This was posted some time ago by Numlock on an Italian forum http://www.wifi-shark.net/forum/, he also found the algorithm.

http://www38.zippyshare.com/v/89004997/file.html