Play interactive tour

Edit tour

Analysis Report Tracking No_SINI0035249718.exe

Overview

General Information

Sample Name:	Tracking No_SINI0035249718.exe
Analysis ID:	343751
MD5:	9d7f4dcaf5e6ef75ed4eae0f16dfc7d7
SHA1:	0e81a911c016cb15a0f4bcb80c0ba0427953edc7
SHA256:	dd2e44f31e3158a713931d11f336664a5b23890471461ffd06a5515bca9485c1
Tags:	exe
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Tracking No_SINI0035249718.exe (PID: 6032 cmdline: 'C:\Users\user\Desktop\Tracking No_SINI0035249718.exe' MD5: 9D7F4DCAF5E6EF75ED4EAE0F16DFC7D7)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Tracking No_SINI0035249718.exe	Virustotal: Detection: 22%			Perma Link
Source: Tracking No_SINI0035249718.exe	ReversingLabs: Detection: 15%

Compliance:

Uses 32bit PE files

Show sources

Source: Tracking No_SINI0035249718.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766058148.000000000078A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Process Stats: CPU usage > 98%

Source: Tracking No_SINI0035249718.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGimpy.exe vs Tracking No_SINI0035249718.exe
Source: Tracking No_SINI0035249718.exe	Binary or memory string: OriginalFilenameGimpy.exe vs Tracking No_SINI0035249718.exe

Source: Tracking No_SINI0035249718.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

File created: C:\Users\user\AppData\Local\Temp\~DF9483F3C9D699138F.TMP

Jump to behavior

Source: Tracking No_SINI0035249718.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Tracking No_SINI0035249718.exe	Virustotal: Detection: 22%
Source: Tracking No_SINI0035249718.exe	ReversingLabs: Detection: 15%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: Tracking No_SINI0035249718.exe PID: 6032, type: MEMORY

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00401480 push ds; retf	0_2_004014E3
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0040149C push ds; retf	0_2_004014E3
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00402DCD push ds; retf	0_2_00402E76
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00406FD1 push edx; ret	0_2_00406FFF

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075247F	0_2_0075247F
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752E61	0_2_00752E61
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075125B	0_2_0075125B
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752842	0_2_00752842
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752620	0_2_00752620
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075282D	0_2_0075282D
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752CEF	0_2_00752CEF
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075629D	0_2_0075629D
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00754545	0_2_00754545
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075273B	0_2_0075273B
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00751B23	0_2_00751B23
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752B1D	0_2_00752B1D
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075370D	0_2_0075370D
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752DB5	0_2_00752DB5
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_007521BE	0_2_007521BE
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00752BB9	0_2_00752BB9

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

RDTSC instruction interceptor: First address: 0000000000756A61 second address: 0000000000756A61 instructions:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Tracking No_SINI0035249718.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	RDTSC instruction interceptor: First address: 0000000000756A61 second address: 0000000000756A61 instructions:
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	RDTSC instruction interceptor: First address: 000000000075658E second address: 000000000075658E instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F608884DB2Dh 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp ch, bh 0x0000001f cmp ebx, edx 0x00000021 add edi, edx 0x00000023 cmp cx, 703Bh 0x00000028 dec dword ptr [ebp+000000F8h] 0x0000002e jmp 00007F608884DB46h 0x00000030 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000037 jne 00007F608884DAD5h 0x00000039 cmp ebx, 7B9ECC22h 0x0000003f cmp eax, edx 0x00000041 call 00007F608884DBC4h 0x00000046 call 00007F608884DB3Dh 0x0000004b lfence 0x0000004e mov edx, dword ptr [7FFE0014h] 0x00000054 lfence 0x00000057 ret 0x00000058 mov esi, edx 0x0000005a pushad 0x0000005b rdtsc

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Code function: 0_2_0075247F rdtsc

0_2_0075247F

Source: Tracking No_SINI0035249718.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe

Code function: 0_2_0075247F rdtsc

0_2_0075247F

Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_0075247F mov eax, dword ptr fs:[00000030h]	0_2_0075247F
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00755C4B mov eax, dword ptr fs:[00000030h]	0_2_00755C4B
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_007534AB mov eax, dword ptr fs:[00000030h]	0_2_007534AB
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00751B23 mov eax, dword ptr fs:[00000030h]	0_2_00751B23
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_007521FD mov eax, dword ptr fs:[00000030h]	0_2_007521FD
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_007521BE mov eax, dword ptr fs:[00000030h]	0_2_007521BE
Source: C:\Users\user\Desktop\Tracking No_SINI0035249718.exe	Code function: 0_2_00756188 mov eax, dword ptr fs:[00000030h]	0_2_00756188

HIPS / PFW / Operating System Protection Evasion:

Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Tracking No_SINI0035249718.exe, 00000000.00000002.1766299299.0000000000D10000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Process Injection1	Input Capture1	Security Software Discovery411	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	System Information Discovery31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Tracking No_SINI0035249718.exe	23%	Virustotal		Browse
Tracking No_SINI0035249718.exe	15%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	343751
Start date:	25.01.2021
Start time:	15:28:19
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Tracking No_SINI0035249718.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 5.5% (good quality ratio 5%) Quality average: 52% Quality standard deviation: 18.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.820289814070592
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Tracking No_SINI0035249718.exe
File size:	102400
MD5:	9d7f4dcaf5e6ef75ed4eae0f16dfc7d7
SHA1:	0e81a911c016cb15a0f4bcb80c0ba0427953edc7
SHA256:	dd2e44f31e3158a713931d11f336664a5b23890471461ffd06a5515bca9485c1
SHA512:	5832d4e862e5855a3dce9029651151cf37ecbdc26bf582c922bc2b66e57adadc1878f096760be8ccd208a6db881d0f69c56cfdebf4f1717622e7b89d139efea9
SSDEEP:	1536:RWZsVu2tSB8dwLgo/WDkfzvx1IbxuO0zd2gGOc4cffuxX1:i8u2I63iFfzp1iD0B2gGOc4cut1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...._.T.................`...0...............p....@................

File Icon


Icon Hash:	f030f0c6f030b100

Static PE Info

General
Entrypoint:	0x401480
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x548B5FA0 [Fri Dec 12 21:35:28 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	901434c98a0ac9771b4195fb76cfab24

Entrypoint Preview

Instruction
push 00402120h
call 00007F60887DC6F5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-5060F6DBh], bl
xchg byte ptr [edx-68h], cl
pop ds
fcomi st(0), st(4)
shr edi, FFFFFFC6h
push ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
or eax, 200A0D0Ah
and byte ptr [eax+72h], dl
outsd
push 00000065h
arpl word ptr [ecx+esi+00h], si
push ebp
xor dh, byte ptr [edx+esi+33h]
cmp byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add al, 58h
xor al, dl
sub ecx, dword ptr [edi-52BC388Ah]
sal byte ptr [esi-42h], FFFFFF9Eh
push ds
retf
in al, dx
push ss
loopne 00007F60887DC720h
fxch4 st(4)
outsb
inc esi
xchg dword ptr [edx-319A1A0Ch], ebx
sbb dword ptr [esi+33AD4F3Ah], esi
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
out dx, al
or eax, dword ptr [eax]
add byte ptr [0000000Bh], bh
or al, byte ptr [eax]
push ebx
dec ebx
dec edi
push esi
dec esp
inc esi
push ebp
dec esp
inc esp
inc ebp
add byte ptr [54000901h], cl
outsb
je 00007F60887DC779h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15c94	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0xa2c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x124	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15190	0x16000	False	0.474165482955	data	6.23820218517	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x11a4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0xa2c	0x1000	False	0.15478515625	data	1.66464717922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x194c4	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x194b0	0x14	data
RT_VERSION	0x190f0	0x3c0	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Trademark International
InternalName	Gimpy
FileVersion	1.00
CompanyName	Native Instruments Nanosystems S.r.l.
LegalTrademarks	Trademark International
Comments	Native Instruments Nanosystems S.r.l.
ProductName	Native Instruments Nanosystems S.r.l.
ProductVersion	1.00
FileDescription	Native
OriginalFilename	Gimpy.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Tracking No_SINI0035249718.exe PID: 6032 Parent PID: 5908

General

Start time:	15:29:06
Start date:	25/01/2021
Path:	C:\Users\user\Desktop\Tracking No_SINI0035249718.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Tracking No_SINI0035249718.exe'
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	9D7F4DCAF5E6EF75ED4EAE0F16DFC7D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Tracking No_SINI0035249718.exe PID: 6032 Parent PID: 5908 Tracking No_SINI0035249718.exeCOMMON

Executed Functions

Function 0040ECC4, Relevance: 313.7, APIs: 169, Strings: 9, Instructions: 2191
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040ECC4(signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v40;
				char _v56;
				char _v60;
				long long _v68;
				void* _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v104;
				long long _v108;
				short _v112;
				intOrPtr _v132;
				char _v136;
				signed int _v140;
				char _v144;
				char _v148;
				signed int _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				intOrPtr _v176;
				char _v184;
				intOrPtr _v192;
				char _v200;
				char* _v208;
				char _v216;
				intOrPtr _v224;
				char _v232;
				signed int _v240;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				char _v288;
				intOrPtr _v292;
				long long _v296;
				char _v304;
				intOrPtr _v308;
				char _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr* _v348;
				signed int _v352;
				char _v368;
				char _v384;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				char* _v420;
				intOrPtr _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				signed int _v440;
				intOrPtr* _v444;
				signed int _v448;
				intOrPtr* _v452;
				signed int _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				intOrPtr* _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				intOrPtr* _v520;
				signed int _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				intOrPtr* _v564;
				signed int _v568;
				intOrPtr* _v572;
				signed int _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				intOrPtr* _v592;
				signed int _v596;
				intOrPtr* _v600;
				signed int _v604;
				intOrPtr* _v608;
				signed int _v612;
				intOrPtr* _v616;
				signed int _v620;
				intOrPtr* _v624;
				signed int _v628;
				intOrPtr* _v632;
				signed int _v636;
				signed int _v640;
				intOrPtr* _v644;
				signed int _v648;
				intOrPtr* _v652;
				signed int _v656;
				intOrPtr* _v660;
				signed int _v664;
				intOrPtr* _v668;
				signed int _v672;
				intOrPtr* _v676;
				signed int _v680;
				intOrPtr* _v684;
				signed int _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr* _v704;
				signed int _v708;
				intOrPtr* _v712;
				signed int _v716;
				intOrPtr* _v720;
				signed int _v724;
				intOrPtr* _v728;
				signed int _v732;
				intOrPtr* _v736;
				signed int _v740;
				signed int _v744;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1103;
				signed int _t1107;
				signed int _t1111;
				signed int _t1115;
				signed int _t1119;
				signed int _t1127;
				signed int _t1134;
				signed int _t1138;
				signed int _t1142;
				signed int _t1146;
				signed int _t1150;
				signed int _t1154;
				signed int _t1159;
				signed int _t1163;
				char* _t1165;
				char* _t1168;
				signed int _t1190;
				signed int _t1194;
				signed int _t1198;
				signed int _t1202;
				signed int _t1221;
				signed int _t1225;
				signed int _t1229;
				signed int _t1233;
				signed int _t1240;
				signed int _t1248;
				signed int _t1252;
				signed int _t1263;
				signed int _t1267;
				signed int _t1271;
				signed int _t1275;
				signed int _t1291;
				signed int _t1295;
				signed int _t1299;
				signed int _t1303;
				signed int _t1319;
				signed int _t1323;
				signed int _t1329;
				signed int _t1333;
				signed int _t1337;
				signed int _t1341;
				signed int _t1345;
				signed int _t1349;
				signed int _t1353;
				signed int _t1357;
				signed int _t1361;
				signed int _t1380;
				signed int _t1384;
				signed int _t1388;
				signed int _t1392;
				signed int _t1396;
				signed int _t1400;
				signed int _t1406;
				signed int _t1414;
				signed int _t1418;
				signed int _t1422;
				signed int _t1426;
				signed int _t1430;
				signed int _t1434;
				signed int _t1438;
				signed int _t1442;
				char* _t1443;
				char* _t1468;
				signed int _t1472;
				signed int _t1476;
				signed int _t1480;
				signed int _t1484;
				signed int _t1493;
				signed int _t1499;
				signed int _t1503;
				signed int _t1508;
				signed int _t1512;
				signed int _t1516;
				signed int _t1520;
				signed int _t1524;
				signed int _t1528;
				char* _t1532;
				signed int _t1536;
				char* _t1543;
				signed int _t1560;
				signed int _t1564;
				signed int _t1571;
				char* _t1574;
				void* _t1575;
				signed int* _t1579;
				intOrPtr _t1587;
				char* _t1600;
				intOrPtr _t1618;
				intOrPtr _t1626;
				char* _t1652;
				intOrPtr _t1662;
				intOrPtr _t1697;
				intOrPtr _t1701;
				char* _t1711;
				void* _t1712;
				void* _t1713;
				void* _t1722;
				long long* _t1731;
				void* _t1732;
				void* _t1733;
				void* _t1736;
				void* _t1738;
				void* _t1739;
				void* _t1740;
				intOrPtr* _t1741;
				intOrPtr* _t1742;
				void* _t1743;
				intOrPtr* _t1744;
				intOrPtr* _t1746;
				void* _t1747;
				intOrPtr* _t1748;

				 *[fs:0x0] = _t1731;
				L004012D0();
				_v16 = _t1731;
				_v12 = 0x4011b0;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, _t1713, _t1722, _t1575,  *[fs:0x0], 0x4012d6);
				_t1086 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4);
				_v316 = _t1086;
				if(_v316 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402e78);
					_push(_a4);
					_push(_v316);
					L00401462();
					_v428 = _t1086;
				}
				if( *0x417010 != 0) {
					_v432 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v432 = 0x417010;
				}
				_t1090 =  &_v148;
				L0040145C();
				_v316 = _t1090;
				_t1094 =  *((intOrPtr*)( *_v316 + 0x160))(_v316,  &_v268, _t1090,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x304))( *_v432));
				asm("fclex");
				_v320 = _t1094;
				if(_v320 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v436 = _t1094;
				}
				_v312 = 0x89a062f0;
				_v308 = 0x5aff;
				_v304 =  *0x4011a8;
				_v208 = L"Intetkoen6";
				_v216 = 8;
				_v296 =  *0x4011a0;
				_v288 = 0x295df0f0;
				_v284 = 0x5b00;
				_t1579 =  &_v140;
				L00401450();
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 =  *0x401198;
				_t1103 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _t1579, _t1579,  &_v140, 0x1ba0,  &_v288, _v268,  &_v296, 0x10,  &_v304,  &_v312, 0x4cf1d8);
				_v324 = _t1103;
				if(_v324 >= 0) {
					_v440 = _v440 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402e78);
					_push(_a4);
					_push(_v324);
					L00401462();
					_v440 = _t1103;
				}
				L0040144A();
				L00401444();
				if( *0x417010 != 0) {
					_v444 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v444 = 0x417010;
				}
				_t1107 =  &_v148;
				L0040145C();
				_v316 = _t1107;
				_t1111 =  *((intOrPtr*)( *_v316 + 0x88))(_v316,  &_v268, _t1107,  *((intOrPtr*)( *((intOrPtr*)( *_v444)) + 0x308))( *_v444));
				asm("fclex");
				_v320 = _t1111;
				if(_v320 >= 0) {
					_v448 = _v448 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v448 = _t1111;
				}
				if( *0x417010 != 0) {
					_v452 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v452 = 0x417010;
				}
				_t1587 =  *((intOrPtr*)( *_v452));
				_t1115 =  &_v152;
				L0040145C();
				_v324 = _t1115;
				_t1119 =  *((intOrPtr*)( *_v324 + 0x78))(_v324,  &_v272, _t1115,  *((intOrPtr*)(_t1587 + 0x2fc))( *_v452));
				asm("fclex");
				_v328 = _t1119;
				if(_v328 >= 0) {
					_v456 = _v456 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403034);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v456 = _t1119;
				}
				_v252 = 0x417b;
				_v288 = 0xeea80150;
				_v284 = 0x5b02;
				_v280 = _v268;
				_v276 =  *0x401190;
				_v160 = _v272;
				 *_t1731 =  *0x401188;
				_t1127 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v276,  &_v280, _t1587, _t1587,  &_v288, _t1587,  &_v252,  &_v256);
				_v332 = _t1127;
				if(_v332 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x402e78);
					_push(_a4);
					_push(_v332);
					L00401462();
					_v460 = _t1127;
				}
				_v112 = _v256;
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1732 = _t1731 + 0xc;
				if( *0x417010 != 0) {
					_v464 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v464 = 0x417010;
				}
				_t1134 =  &_v148;
				L0040145C();
				_v316 = _t1134;
				_t1138 =  *((intOrPtr*)( *_v316 + 0x170))(_v316,  &_v140, _t1134,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x2fc))( *_v464));
				asm("fclex");
				_v320 = _t1138;
				if(_v320 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x403034);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v468 = _t1138;
				}
				if( *0x417010 != 0) {
					_v472 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v472 = 0x417010;
				}
				_t1142 =  &_v152;
				L0040145C();
				_v324 = _t1142;
				_t1146 =  *((intOrPtr*)( *_v324 + 0x78))(_v324,  &_v268, _t1142,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x2fc))( *_v472));
				asm("fclex");
				_v328 = _t1146;
				if(_v328 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403034);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v476 = _t1146;
				}
				if( *0x417010 != 0) {
					_v480 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v480 = 0x417010;
				}
				_t1150 =  &_v156;
				L0040145C();
				_v332 = _t1150;
				_t1154 =  *((intOrPtr*)( *_v332 + 0x158))(_v332,  &_v160, _t1150,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x2fc))( *_v480));
				asm("fclex");
				_v336 = _t1154;
				if(_v336 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403034);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v484 = _t1154;
				}
				_push(0);
				_push(0);
				_push(_v160);
				_push( &_v184);
				L00401438();
				_t1733 = _t1732 + 0x10;
				if( *0x417010 != 0) {
					_v488 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v488 = 0x417010;
				}
				_t1159 =  &_v164;
				L0040145C();
				_v340 = _t1159;
				_t1163 =  *((intOrPtr*)( *_v340 + 0x160))(_v340,  &_v168, _t1159,  *((intOrPtr*)( *((intOrPtr*)( *_v488)) + 0x2fc))( *_v488));
				asm("fclex");
				_v344 = _t1163;
				if(_v344 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x403034);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v492 = _t1163;
				}
				L00401438();
				_t1165 =  &_v184;
				L00401432();
				_v276 = _t1165;
				_v272 = _v268;
				_v252 = 0x6849;
				_v208 = L"Performer";
				_v216 = 8;
				_v396 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1600 =  &_v144;
				L0040142C();
				_t1168 =  &_v200;
				L00401432();
				_v288 =  *0x401180;
				_v296 =  *0x401178;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v144, 0x10,  &_v252,  &_v272, _t1600, _t1600, _t1600,  &_v276, _t1168, _t1168,  &_v288, _t1165,  &_v200, _v168, 0, 0);
				_v92 = _v288;
				_v88 = _v284;
				L0040144A();
				_push( &_v168);
				_push( &_v160);
				_push( &_v164);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(6);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1736 = _t1733 + 0x38;
				if( *0x417010 != 0) {
					_v496 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v496 = 0x417010;
				}
				_t1190 =  &_v148;
				L0040145C();
				_v316 = _t1190;
				_t1194 =  *((intOrPtr*)( *_v316 + 0x178))(_v316,  &_v152, _t1190,  *((intOrPtr*)( *((intOrPtr*)( *_v496)) + 0x304))( *_v496));
				asm("fclex");
				_v320 = _t1194;
				if(_v320 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v500 = _t1194;
				}
				if( *0x417010 != 0) {
					_v504 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v504 = 0x417010;
				}
				_t1198 =  &_v156;
				L0040145C();
				_v324 = _t1198;
				_t1202 =  *((intOrPtr*)( *_v324 + 0xe0))(_v324,  &_v252, _t1198,  *((intOrPtr*)( *((intOrPtr*)( *_v504)) + 0x300))( *_v504));
				asm("fclex");
				_v328 = _t1202;
				if(_v328 >= 0) {
					_v508 = _v508 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x403080);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v508 = _t1202;
				}
				_v256 = _v252;
				_v268 =  *0x401174;
				_v192 = 0x789d91;
				_v200 = 3;
				_v400 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v400;
				_v184 = 9;
				_v208 = L"Arbejdsfelterne";
				_v216 = 8;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x720))(_a4, 0x25a4, 0x10,  &_v184,  &_v200,  &_v268, 0x46a8,  &_v256);
				_push( &_v156);
				_push( &_v148);
				_push(2);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1738 = _t1736 + 0x18;
				if( *0x417010 != 0) {
					_v512 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v512 = 0x417010;
				}
				_t1221 =  &_v148;
				L0040145C();
				_v316 = _t1221;
				_t1225 =  *((intOrPtr*)( *_v316 + 0xd0))(_v316,  &_v252, _t1221,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x300))( *_v512));
				asm("fclex");
				_v320 = _t1225;
				if(_v320 >= 0) {
					_v516 = _v516 & 0x00000000;
				} else {
					_push(0xd0);
					_push(0x403080);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v516 = _t1225;
				}
				if( *0x417010 != 0) {
					_v520 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v520 = 0x417010;
				}
				_t1229 =  &_v152;
				L0040145C();
				_v324 = _t1229;
				_t1233 =  *((intOrPtr*)( *_v324 + 0xf8))(_v324, 0,  &_v140, _t1229,  *((intOrPtr*)( *((intOrPtr*)( *_v520)) + 0x308))( *_v520));
				asm("fclex");
				_v328 = _t1233;
				if(_v328 >= 0) {
					_v524 = _v524 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403008);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v524 = _t1233;
				}
				_v256 = 0x2cc3;
				_v404 = _v140;
				_v140 = _v140 & 0x00000000;
				L0040142C();
				_t1240 =  *((intOrPtr*)( *_a4 + 0x704))(_a4, _v252, 0x702f,  &_v144,  &_v256,  &_v288);
				_v332 = _t1240;
				if(_v332 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x402e78);
					_push(_a4);
					_push(_v332);
					L00401462();
					_v528 = _t1240;
				}
				_v136 = _v288;
				_v132 = _v284;
				L0040144A();
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1739 = _t1738 + 0xc;
				if( *0x417010 != 0) {
					_v532 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v532 = 0x417010;
				}
				_t1618 =  *((intOrPtr*)( *_v532));
				_t1248 =  &_v148;
				L0040145C();
				_v316 = _t1248;
				_t1252 =  *((intOrPtr*)( *_v316 + 0x130))(_v316,  &_v152, _t1248,  *((intOrPtr*)(_t1618 + 0x2fc))( *_v532));
				asm("fclex");
				_v320 = _t1252;
				if(_v320 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403034);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v536 = _t1252;
				}
				_v408 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v408;
				_v184 = 9;
				_v268 =  *0x401170;
				_v484 =  *0x401168;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4, _t1618, _t1618,  &_v268,  &_v184);
				L00401444();
				L00401420();
				if( *0x417010 != 0) {
					_v540 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v540 = 0x417010;
				}
				_t1263 =  &_v148;
				L0040145C();
				_v316 = _t1263;
				_t1267 =  *((intOrPtr*)( *_v316 + 0x130))(_v316,  &_v152, _t1263,  *((intOrPtr*)( *((intOrPtr*)( *_v540)) + 0x304))( *_v540));
				asm("fclex");
				_v320 = _t1267;
				if(_v320 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v544 = _t1267;
				}
				if( *0x417010 != 0) {
					_v548 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v548 = 0x417010;
				}
				_t1626 =  *((intOrPtr*)( *_v548));
				_t1271 =  &_v156;
				L0040145C();
				_v324 = _t1271;
				_t1275 =  *((intOrPtr*)( *_v324 + 0x170))(_v324,  &_v140, _t1271,  *((intOrPtr*)(_t1626 + 0x2fc))( *_v548));
				asm("fclex");
				_v328 = _t1275;
				if(_v328 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x403034);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v552 = _t1275;
				}
				_v296 =  *0x401160;
				_v412 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v412;
				_v184 = 9;
				_v288 =  *0x401158;
				_v208 = 0x34452;
				_v216 = 3;
				_v552 =  *0x401150;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, L"Baereevnen5", 0x10, 0x682f9540, 0x5afb,  &_v288, _t1626, _t1626,  &_v184,  &_v296, _v140,  &_v200);
				L0040141A();
				L0040144A();
				_push( &_v156);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1740 = _t1739 + 0xc;
				L00401420();
				if( *0x417010 != 0) {
					_v556 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v556 = 0x417010;
				}
				_t1291 =  &_v148;
				L0040145C();
				_v316 = _t1291;
				_t1295 =  *((intOrPtr*)( *_v316 + 0x120))(_v316,  &_v268, _t1291,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x2fc))( *_v556));
				asm("fclex");
				_v320 = _t1295;
				if(_v320 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x403034);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v560 = _t1295;
				}
				if( *0x417010 != 0) {
					_v564 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v564 = 0x417010;
				}
				_t1299 =  &_v152;
				L0040145C();
				_v324 = _t1299;
				_t1303 =  *((intOrPtr*)( *_v324 + 0x128))(_v324,  &_v252, _t1299,  *((intOrPtr*)( *((intOrPtr*)( *_v564)) + 0x308))( *_v564));
				asm("fclex");
				_v328 = _t1303;
				if(_v328 >= 0) {
					_v568 = _v568 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x403008);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v568 = _t1303;
				}
				_v256 = _v252;
				_v288 = 0xa17c2980;
				_v284 = 0x5afb;
				_v208 = 0x331e20;
				_v216 = 3;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4, 0x10, 0x577708,  &_v288, _v268,  &_v256,  &_v296);
				_v108 = _v296;
				_v104 = _v292;
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1741 = _t1740 + 0xc;
				if( *0x417010 != 0) {
					_v572 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v572 = 0x417010;
				}
				_t1319 =  &_v148;
				L0040145C();
				_v316 = _t1319;
				_t1323 =  *((intOrPtr*)( *_v316 + 0x120))(_v316,  &_v268, _t1319,  *((intOrPtr*)( *((intOrPtr*)( *_v572)) + 0x2fc))( *_v572));
				asm("fclex");
				_v320 = _t1323;
				if(_v320 >= 0) {
					_v576 = _v576 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x403034);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v576 = _t1323;
				}
				_v288 = 0xcfb51b00;
				_v284 = 0x5af5;
				_v208 = _v268;
				_v216 = 3;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1329 =  *((intOrPtr*)( *_a4 + 0x708))(_a4, 0x10,  &_v288);
				_v324 = _t1329;
				if(_v324 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x402e78);
					_push(_a4);
					_push(_v324);
					L00401462();
					_v580 = _t1329;
				}
				L00401444();
				if( *0x417010 != 0) {
					_v584 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v584 = 0x417010;
				}
				_t1333 =  &_v148;
				L0040145C();
				_v316 = _t1333;
				_t1337 =  *((intOrPtr*)( *_v316 + 0x70))(_v316,  &_v268, _t1333,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x304))( *_v584));
				asm("fclex");
				_v320 = _t1337;
				if(_v320 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v588 = _t1337;
				}
				if( *0x417010 != 0) {
					_v592 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v592 = 0x417010;
				}
				_t1341 =  &_v152;
				L0040145C();
				_v324 = _t1341;
				_t1345 =  *((intOrPtr*)( *_v324 + 0x218))(_v324,  &_v140, _t1341,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x308))( *_v592));
				asm("fclex");
				_v328 = _t1345;
				if(_v328 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x403008);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v596 = _t1345;
				}
				if( *0x417010 != 0) {
					_v600 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v600 = 0x417010;
				}
				_t1349 =  &_v156;
				L0040145C();
				_v332 = _t1349;
				_t1353 =  *((intOrPtr*)( *_v332 + 0x88))(_v332,  &_v272, _t1349,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x304))( *_v600));
				asm("fclex");
				_v336 = _t1353;
				if(_v336 >= 0) {
					_v604 = _v604 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x403008);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v604 = _t1353;
				}
				if( *0x417010 != 0) {
					_v608 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v608 = 0x417010;
				}
				_t1357 =  &_v160;
				L0040145C();
				_v340 = _t1357;
				_t1361 =  *((intOrPtr*)( *_v340 + 0x128))(_v340,  &_v252, _t1357,  *((intOrPtr*)( *((intOrPtr*)( *_v608)) + 0x308))( *_v608));
				asm("fclex");
				_v344 = _t1361;
				if(_v344 >= 0) {
					_v612 = _v612 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x403008);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v612 = _t1361;
				}
				_v256 = _v252;
				_v416 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1652 =  &_v144;
				L0040142C();
				_v288 =  *0x401148;
				_v208 = 0x2eb794;
				_v216 = 3;
				 *_t1741 = _v272;
				 *_t1741 = _v268;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x10,  &_v288, _t1652, L"Abietic6",  &_v144, _t1652,  &_v256, 0x249cd,  &_v276);
				_v60 = _v276;
				L0040144A();
				_push( &_v160);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(4);
				L0040143E();
				_t1742 = _t1741 + 0x14;
				if( *0x417010 != 0) {
					_v616 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v616 = 0x417010;
				}
				_t1380 =  &_v148;
				L0040145C();
				_v316 = _t1380;
				_t1384 =  *((intOrPtr*)( *_v316 + 0x78))(_v316,  &_v268, _t1380,  *((intOrPtr*)( *((intOrPtr*)( *_v616)) + 0x2fc))( *_v616));
				asm("fclex");
				_v320 = _t1384;
				if(_v320 >= 0) {
					_v620 = _v620 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403034);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v620 = _t1384;
				}
				if( *0x417010 != 0) {
					_v624 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v624 = 0x417010;
				}
				_t1388 =  &_v152;
				L0040145C();
				_v324 = _t1388;
				_t1392 =  *((intOrPtr*)( *_v324 + 0x50))(_v324,  &_v252, _t1388,  *((intOrPtr*)( *((intOrPtr*)( *_v624)) + 0x308))( *_v624));
				asm("fclex");
				_v328 = _t1392;
				if(_v328 >= 0) {
					_v628 = _v628 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x403008);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v628 = _t1392;
				}
				if( *0x417010 != 0) {
					_v632 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v632 = 0x417010;
				}
				_t1662 =  *((intOrPtr*)( *_v632));
				_t1396 =  &_v156;
				L0040145C();
				_v332 = _t1396;
				_t1400 =  *((intOrPtr*)( *_v332 + 0x98))(_v332,  &_v256, _t1396,  *((intOrPtr*)(_t1662 + 0x2fc))( *_v632));
				asm("fclex");
				_v336 = _t1400;
				if(_v336 >= 0) {
					_v636 = _v636 & 0x00000000;
				} else {
					_push(0x98);
					_push(0x403034);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v636 = _t1400;
				}
				_v288 = 0xf1e53680;
				_v284 = 0x5af8;
				_v272 = _v268;
				 *_t1742 =  *0x401140;
				_t1406 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4, _t1662,  &_v272, _v252,  &_v288, 0x7a724d90, 0x5b07, _v256,  &_v276);
				_v340 = _t1406;
				if(_v340 >= 0) {
					_v640 = _v640 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x402e78);
					_push(_a4);
					_push(_v340);
					L00401462();
					_v640 = _t1406;
				}
				_v100 = _v276;
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(3);
				L0040143E();
				_t1743 = _t1742 + 0x10;
				if( *0x417010 != 0) {
					_v644 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v644 = 0x417010;
				}
				_t1414 =  &_v148;
				L0040145C();
				_v316 = _t1414;
				_t1418 =  *((intOrPtr*)( *_v316 + 0x198))(_v316,  &_v268, _t1414,  *((intOrPtr*)( *((intOrPtr*)( *_v644)) + 0x308))( *_v644));
				asm("fclex");
				_v320 = _t1418;
				if(_v320 >= 0) {
					_v648 = _v648 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x403008);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v648 = _t1418;
				}
				if( *0x417010 != 0) {
					_v652 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v652 = 0x417010;
				}
				_t1422 =  &_v152;
				L0040145C();
				_v324 = _t1422;
				_t1426 =  *((intOrPtr*)( *_v324 + 0xf8))(_v324, 0,  &_v140, _t1422,  *((intOrPtr*)( *((intOrPtr*)( *_v652)) + 0x308))( *_v652));
				asm("fclex");
				_v328 = _t1426;
				if(_v328 >= 0) {
					_v656 = _v656 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x403008);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v656 = _t1426;
				}
				if( *0x417010 != 0) {
					_v660 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v660 = 0x417010;
				}
				_t1430 =  &_v156;
				L0040145C();
				_v332 = _t1430;
				_t1434 =  *((intOrPtr*)( *_v332 + 0x70))(_v332,  &_v272, _t1430,  *((intOrPtr*)( *((intOrPtr*)( *_v660)) + 0x308))( *_v660));
				asm("fclex");
				_v336 = _t1434;
				if(_v336 >= 0) {
					_v664 = _v664 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x403008);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v664 = _t1434;
				}
				if( *0x417010 != 0) {
					_v668 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v668 = 0x417010;
				}
				_t1438 =  &_v160;
				L0040145C();
				_v340 = _t1438;
				_t1442 =  *((intOrPtr*)( *_v340 + 0x158))(_v340,  &_v164, _t1438,  *((intOrPtr*)( *((intOrPtr*)( *_v668)) + 0x2fc))( *_v668));
				asm("fclex");
				_v344 = _t1442;
				if(_v344 >= 0) {
					_v672 = _v672 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403034);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v672 = _t1442;
				}
				_t1443 =  &_v200;
				L00401438();
				_t1744 = _t1743 + 0x10;
				L00401432();
				_v280 = _t1443;
				_v176 = 0x82fc7f;
				_v184 = 3;
				_v276 = 0x39df66;
				_v296 =  *0x401138;
				_v420 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1711 = _v420;
				L0040142C();
				_v288 = 0xa52d5fc0;
				_v284 = 0x5afd;
				_v208 = _v268;
				_v216 = 3;
				 *_t1744 = _v272;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x734))(_a4, 0x10,  &_v288,  &_v144,  &_v296,  &_v276,  &_v144,  &_v184, 0x64c426,  &_v280, _t1443, _t1443, _v164, 0, 0);
				L0040144A();
				_push( &_v164);
				_push( &_v160);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(5);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1746 = _t1744 + 0x24;
				_v208 = 1;
				_v216 = 2;
				_v224 = 0xbcc3;
				_v232 = 3;
				_v240 = _v240 & 0x00000000;
				_v248 = 2;
				_push( &_v216);
				_push( &_v232);
				_push( &_v248);
				_push( &_v384);
				_push( &_v368);
				_t1468 =  &_v56;
				_push(_t1468);
				L00401414();
				_v424 = _t1468;
				while(_v424 != 0) {
					if( *0x417010 != 0) {
						_v676 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v676 = 0x417010;
					}
					_t1472 =  &_v148;
					L0040145C();
					_v316 = _t1472;
					_t1476 =  *((intOrPtr*)( *_v316 + 0x60))(_v316,  &_v268, _t1472,  *((intOrPtr*)( *((intOrPtr*)( *_v676)) + 0x308))( *_v676));
					asm("fclex");
					_v320 = _t1476;
					if(_v320 >= 0) {
						_v680 = _v680 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x403008);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v680 = _t1476;
					}
					if( *0x417010 != 0) {
						_v684 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v684 = 0x417010;
					}
					_t1480 =  &_v152;
					L0040145C();
					_v324 = _t1480;
					_t1484 =  *((intOrPtr*)( *_v324 + 0x1d0))(_v324,  &_v252, _t1480,  *((intOrPtr*)( *((intOrPtr*)( *_v684)) + 0x300))( *_v684));
					asm("fclex");
					_v328 = _t1484;
					if(_v328 >= 0) {
						_v688 = _v688 & 0x00000000;
					} else {
						_push(0x1d0);
						_push(0x403080);
						_push(_v324);
						_push(_v328);
						L00401462();
						_v688 = _t1484;
					}
					_v256 = _v252;
					_v272 = _v268;
					_v288 =  *0x401130;
					_t1493 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, L"lynfrysning",  &_v288,  &_v272,  &_v256, 0x5c95b7,  &_v296);
					_v332 = _t1493;
					if(_v332 >= 0) {
						_v692 = _v692 & 0x00000000;
					} else {
						_push(0x710);
						_push(0x402e78);
						_push(_a4);
						_push(_v332);
						L00401462();
						_v692 = _t1493;
					}
					_v68 = _v296;
					_push( &_v152);
					_push( &_v148);
					_push(2);
					L0040143E();
					_t1747 = _t1746 + 0xc;
					if( *0x417010 != 0) {
						_v696 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v696 = 0x417010;
					}
					_t1499 =  &_v148;
					L0040145C();
					_v316 = _t1499;
					_t1503 =  *((intOrPtr*)( *_v316 + 0x168))(_v316,  &_v152, _t1499,  *((intOrPtr*)( *((intOrPtr*)( *_v696)) + 0x2fc))( *_v696));
					asm("fclex");
					_v320 = _t1503;
					if(_v320 >= 0) {
						_v700 = _v700 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x403034);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v700 = _t1503;
					}
					_push(0);
					_push(0);
					_push(_v152);
					_push( &_v184);
					L00401438();
					_t1748 = _t1747 + 0x10;
					if( *0x417010 != 0) {
						_v704 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v704 = 0x417010;
					}
					_t1508 =  &_v156;
					L0040145C();
					_v324 = _t1508;
					_t1512 =  *((intOrPtr*)( *_v324 + 0x60))(_v324,  &_v268, _t1508,  *((intOrPtr*)( *((intOrPtr*)( *_v704)) + 0x304))( *_v704));
					asm("fclex");
					_v328 = _t1512;
					if(_v328 >= 0) {
						_v708 = _v708 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x403008);
						_push(_v324);
						_push(_v328);
						L00401462();
						_v708 = _t1512;
					}
					if( *0x417010 != 0) {
						_v712 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v712 = 0x417010;
					}
					_t1516 =  &_v160;
					L0040145C();
					_v332 = _t1516;
					_t1520 =  *((intOrPtr*)( *_v332 + 0xd8))(_v332,  &_v252, _t1516,  *((intOrPtr*)( *((intOrPtr*)( *_v712)) + 0x300))( *_v712));
					asm("fclex");
					_v336 = _t1520;
					if(_v336 >= 0) {
						_v716 = _v716 & 0x00000000;
					} else {
						_push(0xd8);
						_push(0x403080);
						_push(_v332);
						_push(_v336);
						L00401462();
						_v716 = _t1520;
					}
					if( *0x417010 != 0) {
						_v720 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v720 = 0x417010;
					}
					_t1524 =  &_v164;
					L0040145C();
					_v340 = _t1524;
					_t1528 =  *((intOrPtr*)( *_v340 + 0x128))(_v340,  &_v256, _t1524,  *((intOrPtr*)( *((intOrPtr*)( *_v720)) + 0x300))( *_v720));
					asm("fclex");
					_v344 = _t1528;
					if(_v344 >= 0) {
						_v724 = _v724 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x403080);
						_push(_v340);
						_push(_v344);
						L00401462();
						_v724 = _t1528;
					}
					if( *0x417010 != 0) {
						_v728 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v728 = 0x417010;
					}
					_t1697 =  *((intOrPtr*)( *_v728));
					_t1532 =  &_v168;
					L0040145C();
					_v348 = _t1532;
					_t1536 =  *((intOrPtr*)( *_v348 + 0x70))(_v348,  &_v272, _t1532,  *((intOrPtr*)(_t1697 + 0x304))( *_v728));
					asm("fclex");
					_v352 = _t1536;
					if(_v352 >= 0) {
						_v732 = _v732 & 0x00000000;
					} else {
						_push(0x70);
						_push(0x403008);
						_push(_v348);
						_push(_v352);
						L00401462();
						_v732 = _t1536;
					}
					_v264 = _v256;
					_v276 = _v268;
					_v260 = 0x7454;
					 *_t1748 = _v272;
					_t1543 =  &_v184;
					L00401432();
					 *((intOrPtr*)( *_a4 + 0x738))(_a4, 0x75ae89, _t1543, _t1543,  &_v260,  &_v276, _v252,  &_v264, _t1697,  &_v280);
					_v96 = _v280;
					L0040143E();
					_t1746 = _t1748 + 0x1c;
					L00401420();
					 *((intOrPtr*)( *_a4 + 0x73c))(_a4, 6,  &_v148,  &_v156,  &_v160,  &_v164,  &_v168,  &_v152);
					if( *0x417010 != 0) {
						_v736 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v736 = 0x417010;
					}
					_t1701 =  *((intOrPtr*)( *_v736));
					_t1560 =  &_v148;
					L0040145C();
					_v316 = _t1560;
					_t1564 =  *((intOrPtr*)( *_v316 + 0x128))(_v316,  &_v252, _t1560,  *((intOrPtr*)(_t1701 + 0x304))( *_v736));
					asm("fclex");
					_v320 = _t1564;
					if(_v320 >= 0) {
						_v740 = _v740 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x403008);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v740 = _t1564;
					}
					_v268 = 0x7697d7;
					_v256 = _v252;
					 *_t1746 =  *E00401128;
					_t1571 =  *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v256,  &_v268, _t1701, 0x6fc4e4,  &_v184);
					_v324 = _t1571;
					if(_v324 >= 0) {
						_v744 = _v744 & 0x00000000;
					} else {
						_push(0x714);
						_push(0x402e78);
						_push(_a4);
						_push(_v324);
						L00401462();
						_v744 = _t1571;
					}
					_t1711 =  &_v184;
					L0040141A();
					L00401444();
					_push( &_v384);
					_push( &_v368);
					_t1574 =  &_v56;
					_push(_t1574);
					L0040140E();
					_v424 = _t1574;
				}
				_v208 = 0xae;
				_t1712 =  >=  ? 0x405a6f : _t1711;
				goto __edx;
			}

0x0040ecd6
0x0040ece2
0x0040ecea
0x0040eced
0x0040ecfa
0x0040ed02
0x0040ed0d
0x0040ed18
0x0040ed1e
0x0040ed2b
0x0040ed4d
0x0040ed2d
0x0040ed2d
0x0040ed32
0x0040ed37
0x0040ed3a
0x0040ed40
0x0040ed45
0x0040ed45
0x0040ed5b
0x0040ed78
0x0040ed5d
0x0040ed5d
0x0040ed62
0x0040ed67
0x0040ed6c
0x0040ed6c
0x0040ed9c
0x0040eda3
0x0040eda8
0x0040edc3
0x0040edc9
0x0040edcb
0x0040edd8
0x0040edfd
0x0040edda
0x0040edda
0x0040eddf
0x0040ede4
0x0040edea
0x0040edf0
0x0040edf5
0x0040edf5
0x0040ee04
0x0040ee0e
0x0040ee1e
0x0040ee24
0x0040ee2e
0x0040ee3e
0x0040ee44
0x0040ee4e
0x0040ee5d
0x0040ee63
0x0040ee7e
0x0040ee8b
0x0040ee8c
0x0040ee8d
0x0040ee8e
0x0040eeb7
0x0040eec2
0x0040eec8
0x0040eed5
0x0040eef7
0x0040eed7
0x0040eed7
0x0040eedc
0x0040eee1
0x0040eee4
0x0040eeea
0x0040eeef
0x0040eeef
0x0040ef04
0x0040ef0f
0x0040ef1b
0x0040ef38
0x0040ef1d
0x0040ef1d
0x0040ef22
0x0040ef27
0x0040ef2c
0x0040ef2c
0x0040ef5c
0x0040ef63
0x0040ef68
0x0040ef83
0x0040ef89
0x0040ef8b
0x0040ef98
0x0040efbd
0x0040ef9a
0x0040ef9a
0x0040ef9f
0x0040efa4
0x0040efaa
0x0040efb0
0x0040efb5
0x0040efb5
0x0040efcb
0x0040efe8
0x0040efcd
0x0040efcd
0x0040efd2
0x0040efd7
0x0040efdc
0x0040efdc
0x0040f002
0x0040f00c
0x0040f013
0x0040f018
0x0040f033
0x0040f036
0x0040f038
0x0040f045
0x0040f067
0x0040f047
0x0040f047
0x0040f049
0x0040f04e
0x0040f054
0x0040f05a
0x0040f05f
0x0040f05f
0x0040f06e
0x0040f077
0x0040f081
0x0040f091
0x0040f09d
0x0040f0b8
0x0040f0ca
0x0040f0e3
0x0040f0e9
0x0040f0f6
0x0040f118
0x0040f0f8
0x0040f0f8
0x0040f0fd
0x0040f102
0x0040f105
0x0040f10b
0x0040f110
0x0040f110
0x0040f126
0x0040f130
0x0040f137
0x0040f138
0x0040f13a
0x0040f13f
0x0040f149
0x0040f166
0x0040f14b
0x0040f14b
0x0040f150
0x0040f155
0x0040f15a
0x0040f15a
0x0040f18a
0x0040f191
0x0040f196
0x0040f1b1
0x0040f1b7
0x0040f1b9
0x0040f1c6
0x0040f1eb
0x0040f1c8
0x0040f1c8
0x0040f1cd
0x0040f1d2
0x0040f1d8
0x0040f1de
0x0040f1e3
0x0040f1e3
0x0040f1f9
0x0040f216
0x0040f1fb
0x0040f1fb
0x0040f200
0x0040f205
0x0040f20a
0x0040f20a
0x0040f23a
0x0040f241
0x0040f246
0x0040f261
0x0040f264
0x0040f266
0x0040f273
0x0040f295
0x0040f275
0x0040f275
0x0040f277
0x0040f27c
0x0040f282
0x0040f288
0x0040f28d
0x0040f28d
0x0040f2a3
0x0040f2c0
0x0040f2a5
0x0040f2a5
0x0040f2aa
0x0040f2af
0x0040f2b4
0x0040f2b4
0x0040f2e4
0x0040f2eb
0x0040f2f0
0x0040f30b
0x0040f311
0x0040f313
0x0040f320
0x0040f345
0x0040f322
0x0040f322
0x0040f327
0x0040f32c
0x0040f332
0x0040f338
0x0040f33d
0x0040f33d
0x0040f34c
0x0040f34e
0x0040f350
0x0040f35c
0x0040f35d
0x0040f362
0x0040f36c
0x0040f389
0x0040f36e
0x0040f36e
0x0040f373
0x0040f378
0x0040f37d
0x0040f37d
0x0040f3ad
0x0040f3b4
0x0040f3b9
0x0040f3d4
0x0040f3da
0x0040f3dc
0x0040f3e9
0x0040f40e
0x0040f3eb
0x0040f3eb
0x0040f3f0
0x0040f3f5
0x0040f3fb
0x0040f401
0x0040f406
0x0040f406
0x0040f426
0x0040f42e
0x0040f435
0x0040f43a
0x0040f446
0x0040f44c
0x0040f455
0x0040f45f
0x0040f46f
0x0040f475
0x0040f482
0x0040f488
0x0040f494
0x0040f49b
0x0040f4af
0x0040f4ba
0x0040f4ce
0x0040f4db
0x0040f4dc
0x0040f4dd
0x0040f4de
0x0040f4ee
0x0040f4fa
0x0040f503
0x0040f50c
0x0040f517
0x0040f51e
0x0040f525
0x0040f52c
0x0040f533
0x0040f53a
0x0040f53b
0x0040f53d
0x0040f54b
0x0040f552
0x0040f553
0x0040f555
0x0040f55a
0x0040f564
0x0040f581
0x0040f566
0x0040f566
0x0040f56b
0x0040f570
0x0040f575
0x0040f575
0x0040f5a5
0x0040f5ac
0x0040f5b1
0x0040f5cc
0x0040f5d2
0x0040f5d4
0x0040f5e1
0x0040f606
0x0040f5e3
0x0040f5e3
0x0040f5e8
0x0040f5ed
0x0040f5f3
0x0040f5f9
0x0040f5fe
0x0040f5fe
0x0040f614
0x0040f631
0x0040f616
0x0040f616
0x0040f61b
0x0040f620
0x0040f625
0x0040f625
0x0040f655
0x0040f65c
0x0040f661
0x0040f67c
0x0040f682
0x0040f684
0x0040f691
0x0040f6b6
0x0040f693
0x0040f693
0x0040f698
0x0040f69d
0x0040f6a3
0x0040f6a9
0x0040f6ae
0x0040f6ae
0x0040f6c4
0x0040f6d1
0x0040f6d7
0x0040f6e1
0x0040f6f1
0x0040f6f7
0x0040f704
0x0040f70a
0x0040f714
0x0040f71e
0x0040f74c
0x0040f759
0x0040f75a
0x0040f75b
0x0040f75c
0x0040f76a
0x0040f776
0x0040f77d
0x0040f77e
0x0040f780
0x0040f78e
0x0040f795
0x0040f796
0x0040f798
0x0040f79d
0x0040f7a7
0x0040f7c4
0x0040f7a9
0x0040f7a9
0x0040f7ae
0x0040f7b3
0x0040f7b8
0x0040f7b8
0x0040f7e8
0x0040f7ef
0x0040f7f4
0x0040f80f
0x0040f815
0x0040f817
0x0040f824
0x0040f849
0x0040f826
0x0040f826
0x0040f82b
0x0040f830
0x0040f836
0x0040f83c
0x0040f841
0x0040f841
0x0040f857
0x0040f874
0x0040f859
0x0040f859
0x0040f85e
0x0040f863
0x0040f868
0x0040f868
0x0040f898
0x0040f89f
0x0040f8a4
0x0040f8c1
0x0040f8c7
0x0040f8c9
0x0040f8d6
0x0040f8fb
0x0040f8d8
0x0040f8d8
0x0040f8dd
0x0040f8e2
0x0040f8e8
0x0040f8ee
0x0040f8f3
0x0040f8f3
0x0040f902
0x0040f911
0x0040f917
0x0040f92a
0x0040f957
0x0040f95d
0x0040f96a
0x0040f98c
0x0040f96c
0x0040f96c
0x0040f971
0x0040f976
0x0040f979
0x0040f97f
0x0040f984
0x0040f984
0x0040f999
0x0040f9a5
0x0040f9ae
0x0040f9b9
0x0040f9c0
0x0040f9c1
0x0040f9c3
0x0040f9c8
0x0040f9d2
0x0040f9ef
0x0040f9d4
0x0040f9d4
0x0040f9d9
0x0040f9de
0x0040f9e3
0x0040f9e3
0x0040fa09
0x0040fa13
0x0040fa1a
0x0040fa1f
0x0040fa3a
0x0040fa40
0x0040fa42
0x0040fa4f
0x0040fa74
0x0040fa51
0x0040fa51
0x0040fa56
0x0040fa5b
0x0040fa61
0x0040fa67
0x0040fa6c
0x0040fa6c
0x0040fa81
0x0040fa87
0x0040fa94
0x0040fa9a
0x0040faaa
0x0040fac6
0x0040fad1
0x0040fadd
0x0040fae8
0x0040faf4
0x0040fb11
0x0040faf6
0x0040faf6
0x0040fafb
0x0040fb00
0x0040fb05
0x0040fb05
0x0040fb35
0x0040fb3c
0x0040fb41
0x0040fb5c
0x0040fb62
0x0040fb64
0x0040fb71
0x0040fb96
0x0040fb73
0x0040fb73
0x0040fb78
0x0040fb7d
0x0040fb83
0x0040fb89
0x0040fb8e
0x0040fb8e
0x0040fba4
0x0040fbc1
0x0040fba6
0x0040fba6
0x0040fbab
0x0040fbb0
0x0040fbb5
0x0040fbb5
0x0040fbdb
0x0040fbe5
0x0040fbec
0x0040fbf1
0x0040fc0c
0x0040fc12
0x0040fc14
0x0040fc21
0x0040fc46
0x0040fc23
0x0040fc23
0x0040fc28
0x0040fc2d
0x0040fc33
0x0040fc39
0x0040fc3e
0x0040fc3e
0x0040fc53
0x0040fc5f
0x0040fc65
0x0040fc72
0x0040fc78
0x0040fc88
0x0040fc8e
0x0040fc98
0x0040fcc5
0x0040fcdc
0x0040fce9
0x0040fcea
0x0040fceb
0x0040fcec
0x0040fcfa
0x0040fd09
0x0040fd14
0x0040fd1f
0x0040fd26
0x0040fd27
0x0040fd29
0x0040fd2e
0x0040fd37
0x0040fd43
0x0040fd60
0x0040fd45
0x0040fd45
0x0040fd4a
0x0040fd4f
0x0040fd54
0x0040fd54
0x0040fd84
0x0040fd8b
0x0040fd90
0x0040fdab
0x0040fdb1
0x0040fdb3
0x0040fdc0
0x0040fde5
0x0040fdc2
0x0040fdc2
0x0040fdc7
0x0040fdcc
0x0040fdd2
0x0040fdd8
0x0040fddd
0x0040fddd
0x0040fdf3
0x0040fe10
0x0040fdf5
0x0040fdf5
0x0040fdfa
0x0040fdff
0x0040fe04
0x0040fe04
0x0040fe34
0x0040fe3b
0x0040fe40
0x0040fe5b
0x0040fe61
0x0040fe63
0x0040fe70
0x0040fe95
0x0040fe72
0x0040fe72
0x0040fe77
0x0040fe7c
0x0040fe82
0x0040fe88
0x0040fe8d
0x0040fe8d
0x0040fea3
0x0040feaa
0x0040feb4
0x0040febe
0x0040fec8
0x0040fef5
0x0040ff02
0x0040ff03
0x0040ff04
0x0040ff05
0x0040ff0e
0x0040ff1a
0x0040ff23
0x0040ff2c
0x0040ff33
0x0040ff34
0x0040ff36
0x0040ff3b
0x0040ff45
0x0040ff62
0x0040ff47
0x0040ff47
0x0040ff4c
0x0040ff51
0x0040ff56
0x0040ff56
0x0040ff86
0x0040ff8d
0x0040ff92
0x0040ffad
0x0040ffb3
0x0040ffb5
0x0040ffc2
0x0040ffe7
0x0040ffc4
0x0040ffc4
0x0040ffc9
0x0040ffce
0x0040ffd4
0x0040ffda
0x0040ffdf
0x0040ffdf
0x0040ffee
0x0040fff8
0x00410008
0x0041000e
0x00410022
0x0041002f
0x00410030
0x00410031
0x00410032
0x0041003b
0x00410041
0x0041004e
0x00410070
0x00410050
0x00410050
0x00410055
0x0041005a
0x0041005d
0x00410063
0x00410068
0x00410068
0x0041007d
0x00410089
0x004100a6
0x0041008b
0x0041008b
0x00410090
0x00410095
0x0041009a
0x0041009a
0x004100ca
0x004100d1
0x004100d6
0x004100f1
0x004100f4
0x004100f6
0x00410103
0x00410125
0x00410105
0x00410105
0x00410107
0x0041010c
0x00410112
0x00410118
0x0041011d
0x0041011d
0x00410133
0x00410150
0x00410135
0x00410135
0x0041013a
0x0041013f
0x00410144
0x00410144
0x00410174
0x0041017b
0x00410180
0x0041019b
0x004101a1
0x004101a3
0x004101b0
0x004101d5
0x004101b2
0x004101b2
0x004101b7
0x004101bc
0x004101c2
0x004101c8
0x004101cd
0x004101cd
0x004101e3
0x00410200
0x004101e5
0x004101e5
0x004101ea
0x004101ef
0x004101f4
0x004101f4
0x00410224
0x0041022b
0x00410230
0x0041024b
0x00410251
0x00410253
0x00410260
0x00410285
0x00410262
0x00410262
0x00410267
0x0041026c
0x00410272
0x00410278
0x0041027d
0x0041027d
0x00410293
0x004102b0
0x00410295
0x00410295
0x0041029a
0x0041029f
0x004102a4
0x004102a4
0x004102d4
0x004102db
0x004102e0
0x004102fb
0x00410301
0x00410303
0x00410310
0x00410335
0x00410312
0x00410312
0x00410317
0x0041031c
0x00410322
0x00410328
0x0041032d
0x0041032d
0x00410343
0x00410350
0x00410356
0x00410363
0x00410369
0x00410374
0x0041037a
0x00410384
0x004103a8
0x004103be
0x004103cb
0x004103d8
0x004103d9
0x004103da
0x004103db
0x004103e4
0x004103f0
0x004103f9
0x00410404
0x0041040b
0x00410412
0x00410419
0x0041041a
0x0041041c
0x00410421
0x0041042b
0x00410448
0x0041042d
0x0041042d
0x00410432
0x00410437
0x0041043c
0x0041043c
0x0041046c
0x00410473
0x00410478
0x00410493
0x00410496
0x00410498
0x004104a5
0x004104c7
0x004104a7
0x004104a7
0x004104a9
0x004104ae
0x004104b4
0x004104ba
0x004104bf
0x004104bf
0x004104d5
0x004104f2
0x004104d7
0x004104d7
0x004104dc
0x004104e1
0x004104e6
0x004104e6
0x00410516
0x0041051d
0x00410522
0x0041053d
0x00410540
0x00410542
0x0041054f
0x00410571
0x00410551
0x00410551
0x00410553
0x00410558
0x0041055e
0x00410564
0x00410569
0x00410569
0x0041057f
0x0041059c
0x00410581
0x00410581
0x00410586
0x0041058b
0x00410590
0x00410590
0x004105b6
0x004105c0
0x004105c7
0x004105cc
0x004105e7
0x004105ed
0x004105ef
0x004105fc
0x00410621
0x004105fe
0x004105fe
0x00410603
0x00410608
0x0041060e
0x00410614
0x00410619
0x00410619
0x00410628
0x00410632
0x00410642
0x0041067a
0x00410685
0x0041068b
0x00410698
0x004106ba
0x0041069a
0x0041069a
0x0041069f
0x004106a4
0x004106a7
0x004106ad
0x004106b2
0x004106b2
0x004106c7
0x004106d0
0x004106d7
0x004106de
0x004106df
0x004106e1
0x004106e6
0x004106f0
0x0041070d
0x004106f2
0x004106f2
0x004106f7
0x004106fc
0x00410701
0x00410701
0x00410731
0x00410738
0x0041073d
0x00410758
0x0041075e
0x00410760
0x0041076d
0x00410792
0x0041076f
0x0041076f
0x00410774
0x00410779
0x0041077f
0x00410785
0x0041078a
0x0041078a
0x004107a0
0x004107bd
0x004107a2
0x004107a2
0x004107a7
0x004107ac
0x004107b1
0x004107b1
0x004107e1
0x004107e8
0x004107ed
0x0041080a
0x00410810
0x00410812
0x0041081f
0x00410844
0x00410821
0x00410821
0x00410826
0x0041082b
0x00410831
0x00410837
0x0041083c
0x0041083c
0x00410852
0x0041086f
0x00410854
0x00410854
0x00410859
0x0041085e
0x00410863
0x00410863
0x00410893
0x0041089a
0x0041089f
0x004108ba
0x004108bd
0x004108bf
0x004108cc
0x004108ee
0x004108ce
0x004108ce
0x004108d0
0x004108d5
0x004108db
0x004108e1
0x004108e6
0x004108e6
0x004108fc
0x00410919
0x004108fe
0x004108fe
0x00410903
0x00410908
0x0041090d
0x0041090d
0x0041093d
0x00410944
0x00410949
0x00410964
0x0041096a
0x0041096c
0x00410979
0x0041099e
0x0041097b
0x0041097b
0x00410980
0x00410985
0x0041098b
0x00410991
0x00410996
0x00410996
0x004109af
0x004109b6
0x004109bb
0x004109bf
0x004109c4
0x004109ca
0x004109d4
0x004109de
0x004109ee
0x004109fa
0x00410a00
0x00410a07
0x00410a13
0x00410a18
0x00410a22
0x00410a32
0x00410a38
0x00410a5c
0x00410a7e
0x00410a8b
0x00410a8c
0x00410a8d
0x00410a8e
0x00410a97
0x00410aa3
0x00410aae
0x00410ab5
0x00410abc
0x00410ac3
0x00410aca
0x00410acb
0x00410acd
0x00410adb
0x00410ae2
0x00410ae3
0x00410ae5
0x00410aea
0x00410aed
0x00410af7
0x00410b01
0x00410b0b
0x00410b15
0x00410b1c
0x00410b2c
0x00410b33
0x00410b3a
0x00410b41
0x00410b48
0x00410b49
0x00410b4c
0x00410b4d
0x00410b52
0x00411310
0x00410b64
0x00410b81
0x00410b66
0x00410b66
0x00410b6b
0x00410b70
0x00410b75
0x00410b75
0x00410ba5
0x00410bac
0x00410bb1
0x00410bcc
0x00410bcf
0x00410bd1
0x00410bde
0x00410c00
0x00410be0
0x00410be0
0x00410be2
0x00410be7
0x00410bed
0x00410bf3
0x00410bf8
0x00410bf8
0x00410c0e
0x00410c2b
0x00410c10
0x00410c10
0x00410c15
0x00410c1a
0x00410c1f
0x00410c1f
0x00410c4f
0x00410c56
0x00410c5b
0x00410c76
0x00410c7c
0x00410c7e
0x00410c8b
0x00410cb0
0x00410c8d
0x00410c8d
0x00410c92
0x00410c97
0x00410c9d
0x00410ca3
0x00410ca8
0x00410ca8
0x00410cbe
0x00410ccb
0x00410cd7
0x00410d0b
0x00410d11
0x00410d1e
0x00410d40
0x00410d20
0x00410d20
0x00410d25
0x00410d2a
0x00410d2d
0x00410d33
0x00410d38
0x00410d38
0x00410d4d
0x00410d56
0x00410d5d
0x00410d5e
0x00410d60
0x00410d65
0x00410d6f
0x00410d8c
0x00410d71
0x00410d71
0x00410d76
0x00410d7b
0x00410d80
0x00410d80
0x00410db0
0x00410db7
0x00410dbc
0x00410dd7
0x00410ddd
0x00410ddf
0x00410dec
0x00410e11
0x00410dee
0x00410dee
0x00410df3
0x00410df8
0x00410dfe
0x00410e04
0x00410e09
0x00410e09
0x00410e18
0x00410e1a
0x00410e1c
0x00410e28
0x00410e29
0x00410e2e
0x00410e38
0x00410e55
0x00410e3a
0x00410e3a
0x00410e3f
0x00410e44
0x00410e49
0x00410e49
0x00410e79
0x00410e80
0x00410e85
0x00410ea0
0x00410ea3
0x00410ea5
0x00410eb2
0x00410ed4
0x00410eb4
0x00410eb4
0x00410eb6
0x00410ebb
0x00410ec1
0x00410ec7
0x00410ecc
0x00410ecc
0x00410ee2
0x00410eff
0x00410ee4
0x00410ee4
0x00410ee9
0x00410eee
0x00410ef3
0x00410ef3
0x00410f23
0x00410f2a
0x00410f2f
0x00410f4a
0x00410f50
0x00410f52
0x00410f5f
0x00410f84
0x00410f61
0x00410f61
0x00410f66
0x00410f6b
0x00410f71
0x00410f77
0x00410f7c
0x00410f7c
0x00410f92
0x00410faf
0x00410f94
0x00410f94
0x00410f99
0x00410f9e
0x00410fa3
0x00410fa3
0x00410fd3
0x00410fda
0x00410fdf
0x00410ffa
0x00411000
0x00411002
0x0041100f
0x00411034
0x00411011
0x00411011
0x00411016
0x0041101b
0x00411021
0x00411027
0x0041102c
0x0041102c
0x00411042
0x0041105f
0x00411044
0x00411044
0x00411049
0x0041104e
0x00411053
0x00411053
0x00411079
0x00411083
0x0041108a
0x0041108f
0x004110aa
0x004110ad
0x004110af
0x004110bc
0x004110de
0x004110be
0x004110be
0x004110c0
0x004110c5
0x004110cb
0x004110d1
0x004110d6
0x004110d6
0x004110ec
0x004110f9
0x004110ff
0x00411116
0x00411134
0x0041113b
0x0041114e
0x0041115a
0x00411189
0x0041118e
0x00411197
0x004111a4
0x004111b1
0x004111ce
0x004111b3
0x004111b3
0x004111b8
0x004111bd
0x004111c2
0x004111c2
0x004111e8
0x004111f2
0x004111f9
0x004111fe
0x00411219
0x0041121f
0x00411221
0x0041122e
0x00411253
0x00411230
0x00411230
0x00411235
0x0041123a
0x00411240
0x00411246
0x0041124b
0x0041124b
0x0041125a
0x0041126b
0x00411285
0x0041129e
0x004112a4
0x004112b1
0x004112d3
0x004112b3
0x004112b3
0x004112b8
0x004112bd
0x004112c0
0x004112c6
0x004112cb
0x004112cb
0x004112da
0x004112e3
0x004112ee
0x004112f9
0x00411300
0x00411301
0x00411304
0x00411305
0x0041130a
0x0041130a
0x0041131d
0x0041132f
0x00411332

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0040ECE2
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,000006F8), ref: 0040ED40
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040ED67
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EDA3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403008,00000160), ref: 0040EDF0
__vbaStrCopy.MSVBVM60(00000000,00000000,00403008,00000160), ref: 0040EE63
__vbaChkstk.MSVBVM60(?,89A062F0,004CF1D8), ref: 0040EE7E
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,000006FC,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EEEA
__vbaFreeStr.MSVBVM60(?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF04
__vbaFreeObj.MSVBVM60(?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF0F
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF27
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF63
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403008,00000088,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EFB0
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EFD7
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040F013
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403034,00000078,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040F05A
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,00000700,?,?,EEA80150,?,0000417B,?,?,?,?,00001BA0,295DF0F0,?), ref: 0040F10B
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,EEA80150,?,0000417B,?,?,?,?,00001BA0,295DF0F0,?,?), ref: 0040F13A
__vbaNew2.MSVBVM60(00402888,00417010,?,?,004012D6), ref: 0040F155
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F191
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000170), ref: 0040F1DE
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F205
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F241
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000078), ref: 0040F288
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F2AF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F2EB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000158), ref: 0040F338
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F35D
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,?,?,004012D6), ref: 0040F378
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F3B4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000160), ref: 0040F401
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F426
__vbaI4Var.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 0040F435
__vbaStrMove.MSVBVM60 ref: 0040F488
__vbaI4Var.MSVBVM60(?,?), ref: 0040F49B
__vbaChkstk.MSVBVM60(00006849,?,?,?,?,?,00000000,?,?), ref: 0040F4CE
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,?,?), ref: 0040F50C
__vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0040F53D
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?), ref: 0040F555
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,?,?,?,?,?,?), ref: 0040F570
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F5AC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000178), ref: 0040F5F9
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F620
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F65C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000000E0), ref: 0040F6A9
__vbaChkstk.MSVBVM60(00000009,00000003,?,000046A8,?), ref: 0040F74C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040F780
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040F798
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F7B3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F7EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000000D0), ref: 0040F83C
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F863
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F89F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,000000F8), ref: 0040F8EE
__vbaStrMove.MSVBVM60(00000000,?,00403008,000000F8), ref: 0040F92A
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,00000704), ref: 0040F97F
__vbaFreeStr.MSVBVM60(00000000,004011B0,00402E78,00000704), ref: 0040F9AE
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040F9C3
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040F9DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FA1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000130), ref: 0040FA67
__vbaFreeObj.MSVBVM60(?,?,?,00000009), ref: 0040FADD
__vbaFreeVar.MSVBVM60(?,?,?,00000009), ref: 0040FAE8
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,00000009), ref: 0040FB00
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000009), ref: 0040FB3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000130,?,?,?,00000009), ref: 0040FB89
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,00000009), ref: 0040FBB0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000009), ref: 0040FBEC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000170,?,?,?,00000009), ref: 0040FC39
__vbaChkstk.MSVBVM60(682F9540,00005AFB,?,?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FCDC
__vbaVarMove.MSVBVM60(?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FD09
__vbaFreeStr.MSVBVM60(?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FD14
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FD29
__vbaFreeVar.MSVBVM60 ref: 0040FD37
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040FD4F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD8B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000120), ref: 0040FDD8
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040FDFF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE3B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000128), ref: 0040FE88
__vbaChkstk.MSVBVM60(00577708,A17C2980,?,?,?), ref: 0040FEF5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040FF36
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0040FF51
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FF8D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000120), ref: 0040FFDA
__vbaChkstk.MSVBVM60(CFB51B00), ref: 00410022
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,00000708), ref: 00410063
__vbaFreeObj.MSVBVM60(00000000,004011B0,00402E78,00000708), ref: 0041007D
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00410095
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100D1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000070), ref: 00410118
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0041013F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041017B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403008,00000218), ref: 004101C8
__vbaNew2.MSVBVM60(00402888,00417010), ref: 004101EF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041022B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000088), ref: 00410278
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0041029F
__vbaObjSet.MSVBVM60(?,00000000), ref: 004102DB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000128), ref: 00410328
__vbaStrMove.MSVBVM60(00000000,?,00403008,00000128), ref: 00410369
__vbaChkstk.MSVBVM60(CFB51B00,?,Abietic6,?,?,?,000249CD,?), ref: 004103CB
__vbaFreeStr.MSVBVM60(?,Abietic6,?,?,?,000249CD,?), ref: 004103F9
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,Abietic6,?,?,?,000249CD,?), ref: 0041041C
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00410437
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410473
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000078), ref: 004104BA
__vbaNew2.MSVBVM60(00402888,00417010), ref: 004104E1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041051D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000050), ref: 00410564
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0041058B
__vbaObjSet.MSVBVM60(?,00000000), ref: 004105C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000098), ref: 00410614
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,0000070C,?,?,?,F1E53680,7A724D90,00005B07,?,?), ref: 004106AD
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,?,F1E53680,7A724D90,00005B07,?,?), ref: 004106E1
__vbaNew2.MSVBVM60(00402888,00417010), ref: 004106FC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410738
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000198), ref: 00410785
__vbaNew2.MSVBVM60(00402888,00417010), ref: 004107AC
__vbaObjSet.MSVBVM60(?,00000000), ref: 004107E8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,000000F8), ref: 00410837
__vbaNew2.MSVBVM60(00402888,00417010), ref: 0041085E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041089A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000070), ref: 004108E1
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00410908
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410944
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000158), ref: 00410991
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004109B6
__vbaI4Var.MSVBVM60(00000000), ref: 004109BF
__vbaStrMove.MSVBVM60 ref: 00410A13
__vbaChkstk.MSVBVM60(A52D5FC0,?,?,0039DF66,?,00000003,0064C426,?), ref: 00410A7E
__vbaFreeStr.MSVBVM60(?,00000003,0064C426,?), ref: 00410AA3
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?,?,00000003,0064C426,?), ref: 00410ACD
__vbaFreeVarList.MSVBVM60(00000002,00000003,?), ref: 00410AE5
__vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002), ref: 00410B4D
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00410B70
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410BAC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000060), ref: 00410BF3
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00410C1A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410C56
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000001D0), ref: 00410CA3
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E78,00000710), ref: 00410D33

Strings

Abietic6, xrefs: 004103B2
Ih, xrefs: 0040F44C
Arbejdsfelterne, xrefs: 0040F714
Performer, xrefs: 0040F455
Tt, xrefs: 004110FF
lynfrysning, xrefs: 00410CFE
Baereevnen5, xrefs: 0040FCED
Uncausative, xrefs: 0040EE58
Intetkoen6, xrefs: 0040EE24

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$Move$CallLate$CopyInit
String ID: Abietic6$Arbejdsfelterne$Baereevnen5$Ih$Intetkoen6$Performer$Tt$Uncausative$lynfrysning
API String ID: 914953069-1889551928
Opcode ID: 55eb7c4c53c0bd0eb14e7f514874bf92f3b18ababc890a6003486b4881b158e4
Instruction ID: 83408f2990e858f43ff2b19e31631f81007ab310d1cbf4e1990e93f5af51411e
Opcode Fuzzy Hash: 55eb7c4c53c0bd0eb14e7f514874bf92f3b18ababc890a6003486b4881b158e4
Instruction Fuzzy Hash: 0D33E575900228EFDB21DF60CC49BD9BBB8BB08304F1044EAE549B72A1DB795AC4DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00414392, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00414392(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v40;
				void* _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				char _v96;
				intOrPtr _v120;
				intOrPtr _v128;
				intOrPtr _v152;
				char _v160;
				void* _v164;
				signed int _v168;
				intOrPtr* _v172;
				signed int _v176;
				signed int _v184;
				char _v188;
				signed int _v192;
				signed int _v196;
				short _t67;
				char* _t71;
				signed int _t77;
				signed int _t83;
				intOrPtr _t98;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t98;
				L004012D0();
				_v12 = _t98;
				_v8 = 0x401200;
				L004013EA();
				_v72 = 0x80020004;
				_v80 = 0xa;
				_v56 = 0xc;
				_v64 = 2;
				_push(1);
				_push(1);
				_push( &_v80);
				_push( &_v64);
				_push( &_v96); // executed
				L004013C0(); // executed
				_v152 = 0xc;
				_v160 = 0x8002;
				_push( &_v96);
				_t67 =  &_v160;
				_push(_t67);
				L004013F6();
				_v164 = _t67;
				_push( &_v96);
				_push( &_v80);
				_push( &_v64);
				_push(3);
				L00401426();
				_t71 = _v164;
				if(_t71 != 0) {
					if( *0x41733c != 0) {
						_v188 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403118);
						L00401456();
						_v188 = 0x41733c;
					}
					_t23 =  &_v188; // 0x41733c
					_v164 =  *((intOrPtr*)( *_t23));
					_t77 =  *((intOrPtr*)( *_v164 + 0x4c))(_v164,  &_v44);
					asm("fclex");
					_v168 = _t77;
					if(_v168 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x403104);
						_push(_v164);
						_push(_v168);
						L00401462();
						_v192 = _t77;
					}
					_v172 = _v44;
					_v120 = 3;
					_v128 = 2;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t83 =  *((intOrPtr*)( *_v172 + 0x1c))(_v172, 0x10,  &_v48);
					asm("fclex");
					_v176 = _t83;
					if(_v176 >= 0) {
						_v196 = _v196 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x403128);
						_push(_v172);
						_push(_v176);
						L00401462();
						_v196 = _t83;
					}
					_v184 = _v48;
					_v48 = _v48 & 0x00000000;
					_push(_v184);
					_t71 =  &_v24;
					_push(_t71);
					L0040145C();
					L00401444();
				}
				_push(0x4145b4);
				L00401444();
				L00401420();
				return _t71;
			}

0x00414397
0x004143a2
0x004143a3
0x004143af
0x004143b7
0x004143ba
0x004143c7
0x004143cc
0x004143d3
0x004143da
0x004143e1
0x004143e8
0x004143ea
0x004143ef
0x004143f3
0x004143f7
0x004143f8
0x004143fd
0x00414407
0x00414414
0x00414415
0x0041441b
0x0041441c
0x00414421
0x0041442b
0x0041442f
0x00414433
0x00414434
0x00414436
0x0041443e
0x00414447
0x00414454
0x00414471
0x00414456
0x00414456
0x0041445b
0x00414460
0x00414465
0x00414465
0x0041447b
0x00414483
0x0041449b
0x0041449e
0x004144a0
0x004144ad
0x004144cf
0x004144af
0x004144af
0x004144b1
0x004144b6
0x004144bc
0x004144c2
0x004144c7
0x004144c7
0x004144d9
0x004144df
0x004144e6
0x004144f4
0x004144fe
0x004144ff
0x00414500
0x00414501
0x00414510
0x00414513
0x00414515
0x00414522
0x00414544
0x00414524
0x00414524
0x00414526
0x0041452b
0x00414531
0x00414537
0x0041453c
0x0041453c
0x0041454e
0x00414554
0x00414558
0x0041455e
0x00414561
0x00414562
0x0041456a
0x0041456a
0x0041456f
0x004145a6
0x004145ae
0x004145b3

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004143AF
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 004143C7
#660.MSVBVM60(?,00000002,0000000A,00000001,00000001), ref: 004143F8
__vbaVarTstNe.MSVBVM60(00008002,?), ref: 0041441C
__vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?,00008002,?), ref: 00414436
__vbaNew2.MSVBVM60(00403118,0041733C), ref: 00414460
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,0000004C), ref: 004144C2
__vbaChkstk.MSVBVM60(?), ref: 004144F4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403128,0000001C), ref: 00414537
__vbaObjSet.MSVBVM60(?,?), ref: 00414562
__vbaFreeObj.MSVBVM60(?,?), ref: 0041456A
__vbaFreeObj.MSVBVM60(004145B4), ref: 004145A6
__vbaFreeVar.MSVBVM60(004145B4), ref: 004145AE

Strings

<sA, xrefs: 0041447B

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#660ListNew2
String ID: <sA
API String ID: 2914822365-3623460565
Opcode ID: fb2ae9aa05378669f9bc09b1862ca39a2ec322dcf43a56d704b71497045095a4
Instruction ID: 6858b5034fdd6ea81b2d101013c19568dd4ff41ac1d111ba6fd961ffad4c1749
Opcode Fuzzy Hash: fb2ae9aa05378669f9bc09b1862ca39a2ec322dcf43a56d704b71497045095a4
Instruction Fuzzy Hash: B5510671D00218EFDB20DF91CC45BDEBBB9AF09304F1080AAE509B71A1D7B85A85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401480, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 69%

			_entry_(signed int __eax, void* __ebx, intOrPtr __ecx, signed int __edx, unsigned int __edi, void* __esi) {
				signed int _t29;
				signed int _t31;
				signed int _t32;
				signed int _t34;
				signed char _t36;
				signed char _t39;
				signed char _t40;
				intOrPtr _t43;
				intOrPtr _t44;
				void* _t45;
				signed int* _t48;
				signed char _t50;
				unsigned int _t52;
				void* _t53;
				signed int _t55;
				void* _t60;
				void* _t63;
				intOrPtr _t66;

				_push("VB5!6&*"); // executed
				L0040147A(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t29 = __eax + 1;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *((intOrPtr*)(_t29 - 0x5060f6db)) =  *((intOrPtr*)(_t29 - 0x5060f6db)) + __ebx;
				_t31 = _t29 & 0x3eaf9f09;
				_t3 = __edx - 0x68;
				 *_t3 = __ecx;
				_pop(ds);
				asm("fcomi st0, st4");
				_t52 = __edi >> 0xc6;
				_push(ds);
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				_t32 = _t31 | 0x200a0d0a;
				 *(_t32 + 0x72) =  *(_t32 + 0x72) & __edx;
				asm("outsd");
				_push(0x65);
				asm("arpl [ecx+esi], si");
				_t50 = __edx ^  *(__edx + __esi + 0x33);
				 *_t32 =  *_t32 + _t32;
				_t43 = __ebx + __ebx;
				asm("int3");
				 *_t32 =  *_t32 ^ _t32;
				_t34 = _t32 + 0x00000058 ^ _t50;
				_t48 =  *_t3 -  *((intOrPtr*)(_t52 - 0x52bc388a));
				 *(__esi - 0x42) =  *(__esi - 0x42) << 0x9e;
				_push(ds);
				asm("retf");
				asm("in al, dx");
				_push(ss);
				asm("repne loopne 0x20");
				asm("sbb eax, 0x466eccdd");
				_t12 = _t50 - 0x319a1a0c;
				_t44 =  *_t12;
				 *_t12 = _t43;
				asm("sbb [esi+0x33ad4f3a], esi");
				asm("cdq");
				asm("iretw");
				asm("adc [edi+0xaa000c], esi");
				asm("pushad");
				asm("rcl dword [ebx], cl");
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				asm("out dx, al");
				 *0xb =  *0xb + _t44;
				_t36 = _t34 |  *_t34 |  *(_t34 |  *_t34);
				_push(_t44);
				_t45 = _t44 - 1;
				_t53 = _t52 - 1;
				_push(__esi);
				_t55 = __esi + 1;
				_push(_t57);
				_t63 = _t60 + 1;
				 *0x54000901 =  *0x54000901 + _t48;
				_t66 =  *0x54000901;
				asm("gs outsb");
				if(_t66 != 0) {
					asm("popad");
					if(_t66 < 0) {
						L6:
						asm("stosb");
						asm("stosb");
						asm("stosb");
						 *((intOrPtr*)(_t50 - 0x4bff4d4e)) =  *((intOrPtr*)(_t50 - 0x4bff4d4e)) + _t50;
						 *((intOrPtr*)(_t55 - 0x3cff4142)) =  *((intOrPtr*)(_t55 - 0x3cff4142)) + _t45;
						return 0xb4;
					}
					if (_t66 >= 0) goto L5;
					asm("sbb [ecx], eax");
					 *_t50 =  *_t50 + _t36;
					_t39 = _t36 &  *_t48 |  *(_t36 &  *_t48);
					 *((intOrPtr*)(_t63 + _t55 * 2)) =  *((intOrPtr*)(_t63 + _t55 * 2)) + _t48;
					_t50 = _t50 + _t39;
					_t40 = _t39 |  *_t39;
					 *_t40 =  *_t40 + _t40;
					 *_t48 =  *_t48 + _t40;
					 *_t48 =  *_t48 + _t40;
					 *_t40 =  *_t40 + _t50;
					asm("adc [eax], al");
					 *_t48 =  *_t48 + _t40;
					 *_t40 =  *_t40 + _t48;
					 *((intOrPtr*)(_t40 + 5)) =  *((intOrPtr*)(_t40 + 5)) + _t48;
					 *_t40 =  *_t40 + _t40;
					_push(ss);
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t48;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t50;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t48 =  *_t48 + _t40;
					 *_t40 =  *_t40 + _t48;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *_t40 =  *_t40 + _t40;
					 *((intOrPtr*)(_t53 - 0x5eff6061)) =  *((intOrPtr*)(_t53 - 0x5eff6061)) + _t45;
					asm("movsd");
					 *((intOrPtr*)(_t50 - 0x4dff5556)) =  *((intOrPtr*)(_t50 - 0x4dff5556)) + _t48;
					goto L6;
				}
				return _t36;
			}

0x00401480
0x00401485
0x0040148a
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401495
0x00401497
0x00401499
0x0040149b
0x0040149d
0x004014a2
0x004014a2
0x004014a5
0x004014a6
0x004014a8
0x004014ab
0x004014ac
0x004014ae
0x004014b0
0x004014b2
0x004014b4
0x004014b6
0x004014bb
0x004014be
0x004014bf
0x004014c1
0x004014c7
0x004014cd
0x004014cf
0x004014d1
0x004014d2
0x004014d6
0x004014d8
0x004014de
0x004014e2
0x004014e3
0x004014e4
0x004014e5
0x004014e6
0x004014e8
0x004014ed
0x004014ed
0x004014ed
0x004014f3
0x004014f9
0x004014fa
0x004014fc
0x00401502
0x00401503
0x00401509
0x0040150b
0x0040150d
0x0040150f
0x00401511
0x00401513
0x00401515
0x00401517
0x00401519
0x0040151b
0x0040151d
0x0040151f
0x00401521
0x00401523
0x00401525
0x00401527
0x00401529
0x0040152c
0x00401532
0x00401534
0x00401535
0x00401536
0x00401537
0x00401539
0x0040153a
0x0040153c
0x0040153e
0x0040153e
0x00401544
0x00401546
0x00401548
0x00401549
0x004015af
0x004015af
0x004015b0
0x004015b1
0x004015b2
0x004015ba
0x00000000
0x004015bc
0x0040154b
0x0040154d
0x0040154f
0x00401556
0x00401558
0x0040155c
0x0040155e
0x00401560
0x00401562
0x00401564
0x00401566
0x00401568
0x0040156a
0x0040156c
0x0040156e
0x00401571
0x00401573
0x00401574
0x00401576
0x00401578
0x0040157a
0x0040157c
0x0040157e
0x00401580
0x00401582
0x00401584
0x00401586
0x00401588
0x0040158a
0x0040158c
0x0040158e
0x00401590
0x00401592
0x00401594
0x00401596
0x00401598
0x0040159a
0x0040159c
0x0040159e
0x004015a0
0x004015a2
0x004015ad
0x004015ae
0x00000000
0x004015ae
0x004015bf

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401485

Strings

VB5!6&*, xrefs: 00401480

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: a850b7556e3d35d0545bb3dcf670813dcc8f117d3f7fede3177f3ec8954981b0
Instruction ID: 8b877e2aa30a233567ae8d78e773a4d1f6a574cc78d47e03e27a233741c35b32
Opcode Fuzzy Hash: a850b7556e3d35d0545bb3dcf670813dcc8f117d3f7fede3177f3ec8954981b0
Instruction Fuzzy Hash: B301C81184E3C21FD3279B785D259827FB16D4362079A02DBC091DF8F3D24A4E89C362

Uniqueness

Uniqueness Score: -1.00%

Function 00405D79, Relevance: 1.4, APIs: 1, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00405D88

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a618beb64bbf3088457474b860e6f1b6aebb14318bc75ce4c34b013ac30b83a1
Instruction ID: 4c409c6f5dfe003b3ee0b2f82c9e6cb53d9d75a0e02bb81c49d113e8a6b85464
Opcode Fuzzy Hash: a618beb64bbf3088457474b860e6f1b6aebb14318bc75ce4c34b013ac30b83a1
Instruction Fuzzy Hash: 61F0E930517721FAC6684DF488C8077A358DF03F21314767FD86AA5281DE7D81C3994A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00754545, Relevance: 14.1, Strings: 11, Instructions: 384COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
:F, xrefs: 007531EF
W#/, xrefs: 00752C90
sk4G, xrefs: 007531F5
F, xrefs: 0075321C
rX4, xrefs: 00754579
sk4G, xrefs: 007531FA
[r, xrefs: 00753169
Y;X@, xrefs: 007531CD
Y;X@, xrefs: 007531D2

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/$Y;X@$Y;X@$sk4G$sk4G$F$:F$rX4
API String ID: 0-470289104
Opcode ID: 734ba47be833957b6f7e5950cb585671ce22e685ec2852b6c86df3613ea8ab2a
Instruction ID: ec337e978bc710c0eb9c00c9f153233ab930ab6467f29b3138dc9b9f2562ad98
Opcode Fuzzy Hash: 734ba47be833957b6f7e5950cb585671ce22e685ec2852b6c86df3613ea8ab2a
Instruction Fuzzy Hash: BBC12571740309AFFF242E24CC99BE936A1EF15791F604029FD85AB191C7FD9C898B85

Uniqueness

Uniqueness Score: -1.00%

Function 0075629D, Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
`, xrefs: 00756398
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/$`
API String ID: 0-3721009112
Opcode ID: 805da68c5a27483afce093e769c34650e139ab5bcb0828551d33f0264d672cee
Instruction ID: a956b3203d2c42974a458f80098d83e1a88b835f7e7c4848702df7f778063c79
Opcode Fuzzy Hash: 805da68c5a27483afce093e769c34650e139ab5bcb0828551d33f0264d672cee
Instruction Fuzzy Hash: 6BC14571740309AFFF241E24CC99BE936A1EF157A1FA04029FD45AB191C7FD98C98B85

Uniqueness

Uniqueness Score: -1.00%

Function 00751B23, Relevance: 5.8, Strings: 4, Instructions: 805COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: c63441a0f05be277e926a09e10dfd48ce5bd28775e6d7041fcf68b8d2e49de30
Instruction ID: 21e563f5c4fed6191c9f0dfc1f2b2fd6b5dfa8e709bf23902d3fdd08dd08d74b
Opcode Fuzzy Hash: c63441a0f05be277e926a09e10dfd48ce5bd28775e6d7041fcf68b8d2e49de30
Instruction Fuzzy Hash: F4429971740706AFEB245E28CCA9BE673A5FF05351FA44229FC4897281C7F99C89CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0075247F, Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: 179c2de62490cd343b904c579f470a083f92f4e60a9351055704ddc6e1876505
Instruction ID: 12a23e294aaa6983b9ada3f2635c33568d6617edb79c3c712df15cc736820257
Opcode Fuzzy Hash: 179c2de62490cd343b904c579f470a083f92f4e60a9351055704ddc6e1876505
Instruction Fuzzy Hash: 76E15670740306AFFF202E24CCA9BEA36A5EF15791FA04019FD859B1D1D7FD98898B85

Uniqueness

Uniqueness Score: -1.00%

Function 007521BE, Relevance: 5.5, Strings: 4, Instructions: 452COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: 9c5e26da755f9c74364da7dc8cad9732c67504d93839a4348950bb31048787cb
Instruction ID: 61b93e0dcdbbf11f7e1f18849cb376de00ccf3d476949ee0e61770ba461f3796
Opcode Fuzzy Hash: 9c5e26da755f9c74364da7dc8cad9732c67504d93839a4348950bb31048787cb
Instruction Fuzzy Hash: 8FE17971780306AFEB246E28CCA9BEA33A5FF15391F604125FD8597181D7FD9C898781

Uniqueness

Uniqueness Score: -1.00%

Function 0075273B, Relevance: 5.4, Strings: 4, Instructions: 438COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: cbcc3b8a33e028dfb3bfac164aa1fc6e14a792da9747401eca3f7496bf86d5b4
Instruction ID: 3d3b603675365d2cb7c939e2177d7f3ec207b473970de98b13f9febbff5b2286
Opcode Fuzzy Hash: cbcc3b8a33e028dfb3bfac164aa1fc6e14a792da9747401eca3f7496bf86d5b4
Instruction Fuzzy Hash: 9CE186B1640306AFFB241E24CC99BEA3765EF153A1F604128FD859B1E1C7FC9889CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0075370D, Relevance: 5.4, Strings: 4, Instructions: 387COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: a148fc92a2186ae7f8e95207bddd140ecb6fc5de0eba329c8e3254dac9aacc56
Instruction ID: 6a3de5d2096262fbb28f3300c9c6a977c75f04ade0607c056809a2385735d7d0
Opcode Fuzzy Hash: a148fc92a2186ae7f8e95207bddd140ecb6fc5de0eba329c8e3254dac9aacc56
Instruction Fuzzy Hash: FFC188B1740306AFFF202E24CCA9BEA3665EF15391FA04025FD85AB1E1C7FD98898755

Uniqueness

Uniqueness Score: -1.00%

Function 0075125B, Relevance: 5.4, Strings: 4, Instructions: 372COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: f4af5e142c68971bd131c82482d8e5da5bd04a893331cb05b4c58b5036eea9b1
Instruction ID: 41663a73ce429fe19d238ec0f96c360855ec8c2e26e869d50f30af8c4187ac57
Opcode Fuzzy Hash: f4af5e142c68971bd131c82482d8e5da5bd04a893331cb05b4c58b5036eea9b1
Instruction Fuzzy Hash: 72C1347074030AAFFF302E24CC59BE93666EF15791FA04015FE45AB191C7FD98898B85

Uniqueness

Uniqueness Score: -1.00%

Function 00752842, Relevance: 5.4, Strings: 4, Instructions: 357COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: ad4af5e36cd5474c6951ba575110a3745bb40506c1fa491be21370438f5705c4
Instruction ID: 891a342dc275023ef3a98338e0ca4895d80b8bde96d90fb621f8ddd5737395a8
Opcode Fuzzy Hash: ad4af5e36cd5474c6951ba575110a3745bb40506c1fa491be21370438f5705c4
Instruction Fuzzy Hash: 58C14471780706AFFF201E24CC99BE93661EF15791F604029FE85AB2D1C7FD98898B85

Uniqueness

Uniqueness Score: -1.00%

Function 00752620, Relevance: 5.3, Strings: 4, Instructions: 337COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: 55f8b613aaca87dfafeb934bd7afa6a205ebb62fe5f16a8836835bbd18a6d0fb
Instruction ID: 9f50388cde42d7d82c0b0f26cbf7f4cf08dea620697d3b033a03d372ea84c08f
Opcode Fuzzy Hash: 55f8b613aaca87dfafeb934bd7afa6a205ebb62fe5f16a8836835bbd18a6d0fb
Instruction Fuzzy Hash: 39B1267178030AAFFF202E24CC9ABEA3665EF15791F604015FE85AB1D1C7FD98898785

Uniqueness

Uniqueness Score: -1.00%

Function 0075282D, Relevance: 5.3, Strings: 4, Instructions: 319COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: 1a5253c8074a47eeb5cc1cf1f7ec1de63bfd84a93b8b0d99365d8bce5c01c7eb
Instruction ID: 80302abee6318f61377c4b15be50dd9a810d37bb20a85cbbd14abb35a75a6d12
Opcode Fuzzy Hash: 1a5253c8074a47eeb5cc1cf1f7ec1de63bfd84a93b8b0d99365d8bce5c01c7eb
Instruction Fuzzy Hash: 97A1567178030AAFFF202E24CC99BEA3665EF15791F604025FE85AB1D1C7FD98898785

Uniqueness

Uniqueness Score: -1.00%

Function 00752B1D, Relevance: 5.3, Strings: 4, Instructions: 309COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: b1b0e88d76bf3ceb48fd72fa95ff4e3b01304b87959395de8d826ead2b1681dc
Instruction ID: 6083b11300e89db68b41f8280bda88baafa10df5bd333141ea4b363c81691bdb
Opcode Fuzzy Hash: b1b0e88d76bf3ceb48fd72fa95ff4e3b01304b87959395de8d826ead2b1681dc
Instruction Fuzzy Hash: B8A1577178030AAFFF201E24CC99BEA3665EF15791F604024FE85AB1D1C7FD98898785

Uniqueness

Uniqueness Score: -1.00%

Function 00752BB9, Relevance: 5.3, Strings: 4, Instructions: 279COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: cadee7fe825ab662c8023772fcafd3d7a8e928e776ae44cc621071be53015f24
Instruction ID: ae32770a0df6c223e20b6acab74f603a45d8cee927f0d4a2ab11364952b2d3b5
Opcode Fuzzy Hash: cadee7fe825ab662c8023772fcafd3d7a8e928e776ae44cc621071be53015f24
Instruction Fuzzy Hash: B591357168070AAFFF202E24CC99BE93665EF15391F604029FD45A7291C7FD98C9CB85

Uniqueness

Uniqueness Score: -1.00%

Function 00752CEF, Relevance: 2.7, Strings: 2, Instructions: 248COMMON

Download Yara Rule

Strings

6NI', xrefs: 007530B8
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'
API String ID: 0-1201106860
Opcode ID: 716ce41ba88269be0e484092f5f068527edf28cfd5ca1f5d13b36be9bc964d47
Instruction ID: 318a07c8e6d0ecb3ad9ad0685bec77e26e8444df13a4f2963ffec7562f0ade21
Opcode Fuzzy Hash: 716ce41ba88269be0e484092f5f068527edf28cfd5ca1f5d13b36be9bc964d47
Instruction Fuzzy Hash: 30812071680309AFFF211E24CC99BE93661EF15391F604029FD85AB191C7FD98C98B85

Uniqueness

Uniqueness Score: -1.00%

Function 00752DB5, Relevance: 2.7, Strings: 2, Instructions: 196COMMON

Download Yara Rule

Strings

6NI', xrefs: 007530B8
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'
API String ID: 0-1201106860
Opcode ID: afefa3c8013af26984de3cef96f48ba6cf4723a4b430c36c31c560b89f2ac78d
Instruction ID: 007bef9e183fe8eda9def035aa20cb52829516427590ab0ba0e8caa7f00280c8
Opcode Fuzzy Hash: afefa3c8013af26984de3cef96f48ba6cf4723a4b430c36c31c560b89f2ac78d
Instruction Fuzzy Hash: C7514371A80608AFFF351D24DC99BE93666EF18391F600025FD85EA1A1CBF99CC89785

Uniqueness

Uniqueness Score: -1.00%

Function 00752E61, Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

6NI', xrefs: 007530B8
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'
API String ID: 0-1201106860
Opcode ID: 3b6f0db006c8a30f947851d23e83192b323e8316767334519eab7c94b3e40962
Instruction ID: f4d4f9604fae6e954d1c248a4c25fea30356becb70b94c01f048acb33e25afef
Opcode Fuzzy Hash: 3b6f0db006c8a30f947851d23e83192b323e8316767334519eab7c94b3e40962
Instruction Fuzzy Hash: A95177716842896FEF361A248C997E83B66EF1A3D1F580019FD85D60A2C7EE4C8D8785

Uniqueness

Uniqueness Score: -1.00%

Function 007521FD, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c565eaaf4f4e1bb3a16f662a245f1fc10718698e6962b998cabc1789b5e081f
Instruction ID: 3ff900e44dd61a58424222d494554f3b079b68a7b9a4a9da8b21564dd610c719
Opcode Fuzzy Hash: 7c565eaaf4f4e1bb3a16f662a245f1fc10718698e6962b998cabc1789b5e081f
Instruction Fuzzy Hash: 3E416A31740607DFDB24AA288C64BE673A5FF16361FA84225ECD5CB242DB59DC8F8B50

Uniqueness

Uniqueness Score: -1.00%

Function 00756188, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991dc887d273eef3d6444bba3381768c3b96606fdf665c8aff6478bfc41e7e81
Instruction ID: 987ac897edefe5f337edee38fd4a88ee8f1d2b78cdfcbe517e4b67782afc56a4
Opcode Fuzzy Hash: 991dc887d273eef3d6444bba3381768c3b96606fdf665c8aff6478bfc41e7e81
Instruction Fuzzy Hash: 80F0ED763962048FC714DA28D4E0FD5B3A2BF67312FD58064E944C3222CB38EC8ACA24

Uniqueness

Uniqueness Score: -1.00%

Function 007534AB, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c4020350d4328f3e1cfd970057831396fb06a88354af25c1eaff0d9d1f75ba
Instruction ID: 9a44ba166c343d35435025e9eb1f2908f530e90f1ad91929ff2e83a4e273e948
Opcode Fuzzy Hash: b9c4020350d4328f3e1cfd970057831396fb06a88354af25c1eaff0d9d1f75ba
Instruction Fuzzy Hash: 0DE04F366011608BEF54FE1CC091B8973E4FB55755F0944B9EC96DB311C6A8EC45CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00755C4B, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5203b75253c4d8c7fa274c9eb81c00d0e22fb20daaa05a2cb249943f34e761
Instruction ID: ddf7f51b860b03f21535a1efd86e3a15d609469e836282a7d938803d5b48cda4
Opcode Fuzzy Hash: 6a5203b75253c4d8c7fa274c9eb81c00d0e22fb20daaa05a2cb249943f34e761
Instruction Fuzzy Hash: 73B00275655645CFCE55DF09D190F4173B4F758750F8154D0E455C7F11C264E900C910

Uniqueness

Uniqueness Score: -1.00%

Function 00414DD3, Relevance: 84.3, APIs: 42, Strings: 6, Instructions: 343
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00414DD3(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v40;
				char _v44;
				char _v48;
				signed int _v52;
				char _v68;
				signed int _v92;
				char _v100;
				char* _v124;
				intOrPtr _v132;
				char _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v176;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				intOrPtr* _v200;
				signed int _v204;
				char _v208;
				signed int _v212;
				signed int _t148;
				char* _t151;
				signed int _t156;
				signed int _t160;
				signed int _t168;
				signed int _t172;
				char* _t176;
				signed int _t177;
				char* _t178;
				signed int _t182;
				signed int _t186;
				signed int _t193;
				void* _t235;
				intOrPtr _t237;

				 *[fs:0x0] = _t237;
				L004012D0();
				_v12 = _t237;
				_v8 = 0x401280;
				L004013EA();
				_v92 = L"VB.Line";
				_v100 = 8;
				_v124 = L"Dataskrmernes4";
				_v132 = 8;
				_t148 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v48, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, __ecx, __ecx, _t235);
				asm("fclex");
				_v156 = _t148;
				if(_v156 >= 0) {
					_v180 = _v180 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x402e48);
					_push(_a4);
					_push(_v156);
					L00401462();
					_v180 = _t148;
				}
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(2);
				_push(L"Add");
				_push(_v48);
				_t151 =  &_v68;
				_push(_t151);
				L00401384();
				_push(_t151);
				L0040138A();
				_push(_t151);
				_push( &_v44);
				L00401390();
				L00401444();
				L00401420();
				if( *0x417010 != 0) {
					_v184 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v184 = 0x417010;
				}
				_t156 =  &_v48;
				L0040145C();
				_v156 = _t156;
				_t160 =  *((intOrPtr*)( *_v156 + 0x98))(_v156,  &_v152, _t156,  *((intOrPtr*)( *((intOrPtr*)( *_v184)) + 0x2fc))( *_v184));
				asm("fclex");
				_v160 = _t160;
				if(_v160 >= 0) {
					_v188 = _v188 & 0x00000000;
				} else {
					_push(0x98);
					_push(0x403034);
					_push(_v156);
					_push(_v160);
					L00401462();
					_v188 = _t160;
				}
				_v92 = _v152;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"X1");
				_push(_v44);
				L0040137E();
				L00401444();
				_v92 = 0x64d1;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"X2");
				_push(_v44);
				L0040137E();
				_v92 = 0x3aae;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Y1");
				_push(_v44);
				L0040137E();
				if( *0x417010 != 0) {
					_v192 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v192 = 0x417010;
				}
				_t168 =  &_v48;
				L0040145C();
				_v156 = _t168;
				_t172 =  *((intOrPtr*)( *_v156 + 0xd0))(_v156,  &_v152, _t168,  *((intOrPtr*)( *((intOrPtr*)( *_v192)) + 0x300))( *_v192));
				asm("fclex");
				_v160 = _t172;
				if(_v160 >= 0) {
					_v196 = _v196 & 0x00000000;
				} else {
					_push(0xd0);
					_push(0x403080);
					_push(_v156);
					_push(_v160);
					L00401462();
					_v196 = _t172;
				}
				_v92 = _v152;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Y2");
				_push(_v44);
				L0040137E();
				L00401444();
				_v92 = _v92 | 0xffffffff;
				_v100 = 0xb;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Visible");
				_push(_v44);
				L0040137E();
				_v92 = 1;
				_v100 = 0x8002;
				_push(0);
				_push(L"BorderStyle");
				_push(_v44);
				_t176 =  &_v68;
				_push(_t176);
				L00401384();
				_push(_t176);
				_t177 =  &_v100;
				_push(_t177);
				L004013F6();
				_v156 = _t177;
				L00401420();
				_t178 = _v156;
				if(_t178 != 0) {
					if( *0x417010 != 0) {
						_v200 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v200 = 0x417010;
					}
					_t182 =  &_v48;
					L0040145C();
					_v156 = _t182;
					_t186 =  *((intOrPtr*)( *_v156 + 0x1d0))(_v156,  &_v152, _t182,  *((intOrPtr*)( *((intOrPtr*)( *_v200)) + 0x300))( *_v200));
					asm("fclex");
					_v160 = _t186;
					if(_v160 >= 0) {
						_v204 = _v204 & 0x00000000;
					} else {
						_push(0x1d0);
						_push(0x403080);
						_push(_v156);
						_push(_v160);
						L00401462();
						_v204 = _t186;
					}
					if( *0x41733c != 0) {
						_v208 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403118);
						L00401456();
						_v208 = 0x41733c;
					}
					_t116 =  &_v208; // 0x41733c
					_v164 =  *((intOrPtr*)( *_t116));
					_v92 = 0xa8;
					_v100 = 2;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t193 =  *((intOrPtr*)( *_v164 + 0x34))(_v164, 0x10, _v152,  &_v52);
					asm("fclex");
					_v168 = _t193;
					if(_v168 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x34);
						_push(0x403104);
						_push(_v164);
						_push(_v168);
						L00401462();
						_v212 = _t193;
					}
					_v176 = _v52;
					_v52 = _v52 & 0x00000000;
					_push(_v176);
					_t178 =  &_v24;
					_push(_t178);
					L0040145C();
					L00401444();
				}
				_push(0x415326);
				L00401444();
				L00401420();
				L00401444();
				return _t178;
			}

0x00414de4
0x00414df0
0x00414df8
0x00414dfb
0x00414e08
0x00414e0d
0x00414e14
0x00414e1b
0x00414e22
0x00414e35
0x00414e3b
0x00414e3d
0x00414e4a
0x00414e6c
0x00414e4c
0x00414e4c
0x00414e51
0x00414e56
0x00414e59
0x00414e5f
0x00414e64
0x00414e64
0x00414e73
0x00414e76
0x00414e80
0x00414e81
0x00414e82
0x00414e83
0x00414e84
0x00414e87
0x00414e91
0x00414e92
0x00414e93
0x00414e94
0x00414e95
0x00414e97
0x00414e9c
0x00414e9f
0x00414ea2
0x00414ea3
0x00414eab
0x00414eac
0x00414eb1
0x00414eb5
0x00414eb6
0x00414ebe
0x00414ec6
0x00414ed2
0x00414eef
0x00414ed4
0x00414ed4
0x00414ed9
0x00414ede
0x00414ee3
0x00414ee3
0x00414f13
0x00414f17
0x00414f1c
0x00414f37
0x00414f3d
0x00414f3f
0x00414f4c
0x00414f71
0x00414f4e
0x00414f4e
0x00414f53
0x00414f58
0x00414f5e
0x00414f64
0x00414f69
0x00414f69
0x00414f7f
0x00414f83
0x00414f8a
0x00414f8d
0x00414f97
0x00414f98
0x00414f99
0x00414f9a
0x00414f9b
0x00414fa0
0x00414fa3
0x00414fab
0x00414fb0
0x00414fb7
0x00414fbe
0x00414fc1
0x00414fcb
0x00414fcc
0x00414fcd
0x00414fce
0x00414fcf
0x00414fd4
0x00414fd7
0x00414fdc
0x00414fe3
0x00414fea
0x00414fed
0x00414ff7
0x00414ff8
0x00414ff9
0x00414ffa
0x00414ffb
0x00415000
0x00415003
0x0041500f
0x0041502c
0x00415011
0x00415011
0x00415016
0x0041501b
0x00415020
0x00415020
0x00415050
0x00415054
0x00415059
0x00415074
0x0041507a
0x0041507c
0x00415089
0x004150ae
0x0041508b
0x0041508b
0x00415090
0x00415095
0x0041509b
0x004150a1
0x004150a6
0x004150a6
0x004150bc
0x004150c0
0x004150c7
0x004150ca
0x004150d4
0x004150d5
0x004150d6
0x004150d7
0x004150d8
0x004150dd
0x004150e0
0x004150e8
0x004150ed
0x004150f1
0x004150f8
0x004150fb
0x00415105
0x00415106
0x00415107
0x00415108
0x00415109
0x0041510e
0x00415111
0x00415116
0x0041511d
0x00415124
0x00415126
0x0041512b
0x0041512e
0x00415131
0x00415132
0x0041513a
0x0041513b
0x0041513e
0x0041513f
0x00415144
0x0041514e
0x00415153
0x0041515c
0x00415169
0x00415186
0x0041516b
0x0041516b
0x00415170
0x00415175
0x0041517a
0x0041517a
0x004151aa
0x004151ae
0x004151b3
0x004151ce
0x004151d4
0x004151d6
0x004151e3
0x00415208
0x004151e5
0x004151e5
0x004151ea
0x004151ef
0x004151f5
0x004151fb
0x00415200
0x00415200
0x00415216
0x00415233
0x00415218
0x00415218
0x0041521d
0x00415222
0x00415227
0x00415227
0x0041523d
0x00415245
0x0041524b
0x00415252
0x00415266
0x00415270
0x00415271
0x00415272
0x00415273
0x00415282
0x00415285
0x00415287
0x00415294
0x004152b6
0x00415296
0x00415296
0x00415298
0x0041529d
0x004152a3
0x004152a9
0x004152ae
0x004152ae
0x004152c0
0x004152c6
0x004152ca
0x004152d0
0x004152d3
0x004152d4
0x004152dc
0x004152dc
0x004152e1
0x00415310
0x00415318
0x00415320
0x00415325

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414DF0
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414E08
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402E48,00000218), ref: 00414E5F
__vbaChkstk.MSVBVM60(00000000,?,00402E48,00000218), ref: 00414E76
__vbaChkstk.MSVBVM60(00000000,?,00402E48,00000218), ref: 00414E87
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00414EA3
__vbaObjVar.MSVBVM60(00000000), ref: 00414EAC
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000), ref: 00414EB6
__vbaFreeObj.MSVBVM60(?,00000000,00000000), ref: 00414EBE
__vbaFreeVar.MSVBVM60(?,00000000,00000000), ref: 00414EC6
__vbaNew2.MSVBVM60(00402888,00417010,?,00000000,00000000), ref: 00414EDE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414F17
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,00000098), ref: 00414F64
__vbaChkstk.MSVBVM60(00000000,?,00403034,00000098), ref: 00414F8D
__vbaLateMemSt.MSVBVM60(?,00403244), ref: 00414FA3
__vbaFreeObj.MSVBVM60(?,00403244), ref: 00414FAB
__vbaChkstk.MSVBVM60(?,00403244), ref: 00414FC1
__vbaLateMemSt.MSVBVM60(?,0040324C,?,00403244), ref: 00414FD7
__vbaChkstk.MSVBVM60(?,0040324C,?,00403244), ref: 00414FED
__vbaLateMemSt.MSVBVM60(?,00403254,?,0040324C,?,00403244), ref: 00415003
__vbaNew2.MSVBVM60(00402888,00417010,?,00403254,?,0040324C,?,00403244), ref: 0041501B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415054
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000000D0), ref: 004150A1
__vbaChkstk.MSVBVM60(00000000,?,00403080,000000D0), ref: 004150CA
__vbaLateMemSt.MSVBVM60(?,0040325C), ref: 004150E0
__vbaFreeObj.MSVBVM60(?,0040325C), ref: 004150E8
__vbaChkstk.MSVBVM60(?,0040325C), ref: 004150FB
__vbaLateMemSt.MSVBVM60(?,Visible,?,0040325C), ref: 00415111
__vbaLateMemCallLd.MSVBVM60(?,?,BorderStyle,00000000,?,Visible,?,0040325C), ref: 00415132
__vbaVarTstNe.MSVBVM60(?,00000000,?,?,00000000,00000000), ref: 0041513F
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000,00000000), ref: 0041514E
__vbaNew2.MSVBVM60(00402888,00417010,?,00000000,?,?,00000000,00000000), ref: 00415175
__vbaObjSet.MSVBVM60(?,00000000), ref: 004151AE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000001D0), ref: 004151FB
__vbaNew2.MSVBVM60(00403118,0041733C), ref: 00415222
__vbaChkstk.MSVBVM60(?,?), ref: 00415266
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,00000034), ref: 004152A9
__vbaObjSet.MSVBVM60(?,?), ref: 004152D4
__vbaFreeObj.MSVBVM60(?,?), ref: 004152DC
__vbaFreeObj.MSVBVM60(00415326,?,00000000,?,?,00000000,00000000), ref: 00415310
__vbaFreeVar.MSVBVM60(00415326,?,00000000,?,?,00000000,00000000), ref: 00415318
__vbaFreeObj.MSVBVM60(00415326,?,00000000,?,?,00000000,00000000), ref: 00415320

Strings

Dataskrmernes4, xrefs: 00414E1B
Visible, xrefs: 00415109
Add, xrefs: 00414E97
<sA, xrefs: 0041523D
BorderStyle, xrefs: 00415126
VB.Line, xrefs: 00414E0D

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$Late$CheckHresult$New2$Call$Addref
String ID: <sA$Add$BorderStyle$Dataskrmernes4$VB.Line$Visible
API String ID: 457741602-3684216577
Opcode ID: f89b4e8914a03400f926093b624cfb56d8c5890d99906f594603893f0d418928
Instruction ID: 0bfbda819e1203c9dbf2e5e86f6a43f39d679c9706188bb9263c653e441a2b44
Opcode Fuzzy Hash: f89b4e8914a03400f926093b624cfb56d8c5890d99906f594603893f0d418928
Instruction Fuzzy Hash: 3EE12D71900718DBDB10EFA1CC45BCDBBB5BF09308F1044AAE508BB2A2C7B95A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415912, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00415912(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				signed int _v28;
				char _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v76;
				intOrPtr _v84;
				char _v104;
				void* _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _t61;
				char* _t65;
				char* _t69;
				signed int _t73;
				char* _t79;
				signed int _t83;
				intOrPtr _t109;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t109;
				_t61 = 0x7c;
				L004012D0();
				_v12 = _t109;
				_v8 = 0x4012b0;
				_push(0x402f70);
				L00401366();
				L0040142C();
				_push(_t61);
				_push(0x4032bc);
				L004013E4();
				asm("sbb eax, eax");
				_v108 =  ~( ~( ~_t61));
				L0040144A();
				_t65 = _v108;
				if(_t65 != 0) {
					if( *0x417010 != 0) {
						_v132 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v132 = 0x417010;
					}
					_t69 =  &_v32;
					L0040145C();
					_v108 = _t69;
					_t73 =  *((intOrPtr*)( *_v108 + 0x48))(_v108,  &_v28, _t69,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x308))( *_v132));
					asm("fclex");
					_v112 = _t73;
					if(_v112 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x403008);
						_push(_v108);
						_push(_v112);
						L00401462();
						_v136 = _t73;
					}
					_v128 = _v28;
					_v28 = _v28 & 0x00000000;
					_v44 = _v128;
					_v52 = 8;
					if( *0x417010 != 0) {
						_v140 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v140 = 0x417010;
					}
					_t79 =  &_v36;
					L0040145C();
					_v116 = _t79;
					_t83 =  *((intOrPtr*)( *_v116 + 0x58))(_v116,  &_v104, _t79,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x300))( *_v140));
					asm("fclex");
					_v120 = _t83;
					if(_v120 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x403080);
						_push(_v116);
						_push(_v120);
						L00401462();
						_v144 = _t83;
					}
					_v76 = _v104;
					_v84 = 3;
					_push(0x10);
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(2);
					_push(L"ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126");
					_push(_v24);
					L00401360();
					_push( &_v36);
					_t65 =  &_v32;
					_push(_t65);
					_push(2);
					L0040143E();
					L00401420();
				}
				_push(0x415b35);
				L00401444();
				return _t65;
			}

0x00415917
0x00415922
0x00415923
0x0041592c
0x0041592d
0x00415935
0x00415938
0x0041593f
0x00415944
0x0041594e
0x00415953
0x00415954
0x00415959
0x00415960
0x00415966
0x0041596d
0x00415972
0x00415978
0x00415985
0x0041599f
0x00415987
0x00415987
0x0041598c
0x00415991
0x00415996
0x00415996
0x004159ba
0x004159be
0x004159c3
0x004159d2
0x004159d5
0x004159d7
0x004159de
0x004159fa
0x004159e0
0x004159e0
0x004159e2
0x004159e7
0x004159ea
0x004159ed
0x004159f2
0x004159f2
0x00415a04
0x00415a07
0x00415a0e
0x00415a11
0x00415a1f
0x00415a3c
0x00415a21
0x00415a21
0x00415a26
0x00415a2b
0x00415a30
0x00415a30
0x00415a60
0x00415a64
0x00415a69
0x00415a78
0x00415a7b
0x00415a7d
0x00415a84
0x00415aa0
0x00415a86
0x00415a86
0x00415a88
0x00415a8d
0x00415a90
0x00415a93
0x00415a98
0x00415a98
0x00415aaa
0x00415aad
0x00415ab4
0x00415ab7
0x00415ac1
0x00415ac2
0x00415ac3
0x00415ac4
0x00415ac5
0x00415ac8
0x00415ad2
0x00415ad3
0x00415ad4
0x00415ad5
0x00415ad6
0x00415ad8
0x00415add
0x00415ae0
0x00415aeb
0x00415aec
0x00415aef
0x00415af0
0x00415af2
0x00415afd
0x00415afd
0x00415b02
0x00415b2f
0x00415b34

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041592D
#527.MSVBVM60(00402F70,?,?,?,?,004012D6), ref: 00415944
__vbaStrMove.MSVBVM60(00402F70,?,?,?,?,004012D6), ref: 0041594E
__vbaStrCmp.MSVBVM60(004032BC,00000000,00402F70,?,?,?,?,004012D6), ref: 00415959
__vbaFreeStr.MSVBVM60(004032BC,00000000,00402F70,?,?,?,?,004012D6), ref: 0041596D
__vbaNew2.MSVBVM60(00402888,00417010,004032BC,00000000,00402F70,?,?,?,?,004012D6), ref: 00415991
__vbaObjSet.MSVBVM60(?,00000000), ref: 004159BE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000048), ref: 004159ED
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00415A2B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415A64
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,00000058), ref: 00415A93
__vbaChkstk.MSVBVM60(00000000,?,00403080,00000058), ref: 00415AB7
__vbaChkstk.MSVBVM60(00000000,?,00403080,00000058), ref: 00415AC8
__vbaLateMemCall.MSVBVM60(?,ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126,00000002), ref: 00415AE0
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00415AF2
__vbaFreeVar.MSVBVM60 ref: 00415AFD
__vbaFreeObj.MSVBVM60(00415B35,004032BC,00000000,00402F70,?,?,?,?,004012D6), ref: 00415B2F

Strings

ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126, xrefs: 00415AD8

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$CheckHresultNew2$#527CallLateListMove
String ID: ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126
API String ID: 3951332288-3844710931
Opcode ID: 4038f688850da266a9e6cc1e7de76b6c24759c51da30cfecf7d901558bf723f2
Instruction ID: 60a1e2fd5eb9683927ed5d927fe77a60a4e2b21fc7bc2a0cf17d86f421a550ee
Opcode Fuzzy Hash: 4038f688850da266a9e6cc1e7de76b6c24759c51da30cfecf7d901558bf723f2
Instruction Fuzzy Hash: 2D514A70940708DFCB10DFA5C886BDEBBB8BF08704F10456AE505BB2A1DBB95984DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411419, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00411419(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				signed int _v36;
				char _v40;
				char _v44;
				char _v60;
				char* _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				signed int _v140;
				signed int _v144;
				char _v148;
				intOrPtr* _v152;
				signed int _v156;
				signed int _v160;
				signed int _t83;
				char* _t84;
				signed int _t88;
				char* _t94;
				signed int _t98;
				char* _t100;
				signed int _t103;
				void* _t116;
				void* _t118;
				intOrPtr _t119;

				_t119 = _t118 - 0xc;
				 *[fs:0x0] = _t119;
				L004012D0();
				_v16 = _t119;
				_v12 = 0x4011c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t116);
				L00401450();
				_v84 =  &_v28;
				_v92 = 0x4008;
				_push(1);
				_push( &_v92);
				_push( &_v60);
				L004013F0();
				_v100 = 0x4030f0;
				_v108 = 0x8008;
				_push( &_v60);
				_t83 =  &_v108;
				_push(_t83);
				L004013F6();
				_v112 = _t83;
				L00401420();
				_t84 = _v112;
				if(_t84 != 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 0x160))(_a4,  &_v36);
					asm("fclex");
					_v112 = _t88;
					if(_v112 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x160);
						_push(0x402e48);
						_push(_a4);
						_push(_v112);
						L00401462();
						_v144 = _t88;
					}
					if( *0x41733c != 0) {
						_v148 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403118);
						L00401456();
						_v148 = 0x41733c;
					}
					_t33 =  &_v148; // 0x41733c
					_v124 =  *((intOrPtr*)( *_t33));
					if( *0x417010 != 0) {
						_v152 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v152 = 0x417010;
					}
					_t94 =  &_v40;
					L0040145C();
					_v116 = _t94;
					_t98 =  *((intOrPtr*)( *_v116 + 0x218))(_v116,  &_v32, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x304))( *_v152));
					asm("fclex");
					_v120 = _t98;
					if(_v120 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x218);
						_push(0x403008);
						_push(_v116);
						_push(_v120);
						L00401462();
						_v156 = _t98;
					}
					_v140 = _v36;
					_v36 = _v36 & 0x00000000;
					_t100 =  &_v44;
					L0040145C();
					_t103 =  *((intOrPtr*)( *_v124 + 0x40))(_v124, _t100, _t100, _v140, _v32);
					asm("fclex");
					_v128 = _t103;
					if(_v128 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x403104);
						_push(_v124);
						_push(_v128);
						L00401462();
						_v160 = _t103;
					}
					L0040144A();
					_push( &_v44);
					_t84 =  &_v40;
					_push(_t84);
					_push(2);
					L0040143E();
				}
				_push(0x411678);
				L0040144A();
				return _t84;
			}

0x0041141c
0x0041142b
0x00411437
0x0041143f
0x00411442
0x00411449
0x00411458
0x00411463
0x0041146b
0x0041146e
0x00411475
0x0041147a
0x0041147e
0x0041147f
0x00411484
0x0041148b
0x00411495
0x00411496
0x00411499
0x0041149a
0x0041149f
0x004114a6
0x004114ab
0x004114b1
0x004114c3
0x004114c9
0x004114cb
0x004114d2
0x004114f1
0x004114d4
0x004114d4
0x004114d9
0x004114de
0x004114e1
0x004114e4
0x004114e9
0x004114e9
0x004114ff
0x0041151c
0x00411501
0x00411501
0x00411506
0x0041150b
0x00411510
0x00411510
0x00411526
0x0041152e
0x00411538
0x00411555
0x0041153a
0x0041153a
0x0041153f
0x00411544
0x00411549
0x00411549
0x00411579
0x0041157d
0x00411582
0x00411591
0x00411597
0x00411599
0x004115a0
0x004115bf
0x004115a2
0x004115a2
0x004115a7
0x004115ac
0x004115af
0x004115b2
0x004115b7
0x004115b7
0x004115c9
0x004115cf
0x004115dc
0x004115e0
0x004115ee
0x004115f1
0x004115f3
0x004115fa
0x00411616
0x004115fc
0x004115fc
0x004115fe
0x00411603
0x00411606
0x00411609
0x0041160e
0x0041160e
0x00411620
0x00411628
0x00411629
0x0041162c
0x0041162d
0x0041162f
0x00411634
0x00411637
0x00411672
0x00411677

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00411437
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00411463
#619.MSVBVM60(?,00004008,00000001), ref: 0041147F
__vbaVarTstNe.MSVBVM60(?,?,?,00004008,00000001), ref: 0041149A
__vbaFreeVar.MSVBVM60(?,?,?,00004008,00000001), ref: 004114A6
__vbaHresultCheckObj.MSVBVM60(00000000,004011C0,00402E48,00000160), ref: 004114E4
__vbaNew2.MSVBVM60(00403118,0041733C), ref: 0041150B
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00411544
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041157D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000218), ref: 004115B2
__vbaObjSet.MSVBVM60(?,?,?), ref: 004115E0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,00000040), ref: 00411609
__vbaFreeStr.MSVBVM60(00000000,?,00403104,00000040), ref: 00411620
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041162F
__vbaFreeStr.MSVBVM60(00411678,?,?,?,00004008,00000001), ref: 00411672

Strings

ABC, xrefs: 0041145B
<sA, xrefs: 00411526

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#619ChkstkCopyList
String ID: <sA$ABC
API String ID: 1221161852-1763245309
Opcode ID: bda2eb5aa911c713873271ece3603200947d9cd5a6e32706dad1f01adf2da205
Instruction ID: 857a7a05514b7e2ab0061a307a6b0edf3cb5401868a2a4bce405b107fe63a129
Opcode Fuzzy Hash: bda2eb5aa911c713873271ece3603200947d9cd5a6e32706dad1f01adf2da205
Instruction Fuzzy Hash: E8612A70D00218EFDB10EFA5C845BDDBBB8BF08704F10806AE509B72A2D7799985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00414830, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00414830(void* __ebx, void* __edi, void* __esi, void* _a8, void* _a12, void* _a56, signed int* _a60) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v44;
				void* _v48;
				void* _v64;
				void* _v68;
				char _v84;
				char* _v92;
				intOrPtr _v100;
				short _v104;
				char* _t32;
				char* _t33;
				void* _t58;
				intOrPtr _t59;

				_t59 = _t58 - 0xc;
				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t59;
				_push(0x58);
				L004012D0();
				_v16 = _t59;
				_v12 = 0x401230;
				L00401450();
				L004013EA();
				L00401450();
				 *_a60 =  *_a60 & 0x00000000;
				_push( &_v84);
				L004013A8();
				_t32 =  &_v84;
				_push(_t32);
				L004013AE();
				_v104 =  ~(0 | _t32 != 0x0000ffff);
				L00401420();
				_t33 = _v104;
				if(_t33 != 0) {
					_v92 = L"Ferskvandsomraadernes";
					_v100 = 8;
					L004013EA();
					_t33 =  &_v84;
					_push(_t33);
					L004013A2();
					L0040142C();
					L00401420();
				}
				_push(0x41492d);
				L0040144A();
				L0040144A();
				L00401420();
				L0040144A();
				return _t33;
			}

0x00414833
0x00414836
0x00414841
0x00414842
0x00414849
0x0041484c
0x00414854
0x00414857
0x00414864
0x0041486f
0x0041487a
0x00414882
0x00414888
0x00414889
0x0041488e
0x00414891
0x00414892
0x004148a2
0x004148a9
0x004148ae
0x004148b4
0x004148b6
0x004148bd
0x004148ca
0x004148cf
0x004148d2
0x004148d3
0x004148dd
0x004148e5
0x004148e5
0x004148ea
0x0041490f
0x00414917
0x0041491f
0x00414927
0x0041492c

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041484C
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00414864
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 0041486F
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 0041487A
#610.MSVBVM60(?,?,?,?,?,004012D6), ref: 00414889
#557.MSVBVM60(?,?,?,?,?,?,004012D6), ref: 00414892
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004012D6), ref: 004148A9
__vbaVarDup.MSVBVM60 ref: 004148CA
#667.MSVBVM60(?), ref: 004148D3
__vbaStrMove.MSVBVM60(?), ref: 004148DD
__vbaFreeVar.MSVBVM60(?), ref: 004148E5
__vbaFreeStr.MSVBVM60(0041492D,?,?,?,?,?,?,004012D6), ref: 0041490F
__vbaFreeStr.MSVBVM60(0041492D,?,?,?,?,?,?,004012D6), ref: 00414917
__vbaFreeVar.MSVBVM60(0041492D,?,?,?,?,?,?,004012D6), ref: 0041491F
__vbaFreeStr.MSVBVM60(0041492D,?,?,?,?,?,?,004012D6), ref: 00414927

Strings

-IA, xrefs: 00414914
Ferskvandsomraadernes, xrefs: 004148B6

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$#557#610#667ChkstkMove
String ID: -IA$Ferskvandsomraadernes
API String ID: 1992133662-3460466036
Opcode ID: 612148a9cbd6fb48298cc198dabd726968e7ae2f1285b448424f51b939b6ce15
Instruction ID: 61927103246d0c0130cba0d11bffd8935fe03e4b56c886a42f43548d48d4dc8f
Opcode Fuzzy Hash: 612148a9cbd6fb48298cc198dabd726968e7ae2f1285b448424f51b939b6ce15
Instruction Fuzzy Hash: 9321D8719102499BCB04EBE1C891ADEB778BF14708F90803EF401BB5F5EB785949CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00415339, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00415339(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr _v104;
				char _v112;
				intOrPtr _v120;
				char _v128;
				intOrPtr _v136;
				char _v144;
				intOrPtr _v152;
				char _v160;
				intOrPtr _v184;
				char _v192;
				void* _v260;
				signed int _v264;
				signed int _v276;
				intOrPtr* _v280;
				signed int _v284;
				short _t84;
				char* _t87;
				char* _t91;
				signed int _t95;
				void* _t124;
				void* _t126;
				intOrPtr _t127;

				_t127 = _t126 - 0xc;
				 *[fs:0x0] = _t127;
				L004012D0();
				_v16 = _t127;
				_v12 = 0x401290;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t124);
				L00401450();
				_v56 = 0x4b;
				_v64 = 2;
				_push( &_v64);
				_push( &_v80);
				L00401378();
				_v184 = 0x403290;
				_v192 = 0x8008;
				_push( &_v80);
				_t84 =  &_v192;
				_push(_t84);
				L004013F6();
				_v260 = _t84;
				_push( &_v80);
				_push( &_v64);
				_push(2);
				L00401426();
				_t87 = _v260;
				if(_t87 != 0) {
					_v152 = 0x80020004;
					_v160 = 0xa;
					_v136 = 0x80020004;
					_v144 = 0xa;
					_v120 = 0x80020004;
					_v128 = 0xa;
					_v104 = 0x80020004;
					_v112 = 0xa;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					if( *0x417010 != 0) {
						_v280 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v280 = 0x417010;
					}
					_t91 =  &_v44;
					L0040145C();
					_v260 = _t91;
					_t95 =  *((intOrPtr*)( *_v260 + 0x180))(_v260,  &_v48, _t91,  *((intOrPtr*)( *((intOrPtr*)( *_v280)) + 0x300))( *_v280));
					asm("fclex");
					_v264 = _t95;
					if(_v264 >= 0) {
						_v284 = _v284 & 0x00000000;
					} else {
						_push(0x180);
						_push(0x403080);
						_push(_v260);
						_push(_v264);
						L00401462();
						_v284 = _t95;
					}
					_v276 = _v48;
					_v48 = _v48 & 0x00000000;
					_v56 = _v276;
					_v64 = 9;
					_push( &_v160);
					_push( &_v144);
					_push( &_v128);
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					L00401372();
					L0040142C();
					L00401444();
					_push( &_v160);
					_push( &_v144);
					_push( &_v128);
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_t87 =  &_v64;
					_push(_t87);
					_push(7);
					L00401426();
				}
				asm("wait");
				_push(0x4155d1);
				L0040144A();
				L0040144A();
				return _t87;
			}

0x0041533c
0x0041534b
0x00415357
0x0041535f
0x00415362
0x00415369
0x00415378
0x00415381
0x00415386
0x0041538d
0x00415397
0x0041539b
0x0041539c
0x004153a1
0x004153ab
0x004153b8
0x004153b9
0x004153bf
0x004153c0
0x004153c5
0x004153cf
0x004153d3
0x004153d4
0x004153d6
0x004153de
0x004153e7
0x004153ed
0x004153f7
0x00415401
0x0041540b
0x00415415
0x0041541c
0x00415423
0x0041542a
0x00415431
0x00415438
0x0041543f
0x00415446
0x00415454
0x00415471
0x00415456
0x00415456
0x0041545b
0x00415460
0x00415465
0x00415465
0x00415495
0x00415499
0x0041549e
0x004154b6
0x004154bc
0x004154be
0x004154cb
0x004154f0
0x004154cd
0x004154cd
0x004154d2
0x004154d7
0x004154dd
0x004154e3
0x004154e8
0x004154e8
0x004154fa
0x00415500
0x0041550a
0x0041550d
0x0041551a
0x00415521
0x00415525
0x00415529
0x0041552d
0x00415531
0x00415535
0x00415536
0x00415540
0x00415548
0x00415553
0x0041555a
0x0041555e
0x00415562
0x00415566
0x0041556a
0x0041556b
0x0041556e
0x0041556f
0x00415571
0x00415576
0x00415579
0x0041557a
0x004155c3
0x004155cb
0x004155d0

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00415357
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00415381
#573.MSVBVM60(?,00000002), ref: 0041539C
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 004153C0
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 004153D6
__vbaNew2.MSVBVM60(00402888,00417010), ref: 00415460
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415499
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,00000180), ref: 004154E3
#596.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415536
__vbaStrMove.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415540
__vbaFreeObj.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415548
__vbaFreeVarList.MSVBVM60(00000007,00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A,00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415571
__vbaFreeStr.MSVBVM60(004155D1,?,?,004012D6), ref: 004155C3
__vbaFreeStr.MSVBVM60(004155D1,?,?,004012D6), ref: 004155CB

Strings

K, xrefs: 00415386

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$List$#573#596CheckChkstkCopyHresultMoveNew2
String ID: K
API String ID: 259192952-856455061
Opcode ID: 95a28f9edb84bd772ac8ebe72a51c1e5f0aa8fd5da9fd123e98fd3cf22f39805
Instruction ID: c0690bddb5ea555758bd20f8e6282c14c88fac4d2638883fa3780836e965f545
Opcode Fuzzy Hash: 95a28f9edb84bd772ac8ebe72a51c1e5f0aa8fd5da9fd123e98fd3cf22f39805
Instruction Fuzzy Hash: 5C61CAB1D0021CEBDB11DF91C885BDEB7B8BF08304F1081AAE515B71A1DB785A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00414B22, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00414B22(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a8, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v40;
				void* _v48;
				char _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				void* _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				char _v104;
				signed int _v108;
				signed int _v112;
				char* _t54;
				signed int _t55;
				signed int _t61;
				intOrPtr _t87;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t87;
				_push(0x5c);
				L004012D0();
				_v12 = _t87;
				_v8 = 0x401260;
				L004013EA();
				L00401450();
				_v72 = _a4;
				_v80 = 9;
				L004013EA();
				_t54 =  &_v64;
				_push(_t54);
				L00401396();
				_v84 =  ~(0 | _t54 != 0x0000ffff);
				L00401420();
				_t55 = _v84;
				if(_t55 != 0) {
					if( *0x41733c != 0) {
						_v104 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403118);
						L00401456();
						_v104 = 0x41733c;
					}
					_t20 =  &_v104; // 0x41733c
					_v84 =  *((intOrPtr*)( *_t20));
					_t61 =  *((intOrPtr*)( *_v84 + 0x1c))(_v84,  &_v48);
					asm("fclex");
					_v88 = _t61;
					if(_v88 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x403104);
						_push(_v84);
						_push(_v88);
						L00401462();
						_v108 = _t61;
					}
					_v92 = _v48;
					_v72 = 0x80020004;
					_v80 = 0xa;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t55 =  *((intOrPtr*)( *_v92 + 0x60))(_v92, L"dissour", 0x10);
					asm("fclex");
					_v96 = _t55;
					if(_v96 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x4031f4);
						_push(_v92);
						_push(_v96);
						L00401462();
						_v112 = _t55;
					}
					L00401444();
				}
				_push(0x414c9a);
				L00401420();
				L0040144A();
				return _t55;
			}

0x00414b27
0x00414b32
0x00414b33
0x00414b3a
0x00414b3d
0x00414b45
0x00414b48
0x00414b55
0x00414b60
0x00414b68
0x00414b6b
0x00414b78
0x00414b7d
0x00414b80
0x00414b81
0x00414b91
0x00414b98
0x00414b9d
0x00414ba3
0x00414bb0
0x00414bca
0x00414bb2
0x00414bb2
0x00414bb7
0x00414bbc
0x00414bc1
0x00414bc1
0x00414bd1
0x00414bd6
0x00414be5
0x00414be8
0x00414bea
0x00414bf1
0x00414c0a
0x00414bf3
0x00414bf3
0x00414bf5
0x00414bfa
0x00414bfd
0x00414c00
0x00414c05
0x00414c05
0x00414c11
0x00414c14
0x00414c1b
0x00414c25
0x00414c2f
0x00414c30
0x00414c31
0x00414c32
0x00414c40
0x00414c43
0x00414c45
0x00414c4c
0x00414c65
0x00414c4e
0x00414c4e
0x00414c50
0x00414c55
0x00414c58
0x00414c5b
0x00414c60
0x00414c60
0x00414c6c
0x00414c6c
0x00414c71
0x00414c8c
0x00414c94
0x00414c99

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414B3D
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414B55
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00414B60
__vbaVarDup.MSVBVM60 ref: 00414B78
#562.MSVBVM60(?), ref: 00414B81
__vbaFreeVar.MSVBVM60(?), ref: 00414B98
__vbaNew2.MSVBVM60(00403118,0041733C,?), ref: 00414BBC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,0000001C,?,?,?,?,?,?), ref: 00414C00
__vbaChkstk.MSVBVM60(?,?,?,?,?,?), ref: 00414C25
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031F4,00000060,?,?,?,?,?,?), ref: 00414C5B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?), ref: 00414C6C
__vbaFreeVar.MSVBVM60(00414C9A,?), ref: 00414C8C
__vbaFreeStr.MSVBVM60(00414C9A,?), ref: 00414C94

Strings

<sA, xrefs: 00414BD1
dissour, xrefs: 00414C33

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#562CopyNew2
String ID: <sA$dissour
API String ID: 3730601939-3631128563
Opcode ID: 6c95d473fa5a449290b187631c47a318f7326b4ab6e62c37b52a91a7cf2c7718
Instruction ID: cb3aab97ce265d0894e639d9fba397fac5139900cd77abf267174a56a7ff92cb
Opcode Fuzzy Hash: 6c95d473fa5a449290b187631c47a318f7326b4ab6e62c37b52a91a7cf2c7718
Instruction Fuzzy Hash: DD41D570D00208AFDB00EFD5C986BDDBBB4BF58708F10802AE415BB2A5D7B95945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004155F8, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004155F8(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				short _v164;
				char _v168;
				intOrPtr* _v172;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				short _v188;
				char _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr* _v208;
				signed int _v212;
				signed int _v216;
				signed int _t93;
				signed int _t98;
				char* _t102;
				char* _t103;
				char* _t107;
				signed int _t111;
				signed int _t119;
				intOrPtr _t135;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t135;
				L004012D0();
				_v12 = _t135;
				_v8 = 0x4012a0;
				if( *0x41733c != 0) {
					_v196 = 0x41733c;
				} else {
					_push(0x41733c);
					_push(0x403118);
					L00401456();
					_v196 = 0x41733c;
				}
				_t5 =  &_v196; // 0x41733c
				_v172 =  *((intOrPtr*)( *_t5));
				_t93 =  *((intOrPtr*)( *_v172 + 0x14))(_v172,  &_v28);
				asm("fclex");
				_v176 = _t93;
				if(_v176 >= 0) {
					_v200 = _v200 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x403104);
					_push(_v172);
					_push(_v176);
					L00401462();
					_v200 = _t93;
				}
				_v180 = _v28;
				_t98 =  *((intOrPtr*)( *_v180 + 0x128))(_v180,  &_v168);
				asm("fclex");
				_v184 = _t98;
				if(_v184 >= 0) {
					_v204 = _v204 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x403298);
					_push(_v180);
					_push(_v184);
					L00401462();
					_v204 = _t98;
				}
				_v188 =  ~(0 | _v168 == 0x00000000);
				L00401444();
				_t102 = _v188;
				if(_t102 != 0) {
					L0040136C();
					_push(_t102);
					_t103 =  &_v32;
					_push(_t103);
					L0040145C();
					_v180 = _t103;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v40 = 0x80020004;
					_v48 = 0xa;
					if( *0x417010 != 0) {
						_v208 = 0x417010;
					} else {
						_push(0x417010);
						_push(0x402888);
						L00401456();
						_v208 = 0x417010;
					}
					_t107 =  &_v28;
					L0040145C();
					_v172 = _t107;
					_t111 =  *((intOrPtr*)( *_v172 + 0x158))(_v172,  &_v164, _t107,  *((intOrPtr*)( *((intOrPtr*)( *_v208)) + 0x300))( *_v208));
					asm("fclex");
					_v176 = _t111;
					if(_v176 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x158);
						_push(0x403080);
						_push(_v172);
						_push(_v176);
						L00401462();
						_v212 = _t111;
					}
					_t119 =  *((intOrPtr*)( *_v180 + 0x44))(_v180, _v164,  &_v48,  &_v64,  &_v80,  &_v96);
					asm("fclex");
					_v184 = _t119;
					if(_v184 >= 0) {
						_v216 = _v216 & 0x00000000;
					} else {
						_push(0x44);
						_push(0x4032a8);
						_push(_v180);
						_push(_v184);
						L00401462();
						_v216 = _t119;
					}
					_push( &_v32);
					_push( &_v28);
					_push(2);
					L0040143E();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_t102 =  &_v48;
					_push(_t102);
					_push(4);
					L00401426();
				}
				_push(0x4158f7);
				return _t102;
			}

0x004155fd
0x00415608
0x00415609
0x00415615
0x0041561d
0x00415620
0x0041562e
0x0041564b
0x00415630
0x00415630
0x00415635
0x0041563a
0x0041563f
0x0041563f
0x00415655
0x0041565d
0x00415675
0x00415678
0x0041567a
0x00415687
0x004156a9
0x00415689
0x00415689
0x0041568b
0x00415690
0x00415696
0x0041569c
0x004156a1
0x004156a1
0x004156b3
0x004156ce
0x004156d4
0x004156d6
0x004156e3
0x00415708
0x004156e5
0x004156e5
0x004156ea
0x004156ef
0x004156f5
0x004156fb
0x00415700
0x00415700
0x0041571d
0x00415727
0x0041572c
0x00415735
0x0041573b
0x00415740
0x00415741
0x00415744
0x00415745
0x0041574a
0x00415750
0x00415757
0x0041575e
0x00415765
0x0041576c
0x00415773
0x0041577a
0x00415781
0x0041578f
0x004157ac
0x00415791
0x00415791
0x00415796
0x0041579b
0x004157a0
0x004157a0
0x004157d0
0x004157d4
0x004157d9
0x004157f4
0x004157fa
0x004157fc
0x00415809
0x0041582e
0x0041580b
0x0041580b
0x00415810
0x00415815
0x0041581b
0x00415821
0x00415826
0x00415826
0x0041585b
0x0041585e
0x00415860
0x0041586d
0x0041588f
0x0041586f
0x0041586f
0x00415871
0x00415876
0x0041587c
0x00415882
0x00415887
0x00415887
0x00415899
0x0041589d
0x0041589e
0x004158a0
0x004158ab
0x004158af
0x004158b3
0x004158b4
0x004158b7
0x004158b8
0x004158ba
0x004158bf
0x004158c2
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00415615
__vbaNew2.MSVBVM60(00403118,0041733C,?,?,?,?,004012D6), ref: 0041563A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,00000014), ref: 0041569C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403298,00000128), ref: 004156FB
__vbaFreeObj.MSVBVM60(00000000,?,00403298,00000128), ref: 00415727
#685.MSVBVM60(00000000,?,00403298,00000128), ref: 0041573B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415745
__vbaNew2.MSVBVM60(00402888,00417010,?,00000000), ref: 0041579B
__vbaObjSet.MSVBVM60(?,00000000), ref: 004157D4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,00000158), ref: 00415821
__vbaHresultCheckObj.MSVBVM60(00000000,?,004032A8,00000044), ref: 00415882
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 004158A0
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 004158BA

Strings

<sA, xrefs: 00415655

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$ListNew2$#685Chkstk
String ID: <sA
API String ID: 509102008-3623460565
Opcode ID: 3bee6a2b7d94fe532797e91751c602c1d46509661eda3dc72fa90296642a5b8c
Instruction ID: f92bc3ac19aacffd932e17a126d9b96ab60c41deac77f23a0d4db943a6143fe5
Opcode Fuzzy Hash: 3bee6a2b7d94fe532797e91751c602c1d46509661eda3dc72fa90296642a5b8c
Instruction Fuzzy Hash: 4981E6B1901718EFDB20DF91CC45BDEBBB9BB09304F1041EAE109B62A1D7785A85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004145C7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004145C7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				char* _v104;
				intOrPtr _v112;
				intOrPtr _v120;
				char _v128;
				short _v164;
				short _t47;
				char* _t50;
				void* _t65;
				void* _t67;
				intOrPtr _t68;

				_t68 = _t67 - 0xc;
				 *[fs:0x0] = _t68;
				L004012D0();
				_v16 = _t68;
				_v12 = 0x401210;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t65);
				_v104 = 0x403164;
				_v112 = 8;
				L004013EA();
				_push(2);
				_push( &_v48);
				_push( &_v64);
				L004013BA();
				_v120 = 0x403170;
				_v128 = 0x8008;
				_push( &_v64);
				_t47 =  &_v128;
				_push(_t47);
				L004013F6();
				_v164 = _t47;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401426();
				_t50 = _v164;
				if(_t50 != 0) {
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v104 = L"ceterach";
					_v112 = 8;
					L004013EA();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_push(0);
					_push( &_v48);
					L004013B4();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_t50 =  &_v48;
					_push(_t50);
					_push(4);
					L00401426();
				}
				_push(0x414707);
				return _t50;
			}

0x004145ca
0x004145d9
0x004145e5
0x004145ed
0x004145f0
0x004145f7
0x00414606
0x00414609
0x00414610
0x0041461d
0x00414622
0x00414627
0x0041462b
0x0041462c
0x00414631
0x00414638
0x00414642
0x00414643
0x00414646
0x00414647
0x0041464c
0x00414656
0x0041465a
0x0041465b
0x0041465d
0x00414665
0x0041466e
0x00414670
0x00414677
0x0041467e
0x00414685
0x0041468c
0x00414693
0x0041469a
0x004146a1
0x004146ae
0x004146b6
0x004146ba
0x004146be
0x004146bf
0x004146c4
0x004146c5
0x004146cd
0x004146d1
0x004146d5
0x004146d6
0x004146d9
0x004146da
0x004146dc
0x004146e1
0x004146e4
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004145E5
__vbaVarDup.MSVBVM60 ref: 0041461D
#513.MSVBVM60(?,?,00000002), ref: 0041462C
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000002), ref: 00414647
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000002), ref: 0041465D
__vbaVarDup.MSVBVM60 ref: 004146AE
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 004146C5
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 004146DC

Strings

ceterach, xrefs: 0041469A

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$FreeList$#513#595Chkstk
String ID: ceterach
API String ID: 910115642-2788406423
Opcode ID: 1284aa6066488661d9d3c15b82d718a53676b3b869f70c26c575da4f129db559
Instruction ID: 71136ade9e2124b13e47cc93999effb20dda40703a448507cbfb5b0116e936cf
Opcode Fuzzy Hash: 1284aa6066488661d9d3c15b82d718a53676b3b869f70c26c575da4f129db559
Instruction Fuzzy Hash: F23198B2D0020CAADB01DFD5C885BDEBBBCEB09704F50C12AE515BB191DB789609CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411697, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00411697(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v56;
				signed int _v60;
				char _v72;
				signed int _v76;
				signed int _v80;
				signed int _t48;
				signed int _t52;
				void* _t60;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				 *[fs:0x0] = _t63;
				L004012D0();
				_v16 = _t63;
				_v12 = 0x4011d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4012d6, _t60);
				L004013EA();
				if( *0x41733c != 0) {
					_v72 = 0x41733c;
				} else {
					_push(0x41733c);
					_push(0x403118);
					L00401456();
					_v72 = 0x41733c;
				}
				_t11 =  &_v72; // 0x41733c
				_v48 =  *((intOrPtr*)( *_t11));
				_t48 =  *((intOrPtr*)( *_v48 + 0x4c))(_v48,  &_v44);
				asm("fclex");
				_v52 = _t48;
				if(_v52 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x4c);
					_push(0x403104);
					_push(_v48);
					_push(_v52);
					L00401462();
					_v76 = _t48;
				}
				_v56 = _v44;
				_t52 =  *((intOrPtr*)( *_v56 + 0x28))(_v56);
				asm("fclex");
				_v60 = _t52;
				if(_v60 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x28);
					_push(0x403128);
					_push(_v56);
					_push(_v60);
					L00401462();
					_v80 = _t52;
				}
				L00401444();
				_push(0x41179f);
				L00401420();
				return _t52;
			}

0x0041169a
0x004116a9
0x004116b3
0x004116bb
0x004116be
0x004116c5
0x004116d4
0x004116dd
0x004116e9
0x00411703
0x004116eb
0x004116eb
0x004116f0
0x004116f5
0x004116fa
0x004116fa
0x0041170a
0x0041170f
0x0041171e
0x00411721
0x00411723
0x0041172a
0x00411743
0x0041172c
0x0041172c
0x0041172e
0x00411733
0x00411736
0x00411739
0x0041173e
0x0041173e
0x0041174a
0x00411755
0x00411758
0x0041175a
0x00411761
0x0041177a
0x00411763
0x00411763
0x00411765
0x0041176a
0x0041176d
0x00411770
0x00411775
0x00411775
0x00411781
0x00411786
0x00411799
0x0041179e

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004116B3
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 004116DD
__vbaNew2.MSVBVM60(00403118,0041733C,?,?,?,?,004012D6), ref: 004116F5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403104,0000004C), ref: 00411739
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403128,00000028), ref: 00411770
__vbaFreeObj.MSVBVM60(00000000,?,00403128,00000028), ref: 00411781
__vbaFreeVar.MSVBVM60(0041179F), ref: 00411799

Strings

<sA, xrefs: 0041170A

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2
String ID: <sA
API String ID: 304406766-3623460565
Opcode ID: 72f76297b13de5c746b10d9cf78771a9b7214c4edc570a20ac0efd5ed503cb36
Instruction ID: f4055bbd2f4e87f3241bf44e026b674a9be19285a2a23f32f19845d94de39860
Opcode Fuzzy Hash: 72f76297b13de5c746b10d9cf78771a9b7214c4edc570a20ac0efd5ed503cb36
Instruction Fuzzy Hash: C331D270900208EFCB10EFA5D985BCCBBB4BF08719F10802AF511B62A1D7785985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415B48, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00415B48(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v80;
				signed int _v84;
				char* _t38;
				signed int _t42;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				L004012D0();
				_v16 = _t55;
				_v12 = 0x4012c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4012d6, _t52);
				 *_a24 =  *_a24 & 0x00000000;
				if( *0x417010 != 0) {
					_v80 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v80 = 0x417010;
				}
				_t38 =  &_v44;
				L0040145C();
				_v64 = _t38;
				_v52 = 0x80020004;
				_v60 = 0xa;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t42 =  *((intOrPtr*)( *_v64 + 0x1ec))(_v64, L"Frilbsnavenes1", 0x10, _t38,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
				asm("fclex");
				_v68 = _t42;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x403008);
					_push(_v64);
					_push(_v68);
					L00401462();
					_v84 = _t42;
				}
				L00401444();
				_push(0x415c5c);
				return _t42;
			}

0x00415b4b
0x00415b5a
0x00415b64
0x00415b6c
0x00415b6f
0x00415b76
0x00415b85
0x00415b8b
0x00415b95
0x00415baf
0x00415b97
0x00415b97
0x00415b9c
0x00415ba1
0x00415ba6
0x00415ba6
0x00415bca
0x00415bce
0x00415bd3
0x00415bd6
0x00415bdd
0x00415be7
0x00415bf1
0x00415bf2
0x00415bf3
0x00415bf4
0x00415c02
0x00415c08
0x00415c0a
0x00415c11
0x00415c2d
0x00415c13
0x00415c13
0x00415c18
0x00415c1d
0x00415c20
0x00415c23
0x00415c28
0x00415c28
0x00415c34
0x00415c39
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00415B64
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,004012D6), ref: 00415BA1
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415BCE
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415BE7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,000001EC), ref: 00415C23
__vbaFreeObj.MSVBVM60 ref: 00415C34

Strings

Frilbsnavenes1, xrefs: 00415BF5

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Frilbsnavenes1
API String ID: 3189907775-3846256057
Opcode ID: 4c17573a3d5aeb5aa9b141eb850d6f3d4d8abf063a5d3fe681eadd1e30496ee2
Instruction ID: 2d912a01f0d21337c6ddc108745106fed3f7e057520dea9072f52e5c49a83ca9
Opcode Fuzzy Hash: 4c17573a3d5aeb5aa9b141eb850d6f3d4d8abf063a5d3fe681eadd1e30496ee2
Instruction Fuzzy Hash: CB310474A00708EFCB10EF95C849BCDBBB8BF49704F10846AF401BB2A1C7B99945DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00414734, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00414734(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t29;
				signed int _t33;
				intOrPtr _t46;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x28);
				L004012D0();
				_v12 = _t46;
				_v8 = 0x401220;
				if( *0x417010 != 0) {
					_v56 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v56 = 0x417010;
				}
				_t29 =  &_v24;
				L0040145C();
				_v44 = _t29;
				_v32 = 0x80020004;
				_v40 = 0xa;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t33 =  *((intOrPtr*)( *_v44 + 0x1ec))(_v44, L"Ballbuster6", 0x10, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x300))( *_v56));
				asm("fclex");
				_v48 = _t33;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x403080);
					_push(_v44);
					_push(_v48);
					L00401462();
					_v60 = _t33;
				}
				L00401444();
				_push(0x41481d);
				return _t33;
			}

0x00414739
0x00414744
0x00414745
0x0041474c
0x0041474f
0x00414757
0x0041475a
0x00414768
0x00414782
0x0041476a
0x0041476a
0x0041476f
0x00414774
0x00414779
0x00414779
0x0041479d
0x004147a1
0x004147a6
0x004147a9
0x004147b0
0x004147ba
0x004147c4
0x004147c5
0x004147c6
0x004147c7
0x004147d5
0x004147db
0x004147dd
0x004147e4
0x00414800
0x004147e6
0x004147e6
0x004147eb
0x004147f0
0x004147f3
0x004147f6
0x004147fb
0x004147fb
0x00414807
0x0041480c
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041474F
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,004012D6), ref: 00414774
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004147A1
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004147BA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403080,000001EC,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004147F6
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004012D6), ref: 00414807

Strings

Ballbuster6, xrefs: 004147C8

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Ballbuster6
API String ID: 3189907775-1741902468
Opcode ID: cda057b65d1e89a44bdff4d25f5ca8c4fe75abd22da3f2e50dda3283a9650168
Instruction ID: 32b7214dff4f24874bde2d9d1486c65a2fecf587594be996d434c241eacf148e
Opcode Fuzzy Hash: cda057b65d1e89a44bdff4d25f5ca8c4fe75abd22da3f2e50dda3283a9650168
Instruction Fuzzy Hash: D0213C75940208EFCB00EF95D845BDDBBB9EB09714F20446AF001BB2A1C7B959449B69

Uniqueness

Uniqueness Score: -1.00%

Function 00414A43, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00414A43(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				intOrPtr _v48;
				char _v56;
				char _v72;
				intOrPtr _v112;
				char _v120;
				short _v124;
				short _t29;
				char* _t31;
				void* _t38;
				void* _t40;
				intOrPtr _t41;

				_t41 = _t40 - 0xc;
				 *[fs:0x0] = _t41;
				L004012D0();
				_v16 = _t41;
				_v12 = 0x401250;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x6c,  *[fs:0x0], 0x4012d6, _t38);
				L004013EA();
				_v48 = 0x20;
				_v56 = 2;
				_push( &_v56);
				_push(1);
				_push( &_v72);
				L0040139C();
				_v112 = 0x4031dc;
				_v120 = 0x8008;
				_push( &_v72);
				_t29 =  &_v120;
				_push(_t29);
				L004013F6();
				_v124 = _t29;
				_push( &_v72);
				_t31 =  &_v56;
				_push(_t31);
				_push(2);
				L00401426();
				_push(0x414b03);
				L00401420();
				return _t31;
			}

0x00414a46
0x00414a55
0x00414a5f
0x00414a67
0x00414a6a
0x00414a71
0x00414a80
0x00414a89
0x00414a8e
0x00414a95
0x00414a9f
0x00414aa0
0x00414aa5
0x00414aa6
0x00414aab
0x00414ab2
0x00414abc
0x00414abd
0x00414ac0
0x00414ac1
0x00414ac6
0x00414acd
0x00414ace
0x00414ad1
0x00414ad2
0x00414ad4
0x00414adc
0x00414afd
0x00414b02

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414A5F
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414A89
#607.MSVBVM60(?,00000001,00000002), ref: 00414AA6
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00414AC1
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 00414AD4
__vbaFreeVar.MSVBVM60(00414B03,?,?,004012D6), ref: 00414AFD

Strings

, xrefs: 00414A8E

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#607ChkstkList
String ID:
API String ID: 3712179512-3916222277
Opcode ID: 5d5633b2cc61ae3e59646953103a869a8f696f6b15a45da26691c1002d49f1b3
Instruction ID: db32438809664972bd623012636cf977469e664385c1247e7577f1ce078cb1b3
Opcode Fuzzy Hash: 5d5633b2cc61ae3e59646953103a869a8f696f6b15a45da26691c1002d49f1b3
Instruction Fuzzy Hash: 2D11CE71900208ABDB00EFD5C946BDEBBB8EF04704F50846AF505B7191D779AA49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041494A, Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041494A(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v44;
				char _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v64;
				signed int _v68;
				char* _t29;
				signed int _t32;
				intOrPtr _t46;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x30);
				L004012D0();
				_v12 = _t46;
				_v8 = 0x401240;
				L004013EA();
				if( *0x417010 != 0) {
					_v64 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v64 = 0x417010;
				}
				_t29 =  &_v48;
				L0040145C();
				_v52 = _t29;
				_t32 =  *((intOrPtr*)( *_v52 + 0x208))(_v52, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x308))( *_v64));
				asm("fclex");
				_v56 = _t32;
				if(_v56 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x208);
					_push(0x403008);
					_push(_v52);
					_push(_v56);
					L00401462();
					_v68 = _t32;
				}
				L00401444();
				_push(0x414a22);
				L00401420();
				return _t32;
			}

0x0041494f
0x0041495a
0x0041495b
0x00414962
0x00414965
0x0041496d
0x00414970
0x0041497d
0x00414989
0x004149a3
0x0041498b
0x0041498b
0x00414990
0x00414995
0x0041499a
0x0041499a
0x004149be
0x004149c2
0x004149c7
0x004149d2
0x004149d8
0x004149da
0x004149e1
0x004149fd
0x004149e3
0x004149e3
0x004149e8
0x004149ed
0x004149f0
0x004149f3
0x004149f8
0x004149f8
0x00414a04
0x00414a09
0x00414a1c
0x00414a21

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414965
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 0041497D
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,004012D6), ref: 00414995
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004149C2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403008,00000208), ref: 004149F3
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 00414A04
__vbaFreeVar.MSVBVM60(00414A22,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 00414A1C

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID:
API String ID: 1725699769-0
Opcode ID: cd55c33ca4f2ed7fac0ea65798c73a43aa686316c2f52f1f5dae12ff9ad60a52
Instruction ID: d21e6b59e1d70d018fb789943050694f24f1b8b458860e137c8f122194318995
Opcode Fuzzy Hash: cd55c33ca4f2ed7fac0ea65798c73a43aa686316c2f52f1f5dae12ff9ad60a52
Instruction Fuzzy Hash: 28212871950208EFCB04EFA1D845FDDBBB8BF48748F10442AF011B72A1CBB86944DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004117BE, Relevance: 10.5, APIs: 7, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004117BE(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v32;
				void* _v36;
				intOrPtr _v44;
				char _v52;
				short _v72;
				signed int _t21;
				short _t25;
				void* _t33;
				void* _t35;
				intOrPtr _t36;

				_t36 = _t35 - 0xc;
				 *[fs:0x0] = _t36;
				L004012D0();
				_v16 = _t36;
				_v12 = 0x4011e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4012d6, _t33);
				_v44 = 9;
				_v52 = 2;
				_t21 =  &_v52;
				_push(_t21);
				L004013DE();
				L0040142C();
				_push(_t21);
				_push(0x40313c);
				L004013E4();
				asm("sbb eax, eax");
				_v72 =  ~( ~( ~_t21));
				L0040144A();
				L00401420();
				_t25 = _v72;
				if(_t25 != 0) {
					_push(0x5a);
					L004013D8();
					_v32 = _t25;
				}
				_push(0x411871);
				return _t25;
			}

0x004117c1
0x004117d0
0x004117da
0x004117e2
0x004117e5
0x004117ec
0x004117fb
0x004117fe
0x00411805
0x0041180c
0x0041180f
0x00411810
0x0041181a
0x0041181f
0x00411820
0x00411825
0x0041182c
0x00411832
0x00411839
0x00411841
0x00411846
0x0041184c
0x0041184e
0x00411850
0x00411855
0x00411855
0x00411858
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004117DA
#574.MSVBVM60(00000002), ref: 00411810
__vbaStrMove.MSVBVM60(00000002), ref: 0041181A
__vbaStrCmp.MSVBVM60(0040313C,00000000,00000002), ref: 00411825
__vbaFreeStr.MSVBVM60(0040313C,00000000,00000002), ref: 00411839
__vbaFreeVar.MSVBVM60(0040313C,00000000,00000002), ref: 00411841
#568.MSVBVM60(0000005A,0040313C,00000000,00000002), ref: 00411850

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#568#574ChkstkMove
String ID:
API String ID: 288442590-0
Opcode ID: 398781a4188f9ac3eafdf209dab54ae4c5b3f17b7409b252d5fc4549416915d8
Instruction ID: 58eef053d106596e68c488db651686fbd9876aff4c3f36d5c361f37d28a60d6c
Opcode Fuzzy Hash: 398781a4188f9ac3eafdf209dab54ae4c5b3f17b7409b252d5fc4549416915d8
Instruction Fuzzy Hash: 1B115270950208ABDB00EFA2C845BEE7BB8FF08744F50812AF401FB1E1DB7C99458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00414CB5, Relevance: 9.1, APIs: 6, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00414CB5(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t36;
				signed int _t40;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012D0();
				_v16 = _t53;
				_v12 = 0x401270;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4012d6, _t50);
				if( *0x417010 != 0) {
					_v68 = 0x417010;
				} else {
					_push(0x417010);
					_push(0x402888);
					L00401456();
					_v68 = 0x417010;
				}
				_t36 =  &_v32;
				L0040145C();
				_v52 = _t36;
				_v40 = 1;
				_v48 = 2;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t40 =  *((intOrPtr*)( *_v52 + 0x1b8))(_v52, 0x10, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x2fc))( *_v68));
				asm("fclex");
				_v56 = _t40;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x1b8);
					_push(0x403034);
					_push(_v52);
					_push(_v56);
					L00401462();
					_v72 = _t40;
				}
				L00401444();
				_push(0x414dac);
				return _t40;
			}

0x00414cb8
0x00414cc7
0x00414cd1
0x00414cd9
0x00414cdc
0x00414ce3
0x00414cf2
0x00414cfc
0x00414d16
0x00414cfe
0x00414cfe
0x00414d03
0x00414d08
0x00414d0d
0x00414d0d
0x00414d31
0x00414d35
0x00414d3a
0x00414d3d
0x00414d44
0x00414d4e
0x00414d58
0x00414d59
0x00414d5a
0x00414d5b
0x00414d64
0x00414d6a
0x00414d6c
0x00414d73
0x00414d8f
0x00414d75
0x00414d75
0x00414d7a
0x00414d7f
0x00414d82
0x00414d85
0x00414d8a
0x00414d8a
0x00414d96
0x00414d9b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414CD1
__vbaNew2.MSVBVM60(00402888,00417010,?,?,?,?,004012D6), ref: 00414D08
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414D35
__vbaChkstk.MSVBVM60(?,00000000), ref: 00414D4E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403034,000001B8), ref: 00414D85
__vbaFreeObj.MSVBVM60 ref: 00414D96

Memory Dump Source

Source File: 00000000.00000002.1765508910.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1765496463.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1765546444.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1765563091.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: 983ccd2169387fcbc15db41b525c9ca3f7ac784fd4fe1e1d304a67f87967ff8d
Instruction ID: cef441632d4734e6225ab608b763edd638d1041e0887abea588198162336ee63
Opcode Fuzzy Hash: 983ccd2169387fcbc15db41b525c9ca3f7ac784fd4fe1e1d304a67f87967ff8d
Instruction Fuzzy Hash: 82213970900308EFCB10EF95D949BDDBBB9BF48748F20846AF401BB2A1C7B95945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00753196, Relevance: 7.6, Strings: 6, Instructions: 57COMMON

Download Yara Rule

Strings

:F, xrefs: 007531EF
sk4G, xrefs: 007531F5
F, xrefs: 0075321C
sk4G, xrefs: 007531FA
Y;X@, xrefs: 007531CD
Y;X@, xrefs: 007531D2

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: Y;X@$Y;X@$sk4G$sk4G$F$:F
API String ID: 0-3626144075
Opcode ID: f8c15aca40a777048471174b3bb2a3929da24ee4f9c04e3b2c91bd1532e60795
Instruction ID: 58b0fb9a3bdc13508e4a63386fc6923b19cd51ec0714f3a8534160c76095314c
Opcode Fuzzy Hash: f8c15aca40a777048471174b3bb2a3929da24ee4f9c04e3b2c91bd1532e60795
Instruction Fuzzy Hash: 19112575240248EFDF746E2898987D936A1FB09322F90001AFC4AD7140CAA68CE58B96

Uniqueness

Uniqueness Score: -1.00%

Function 00753747, Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

P*L, xrefs: 00752BFE
6NI', xrefs: 007530B8
W#/, xrefs: 00752C90
[r, xrefs: 00753169

Memory Dump Source

Source File: 00000000.00000002.1766008567.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Similarity

API ID:
String ID: [r$6NI'$P*L$W#/
API String ID: 0-1596527173
Opcode ID: 533cbe71e191d9b836c46e0bfda5f2a5b772ade00637be97c46a9ed8615fd7a0
Instruction ID: 1155b7cd981971d11713ecf21a18f327494d8678ee2d896deb1265bf21dc9773
Opcode Fuzzy Hash: 533cbe71e191d9b836c46e0bfda5f2a5b772ade00637be97c46a9ed8615fd7a0
Instruction Fuzzy Hash: C0117BB56003029FF7255998C8A4BD63755AF263F2FA04264ED828B1F2CBE8D9868531

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Tracking No_SINI0035249718.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Tracking No_SINI0035249718.exe PID: 6032 Parent PID: 5908

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Tracking No_SINI0035249718.exe PID: 6032 Parent PID: 5908 Tracking No_SINI0035249718.exeCOMMON

Executed Functions

Function 0040ECC4, Relevance: 313.7, APIs: 169, Strings: 9, Instructions: 2191COMMON

Function 00414392, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127COMMON

Function 00401480, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Function 00405D79, Relevance: 1.4, APIs: 1, Instructions: 130memoryCOMMON

Function 0040ECC4, Relevance: 313.7, APIs: 169, Strings: 9, Instructions: 2191
COMMON

Function 00414392, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127
COMMON

Function 00401480, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
COMMON

Function 00414DD3, Relevance: 84.3, APIs: 42, Strings: 6, Instructions: 343
COMMON

Function 00415912, Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 156
COMMON

Function 00411419, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 150
COMMON

Function 00414830, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 66
COMMON

Function 00415339, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 148
COMMON

Function 00414B22, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
COMMON

Function 004155F8, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 173
COMMON

Function 004145C7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83
COMMON

Function 00411697, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
COMMON

Function 00415B48, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
COMMON

Function 00414734, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69
COMMON

Function 00414A43, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Function 0041494A, Relevance: 10.6, APIs: 7, Instructions: 62
COMMON

Function 004117BE, Relevance: 10.5, APIs: 7, Instructions: 49
COMMON

Function 00414CB5, Relevance: 9.1, APIs: 6, Instructions: 72
COMMON