Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report Proforma Invoice.exe

Overview

General Information

Sample Name:Proforma Invoice.exe
Analysis ID:343196
MD5:6479f35608769db340640d6a8f84a38d
SHA1:1ffc79fde43e746e826f32a018e02a65fc51602e
SHA256:e97a63a8f54270ace4969870597c7642bbdb31fc6d5d1972d412edaf4fccd80e
Tags:GuLoader

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Detected potential crypto function
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • Proforma Invoice.exe (PID: 2952 cmdline: 'C:\Users\user\Desktop\Proforma Invoice.exe' MD5: 6479F35608769DB340640D6A8F84A38D)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: Proforma Invoice.exe PID: 2952JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: Proforma Invoice.exe PID: 2952JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: Proforma Invoice.exeVirustotal: Detection: 33%Perma Link
      Source: Proforma Invoice.exeReversingLabs: Detection: 19%

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: Proforma Invoice.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

      System Summary:

      barindex
      Executable has a suspicious name (potential lure to open the executable)Show sources
      Source: Proforma Invoice.exeStatic file information: Suspicious name
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: Proforma Invoice.exe
      Source: C:\Users\user\Desktop\Proforma Invoice.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F76CF NtProtectVirtualMemory,0_2_021F76CF
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_0040326F0_2_0040326F
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_004034240_2_00403424
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_004033DF0_2_004033DF
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_004033830_2_00403383
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_004033AF0_2_004033AF
      Source: Proforma Invoice.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: Proforma Invoice.exe, 00000000.00000000.226901777.0000000000411000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameABJOINT.exe vs Proforma Invoice.exe
      Source: Proforma Invoice.exe, 00000000.00000002.1387605484.0000000002110000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Proforma Invoice.exe
      Source: Proforma Invoice.exeBinary or memory string: OriginalFilenameABJOINT.exe vs Proforma Invoice.exe
      Source: Proforma Invoice.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.troj.evad.winEXE@1/0@0/0
      Source: C:\Users\user\Desktop\Proforma Invoice.exeFile created: C:\Users\user\AppData\Local\Temp\~DF97811D99A2EC711B.TMPJump to behavior
      Source: Proforma Invoice.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Proforma Invoice.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\Proforma Invoice.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Proforma Invoice.exeVirustotal: Detection: 33%
      Source: Proforma Invoice.exeReversingLabs: Detection: 19%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: Proforma Invoice.exe PID: 2952, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: Proforma Invoice.exe PID: 2952, type: MEMORY
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_00407A10 pushfd ; retf 0_2_00407A12
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_00404292 push cs; iretd 0_2_00404294
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_004072AB push ecx; iretd 0_2_00407361
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F6EF1 push eax; ret 0_2_021F6EF2
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F4AE6 push ss; iretd 0_2_021F4AE7
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F576C push FFFFFFB9h; retf 0_2_021F576E
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F0F86 push edi; retf 0_2_021F0F9F
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F0FA0 push edi; retf 0_2_021F0F9F
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F0FA0 push edi; retf 0_2_021F0FC4
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F49C2 push edi; iretd 0_2_021F49C8
      Source: C:\Users\user\Desktop\Proforma Invoice.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F1850 0_2_021F1850
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\Proforma Invoice.exeRDTSC instruction interceptor: First address: 00000000021F0249 second address: 00000000021F0249 instructions:
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: Proforma Invoice.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\Proforma Invoice.exeRDTSC instruction interceptor: First address: 00000000021F0249 second address: 00000000021F0249 instructions:
      Source: C:\Users\user\Desktop\Proforma Invoice.exeRDTSC instruction interceptor: First address: 00000000021F6485 second address: 00000000021F6485 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FD330E19525h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test edx, CAC49675h 0x00000023 cmp edx, edx 0x00000025 cmp eax, ecx 0x00000027 add edi, edx 0x00000029 dec dword ptr [ebp+000000F8h] 0x0000002f jmp 00007FD330E1951Ah 0x00000031 test di, 395Ch 0x00000036 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000003d jne 00007FD330E19460h 0x0000003f cmp bx, ax 0x00000042 call 00007FD330E19559h 0x00000047 call 00007FD330E19535h 0x0000004c lfence 0x0000004f mov edx, dword ptr [7FFE0014h] 0x00000055 lfence 0x00000058 ret 0x00000059 mov esi, edx 0x0000005b pushad 0x0000005c rdtsc
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F1A1F rdtsc 0_2_021F1A1F
      Source: Proforma Invoice.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F1A1F rdtsc 0_2_021F1A1F
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F6006 mov eax, dword ptr fs:[00000030h]0_2_021F6006
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F5A78 mov eax, dword ptr fs:[00000030h]0_2_021F5A78
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F34AA mov eax, dword ptr fs:[00000030h]0_2_021F34AA
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F34A8 mov eax, dword ptr fs:[00000030h]0_2_021F34A8
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F2519 mov eax, dword ptr fs:[00000030h]0_2_021F2519
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F2571 mov eax, dword ptr fs:[00000030h]0_2_021F2571
      Source: Proforma Invoice.exe, 00000000.00000002.1387502839.0000000000C40000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: Proforma Invoice.exe, 00000000.00000002.1387502839.0000000000C40000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: Proforma Invoice.exe, 00000000.00000002.1387502839.0000000000C40000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: Proforma Invoice.exe, 00000000.00000002.1387502839.0000000000C40000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: Proforma Invoice.exe, 00000000.00000002.1387502839.0000000000C40000.00000002.00000001.sdmpBinary or memory string: Progmanlock
      Source: C:\Users\user\Desktop\Proforma Invoice.exeCode function: 0_2_021F2BD8 cpuid 0_2_021F2BD8

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Process Injection1OS Credential DumpingSecurity Software Discovery411Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery311SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Proforma Invoice.exe34%VirustotalBrowse
      Proforma Invoice.exe20%ReversingLabsWin32.Trojan.Generic

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Red Diamond
      Analysis ID:343196
      Start date:22.01.2021
      Start time:14:49:45
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 11m 42s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:Proforma Invoice.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:39
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal84.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 17.7% (good quality ratio 10%)
      • Quality average: 39.1%
      • Quality standard deviation: 36.7%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):5.766612306860119
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:Proforma Invoice.exe
      File size:69632
      MD5:6479f35608769db340640d6a8f84a38d
      SHA1:1ffc79fde43e746e826f32a018e02a65fc51602e
      SHA256:e97a63a8f54270ace4969870597c7642bbdb31fc6d5d1972d412edaf4fccd80e
      SHA512:cab95cae43799faaec6d612e4f63d363629506dd5973513e29870e0d81e1a3a99adc86696d320ffaeeff5cc23b6f6491cbe30052a3eff9afd303227db113054f
      SSDEEP:768:IxdbBehQZF4bp4kbKR80KQWfD5HDm0L5g5eucI1hzRU66t:6dde0F4bekepUrZi0O5FcI1hzR+
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L......S.....................0......T.............@................

      File Icon

      Icon Hash:f030f0c6f030b100

      Static PE Info

      General

      Entrypoint:0x401354
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x530B1A94 [Mon Feb 24 10:10:28 2014 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:e22238527efb5691a1dfa3f0e707406a

      Entrypoint Preview

      Instruction
      push 00401FECh
      call 00007FD3307D24E5h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      inc eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dh, cl
      in al, dx
      add edx, dword ptr [ebx+42150DA1h]
      cmpsd
      xchg eax, ecx
      aas
      test eax, CAE2F407h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      inc ecx
      add byte ptr [esi+50018250h], al
      jc 00007FD3307D2561h
      push 00000065h
      arpl word ptr [ecx+esi+00h], si
      add byte ptr [eax], al
      add byte ptr [ecx+edi-01h], bl
      add al, byte ptr [eax]
      add byte ptr [eax], al
      add bh, bh
      int3
      xor dword ptr [eax], eax
      add al, 93h
      sub eax, 444FEB34h
      or dword ptr [edi-6Fh], ecx
      add dword ptr [ebx-03792E85h], esp
      adc dword ptr [ecx], ebp
      sti
      mov edx, BC44A82Ah
      inc ecx
      adc al, 0000002Fh
      lahf
      aad 16h
      aad CCh
      cmp cl, byte ptr [edi-53h]
      xor ebx, dword ptr [ecx-48EE309Ah]
      or al, 00h
      stosb
      add byte ptr [eax-2Dh], ah
      xchg eax, ebx
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      in al, 0Bh
      add byte ptr [eax], al
      dec eax
      or eax, dword ptr [eax]
      add byte ptr [eax], al
      or dword ptr [eax], eax
      insb
      popad
      jnc 00007FD3307D2566h
      imul esi, dword ptr [ebx+6Bh], 010D0065h
      sldt word ptr [esi+69h]
      jc 00007FD3307D2557h
      je 00007FD3307D24F3h

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xe9f40x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x110000x930.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xfc.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000xde480xe000False0.533761160714data6.42243762415IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0xf0000x11800x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x110000x9300x1000False0.140625data1.4231462793IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0x113c80x568GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x113b40x14data
      RT_VERSION0x110f00x2c4dataChineseTaiwan

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaFreeVar, __vbaLenBstr, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarDup, __vbaFpI4, _CIatan, __vbaCastObj, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeStr, __vbaFreeObj

      Version Infos

      DescriptionData
      Translation0x0404 0x04b0
      LegalCopyrightCalc Theory
      InternalNameABJOINT
      FileVersion1.00
      CompanyNameCalc Theory
      CommentsCalc Theory
      ProductNameCalc Theory
      ProductVersion1.00
      FileDescriptionCalc Theory
      OriginalFilenameABJOINT.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      ChineseTaiwan

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      Analysis Process: Proforma Invoice.exe PID: 2952 Parent PID: 5692

      General

      Start time:14:50:35
      Start date:22/01/2021
      Path:C:\Users\user\Desktop\Proforma Invoice.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\Proforma Invoice.exe'
      Imagebase:0x400000
      File size:69632 bytes
      MD5 hash:6479F35608769DB340640D6A8F84A38D
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Chronological Activities

      Disassembly

      Code Analysis

      Reset < >

        Analysis Process: Proforma Invoice.exe PID: 2952 Parent PID: 5692 Proforma Invoice.exeCOMMON

        Executed Functions

        Function 0040326F, Relevance: 1.6, APIs: 1, Instructions: 382memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 483b60f7a4c7549c0d4504d3efc80229cfd7c30ae8375bf36dbe308660a48519
        • Instruction ID: 4b4e9678d1031a565a411b24c0ba49daa2869fcf95869d53b6d6a74f0308c67e
        • Opcode Fuzzy Hash: 483b60f7a4c7549c0d4504d3efc80229cfd7c30ae8375bf36dbe308660a48519
        • Instruction Fuzzy Hash: 3F915AF111B3C1ABC3224F74D8A12A57FE4EF43F2431458AAC4C1DA265DA3D5697D70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 004033DF, Relevance: 1.5, APIs: 1, Instructions: 272memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: bc986c618d134da718ab3b179aae8ffc4bd059da91dcdfb16707caccf2ac45f6
        • Instruction ID: 65d8371450eae8e8d5e89c4eeb17077a28e03c63c83dede64b5e5a7fff627a0b
        • Opcode Fuzzy Hash: bc986c618d134da718ab3b179aae8ffc4bd059da91dcdfb16707caccf2ac45f6
        • Instruction Fuzzy Hash: A9517CF2627385FBC3614F68ECA52657FD8FB42F50710587AC080DA268DB2D4693E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 00403383, Relevance: 1.5, APIs: 1, Instructions: 272COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e0cbe472ffb8f612a2c163d169fce9ee658733947583dda1d0ca5db451776b44
        • Instruction ID: 490a3e638973201b5276b361a1dabfdc3001f14802dd14032667fcaa7c24df3e
        • Opcode Fuzzy Hash: e0cbe472ffb8f612a2c163d169fce9ee658733947583dda1d0ca5db451776b44
        • Instruction Fuzzy Hash: 7C516BF2627385B7C3314F68ECA52657F98FB42F50310687AC081DA2A8DB2D4693D20A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 004033AF, Relevance: 1.5, APIs: 1, Instructions: 257memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 302edd1832d91ba5cea169e89dc6e17526231e531470d9a8bf7aafdd6cf60386
        • Instruction ID: 621510f05bc6489942c89f33899c2b9c4a5190054e2400cbbbe37147a7371058
        • Opcode Fuzzy Hash: 302edd1832d91ba5cea169e89dc6e17526231e531470d9a8bf7aafdd6cf60386
        • Instruction Fuzzy Hash: DE516CF2627385F7C3710F68ECA52A57FD9FB42F50310587AC085DA268DA2D4693E20A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 00403424, Relevance: 1.5, APIs: 1, Instructions: 233memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: b89473d0137af4d70ee81edf2a9f55408ea1c7ef504a98a8462ae436a745a524
        • Instruction ID: f74fda1348ff46c3ed416176c195ae2a6ba61eddf1cc535c1c4c099e3984234d
        • Opcode Fuzzy Hash: b89473d0137af4d70ee81edf2a9f55408ea1c7ef504a98a8462ae436a745a524
        • Instruction Fuzzy Hash: 89518CF2627385FBC3610F68EC952A67BD5FB42F50710587AC080D6268DB2D4693E30A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040D7C4, Relevance: 105.6, APIs: 56, Strings: 4, Instructions: 592COMMON
        Download Yara Rule
        C-Code - Quality: 60%
        			E0040D7C4(signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v40;
				short _v44;
				intOrPtr _v48;
				long long _v52;
				intOrPtr _v56;
				char _v60;
				short _v64;
				short _v84;
				long long _v92;
				signed int _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v116;
				char _v124;
				char* _v132;
				char _v140;
				intOrPtr _v148;
				char _v156;
				signed int _v164;
				char _v172;
				void* _v176;
				char _v180;
				char _v184;
				intOrPtr _v188;
				long long _v192;
				signed int _v196;
				signed int _v200;
				signed int* _v204;
				signed int _v208;
				signed int _v212;
				char _v228;
				char _v244;
				signed int _v256;
				intOrPtr _v260;
				intOrPtr* _v264;
				intOrPtr* _v268;
				signed int _v272;
				signed int _v276;
				intOrPtr* _v280;
				signed int _v284;
				char _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				signed int _v312;
				intOrPtr* _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				char _v332;
				signed int _v336;
				intOrPtr _t296;
				char* _t297;
				signed int _t305;
				signed int _t309;
				char* _t310;
				signed int _t325;
				signed int _t329;
				signed int _t337;
				signed int _t346;
				signed int _t351;
				signed int _t356;
				signed int _t360;
				signed int* _t364;
				signed int _t368;
				signed int _t372;
				signed int _t378;
				char* _t385;
				signed int _t386;
				signed char _t392;
				char* _t395;
				signed int _t399;
				void* _t400;
				char* _t428;
				signed int _t433;
				void* _t435;
				void* _t436;
				void* _t438;
				void* _t440;
				void* _t442;
				intOrPtr _t443;
				void* _t445;
				void* _t446;
				signed long long _t454;

				_t443 = _t442 - 0xc;
				 *[fs:0x0] = _t443;
				L004011E0();
				_v16 = _t443;
				_v12 = 0x401140;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				_t296 =  *((intOrPtr*)( *_a4 + 4))(_a4, _t436, _t438, _t400,  *[fs:0x0], 0x4011e6, _t440);
				L00401330();
				_v116 = _t296;
				_v124 = 8;
				_t297 =  &_v124;
				_push(_t297); // executed
				L00401336(); // executed
				_v196 =  ~(0 | _t297 != 0x0000ffff);
				L0040132A();
				if(_v196 != 0) {
					if( *0x40f33c != 0) {
						_v264 = 0x40f33c;
					} else {
						_push(0x40f33c);
						_push(0x402e1c);
						L00401324();
						_v264 = 0x40f33c;
					}
					_v264 =  *_v264;
					_v204 =  *_v264;
					if( *0x40f010 != 0) {
						_v268 = 0x40f010;
					} else {
						_push("xqk");
						_push(0x402754);
						L00401324();
						_v268 = 0x40f010;
					}
					_v268 =  *_v268;
					__eax =  *((intOrPtr*)( *((intOrPtr*)( *_v268)) + 0x304))( *_v268);
					__eax =  &_v104;
					L0040131E();
					_v196 = __eax;
					__eax =  &_v96;
					_v196 =  *_v196;
					__eax =  *((intOrPtr*)( *_v196 + 0x188))(_v196,  &_v96, __eax,  *_v268);
					asm("fclex");
					_v200 = __eax;
					if(_v200 >= 0) {
						_v272 = _v272 & 0x00000000;
					} else {
						_push(0x188);
						_push(0x402ddc);
						_push(_v196);
						_push(_v200);
						L00401318();
						_v272 = __eax;
					}
					L00401312();
					__eax =  &_v108;
					L0040131E();
					_v204 =  *_v204;
					__eax =  *((intOrPtr*)( *_v204 + 0x40))(_v204, __eax, __eax, __eax, _v56, 0x402dec, _v96);
					asm("fclex");
					_v208 = __eax;
					if(_v208 >= 0) {
						_v276 = _v276 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x402e0c);
						_push(_v204);
						_push(_v208);
						L00401318();
						_v276 = __eax;
					}
					L0040130C();
					__eax =  &_v108;
					_push( &_v108);
					__eax =  &_v104;
					_push( &_v104);
					_push(2);
					L00401306();
					__esp = __esp + 0xc;
				}
				 *((intOrPtr*)( *_a4 + 0x710))(_a4);
				if( *0x40f010 != 0) {
					_v280 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v280 = 0x40f010;
				}
				_t305 =  &_v104;
				L0040131E();
				_v196 = _t305;
				_t309 =  *((intOrPtr*)( *_v196 + 0x130))(_v196,  &_v108, _t305,  *((intOrPtr*)( *((intOrPtr*)( *_v280)) + 0x304))( *_v280));
				asm("fclex");
				_v200 = _t309;
				if(_v200 >= 0) {
					_v284 = _v284 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x402ddc);
					_push(_v196);
					_push(_v200);
					L00401318();
					_v284 = _t309;
				}
				_t310 =  &_v124;
				L004012FA();
				L00401300();
				_v184 = _t310;
				_v180 =  *0x40113c;
				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v180,  &_v184, _t310, _t310, _v108, 0, 0);
				L00401306();
				_t445 = _t443 + 0x1c;
				L0040132A();
				 *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v180, 2,  &_v104,  &_v108);
				_v60 = _v180;
				if( *0x40f010 != 0) {
					_v288 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v288 = 0x40f010;
				}
				_t325 =  &_v104;
				L0040131E();
				_v196 = _t325;
				_t329 =  *((intOrPtr*)( *_v196 + 0x48))(_v196,  &_v96, _t325,  *((intOrPtr*)( *((intOrPtr*)( *_v288)) + 0x300))( *_v288));
				asm("fclex");
				_v200 = _t329;
				if(_v200 >= 0) {
					_v292 = _v292 & 0x00000000;
				} else {
					_push(0x48);
					_push(0x402e2c);
					_push(_v196);
					_push(_v200);
					L00401318();
					_v292 = _t329;
				}
				L004012F4();
				_v256 = _v96;
				_v96 = _v96 & 0x00000000;
				_v116 = _v256;
				_v124 = 8;
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t337 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4, 0x10,  &_v100,  &_v192);
				_v204 = _t337;
				if(_v204 >= 0) {
					_v296 = _v296 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402c88);
					_push(_a4);
					_push(_v204);
					L00401318();
					_v296 = _t337;
				}
				_v52 = _v192;
				_v48 = _v188;
				L0040130C();
				L004012EE();
				L0040132A();
				_v132 = L"yWwcUJLP2nVmMuZiSL220";
				_v140 = 8;
				L004012E8();
				_t433 = L"YKyT2IjOTG5HP140";
				L004012F4();
				_v180 = 0x50c61e;
				_t346 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v180,  &_v96,  &_v124,  &_v176);
				_v196 = _t346;
				if(_v196 >= 0) {
					_v300 = _v300 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402c88);
					_push(_a4);
					_push(_v196);
					L00401318();
					_v300 = _t346;
				}
				_v64 = _v176;
				L0040130C();
				L0040132A();
				_t351 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v176);
				_v196 = _t351;
				if(_v196 >= 0) {
					_v304 = _v304 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x402c88);
					_push(_a4);
					_push(_v196);
					L00401318();
					_v304 = _t351;
				}
				_v44 = _v176;
				if( *0x40f010 != 0) {
					_v308 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v308 = 0x40f010;
				}
				_t356 =  &_v104;
				L0040131E();
				_v196 = _t356;
				_t360 =  *((intOrPtr*)( *_v196 + 0x50))(_v196,  &_v176, _t356,  *((intOrPtr*)( *((intOrPtr*)( *_v308)) + 0x308))( *_v308));
				asm("fclex");
				_v200 = _t360;
				if(_v200 >= 0) {
					_v312 = _v312 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x402ddc);
					_push(_v196);
					_push(_v200);
					L00401318();
					_v312 = _t360;
				}
				if( *0x40f010 != 0) {
					_v316 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v316 = 0x40f010;
				}
				_t364 =  &_v108;
				L0040131E();
				_v204 = _t364;
				_t368 =  *((intOrPtr*)( *_v204 + 0x160))(_v204,  &_v180, _t364,  *((intOrPtr*)( *((intOrPtr*)( *_v316)) + 0x308))( *_v316));
				asm("fclex");
				_v208 = _t368;
				if(_v208 >= 0) {
					_v320 = _v320 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x402ddc);
					_push(_v204);
					_push(_v208);
					L00401318();
					_v320 = _t368;
				}
				_t372 =  *((intOrPtr*)( *_a4 + 0x704))(_a4, _v176, 0x347c, _v180,  &_v192);
				_v212 = _t372;
				if(_v212 >= 0) {
					_v324 = _v324 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x402c88);
					_push(_a4);
					_push(_v212);
					L00401318();
					_v324 = _t372;
				}
				_v92 = _v192;
				L00401306();
				_t446 = _t445 + 0xc;
				_t378 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v176, 2,  &_v104,  &_v108);
				_v196 = _t378;
				if(_v196 >= 0) {
					_v328 = _v328 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x402c88);
					_push(_a4);
					_push(_v196);
					L00401318();
					_v328 = _t378;
				}
				_v84 = _v176;
				_v132 = 1;
				_v140 = 2;
				_v148 = 0x18013;
				_v156 = 3;
				_v164 = _v164 & 0x00000000;
				_v172 = 2;
				_push( &_v140);
				_push( &_v156);
				_push( &_v172);
				_push( &_v244);
				_push( &_v228);
				_t385 =  &_v40;
				_push(_t385);
				L004012E2();
				_v260 = _t385;
				while(_v260 != 0) {
					_v116 = 2;
					_v124 = 2;
					_t386 =  &_v124;
					_push(_t386);
					_push(1);
					_push(0x402ecc);
					_push(0x402ecc);
					L004012CA();
					L004012D6();
					_push(_t386);
					L004012D0();
					_t433 = _t386;
					L004012D6();
					_push(_t386);
					_push(0x402ed8);
					L004012DC();
					asm("sbb eax, eax");
					_v196 =  ~( ~( ~_t386));
					_push( &_v100);
					_push( &_v96);
					_push(2);
					L004012C4();
					_t446 = _t446 + 0xc;
					_t428 =  &_v124;
					L0040132A();
					_t392 = _v196;
					if(_t392 == 0) {
						L63:
						_push( &_v244);
						_push( &_v228);
						_t395 =  &_v40;
						_push(_t395);
						L004012B8();
						_v260 = _t395;
						continue;
					}
					_push(_t428);
					_v276 =  *0x401138;
					_t454 =  *0x401130 *  *0x401128;
					if( *0x40f000 != 0) {
						_push( *0x401124);
						_push( *0x401120);
						L00401204();
					} else {
						_t454 = _t454 /  *0x401120;
					}
					asm("fnstsw ax");
					if((_t392 & 0x0000000d) != 0) {
						return __imp____vbaFPException();
					} else {
						_v332 = _t454;
						_v288 = _v332;
						_v292 =  *0x401118;
						L004012BE();
						_v300 =  *0x401108;
						_v304 =  *0x401104;
						_v308 =  *0x401100;
						_t399 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t428, _t428, _t428, _t392, _t428, _t428);
						asm("fclex");
						_v196 = _t399;
						if(_v196 >= 0) {
							_v336 = _v336 & 0x00000000;
						} else {
							_push(0x2c0);
							_push(0x402c58);
							_push(_a4);
							_push(_v196);
							L00401318();
							_v336 = _t399;
						}
						goto L63;
					}
				}
				_v132 = 0xaa;
				_t435 =  >=  ? 0x40333c : _t433;
				goto __edx;
			}





























































































        0x0040d7c7
        0x0040d7d6
        0x0040d7e2
        0x0040d7ea
        0x0040d7ed
        0x0040d7fa
        0x0040d802
        0x0040d80d
        0x0040d810
        0x0040d815
        0x0040d818
        0x0040d81f
        0x0040d822
        0x0040d823
        0x0040d833
        0x0040d83d
        0x0040d84b
        0x0040d858
        0x0040d875
        0x0040d85a
        0x0040d85a
        0x0040d85f
        0x0040d864
        0x0040d869
        0x0040d869
        0x0040d885
        0x0040d887
        0x0040d894
        0x0040d8b1
        0x0040d896
        0x0040d896
        0x0040d89b
        0x0040d8a0
        0x0040d8a5
        0x0040d8a5
        0x0040d8c1
        0x0040d8ce
        0x0040d8d5
        0x0040d8d9
        0x0040d8de
        0x0040d8e4
        0x0040d8ee
        0x0040d8f6
        0x0040d8fc
        0x0040d8fe
        0x0040d90b
        0x0040d930
        0x0040d90d
        0x0040d90d
        0x0040d912
        0x0040d917
        0x0040d91d
        0x0040d923
        0x0040d928
        0x0040d928
        0x0040d942
        0x0040d948
        0x0040d94c
        0x0040d958
        0x0040d960
        0x0040d963
        0x0040d965
        0x0040d972
        0x0040d994
        0x0040d974
        0x0040d974
        0x0040d976
        0x0040d97b
        0x0040d981
        0x0040d987
        0x0040d98c
        0x0040d98c
        0x0040d99e
        0x0040d9a3
        0x0040d9a6
        0x0040d9a7
        0x0040d9aa
        0x0040d9ab
        0x0040d9ad
        0x0040d9b2
        0x0040d9b2
        0x0040d9bd
        0x0040d9ca
        0x0040d9e7
        0x0040d9cc
        0x0040d9cc
        0x0040d9d1
        0x0040d9d6
        0x0040d9db
        0x0040d9db
        0x0040da0b
        0x0040da0f
        0x0040da14
        0x0040da2c
        0x0040da32
        0x0040da34
        0x0040da41
        0x0040da66
        0x0040da43
        0x0040da43
        0x0040da48
        0x0040da4d
        0x0040da53
        0x0040da59
        0x0040da5e
        0x0040da5e
        0x0040da74
        0x0040da78
        0x0040da81
        0x0040da86
        0x0040da92
        0x0040daae
        0x0040dabe
        0x0040dac3
        0x0040dac9
        0x0040dadd
        0x0040dae9
        0x0040daf3
        0x0040db10
        0x0040daf5
        0x0040daf5
        0x0040dafa
        0x0040daff
        0x0040db04
        0x0040db04
        0x0040db34
        0x0040db38
        0x0040db3d
        0x0040db55
        0x0040db58
        0x0040db5a
        0x0040db67
        0x0040db89
        0x0040db69
        0x0040db69
        0x0040db6b
        0x0040db70
        0x0040db76
        0x0040db7c
        0x0040db81
        0x0040db81
        0x0040db98
        0x0040dba0
        0x0040dba6
        0x0040dbb0
        0x0040dbb3
        0x0040dbc8
        0x0040dbd2
        0x0040dbd3
        0x0040dbd4
        0x0040dbd5
        0x0040dbde
        0x0040dbe4
        0x0040dbf1
        0x0040dc13
        0x0040dbf3
        0x0040dbf3
        0x0040dbf8
        0x0040dbfd
        0x0040dc00
        0x0040dc06
        0x0040dc0b
        0x0040dc0b
        0x0040dc20
        0x0040dc29
        0x0040dc2f
        0x0040dc37
        0x0040dc3f
        0x0040dc44
        0x0040dc4b
        0x0040dc5e
        0x0040dc63
        0x0040dc6b
        0x0040dc70
        0x0040dc98
        0x0040dc9e
        0x0040dcab
        0x0040dccd
        0x0040dcad
        0x0040dcad
        0x0040dcb2
        0x0040dcb7
        0x0040dcba
        0x0040dcc0
        0x0040dcc5
        0x0040dcc5
        0x0040dcdb
        0x0040dce2
        0x0040dcea
        0x0040dcfe
        0x0040dd04
        0x0040dd11
        0x0040dd33
        0x0040dd13
        0x0040dd13
        0x0040dd18
        0x0040dd1d
        0x0040dd20
        0x0040dd26
        0x0040dd2b
        0x0040dd2b
        0x0040dd41
        0x0040dd4c
        0x0040dd69
        0x0040dd4e
        0x0040dd4e
        0x0040dd53
        0x0040dd58
        0x0040dd5d
        0x0040dd5d
        0x0040dd8d
        0x0040dd91
        0x0040dd96
        0x0040ddb1
        0x0040ddb4
        0x0040ddb6
        0x0040ddc3
        0x0040dde5
        0x0040ddc5
        0x0040ddc5
        0x0040ddc7
        0x0040ddcc
        0x0040ddd2
        0x0040ddd8
        0x0040dddd
        0x0040dddd
        0x0040ddf3
        0x0040de10
        0x0040ddf5
        0x0040ddf5
        0x0040ddfa
        0x0040ddff
        0x0040de04
        0x0040de04
        0x0040de34
        0x0040de38
        0x0040de3d
        0x0040de58
        0x0040de5e
        0x0040de60
        0x0040de6d
        0x0040de92
        0x0040de6f
        0x0040de6f
        0x0040de74
        0x0040de79
        0x0040de7f
        0x0040de85
        0x0040de8a
        0x0040de8a
        0x0040deb9
        0x0040debf
        0x0040decc
        0x0040deee
        0x0040dece
        0x0040dece
        0x0040ded3
        0x0040ded8
        0x0040dedb
        0x0040dee1
        0x0040dee6
        0x0040dee6
        0x0040defb
        0x0040df08
        0x0040df0d
        0x0040df1f
        0x0040df25
        0x0040df32
        0x0040df54
        0x0040df34
        0x0040df34
        0x0040df39
        0x0040df3e
        0x0040df41
        0x0040df47
        0x0040df4c
        0x0040df4c
        0x0040df62
        0x0040df66
        0x0040df6d
        0x0040df77
        0x0040df81
        0x0040df8b
        0x0040df92
        0x0040dfa2
        0x0040dfa9
        0x0040dfb0
        0x0040dfb7
        0x0040dfbe
        0x0040dfbf
        0x0040dfc2
        0x0040dfc3
        0x0040dfc8
        0x0040e141
        0x0040dfd3
        0x0040dfda
        0x0040dfe1
        0x0040dfe4
        0x0040dfe5
        0x0040dfe7
        0x0040dfec
        0x0040dff1
        0x0040dffb
        0x0040e000
        0x0040e001
        0x0040e006
        0x0040e00b
        0x0040e010
        0x0040e011
        0x0040e016
        0x0040e01d
        0x0040e023
        0x0040e02d
        0x0040e031
        0x0040e032
        0x0040e034
        0x0040e039
        0x0040e03c
        0x0040e03f
        0x0040e044
        0x0040e04d
        0x0040e124
        0x0040e12a
        0x0040e131
        0x0040e132
        0x0040e135
        0x0040e136
        0x0040e13b
        0x00000000
        0x0040e13b
        0x0040e059
        0x0040e05a
        0x0040e063
        0x0040e070
        0x0040e07a
        0x0040e080
        0x0040e086
        0x0040e072
        0x0040e072
        0x0040e072
        0x0040e08b
        0x0040e08f
        0x004011ec
        0x0040e095
        0x0040e095
        0x0040e0a2
        0x0040e0ac
        0x0040e0b5
        0x0040e0c2
        0x0040e0cc
        0x0040e0d6
        0x0040e0e6
        0x0040e0ec
        0x0040e0ee
        0x0040e0fb
        0x0040e11d
        0x0040e0fd
        0x0040e0fd
        0x0040e102
        0x0040e107
        0x0040e10a
        0x0040e110
        0x0040e115
        0x0040e115
        0x00000000
        0x0040e0fb
        0x0040e08f
        0x0040e14e
        0x0040e15d
        0x0040e160

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040D7E2
        • #609.MSVBVM60(?,?,?,?,004011E6), ref: 0040D810
        • #557.MSVBVM60(00000008), ref: 0040D823
        • __vbaFreeVar.MSVBVM60(00000008), ref: 0040D83D
        • __vbaNew2.MSVBVM60(00402E1C,0040F33C,00000008), ref: 0040D864
        • __vbaNew2.MSVBVM60(00402754,xqk), ref: 0040D8A0
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040D8D9
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402DDC,00000188), ref: 0040D923
        • __vbaCastObj.MSVBVM60(?,00402DEC,?), ref: 0040D942
        • __vbaObjSet.MSVBVM60(?,00000000,?,00402DEC,?), ref: 0040D94C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402E0C,00000040), ref: 0040D987
        • __vbaFreeStr.MSVBVM60(00000000,?,00402E0C,00000040), ref: 0040D99E
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D9AD
        • __vbaNew2.MSVBVM60(00402754,xqk), ref: 0040D9D6
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040DA0F
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402DDC,00000130), ref: 0040DA59
        • __vbaLateIdCallLd.MSVBVM60(00000008,?,00000000,00000000), ref: 0040DA78
        • __vbaI4Var.MSVBVM60(00000000,?,?,?,004011E6), ref: 0040DA81
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,004011E6), ref: 0040DABE
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004011E6), ref: 0040DAC9
        • __vbaNew2.MSVBVM60(00402754,xqk,?,?,?,?,?,?,004011E6), ref: 0040DAFF
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040DB38
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402E2C,00000048), ref: 0040DB7C
        • __vbaStrCopy.MSVBVM60(00000000,?,00402E2C,00000048), ref: 0040DB98
        • __vbaChkstk.MSVBVM60(?,?), ref: 0040DBC8
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC06
        • __vbaFreeStr.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC2F
        • __vbaFreeObj.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC37
        • __vbaFreeVar.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC3F
        • __vbaVarDup.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC5E
        • __vbaStrCopy.MSVBVM60(00000000,00401140,00402C88,000006F8), ref: 0040DC6B
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C88,000006FC), ref: 0040DCC0
        • __vbaFreeStr.MSVBVM60(00000000,00401140,00402C88,000006FC), ref: 0040DCE2
        • __vbaFreeVar.MSVBVM60(00000000,00401140,00402C88,000006FC), ref: 0040DCEA
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C88,00000700), ref: 0040DD26
        • __vbaNew2.MSVBVM60(00402754,xqk), ref: 0040DD58
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040DD91
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402DDC,00000050), ref: 0040DDD8
        • __vbaNew2.MSVBVM60(00402754,xqk), ref: 0040DDFF
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040DE38
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402DDC,00000160), ref: 0040DE85
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C88,00000704), ref: 0040DEE1
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040DF08
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C88,00000708), ref: 0040DF47
        • __vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002), ref: 0040DFC3
        • __vbaStrCat.MSVBVM60(00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040DFF1
        • __vbaStrMove.MSVBVM60(00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040DFFB
        • #628.MSVBVM60(00000000,00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040E001
        • __vbaStrMove.MSVBVM60(00000000,00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040E00B
        • __vbaStrCmp.MSVBVM60(00402ED8,00000000,00000000,00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040E016
        • __vbaFreeStrList.MSVBVM60(00000002,?,?,00402ED8,00000000,00000000,00402ECC,00402ECC,00000001,00000002,?,?,?,00000002,00000003,00000002), ref: 0040E034
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E03F
        • _adj_fdiv_m64.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E086
        • __vbaFpI4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E0B5
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401140,00402C58,000002C0), ref: 0040E110
        • __vbaVarForNext.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E136
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$New2$List$ChkstkCopyMove$#557#609#628CallCastInitLateNext_adj_fdiv_m64
        • String ID: UcScmXD96757qJJZGyR8162$YKyT2IjOTG5HP140$xqk$yWwcUJLP2nVmMuZiSL220
        • API String ID: 2886871742-3938074432
        • Opcode ID: d0f784fe47cf042a24ffbe4190a61defa9e5d09eb90ed0058cf0d25712b7f915
        • Instruction ID: b3eb52e8bbaeb341ceaca9dc5af10b1389dc8fc0a704307edb5c03bedf5b531a
        • Opcode Fuzzy Hash: d0f784fe47cf042a24ffbe4190a61defa9e5d09eb90ed0058cf0d25712b7f915
        • Instruction Fuzzy Hash: 3442C571900218EFEB219F90CC45BDDBBB4BB08304F1041FAE549BB2A1DB795A99DF58
        Uniqueness

        Uniqueness Score: -1.00%

        Function 00401354, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 642COMMON
        Download Yara Rule
        C-Code - Quality: 91%
        			_entry_(signed int __eax, void* __ebx, signed int __ecx, void* __edx, void* __edi, signed int __esi, signed int __ebp, intOrPtr _a12245889) {
				intOrPtr* _t55;
				signed char _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				intOrPtr* _t61;
				intOrPtr* _t62;
				intOrPtr* _t65;
				intOrPtr* _t70;
				intOrPtr* _t76;
				signed char _t77;
				signed char _t78;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				intOrPtr* _t87;
				void* _t88;
				intOrPtr* _t89;
				intOrPtr* _t90;
				signed char _t91;
				signed char _t93;
				signed int _t94;
				void* _t97;
				signed int _t98;
				signed int* _t100;
				void* _t102;
				signed int _t104;
				signed int _t108;
				void* _t109;
				intOrPtr* _t112;
				signed int _t120;
				intOrPtr* _t123;
				signed int* _t124;
				void* _t126;
				signed int _t127;
				signed int _t130;
				void* _t131;
				void* _t133;
				void* _t135;
				signed int _t141;

				_t130 = __ebp;
				_t127 = __esi;
				_t126 = __edi;
				_t99 = __ebx;
				_push("VB5!6&*"); // executed
				L0040134E(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t55 = __eax + 1;
				 *_t55 =  *_t55 + _t55;
				 *_t55 =  *_t55 + _t55;
				 *_t55 =  *_t55 + _t55;
				asm("in al, dx");
				_t123 = __edx + __ecx +  *((intOrPtr*)(__ebx + 0x42150da1));
				asm("cmpsd");
				_t56 = __ecx;
				asm("aas");
				 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
				 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
				 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
				 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
				 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
				_t108 = _t55 + 1;
				_t5 = __esi + 0x50018250;
				 *_t5 =  *((intOrPtr*)(__esi + 0x50018250)) + __ecx;
				if( *_t5 >= 0) {
					_push(0x65);
					asm("arpl [ecx+esi], si");
					 *((intOrPtr*)(__ecx)) =  *((intOrPtr*)(__ecx)) + __ecx;
					 *((intOrPtr*)(_t108 + __edi - 1)) =  *((intOrPtr*)(_t108 + __edi - 1)) + __ebx;
					_t94 = __ecx +  *((intOrPtr*)(__ecx));
					 *_t94 =  *_t94 + _t94;
					_t104 = __ebx + __ebx;
					asm("int3");
					 *_t94 =  *_t94 ^ _t94;
					 *(__edi - 0x6f) =  *(__edi - 0x6f) | _t108;
					 *((intOrPtr*)(_t104 - 0x3792e85)) =  *((intOrPtr*)(_t104 - 0x3792e85)) + _t133;
					asm("adc [ecx], ebp");
					asm("sti");
					_t123 = 0xbc44a82a;
					_t108 = _t108 + 1;
					asm("adc al, 0x2f");
					asm("lahf");
					asm("aad 0x16");
					asm("aad 0xcc");
					_t97 = _t94 + 0x93 - 0x444feb34;
					asm("stosb");
					 *((intOrPtr*)(_t97 - 0x2d)) =  *((intOrPtr*)(_t97 - 0x2d)) + _t97;
					_t98 = _t104 ^  *(_t108 - 0x48ee309a);
					_t99 = _t97;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					 *_t98 =  *_t98 + _t98;
					asm("in al, 0xb");
					 *_t98 =  *_t98 + _t98;
					_t56 = _t98 - 1;
				}
				_t57 = _t56 |  *_t56;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 | _t57;
				asm("gs insb");
				asm("popad");
				if( *_t57 >= 0) {
					L10:
					_t57 =  *0xa5a500a1;
					asm("movsd");
					 *((intOrPtr*)(_t123 - 0x4dff5556)) =  *((intOrPtr*)(_t123 - 0x4dff5556)) + _t108;
					_t123 = 0xb2;
					 *((intOrPtr*)(_t133 + _t127 * 4 - 0x4141ff4c)) =  *((intOrPtr*)(_t133 + _t127 * 4 - 0x4141ff4c)) + 0xb2;
				} else {
					_t127 =  *(_t99 + 0x6b) * 0x10d0065;
					_t141 = _t127;
					asm("sldt word [esi+0x69]");
					if(_t141 < 0) {
						L9:
						 *((intOrPtr*)(_t108 - 0x5aff5e5f)) =  *((intOrPtr*)(_t108 - 0x5aff5e5f)) + _t57;
						goto L10;
					} else {
						if(_t141 == 0) {
							L8:
							asm("lahf");
							goto L9;
						} else {
							asm("a16 jae 0x6c");
							if(_t141 == 0) {
								if (_t141 >= 0) goto L7;
								asm("sbb [ecx], eax");
								 *_t123 =  *_t123 + _t57;
								_t130 = _t130 & _t127;
								_t93 = _t57 &  *_t108 |  *(_t57 &  *_t108);
								 *((intOrPtr*)(_t133 + _t127 * 2)) =  *((intOrPtr*)(_t133 + _t127 * 2)) + _t108;
								_t123 = _t123 + _t93;
								_t57 = _t93 |  *_t93;
								 *_t57 =  *_t57 + _t57;
								 *_t108 =  *_t108 + _t57;
								 *_t108 =  *_t108 + _t57;
								 *_t57 =  *_t57 + _t123;
								asm("adc [eax], al");
								 *_t108 =  *_t108 + _t57;
								 *_t57 =  *_t57 + _t108;
								 *((intOrPtr*)(_t57 + 5)) =  *((intOrPtr*)(_t57 + 5)) + _t108;
								 *_t57 =  *_t57 + _t57;
								_push(ss);
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t108;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t123;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t108 =  *_t108 + _t57;
								 *_t57 =  *_t57 + _t108;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *_t57 =  *_t57 + _t57;
								 *((intOrPtr*)(_t126 - 0x5eff6061)) =  *((intOrPtr*)(_t126 - 0x5eff6061)) + _t99;
								goto L8;
							}
						}
					}
				}
				_t109 = _t108 + _t108;
				_pop(_t131);
				_t135 = _t131;
				_t124 = _t123 + _t109;
				asm("into");
				asm("into");
				asm("rcl ecx, 1");
				asm("aad 0xd5");
				_t112 = _t109 + _t124 + _t124 + _t57;
				asm("loope 0xffffffe3");
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				_t100 = _t99 + _t99;
				asm("invalid");
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t57 =  *_t57 + _t57;
				 *_t124 =  *_t124 + _t57;
				_t58 = _t57 +  *_t124;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				 *_t58 =  *_t58 + _t58;
				_push(es);
				_push(es);
				_t60 = _t58 +  *0xc3c3c300 +  *((intOrPtr*)(_t58 +  *0xc3c3c300));
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				 *_t60 =  *_t60 + _t60;
				_t61 = _t60 +  *_t112;
				 *_t112 =  *_t112 + _t61;
				_t62 = _t61 +  *_t61;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + _t62;
				 *_t62 =  *_t62 + _t62;
				_t65 = _t62 +  *_t124 +  *_t124 +  *((intOrPtr*)(_t62 +  *_t124 +  *_t124));
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				 *_t124 =  *_t124 + _t65;
				_t70 = _t65 +  *_t124 +  *_t124 +  *((intOrPtr*)(_t124 + _t65 +  *_t124 +  *_t124)) +  *_t124 +  *((intOrPtr*)(_t65 +  *_t124 +  *_t124 +  *((intOrPtr*)(_t124 + _t65 +  *_t124 +  *_t124)) +  *_t124));
				 *_t70 =  *_t70 + _t70;
				 *_t124 =  *_t124 + _t70;
				_t76 = _t70 + 0x16;
				 *_t76 =  *_t76 + _t76;
				 *_t124 =  *_t124 + _t76;
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_t77 = _t76 +  *_t76;
				 *_t77 =  *_t77 + _t77;
				es = es;
				_t78 = _t77 |  *_t124;
				 *_t78 =  *_t78 + _t78;
				 *_t78 =  *_t78 + _t78;
				_t80 = _t78 +  *_t124 +  *_t124;
				_t83 = (_t80 |  *_t124) +  *_t124 +  *((intOrPtr*)((_t80 |  *_t124) +  *_t124));
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t83 =  *_t83 + _t83;
				 *_t124 =  *_t124 + _t83;
				_t84 = _t83 |  *_t124;
				 *_t84 =  *_t84 + _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t84 =  *_t84 + _t84;
				 *_t124 =  *_t124 + _t84;
				_t120 = _t112 +  *_t100 |  *_t100 |  *_t77 |  *_t124 |  *_t100 |  *_t80 |  *_t124 |  *_t124;
				_t85 = _t84 |  *_t124;
				 *_t85 =  *_t85 + _t85;
				 *_t85 =  *_t85 + _t85;
				 *_t85 =  *_t85 + _t85;
				 *_t85 =  *_t85 + _t85;
				 *_t85 =  *_t85 + _t85;
				 *_t124 =  *_t124 + _t85;
				_t86 = _t85 | 0x00020d0d;
				 *_t86 =  *_t86 + _t86;
				 *_t86 =  *_t86 + _t86;
				 *_t86 =  *_t86 + _t86;
				 *_t86 =  *_t86 + _t86;
				 *_t86 =  *_t86 + _t86;
				 *_t124 =  *_t124 + _t86;
				_t87 = _t86 +  *_t124;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + _t87;
				 *_t87 =  *_t87 + 1;
				_t102 = _t100 + _t100 + _t100 + _t100;
				 *_t87 =  *_t87 + 1;
				_t88 = _t87 + _t102;
				if (_t88 > 0) goto L12;
				_t89 = _t88 + _t102;
				asm("aas");
				 *_t89 =  *_t89 + _t89;
				asm("clc");
				asm("aas");
				 *_t89 =  *_t89 + _t89;
				asm("clc");
				asm("aas");
				 *_t89 =  *_t89 + _t89;
				asm("rol byte [edi], 0x0");
				 *((intOrPtr*)(_t89 - 0x7ffffffd)) =  *((intOrPtr*)(_t89 - 0x7ffffffd)) + _t89;
				_t90 = _t89 +  *_t89;
				 *((intOrPtr*)(_t90 - 0x3ffffffd)) =  *((intOrPtr*)(_t90 - 0x3ffffffd)) + _t90;
				es = es;
				 *_t90 =  *_t90 + _t90;
				asm("clc");
				asm("aas");
				 *_t90 =  *_t90 + _t90;
				asm("clc");
				asm("aas");
				 *_t90 =  *_t90 + _t90;
				asm("clc");
				asm("aas");
				 *_t90 =  *_t90 + _t90;
				asm("cld");
				if ( *_t90 > 0) goto L13;
				 *_t90 =  *_t90 + 1;
				 *_t90 =  *_t90 + _t120;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t124;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t120 =  *_t120 + _t90;
				 *_t90 =  *_t90 + _t120;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *_t90 =  *_t90 + _t90;
				 *((intOrPtr*)(_t126 - 0x5eff6061)) =  *((intOrPtr*)(_t126 - 0x5eff6061)) + _t102 + _t102;
				_t91 =  *0xa5a500a1;
				asm("movsd");
				 *((intOrPtr*)(_t124 - 0x4dff5556)) =  *((intOrPtr*)(_t124 - 0x4dff5556)) + _t120;
				_a12245889 =  *((intOrPtr*)(_t135 + 0xfffffffecdcd0cb4)) + 0xb2;
				return _t91;
			}












































        0x00401354
        0x00401354
        0x00401354
        0x00401354
        0x00401354
        0x00401359
        0x0040135e
        0x00401360
        0x00401362
        0x00401364
        0x00401366
        0x00401368
        0x00401369
        0x0040136b
        0x0040136d
        0x00401371
        0x00401372
        0x00401378
        0x00401379
        0x0040137a
        0x00401380
        0x00401382
        0x00401384
        0x00401386
        0x00401388
        0x0040138a
        0x0040138b
        0x0040138b
        0x00401391
        0x00401393
        0x00401395
        0x00401399
        0x0040139b
        0x0040139f
        0x004013a1
        0x004013a3
        0x004013a5
        0x004013a6
        0x004013af
        0x004013b2
        0x004013b8
        0x004013ba
        0x004013bb
        0x004013c0
        0x004013c1
        0x004013c4
        0x004013c5
        0x004013c7
        0x004013d2
        0x004013d4
        0x004013d5
        0x004013d8
        0x004013d8
        0x004013d9
        0x004013db
        0x004013dd
        0x004013df
        0x004013e1
        0x004013e3
        0x004013e5
        0x004013e7
        0x004013e9
        0x004013eb
        0x004013ed
        0x004013ef
        0x004013f1
        0x004013f3
        0x004013f5
        0x004013f7
        0x004013f9
        0x004013fb
        0x004013fd
        0x004013ff
        0x00401401
        0x00401401
        0x00401402
        0x00401404
        0x00401406
        0x00401408
        0x0040140a
        0x0040140b
        0x00401481
        0x00401481
        0x00401486
        0x00401487
        0x0040148d
        0x0040148f
        0x0040140d
        0x0040140d
        0x0040140d
        0x00401414
        0x00401418
        0x0040147f
        0x0040147f
        0x00000000
        0x0040141a
        0x0040141a
        0x0040147e
        0x0040147e
        0x00000000
        0x0040141d
        0x0040141d
        0x00401421
        0x00401423
        0x00401426
        0x00401428
        0x0040142d
        0x0040142f
        0x00401431
        0x00401435
        0x00401437
        0x00401439
        0x0040143b
        0x0040143d
        0x0040143f
        0x00401441
        0x00401443
        0x00401445
        0x00401447
        0x0040144a
        0x0040144c
        0x0040144d
        0x0040144f
        0x00401451
        0x00401453
        0x00401455
        0x00401457
        0x00401459
        0x0040145b
        0x0040145d
        0x0040145f
        0x00401461
        0x00401463
        0x00401465
        0x00401467
        0x00401469
        0x0040146b
        0x0040146d
        0x0040146f
        0x00401471
        0x00401473
        0x00401475
        0x00401477
        0x00401479
        0x0040147b
        0x00000000
        0x0040147b
        0x00401421
        0x0040141a
        0x00401418
        0x0040149b
        0x0040149d
        0x0040149e
        0x0040149f
        0x004014a1
        0x004014a2
        0x004014a5
        0x004014a9
        0x004014ab
        0x004014ad
        0x004014af
        0x004014b1
        0x004014b3
        0x004014b5
        0x004014b7
        0x004014b9
        0x004014bb
        0x004014bd
        0x004014bf
        0x004014c1
        0x004014c3
        0x004014c5
        0x004014c7
        0x004014c9
        0x004014cb
        0x004014cd
        0x004014cf
        0x004014d1
        0x004014d3
        0x004014d5
        0x004014d7
        0x004014d9
        0x004014db
        0x004014dd
        0x004014df
        0x004014e1
        0x004014e3
        0x004014e5
        0x004014e7
        0x004014e9
        0x004014eb
        0x004014ed
        0x004014ef
        0x004014f1
        0x004014f3
        0x004014f5
        0x004014f7
        0x004014f9
        0x004014fb
        0x004014fd
        0x004014ff
        0x00401501
        0x00401503
        0x00401505
        0x00401507
        0x00401509
        0x0040150b
        0x0040150d
        0x0040150f
        0x00401511
        0x00401513
        0x00401515
        0x00401517
        0x00401519
        0x0040151b
        0x0040151d
        0x0040151f
        0x00401521
        0x00401523
        0x00401525
        0x00401527
        0x00401529
        0x0040152b
        0x0040152d
        0x0040152f
        0x00401531
        0x00401533
        0x00401535
        0x00401537
        0x00401539
        0x0040153b
        0x0040153d
        0x0040153f
        0x00401541
        0x00401543
        0x00401545
        0x00401547
        0x00401549
        0x0040154b
        0x0040154d
        0x0040154f
        0x00401551
        0x00401553
        0x00401555
        0x00401557
        0x00401559
        0x0040155b
        0x0040155d
        0x0040155f
        0x00401561
        0x00401563
        0x00401565
        0x00401567
        0x00401569
        0x0040156b
        0x0040156d
        0x0040156f
        0x00401571
        0x00401573
        0x00401575
        0x00401577
        0x00401579
        0x0040157b
        0x0040157d
        0x0040157f
        0x00401581
        0x00401583
        0x00401585
        0x00401587
        0x00401589
        0x0040158b
        0x0040158d
        0x0040158f
        0x00401591
        0x00401593
        0x00401595
        0x00401597
        0x00401599
        0x0040159b
        0x0040159d
        0x0040159f
        0x004015a1
        0x004015a3
        0x004015a5
        0x004015a7
        0x004015a9
        0x004015ab
        0x004015ad
        0x004015af
        0x004015b1
        0x004015b3
        0x004015b5
        0x004015b7
        0x004015b9
        0x004015bb
        0x004015bd
        0x004015bf
        0x004015c1
        0x004015c3
        0x004015c5
        0x004015c7
        0x004015c9
        0x004015cb
        0x004015cd
        0x004015cf
        0x004015d1
        0x004015d3
        0x004015d5
        0x004015d7
        0x004015d9
        0x004015db
        0x004015dd
        0x004015df
        0x004015e1
        0x004015e3
        0x004015e5
        0x004015e7
        0x004015e9
        0x004015eb
        0x004015ed
        0x004015ef
        0x004015f1
        0x004015f3
        0x004015f5
        0x004015f7
        0x004015f9
        0x004015fb
        0x004015fd
        0x004015ff
        0x00401601
        0x00401603
        0x00401605
        0x00401607
        0x00401609
        0x0040160b
        0x0040160d
        0x0040160f
        0x00401611
        0x00401613
        0x00401615
        0x00401617
        0x00401619
        0x0040161b
        0x0040161d
        0x0040161f
        0x00401621
        0x00401623
        0x00401625
        0x00401627
        0x00401629
        0x0040162b
        0x0040162d
        0x0040162f
        0x00401631
        0x00401633
        0x00401635
        0x00401637
        0x00401639
        0x0040163b
        0x0040163d
        0x0040163f
        0x00401641
        0x00401643
        0x00401645
        0x00401647
        0x00401649
        0x0040164b
        0x0040164d
        0x0040164f
        0x00401651
        0x00401653
        0x00401655
        0x00401657
        0x00401659
        0x0040165b
        0x0040165d
        0x0040165f
        0x00401661
        0x00401663
        0x00401665
        0x00401667
        0x00401669
        0x0040166b
        0x0040166d
        0x0040166f
        0x00401671
        0x00401673
        0x00401675
        0x00401677
        0x00401679
        0x0040167b
        0x0040167d
        0x0040167f
        0x00401681
        0x00401683
        0x00401685
        0x00401687
        0x00401689
        0x0040168b
        0x0040168d
        0x0040168f
        0x00401691
        0x00401693
        0x00401695
        0x00401697
        0x00401699
        0x0040169b
        0x0040169d
        0x0040169f
        0x004016a1
        0x004016a3
        0x004016a5
        0x004016a7
        0x004016a9
        0x004016ab
        0x004016ad
        0x004016af
        0x004016b1
        0x004016b3
        0x004016b5
        0x004016b7
        0x004016b9
        0x004016bb
        0x004016bd
        0x004016bf
        0x004016c1
        0x004016c3
        0x004016c5
        0x004016c7
        0x004016c9
        0x004016cb
        0x004016cd
        0x004016cf
        0x004016d1
        0x004016d3
        0x004016d5
        0x004016d7
        0x004016d9
        0x004016db
        0x004016dd
        0x004016df
        0x004016e1
        0x004016e3
        0x004016e5
        0x004016e7
        0x004016e9
        0x004016eb
        0x004016ed
        0x004016ef
        0x004016f1
        0x004016f3
        0x004016f5
        0x004016f7
        0x004016f9
        0x004016fb
        0x004016fd
        0x004016ff
        0x00401701
        0x00401703
        0x00401705
        0x00401707
        0x00401709
        0x0040170b
        0x0040170d
        0x0040170f
        0x00401711
        0x00401713
        0x00401715
        0x00401717
        0x00401719
        0x0040171b
        0x0040171d
        0x0040171f
        0x00401721
        0x00401723
        0x00401725
        0x00401727
        0x00401729
        0x0040172b
        0x0040172d
        0x0040172f
        0x00401731
        0x00401733
        0x00401735
        0x00401737
        0x00401739
        0x0040173b
        0x0040173d
        0x0040173f
        0x00401741
        0x00401743
        0x00401745
        0x00401747
        0x00401749
        0x0040174b
        0x0040174d
        0x0040174f
        0x00401751
        0x00401753
        0x00401755
        0x00401757
        0x00401759
        0x0040175b
        0x0040175d
        0x0040175f
        0x00401761
        0x00401763
        0x00401765
        0x00401767
        0x00401769
        0x0040176b
        0x0040176d
        0x0040176f
        0x00401771
        0x00401773
        0x00401775
        0x00401777
        0x00401779
        0x0040177b
        0x0040177d
        0x0040177f
        0x00401781
        0x00401783
        0x00401785
        0x00401787
        0x00401789
        0x0040178b
        0x0040178d
        0x0040178f
        0x00401791
        0x00401793
        0x00401795
        0x00401797
        0x00401799
        0x0040179b
        0x0040179d
        0x0040179f
        0x004017a1
        0x004017a3
        0x004017a5
        0x004017a7
        0x004017a9
        0x004017ab
        0x004017ad
        0x004017af
        0x004017b1
        0x004017b3
        0x004017b5
        0x004017b7
        0x004017b9
        0x004017bb
        0x004017bd
        0x004017bf
        0x004017c1
        0x004017c3
        0x004017c5
        0x004017c7
        0x004017c9
        0x004017cb
        0x004017cd
        0x004017cf
        0x004017d1
        0x004017d3
        0x004017d5
        0x004017d7
        0x004017d9
        0x004017db
        0x004017dd
        0x004017df
        0x004017e1
        0x004017e3
        0x004017e5
        0x004017e7
        0x004017e9
        0x004017eb
        0x004017ed
        0x004017ef
        0x004017f1
        0x004017f3
        0x004017f5
        0x004017f7
        0x004017f9
        0x004017fb
        0x004017fd
        0x004017ff
        0x00401801
        0x00401803
        0x00401805
        0x00401807
        0x00401809
        0x0040180b
        0x0040180d
        0x0040180f
        0x00401811
        0x00401813
        0x00401815
        0x00401817
        0x00401819
        0x0040181b
        0x0040181d
        0x0040181f
        0x00401821
        0x00401823
        0x00401825
        0x00401827
        0x00401829
        0x0040182b
        0x0040182d
        0x0040182f
        0x00401831
        0x00401833
        0x00401835
        0x00401837
        0x00401839
        0x0040183b
        0x0040183d
        0x0040183f
        0x00401841
        0x00401843
        0x00401845
        0x00401847
        0x00401849
        0x0040184b
        0x0040184d
        0x0040184f
        0x00401851
        0x00401853
        0x00401855
        0x00401857
        0x00401859
        0x0040185b
        0x0040185d
        0x0040185f
        0x00401861
        0x00401863
        0x00401865
        0x00401867
        0x00401869
        0x0040186b
        0x0040186d
        0x0040186f
        0x00401871
        0x00401873
        0x00401875
        0x00401877
        0x00401879
        0x0040187b
        0x0040187d
        0x0040187f
        0x00401881
        0x00401883
        0x00401885
        0x00401887
        0x00401889
        0x0040188b
        0x0040188d
        0x0040188f
        0x00401891
        0x00401893
        0x00401895
        0x00401897
        0x00401899
        0x0040189b
        0x0040189d
        0x0040189f
        0x004018a1
        0x004018a3
        0x004018a5
        0x004018a7
        0x004018a9
        0x004018ab
        0x004018af
        0x004018b0
        0x004018b1
        0x004018b3
        0x004018b5
        0x004018b7
        0x004018b9
        0x004018bb
        0x004018bd
        0x004018bf
        0x004018c1
        0x004018c3
        0x004018c5
        0x004018c7
        0x004018c9
        0x004018cb
        0x004018d1
        0x004018d3
        0x004018d5
        0x004018d7
        0x004018d9
        0x004018e4
        0x004018e6
        0x004018e8
        0x004018f4
        0x004018f6
        0x004018f8
        0x004018fa
        0x004018fb
        0x004018fc
        0x004018fd
        0x004018fe
        0x004018ff
        0x00401900
        0x00401901
        0x00401902
        0x00401905
        0x00401907
        0x0040190f
        0x00401914
        0x00401916
        0x00401918
        0x0040191c
        0x00401924
        0x00401926
        0x00401928
        0x0040192a
        0x0040192c
        0x00401930
        0x00401932
        0x00401934
        0x00401936
        0x00401938
        0x0040193a
        0x0040193c
        0x0040193e
        0x00401940
        0x00401942
        0x00401944
        0x00401946
        0x00401948
        0x0040194a
        0x0040194c
        0x0040194e
        0x00401953
        0x00401955
        0x00401957
        0x00401959
        0x0040195b
        0x0040195d
        0x0040195f
        0x00401961
        0x00401963
        0x00401965
        0x00401967
        0x00401969
        0x0040196b
        0x0040196d
        0x0040196f
        0x00401971
        0x00401973
        0x00401975
        0x00401979
        0x0040197b
        0x0040197d
        0x0040197f
        0x00401981
        0x00401983
        0x00401985
        0x00401986
        0x00401988
        0x00401989
        0x0040198a
        0x0040198c
        0x0040198d
        0x0040198e
        0x00401990
        0x00401993
        0x00401999
        0x0040199b
        0x004019a1
        0x004019a2
        0x004019a4
        0x004019a5
        0x004019a6
        0x004019a8
        0x004019a9
        0x004019aa
        0x004019ac
        0x004019ad
        0x004019ae
        0x004019b0
        0x004019b1
        0x004019b5
        0x004019b7
        0x004019b9
        0x004019bb
        0x004019bd
        0x004019bf
        0x004019c1
        0x004019c3
        0x004019c5
        0x004019c7
        0x004019c9
        0x004019cb
        0x004019cd
        0x004019cf
        0x004019d1
        0x004019d3
        0x004019d5
        0x004019d7
        0x004019d9
        0x004019db
        0x004019dd
        0x004019df
        0x004019e1
        0x004019e3
        0x004019e9
        0x004019ee
        0x004019ef
        0x004019f7
        0x00401a02

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: 0732eda9fbf363cae1946ae74455cacb231da59d0c5ff64d184348764e79b701
        • Instruction ID: 719fac31c275215f9b4713353a07189c10f2d84ff6acbe7032340b47db40e992
        • Opcode Fuzzy Hash: 0732eda9fbf363cae1946ae74455cacb231da59d0c5ff64d184348764e79b701
        • Instruction Fuzzy Hash: 5851EC2544E7C14FD30387B4886A591BFB0AE17224B4E85EBC8C1CF5F3D26D980ACB66
        Uniqueness

        Uniqueness Score: -1.00%

        Function 00403475, Relevance: 1.5, APIs: 1, Instructions: 215COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: de60482d0c5eebe96256944f11e0c246bb057e6005a93b677c2f4eaa507622f7
        • Instruction ID: 628873b96ba288c63ea869d8b6a566d52befacabb5a0bbce5cc1573593ad09f2
        • Opcode Fuzzy Hash: de60482d0c5eebe96256944f11e0c246bb057e6005a93b677c2f4eaa507622f7
        • Instruction Fuzzy Hash: 54519EF2627385FBC3610F68ECA53A57BD5F742F50710597AC080D62A8DB2D4693E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 00403541, Relevance: 1.4, APIs: 1, Instructions: 193memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: fd5c28022d7b14f66e6872e6a9366538ed86c946f0c0f4204838abcf43fa7d74
        • Instruction ID: afc2f11bbe3aeb7f3d874b9708490824804a1eeea62dba2c84462366243841ce
        • Opcode Fuzzy Hash: fd5c28022d7b14f66e6872e6a9366538ed86c946f0c0f4204838abcf43fa7d74
        • Instruction Fuzzy Hash: A64159F362B385FBC3624F58E8653A57BD5F751F5034044AAC080DA26CEB2D56A3E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 004034ED, Relevance: 1.4, APIs: 1, Instructions: 190memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: bcd02568affa6c4fa24d17e601fd295f19ca6894ae8493ac290c4de7aa965e3c
        • Instruction ID: 723efedbaf670e3e205e397363e99a5121a112ad9e1fac076d6f705076a0522e
        • Opcode Fuzzy Hash: bcd02568affa6c4fa24d17e601fd295f19ca6894ae8493ac290c4de7aa965e3c
        • Instruction Fuzzy Hash: 3B418EF3627385FBC3624F68EC653A57BD5F741F5031058A9C080DA268EB2D5693E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040358F, Relevance: 1.4, APIs: 1, Instructions: 156memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: 11458ab7d0eb33e7d1af661252f13b268de5bf2b7b768e054324cd3ec03d4b30
        • Instruction ID: 2f5ae2b32e715f04bf6af2d0d57f1d116131e42feb1c5d5bf7e4566b83ce9267
        • Opcode Fuzzy Hash: 11458ab7d0eb33e7d1af661252f13b268de5bf2b7b768e054324cd3ec03d4b30
        • Instruction Fuzzy Hash: 534149F3627385EBC3A20F59F8653A57BD5B751F5034044A9C0C0DA26CEB2D1663E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040351F, Relevance: 1.4, APIs: 1, Instructions: 147memoryCOMMON
        Download Yara Rule
        APIs
        • VirtualAlloc.KERNELBASE(00000000,0000D000,-00000A91,FFFFFEC9,00403700), ref: 004035E7
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: a7cbd3758065020599cd17be141d216697a27c63e12adfbb196c57010bcb54ae
        • Instruction ID: 5939034ce64d2caf762c866d69bf1b7f8559d551d43002bbc0ccd35c85daedfd
        • Opcode Fuzzy Hash: a7cbd3758065020599cd17be141d216697a27c63e12adfbb196c57010bcb54ae
        • Instruction Fuzzy Hash: 184138F3627385EBC3A20F59F8653A57BD5B751F5034044A9C080D926CEB2D1663E70A
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Function 021F2519, Relevance: .1, Instructions: 147COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ccd7c736adfb6833e99c60fede6ac99cc959bb39c1dd38464d9f1dd0d9f414bb
        • Instruction ID: e034b5d9700333f5a5a4f6c76f8c35fcff5a2f6aca2ecb4d6686afc05f61fdf9
        • Opcode Fuzzy Hash: ccd7c736adfb6833e99c60fede6ac99cc959bb39c1dd38464d9f1dd0d9f414bb
        • Instruction Fuzzy Hash: 32419B70684301AFEB945F24C8A8BE973A6FF04364F914159EEB68B2E2D774C885CF51
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F2571, Relevance: .1, Instructions: 111COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a1de6e12a690250d06b30a0a23bf5c24d664545ca8fab859da865edf480f46e8
        • Instruction ID: 90b3d19855f5d90b103c8813d47b7ae14b9c76c28a9e05ceac16a3ba1f4e49ee
        • Opcode Fuzzy Hash: a1de6e12a690250d06b30a0a23bf5c24d664545ca8fab859da865edf480f46e8
        • Instruction Fuzzy Hash: 8231AF306817045FEB542A158968FDA73E9DF40794F514066DF628F393D7A08DC6C641
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F1850, Relevance: .1, Instructions: 62COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7891e955650c1472b1613c492d38ce2815e97fda6c37b44f78f922251f039f52
        • Instruction ID: d4f9ddd56570e822335d5b00023fcfb0845d235793bb1567e63a088fcd925623
        • Opcode Fuzzy Hash: 7891e955650c1472b1613c492d38ce2815e97fda6c37b44f78f922251f039f52
        • Instruction Fuzzy Hash: 06110471680249AFEF702E20CC54BCA3623FF92B10FE54114FE69571C5E7794681CB52
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F6006, Relevance: .0, Instructions: 33COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: fa85d354ee7670abcd870267b62f05b4764037ac87b09cea1d330b548ffde453
        • Instruction ID: 8708a5cc7797a11733440b1134b2f9597a947dd27011ca88f1ac1a52e89fe7ef
        • Opcode Fuzzy Hash: fa85d354ee7670abcd870267b62f05b4764037ac87b09cea1d330b548ffde453
        • Instruction Fuzzy Hash: 1FF03AB47486418FE398CA15CAC0F1A73AAAF95740F658468EA35C7656C735D880C620
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F34AA, Relevance: .0, Instructions: 33COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2ed2cd92c3539a8f628810169507c637954b7030f06927efc7b6d717cd25f2e3
        • Instruction ID: 9c6f005039ec71570f38b7068d34b269a92f08e43ea3892f7b489c2bff708cdc
        • Opcode Fuzzy Hash: 2ed2cd92c3539a8f628810169507c637954b7030f06927efc7b6d717cd25f2e3
        • Instruction Fuzzy Hash: E1F0A56BE22E580BE340640BC146F0AF2C9DBE0588F9160729A46CF327EBC49FD543C1
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F1A1F, Relevance: .0, Instructions: 28COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 31eb0dcfbc945cf54c4fd48099b1ecfc69a0032416b675da11d008a82869accd
        • Instruction ID: 839d5714c13e0ebb2734036a2b1f53563d1ff6728fb18dc1395885ce73119f11
        • Opcode Fuzzy Hash: 31eb0dcfbc945cf54c4fd48099b1ecfc69a0032416b675da11d008a82869accd
        • Instruction Fuzzy Hash: 4DE02B301802487FEBE55A008C40FCE321B6F85314F610100FF5C660D0D765A9508A15
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F34A8, Relevance: .0, Instructions: 10COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 93e41da55b7555f549cbc261019fdcdf89de4619b000cd0bcf65246427efcd37
        • Instruction ID: f77c7b2a87326561b77f5e9d4ee1ef4e0612fbc7f9f20be7cf2a7d534da81d3c
        • Opcode Fuzzy Hash: 93e41da55b7555f549cbc261019fdcdf89de4619b000cd0bcf65246427efcd37
        • Instruction Fuzzy Hash: 39C002BAB519848FF75ACA08C982B45B3A7A795745FC94490E026CB6A6D628EE40C601
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F2BD8, Relevance: .0, Instructions: 8COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7c8ce430631aa5a54b0f20eb3eae1a6635d88c70c49c577f191f8e34a626f931
        • Instruction ID: 3402f3441584e9afbb20f3e15d1a908e5a6717df0e448bd4278203a97162e5cd
        • Opcode Fuzzy Hash: 7c8ce430631aa5a54b0f20eb3eae1a6635d88c70c49c577f191f8e34a626f931
        • Instruction Fuzzy Hash: 02A0228E28C30B02EB320C888A0C3200000FB0B2B0EE002F00E22FA383E2EE8C000200
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F5A78, Relevance: .0, Instructions: 6COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 51e29902f6aa8004b73bf30c188af96b61040b6e259ab443869e9d8aee1e2ec0
        • Instruction ID: 3cc760c0003aaedddffc48b9b5468551ca5c8238650d5a64e996f39ef7507eb1
        • Opcode Fuzzy Hash: 51e29902f6aa8004b73bf30c188af96b61040b6e259ab443869e9d8aee1e2ec0
        • Instruction Fuzzy Hash: 4DB092742126808FC341CE08C080E80B3A1BB44B40F520890E800CBB11C364E800CA00
        Uniqueness

        Uniqueness Score: -1.00%

        Function 021F76CF, Relevance: .0, Instructions: 3COMMON
        Download Yara Rule
        Memory Dump Source
        • Source File: 00000000.00000002.1387800089.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: a01119da225e315b075405612d5ceddb45e15ab1b91e9dc2fc9138637cda8dbf
        • Instruction ID: d423e7d8e3b1d011b6385be6b950d1c950a69758382fdbfcbf6f8257127aefa3
        • Opcode Fuzzy Hash: a01119da225e315b075405612d5ceddb45e15ab1b91e9dc2fc9138637cda8dbf
        • Instruction Fuzzy Hash:
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E5BD, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98COMMON
        Download Yara Rule
        C-Code - Quality: 51%
        			E0040E5BD(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				intOrPtr _v80;
				intOrPtr* _v84;
				signed int _v88;
				intOrPtr* _v100;
				signed int _v104;
				char* _t42;
				signed int _t48;
				intOrPtr _t52;
				void* _t62;
				void* _t64;
				intOrPtr _t65;

				_t65 = _t64 - 0xc;
				 *[fs:0x0] = _t65;
				L004011E0();
				_v16 = _t65;
				_v12 = 0x401198;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x50,  *[fs:0x0], 0x4011e6, _t62);
				if( *0x40f010 != 0) {
					_v100 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v100 = 0x40f010;
				}
				_t52 =  *((intOrPtr*)( *_v100));
				_t42 =  &_v32;
				L0040131E();
				_v84 = _t42;
				_v72 = 0x80020004;
				_v80 = 0xa;
				_v56 = 0x80020004;
				_v64 = 0xa;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v56 =  *0x401194;
				_t48 =  *((intOrPtr*)( *_v84 + 0x204))(_v84, _t52, 0x10, 0x10, 0x10, _t42,  *((intOrPtr*)(_t52 + 0x304))( *_v100));
				asm("fclex");
				_v88 = _t48;
				if(_v88 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x204);
					_push(0x402ddc);
					_push(_v84);
					_push(_v88);
					L00401318();
					_v104 = _t48;
				}
				L004012EE();
				asm("wait");
				_push(0x40e6fd);
				return _t48;
			}























        0x0040e5c0
        0x0040e5cf
        0x0040e5d9
        0x0040e5e1
        0x0040e5e4
        0x0040e5eb
        0x0040e5fa
        0x0040e604
        0x0040e61e
        0x0040e606
        0x0040e606
        0x0040e60b
        0x0040e610
        0x0040e615
        0x0040e615
        0x0040e62f
        0x0040e639
        0x0040e63d
        0x0040e642
        0x0040e645
        0x0040e64c
        0x0040e653
        0x0040e65a
        0x0040e661
        0x0040e668
        0x0040e672
        0x0040e67c
        0x0040e67d
        0x0040e67e
        0x0040e67f
        0x0040e683
        0x0040e68d
        0x0040e68e
        0x0040e68f
        0x0040e690
        0x0040e694
        0x0040e69e
        0x0040e69f
        0x0040e6a0
        0x0040e6a1
        0x0040e6a9
        0x0040e6b4
        0x0040e6ba
        0x0040e6bc
        0x0040e6c3
        0x0040e6df
        0x0040e6c5
        0x0040e6c5
        0x0040e6ca
        0x0040e6cf
        0x0040e6d2
        0x0040e6d5
        0x0040e6da
        0x0040e6da
        0x0040e6e6
        0x0040e6eb
        0x0040e6ec
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E5D9
        • __vbaNew2.MSVBVM60(00402754,xqk,?,?,?,?,004011E6), ref: 0040E610
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040E63D
        • __vbaChkstk.MSVBVM60(?,00000000), ref: 0040E672
        • __vbaChkstk.MSVBVM60(?,00000000), ref: 0040E683
        • __vbaChkstk.MSVBVM60(?,00000000), ref: 0040E694
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402DDC,00000204,?,?,00000000), ref: 0040E6D5
        • __vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0040E6E6
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Chkstk$CheckFreeHresultNew2
        • String ID: xqk
        • API String ID: 3189907775-1239879837
        • Opcode ID: 427205aeeed7160c6b0840262c381a8e9cdc20c4572e2ddcd282a0cfcb115f97
        • Instruction ID: cf899655c662d00b2174c9ca7518ca3bfce7042b6736fdeeb8f9c79ba890dab6
        • Opcode Fuzzy Hash: 427205aeeed7160c6b0840262c381a8e9cdc20c4572e2ddcd282a0cfcb115f97
        • Instruction Fuzzy Hash: D2314870900708AFCB01DFD5D949B8DBBB6BF09704F20482AF901BF2A1C7BA5905CB09
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E726, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 52COMMON
        Download Yara Rule
        C-Code - Quality: 68%
        			E0040E726(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v32;
				char _v48;
				char* _v56;
				intOrPtr _v64;
				short _v68;
				signed int _t21;
				char* _t25;
				void* _t35;
				void* _t37;
				intOrPtr _t38;

				_t38 = _t37 - 0xc;
				 *[fs:0x0] = _t38;
				L004011E0();
				_v16 = _t38;
				_v12 = 0x4011a8;
				_v8 = 0;
				_t21 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x4011e6, _t35);
				_push(2);
				_push(0x402f24);
				L00401282();
				L004012D6();
				_push(_t21);
				_push(0x402f30);
				L004012DC();
				asm("sbb eax, eax");
				_v68 =  ~( ~( ~_t21));
				L0040130C();
				_t25 = _v68;
				if(_t25 != 0) {
					_v56 = L"Uza4XqOLcUXEH6vTy4hPhy6LxQaW8WzS7UbN40";
					_v64 = 8;
					L004012E8();
					_t25 =  &_v48;
					_push(_t25);
					L0040127C();
					L0040132A();
				}
				_push(0x40e7e6);
				return _t25;
			}
















        0x0040e729
        0x0040e738
        0x0040e742
        0x0040e74a
        0x0040e74d
        0x0040e754
        0x0040e763
        0x0040e766
        0x0040e768
        0x0040e76d
        0x0040e777
        0x0040e77c
        0x0040e77d
        0x0040e782
        0x0040e789
        0x0040e78f
        0x0040e796
        0x0040e79b
        0x0040e7a1
        0x0040e7a3
        0x0040e7aa
        0x0040e7b7
        0x0040e7bc
        0x0040e7bf
        0x0040e7c0
        0x0040e7c8
        0x0040e7c8
        0x0040e7cd
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E742
        • #512.MSVBVM60(00402F24,00000002,?,?,?,?,004011E6), ref: 0040E76D
        • __vbaStrMove.MSVBVM60(00402F24,00000002,?,?,?,?,004011E6), ref: 0040E777
        • __vbaStrCmp.MSVBVM60(00402F30,00000000,00402F24,00000002,?,?,?,?,004011E6), ref: 0040E782
        • __vbaFreeStr.MSVBVM60(00402F30,00000000,00402F24,00000002,?,?,?,?,004011E6), ref: 0040E796
        • __vbaVarDup.MSVBVM60 ref: 0040E7B7
        • #529.MSVBVM60(00000000), ref: 0040E7C0
        • __vbaFreeVar.MSVBVM60(00000000), ref: 0040E7C8
        Strings
        • Uza4XqOLcUXEH6vTy4hPhy6LxQaW8WzS7UbN40, xrefs: 0040E7A3
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#512#529ChkstkMove
        • String ID: Uza4XqOLcUXEH6vTy4hPhy6LxQaW8WzS7UbN40
        • API String ID: 3639670698-2977998
        • Opcode ID: 9fd2b24ecd1deaa6b8568a9ce64af38e352c7e931743b52ca58df9003f99f7c0
        • Instruction ID: 816b33d8d75bcfcf5fb18891f08a0dac1473ff6b82095c49c29224d6c8237700
        • Opcode Fuzzy Hash: 9fd2b24ecd1deaa6b8568a9ce64af38e352c7e931743b52ca58df9003f99f7c0
        • Instruction Fuzzy Hash: C7111F30940209ABCB14EBE6C946B9EB7B8AF08744F50857AF501FB1E1DBBC5905CB58
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E32F, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69COMMON
        Download Yara Rule
        C-Code - Quality: 49%
        			E0040E32F(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t29;
				signed int _t33;
				intOrPtr _t46;

				_push(0x4011e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x28);
				L004011E0();
				_v12 = _t46;
				_v8 = 0x401160;
				if( *0x40f010 != 0) {
					_v56 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v56 = 0x40f010;
				}
				_t29 =  &_v24;
				L0040131E();
				_v44 = _t29;
				_v32 = 0x80020004;
				_v40 = 0xa;
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t33 =  *((intOrPtr*)( *_v44 + 0x1ec))(_v44, L"s9rH0uOE9h2umGS100", 0x10, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x308))( *_v56));
				asm("fclex");
				_v48 = _t33;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x402ddc);
					_push(_v44);
					_push(_v48);
					L00401318();
					_v60 = _t33;
				}
				L004012EE();
				_push(0x40e418);
				return _t33;
			}















        0x0040e334
        0x0040e33f
        0x0040e340
        0x0040e347
        0x0040e34a
        0x0040e352
        0x0040e355
        0x0040e363
        0x0040e37d
        0x0040e365
        0x0040e365
        0x0040e36a
        0x0040e36f
        0x0040e374
        0x0040e374
        0x0040e398
        0x0040e39c
        0x0040e3a1
        0x0040e3a4
        0x0040e3ab
        0x0040e3b5
        0x0040e3bf
        0x0040e3c0
        0x0040e3c1
        0x0040e3c2
        0x0040e3d0
        0x0040e3d6
        0x0040e3d8
        0x0040e3df
        0x0040e3fb
        0x0040e3e1
        0x0040e3e1
        0x0040e3e6
        0x0040e3eb
        0x0040e3ee
        0x0040e3f1
        0x0040e3f6
        0x0040e3f6
        0x0040e402
        0x0040e407
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E34A
        • __vbaNew2.MSVBVM60(00402754,xqk,?,?,?,?,004011E6), ref: 0040E36F
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E39C
        • __vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E3B5
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402DDC,000001EC,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E3F1
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E402
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Chkstk$CheckFreeHresultNew2
        • String ID: s9rH0uOE9h2umGS100$xqk
        • API String ID: 3189907775-3056338220
        • Opcode ID: 32af3024979871865329785ff89f1c7a4a165fc7bc6f45bb200edc097ba7b202
        • Instruction ID: 2aaeee2bd846248e71f069aad2295cbfcad20d6aaf998332bd71c6034e89f924
        • Opcode Fuzzy Hash: 32af3024979871865329785ff89f1c7a4a165fc7bc6f45bb200edc097ba7b202
        • Instruction Fuzzy Hash: 50214C70900208AFCB10DF95D989BDDBBB5FB09714F20047AF501BB2E1C7B91944DB69
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E8C6, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72COMMON
        Download Yara Rule
        C-Code - Quality: 59%
        			E0040E8C6(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				signed int _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t37;
				signed int _t41;
				void* _t51;
				void* _t53;
				intOrPtr _t54;

				_t54 = _t53 - 0xc;
				 *[fs:0x0] = _t54;
				L004011E0();
				_v16 = _t54;
				_v12 = 0x4011c8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4011e6, _t51);
				if( *0x40f010 != 0) {
					_v68 = 0x40f010;
				} else {
					_push("xqk");
					_push(0x402754);
					L00401324();
					_v68 = 0x40f010;
				}
				_t37 =  &_v32;
				L0040131E();
				_v52 = _t37;
				_v40 = _v40 & 0x00000000;
				_v48 = 2;
				L004011E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t41 =  *((intOrPtr*)( *_v52 + 0x200))(_v52, 0x10, _t37,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x308))( *_v68));
				asm("fclex");
				_v56 = _t41;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x200);
					_push(0x402ddc);
					_push(_v52);
					_push(_v56);
					L00401318();
					_v72 = _t41;
				}
				L004012EE();
				_push(0x40e9ba);
				return _t41;
			}


















        0x0040e8c9
        0x0040e8d8
        0x0040e8e2
        0x0040e8ea
        0x0040e8ed
        0x0040e8f4
        0x0040e903
        0x0040e90d
        0x0040e927
        0x0040e90f
        0x0040e90f
        0x0040e914
        0x0040e919
        0x0040e91e
        0x0040e91e
        0x0040e942
        0x0040e946
        0x0040e94b
        0x0040e94e
        0x0040e952
        0x0040e95c
        0x0040e966
        0x0040e967
        0x0040e968
        0x0040e969
        0x0040e972
        0x0040e978
        0x0040e97a
        0x0040e981
        0x0040e99d
        0x0040e983
        0x0040e983
        0x0040e988
        0x0040e98d
        0x0040e990
        0x0040e993
        0x0040e998
        0x0040e998
        0x0040e9a4
        0x0040e9a9
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E8E2
        • __vbaNew2.MSVBVM60(00402754,xqk,?,?,?,?,004011E6), ref: 0040E919
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040E946
        • __vbaChkstk.MSVBVM60(?,00000000), ref: 0040E95C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402DDC,00000200), ref: 0040E993
        • __vbaFreeObj.MSVBVM60 ref: 0040E9A4
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Chkstk$CheckFreeHresultNew2
        • String ID: xqk
        • API String ID: 3189907775-1239879837
        • Opcode ID: 8bcab2cf514f5d6f8db4dd7e56be4a99f99796e7b202c5e161b56bcc8b4e4a29
        • Instruction ID: fbd41e7325d7c4b89c118a54f1270e5c84c16fa43d17a135a267476116bfc8be
        • Opcode Fuzzy Hash: 8bcab2cf514f5d6f8db4dd7e56be4a99f99796e7b202c5e161b56bcc8b4e4a29
        • Instruction Fuzzy Hash: 11212470910208EFDB10EF95D98AB9DBBB5BF08704F20447AF501BB2E2C7B96945DB58
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E80F, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMON
        Download Yara Rule
        C-Code - Quality: 71%
        			E0040E80F(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long long _v32;
				char _v56;
				char* _v64;
				intOrPtr _v72;
				char* _t18;
				void* _t25;
				void* _t27;
				intOrPtr _t28;

				_t28 = _t27 - 0xc;
				 *[fs:0x0] = _t28;
				L004011E0();
				_v16 = _t28;
				_v12 = 0x4011b8;
				_v8 = 0;
				_t18 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4011e6, _t25);
				_push(0x402f8c);
				L00401276();
				if(_t18 != 1) {
					_v64 = L"auWNn4TduPCda2qIaQXA176";
					_v72 = 8;
					L004012E8();
					_push(2);
					_t18 =  &_v56;
					_push(_t18);
					L00401270();
					_v32 = __fp0;
					L0040132A();
				}
				asm("wait");
				_push(0x40e89f);
				return _t18;
			}














        0x0040e812
        0x0040e821
        0x0040e82b
        0x0040e833
        0x0040e836
        0x0040e83d
        0x0040e84c
        0x0040e84f
        0x0040e854
        0x0040e85c
        0x0040e85e
        0x0040e865
        0x0040e872
        0x0040e877
        0x0040e879
        0x0040e87c
        0x0040e87d
        0x0040e882
        0x0040e888
        0x0040e888
        0x0040e88d
        0x0040e88e
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E82B
        • __vbaLenBstr.MSVBVM60(00402F8C,?,?,?,?,004011E6), ref: 0040E854
        • __vbaVarDup.MSVBVM60 ref: 0040E872
        • #600.MSVBVM60(?,00000002), ref: 0040E87D
        • __vbaFreeVar.MSVBVM60(?,00000002), ref: 0040E888
        Strings
        • auWNn4TduPCda2qIaQXA176, xrefs: 0040E85E
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#600BstrChkstkFree
        • String ID: auWNn4TduPCda2qIaQXA176
        • API String ID: 2986526412-1228655893
        • Opcode ID: 0a2c0e0d2e3001e2f021e565437040368db21e0af0e14cbab42da2c3e43f28da
        • Instruction ID: 32afc0dbe532c1f6a8ff95166c8e17cbffb7e10ba1eb090d30e334288858b585
        • Opcode Fuzzy Hash: 0a2c0e0d2e3001e2f021e565437040368db21e0af0e14cbab42da2c3e43f28da
        • Instruction Fuzzy Hash: D2011E71941209ABCB04EFD5C986B9DBBB8AF05744F50846AF500BB1E1DB785A05CB49
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E20C, Relevance: 9.1, APIs: 6, Instructions: 81COMMON
        Download Yara Rule
        C-Code - Quality: 53%
        			E0040E20C(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v28;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				short _v52;
				intOrPtr* _v60;
				signed int _v64;
				signed int _v68;
				signed int _t45;
				signed int _t50;
				short _t54;
				intOrPtr _t62;

				_push(0x4011e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t62;
				_push(0x30);
				L004011E0();
				_v12 = _t62;
				_v8 = 0x401150;
				if( *0x40f33c != 0) {
					_v60 = 0x40f33c;
				} else {
					_push(0x40f33c);
					_push(0x402e1c);
					L00401324();
					_v60 = 0x40f33c;
				}
				_v36 =  *_v60;
				_t45 =  *((intOrPtr*)( *_v36 + 0x14))(_v36,  &_v28);
				asm("fclex");
				_v40 = _t45;
				if(_v40 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x402e0c);
					_push(_v36);
					_push(_v40);
					L00401318();
					_v64 = _t45;
				}
				_v44 = _v28;
				_t50 =  *((intOrPtr*)( *_v44 + 0x100))(_v44,  &_v32);
				asm("fclex");
				_v48 = _t50;
				if(_v48 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x402edc);
					_push(_v44);
					_push(_v48);
					L00401318();
					_v68 = _t50;
				}
				_v52 =  ~(0 | _v32 != 0x00400000);
				L004012EE();
				_t54 = _v52;
				if(_t54 != 0) {
					_push(6);
					L004012A0();
					_v24 = _t54;
				}
				_push(0x40e31c);
				return _t54;
			}




















        0x0040e211
        0x0040e21c
        0x0040e21d
        0x0040e224
        0x0040e227
        0x0040e22f
        0x0040e232
        0x0040e240
        0x0040e25a
        0x0040e242
        0x0040e242
        0x0040e247
        0x0040e24c
        0x0040e251
        0x0040e251
        0x0040e266
        0x0040e275
        0x0040e278
        0x0040e27a
        0x0040e281
        0x0040e29a
        0x0040e283
        0x0040e283
        0x0040e285
        0x0040e28a
        0x0040e28d
        0x0040e290
        0x0040e295
        0x0040e295
        0x0040e2a1
        0x0040e2b0
        0x0040e2b6
        0x0040e2b8
        0x0040e2bf
        0x0040e2db
        0x0040e2c1
        0x0040e2c1
        0x0040e2c6
        0x0040e2cb
        0x0040e2ce
        0x0040e2d1
        0x0040e2d6
        0x0040e2d6
        0x0040e2ed
        0x0040e2f4
        0x0040e2f9
        0x0040e2ff
        0x0040e301
        0x0040e303
        0x0040e308
        0x0040e308
        0x0040e30b
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E227
        • __vbaNew2.MSVBVM60(00402E1C,0040F33C,?,?,?,?,004011E6), ref: 0040E24C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402E0C,00000014,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E290
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00402EDC,00000100,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E2D1
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E2F4
        • #569.MSVBVM60(00000006,?,?,?,?,?,?,?,?,?,?,?,?,?,004011E6), ref: 0040E303
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$#569ChkstkFreeNew2
        • String ID:
        • API String ID: 1758081487-0
        • Opcode ID: 2f0126cb60df57dd64e686bcf89cf6aca6c058a4d5b4cce543068d7d51ac9ed7
        • Instruction ID: 0a5216f7ea2b7c3e5c5b9f21ed1fc204e2b1798acd178545fa0f111e93bf384e
        • Opcode Fuzzy Hash: 2f0126cb60df57dd64e686bcf89cf6aca6c058a4d5b4cce543068d7d51ac9ed7
        • Instruction Fuzzy Hash: 31311270D40208EFDB10DBA6C94ABEEBBF4BB08754F10447AF501B62E0C7B85855CB68
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E42B, Relevance: 7.6, APIs: 5, Instructions: 65COMMON
        Download Yara Rule
        C-Code - Quality: 49%
        			E0040E42B(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, long long __fp0) {
				intOrPtr _v8;
				long long* _v12;
				intOrPtr _v24;
				intOrPtr _v36;
				char _v44;
				intOrPtr _v52;
				char _v60;
				short _v96;
				signed int _v104;
				short _t26;
				long long* _t33;

				_push(0x4011e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t33;
				_push(0x54);
				L004011E0();
				_v12 = _t33;
				_v8 = 0x401178;
				_v52 = 0x80020004;
				_v60 = 0xa;
				_v36 = 0x80020004;
				_v44 = 0xa;
				_push( &_v60);
				_push( &_v44);
				asm("fld1");
				 *_t33 = __fp0;
				asm("fld1");
				 *_t33 = __fp0;
				asm("fld1");
				 *_t33 = __fp0;
				L00401294();
				L0040129A();
				asm("fcomp qword [0x401170]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags == 0) {
					_t10 =  &_v104;
					 *_t10 = _v104 & 0x00000000;
					__eflags =  *_t10;
				} else {
					_v104 = 1;
				}
				_v96 =  ~_v104;
				_push( &_v60);
				_push( &_v44);
				_push(2);
				L004012A6();
				_t26 = _v96;
				if(_t26 != 0) {
					_push(0xa9);
					L0040128E();
					_v24 = _t26;
				}
				asm("wait");
				_push(0x40e4ff);
				return _t26;
			}














        0x0040e430
        0x0040e43b
        0x0040e43c
        0x0040e443
        0x0040e446
        0x0040e44e
        0x0040e451
        0x0040e458
        0x0040e45f
        0x0040e466
        0x0040e46d
        0x0040e477
        0x0040e47b
        0x0040e47c
        0x0040e480
        0x0040e483
        0x0040e487
        0x0040e48a
        0x0040e48e
        0x0040e491
        0x0040e496
        0x0040e49b
        0x0040e4a1
        0x0040e4a3
        0x0040e4a4
        0x0040e4af
        0x0040e4af
        0x0040e4af
        0x0040e4a6
        0x0040e4a6
        0x0040e4a6
        0x0040e4b8
        0x0040e4bf
        0x0040e4c3
        0x0040e4c4
        0x0040e4c6
        0x0040e4ce
        0x0040e4d4
        0x0040e4d6
        0x0040e4db
        0x0040e4e0
        0x0040e4e0
        0x0040e4e3
        0x0040e4e4
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E446
        • #679.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 0040E491
        • __vbaFpR8.MSVBVM60(?,?,?,?,?,?,0000000A,0000000A), ref: 0040E496
        • __vbaFreeVarList.MSVBVM60(00000002,0000000A,0000000A,?,?,?,?,?,?,?,?,?,0000000A,0000000A), ref: 0040E4C6
        • #570.MSVBVM60(000000A9), ref: 0040E4DB
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#570#679ChkstkFreeList
        • String ID:
        • API String ID: 1921519738-0
        • Opcode ID: 992f70c3317e9672dc9cd3cc16a2095457a577a5e9d9f774a1ddb178ccb916d2
        • Instruction ID: 4deacc27b47e900a2b727703435e47afd96e9bb03e1eb4063fe8f4596657b98c
        • Opcode Fuzzy Hash: 992f70c3317e9672dc9cd3cc16a2095457a577a5e9d9f774a1ddb178ccb916d2
        • Instruction Fuzzy Hash: 26114FB1950308AADB05DFD2D946BEEBBBCEB04B10F14452FF100BA290D7B855548769
        Uniqueness

        Uniqueness Score: -1.00%

        Function 0040E51A, Relevance: 7.5, APIs: 5, Instructions: 34COMMON
        Download Yara Rule
        C-Code - Quality: 77%
        			E0040E51A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v48;
				intOrPtr _v52;
				intOrPtr _t15;
				void* _t22;
				void* _t24;
				intOrPtr _t25;

				_t25 = _t24 - 0xc;
				 *[fs:0x0] = _t25;
				L004011E0();
				_v16 = _t25;
				_v12 = 0x401188;
				_v8 = 0;
				_t15 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4011e6, _t22);
				L004012E8();
				_push(0x402f1c);
				L00401288();
				if(_t15 != 0x61) {
					_push(0xb0);
					L004012A0();
					_v52 = _t15;
				}
				_push(0x40e590);
				L0040132A();
				return _t15;
			}












        0x0040e51d
        0x0040e52c
        0x0040e536
        0x0040e53e
        0x0040e541
        0x0040e548
        0x0040e557
        0x0040e560
        0x0040e565
        0x0040e56a
        0x0040e573
        0x0040e575
        0x0040e57a
        0x0040e57f
        0x0040e57f
        0x0040e582
        0x0040e58a
        0x0040e58f

        APIs
        • __vbaChkstk.MSVBVM60(?,004011E6), ref: 0040E536
        • __vbaVarDup.MSVBVM60(?,?,?,?,004011E6), ref: 0040E560
        • #696.MSVBVM60(00402F1C,?,?,?,?,004011E6), ref: 0040E56A
        • #569.MSVBVM60(000000B0,00402F1C,?,?,?,?,004011E6), ref: 0040E57A
        • __vbaFreeVar.MSVBVM60(0040E590,00402F1C,?,?,?,?,004011E6), ref: 0040E58A
        Memory Dump Source
        • Source File: 00000000.00000002.1387063826.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1387049656.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387092258.000000000040F000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1387127205.0000000000411000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#569#696ChkstkFree
        • String ID:
        • API String ID: 3176559447-0
        • Opcode ID: 8f096bb04af9eaac33bc63e09c7b25ef31132968097f7fe28b1c00affbf6fec0
        • Instruction ID: 9a8608fc0101f2249552cb7f6a76e1a43d4d6085daebf953bda247cd84676894
        • Opcode Fuzzy Hash: 8f096bb04af9eaac33bc63e09c7b25ef31132968097f7fe28b1c00affbf6fec0
        • Instruction Fuzzy Hash: 22F03C30940209BBCB00AFE9C946B8D7BB4EB04748F90C57AF900BA2E1D7B85A058B59
        Uniqueness

        Uniqueness Score: -1.00%