ldr r0, [pc, #offset]` instruction loads a value from a **literal pool** a data area near the code. Examine what's at the literal pool: - -```gdb -(gdb) x/4wx 0x100002a8 -``` - -Look for a value in the `0x2000xxxx` range this is the SRAM address of `i2c1_inst`. It should be `0x2000062c`. - -##### Step 4: Examine the i2c1_inst Struct in SRAM - -Now examine the struct at that SRAM address: - -```gdb -(gdb) x/2wx 0x2000062c -``` - -Expected output: -``` -0x2000062c: 0x40098000 0x00000000 -``` - -This maps to the `i2c_inst_t` struct: - -| Offset | Field | Value | Meaning | -| ------ | ----------------- | ------------ | -------------------------------- | -| `+0x00` | `hw` | `0x40098000` | Pointer to IC1 hardware regs | -| `+0x04` | `restart_on_next` | `0x00000000` | `false` (no pending restart) | - -##### Step 5: Follow the hw Pointer to Hardware Registers - -The first member of the struct (`hw`) points to `0x40098000` the IC1 hardware register block. Examine it: - -```gdb -(gdb) x/8wx 0x40098000 -``` - -You should see the IC1 control and status registers: - -| Offset | Register | Description | -| ------ | -------------- | ------------------------------ | -| `+0x00` | IC_CON | IC control register | -| `+0x04` | IC_TAR | Target address register | -| `+0x08` | IC_SAR | Slave address register | -| `+0x0C` | (reserved) | | -| `+0x10` | IC_DATA_CMD | Data command register | - -##### Step 6: Verify the IC Target Address - -After `i2c_init` and `lcd_i2c_init` have run, check the target address register: - -Let the program run past initialization: - -```gdb -(gdb) delete -(gdb) b * -(gdb) c -``` - -Then examine IC_TAR: - -```gdb -(gdb) x/1wx 0x40098004 -``` - -You should see `0x27` (or a value containing 0x27) this is the LCD's IC address! - -##### Step 7: Document the Complete Chain - -Create a diagram of the complete pointer chain: - -``` -Your Code: I2C_PORT - - ? (preprocessor macro) -i2c1 - - ? (macro: #define i2c1 (&i2c1_inst)) -&i2c1_inst = 0x2000062c (SRAM address) - - ? (struct member access) -i2c1_inst.hw = 0x40098000 (hardware register base) - - ? (memory-mapped I/O) -IC1 Hardware Registers (silicon) - - +-- IC_CON at 0x40098000 - +-- IC_TAR at 0x40098004 - +-- IC_DATA_CMD at 0x40098010 - +-- ... -``` - -##### Step 8: Compare with IC0 - -The Pico 2 has two IC controllers. Find the `i2c0_inst` struct and compare: - -```gdb -(gdb) x/2wx 0x20000628 -``` - -If IC0's struct is at a nearby address, you should see: -- `hw` pointing to `0x40090000` (IC0 base, different from IC1's `0x40098000`) -- `restart_on_next` = 0 - -This demonstrates how the SDK uses the same struct layout for both IC controllers, with only the hardware pointer changing. - -#### Expected Output - -After completing this exercise, you should be able to: -- Trace pointer chains from high-level code to hardware registers -- Understand how the Pico SDK uses structs to abstract hardware -- Read struct members from raw memory using GDB -- Navigate from SRAM data structures to memory-mapped I/O registers - -#### Questions for Reflection - -###### Question 1: Why does the SDK use a struct with a pointer to hardware registers instead of accessing `0x40098000` directly? What advantage does this abstraction provide? - -###### Question 2: The `hw` pointer stores `0x40098000`. In the binary, this appears as bytes `00 80 09 40`. Why is the byte order reversed from how we write the address? - -###### Question 3: If you changed the `hw` pointer at `0x2000062c` from `0x40098000` to `0x40090000` using GDB (`set {int}0x2000062c = 0x40090000`), what IC controller would the program use? What would happen to the LCD? - -###### Question 4: The macro chain has 4 levels of indirection (I2C_PORT ? i2c1 ? &i2c1_inst ? hw ? registers). Is this typical for embedded SDKs? What are the trade-offs of this approach? - -#### Tips and Hints -- Use `x/wx` to examine 32-bit words (pointers are 32 bits on ARM Cortex-M33) -- SRAM addresses start with `0x20xxxxxx`; hardware register addresses start with `0x40xxxxxx` -- The literal pool (where PC-relative loads get their data) is usually right after the function's code -- `i2c_inst_t` is only 8 bytes: 4-byte pointer + 4-byte bool (padded to 4 bytes for alignment) -- IC0 base = `0x40090000`, IC1 base = `0x40098000` they are `0x8000` bytes apart - -#### Next Steps -- Proceed to Exercise 4 to patch the LCD to display your own custom message -- Try modifying the `restart_on_next` field in GDB and observe if it changes IC behavior -- Explore the IC hardware registers at `0x40098000` can you read the IC_STATUS register to see if the bus is active? diff --git a/WEEK07/WEEK07-04-S.md b/WEEK07/WEEK07-04-S.md deleted file mode 100644 index fb7e7ad..0000000 --- a/WEEK07/WEEK07-04-S.md +++ /dev/null @@ -1,96 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 4 Solution: Display Your Own Custom Message on the LCD - -#### Answers - -##### String Constraints - -| Line | Original | Address | File Offset | Max Chars | Allocated Bytes | -|------|--------------|-------------|-------------|-----------|-----------------| -| 1 | "Reverse" | 0x10003ee8 | 0x3EE8 | 7 | 8 | -| 2 | "Engineering" | 0x10003ef0 | 0x3EF0 | 11 | 12 | - -##### Example Patch: "Hello!!" and "World!!" - -**Line 1: "Hello!!" (7 characters — exact fit)** - -| Character | Hex | -|-----------|--------| -| H | 0x48 | -| e | 0x65 | -| l | 0x6C | -| l | 0x6C | -| o | 0x6F | -| ! | 0x21 | -| ! | 0x21 | -| \0 | 0x00 | - -``` -Offset 0x3EE8: -Before: 52 65 76 65 72 73 65 00 ("Reverse") -After: 48 65 6C 6C 6F 21 21 00 ("Hello!!") -``` - -**Line 2: "World!!" (7 characters — needs 5 bytes of null padding)** - -| Character | Hex | -|-----------|--------| -| W | 0x57 | -| o | 0x6F | -| r | 0x72 | -| l | 0x6C | -| d | 0x64 | -| ! | 0x21 | -| ! | 0x21 | -| \0 | 0x00 | -| \0 (pad) | 0x00 | -| \0 (pad) | 0x00 | -| \0 (pad) | 0x00 | -| \0 (pad) | 0x00 | - -``` -Offset 0x3EF0: -Before: 45 6E 67 69 6E 65 65 72 69 6E 67 00 ("Engineering") -After: 57 6F 72 6C 64 21 21 00 00 00 00 00 ("World!!") -``` - -##### Example Patch: Short String "Hi" - -**Line 1: "Hi" (2 characters — needs 5 bytes of null padding)** - -``` -Offset 0x3EE8: -Before: 52 65 76 65 72 73 65 00 ("Reverse") -After: 48 69 00 00 00 00 00 00 ("Hi") -``` - -##### Conversion and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants -python ..\uf2conv.py build\0x0017_constants-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -#### Reflection Answers - -1. **You padded short strings with 0x00 null bytes. Would it also work to pad with 0x20 (space characters)? What would be the difference on the LCD display?** - Both approaches produce valid strings, but the display differs. With `0x00` padding, the string terminates at the first null byte — `lcd_puts` stops reading there, and the remaining bytes are ignored. The LCD shows only your text. With `0x20` (space) padding, the spaces become part of the string — `lcd_puts` sends them to the LCD as visible blank characters. The LCD would show your text followed by trailing spaces. Functionally both work, but `0x00` padding is cleaner because the string length matches your intended text, and the LCD positions after your text remain in whatever state the LCD controller initialized them to (typically blank anyway). - -2. **The LCD is a 1602 (16 columns × 2 rows). What would happen if you could somehow put a 20-character string in memory? Would the LCD display all 20, or only the first 16?** - The LCD would display only the first 16 characters in the visible area. The HD44780 controller (used in 1602 LCD modules) has 40 bytes of DDRAM per line, so characters 17-20 would be written to DDRAM but are beyond the visible 16-column window. They would only become visible if you issued a display shift command to scroll the view. The `lcd_puts` function writes all characters to the controller regardless of line length — it has no built-in truncation. The 16-character limit is a physical display constraint, not a software one. - -3. **If you wanted to combine the string hacks from Exercise 1 (changing both LCD lines) AND a hypothetical numeric hack (e.g., changing the movs r1, #42 encoding at offset 0x28E), could you do all patches in a single .bin file? What offsets would you need to modify?** - Yes, all patches can be applied to the same `.bin` file since they are at non-overlapping offsets. The three patch locations are: - - **Offset 0x28E**: FAV_NUM — change `movs r1, #42` immediate byte from `0x2A` to desired value (1 byte) - - **Offset 0x3EE8**: LCD line 1 — replace the 8-byte "Reverse" string - - **Offset 0x3EF0**: LCD line 2 — replace the 12-byte "Engineering" string - - Each patch modifies a different region of the binary, so they are completely independent. You could also patch the `movw r1, #1337` instruction at offset `0x298` (the imm8 byte of the OTHER_FAV_NUM encoding) for a fourth independent patch. - -4. **Besides LCD text, what other strings could you patch in a real-world embedded device to change its behavior? Think about Wi-Fi SSIDs, Bluetooth device names, HTTP headers, etc.** - Real-world embedded devices contain many patchable strings: **Wi-Fi SSIDs** and **passwords** (change what network the device connects to), **Bluetooth device names** (change how it appears during pairing), **HTTP/HTTPS URLs** (redirect API calls to a different server), **MQTT broker addresses** (redirect IoT telemetry), **DNS hostnames**, **firmware version strings** (spoof version for update bypass), **serial number formats**, **command-line interface prompts**, **error and debug messages** (hide forensic evidence), **TLS/SSL certificate fields**, **NTP server addresses** (manipulate time synchronization), and **authentication tokens or API keys**. String patching is one of the most practical firmware modification techniques because it's simple to execute and can dramatically change device behavior. diff --git a/WEEK07/WEEK07-04.md b/WEEK07/WEEK07-04.md deleted file mode 100644 index 5339d50..0000000 --- a/WEEK07/WEEK07-04.md +++ /dev/null @@ -1,148 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 7 -Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics - -### Non-Credit Practice Exercise 4: Display Your Own Custom Message on the LCD - -#### Objective -Patch both LCD string literals in the binary to display your name (or any custom message) on the 1602 LCD, respecting the character length constraints, converting your text to hex bytes, and verifying the result on hardware. - -#### Prerequisites -- Completed Week 7 tutorial (hex editor section) and Exercise 1 -- `0x0017_constants.bin` binary available in your build directory -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with 1602 LCD connected via I²C - -#### Task Description -You will choose two custom messages to display on the LCD — one for each line. Line 1 replaces "Reverse" (7 characters max) and line 2 replaces "Engineering" (11 characters max). You must convert your chosen text to ASCII hex, handle the case where your text is shorter than the original (pad with null bytes), patch the binary, and flash it to see your custom message on the physical LCD. - -#### Step-by-Step Instructions - -##### Step 1: Choose Your Messages - -Plan two messages that fit the constraints: - -| Line | Original | Max Length | Your Message | Length | Valid? | -| ---- | ------------- | ---------- | ------------ | ------ | ------ | -| 1 | "Reverse" | 7 chars | | | | -| 2 | "Engineering" | 11 chars | | | | - -**Examples that work:** -- Line 1: "Hello!!" (7 chars) ✅ -- Line 2: "World!!" (7 chars, pad with 4 null bytes) ✅ -- Line 1: "Hi" (2 chars, pad with 5 null bytes) ✅ -- Line 2: "My Name Here" — ❌ (12 chars, too long!) - -> ⚠️ **Remember:** The 1602 LCD can display up to 16 characters per line, but the binary only allocates 8 bytes for "Reverse" and 12 bytes for "Engineering". You cannot exceed these byte allocations. - -##### Step 2: Convert Your Messages to Hex - -Use an ASCII table to convert each character: - -**Common ASCII values:** - -| Character | Hex | Character | Hex | Character | Hex | -| --------- | ------ | --------- | ------ | --------- | ------ | -| Space | `0x20` | 0-9 | `0x30`-`0x39` | A-Z | `0x41`-`0x5A` | -| ! | `0x21` | : | `0x3A` | a-z | `0x61`-`0x7A` | -| " | `0x22` | ? | `0x3F` | \0 (null) | `0x00` | - -Write out the hex bytes for each message, including the null terminator and any padding: - -**Line 1 (8 bytes total):** -``` -[char1] [char2] [char3] [char4] [char5] [char6] [char7] [0x00] -``` - -If your message is shorter than 7 characters, fill the remaining bytes with `0x00`. - -**Line 2 (12 bytes total):** -``` -[char1] [char2] [char3] [char4] [char5] [char6] [char7] [char8] [char9] [char10] [char11] [0x00] -``` - -If your message is shorter than 11 characters, fill the remaining bytes with `0x00`. - -##### Step 3: Open the Binary and Navigate - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants\build\0x0017_constants.bin` -2. Press **Ctrl+G** and enter offset: `3EE8` (Line 1: "Reverse") -3. Verify you see: `52 65 76 65 72 73 65 00` ("Reverse\0") - -##### Step 4: Patch Line 1 - -Replace the 8 bytes starting at offset `0x3EE8` with your prepared hex sequence. - -For example, to write "Hello!!" (7 chars + null): -``` -Before: 52 65 76 65 72 73 65 00 (Reverse) -After: 48 65 6C 6C 6F 21 21 00 (Hello!!) -``` - -For a shorter message like "Hi" (2 chars + null + padding): -``` -Before: 52 65 76 65 72 73 65 00 (Reverse) -After: 48 69 00 00 00 00 00 00 (Hi\0\0\0\0\0\0) -``` - -##### Step 5: Patch Line 2 - -1. Press **Ctrl+G** and enter offset: `3EF0` (Line 2: "Engineering") -2. Verify you see: `45 6E 67 69 6E 65 65 72 69 6E 67 00` -3. Replace the 12 bytes with your prepared hex sequence - -##### Step 6: Save the Patched Binary - -1. Click **File** → **Save As** → `0x0017_constants-h.bin` - -##### Step 7: Convert to UF2 and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants -python ..\uf2conv.py build\0x0017_constants-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -##### Step 8: Verify on the LCD - -Check the physical LCD display. Your custom messages should appear on lines 1 and 2. - -If the LCD shows garbled text or nothing at all: -- Verify your hex conversion was correct -- Ensure you included the null terminator (`0x00`) -- Confirm you didn't accidentally modify bytes outside the string regions -- Re-open the binary and double-check offsets `0x3EE8` and `0x3EF0` - -#### Expected Output - -After completing this exercise, you should be able to: -- Convert any ASCII text to hex bytes for binary patching -- Handle strings shorter than the allocated space using null padding -- Patch string literals in any compiled binary -- Verify patches work on real hardware - -#### Questions for Reflection - -###### Question 1: You padded short strings with `0x00` null bytes. Would it also work to pad with `0x20` (space characters)? What would be the difference on the LCD display? - -###### Question 2: The LCD is a 1602 (16 columns × 2 rows). What would happen if you could somehow put a 20-character string in memory? Would the LCD display all 20, or only the first 16? - -###### Question 3: If you wanted to combine the string hacks from Exercise 1 (changing both LCD lines) AND a hypothetical numeric hack (e.g., changing the `movs r1, #42` encoding at offset `0x28E`), could you do all patches in a single `.bin` file? What offsets would you need to modify? - -###### Question 4: Besides LCD text, what other strings could you patch in a real-world embedded device to change its behavior? Think about Wi-Fi SSIDs, Bluetooth device names, HTTP headers, etc. - -#### Tips and Hints -- HxD shows the ASCII representation of bytes in the right panel — use this to verify your patches look correct -- A quick way to compute ASCII: lowercase letter hex = uppercase letter hex + `0x20` -- If you make a mistake, close the file WITHOUT saving and start over with the original `.bin` -- Take a photo of your custom LCD display for your portfolio! - -#### Next Steps -- Review all four WEEK07 exercises and verify you understand string patching, data analysis, struct tracing, and custom message creation -- Try patching the `printf` format strings to display different labels in the serial output -- Challenge: can you make the LCD display emoji-like characters using the LCD's custom character feature (if supported by the backpack)? diff --git a/WEEK07/WEEK07.md b/WEEK07/WEEK07.md index f2b35ff..43dbbe8 100644 --- a/WEEK07/WEEK07.md +++ b/WEEK07/WEEK07.md @@ -1,12 +1,12 @@ -# Week 7: Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics +?# Week 7: Constants in Embedded Systems: Debugging and Hacking Constants w/ 1602 LCD I2C Basics -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand the difference between `#define` macros and `const` variables - Know how constants are stored differently in memory (compile-time vs runtime) -- Understand the I²C (Inter-Integrated Circuit) communication protocol -- Configure I²C peripherals and communicate with LCD displays +- Understand the I2C (Inter-Integrated Circuit) communication protocol +- Configure I2C peripherals and communicate with LCD displays - Understand C structs and how the Pico SDK uses them for hardware abstraction - Use GDB to examine constants, structs, and string literals in memory - Hack constant values and string literals using a hex editor @@ -14,7 +14,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 1: Understanding Constants in C +## Part 1: Understanding Constants in C ### Two Types of Constants @@ -39,20 +39,20 @@ printf("Value: %d", FAV_NUM); Think of it like a "find and replace" in a text editor. The compiler never sees `FAV_NUM` - it only sees `42`! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Preprocessor Macro Flow │ -│ │ -│ Source Code Preprocessor Compiler │ -│ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ -│ │ #define │ │ Replace │ │ Compile │ │ -│ │ FAV_NUM │ ─────► │ FAV_NUM │ ─────► │ binary │ │ -│ │ 42 │ │ with 42 │ │ code │ │ -│ └──────────┘ └──────────┘ └──────────┘ │ -│ │ -│ FAV_NUM doesn't exist in the final binary! │ -│ The value 42 is embedded directly in instructions. │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Preprocessor Macro Flow | +| | +| Source Code Preprocessor Compiler | +| +----------+ +----------+ +----------+ | +| | #define | | Replace | | Compile | | +| | FAV_NUM | -----? | FAV_NUM | -----? | binary | | +| | 42 | | with 42 | | code | | +| +----------+ +----------+ +----------+ | +| | +| FAV_NUM doesn't exist in the final binary! | +| The value 42 is embedded directly in instructions. | +| | ++-----------------------------------------------------------------+ ``` ### Const Variables @@ -66,19 +66,19 @@ const int OTHER_FAV_NUM = 1337; Unlike `#define`, this creates a real memory location in the `.rodata` (read-only data) section of flash: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Const Variable in Memory │ -│ │ -│ Flash Memory (.rodata section) │ -│ ┌────────────────────────────────────────────────────────────┐ │ -│ │ Address: 0x10001234 │ │ -│ │ Value: 0x00000539 (1337 in hex) │ │ -│ │ Name: OTHER_FAV_NUM (in debug symbols only) │ │ -│ └────────────────────────────────────────────────────────────┘ │ -│ │ -│ The variable EXISTS in memory and can be read at runtime. │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Const Variable in Memory | +| | +| Flash Memory (.rodata section) | +| +------------------------------------------------------------+ | +| | Address: 0x10001234 | | +| | Value: 0x00000539 (1337 in hex) | | +| | Name: OTHER_FAV_NUM (in debug symbols only) | | +| +------------------------------------------------------------+ | +| | +| The variable EXISTS in memory and can be read at runtime. | +| | ++-----------------------------------------------------------------+ ``` ### Comparison: #define vs const @@ -93,35 +93,35 @@ Unlike `#define`, this creates a real memory location in the `.rodata` (read-onl --- -## 📚 Part 2: Understanding I²C Communication +## Part 2: Understanding I2C Communication -### What is I²C? +### What is I2C? -**I²C** (pronounced "I-squared-C" or "I-two-C") stands for **Inter-Integrated Circuit**. It's a way for chips to talk to each other using just TWO wires! +**I2C** (pronounced "I-squared-C" or "I-two-C") stands for **Inter-Integrated Circuit**. It's a way for chips to talk to each other using just TWO wires! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ I²C Bus - Two Wires, Many Devices │ -│ │ -│ 3.3V │ -│ │ │ -│ ┴ Pull-up ┴ Pull-up │ -│ │ │ │ -│ SDA ─┼────────────┼─────────────────────────────────────── │ -│ │ │ │ -│ SCL ─┼────────────┼─────────────────────────────────────── │ -│ │ │ │ │ │ -│ ┌───┴────┐ ┌──┴───┐ ┌────┴──┐ ┌─────┴───┐ │ -│ │ Pico │ │ LCD │ │Sensor │ │ EEPROM │ │ -│ │(Master)│ │ 0x27 │ │ 0x48 │ │ 0x50 │ │ -│ └────────┘ └──────┘ └───────┘ └─────────┘ │ -│ │ -│ Each device has a unique address (0x27, 0x48, 0x50...) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| I2C Bus - Two Wires, Many Devices | +| | +| 3.3V | +| | | +| + Pull-up + Pull-up | +| | | | +| SDA -+------------+--------------------------------------- | +| | | | +| SCL -+------------+--------------------------------------- | +| | | | | | +| +---+----+ +--+---+ +----+--+ +-----+---+ | +| | Pico | | LCD | |Sensor | | EEPROM | | +| |(Master)| | 0x27 | | 0x48 | | 0x50 | | +| +--------+ +------+ +-------+ +---------+ | +| | +| Each device has a unique address (0x27, 0x48, 0x50...) | +| | ++-----------------------------------------------------------------+ ``` -### The Two I²C Wires +### The Two I2C Wires | Wire | Name | Purpose | | ------- | ------------ | ------------------------------------ | @@ -130,13 +130,13 @@ Unlike `#define`, this creates a real memory location in the `.rodata` (read-onl ### Why Pull-Up Resistors? -I²C uses **open-drain** signals, meaning devices can only pull the line LOW. They can't drive it HIGH! Pull-up resistors are needed to bring the lines back to HIGH when no device is pulling them down. +I2C uses **open-drain** signals, meaning devices can only pull the line LOW. They can't drive it HIGH! Pull-up resistors are needed to bring the lines back to HIGH when no device is pulling them down. The Pico 2 has internal pull-ups that we can enable with `gpio_pull_up()`. -### I²C Addresses +### I2C Addresses -Every I²C device has a unique **7-bit address**. Common addresses: +Every I2C device has a unique **7-bit address**. Common addresses: | Device Type | Typical Address | | --------------------- | ---------------- | @@ -145,27 +145,27 @@ Every I²C device has a unique **7-bit address**. Common addresses: | EEPROM | `0x50` | | Real-time clock | `0x68` | -### I²C Communication Flow +### I2C Communication Flow ``` -┌─────────────────────────────────────────────────────────────────┐ -│ I²C Transaction │ -│ │ -│ 1. Master sends START condition │ -│ 2. Master sends device address (7 bits) + R/W bit │ -│ 3. Addressed device sends ACK (acknowledge) │ -│ 4. Data is transferred (8 bits at a time) │ -│ 5. Receiver sends ACK after each byte │ -│ 6. Master sends STOP condition │ -│ │ -│ START ──► Address ──► ACK ──► Data ──► ACK ──► STOP │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| I2C Transaction | +| | +| 1. Master sends START condition | +| 2. Master sends device address (7 bits) + R/W bit | +| 3. Addressed device sends ACK (acknowledge) | +| 4. Data is transferred (8 bits at a time) | +| 5. Receiver sends ACK after each byte | +| 6. Master sends STOP condition | +| | +| START --? Address --? ACK --? Data --? ACK --? STOP | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 3: Understanding C Structs +## Part 3: Understanding C Structs ### What is a Struct? @@ -222,11 +222,11 @@ struct i2c_inst { --- -## 📚 Part 4: Understanding the Pico SDK's I²C Structs +## Part 4: Understanding the Pico SDK's I2C Structs ### The i2c_inst_t Struct -The Pico SDK uses a struct to represent each I²C controller: +The Pico SDK uses a struct to represent each I2C controller: ```c struct i2c_inst { @@ -247,24 +247,24 @@ struct i2c_inst { When you write `I2C_PORT` in your code, here's what happens: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Macro Expansion Chain │ -│ │ -│ In your code: #define I2C_PORT i2c1 │ -│ │ │ -│ ▼ │ -│ In i2c.h: #define i2c1 (&i2c1_inst) │ -│ │ │ -│ ▼ │ -│ In i2c.c: i2c_inst_t i2c1_inst = {i2c1_hw, false}; │ -│ │ │ -│ ▼ │ -│ In i2c.h: #define i2c1_hw ((i2c_hw_t *)I2C1_BASE) │ -│ │ │ -│ ▼ │ -│ In addressmap.h: #define I2C1_BASE 0x40098000 │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Macro Expansion Chain | +| | +| In your code: #define I2C_PORT i2c1 | +| | | +| ? | +| In i2c.h: #define i2c1 (&i2c1_inst) | +| | | +| ? | +| In i2c.c: i2c_inst_t i2c1_inst = {i2c1_hw, false}; | +| | | +| ? | +| In i2c.h: #define i2c1_hw ((i2c_hw_t *)I2C1_BASE) | +| | | +| ? | +| In addressmap.h: #define I2C1_BASE 0x40098000 | +| | ++-----------------------------------------------------------------+ ``` So `I2C_PORT` eventually becomes a pointer to a struct that contains a pointer to hardware registers at address `0x40098000`! @@ -274,25 +274,25 @@ So `I2C_PORT` eventually becomes a pointer to a struct that contains a pointer t The `i2c_hw_t *hw` member points to the actual silicon: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Memory Map │ -│ │ -│ Address 0x40098000: I²C1 Hardware Registers │ -│ ┌────────────────────────────────────────────────────────────┐ │ -│ │ Offset 0x00: IC_CON (Control register) │ │ -│ │ Offset 0x04: IC_TAR (Target address register) │ │ -│ │ Offset 0x10: IC_DATA_CMD (Data command register) │ │ -│ │ ... │ │ -│ └────────────────────────────────────────────────────────────┘ │ -│ │ -│ The i2c_hw_t struct maps directly to these registers! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Memory Map | +| | +| Address 0x40098000: I2C1 Hardware Registers | +| +------------------------------------------------------------+ | +| | Offset 0x00: IC_CON (Control register) | | +| | Offset 0x04: IC_TAR (Target address register) | | +| | Offset 0x10: IC_DATA_CMD (Data command register) | | +| | ... | | +| +------------------------------------------------------------+ | +| | +| The i2c_hw_t struct maps directly to these registers! | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 5: The ARM Calling Convention (AAPCS) +## Part 5: The ARM Calling Convention (AAPCS) ### How Arguments Are Passed @@ -322,7 +322,7 @@ bl i2c_init ; Call the function --- -## 📚 Part 6: Setting Up Your Environment +## Part 6: Setting Up Your Environment ### Prerequisites @@ -333,7 +333,7 @@ Before we start, make sure you have: 4. GDB (`arm-none-eabi-gdb`) installed 5. Python installed (for UF2 conversion) 6. A serial monitor (PuTTY, minicom, or screen) -7. A 1602 LCD display with I²C backpack (PCF8574) +7. A 1602 LCD display with I2C backpack (PCF8574) 8. A hex editor (HxD, ImHex, or similar) 9. The sample project: `0x0017_constants` @@ -349,43 +349,43 @@ Connect your LCD like this: | SCL | GPIO 3 | ``` -┌─────────────────────────────────────────────────────────────────┐ -│ I²C LCD Wiring │ -│ │ -│ Pico 2 1602 LCD + I²C Backpack │ -│ ┌──────────┐ ┌──────────────────────┐ │ -│ │ │ │ │ │ -│ │ GPIO 2 │─────── SDA ─────►│ SDA │ │ -│ │ (SDA) │ │ │ │ -│ │ │ │ ┌────────────┐ │ │ -│ │ GPIO 3 │─────── SCL ─────►│ SCL│ Reverse │ │ │ -│ │ (SCL) │ │ │Engineering │ │ │ -│ │ │ │ └────────────┘ │ │ -│ │ 3.3V │─────── VCC ─────►│ VCC │ │ -│ │ │ │ │ │ -│ │ GND │─────── GND ─────►│ GND │ │ -│ │ │ │ │ │ -│ └──────────┘ └──────────────────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| I2C LCD Wiring | +| | +| Pico 2 1602 LCD + I2C Backpack | +| +----------+ +----------------------+ | +| | | | | | +| | GPIO 2 |------- SDA -----?| SDA | | +| | (SDA) | | | | +| | | | +------------+ | | +| | GPIO 3 |------- SCL -----?| SCL| Reverse | | | +| | (SCL) | | |Engineering | | | +| | | | +------------+ | | +| | 3.3V |------- VCC -----?| VCC | | +| | | | | | +| | GND |------- GND -----?| GND | | +| | | | | | +| +----------+ +----------------------+ | +| | ++-----------------------------------------------------------------+ ``` ### Project Structure ``` Embedded-Hacking/ -├── 0x0017_constants/ -│ ├── build/ -│ │ ├── 0x0017_constants.uf2 -│ │ └── 0x0017_constants.bin -│ ├── 0x0017_constants.c -│ └── lcd_1602.h -└── uf2conv.py ++-- 0x0017_constants/ +| +-- build/ +| | +-- 0x0017_constants.uf2 +| | +-- 0x0017_constants.bin +| +-- 0x0017_constants.c +| +-- lcd_1602.h ++-- uf2conv.py ``` --- -## 🔬 Part 7: Hands-On Tutorial - Constants and I²C LCD +## ? Part 7: Hands-On Tutorial - Constants and I2C LCD ### Step 1: Review the Source Code @@ -431,10 +431,10 @@ int main(void) { **What this code does:** -1. **Lines 7-10:** Define preprocessor macros for constants and I²C configuration +1. **Lines 7-10:** Define preprocessor macros for constants and I2C configuration 2. **Line 12:** Define a `const` variable stored in flash 3. **Line 15:** Initialize UART for serial output -4. **Lines 17-21:** Initialize I²C1 at 100kHz, configure GPIO pins, enable pull-ups +4. **Lines 17-21:** Initialize I2C1 at 100kHz, configure GPIO pins, enable pull-ups 5. **Lines 23-27:** Initialize LCD and display "Reverse" on line 0, "Engineering" on line 1 6. **Lines 29-32:** Infinite loop printing both constant values to serial terminal @@ -463,9 +463,9 @@ OTHER_FAV_NUM: 1337 --- -## 🔬 Part 8: Debugging with GDB (Dynamic Analysis) +## ? Part 8: Debugging with GDB (Dynamic Analysis) -> 🔄 **REVIEW:** This setup is identical to previous weeks. If you need a refresher on OpenOCD and GDB connection, refer back to Week 3 Part 6. +> ? **REVIEW:** This setup is identical to previous weeks. If you need a refresher on OpenOCD and GDB connection, refer back to Week 3 Part 6. ### Starting the Debug Session @@ -473,7 +473,7 @@ OTHER_FAV_NUM: 1337 ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -573,17 +573,17 @@ c GDB responds: ``` -Breakpoint 1 at 0x10000234: file C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0017_constants/0x0017_constants.c, line 16. +Breakpoint 1 at 0x10000234: file C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0017_constants/0x0017_constants.c, line 16. Note: automatically using hardware breakpoints for read-only addresses. (gdb) c Continuing. Thread 1 "rp2350.cm0" hit Breakpoint 1, main () - at C:/Users/flare-vm/Desktop/Embedded-Hacking-main/0x0017_constants/0x0017_constants.c:16 + at C:/Users/assem.KEVINTHOMAS/OneDrive/Documents/Embedded-Hacking/0x0017_constants/0x0017_constants.c:16 16 stdio_init_all(); ``` -> ⚠️ **Note:** If GDB says `The program is not being run.` when you type `c`, the target hasn't been started yet. Use `monitor reset halt` first, then `c` to continue to your breakpoint. +> **Note:** If GDB says `The program is not being run.` when you type `c`, the target hasn't been started yet. Use `monitor reset halt` first, then `c` to continue to your breakpoint. ### Step 6: Find the #define Constant (FAV_NUM) @@ -618,13 +618,13 @@ Look for this instruction: ... ``` -**Surprise!** The `const` variable is ALSO embedded as an immediate value — not loaded from memory! The compiler saw that `OTHER_FAV_NUM` is never address-taken (`&OTHER_FAV_NUM` is never used), so it optimized the `const` the same way as `#define` — as a constant embedded directly in the instruction. +**Surprise!** The `const` variable is ALSO embedded as an immediate value - not loaded from memory! The compiler saw that `OTHER_FAV_NUM` is never address-taken (`&OTHER_FAV_NUM` is never used), so it optimized the `const` the same way as `#define` - as a constant embedded directly in the instruction. The difference is the instruction encoding: -- `FAV_NUM` (42): `movs r1, #0x2a` — 16-bit Thumb instruction (values 0-255) -- `OTHER_FAV_NUM` (1337): `movw r1, #0x539` — 32-bit Thumb-2 instruction (values 0-65535) +- `FAV_NUM` (42): `movs r1, #0x2a` - 16-bit Thumb instruction (values 0-255) +- `OTHER_FAV_NUM` (1337): `movw r1, #0x539` - 32-bit Thumb-2 instruction (values 0-65535) -> 💡 **Why `movw` instead of `movs`?** The value 1337 doesn't fit in 8 bits (max 255), so the compiler uses `movw` (Move Wide) which can encode any 16-bit immediate (0-65535) in a 32-bit instruction. +> Tip: **Why `movw` instead of `movs`?** The value 1337 doesn't fit in 8 bits (max 255), so the compiler uses `movw` (Move Wide) which can encode any 16-bit immediate (0-65535) in a 32-bit instruction. ### Step 8: Examine the Literal Pool @@ -647,9 +647,9 @@ These are the values that `ldr rN, [pc, #offset]` instructions load: | `0x100002b4` | `0x10003EFC` | "FAV_NUM: %d\r\n" format str | | `0x100002b8` | `0x10003F0C` | "OTHER_FAV_NUM: %d\r\n" fmt | -> 💡 **Why does the disassembly at `0x100002a4` show `strh r0, [r4, #52]` instead of data?** Same reason as Week 6 — GDB's `x/i` tries to decode raw data as instructions. Use `x/wx` to see the actual word values. +> Tip: **Why does the disassembly at `0x100002a4` show `strh r0, [r4, #52]` instead of data?** Same reason as Week 6 - GDB's `x/i` tries to decode raw data as instructions. Use `x/wx` to see the actual word values. -### Step 9: Examine the I²C Struct +### Step 9: Examine the I2C Struct Find the i2c1_inst struct address loaded into r0 before i2c_init: @@ -684,9 +684,9 @@ Output: 0x10003ef0: "Engineering" ``` -### Step 11: Step Through I²C Initialization +### Step 11: Step Through I2C Initialization -Use `si` to step through instructions and watch the I²C setup: +Use `si` to step through instructions and watch the I2C setup: ``` si @@ -695,36 +695,36 @@ i r r0 r1 --- -## 🔬 Part 9: Understanding the Assembly +## ? Part 9: Understanding the Assembly Now that we've explored the binary in GDB, let's make sense of the key patterns we found. ### Step 12: Analyze #define vs const in Assembly -From GDB, we discovered something interesting — **both constants ended up as instruction immediates!** +From GDB, we discovered something interesting - **both constants ended up as instruction immediates!** -**For FAV_NUM (42) — a `#define` macro:** +**For FAV_NUM (42) - a `#define` macro:** ``` 0x1000028e: movs r1, #42 @ 0x2a ``` -The value 42 is embedded directly in a 16-bit Thumb instruction. This is expected — `#define` is text replacement, so the compiler never sees `FAV_NUM`, only `42`. +The value 42 is embedded directly in a 16-bit Thumb instruction. This is expected - `#define` is text replacement, so the compiler never sees `FAV_NUM`, only `42`. -**For OTHER_FAV_NUM (1337) — a `const` variable:** +**For OTHER_FAV_NUM (1337) - a `const` variable:** ``` 0x10000296: movw r1, #1337 @ 0x539 ``` -The value 1337 is ALSO embedded directly in an instruction — but this time a 32-bit Thumb-2 `movw` because the value doesn't fit in 8 bits. +The value 1337 is ALSO embedded directly in an instruction - but this time a 32-bit Thumb-2 `movw` because the value doesn't fit in 8 bits. **Why wasn't `const` stored in memory?** In theory, `const int OTHER_FAV_NUM = 1337` creates a variable in the `.rodata` section. But the compiler optimized it away because: 1. We never take the address of `OTHER_FAV_NUM` (no `&OTHER_FAV_NUM`) 2. The value fits in a 16-bit `movw` immediate 3. Loading from an immediate is faster than loading from memory -> 💡 **Key takeaway for reverse engineering:** Don't assume `const` variables will appear as memory loads. Modern compilers aggressively inline constant values. The C keyword `const` is a **source-level** concept — the compiler may or may not honor it in the final binary. +> Tip: **Key takeaway for reverse engineering:** Don't assume `const` variables will appear as memory loads. Modern compilers aggressively inline constant values. The C keyword `const` is a **source-level** concept - the compiler may or may not honor it in the final binary. -### Step 13: Analyze the I²C Struct Layout +### Step 13: Analyze the I2C Struct Layout In GDB, we examined the `i2c1_inst` struct at `0x2000062c`: @@ -736,19 +736,19 @@ In GDB, we examined the `i2c1_inst` struct at `0x2000062c`: This maps to the `i2c_inst_t` struct: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ i2c_inst_t at 0x2000062c │ -│ │ -│ ┌────────────────────────────────────────────────────────────┐ │ -│ │ Offset Type Name Value │ │ -│ │ 0x00 i2c_hw_t * hw 0x40098000 │ │ -│ │ 0x04 bool restart_on_next 0x00 (false) │ │ -│ └────────────────────────────────────────────────────────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| i2c_inst_t at 0x2000062c | +| | +| +------------------------------------------------------------+ | +| | Offset Type Name Value | | +| | 0x00 i2c_hw_t * hw 0x40098000 | | +| | 0x04 bool restart_on_next 0x00 (false) | | +| +------------------------------------------------------------+ | +| | ++-----------------------------------------------------------------+ ``` -The first member (`hw`) points to `0x40098000` — the I²C1 hardware register base. This is the end of the macro chain: `I2C_PORT` → `i2c1` → `&i2c1_inst` → `hw` → `0x40098000`. +The first member (`hw`) points to `0x40098000` - the I2C1 hardware register base. This is the end of the macro chain: `I2C_PORT` -> `i2c1` -> `&i2c1_inst` -> `hw` -> `0x40098000`. ### Step 14: Locate the String Literals @@ -762,21 +762,21 @@ We found the LCD strings in flash memory: 0x10003ef0: "Engineering" ``` -These are stored consecutively in the `.rodata` section. Note the addresses — we'll need them for patching. +These are stored consecutively in the `.rodata` section. Note the addresses - we'll need them for patching. --- -## 🔬 Part 10: Hacking the Binary with a Hex Editor +## ? Part 10: Hacking the Binary with a Hex Editor -Now for the fun part — we'll patch the `.bin` file directly using a hex editor! +Now for the fun part - we'll patch the `.bin` file directly using a hex editor! -> 💡 **Why a hex editor?** GDB **cannot write to flash memory** — the `0x10000000+` address range where program instructions and read-only data live. Trying `set *(char *)0x1000028e = 0x2b` in GDB gives `Writing to flash memory forbidden in this context`. To make **permanent** patches that survive a power cycle, we edit the `.bin` file directly with a hex editor and re-flash it. +> Tip: **Why a hex editor?** GDB **cannot write to flash memory** - the `0x10000000+` address range where program instructions and read-only data live. Trying `set *(char *)0x1000028e = 0x2b` in GDB gives `Writing to flash memory forbidden in this context`. To make **permanent** patches that survive a power cycle, we edit the `.bin` file directly with a hex editor and re-flash it. ### Step 15: Open the Binary in a Hex Editor 1. Open **HxD** (or your preferred hex editor: ImHex, 010 Editor, etc.) -2. Click **File** → **Open** -3. Navigate to `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants\build\` +2. Click **File** -> **Open** +3. Navigate to `C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0017_constants\build\` 4. Open `0x0017_constants.bin` ### Step 16: Calculate the File Offset @@ -788,22 +788,22 @@ file_offset = address - 0x10000000 ``` For example: -- Address `0x1000028e` → file offset `0x28E` (654 in decimal) -- Address `0x10003ee8` → file offset `0x3EE8` (16104 in decimal) +- Address `0x1000028e` -> file offset `0x28E` (654 in decimal) +- Address `0x10003ee8` -> file offset `0x3EE8` (16104 in decimal) -### Step 17: Understand FAV_NUM Encoding (movs — 16-bit Thumb) +### Step 17: Understand FAV_NUM Encoding (movs - 16-bit Thumb) From our GDB analysis, we know the instruction at `0x1000028e` is: ``` -movs r1, #0x2a → bytes: 2a 21 +movs r1, #0x2a -> bytes: 2a 21 ``` In HxD, navigate to file offset `0x28E` and verify you see the byte `2A` followed by `21`. -> 🔍 **How Thumb encoding works:** In `movs r1, #imm8`, the immediate value is the first byte, and the opcode `21` is the second byte. So the bytes `2a 21` encode `movs r1, #0x2a` (42). If you wanted to change this to 43, you'd change `2A` to `2B`. +> ?? **How Thumb encoding works:** In `movs r1, #imm8`, the immediate value is the first byte, and the opcode `21` is the second byte. So the bytes `2a 21` encode `movs r1, #0x2a` (42). If you wanted to change this to 43, you'd change `2A` to `2B`. -### Step 18: Understand OTHER_FAV_NUM Encoding (movw — 32-bit Thumb-2) +### Step 18: Understand OTHER_FAV_NUM Encoding (movw - 32-bit Thumb-2) From GDB, we found the `movw r1, #1337` instruction at `0x10000296`. Examine the exact bytes: @@ -815,18 +815,18 @@ From GDB, we found the `movw r1, #1337` instruction at `0x10000296`. Examine the This is the 32-bit Thumb-2 encoding of `movw r1, #0x539` (1337). The bytes break down as: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ movw r1, #0x539 → bytes: 40 F2 39 51 │ -│ │ -│ Byte 0: 0x40 ─┐ │ -│ Byte 1: 0xF2 ─┘ First halfword (opcode + upper imm bits) │ -│ Byte 2: 0x39 ──── Lower 8 bits of immediate (imm8) ← CHANGE │ -│ Byte 3: 0x51 ──── Destination register (r1) + upper imm bits │ -│ │ -│ imm16 = 0x0539 = 1337 decimal │ -│ imm8 field = 0x39 (lower 8 bits of the value) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| movw r1, #0x539 -> bytes: 40 F2 39 51 | +| | +| Byte 0: 0x40 -?? | +| Byte 1: 0xF2 -+ First halfword (opcode + upper imm bits) | +| Byte 2: 0x39 ---- Lower 8 bits of immediate (imm8) ?? CHANGE | +| Byte 3: 0x51 ---- Destination register (r1) + upper imm bits | +| | +| imm16 = 0x0539 = 1337 decimal | +| imm8 field = 0x39 (lower 8 bits of the value) | +| | ++-----------------------------------------------------------------+ ``` The file offset is `0x10000296 - 0x10000000 = 0x296`. The imm8 byte is the 3rd byte of the instruction: `0x296 + 2 = 0x298`. @@ -838,11 +838,11 @@ To change `movw r1, #1337` to `movw r1, #1344`: 3. You should see the byte `39` at this position 4. Change `39` to `40` -> 🔍 **Why offset `0x298` and not `0x296`?** The lower 8 bits of the immediate (`imm8`) are in the **third byte** of the 4-byte `movw` instruction. The instruction starts at file offset `0x296`, so imm8 is at `0x296 + 2 = 0x298`. Changing `0x39` to `0x40` changes the value from `0x539` (1337) to `0x540` (1344). +> ?? **Why offset `0x298` and not `0x296`?** The lower 8 bits of the immediate (`imm8`) are in the **third byte** of the 4-byte `movw` instruction. The instruction starts at file offset `0x296`, so imm8 is at `0x296 + 2 = 0x298`. Changing `0x39` to `0x40` changes the value from `0x539` (1337) to `0x540` (1344). -### Step 19: Hack — Change LCD Text from "Reverse" to "Exploit" +### Step 19: Hack - Change LCD Text from "Reverse" to "Exploit" -**IMPORTANT:** The new string must be the **same length** as the original! "Reverse" and "Exploit" are both 7 characters — perfect! +**IMPORTANT:** The new string must be the **same length** as the original! "Reverse" and "Exploit" are both 7 characters - perfect! From our GDB analysis in Step 10, we found the string at `0x10003ee8`. File offset = `0x10003ee8 - 0x10000000 = 0x3EE8`. @@ -864,20 +864,20 @@ From our GDB analysis in Step 10, we found the string at `0x10003ee8`. File offs ### Step 20: Save the Patched Binary -1. Click **File** → **Save As** +1. Click **File** -> **Save As** 2. Save as `0x0017_constants-h.bin` in the build directory 3. Close the hex editor --- -## 🔬 Part 11: Converting and Flashing the Hacked Binary +## ? Part 11: Converting and Flashing the Hacked Binary ### Step 21: Convert to UF2 Format Open a terminal and navigate to your project directory: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0017_constants +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x0017_constants ``` Run the conversion command: @@ -907,18 +907,18 @@ OTHER_FAV_NUM: 1337 ... ``` -The numbers are unchanged — we only patched the LCD string! +The numbers are unchanged - we only patched the LCD string! -🎉 **BOOM! We successfully changed the LCD text from "Reverse" to "Exploit" without access to the source code!** +? **BOOM! We successfully changed the LCD text from "Reverse" to "Exploit" without access to the source code!** --- -## 📊 Part 12: Summary and Review +## ? Part 12: Summary and Review ### What We Accomplished 1. **Learned about constants** - `#define` macros vs `const` variables -2. **Understood I²C communication** - Two-wire protocol for peripheral communication +2. **Understood I2C communication** - Two-wire protocol for peripheral communication 3. **Explored C structs** - How the Pico SDK abstracts hardware 4. **Mastered the macro chain** - From `I2C_PORT` to `0x40098000` 5. **Examined structs in GDB** - Inspected memory layout of `i2c_inst_t` @@ -928,52 +928,52 @@ The numbers are unchanged — we only patched the LCD string! ### #define vs const Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ #define FAV_NUM 42 │ -│ ─────────────────── │ -│ • Text replacement at compile time │ -│ • No memory allocated │ -│ • Cannot take address (&FAV_NUM is invalid) │ -│ • In binary: value appears as immediate (movs r1, #0x2a) │ -│ • To hack: patch the instruction operand │ -├─────────────────────────────────────────────────────────────────┤ -│ const int OTHER_FAV_NUM = 1337 │ -│ ────────────────────────────── │ -│ • Theoretically in .rodata, but compiler optimized it away │ -│ • Value embedded as immediate: movw r1, #0x539 (32-bit instr) │ -│ • Optimization: compiler saw &OTHER_FAV_NUM is never used │ -│ • In binary: immediate in instruction, same as #define! │ -│ • To hack: patch instruction operand (imm8 byte at offset +2) │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| #define FAV_NUM 42 | +| ------------------- | +| - Text replacement at compile time | +| - No memory allocated | +| - Cannot take address (&FAV_NUM is invalid) | +| - In binary: value appears as immediate (movs r1, #0x2a) | +| - To hack: patch the instruction operand | ++-----------------------------------------------------------------+ +| const int OTHER_FAV_NUM = 1337 | +| ------------------------------ | +| - Theoretically in .rodata, but compiler optimized it away | +| - Value embedded as immediate: movw r1, #0x539 (32-bit instr) | +| - Optimization: compiler saw &OTHER_FAV_NUM is never used | +| - In binary: immediate in instruction, same as #define! | +| - To hack: patch instruction operand (imm8 byte at offset +2) | ++-----------------------------------------------------------------+ ``` -### I²C Configuration Summary +### I2C Configuration Summary ``` -┌─────────────────────────────────────────────────────────────────┐ -│ I²C Setup Steps │ -│ │ -│ 1. i2c_init(i2c1, 100000) - Initialize at 100kHz │ -│ 2. gpio_set_function(pin, I2C) - Assign pins to I²C │ -│ 3. gpio_pull_up(sda_pin) - Enable SDA pull-up │ -│ 4. gpio_pull_up(scl_pin) - Enable SCL pull-up │ -│ 5. lcd_i2c_init(...) - Initialize the device │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| I2C Setup Steps | +| | +| 1. i2c_init(i2c1, 100000) - Initialize at 100kHz | +| 2. gpio_set_function(pin, I2C) - Assign pins to I2C | +| 3. gpio_pull_up(sda_pin) - Enable SDA pull-up | +| 4. gpio_pull_up(scl_pin) - Enable SCL pull-up | +| 5. lcd_i2c_init(...) - Initialize the device | +| | ++-----------------------------------------------------------------+ ``` ### The Struct Chain ``` -┌─────────────────────────────────────────────────────────────────┐ -│ I2C_PORT → i2c1 → &i2c1_inst → i2c_inst_t │ -│ │ │ -│ ├── hw → i2c_hw_t * │ -│ │ └── 0x40098000 │ -│ │ │ -│ └── restart_on_next (bool) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| I2C_PORT -> i2c1 -> &i2c1_inst -> i2c_inst_t | +| | | +| +-- hw -> i2c_hw_t * | +| | +-- 0x40098000 | +| | | +| +-- restart_on_next (bool) | +| | ++-----------------------------------------------------------------+ ``` ### Key Memory Addresses @@ -984,51 +984,24 @@ The numbers are unchanged — we only patched the LCD string! | `0x1000028e` | FAV_NUM value in instruction | | `0x10000296` | OTHER_FAV_NUM value in instruction | | `0x10003ee8` | "Reverse" string literal (example) | -| `0x40098000` | I²C1 hardware registers base | +| `0x40098000` | I2C1 hardware registers base | | `0x2000062C` | i2c1_inst struct in SRAM | --- -## ✅ Practice Exercises - -### Exercise 1: Change Both LCD Lines -Change "Engineering" to "Hacking!!!" (same number of characters). - -**Hint:** Find the second string after "Reverse" in memory. - -### Exercise 2: Change the I²C Address -The LCD is at address `0x27`. Find where this is passed to `lcd_i2c_init` and change it. - -**Warning:** If you change to an invalid address, the LCD won't work! - -### Exercise 3: Find All String Literals -Search the binary for all readable strings. How many can you find? What do they reveal about the program? - -**Hint:** In GDB, use `x/s` to search for strings in the binary, or scan through the `.bin` file in your hex editor. - -### Exercise 4: Trace the Struct Pointer -Follow the `i2c1_inst` pointer from the code to SRAM. What values are stored in the struct? - -**Hint:** The first member should point to `0x40098000`. - -### Exercise 5: Add Your Own Message -Can you make the LCD display your name? Remember the character limit! - -**Hint:** Line 1 and Line 2 each have 16 characters maximum on a 1602 LCD. - --- -## 🎓 Key Takeaways +## ? Key Takeaways 1. **#define is text replacement** - It happens before compilation, no memory used. 2. **const creates real variables** - Stored in .rodata, takes memory, has an address. -3. **I²C uses two wires** - SDA for data, SCL for clock, pull-ups required. +3. **I2C uses two wires** - SDA for data, SCL for clock, pull-ups required. 4. **Structs group related data** - The SDK uses them to abstract hardware. -5. **Macros can chain** - `I2C_PORT` → `i2c1` → `&i2c1_inst` → hardware pointer. +5. **Macros can chain** - `I2C_PORT` -> `i2c1` -> `&i2c1_inst` -> hardware pointer. 6. **ARM passes args in registers** - r0-r3 for first four arguments. @@ -1042,7 +1015,7 @@ Can you make the LCD display your name? Remember the character limit! --- -## 📖 Glossary +## ? Glossary | Term | Definition | | ----------------------- | --------------------------------------------------- | @@ -1050,22 +1023,22 @@ Can you make the LCD display your name? Remember the character limit! | **AAPCS** | ARM Architecture Procedure Call Standard | | **const** | Keyword marking a variable as read-only | | **Forward Declaration** | Telling compiler a type exists before defining it | -| **I²C** | Inter-Integrated Circuit - two-wire serial protocol | +| **I2C** | Inter-Integrated Circuit - two-wire serial protocol | | **Immediate Value** | A constant embedded directly in an instruction | | **Open-Drain** | Output that can only pull low, not drive high | -| **PCF8574** | Common I²C I/O expander chip used in LCD backpacks | +| **PCF8574** | Common I2C I/O expander chip used in LCD backpacks | | **Preprocessor** | Tool that processes code before compilation | | **Pull-Up Resistor** | Resistor that holds a line HIGH by default | -| **SCL** | Serial Clock - I²C timing signal | -| **SDA** | Serial Data - I²C data line | +| **SCL** | Serial Clock - I2C timing signal | +| **SDA** | Serial Data - I2C data line | | **Struct** | User-defined type grouping related variables | | **typedef** | Creates an alias for a type | --- -## 🔗 Additional Resources +## ? Additional Resources -### I²C Timing Reference +### I2C Timing Reference | Speed Mode | Maximum Frequency | | ---------- | ----------------- | @@ -1073,7 +1046,7 @@ Can you make the LCD display your name? Remember the character limit! | Fast | 400 kHz | | Fast Plus | 1 MHz | -### Common I²C Addresses +### Common I2C Addresses | Device | Address | | --------------------- | ------------- | @@ -1091,15 +1064,17 @@ Can you make the LCD display your name? Remember the character limit! | `ldr rN, [pc, #off]` | Load larger value from literal pool | | `ldr rN, =value` | Pseudo-instruction for loading any constant | -### RP2350 I²C Memory Map +### RP2350 I2C Memory Map | Address | Description | | ------------ | ----------------------- | -| `0x40090000` | I²C0 hardware registers | -| `0x40098000` | I²C1 hardware registers | +| `0x40090000` | I2C0 hardware registers | +| `0x40098000` | I2C1 hardware registers | --- -**Remember:** When you see complex nested structures in a binary, take your time to understand the hierarchy. Use GDB to examine struct layouts in memory and trace pointer chains. And always remember — even "constants" can be hacked! +**Remember:** When you see complex nested structures in a binary, take your time to understand the hierarchy. Use GDB to examine struct layouts in memory and trace pointer chains. And always remember - even "constants" can be hacked! + +Happy hacking! ? + -Happy hacking! 🔧 diff --git a/WEEK09/WEEK09-01-S.md b/WEEK09/WEEK09-01-S.md deleted file mode 100644 index a10bc14..0000000 --- a/WEEK09/WEEK09-01-S.md +++ /dev/null @@ -1,66 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Basics - -### Non-Credit Practice Exercise 1 Solution: Change the Sleep Duration - -#### Answers - -##### Sleep Duration Values - -| Parameter | Original | Patched | -|---------------|-------------|-------------| -| Duration (ms) | 2000 | 5000 | -| Hex | 0x000007D0 | 0x00001388 | -| Little-endian | D0 07 00 00 | 88 13 00 00 | - -##### Why a Literal Pool Is Needed - -The value 2000 exceeds the 8-bit immediate range of `movs` (0–255) and the 16-bit range is also impractical for a single-instruction load. The compiler stores `0x000007D0` in a **literal pool** near the function code and loads it with a `ldr r0, [pc, #offset]` instruction that reads the 32-bit word from the pool into `r0` before the `bl sleep_ms` call. - -##### Patch Procedure - -1. Find the literal pool entry containing `D0 07 00 00` in HxD -2. Replace with `88 13 00 00` - -``` -Before: D0 07 00 00 (2000) -After: 88 13 00 00 (5000) -``` - -##### Conversion and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators -python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Serial Output After Patch - -``` -arithmetic_operator: 50 -increment_operator: 5 -relational_operator: 0 -logical_operator: 0 -bitwise_operator: 12 -assignment_operator: 11 -Humidity: 51.0%, Temperature: 24.0°C -``` - -Output repeats every **5 seconds** instead of 2 seconds. - -#### Reflection Answers - -1. **Why can't 2000 be encoded as a movs immediate? What is the maximum value movs can hold?** - The `movs Rd, #imm8` instruction is a 16-bit Thumb encoding that has only 8 bits for the immediate value, giving a range of 0–255. The value 2000 (`0x7D0`) is far beyond this range. Even the 32-bit Thumb-2 `movw` instruction can only encode 0–65535, which could handle 2000, but the compiler chose a literal pool approach. The literal pool is a general-purpose solution that works for any 32-bit value, including addresses and large constants. - -2. **If you wanted to change the sleep to exactly 1 second (1000ms), what 4 bytes would you write in little-endian? Show your work.** - 1000 decimal = `0x000003E8` hex. In little-endian byte order (LSB first): `E8 03 00 00`. Breakdown: byte 0 = `0xE8` (LSB), byte 1 = `0x03`, byte 2 = `0x00`, byte 3 = `0x00` (MSB). - -3. **Could other code in the program reference the same literal pool entry containing 0x7D0? What would happen if it did?** - Yes, the compiler may share literal pool entries to save space. If another instruction also loads `0x7D0` from the same pool address (using its own `ldr rN, [pc, #offset]`), then patching that pool entry would change the value for ALL instructions that reference it. This is a risk with literal pool patching — you might unintentionally modify other parts of the program. To check, search for all `ldr` instructions whose PC-relative offset resolves to the same pool address. - -4. **What would happen if you set sleep_ms to 0? Would the program crash or just run extremely fast?** - The program would not crash — `sleep_ms(0)` is a valid call that returns immediately. The loop would run as fast as the processor can execute it, printing operator values and reading the DHT11 sensor with no delay between iterations. The serial output would flood extremely quickly. However, the DHT11 sensor has a minimum sampling interval of about 1 second; reading it more frequently may return stale data or read errors ("DHT11 read failed"), but the program itself would continue running. diff --git a/WEEK09/WEEK09-01.md b/WEEK09/WEEK09-01.md deleted file mode 100644 index bb40eec..0000000 --- a/WEEK09/WEEK09-01.md +++ /dev/null @@ -1,141 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics - -### Non-Credit Practice Exercise 1: Change the Sleep Duration - -#### Objective -Find the `sleep_ms(2000)` call in the `0x001a_operators` binary using GDB, identify the immediate value `0x7d0` (2000) being loaded into `r0`, calculate the file offset, patch it to `0x1388` (5000) using a hex editor, and verify on hardware that the serial output now prints every 5 seconds instead of every 2 seconds. - -#### Prerequisites -- Completed Week 9 tutorial (GDB and hex editor sections) -- `0x001a_operators.elf` and `0x001a_operators.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with DHT11 sensor connected - -#### Task Description -The program calls `sleep_ms(2000)` at the end of its main loop, causing a 2-second delay between each set of serial output. The value `2000` (`0x7D0`) is loaded into register `r0` before the `bl sleep_ms` call. You will locate this value in the disassembly, find the corresponding bytes in the `.bin` file, and patch them to `5000` (`0x1388`) so the loop runs every 5 seconds instead. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x001a_operators.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the sleep_ms Call - -Disassemble main and look for the `sleep_ms` call: - -```gdb -(gdb) x/60i 0x10000234 -``` - -Look for an instruction pattern like: - -``` -ldr r0, =0x7d0 ; 2000 milliseconds -bl sleep_ms -``` - -The value `0x7d0` will be loaded from the literal pool. - -##### Step 3: Examine the Literal Pool Value - -Once you find the `ldr r0, [pc, #offset]` instruction, examine the literal pool entry it references: - -```gdb -(gdb) x/wx -``` - -You should see `0x000007d0` (2000 in hex). - -##### Step 4: Calculate the File Offset - -``` -file_offset = literal_pool_address - 0x10000000 -``` - -Note the file offset of the 4-byte word containing `0x7d0`. - -##### Step 5: Encode the New Value - -The new value `5000` in hex is `0x1388`. In little-endian byte order: - -| Value | Hex | Little-Endian Bytes | -| ----- | ---------- | ------------------- | -| 2000 | `0x000007D0` | `D0 07 00 00` | -| 5000 | `0x00001388` | `88 13 00 00` | - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators\build\0x001a_operators.bin` -2. Press **Ctrl+G** and enter the file offset you calculated -3. You should see: `D0 07 00 00` -4. Replace with: `88 13 00 00` - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x001a_operators-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators -python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the serial monitor:** -- Output should now appear every **5 seconds** instead of every 2 seconds -- All operator values should remain unchanged (50, 5, 0, 0, 12, 11) - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate literal pool values referenced by `ldr` instructions -- Understand little-endian byte ordering for 32-bit values -- Patch timing constants in embedded firmware -- Calculate file offsets from memory addresses - -#### Questions for Reflection - -###### Question 1: The value `2000` is stored in the literal pool as a 32-bit word, not as an immediate in the instruction. Why can't `2000` be encoded as an immediate in a single `movs` instruction? - -###### Question 2: If you wanted to change the delay to exactly 1 second (1000ms = `0x3E8`), what bytes would you write in little-endian order? - -###### Question 3: The literal pool value is shared — could other code in the binary also reference this same `0x7D0` value? How would you check? - -###### Question 4: What would happen if you changed the sleep value to `0` (`00 00 00 00`)? Would the program crash or just run extremely fast? - -#### Tips and Hints -- `movs` can only encode immediates 0-255; values larger than 255 must be loaded from the literal pool via `ldr` -- Always verify the bytes BEFORE patching — make sure you see `D0 07 00 00` at your calculated offset -- The literal pool is typically right after the function's `b.n` (loop branch) instruction -- Use a stopwatch or count "one-one-thousand" to verify the timing change diff --git a/WEEK09/WEEK09-02-S.md b/WEEK09/WEEK09-02-S.md deleted file mode 100644 index 8c06b2c..0000000 --- a/WEEK09/WEEK09-02-S.md +++ /dev/null @@ -1,66 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Basics - -### Non-Credit Practice Exercise 2 Solution: Invert the Temperature Reading - -#### Answers - -##### IEEE-754 Sign Bit Flip - -| Value | IEEE-754 Hex | Little-Endian Bytes | Sign Bit | -|---------|--------------|--------------------|---------| -| +0.1f | 0x3DCCCCCD | CD CC CC 3D | 0 | -| -0.1f | 0xBDCCCCCD | CD CC CC BD | 1 | - -Only the **last byte** changes in little-endian: `3D` → `BD`. This flips bit 31 (the IEEE-754 sign bit) from 0 to 1, negating the value. - -##### Patch at File Offset 0x42C - -``` -Offset 0x42C: -Before: CD CC CC 3D (+0.1f) -After: CD CC CC BD (-0.1f) -``` - -Only 1 byte changes: offset `0x42F` from `0x3D` to `0xBD`. - -##### How the Temperature Changes - -The DHT11 returns raw integer and decimal parts (e.g., integer=24, decimal=0). The firmware computes: - -``` -temperature = integer_part + (decimal_part × 0.1f) -``` - -With `vfma.f32 s15, s13, s11`: result = s15 + (s13 × s11) = integer + (decimal × 0.1f) - -After patching to -0.1f: result = integer + (decimal × -0.1f) - -For a reading of 24.5°C: original = 24 + (5 × 0.1) = 24.5°C, patched = 24 + (5 × -0.1) = 23.5°C - -For a reading of 24.0°C: integer=24, decimal=0, so 24 + (0 × -0.1) = 24.0°C (unchanged when decimal is 0). - -##### Serial Output After Patch - -``` -Humidity: 51.0%, Temperature: 23.5°C -``` - -(Temperature decimal contribution is inverted; effect depends on the decimal component.) - -#### Reflection Answers - -1. **Why does changing the byte from 0x3D to 0xBD negate the float? What specific bit is being flipped?** - In IEEE-754 single-precision format, bit 31 is the **sign bit**: 0 = positive, 1 = negative. The byte `0x3D` in binary is `0011 1101` and `0xBD` is `1011 1101` — only bit 7 of that byte differs, which corresponds to bit 31 of the 32-bit float (since it's the MSB of the last byte in little-endian storage). The exponent and mantissa bits remain identical, so the magnitude stays exactly `0.1` — only the sign changes. - -2. **Why does patching one constant affect both humidity AND temperature? They use different vfma instructions (at 0x410 and 0x414) — so why are both affected?** - Both `vfma` instructions at `0x410` (humidity) and `0x414` (temperature) load the scaling constant from the **same literal pool entry** at offset `0x42C`. The compiler recognized that both computations use the same `0.1f` value and stored it only once to save space. Both `vldr s11, [pc, #offset]` instructions resolve to address `0x1000042C`. So patching that single 4-byte value changes the scaling factor for both humidity and temperature simultaneously. - -3. **What is the IEEE-754 encoding of 0.5f? If the raw sensor decimal reading was 8, what would the computed value be with 0.5f instead of 0.1f?** - 0.5f in IEEE-754: sign=0, exponent=126 (`0x7E`), mantissa=0. Hex = `0x3F000000`. Little-endian bytes: `00 00 00 3F`. With a raw decimal reading of 8: `8 × 0.5 = 4.0`. So if the integer part was 24, the result would be `24 + 4.0 = 28.0°C` instead of `24 + 0.8 = 24.8°C`. - -4. **Could you achieve the same inversion by patching the vfma instruction instead of the constant? What instruction change would work?** - Yes. You could change `vfma.f32` (fused multiply-add: d = d + a×b) to `vfms.f32` (fused multiply-subtract: d = d - a×b). This would compute `temperature = integer - (decimal × 0.1f)` instead of `integer + (decimal × 0.1f)`, achieving the same sign inversion on the decimal contribution. The instruction encoding difference between `vfma` and `vfms` is typically a single bit in the opcode. However, this approach is more complex than simply flipping the sign bit of the constant. diff --git a/WEEK09/WEEK09-02.md b/WEEK09/WEEK09-02.md deleted file mode 100644 index ac0e5cf..0000000 --- a/WEEK09/WEEK09-02.md +++ /dev/null @@ -1,136 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics - -### Non-Credit Practice Exercise 2: Invert the Temperature Reading - -#### Objective -Using GDB to locate the IEEE-754 scaling constant `0.1f` at file offset `0x42C`, patch it to `-0.1f` using a hex editor, and verify on hardware that the serial output now displays negative temperature values. - -#### Prerequisites -- Completed Week 9 tutorial (GDB, Ghidra, and hex editor sections) -- `0x001a_operators.elf` and `0x001a_operators.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with DHT11 sensor connected - -#### Task Description -The DHT11 driver uses a scaling constant of `0.1f` stored at address `0x1000042C` (file offset `0x42C`) to convert raw sensor data into human-readable values. By changing this constant to `-0.1f`, you will invert the decimal component of the temperature calculation, causing the reported temperature to drop. This exercise teaches IEEE-754 float encoding and how a single 4-byte patch can dramatically change sensor behavior. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x001a_operators.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Verify the Current Scaling Constant - -Examine the float constant at the known address: - -```gdb -(gdb) x/wx 0x1000042c -``` - -Output: -``` -0x1000042c: 0x3dcccccd -``` - -This is `0.1f` in IEEE-754 encoding (approximately — the repeating binary fraction makes it `0x3dcccccd`). - -##### Step 3: Understand the IEEE-754 Encoding - -**Current value (0.1f):** - -| Field | Bits | Value | -| -------- | ---------- | ----- | -| Sign | `0` | Positive | -| Exponent | `01111011` | 123 (biased) | -| Mantissa | `10011001100110011001101` | ~1.6 | - -**New value (-0.1f):** -- Flip only the sign bit (bit 31) from `0` to `1` -- `0x3dcccccd` → `0xbdcccccd` - -| Value | Hex | Little-Endian Bytes | -| ------ | ------------ | ------------------- | -| 0.1f | `0x3dcccccd` | `cd cc cc 3d` | -| -0.1f | `0xbdcccccd` | `cd cc cc bd` | - -> 💡 **Key insight:** To negate an IEEE-754 float, you only need to flip the most significant bit. In little-endian, this is the **last** byte — change `3d` to `bd`. - -##### Step 4: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators\build\0x001a_operators.bin` -2. Press **Ctrl+G** and enter offset: `42C` -3. You should see: `cd cc cc 3d` (or `cc cc cc 3d`) -4. Replace with: `cd cc cc bd` (or `cc cc cc bd`) - -> ⚠️ **Note:** The exact bytes may be `cc cc cc 3d` or `cd cc cc 3d` depending on compiler rounding. Just change the last byte from `3d` to `bd`. - -##### Step 5: Save and Convert - -1. Click **File** → **Save As** → `0x001a_operators-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators -python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 6: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the serial monitor:** -- All operator values remain unchanged (50, 5, 0, 0, 12, 11) -- Temperature should now display with an inverted decimal component -- Humidity will also be affected (same constant is shared) - -#### Expected Output - -After completing this exercise, you should be able to: -- Decode and encode IEEE-754 floating-point values -- Understand that flipping one bit (sign bit) negates a float -- Patch floating-point constants in compiled binaries -- Predict how a constant change propagates through calculations - -#### Questions for Reflection - -###### Question 1: Why does changing one byte (`3d` → `bd`) negate the entire float value? What does the sign bit (bit 31) control in IEEE-754? - -###### Question 2: The scaling constant `0.1f` is used by BOTH the humidity and temperature `vfma.f32` instructions. Why does patching this single constant affect both readings? - -###### Question 3: If you wanted to change the constant to `0.5f` (`0x3f000000`, little-endian `00 00 00 3f`) instead of `-0.1f`, how would the temperature reading change? If the raw decimal part is 8, what would the new output be? - -###### Question 4: Could you achieve negative temperature by patching the `vfma.f32` instruction itself instead of the constant? What instruction might you replace it with? - -#### Tips and Hints -- IEEE-754 sign bit is the MSB (bit 31) — `0` = positive, `1` = negative -- In little-endian, the sign bit is in the **last** (highest address) byte -- Use an online IEEE-754 converter to verify your understanding -- If the output looks completely wrong (NaN, inf), you may have changed the wrong byte — start over with a fresh copy of the `.bin` file diff --git a/WEEK09/WEEK09-03-S.md b/WEEK09/WEEK09-03-S.md deleted file mode 100644 index f0fa0d1..0000000 --- a/WEEK09/WEEK09-03-S.md +++ /dev/null @@ -1,74 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Basics - -### Non-Credit Practice Exercise 3 Solution: Add a Fixed Temperature Offset - -#### Answers - -##### Two Patches Required - -This exercise requires **two** simultaneous patches to add a fixed +10°C offset to every temperature reading. - -##### Patch 1: Instruction at Offset 0x414 - -Change `vfma.f32` to `vadd.f32`: - -| Item | Original | Patched | -|------------|------------------------------|------------------------------| -| Instruction | vfma.f32 s15, s13, s11 | vadd.f32 s15, s15, s11 | -| Encoding | e6 ee a5 7a | b4 ee a5 7a | -| Operation | s15 = s15 + (s13 × s11) | s15 = s15 + s11 | - -``` -Offset 0x414: -Before: E6 EE A5 7A (vfma.f32) -After: B4 EE A5 7A (vadd.f32) -``` - -Only the first two bytes change: `E6 EE` → `B4 EE`. - -##### Patch 2: Constant at Offset 0x42C - -Change the constant from 0.1f to 10.0f: - -| Value | IEEE-754 Hex | Little-Endian Bytes | -|--------|--------------|--------------------| -| 0.1f | 0x3DCCCCCD | CD CC CC 3D | -| 10.0f | 0x41200000 | 00 00 20 41 | - -``` -Offset 0x42C: -Before: CD CC CC 3D (0.1f) -After: 00 00 20 41 (10.0f) -``` - -##### Why Both Patches Are Needed - -- **Original:** `vfma.f32` computes `temp = integer + (decimal × 0.1f)` — fractional scaling -- **After both patches:** `vadd.f32` computes `temp = integer + 10.0f` — fixed offset addition -- **If only constant changed:** `vfma.f32` would compute `temp = integer + (decimal × 10.0f)` — amplified decimal, not a fixed offset - -##### Serial Output After Patch - -``` -Humidity: 51.0%, Temperature: 34.0°C -``` - -(Original 24.0°C + 10.0°C offset = 34.0°C) - -#### Reflection Answers - -1. **Why are both patches needed? What would happen if you only changed the constant to 10.0f but left vfma unchanged?** - If you only changed `0.1f` to `10.0f` but left `vfma.f32`, the computation would be `temp = integer + (decimal × 10.0f)`. For a reading of 24.5°C (integer=24, decimal=5): result = 24 + (5 × 10.0) = 74.0°C — wildly incorrect. The `vfma` instruction multiplies two operands and adds, so the constant serves as a multiplier for the decimal part. By changing to `vadd.f32`, we eliminate the multiplication entirely and just add the constant directly to the integer, giving `24 + 10.0 = 34.0°C`. - -2. **The humidity vfma instruction at 0x410 was NOT changed. Both vfma instructions (0x410 and 0x414) load the same 0.1f constant from 0x42C. With the constant now 10.0f, what happens to the humidity computation?** - The humidity `vfma` at `0x410` now computes `hum = integer + (decimal × 10.0f)`. If the humidity decimal part is 0 (e.g., raw humidity = 51.0%), then `51 + (0 × 10.0) = 51.0%` — unchanged. But if the decimal part is non-zero (e.g., raw = 51.3%, decimal=3), the result would be `51 + (3 × 10.0) = 81.0%` — grossly incorrect. The DHT11 sensor's humidity decimal is often 0, so you might not notice the bug immediately, but it's a latent defect. - -3. **If you wanted to add a 10°C offset to temperature WITHOUT affecting humidity, what additional patch(es) would you need?** - You would need to ensure humidity still uses the original `0.1f` scaling. Options: (1) Also change the humidity `vfma` at `0x410` to `vadd.f32` and create a separate literal pool entry with `0.1f` for it — but this requires finding free space. (2) More practically, place a second copy of `0.1f` (`CD CC CC 3D`) in unused space in the binary, and redirect the humidity `vldr` instruction's PC-relative offset to point to that new location instead of `0x42C`. (3) Alternatively, NOP out the humidity `vfma` entirely if the decimal contribution is negligible. - -4. **Why do only the first 2 bytes differ between vfma and vadd? What do the last 2 bytes encode?** - In the ARM VFPv4 encoding, the first two bytes (`E6 EE` vs `B4 EE`) contain the **opcode** that distinguishes the operation type (fused multiply-add vs addition). The last two bytes (`A5 7A`) encode the **operand registers**: the source and destination VFP registers (s15, s13, s11). Since both instructions operate on the same registers, the operand encoding is identical. Only the operation code changes — this is a characteristic of the ARM instruction set where opcode and operand fields are cleanly separated. diff --git a/WEEK09/WEEK09-03.md b/WEEK09/WEEK09-03.md deleted file mode 100644 index 7060ce6..0000000 --- a/WEEK09/WEEK09-03.md +++ /dev/null @@ -1,152 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics - -### Non-Credit Practice Exercise 3: Add a Fixed Temperature Offset - -#### Objective -Patch both the `vfma.f32` instruction at file offset `0x414` and the scaling constant at `0x42C` to replace the multiply-add with a simple add of `10.0f`, causing every temperature reading to be increased by exactly 10°C, and verify on hardware. - -#### Prerequisites -- Completed Week 9 tutorial and Exercise 2 -- `0x001a_operators.elf` and `0x001a_operators.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with DHT11 sensor connected - -#### Task Description -The temperature calculation uses `vfma.f32 s15, s13, s11` which computes `s15 = s15 + (s13 × s11)` where `s11 = 0.1f`. You will make TWO patches: (1) change the `vfma.f32` instruction to `vadd.f32` so it performs addition instead of multiply-add, and (2) change the constant from `0.1f` to `10.0f`. The result: every temperature reading will have 10°C added to it. This exercise teaches ARM floating-point instruction encoding and multi-site patching. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x001a_operators.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Verify the Current Instructions - -Examine the floating-point instructions near the temperature calculation: - -```gdb -(gdb) x/4bx 0x10000414 -``` - -Output: -``` -0x10000414: 0xe6 0xee 0xa5 0x7a -``` - -This is `vfma.f32 s15, s13, s11` — the temperature fused multiply-add. - -##### Step 3: Verify the Current Constant - -```gdb -(gdb) x/wx 0x1000042c -``` - -Output: -``` -0x1000042c: 0x3dcccccd -``` - -This is `0.1f`. - -##### Step 4: Understand the Two Patches - -**Patch 1 — Instruction at offset `0x414`:** - -| Original | Bytes (LE) | New | Bytes (LE) | -| --------------------------- | --------------- | --------------------------- | --------------- | -| `vfma.f32 s15, s13, s11` | `e6 ee a5 7a` | `vadd.f32 s15, s15, s11` | `b4 ee a5 7a` | - -> 🔍 Only the first two bytes change: `e6 ee` → `b4 ee`. The operand bytes `a5 7a` stay the same. - -**Patch 2 — Constant at offset `0x42C`:** - -| Original | Hex | LE Bytes | New | Hex | LE Bytes | -| -------- | ------------ | --------------- | ----- | ------------ | --------------- | -| 0.1f | `0x3dcccccd` | `cd cc cc 3d` | 10.0f | `0x41200000` | `00 00 20 41` | - -##### Step 5: Patch the Instruction with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators\build\0x001a_operators.bin` -2. Press **Ctrl+G** and enter offset: `414` -3. You should see: `e6 ee a5 7a` -4. Change the first two bytes: `e6 ee` → `b4 ee` -5. Result should be: `b4 ee a5 7a` - -##### Step 6: Patch the Constant with HxD - -1. Press **Ctrl+G** and enter offset: `42C` -2. You should see: `cd cc cc 3d` (or `cc cc cc 3d`) -3. Replace all 4 bytes with: `00 00 20 41` - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x001a_operators-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators -python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the serial monitor:** -- All operator values remain unchanged (50, 5, 0, 0, 12, 11) -- Temperature should now read approximately **10°C higher** than the real temperature -- Humidity will also be affected (the constant is shared) - -> ⚠️ **Note:** Since the constant at `0x42C` is shared between the humidity `vfma.f32` at `0x410` and the temperature one at `0x414`, changing it to `10.0f` will also affect humidity. The humidity instruction still uses `vfma` (multiply-add), so it will compute `humidity_int + (decimal × 10.0)` — producing very large humidity values. - -#### Expected Output - -After completing this exercise, you should be able to: -- Distinguish between `vfma.f32` (multiply-add) and `vadd.f32` (add) encodings -- Perform multi-site patches in a single binary -- Understand how shared constants affect multiple code paths -- Predict the side effects of patching shared data - -#### Questions for Reflection - -###### Question 1: Why did we need to change BOTH the instruction AND the constant? What would happen if you only changed the constant to `10.0f` but left the `vfma.f32` instruction unchanged? - -###### Question 2: The humidity `vfma.f32` at offset `0x410` was NOT changed to `vadd`. With the constant now set to `10.0f`, what formula does the humidity instruction compute? If the raw humidity integer is 51 and decimal is 0, what value would it display? - -###### Question 3: If you wanted to add 10°C to temperature WITHOUT affecting humidity, you would need to change both instructions. What bytes would you write at offset `0x410` to change the humidity `vfma` to `vadd` as well, and what constant would preserve the original humidity calculation? - -###### Question 4: The `vadd.f32 s15, s15, s11` encoding is `b4 ee a5 7a`. In the original `vfma.f32 s15, s13, s11` (`e6 ee a5 7a`), why do only the first two bytes differ? What do those bytes encode? - -#### Tips and Hints -- Make BOTH patches before saving — if you only patch one, the results will be wrong -- The `vfma` → `vadd` change only affects the first two bytes of the 4-byte instruction -- `10.0f` in IEEE-754 is `0x41200000` — memorize this common value -- Always start with a fresh copy of the `.bin` file if you need to redo the exercise -- Compare the original and hacked serial output side by side to verify only temperature changed as expected diff --git a/WEEK09/WEEK09-04-S.md b/WEEK09/WEEK09-04-S.md deleted file mode 100644 index b58ca2e..0000000 --- a/WEEK09/WEEK09-04-S.md +++ /dev/null @@ -1,72 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Basics - -### Non-Credit Practice Exercise 4 Solution: Find All printf Format Strings - -#### Answers - -##### Complete String Catalog - -| # | String | Type | Used By | -|---|-----------------------------------------------------|---------------|-------------| -| 1 | `"arithmetic_operator: %d\r\n"` | Format string | printf #1 | -| 2 | `"increment_operator: %d\r\n"` | Format string | printf #2 | -| 3 | `"relational_operator: %d\r\n"` | Format string | printf #3 | -| 4 | `"logical_operator: %d\r\n"` | Format string | printf #4 | -| 5 | `"bitwise_operator: %d\r\n"` | Format string | printf #5 | -| 6 | `"assignment_operator: %d\r\n"` | Format string | printf #6 | -| 7 | `"Humidity: %.1f%%, Temperature: %.1f°C\r\n"` | Format string | printf #7 | -| 8 | `"DHT11 read failed\r\n"` | Plain string | puts | - -##### Format Specifier Analysis - -| Specifier | Meaning | Used In | -|-----------|------------------------------------------|---------------| -| `%d` | Signed decimal integer | Strings 1–6 | -| `%.1f` | Float with 1 decimal place | String 7 | -| `%%` | Literal percent sign (escaped) | String 7 | -| `\r\n` | Carriage return + line feed (0x0D 0x0A) | All strings | -| `°C` | UTF-8 degree symbol + C (0xC2 0xB0 0x43)| String 7 | - -##### Expected Operator Output Values - -| Operator | Expression | Value | Explanation | -|-----------------------|------------------------|-------|------------------------------------| -| arithmetic_operator | 5 × 10 | 50 | Multiplication | -| increment_operator | x++ (x=5) | 5 | Post-increment returns old value | -| relational_operator | 6 > 10 | 0 | False | -| logical_operator | (6>10) && (10>6) | 0 | Short-circuit: first operand false | -| bitwise_operator | 6 << 1 | 12 | Left shift = multiply by 2 | -| assignment_operator | 6 + 5 | 11 | Addition assignment | - -##### GDB Search Commands - -```gdb -(gdb) x/20s 0x10003e00 -(gdb) x/50s 0x10003d00 -``` - -##### Special Byte Sequences in Strings - -| Sequence | Bytes | Meaning | -|----------|------------|---------------------| -| `\r\n` | 0x0D 0x0A | CRLF line ending | -| `%%` | 0x25 0x25 | Literal % character | -| `°` | 0xC2 0xB0 | UTF-8 degree symbol | - -#### Reflection Answers - -1. **The humidity/temperature format string contains %%. What would happen if you patched one of the % characters to a different character (e.g., changed %% to %,)?** - The `%%` escape produces a literal `%` in the output. If you change it to `%,` (bytes `25 2C`), `printf` would interpret `%,` as the start of a format specifier where `,` is the conversion character. Since `,` is not a valid `printf` conversion specifier, the behavior is **undefined** — most implementations would either print garbage, skip it, or consume the next argument from the stack incorrectly. This could corrupt the remaining output or even crash if `printf` tries to read a non-existent argument. - -2. **If you changed "arithmetic_operator" to "hacked_operator__" (same length) in the binary, what would the serial output look like? Would the computed value change?** - The serial output would show `hacked_operator__: 50` instead of `arithmetic_operator: 50`. The **computed value (50) would not change** — it's determined by the actual multiplication instruction in the code, not by the format string. The format string is just a label for display purposes. The `%d` specifier still reads the same `r1` register value (50) passed as the second argument to `printf`. - -3. **What happens if you make a format string 1 byte longer (e.g., add a character)? Where would the extra byte be stored?** - The extra byte would overwrite the **null terminator** (`0x00`) of the current string, and the byte after that is the first byte of the next consecutive string in `.rodata`. This effectively merges the two strings: `printf` would continue reading past the intended end into the next string's data until it finds another `0x00`. The output would include garbage characters from the adjacent string. If the adjacent data happens to contain `%` followed by a valid specifier, `printf` might try to read additional arguments from the stack, potentially causing a crash or information leak. - -4. **The "DHT11 read failed" message uses puts instead of printf. Why would the compiler choose puts over printf for this particular string?** - The compiler (with optimizations enabled) recognizes that `printf("DHT11 read failed\r\n")` has **no format specifiers** — it's a plain string with no `%d`, `%s`, `%f`, etc. Since no formatting is needed, the compiler optimizes it to `puts("DHT11 read failed")` (which automatically appends a newline). This is a common GCC optimization (`-fprintf-return-value`) because `puts` is simpler and faster than `printf` — it doesn't need to parse the format string looking for specifiers. The `\r\n` may be handled slightly differently depending on the implementation, but the key insight is that the compiler automatically selects the more efficient function. diff --git a/WEEK09/WEEK09-04.md b/WEEK09/WEEK09-04.md deleted file mode 100644 index 661833d..0000000 --- a/WEEK09/WEEK09-04.md +++ /dev/null @@ -1,140 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 9 -Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics - -### Non-Credit Practice Exercise 4: Find All printf Format Strings - -#### Objective -Systematically search through the `0x001a_operators` binary using GDB and a hex editor to locate every `printf` format string, catalog their addresses, file offsets, contents, and purposes, and gain experience identifying data structures in compiled binaries. - -#### Prerequisites -- Completed Week 9 tutorial (GDB section) -- `0x001a_operators.elf` and `0x001a_operators.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) - -#### Task Description -The `0x001a_operators` program contains multiple `printf` calls, each with a format string like `"arithmetic_operator: %d\r\n"`. These strings are stored in the `.rodata` section of flash memory. You will use GDB to trace each `printf` call to its format string argument, then verify the strings in HxD. You will also search for strings that are NOT directly referenced by `printf` (like the `"DHT11 read failed"` error message). This exercise builds your ability to map out all human-readable data in a binary. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x001a_operators.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Disassemble Main to Find printf Calls - -```gdb -(gdb) x/60i 0x10000234 -``` - -Look for repeated patterns of: -``` -ldr r0, [pc, #offset] ; Load format string address -movs r1, #value ; Load the value to print -bl printf ; Call printf -``` - -Each `ldr r0` before a `bl printf` loads the format string address from the literal pool. - -##### Step 3: Examine the Literal Pool - -Find the literal pool after the loop branch (typically after the `b.n` instruction). Examine the word values: - -```gdb -(gdb) x/10wx -``` - -Each word that falls in the `0x10003xxx` range is likely a pointer to a string in `.rodata`. - -##### Step 4: Read Each Format String - -For each address found in the literal pool, use `x/s` to read the string: - -```gdb -(gdb) x/s -``` - -Document each one. You should find at least these format strings: -- `"arithmetic_operator: %d\r\n"` -- `"increment_operator: %d\r\n"` -- `"relational_operator: %d\r\n"` -- `"logical_operator: %d\r\n"` -- `"bitwise_operator: %d\r\n"` -- `"assignment_operator: %d\r\n"` -- `"Humidity: %.1f%%, Temperature: %.1f°C\r\n"` -- `"DHT11 read failed"` - -##### Step 5: Build a String Catalog - -Fill in a table like this (addresses will vary — use the ones you find): - -| Address | File Offset | String Content | Used By | -| -------------- | ----------- | --------------------------------------- | ----------- | -| `0x10003xxx` | `0x3xxx` | `"arithmetic_operator: %d\r\n"` | printf #1 | -| `0x10003xxx` | `0x3xxx` | `"increment_operator: %d\r\n"` | printf #2 | -| `0x10003xxx` | `0x3xxx` | `"relational_operator: %d\r\n"` | printf #3 | -| `0x10003xxx` | `0x3xxx` | `"logical_operator: %d\r\n"` | printf #4 | -| `0x10003xxx` | `0x3xxx` | `"bitwise_operator: %d\r\n"` | printf #5 | -| `0x10003xxx` | `0x3xxx` | `"assignment_operator: %d\r\n"` | printf #6 | -| `0x10003xxx` | `0x3xxx` | `"Humidity: %.1f%%, Temperature: %.1f°C\r\n"` | printf #7 | -| `0x10003xxx` | `0x3xxx` | `"DHT11 read failed"` | puts | - -##### Step 6: Verify in HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators\build\0x001a_operators.bin` -2. For each string, press **Ctrl+G** and enter the file offset -3. Verify you can read the ASCII text in the right panel -4. Note how the strings are stored consecutively in memory, each terminated by `0x00` - -##### Step 7: Search for Hidden Strings - -Scroll through the `.rodata` region in HxD (typically starting around offset `0x3000`+) and look for any ASCII text in the right panel that you didn't find via `printf` calls. Library functions may have their own strings. - -#### Expected Output - -After completing this exercise, you should be able to: -- Trace `printf` calls to their format string arguments using GDB -- Read string addresses from literal pools -- Build a complete catalog of strings in a binary -- Navigate to specific offsets in a hex editor to verify string data - -#### Questions for Reflection - -###### Question 1: The format string `"Humidity: %.1f%%, Temperature: %.1f°C\r\n"` uses `%%` to print a literal percent sign. What would happen if you patched one of the `%` characters to a space (`0x20`)? - -###### Question 2: If you patched the string `"arithmetic_operator: %d\r\n"` to `"HACKED_OPERATOR!: %d\r\n"` (same length, 27 characters + null), what would the serial output show? Would the actual computed value change? - -###### Question 3: The strings are stored consecutively in `.rodata`. If you made `"arithmetic_operator: %d\r\n"` one byte longer, which string would be corrupted and how? - -###### Question 4: Why does the compiler use `puts` instead of `printf` for `"DHT11 read failed"`? What's the difference between the two functions for strings with no format specifiers? - -#### Tips and Hints -- Format strings always start with a printable ASCII character — look for bytes in the `0x20`-`0x7E` range -- The `\r\n` at the end of format strings shows up as bytes `0x0D 0x0A` -- Use HxD's **Search** → **Find** (Ctrl+F) with "Text string" mode to search for known text like "arithmetic" -- Strings in `.rodata` are typically 4-byte aligned, so there may be padding bytes (`0x00`) between them -- The `°` character in "°C" is a multi-byte UTF-8 sequence (`0xC2 0xB0`), not a single byte diff --git a/WEEK09/WEEK09.md b/WEEK09/WEEK09.md index 37b2550..9b32a2a 100644 --- a/WEEK09/WEEK09.md +++ b/WEEK09/WEEK09.md @@ -1,6 +1,6 @@ -# Week 9: Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics. +?# Week 9: Operators in Embedded Systems: Debugging and Hacking Operators w/ DHT11 Temperature & Humidity Sensor Single-Wire Protocol Basics. -## 🎯 What You'll Learn This Week +## ? What You'll Learn This Week By the end of this tutorial, you will be able to: - Understand all six types of C operators (arithmetic, increment, relational, logical, bitwise, assignment) @@ -13,7 +13,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 1: Understanding C Operators +## Part 1: Understanding C Operators ### What Are Operators? @@ -32,7 +32,7 @@ By the end of this tutorial, you will be able to: --- -## 📚 Part 2: Arithmetic Operators +## Part 2: Arithmetic Operators ### Basic Math in C @@ -45,23 +45,23 @@ int result = x * y; // result = 50 ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Arithmetic Operators │ -│ │ -│ Operator Example Result Description │ -│ ───────────────────────────────────────────────────────────── │ -│ + 5 + 10 15 Addition │ -│ - 10 - 5 5 Subtraction │ -│ * 5 * 10 50 Multiplication │ -│ / 10 / 5 2 Division │ -│ % 10 % 3 1 Modulus (remainder) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Arithmetic Operators | +| | +| Operator Example Result Description | +| ------------------------------------------------------------- | +| + 5 + 10 15 Addition | +| - 10 - 5 5 Subtraction | +| * 5 * 10 50 Multiplication | +| / 10 / 5 2 Division | +| % 10 % 3 1 Modulus (remainder) | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 3: Increment and Decrement Operators +## Part 3: Increment and Decrement Operators ### Pre-Increment vs Post-Increment @@ -77,29 +77,29 @@ int b = ++x; // Pre-increment: x becomes 7, then b = 7 | Type | Syntax | When Value Changes | Example Result | | ------------------ | ------ | --------------------- | -------------------- | -| **Post-increment** | `x++` | AFTER the expression | `a = x++` → a=5, x=6 | -| **Pre-increment** | `++x` | BEFORE the expression | `b = ++x` → x=7, b=7 | +| **Post-increment** | `x++` | AFTER the expression | `a = x++` -> a=5, x=6 | +| **Pre-increment** | `++x` | BEFORE the expression | `b = ++x` -> x=7, b=7 | ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Post-Increment (x++) │ -│ │ -│ int x = 5; │ -│ int result = x++; │ -│ │ -│ Step 1: result = x (result gets 5) │ -│ Step 2: x = x + 1 (x becomes 6) │ -│ │ -│ Final: result = 5, x = 6 │ -│ │ -│ Think of it as: "Use first, THEN increment" │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Post-Increment (x++) | +| | +| int x = 5; | +| int result = x++; | +| | +| Step 1: result = x (result gets 5) | +| Step 2: x = x + 1 (x becomes 6) | +| | +| Final: result = 5, x = 6 | +| | +| Think of it as: "Use first, THEN increment" | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 4: Relational Operators +## Part 4: Relational Operators ### Comparing Values @@ -112,24 +112,24 @@ bool result = (x > y); // false, because 6 is NOT greater than 10 ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Relational Operators │ -│ │ -│ Operator Example Result Description │ -│ ───────────────────────────────────────────────────────────── │ -│ > 6 > 10 false Greater than │ -│ < 6 < 10 true Less than │ -│ >= 6 >= 6 true Greater than or equal │ -│ <= 6 <= 10 true Less than or equal │ -│ == 6 == 10 false Equal to │ -│ != 6 != 10 true Not equal to │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Relational Operators | +| | +| Operator Example Result Description | +| ------------------------------------------------------------- | +| > 6 > 10 false Greater than | +| < 6 < 10 true Less than | +| >= 6 >= 6 true Greater than or equal | +| <= 6 <= 10 true Less than or equal | +| == 6 == 10 false Equal to | +| != 6 != 10 true Not equal to | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 5: Logical Operators +## Part 5: Logical Operators ### Combining Conditions @@ -142,33 +142,33 @@ bool result = (x > y) && (y > x); // false AND true = false ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Logical Operators │ -│ │ -│ Operator Name Example Result │ -│ ───────────────────────────────────────────────────────────── │ -│ && AND true && true true │ -│ && AND true && false false │ -│ || OR true || false true │ -│ || OR false || false false │ -│ ! NOT !true false │ -│ │ -│ Truth Table for AND (&&): │ -│ ┌───────┬───────┬────────┐ │ -│ │ A │ B │ A && B │ │ -│ ├───────┼───────┼────────┤ │ -│ │ false │ false │ false │ │ -│ │ false │ true │ false │ │ -│ │ true │ false │ false │ │ -│ │ true │ true │ true │ │ -│ └───────┴───────┴────────┘ │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Logical Operators | +| | +| Operator Name Example Result | +| ------------------------------------------------------------- | +| && AND true && true true | +| && AND true && false false | +| || OR true || false true | +| || OR false || false false | +| ! NOT !true false | +| | +| Truth Table for AND (&&): | +| +-------+-------+--------+ | +| | A | B | A && B | | +| +-------+-------+--------+ | +| | false | false | false | | +| | false | true | false | | +| | true | false | false | | +| | true | true | true | | +| +-------+-------+--------+ | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 6: Bitwise Operators +## Part 6: Bitwise Operators ### Manipulating Individual Bits @@ -180,21 +180,21 @@ int result = x << 1; // Shift left by 1: 0b00001100 = 12 ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Bitwise Left Shift (<<) │ -│ │ -│ x = 6 = 0b00000110 │ -│ │ -│ x << 1 means "shift all bits LEFT by 1 position" │ -│ │ -│ Before: 0 0 0 0 0 1 1 0 (6) │ -│ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ │ -│ After: 0 0 0 0 1 1 0 0 (12) │ -│ │ -│ Each left shift DOUBLES the value! │ -│ 6 << 1 = 12 (same as 6 * 2) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Bitwise Left Shift (<<) | +| | +| x = 6 = 0b00000110 | +| | +| x << 1 means "shift all bits LEFT by 1 position" | +| | +| Before: 0 0 0 0 0 1 1 0 (6) | +| ? ? ? ? ? ? ? ? | +| After: 0 0 0 0 1 1 0 0 (12) | +| | +| Each left shift DOUBLES the value! | +| 6 << 1 = 12 (same as 6 * 2) | +| | ++-----------------------------------------------------------------+ ``` **Common Bitwise Operators:** @@ -210,7 +210,7 @@ int result = x << 1; // Shift left by 1: 0b00001100 = 12 --- -## 📚 Part 7: Assignment Operators +## Part 7: Assignment Operators ### Shorthand for Math + Assign @@ -222,69 +222,69 @@ x += 5; // Same as: x = x + 5; Result: x = 11 ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Compound Assignment Operators │ -│ │ -│ Operator Example Equivalent To Result (if x=6) │ -│ ───────────────────────────────────────────────────────────── │ -│ += x += 5 x = x + 5 x = 11 │ -│ -= x -= 2 x = x - 2 x = 4 │ -│ *= x *= 3 x = x * 3 x = 18 │ -│ /= x /= 2 x = x / 2 x = 3 │ -│ %= x %= 4 x = x % 4 x = 2 │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Compound Assignment Operators | +| | +| Operator Example Equivalent To Result (if x=6) | +| ------------------------------------------------------------- | +| += x += 5 x = x + 5 x = 11 | +| -= x -= 2 x = x - 2 x = 4 | +| *= x *= 3 x = x * 3 x = 18 | +| /= x /= 2 x = x / 2 x = 3 | +| %= x %= 4 x = x % 4 x = 2 | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 8: Understanding the DHT11 Sensor +## Part 8: Understanding the DHT11 Sensor ### What is the DHT11? The **DHT11** is a low-cost digital temperature and humidity sensor. It uses a single wire for communication (plus power and ground). ``` -┌─────────────────────────────────────────────────────────────────┐ -│ DHT11 Pinout │ -│ │ -│ ┌─────────────┐ │ -│ │ DHT11 │ │ -│ │ ┌─────┐ │ │ -│ │ │ │ │ │ -│ │ │ │ │ │ -│ │ └─────┘ │ │ -│ │ 1 2 3 4 │ │ -│ └──┬──┬──┬──┬─┘ │ -│ │ │ │ │ │ -│ VCC DATA NC GND │ -│ │ -│ Pin 1: VCC (3.3V or 5V) │ -│ Pin 2: DATA (connect to GPIO) │ -│ Pin 3: Not Connected │ -│ Pin 4: GND (Ground) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| DHT11 Pinout | +| | +| +-------------+ | +| | DHT11 | | +| | +-----+ | | +| | | | | | +| | | | | | +| | +-----+ | | +| | 1 2 3 4 | | +| +--+--+--+--+-+ | +| | | | | | +| VCC DATA NC GND | +| | +| Pin 1: VCC (3.3V or 5V) | +| Pin 2: DATA (connect to GPIO) | +| Pin 3: Not Connected | +| Pin 4: GND (Ground) | +| | ++-----------------------------------------------------------------+ ``` ### DHT11 Specifications | Parameter | Range | Accuracy | | --------------- | ------------ | -------- | -| **Humidity** | 20% - 90% RH | ±5% RH | -| **Temperature** | 0°C - 50°C | ±2°C | +| **Humidity** | 20% - 90% RH | ?5% RH | +| **Temperature** | 0 deg C - 50 deg C | ?2 deg C | ### How DHT11 Communication Works The DHT11 uses a custom one-wire protocol: 1. **Host sends start signal** - Pull data line LOW for 18ms -2. **DHT11 responds** - Pulls line LOW for 80µs, then HIGH for 80µs +2. **DHT11 responds** - Pulls line LOW for 80 us, then HIGH for 80 us 3. **Data transmission** - 40 bits sent (8 humidity int, 8 humidity decimal, 8 temp int, 8 temp decimal, 8 checksum) --- -## 📚 Part 9: Understanding Pointers (Quick Review) +## Part 9: Understanding Pointers (Quick Review) ### The & Operator (Address-Of) @@ -295,32 +295,32 @@ float hum, temp; // Pass ADDRESSES to the function so it can modify our variables if (dht11_read(&hum, &temp)) { - printf("Humidity: %.1f%%, Temperature: %.1f°C\n", hum, temp); + printf("Humidity: %.1f%%, Temperature: %.1f?C\n", hum, temp); } ``` ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Passing by Reference │ -│ │ -│ Stack Memory │ -│ ┌────────────────────────────┐ │ -│ │ Address 0x20000008: hum │◄─── &hum (passed to function) │ -│ │ Value: 51.0 │ │ -│ ├────────────────────────────┤ │ -│ │ Address 0x2000000C: temp │◄─── &temp (passed to function) │ -│ │ Value: 23.8 │ │ -│ └────────────────────────────┘ │ -│ │ -│ dht11_read() receives the ADDRESSES, so it can write │ -│ new values directly into hum and temp! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Passing by Reference | +| | +| Stack Memory | +| +----------------------------+ | +| | Address 0x20000008: hum |?--- &hum (passed to function) | +| | Value: 51.0 | | +| +----------------------------+ | +| | Address 0x2000000C: temp |?--- &temp (passed to function) | +| | Value: 23.8 | | +| +----------------------------+ | +| | +| dht11_read() receives the ADDRESSES, so it can write | +| new values directly into hum and temp! | +| | ++-----------------------------------------------------------------+ ``` --- -## 📚 Part 10: Setting Up Your Environment +## Part 10: Setting Up Your Environment ### Prerequisites @@ -344,43 +344,43 @@ Connect your DHT11 like this: | GND | GND | ``` -┌─────────────────────────────────────────────────────────────────┐ -│ DHT11 Wiring │ -│ │ -│ Pico 2 DHT11 Sensor │ -│ ┌──────────┐ ┌──────────┐ │ -│ │ │ │ │ │ -│ │ GPIO 4 │────────── DATA ──────►│ DATA │ │ -│ │ │ │ │ │ -│ │ 3.3V │────────── VCC ───────►│ VCC │ │ -│ │ │ │ │ │ -│ │ GND │────────── GND ───────►│ GND │ │ -│ │ │ │ │ │ -│ └──────────┘ └──────────┘ │ -│ │ -│ Note: Some DHT11 modules have a built-in pull-up resistor. │ -│ If yours doesn't, add a 10K resistor between DATA and VCC. │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| DHT11 Wiring | +| | +| Pico 2 DHT11 Sensor | +| +----------+ +----------+ | +| | | | | | +| | GPIO 4 |---------- DATA ------?| DATA | | +| | | | | | +| | 3.3V |---------- VCC -------?| VCC | | +| | | | | | +| | GND |---------- GND -------?| GND | | +| | | | | | +| +----------+ +----------+ | +| | +| Note: Some DHT11 modules have a built-in pull-up resistor. | +| If yours doesn't, add a 10K resistor between DATA and VCC. | +| | ++-----------------------------------------------------------------+ ``` ### Project Structure ``` Embedded-Hacking/ -├── 0x001a_operators/ -│ ├── build/ -│ │ ├── 0x001a_operators.uf2 -│ │ └── 0x001a_operators.bin -│ ├── main/ -│ │ └── 0x001a_operators.c -│ └── dht11.h -└── uf2conv.py ++-- 0x001a_operators/ +| +-- build/ +| | +-- 0x001a_operators.uf2 +| | +-- 0x001a_operators.bin +| +-- main/ +| | +-- 0x001a_operators.c +| +-- dht11.h ++-- uf2conv.py ``` --- -## 🔬 Part 11: Hands-On Tutorial - The Operators Code +## ? Part 11: Hands-On Tutorial - The Operators Code ### Step 1: Review the Source Code @@ -417,7 +417,7 @@ int main(void) { float hum, temp; if (dht11_read(&hum, &temp)) { - printf("Humidity: %.1f%%, Temperature: %.1f°C\r\n", hum, temp); + printf("Humidity: %.1f%%, Temperature: %.1f?C\r\n", hum, temp); } else { printf("DHT11 read failed\r\n"); } @@ -432,20 +432,20 @@ int main(void) { Let's trace through what happens to `x`: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Variable x Through the Program │ -│ │ -│ Line │ x value │ Result │ -│ ──────────────────┼─────────┼───────────────────────────────── │ -│ int x = 5; │ 5 │ x initialized to 5 │ -│ x * y │ 5 │ arithmetic = 5 * 10 = 50 │ -│ x++ │ 5→6 │ increment = 5 (then x becomes 6) │ -│ x > y │ 6 │ relational = (6 > 10) = false │ -│ (x>y) && (y>x) │ 6 │ logical = false && true = false │ -│ x << 1 │ 6 │ bitwise = 6 << 1 = 12 │ -│ x += 5 │ 6→11 │ assignment = 6 + 5 = 11 │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Variable x Through the Program | +| | +| Line | x value | Result | +| ------------------+---------+--------------------------------- | +| int x = 5; | 5 | x initialized to 5 | +| x * y | 5 | arithmetic = 5 * 10 = 50 | +| x++ | 5->6 | increment = 5 (then x becomes 6) | +| x > y | 6 | relational = (6 > 10) = false | +| (x>y) && (y>x) | 6 | logical = false && true = false | +| x << 1 | 6 | bitwise = 6 << 1 = 12 | +| x += 5 | 6->11 | assignment = 6 + 5 = 11 | +| | ++-----------------------------------------------------------------+ ``` ### Step 3: Flash the Binary to Your Pico 2 @@ -467,25 +467,25 @@ relational_operator: 0 logical_operator: 0 bitwise_operator: 12 assignment_operator: 11 -Humidity: 51.0%, Temperature: 23.8°C +Humidity: 51.0%, Temperature: 23.8 deg C ``` **Understanding the Output:** | Variable | Value | Explanation | | ------------------- | ------ | --------------------------------------------- | -| arithmetic_operator | 50 | 5 × 10 = 50 | +| arithmetic_operator | 50 | 5 * 10 = 50 | | increment_operator | 5 | Post-increment returns value BEFORE increment | | relational_operator | 0 | 6 > 10 is false (0) | | logical_operator | 0 | false AND true = false (0) | | bitwise_operator | 12 | 6 (0b0110) << 1 = 12 (0b1100) | | assignment_operator | 11 | 6 + 5 = 11 | | Humidity | 51.0% | Real reading from DHT11 | -| Temperature | 23.8°C | Real reading from DHT11 | +| Temperature | 23.8 deg C | Real reading from DHT11 | --- -## 🔬 Part 12: Debugging with GDB +## ? Part 12: Debugging with GDB ### Step 5: Start OpenOCD (Terminal 1) @@ -493,7 +493,7 @@ Open a terminal and start OpenOCD: ```powershell openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ + -s "C:\Users\assem.KEVINTHOMAS\.pico-sdk\openocd\0.12.0+dev\scripts" ^ -f interface/cmsis-dap.cfg ^ -f target/rp2350.cfg ^ -c "adapter speed 5000" @@ -640,7 +640,7 @@ The program will loop, printing values to serial. --- -## 🔬 Part 13: Setting Up Ghidra for Analysis +## ? Part 13: Setting Up Ghidra for Analysis ### Step 17: Start Ghidra @@ -652,7 +652,7 @@ ghidraRun ### Step 18: Create a New Project -1. Click **File** → **New Project** +1. Click **File** -> **New Project** 2. Select **Non-Shared Project** 3. Click **Next** 4. Enter Project Name: `0x001a_operators` @@ -666,12 +666,12 @@ ghidraRun ### Step 20: Configure the Binary Format -**Click the three dots (…) next to "Language" and:** +**Click the three dots (...) next to "Language" and:** 1. Search for "Cortex" 2. Select **ARM Cortex 32 little endian default** 3. Click **OK** -**Click the "Options…" button and:** +**Click the "Options..." button and:** 1. Change **Block Name** to `.text` 2. Change **Base Address** to `10000000` 3. Click **OK** @@ -686,25 +686,25 @@ Wait for analysis to complete. --- -## 🔬 Part 14: Finding the Reset_Handler +## ? Part 14: Finding the Reset_Handler ### Step 22: Understand the Vector Table In ARM Cortex-M, the **vector table** is at the base of flash (0x10000000). The second entry (offset 4) contains the Reset_Handler address. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ ARM Vector Table at 0x10000000 │ -│ │ -│ Offset Contents Description │ -│ ───────────────────────────────────────────────────────────── │ -│ 0x00 Initial SP value Stack pointer at reset │ -│ 0x04 Reset_Handler addr First code to execute │ -│ 0x08 NMI_Handler addr Non-maskable interrupt │ -│ 0x0C HardFault_Handler Hard fault handler │ -│ ... │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| ARM Vector Table at 0x10000000 | +| | +| Offset Contents Description | +| ------------------------------------------------------------- | +| 0x00 Initial SP value Stack pointer at reset | +| 0x04 Reset_Handler addr First code to execute | +| 0x08 NMI_Handler addr Non-maskable interrupt | +| 0x0C HardFault_Handler Hard fault handler | +| ... | +| | ++-----------------------------------------------------------------+ ``` ### Step 23: Read the Reset_Handler Address @@ -715,18 +715,18 @@ In ARM Cortex-M, the **vector table** is at the base of flash (0x10000000). The **Important:** This is **little-endian**, so we need to reverse the byte order! ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Little-Endian Byte Order │ -│ │ -│ In memory: 5d 01 00 10 │ -│ Reversed: 10 00 01 5d │ -│ As hex: 0x1000015d │ -│ │ -│ But wait! ARM uses the THUMB bit! │ -│ The lowest bit indicates Thumb mode (always set for Cortex-M) │ -│ Real address: 0x1000015d - 1 = 0x1000015c │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Little-Endian Byte Order | +| | +| In memory: 5d 01 00 10 | +| Reversed: 10 00 01 5d | +| As hex: 0x1000015d | +| | +| But wait! ARM uses the THUMB bit! | +| The lowest bit indicates Thumb mode (always set for Cortex-M) | +| Real address: 0x1000015d - 1 = 0x1000015c | +| | ++-----------------------------------------------------------------+ ``` ### Step 24: Navigate to Reset_Handler @@ -740,7 +740,7 @@ If Ghidra didn't automatically recognize this as a function: 1. Click on the address `0x1000015c` 2. Right-click and press `F` to create a function -3. Right-click → **Edit Function Signature** +3. Right-click -> **Edit Function Signature** 4. Change the name to `Reset_Handler` 5. Click **OK** @@ -749,17 +749,17 @@ If Ghidra didn't automatically recognize this as a function: The Reset_Handler typically calls three functions: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Reset_Handler Flow (crt0.S) │ -│ │ -│ Reset_Handler: │ -│ 1. Call some_init() ◄── Initialize hardware │ -│ 2. Call main() ◄── THIS IS WHAT WE WANT! │ -│ 3. Call exit() ◄── Never returns │ -│ │ -│ The MIDDLE function is main! │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Reset_Handler Flow (crt0.S) | +| | +| Reset_Handler: | +| 1. Call some_init() ?-- Initialize hardware | +| 2. Call main() ?-- THIS IS WHAT WE WANT! | +| 3. Call exit() ?-- Never returns | +| | +| The MIDDLE function is main! | +| | ++-----------------------------------------------------------------+ ``` Look at the end of Reset_Handler for three function calls. The middle one is `main`! @@ -767,13 +767,13 @@ Look at the end of Reset_Handler for three function calls. The middle one is `ma ### Step 27: Navigate to Main 1. Double-click on the middle function call (should be around `0x10000234`) -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `int main(void)` 4. Click **OK** --- -## 🔬 Part 15: Resolving Functions in Ghidra +## ? Part 15: Resolving Functions in Ghidra ### Step 28: Resolve stdio_init_all @@ -781,7 +781,7 @@ The first function call in main is `stdio_init_all`: 1. Find the call at approximately `0x10000238` 2. Double-click to navigate to the function -3. Right-click → **Edit Function Signature** +3. Right-click -> **Edit Function Signature** 4. Change to: `bool stdio_init_all(void)` 5. Click **OK** @@ -798,7 +798,7 @@ bl FUN_xxxxx ; dht11_init - The argument `4` is the GPIO pin number - We physically connected the DHT11 to GPIO 4! -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void dht11_init(uint pin)` 3. Click **OK** @@ -807,7 +807,7 @@ bl FUN_xxxxx ; dht11_init Look for repeated function calls with string addresses: 1. Find a call like the one at `0x10000262` -2. Right-click → **Edit Function Signature** +2. Right-click -> **Edit Function Signature** 3. Change to: `int printf(char *format, ...)` 4. Check the **Varargs** checkbox 5. Click **OK** @@ -821,7 +821,7 @@ ldr r0, =0x7d0 ; 2000 milliseconds bl FUN_xxxxx ; sleep_ms ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `void sleep_ms(uint ms)` 3. Click **OK** @@ -840,7 +840,7 @@ bl FUN_xxxxx ; dht11_read - `sp + 0xc` = address of `temp` variable - These are `float` pointers passed to the function -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `bool dht11_read(float *humidity, float *temperature)` 3. Click **OK** @@ -853,32 +853,32 @@ ldr r0, ="DHT11 read failed" bl FUN_xxxxx ; puts ``` -1. Right-click → **Edit Function Signature** +1. Right-click -> **Edit Function Signature** 2. Change to: `int puts(char *s)` 3. Click **OK** --- -## 🔬 Part 16: Understanding IEEE-754 Floating-Point +## ? Part 16: Understanding IEEE-754 Floating-Point ### What is IEEE-754? IEEE-754 is the standard for representing decimal numbers in binary. A 32-bit float is divided into three parts: ``` -┌─────────────────────────────────────────────────────────────────┐ -│ IEEE-754 Single Precision (32-bit) Float │ -│ │ -│ ┌─────┬─────────────┬───────────────────────────────────────┐ │ -│ │ S │ Exponent │ Mantissa (Fraction) │ │ -│ │ 1 │ 8 bits │ 23 bits │ │ -│ └─────┴─────────────┴───────────────────────────────────────┘ │ -│ bit bits bits │ -│ 31 30-23 22-0 │ -│ │ -│ Value = (-1)^S × (1 + Mantissa) × 2^(Exponent - 127) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| IEEE-754 Single Precision (32-bit) Float | +| | +| +-----+-------------+---------------------------------------+ | +| | S | Exponent | Mantissa (Fraction) | | +| | 1 | 8 bits | 23 bits | | +| +-----+-------------+---------------------------------------+ | +| bit bits bits | +| 31 30-23 22-0 | +| | +| Value = (-1)^S * (1 + Mantissa) * 2^(Exponent - 127) | +| | ++-----------------------------------------------------------------+ ``` ### Example: Decoding 0x3dcccccc (0.1f) @@ -895,7 +895,7 @@ Let's decode the bytes `cc cc cc 3d`: 4. **Calculate value:** - Actual exponent: 123 - 127 = -4 - Mantissa value: 1.6 (approximately) - - Final value: 1.6 × 2^(-4) ≈ 0.1 + - Final value: 1.6 * 2^(-4) ? 0.1 ### Example: Encoding -1.0f as 0xbf800000 @@ -927,7 +927,7 @@ print(f"Bytes: {encoded.hex()}") # 0000 80bf --- -## 🔬 Part 17: Finding the Temperature Hack Point +## ? Part 17: Finding the Temperature Hack Point ### Step 34: Locate the dht11_read Function @@ -945,19 +945,19 @@ vfma.f32 s15, s13, s11 ; Fused multiply-add for temperature The constant `0.1` (at address `0x1000042c`) is loaded into register `s11` and used to scale the raw sensor readings. ``` -┌─────────────────────────────────────────────────────────────────┐ -│ DHT11 Scaling Calculation │ -│ │ -│ Raw sensor data: integer + decimal parts │ -│ Example: 238 (integer=23, decimal=8) │ -│ │ -│ Formula: result = integer + (decimal × 0.1) │ -│ 23.8 = 23 + (8 × 0.1) │ -│ │ -│ The vfma.f32 instruction does: s15 = s13 + (s11 × something) │ -│ Where s11 = 0.1f (our target!) │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| DHT11 Scaling Calculation | +| | +| Raw sensor data: integer + decimal parts | +| Example: 238 (integer=23, decimal=8) | +| | +| Formula: result = integer + (decimal * 0.1) | +| 23.8 = 23 + (8 * 0.1) | +| | +| The vfma.f32 instruction does: s15 = s13 + (s11 * something) | +| Where s11 = 0.1f (our target!) | +| | ++-----------------------------------------------------------------+ ``` ### Step 36: Identify Key Offsets @@ -972,11 +972,11 @@ Make note of these offsets in the binary file: --- -## 🔬 Part 18: Manual Hacking in Ghidra +## ? Part 18: Manual Hacking in Ghidra ### Step 37: Open the Bytes Editor -1. Click **Window** → **Bytes** +1. Click **Window** -> **Bytes** 2. A new panel appears showing raw hex bytes ### Step 38: Enable Editing @@ -1011,11 +1011,11 @@ print(f"New: {new}") # 5.0 --- -## 🔬 Part 19: Exporting and Testing +## ? Part 19: Exporting and Testing ### Step 41: Export the Patched Binary -1. Click **File** → **Export Program** +1. Click **File** -> **Export Program** 2. Set **Format** to **Binary** 3. Navigate to your build directory 4. Name the file `0x001a_operators-h.bin` @@ -1026,7 +1026,7 @@ print(f"New: {new}") # 5.0 Open a terminal and run: ```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x001a_operators +cd C:\Users\assem.KEVINTHOMAS\OneDrive\Documents\Embedded-Hacking\0x001a_operators python ..\uf2conv.py build\0x001a_operators-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 ``` @@ -1040,7 +1040,7 @@ You should see dramatically increased temperature readings! --- -## 📊 Part 20: Summary and Review +## ? Part 20: Summary and Review ### What We Accomplished @@ -1055,18 +1055,18 @@ You should see dramatically increased temperature readings! ### The Hacking Workflow ``` -┌─────────────────────────────────────────────────────────────────┐ -│ Binary Hacking Workflow │ -│ │ -│ 1. Analyze the binary in Ghidra │ -│ 2. Identify target values/instructions │ -│ 3. Calculate file offsets from memory addresses │ -│ 4. Determine replacement bytes │ -│ 5. Patch the binary (manual in hex editor) │ -│ 6. Export and convert to UF2 │ -│ 7. Flash and test │ -│ │ -└─────────────────────────────────────────────────────────────────┘ ++-----------------------------------------------------------------+ +| Binary Hacking Workflow | +| | +| 1. Analyze the binary in Ghidra | +| 2. Identify target values/instructions | +| 3. Calculate file offsets from memory addresses | +| 4. Determine replacement bytes | +| 5. Patch the binary (manual in hex editor) | +| 6. Export and convert to UF2 | +| 7. Flash and test | +| | ++-----------------------------------------------------------------+ ``` ### Key Memory Addresses @@ -1082,34 +1082,9 @@ You should see dramatically increased temperature readings! --- -## ✅ Practice Exercises - -### Exercise 1: Change the Sleep Duration -Find the `sleep_ms(2000)` call and change it to 5000ms (5 seconds). - -**Hint:** Look for `0x7d0` (2000) being loaded into r0. - -### Exercise 2: Invert Temperature Reading -Using HxD, change the scaling constant at offset `0x42C` to make temperature readings negative. - -**Hint:** Encode -0.1f as IEEE-754 and write those bytes. - -### Exercise 3: Add a Fixed Offset -Using HxD, patch the instruction at offset `0x414` and the constant at `0x42C` to add exactly 10°C to every reading. - -**Hint:** Change vfma to vadd and set the pool constant to 10.0f (`00 00 20 41`). - -### Exercise 4: Find All printf Strings -Search the binary for all format strings like "%d" and "%.1f". - -**Hint:** Use GDB's `x/s` command to search flash memory, or scan in HxD's ASCII panel. - -### Exercise 5: Trace the Variable Flow -In Ghidra, trace how x changes through each operator. Match your findings to the output values. - --- -## 🎓 Key Takeaways +## ? Key Takeaways 1. **Post-increment returns the OLD value** - `x++` gives you x, THEN adds 1 @@ -1121,7 +1096,7 @@ In Ghidra, trace how x changes through each operator. Match your findings to the 5. **IEEE-754 is how floats are stored** - Sign, exponent, mantissa -6. **File offset = Memory address - Base** - 0x10000410 → offset 0x410 +6. **File offset = Memory address - Base** - 0x10000410 -> offset 0x410 7. **Little-endian reverses byte order** - 0x3dcccccc stored as cc cc cc 3d @@ -1131,7 +1106,7 @@ In Ghidra, trace how x changes through each operator. Match your findings to the --- -## 📖 Glossary +## ? Glossary | Term | Definition | | ------------------ | --------------------------------------------------- | @@ -1156,7 +1131,7 @@ In Ghidra, trace how x changes through each operator. Match your findings to the --- -## 🔗 Additional Resources +## ? Additional Resources ### IEEE-754 Float Quick Reference @@ -1174,16 +1149,16 @@ In Ghidra, trace how x changes through each operator. Match your findings to the | Instruction | Description | | --------------------- | ---------------------------------------- | -| `vfma.f32 Sd, Sn, Sm` | Sd = Sd + (Sn × Sm) (fused multiply-add) | +| `vfma.f32 Sd, Sn, Sm` | Sd = Sd + (Sn * Sm) (fused multiply-add) | | `vadd.f32 Sd, Sn, Sm` | Sd = Sn + Sm | | `vsub.f32 Sd, Sn, Sm` | Sd = Sn - Sm | -| `vmul.f32 Sd, Sn, Sm` | Sd = Sn × Sm | +| `vmul.f32 Sd, Sn, Sm` | Sd = Sn * Sm | | `vldr.f32 Sd, [addr]` | Load float from memory | | `vstr.f32 Sd, [addr]` | Store float to memory | --- -## 🚨 Real-World Implications +## ? Real-World Implications ### Why This Matters @@ -1210,4 +1185,6 @@ By manipulating sensor readings, an attacker could: **Remember:** The techniques you learned today can be used for good (security research, debugging) or bad (sabotage, fraud). Always use your skills ethically and legally. Understanding how attacks work helps us build more secure systems! -Happy hacking! 🔧 +Happy hacking! ? + + diff --git a/WEEK10/WEEK10-01-S.md b/WEEK10/WEEK10-01-S.md deleted file mode 100644 index 25d7eba..0000000 --- a/WEEK10/WEEK10-01-S.md +++ /dev/null @@ -1,57 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Dynamic Conditionals in Embedded Systems: Debugging and Hacking Dynamic Conditionals w/ SG90 Servo Basics - -### Non-Credit Practice Exercise 1 Solution: Change Servo Angle Range - -#### Answers - -##### IEEE-754 Angle Encodings - -| Angle | IEEE-754 Hex | Little-Endian Bytes | Sign | Exponent | Mantissa | -|--------|--------------|--------------------|----- |----------|-----------| -| 0.0f | 0x00000000 | 00 00 00 00 | 0 | 0 | 0 | -| 45.0f | 0x42340000 | 00 00 34 42 | 0 | 132 | 0x340000 | -| 135.0f | 0x43070000 | 00 00 07 43 | 0 | 134 | 0x070000 | -| 180.0f | 0x43340000 | 00 00 34 43 | 0 | 134 | 0x340000 | - -##### Patch 1: Maximum Angle 180.0f → 135.0f - -``` -Before: 00 00 34 43 (180.0f) -After: 00 00 07 43 (135.0f) -``` - -##### Patch 2: Minimum Angle 0.0f → 45.0f - -``` -Before: 00 00 00 00 (0.0f) -After: 00 00 34 42 (45.0f) -``` - -##### Result - -Servo sweeps from **45° to 135°** instead of 0° to 180°, a 90° range centered at the midpoint. - -##### Conversion and Flash - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals -python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -#### Reflection Answers - -1. **Break down the IEEE-754 encoding of 180.0f (0x43340000). What are the sign bit, exponent, and mantissa fields?** - `0x43340000` in binary: `0 10000110 01101000000000000000000`. **Sign** = 0 (positive). **Exponent** = `10000110` = 134, biased exponent = 134 - 127 = 7. **Mantissa** = `0x340000` = `01101000...0`, representing 1.01101₂ = 1 + 0.25 + 0.125 + 0.03125 = 1.40625. Value = 1.40625 × 2⁷ = 1.40625 × 128 = **180.0**. - -2. **Why is 0.0f represented as 0x00000000 (all zeros) in IEEE-754? Most floats have a non-zero exponent — what makes zero special?** - Zero is a **special case** in IEEE-754. When both the exponent and mantissa are all zeros, the value is defined as ±0.0 (the sign bit distinguishes +0.0 from -0.0). This is by design — the IEEE-754 standard reserves the all-zeros exponent for zero and denormalized numbers. Unlike normal floats that have an implicit leading 1 in the mantissa (1.xxx), zero has no such implicit bit. This special encoding means you can check for zero by testing if all 32 bits are 0, which is efficient for hardware. - -3. **What is the IEEE-754 encoding of 90.0f? Show the sign, exponent, and mantissa calculation.** - 90.0 = 1.40625 × 2⁶. **Sign** = 0. **Exponent** = 6 + 127 = 133 = `0x85` = `10000101`. **Mantissa**: 90.0 / 64 = 1.40625, fractional part = 0.40625 = 0.25 + 0.125 + 0.03125 = `0110100...0` = `0x340000`. Result: `0 10000101 01101000000000000000000` = `0x42B40000`. Little-endian: `00 00 B4 42`. - -4. **The compiler might use movs r0, #0 instead of loading 0.0f from a literal pool. Why would it choose one approach over the other?** - For integer zero, the compiler prefers `movs r0, #0` (a 2-byte Thumb instruction) because it's smaller and faster than a literal pool load. However, for **floating-point** zero used with VFP instructions, the compiler must load it into an FPU register (e.g., `s0`). If the FPU has a `vmov.f32 s0, #0.0` immediate form available, it can encode zero directly. Otherwise, it loads from a literal pool or uses `movs` to set an integer register to 0 and transfers it with `vmov s0, r0`. The choice depends on instruction context — integer vs. FPU register — and optimization level. diff --git a/WEEK10/WEEK10-01.md b/WEEK10/WEEK10-01.md deleted file mode 100644 index 9ce41ca..0000000 --- a/WEEK10/WEEK10-01.md +++ /dev/null @@ -1,155 +0,0 @@ -# Embedded Systems Reverse Engineering -[Repository](https://github.com/mytechnotalent/Embedded-Hacking) - -## Week 10 -Conditionals in Embedded Systems: Debugging and Hacking Static & Dynamic Conditionals w/ SG90 Servo Motor PWM Basics - -### Non-Credit Practice Exercise 1: Change Servo Angle Range - -#### Objective -Find the IEEE-754 floating-point value `0x43340000` (180.0f) in the `0x0020_dynamic-conditionals` binary using GDB, calculate the file offset, patch it to `0x43070000` (135.0f) using a hex editor, then find and patch the `0x00000000` (0.0f) value to `0x42340000` (45.0f), and verify on hardware that the servo now sweeps from 45° to 135° instead of 0° to 180°. - -#### Prerequisites -- Completed Week 10 tutorial (GDB and hex editor sections) -- `0x0020_dynamic-conditionals.elf` and `0x0020_dynamic-conditionals.bin` available in your build directory -- GDB (`arm-none-eabi-gdb`) and OpenOCD installed -- A hex editor (HxD, ImHex, or similar) -- Python installed (for UF2 conversion) -- Raspberry Pi Pico 2 with SG90 servo motor connected on GPIO 6 - -#### Task Description -The program uses `servo_set_angle(0.0f)` and `servo_set_angle(180.0f)` to sweep the servo across its full range. The float values `0.0` (`0x00000000`) and `180.0` (`0x43340000`) are loaded from the literal pool into registers before the `bl servo_set_angle` calls. You will locate these values in the disassembly, find the corresponding bytes in the `.bin` file, and patch them to `45.0` (`0x42340000`) and `135.0` (`0x43070000`) so the servo sweeps a narrower 90° range centered at 90°. - -#### Step-by-Step Instructions - -##### Step 1: Start the Debug Session - -**Terminal 1 - Start OpenOCD:** - -```powershell -openocd ^ - -s "C:\Users\flare-vm\.pico-sdk\openocd\0.12.0+dev\scripts" ^ - -f interface/cmsis-dap.cfg ^ - -f target/rp2350.cfg ^ - -c "adapter speed 5000" -``` - -**Terminal 2 - Start GDB:** - -```powershell -arm-none-eabi-gdb build\0x0020_dynamic-conditionals.elf -``` - -**Connect to target:** - -```gdb -(gdb) target remote :3333 -(gdb) monitor reset halt -``` - -##### Step 2: Find the servo_set_angle Calls - -Disassemble main and look for the `servo_set_angle` calls: - -```gdb -(gdb) disassemble 0x10000234,+250 -``` - -Look for instruction patterns like: - -``` -ldr r0, [pc, #offset] ; load float from literal pool -bl servo_set_angle -``` - -There will be multiple pairs — one loading `0x00000000` (0.0f) and another loading `0x43340000` (180.0f). - -##### Step 3: Examine the Literal Pool Values - -Once you find the `ldr r0, [pc, #offset]` instructions, examine the literal pool entries they reference: - -```gdb -(gdb) x/wx -``` - -You should see `0x43340000` (180.0f in IEEE-754). - -```gdb -(gdb) x/wx -``` - -You should see `0x00000000` (0.0f in IEEE-754). - -##### Step 4: Calculate the File Offsets - -``` -file_offset = literal_pool_address - 0x10000000 -``` - -Note the file offsets for both 4-byte words. - -##### Step 5: Encode the New Values - -**IEEE-754 Encoding:** - -| Angle | IEEE-754 Hex | Little-Endian Bytes | -| ----- | -------------- | ------------------- | -| 0.0f | `0x00000000` | `00 00 00 00` | -| 45.0f | `0x42340000` | `00 00 34 42` | -| 135.0f| `0x43070000` | `00 00 07 43` | -| 180.0f| `0x43340000` | `00 00 34 43` | - -##### Step 6: Patch with HxD - -1. In HxD, open `C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals\build\0x0020_dynamic-conditionals.bin` -2. Press **Ctrl+G** and enter the file offset for the 180.0f value -3. You should see: `00 00 34 43` -4. Replace with: `00 00 07 43` (135.0f) -5. Press **Ctrl+G** and enter the file offset for the 0.0f value -6. You should see: `00 00 00 00` -7. Replace with: `00 00 34 42` (45.0f) - -###### Question 1: How many literal pool entries reference `0x43340000`? Do you need to patch all of them? - -##### Step 7: Save and Convert - -1. Click **File** → **Save As** → `0x0020_dynamic-conditionals-h.bin` - -```powershell -cd C:\Users\flare-vm\Desktop\Embedded-Hacking-main\0x0020_dynamic-conditionals -python ..\uf2conv.py build\0x0020_dynamic-conditionals-h.bin --base 0x10000000 --family 0xe48bff59 --output build\hacked.uf2 -``` - -##### Step 8: Flash and Verify - -1. Hold BOOTSEL and plug in your Pico 2 -2. Drag and drop `hacked.uf2` onto the RPI-RP2 drive - -**Check the servo behavior:** -- Press '1' → servo sweeps from **45°** to **135°** (was 0° to 180°) -- Press '2' → servo sweeps from **135°** to **45°** (was 180° to 0°) -- The total sweep range should be noticeably smaller - -#### Expected Output - -After completing this exercise, you should be able to: -- Locate IEEE-754 floating-point values in the literal pool -- Understand the IEEE-754 single-precision encoding format -- Patch floating-point angle constants in embedded firmware -- Calculate file offsets from memory addresses - -#### Questions for Reflection - -###### Question 1: The value `180.0f` is encoded as `0x43340000` in IEEE-754. Break this down: what are the sign bit, exponent, and mantissa fields? - -###### Question 2: Why is `0.0f` stored as `0x00000000` and not some other pattern? What makes zero special in IEEE-754? - -###### Question 3: If you wanted to set the servo to exactly 90° (center), what IEEE-754 hex value would you use? Show the calculation. - -###### Question 4: Could the compiler optimize `0.0f` differently — for example, using `movs r0, #0` instead of a literal pool load? How would that affect your patching strategy? - -#### Tips and Hints -- IEEE-754 for 90.0f: sign=0, exponent=127+6=133=0x85, mantissa=0x340000 → `0x42b40000` -- There may be multiple references to `0x43340000` in the literal pool — the case '1' and case '2' branches each load both angles -- Be careful with `0x00000000` — make sure you are patching a float literal pool entry and not zeroed data -- Use `x/4wx