Play interactive tour

Edit tour

Analysis Report Proforma Invoice 1009745.exe

Overview

General Information

Sample Name:	Proforma Invoice 1009745.exe
Analysis ID:	343935
MD5:	71eee7537f1ac4347b00db9d5777a078
SHA1:	5867ba045cb9817a6f15938d021db6839c5b346f
SHA256:	956ec30b9191b8755a1b879822317ccda7be9a0284a4df1f1f3efd53669f8928
Tags:	exeGuLoader
Most interesting Screenshot:

Detection

GuLoader

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to read the PEB

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

Proforma Invoice 1009745.exe (PID: 7064 cmdline: 'C:\Users\user\Desktop\Proforma Invoice 1009745.exe' MD5: 71EEE7537F1AC4347B00DB9D5777A078)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Proforma Invoice 1009745.exe PID: 7064	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Proforma Invoice 1009745.exe PID: 7064	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Proforma Invoice 1009745.exe	Virustotal: Detection: 23%			Perma Link
Source: Proforma Invoice 1009745.exe	ReversingLabs: Detection: 23%

Compliance:

Uses 32bit PE files

Show sources

Source: Proforma Invoice 1009745.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Proforma Invoice 1009745.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Code function: 0_2_022C76C7 NtProtectVirtualMemory,

0_2_022C76C7

Source: Proforma Invoice 1009745.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Proforma Invoice 1009745.exe, 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameARBEJDSPSYKOLOGIEN.exe vs Proforma Invoice 1009745.exe
Source: Proforma Invoice 1009745.exe, 00000000.00000002.1405395953.00000000021E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs Proforma Invoice 1009745.exe
Source: Proforma Invoice 1009745.exe	Binary or memory string: OriginalFilenameARBEJDSPSYKOLOGIEN.exe vs Proforma Invoice 1009745.exe

Source: Proforma Invoice 1009745.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal80.troj.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC2B0EFE621F04776.TMP

Jump to behavior

Source: Proforma Invoice 1009745.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Proforma Invoice 1009745.exe	Virustotal: Detection: 23%
Source: Proforma Invoice 1009745.exe	ReversingLabs: Detection: 23%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: Proforma Invoice 1009745.exe PID: 7064, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: Proforma Invoice 1009745.exe PID: 7064, type: MEMORY

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_0040734E push ebx; iretd	0_2_0040737B
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C0EB0 push 85660000h; ret	0_2_022C0EB5
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C7EF9 push esp; retf	0_2_022C7EFA
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C7DFA push ebx; retf	0_2_022C7E13

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Code function: 0_2_022C6CB5

0_2_022C6CB5

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

RDTSC instruction interceptor: First address: 00000000022C69A5 second address: 00000000022C69A5 instructions:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Proforma Invoice 1009745.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	RDTSC instruction interceptor: First address: 00000000022C69A5 second address: 00000000022C69A5 instructions:
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	RDTSC instruction interceptor: First address: 00000000022C65A9 second address: 00000000022C65A9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FB0889D2538h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test bh, ah 0x0000001f test ax, cx 0x00000022 add edi, edx 0x00000024 dec dword ptr [ebp+000000F8h] 0x0000002a jmp 00007FB0889D2576h 0x0000002c test ecx, eax 0x0000002e cmp dword ptr [ebp+000000F8h], 00000000h 0x00000035 jne 00007FB0889D24CDh 0x00000037 cmp bh, ch 0x00000039 call 00007FB0889D25A0h 0x0000003e call 00007FB0889D2548h 0x00000043 lfence 0x00000046 mov edx, dword ptr [7FFE0014h] 0x0000004c lfence 0x0000004f ret 0x00000050 mov esi, edx 0x00000052 pushad 0x00000053 rdtsc

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Code function: 0_2_022C6621 rdtsc

0_2_022C6621

Source: Proforma Invoice 1009745.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe

Code function: 0_2_022C6621 rdtsc

0_2_022C6621

Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C3642 mov eax, dword ptr fs:[00000030h]	0_2_022C3642
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C6CB5 mov eax, dword ptr fs:[00000030h]	0_2_022C6CB5
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C6280 mov eax, dword ptr fs:[00000030h]	0_2_022C6280
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C2737 mov eax, dword ptr fs:[00000030h]	0_2_022C2737
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C5D7D mov eax, dword ptr fs:[00000030h]	0_2_022C5D7D
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C274B mov eax, dword ptr fs:[00000030h]	0_2_022C274B
Source: C:\Users\user\Desktop\Proforma Invoice 1009745.exe	Code function: 0_2_022C219E mov eax, dword ptr fs:[00000030h]	0_2_022C219E

HIPS / PFW / Operating System Protection Evasion:

Source: Proforma Invoice 1009745.exe, 00000000.00000002.1405208564.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Proforma Invoice 1009745.exe, 00000000.00000002.1405208564.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Proforma Invoice 1009745.exe, 00000000.00000002.1405208564.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: Proforma Invoice 1009745.exe, 00000000.00000002.1405208564.0000000000DA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Process Injection1	OS Credential Dumping	Security Software Discovery411	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	System Information Discovery31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Proforma Invoice 1009745.exe	24%	Virustotal		Browse
Proforma Invoice 1009745.exe	24%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	343935
Start date:	25.01.2021
Start time:	19:14:46
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Proforma Invoice 1009745.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.3% (good quality ratio 4.1%) Quality average: 22.5% Quality standard deviation: 29.5%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:
Entropy (8bit):	5.832013404875337
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Proforma Invoice 1009745.exe
File size:	102400
MD5:	71eee7537f1ac4347b00db9d5777a078
SHA1:	5867ba045cb9817a6f15938d021db6839c5b346f
SHA256:	956ec30b9191b8755a1b879822317ccda7be9a0284a4df1f1f3efd53669f8928
SHA512:	31d626568310d36850e6ec84f7b4d61fffb8dd0b587974b5957e3c36fdd3e77954a57242a41ec4d2a65294c95221c14dce5e978629fa2bc3e12d8e8c812049f0
SSDEEP:	1536:WD9Ou2tSBrRY0419Xh2qw4H4kF9E2L6HiuUCWVD:Pu2IhRHy9ww4yC2L6HiN5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...CZ.R.................`...0...............p....@................

File Icon


Icon Hash:	f030f0c6f030b100

Static PE Info

General
Entrypoint:	0x401480
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x52F55A43 [Fri Feb 7 22:12:19 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	901434c98a0ac9771b4195fb76cfab24

Entrypoint Preview

Instruction
push 004021A8h
call 00007FB088BBBB25h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, dl
push 00000021h
test byte ptr [edx-61BA80A6h], ah
pop edi
aas
fsub st(4), st(0)
insd
aad 46h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push eax
jc 00007FB088BBBBA1h
push 00000065h
arpl word ptr [ecx+esi+00h], si
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add al, DFh
fldenv [ebp-4A24E1BFh]
inc eax
mov cl, B0h
inc dword ptr [esi+54h]
sub byte ptr [ecx], 00000006h
xor ch, byte ptr [ebp-23h]
pop ebx
pop ss
xchg eax, esp
mov ch, 40h
lahf
fbstp [ebp-0D25B5A6h]
sbb eax, 33AD4F3Ah
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
salc
or eax, dword ptr [eax]
add byte ptr [esi], dh
or eax, dword ptr [eax]
add byte ptr [eax], al
or eax, dword ptr [eax]
dec edi
jbe 00007FB088BBBB97h
jc 00007FB088BBBBA4h
jne 00007FB088BBBBA0h
popad
jc 00007FB088BBBB32h
or eax, 67000501h
arpl word ptr [ebx+00h], bp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15c74	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0xa64	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x124	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x15170	0x16000	False	0.472156871449	data	6.2500820394	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x17000	0x11a4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0xa64	0x1000	False	0.15966796875	data	1.73359437587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x194fc	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x194e8	0x14	data
RT_VERSION	0x190f0	0x3f8	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaLateMemSt, __vbaVarForInit, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaLateMemCall, __vbaVarDup, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Trademark International
InternalName	ARBEJDSPSYKOLOGIEN
FileVersion	1.00
CompanyName	Native Instruments Nanosystems S.r.l.
LegalTrademarks	Trademark International
Comments	Native Instruments Nanosystems S.r.l.
ProductName	Native Instruments Nanosystems S.r.l.
ProductVersion	1.00
FileDescription	Native
OriginalFilename	ARBEJDSPSYKOLOGIEN.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Proforma Invoice 1009745.exe PID: 7064 Parent PID: 5868

General

Start time:	19:15:41
Start date:	25/01/2021
Path:	C:\Users\user\Desktop\Proforma Invoice 1009745.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Proforma Invoice 1009745.exe'
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	71EEE7537F1AC4347B00DB9D5777A078
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Proforma Invoice 1009745.exe PID: 7064 Parent PID: 5868 Proforma Invoice 1009745.exeCOMMON

Executed Functions

Function 0040ECA4, Relevance: 315.4, APIs: 169, Strings: 10, Instructions: 2191
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040ECA4(signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				long long* _v16;
				void* _v40;
				char _v56;
				char _v60;
				long long _v68;
				void* _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				char _v100;
				char _v104;
				long long _v108;
				short _v112;
				intOrPtr _v132;
				char _v136;
				signed int _v140;
				char _v144;
				char _v148;
				signed int _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				intOrPtr _v176;
				char _v184;
				intOrPtr _v192;
				char _v200;
				char* _v208;
				char _v216;
				intOrPtr _v224;
				char _v232;
				signed int _v240;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				char _v288;
				intOrPtr _v292;
				long long _v296;
				char _v304;
				intOrPtr _v308;
				char _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr* _v348;
				signed int _v352;
				char _v368;
				char _v384;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _v412;
				signed int _v416;
				char* _v420;
				intOrPtr _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				signed int _v440;
				intOrPtr* _v444;
				signed int _v448;
				intOrPtr* _v452;
				signed int _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				intOrPtr* _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				intOrPtr* _v520;
				signed int _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				intOrPtr* _v564;
				signed int _v568;
				intOrPtr* _v572;
				signed int _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				intOrPtr* _v592;
				signed int _v596;
				intOrPtr* _v600;
				signed int _v604;
				intOrPtr* _v608;
				signed int _v612;
				intOrPtr* _v616;
				signed int _v620;
				intOrPtr* _v624;
				signed int _v628;
				intOrPtr* _v632;
				signed int _v636;
				signed int _v640;
				intOrPtr* _v644;
				signed int _v648;
				intOrPtr* _v652;
				signed int _v656;
				intOrPtr* _v660;
				signed int _v664;
				intOrPtr* _v668;
				signed int _v672;
				intOrPtr* _v676;
				signed int _v680;
				intOrPtr* _v684;
				signed int _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr* _v704;
				signed int _v708;
				intOrPtr* _v712;
				signed int _v716;
				intOrPtr* _v720;
				signed int _v724;
				intOrPtr* _v728;
				signed int _v732;
				intOrPtr* _v736;
				signed int _v740;
				signed int _v744;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1103;
				signed int _t1107;
				signed int _t1111;
				signed int _t1115;
				signed int _t1119;
				signed int _t1127;
				signed int _t1134;
				signed int _t1138;
				signed int _t1142;
				signed int _t1146;
				signed int _t1150;
				signed int _t1154;
				signed int _t1159;
				signed int _t1163;
				char* _t1165;
				char* _t1168;
				signed int _t1190;
				signed int _t1194;
				signed int _t1198;
				signed int _t1202;
				signed int _t1221;
				signed int _t1225;
				signed int _t1229;
				signed int _t1233;
				signed int _t1240;
				signed int _t1248;
				signed int _t1252;
				signed int _t1263;
				signed int _t1267;
				signed int _t1271;
				signed int _t1275;
				signed int _t1291;
				signed int _t1295;
				signed int _t1299;
				signed int _t1303;
				signed int _t1319;
				signed int _t1323;
				signed int _t1329;
				signed int _t1333;
				signed int _t1337;
				signed int _t1341;
				signed int _t1345;
				signed int _t1349;
				signed int _t1353;
				signed int _t1357;
				signed int _t1361;
				signed int _t1380;
				signed int _t1384;
				signed int _t1388;
				signed int _t1392;
				signed int _t1396;
				signed int _t1400;
				signed int _t1406;
				signed int _t1414;
				signed int _t1418;
				signed int _t1422;
				signed int _t1426;
				signed int _t1430;
				signed int _t1434;
				signed int _t1438;
				signed int _t1442;
				char* _t1443;
				char* _t1468;
				signed int _t1472;
				signed int _t1476;
				signed int _t1480;
				signed int _t1484;
				signed int _t1493;
				signed int _t1499;
				signed int _t1503;
				signed int _t1508;
				signed int _t1512;
				signed int _t1516;
				signed int _t1520;
				signed int _t1524;
				signed int _t1528;
				char* _t1532;
				signed int _t1536;
				char* _t1543;
				signed int _t1560;
				signed int _t1564;
				signed int _t1571;
				char* _t1574;
				void* _t1575;
				signed int* _t1579;
				intOrPtr _t1587;
				char* _t1600;
				intOrPtr _t1618;
				intOrPtr _t1626;
				char* _t1652;
				intOrPtr _t1662;
				intOrPtr _t1697;
				intOrPtr _t1701;
				char* _t1711;
				void* _t1712;
				void* _t1713;
				void* _t1722;
				long long* _t1731;
				void* _t1732;
				void* _t1733;
				void* _t1736;
				void* _t1738;
				void* _t1739;
				void* _t1740;
				intOrPtr* _t1741;
				intOrPtr* _t1742;
				void* _t1743;
				intOrPtr* _t1744;
				intOrPtr* _t1746;
				void* _t1747;
				intOrPtr* _t1748;

				 *[fs:0x0] = _t1731;
				L004012D0();
				_v16 = _t1731;
				_v12 = 0x4011b0;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, _t1713, _t1722, _t1575,  *[fs:0x0], 0x4012d6);
				_t1086 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4);
				_v316 = _t1086;
				if(_v316 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402e70);
					_push(_a4);
					_push(_v316);
					L00401462();
					_v428 = _t1086;
				}
				if( *0x417010 != 0) {
					_v432 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v432 = 0x417010;
				}
				_t1090 =  &_v148;
				L0040145C();
				_v316 = _t1090;
				_t1094 =  *((intOrPtr*)( *_v316 + 0x160))(_v316,  &_v268, _t1090,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x304))( *_v432));
				asm("fclex");
				_v320 = _t1094;
				if(_v320 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v436 = _t1094;
				}
				_v312 = 0x89a062f0;
				_v308 = 0x5aff;
				_v304 =  *0x4011a8;
				_v208 = L"Intetkoen6";
				_v216 = 8;
				_v296 =  *0x4011a0;
				_v288 = 0x295df0f0;
				_v284 = 0x5b00;
				_t1579 =  &_v140;
				L00401450();
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 =  *0x401198;
				_t1103 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _t1579, _t1579,  &_v140, 0x1ba0,  &_v288, _v268,  &_v296, 0x10,  &_v304,  &_v312, 0x4cf1d8);
				_v324 = _t1103;
				if(_v324 >= 0) {
					_v440 = _v440 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402e70);
					_push(_a4);
					_push(_v324);
					L00401462();
					_v440 = _t1103;
				}
				L0040144A();
				L00401444();
				if( *0x417010 != 0) {
					_v444 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v444 = 0x417010;
				}
				_t1107 =  &_v148;
				L0040145C();
				_v316 = _t1107;
				_t1111 =  *((intOrPtr*)( *_v316 + 0x88))(_v316,  &_v268, _t1107,  *((intOrPtr*)( *((intOrPtr*)( *_v444)) + 0x308))( *_v444));
				asm("fclex");
				_v320 = _t1111;
				if(_v320 >= 0) {
					_v448 = _v448 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v448 = _t1111;
				}
				if( *0x417010 != 0) {
					_v452 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v452 = 0x417010;
				}
				_t1587 =  *((intOrPtr*)( *_v452));
				_t1115 =  &_v152;
				L0040145C();
				_v324 = _t1115;
				_t1119 =  *((intOrPtr*)( *_v324 + 0x78))(_v324,  &_v272, _t1115,  *((intOrPtr*)(_t1587 + 0x2fc))( *_v452));
				asm("fclex");
				_v328 = _t1119;
				if(_v328 >= 0) {
					_v456 = _v456 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403024);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v456 = _t1119;
				}
				_v252 = 0x417b;
				_v288 = 0xeea80150;
				_v284 = 0x5b02;
				_v280 = _v268;
				_v276 =  *0x401190;
				_v160 = _v272;
				 *_t1731 =  *0x401188;
				_t1127 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v276,  &_v280, _t1587, _t1587,  &_v288, _t1587,  &_v252,  &_v256);
				_v332 = _t1127;
				if(_v332 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x402e70);
					_push(_a4);
					_push(_v332);
					L00401462();
					_v460 = _t1127;
				}
				_v112 = _v256;
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1732 = _t1731 + 0xc;
				if( *0x417010 != 0) {
					_v464 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v464 = 0x417010;
				}
				_t1134 =  &_v148;
				L0040145C();
				_v316 = _t1134;
				_t1138 =  *((intOrPtr*)( *_v316 + 0x170))(_v316,  &_v140, _t1134,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x2fc))( *_v464));
				asm("fclex");
				_v320 = _t1138;
				if(_v320 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x403024);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v468 = _t1138;
				}
				if( *0x417010 != 0) {
					_v472 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v472 = 0x417010;
				}
				_t1142 =  &_v152;
				L0040145C();
				_v324 = _t1142;
				_t1146 =  *((intOrPtr*)( *_v324 + 0x78))(_v324,  &_v268, _t1142,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x2fc))( *_v472));
				asm("fclex");
				_v328 = _t1146;
				if(_v328 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403024);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v476 = _t1146;
				}
				if( *0x417010 != 0) {
					_v480 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v480 = 0x417010;
				}
				_t1150 =  &_v156;
				L0040145C();
				_v332 = _t1150;
				_t1154 =  *((intOrPtr*)( *_v332 + 0x158))(_v332,  &_v160, _t1150,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x2fc))( *_v480));
				asm("fclex");
				_v336 = _t1154;
				if(_v336 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403024);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v484 = _t1154;
				}
				_push(0);
				_push(0);
				_push(_v160);
				_push( &_v184);
				L00401438();
				_t1733 = _t1732 + 0x10;
				if( *0x417010 != 0) {
					_v488 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v488 = 0x417010;
				}
				_t1159 =  &_v164;
				L0040145C();
				_v340 = _t1159;
				_t1163 =  *((intOrPtr*)( *_v340 + 0x160))(_v340,  &_v168, _t1159,  *((intOrPtr*)( *((intOrPtr*)( *_v488)) + 0x2fc))( *_v488));
				asm("fclex");
				_v344 = _t1163;
				if(_v344 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x403024);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v492 = _t1163;
				}
				L00401438();
				_t1165 =  &_v184;
				L00401432();
				_v276 = _t1165;
				_v272 = _v268;
				_v252 = 0x6849;
				_v208 = L"Performer";
				_v216 = 8;
				_v396 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1600 =  &_v144;
				L0040142C();
				_t1168 =  &_v200;
				L00401432();
				_v288 =  *0x401180;
				_v296 =  *0x401178;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v144, 0x10,  &_v252,  &_v272, _t1600, _t1600, _t1600,  &_v276, _t1168, _t1168,  &_v288, _t1165,  &_v200, _v168, 0, 0);
				_v92 = _v288;
				_v88 = _v284;
				L0040144A();
				_push( &_v168);
				_push( &_v160);
				_push( &_v164);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(6);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1736 = _t1733 + 0x38;
				if( *0x417010 != 0) {
					_v496 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v496 = 0x417010;
				}
				_t1190 =  &_v148;
				L0040145C();
				_v316 = _t1190;
				_t1194 =  *((intOrPtr*)( *_v316 + 0x178))(_v316,  &_v152, _t1190,  *((intOrPtr*)( *((intOrPtr*)( *_v496)) + 0x304))( *_v496));
				asm("fclex");
				_v320 = _t1194;
				if(_v320 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v500 = _t1194;
				}
				if( *0x417010 != 0) {
					_v504 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v504 = 0x417010;
				}
				_t1198 =  &_v156;
				L0040145C();
				_v324 = _t1198;
				_t1202 =  *((intOrPtr*)( *_v324 + 0xe0))(_v324,  &_v252, _t1198,  *((intOrPtr*)( *((intOrPtr*)( *_v504)) + 0x300))( *_v504));
				asm("fclex");
				_v328 = _t1202;
				if(_v328 >= 0) {
					_v508 = _v508 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x403070);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v508 = _t1202;
				}
				_v256 = _v252;
				_v268 =  *0x401174;
				_v192 = 0x789d91;
				_v200 = 3;
				_v400 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v400;
				_v184 = 9;
				_v208 = L"Arbejdsfelterne";
				_v216 = 8;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x720))(_a4, 0x25a4, 0x10,  &_v184,  &_v200,  &_v268, 0x46a8,  &_v256);
				_push( &_v156);
				_push( &_v148);
				_push(2);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1738 = _t1736 + 0x18;
				if( *0x417010 != 0) {
					_v512 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v512 = 0x417010;
				}
				_t1221 =  &_v148;
				L0040145C();
				_v316 = _t1221;
				_t1225 =  *((intOrPtr*)( *_v316 + 0xd0))(_v316,  &_v252, _t1221,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x300))( *_v512));
				asm("fclex");
				_v320 = _t1225;
				if(_v320 >= 0) {
					_v516 = _v516 & 0x00000000;
				} else {
					_push(0xd0);
					_push(0x403070);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v516 = _t1225;
				}
				if( *0x417010 != 0) {
					_v520 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v520 = 0x417010;
				}
				_t1229 =  &_v152;
				L0040145C();
				_v324 = _t1229;
				_t1233 =  *((intOrPtr*)( *_v324 + 0xf8))(_v324, 0,  &_v140, _t1229,  *((intOrPtr*)( *((intOrPtr*)( *_v520)) + 0x308))( *_v520));
				asm("fclex");
				_v328 = _t1233;
				if(_v328 >= 0) {
					_v524 = _v524 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x402ff8);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v524 = _t1233;
				}
				_v256 = 0x2cc3;
				_v404 = _v140;
				_v140 = _v140 & 0x00000000;
				L0040142C();
				_t1240 =  *((intOrPtr*)( *_a4 + 0x704))(_a4, _v252, 0x702f,  &_v144,  &_v256,  &_v288);
				_v332 = _t1240;
				if(_v332 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x402e70);
					_push(_a4);
					_push(_v332);
					L00401462();
					_v528 = _t1240;
				}
				_v136 = _v288;
				_v132 = _v284;
				L0040144A();
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1739 = _t1738 + 0xc;
				if( *0x417010 != 0) {
					_v532 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v532 = 0x417010;
				}
				_t1618 =  *((intOrPtr*)( *_v532));
				_t1248 =  &_v148;
				L0040145C();
				_v316 = _t1248;
				_t1252 =  *((intOrPtr*)( *_v316 + 0x130))(_v316,  &_v152, _t1248,  *((intOrPtr*)(_t1618 + 0x2fc))( *_v532));
				asm("fclex");
				_v320 = _t1252;
				if(_v320 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x403024);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v536 = _t1252;
				}
				_v408 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v408;
				_v184 = 9;
				_v268 =  *0x401170;
				_v484 =  *0x401168;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4, _t1618, _t1618,  &_v268,  &_v184);
				L00401444();
				L00401420();
				if( *0x417010 != 0) {
					_v540 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v540 = 0x417010;
				}
				_t1263 =  &_v148;
				L0040145C();
				_v316 = _t1263;
				_t1267 =  *((intOrPtr*)( *_v316 + 0x130))(_v316,  &_v152, _t1263,  *((intOrPtr*)( *((intOrPtr*)( *_v540)) + 0x304))( *_v540));
				asm("fclex");
				_v320 = _t1267;
				if(_v320 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v544 = _t1267;
				}
				if( *0x417010 != 0) {
					_v548 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v548 = 0x417010;
				}
				_t1626 =  *((intOrPtr*)( *_v548));
				_t1271 =  &_v156;
				L0040145C();
				_v324 = _t1271;
				_t1275 =  *((intOrPtr*)( *_v324 + 0x170))(_v324,  &_v140, _t1271,  *((intOrPtr*)(_t1626 + 0x2fc))( *_v548));
				asm("fclex");
				_v328 = _t1275;
				if(_v328 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x403024);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v552 = _t1275;
				}
				_v296 =  *0x401160;
				_v412 = _v152;
				_v152 = _v152 & 0x00000000;
				_v176 = _v412;
				_v184 = 9;
				_v288 =  *0x401158;
				_v208 = 0x34452;
				_v216 = 3;
				_v552 =  *0x401150;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, L"Baereevnen5", 0x10, 0x682f9540, 0x5afb,  &_v288, _t1626, _t1626,  &_v184,  &_v296, _v140,  &_v200);
				L0040141A();
				L0040144A();
				_push( &_v156);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1740 = _t1739 + 0xc;
				L00401420();
				if( *0x417010 != 0) {
					_v556 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v556 = 0x417010;
				}
				_t1291 =  &_v148;
				L0040145C();
				_v316 = _t1291;
				_t1295 =  *((intOrPtr*)( *_v316 + 0x120))(_v316,  &_v268, _t1291,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x2fc))( *_v556));
				asm("fclex");
				_v320 = _t1295;
				if(_v320 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x403024);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v560 = _t1295;
				}
				if( *0x417010 != 0) {
					_v564 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v564 = 0x417010;
				}
				_t1299 =  &_v152;
				L0040145C();
				_v324 = _t1299;
				_t1303 =  *((intOrPtr*)( *_v324 + 0x128))(_v324,  &_v252, _t1299,  *((intOrPtr*)( *((intOrPtr*)( *_v564)) + 0x308))( *_v564));
				asm("fclex");
				_v328 = _t1303;
				if(_v328 >= 0) {
					_v568 = _v568 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402ff8);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v568 = _t1303;
				}
				_v256 = _v252;
				_v288 = 0xa17c2980;
				_v284 = 0x5afb;
				_v208 = 0x331e20;
				_v216 = 3;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4, 0x10, 0x577708,  &_v288, _v268,  &_v256,  &_v296);
				_v108 = _v296;
				_v104 = _v292;
				_push( &_v152);
				_push( &_v148);
				_push(2);
				L0040143E();
				_t1741 = _t1740 + 0xc;
				if( *0x417010 != 0) {
					_v572 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v572 = 0x417010;
				}
				_t1319 =  &_v148;
				L0040145C();
				_v316 = _t1319;
				_t1323 =  *((intOrPtr*)( *_v316 + 0x120))(_v316,  &_v268, _t1319,  *((intOrPtr*)( *((intOrPtr*)( *_v572)) + 0x2fc))( *_v572));
				asm("fclex");
				_v320 = _t1323;
				if(_v320 >= 0) {
					_v576 = _v576 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x403024);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v576 = _t1323;
				}
				_v288 = 0xcfb51b00;
				_v284 = 0x5af5;
				_v208 = _v268;
				_v216 = 3;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1329 =  *((intOrPtr*)( *_a4 + 0x708))(_a4, 0x10,  &_v288);
				_v324 = _t1329;
				if(_v324 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x402e70);
					_push(_a4);
					_push(_v324);
					L00401462();
					_v580 = _t1329;
				}
				L00401444();
				if( *0x417010 != 0) {
					_v584 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v584 = 0x417010;
				}
				_t1333 =  &_v148;
				L0040145C();
				_v316 = _t1333;
				_t1337 =  *((intOrPtr*)( *_v316 + 0x70))(_v316,  &_v268, _t1333,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x304))( *_v584));
				asm("fclex");
				_v320 = _t1337;
				if(_v320 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v588 = _t1337;
				}
				if( *0x417010 != 0) {
					_v592 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v592 = 0x417010;
				}
				_t1341 =  &_v152;
				L0040145C();
				_v324 = _t1341;
				_t1345 =  *((intOrPtr*)( *_v324 + 0x218))(_v324,  &_v140, _t1341,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x308))( *_v592));
				asm("fclex");
				_v328 = _t1345;
				if(_v328 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x402ff8);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v596 = _t1345;
				}
				if( *0x417010 != 0) {
					_v600 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v600 = 0x417010;
				}
				_t1349 =  &_v156;
				L0040145C();
				_v332 = _t1349;
				_t1353 =  *((intOrPtr*)( *_v332 + 0x88))(_v332,  &_v272, _t1349,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x304))( *_v600));
				asm("fclex");
				_v336 = _t1353;
				if(_v336 >= 0) {
					_v604 = _v604 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x402ff8);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v604 = _t1353;
				}
				if( *0x417010 != 0) {
					_v608 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v608 = 0x417010;
				}
				_t1357 =  &_v160;
				L0040145C();
				_v340 = _t1357;
				_t1361 =  *((intOrPtr*)( *_v340 + 0x128))(_v340,  &_v252, _t1357,  *((intOrPtr*)( *((intOrPtr*)( *_v608)) + 0x308))( *_v608));
				asm("fclex");
				_v344 = _t1361;
				if(_v344 >= 0) {
					_v612 = _v612 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402ff8);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v612 = _t1361;
				}
				_v256 = _v252;
				_v416 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1652 =  &_v144;
				L0040142C();
				_v288 =  *0x401148;
				_v208 = 0x2eb794;
				_v216 = 3;
				 *_t1741 = _v272;
				 *_t1741 = _v268;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x10,  &_v288, _t1652, L"Abietic6",  &_v144, _t1652,  &_v256, 0x249cd,  &_v276);
				_v60 = _v276;
				L0040144A();
				_push( &_v160);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(4);
				L0040143E();
				_t1742 = _t1741 + 0x14;
				if( *0x417010 != 0) {
					_v616 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v616 = 0x417010;
				}
				_t1380 =  &_v148;
				L0040145C();
				_v316 = _t1380;
				_t1384 =  *((intOrPtr*)( *_v316 + 0x78))(_v316,  &_v268, _t1380,  *((intOrPtr*)( *((intOrPtr*)( *_v616)) + 0x2fc))( *_v616));
				asm("fclex");
				_v320 = _t1384;
				if(_v320 >= 0) {
					_v620 = _v620 & 0x00000000;
				} else {
					_push(0x78);
					_push(0x403024);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v620 = _t1384;
				}
				if( *0x417010 != 0) {
					_v624 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v624 = 0x417010;
				}
				_t1388 =  &_v152;
				L0040145C();
				_v324 = _t1388;
				_t1392 =  *((intOrPtr*)( *_v324 + 0x50))(_v324,  &_v252, _t1388,  *((intOrPtr*)( *((intOrPtr*)( *_v624)) + 0x308))( *_v624));
				asm("fclex");
				_v328 = _t1392;
				if(_v328 >= 0) {
					_v628 = _v628 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x402ff8);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v628 = _t1392;
				}
				if( *0x417010 != 0) {
					_v632 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v632 = 0x417010;
				}
				_t1662 =  *((intOrPtr*)( *_v632));
				_t1396 =  &_v156;
				L0040145C();
				_v332 = _t1396;
				_t1400 =  *((intOrPtr*)( *_v332 + 0x98))(_v332,  &_v256, _t1396,  *((intOrPtr*)(_t1662 + 0x2fc))( *_v632));
				asm("fclex");
				_v336 = _t1400;
				if(_v336 >= 0) {
					_v636 = _v636 & 0x00000000;
				} else {
					_push(0x98);
					_push(0x403024);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v636 = _t1400;
				}
				_v288 = 0xf1e53680;
				_v284 = 0x5af8;
				_v272 = _v268;
				 *_t1742 =  *0x401140;
				_t1406 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4, _t1662,  &_v272, _v252,  &_v288, 0x7a724d90, 0x5b07, _v256,  &_v276);
				_v340 = _t1406;
				if(_v340 >= 0) {
					_v640 = _v640 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x402e70);
					_push(_a4);
					_push(_v340);
					L00401462();
					_v640 = _t1406;
				}
				_v100 = _v276;
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(3);
				L0040143E();
				_t1743 = _t1742 + 0x10;
				if( *0x417010 != 0) {
					_v644 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v644 = 0x417010;
				}
				_t1414 =  &_v148;
				L0040145C();
				_v316 = _t1414;
				_t1418 =  *((intOrPtr*)( *_v316 + 0x198))(_v316,  &_v268, _t1414,  *((intOrPtr*)( *((intOrPtr*)( *_v644)) + 0x308))( *_v644));
				asm("fclex");
				_v320 = _t1418;
				if(_v320 >= 0) {
					_v648 = _v648 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x402ff8);
					_push(_v316);
					_push(_v320);
					L00401462();
					_v648 = _t1418;
				}
				if( *0x417010 != 0) {
					_v652 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v652 = 0x417010;
				}
				_t1422 =  &_v152;
				L0040145C();
				_v324 = _t1422;
				_t1426 =  *((intOrPtr*)( *_v324 + 0xf8))(_v324, 0,  &_v140, _t1422,  *((intOrPtr*)( *((intOrPtr*)( *_v652)) + 0x308))( *_v652));
				asm("fclex");
				_v328 = _t1426;
				if(_v328 >= 0) {
					_v656 = _v656 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x402ff8);
					_push(_v324);
					_push(_v328);
					L00401462();
					_v656 = _t1426;
				}
				if( *0x417010 != 0) {
					_v660 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v660 = 0x417010;
				}
				_t1430 =  &_v156;
				L0040145C();
				_v332 = _t1430;
				_t1434 =  *((intOrPtr*)( *_v332 + 0x70))(_v332,  &_v272, _t1430,  *((intOrPtr*)( *((intOrPtr*)( *_v660)) + 0x308))( *_v660));
				asm("fclex");
				_v336 = _t1434;
				if(_v336 >= 0) {
					_v664 = _v664 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402ff8);
					_push(_v332);
					_push(_v336);
					L00401462();
					_v664 = _t1434;
				}
				if( *0x417010 != 0) {
					_v668 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v668 = 0x417010;
				}
				_t1438 =  &_v160;
				L0040145C();
				_v340 = _t1438;
				_t1442 =  *((intOrPtr*)( *_v340 + 0x158))(_v340,  &_v164, _t1438,  *((intOrPtr*)( *((intOrPtr*)( *_v668)) + 0x2fc))( *_v668));
				asm("fclex");
				_v344 = _t1442;
				if(_v344 >= 0) {
					_v672 = _v672 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x403024);
					_push(_v340);
					_push(_v344);
					L00401462();
					_v672 = _t1442;
				}
				_t1443 =  &_v200;
				L00401438();
				_t1744 = _t1743 + 0x10;
				L00401432();
				_v280 = _t1443;
				_v176 = 0x82fc7f;
				_v184 = 3;
				_v276 = 0x39df66;
				_v296 =  *0x401138;
				_v420 = _v140;
				_v140 = _v140 & 0x00000000;
				_t1711 = _v420;
				L0040142C();
				_v288 = 0xa52d5fc0;
				_v284 = 0x5afd;
				_v208 = _v268;
				_v216 = 3;
				 *_t1744 = _v272;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x734))(_a4, 0x10,  &_v288,  &_v144,  &_v296,  &_v276,  &_v144,  &_v184, 0x64c426,  &_v280, _t1443, _t1443, _v164, 0, 0);
				L0040144A();
				_push( &_v164);
				_push( &_v160);
				_push( &_v156);
				_push( &_v152);
				_push( &_v148);
				_push(5);
				L0040143E();
				_push( &_v200);
				_push( &_v184);
				_push(2);
				L00401426();
				_t1746 = _t1744 + 0x24;
				_v208 = 1;
				_v216 = 2;
				_v224 = 0xbcc3;
				_v232 = 3;
				_v240 = _v240 & 0x00000000;
				_v248 = 2;
				_push( &_v216);
				_push( &_v232);
				_push( &_v248);
				_push( &_v384);
				_push( &_v368);
				_t1468 =  &_v56;
				_push(_t1468);
				L00401414();
				_v424 = _t1468;
				while(_v424 != 0) {
					if( *0x417010 != 0) {
						_v676 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v676 = 0x417010;
					}
					_t1472 =  &_v148;
					L0040145C();
					_v316 = _t1472;
					_t1476 =  *((intOrPtr*)( *_v316 + 0x60))(_v316,  &_v268, _t1472,  *((intOrPtr*)( *((intOrPtr*)( *_v676)) + 0x308))( *_v676));
					asm("fclex");
					_v320 = _t1476;
					if(_v320 >= 0) {
						_v680 = _v680 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x402ff8);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v680 = _t1476;
					}
					if( *0x417010 != 0) {
						_v684 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v684 = 0x417010;
					}
					_t1480 =  &_v152;
					L0040145C();
					_v324 = _t1480;
					_t1484 =  *((intOrPtr*)( *_v324 + 0x1d0))(_v324,  &_v252, _t1480,  *((intOrPtr*)( *((intOrPtr*)( *_v684)) + 0x300))( *_v684));
					asm("fclex");
					_v328 = _t1484;
					if(_v328 >= 0) {
						_v688 = _v688 & 0x00000000;
					} else {
						_push(0x1d0);
						_push(0x403070);
						_push(_v324);
						_push(_v328);
						L00401462();
						_v688 = _t1484;
					}
					_v256 = _v252;
					_v272 = _v268;
					_v288 =  *0x401130;
					_t1493 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, L"lynfrysning",  &_v288,  &_v272,  &_v256, 0x5c95b7,  &_v296);
					_v332 = _t1493;
					if(_v332 >= 0) {
						_v692 = _v692 & 0x00000000;
					} else {
						_push(0x710);
						_push(0x402e70);
						_push(_a4);
						_push(_v332);
						L00401462();
						_v692 = _t1493;
					}
					_v68 = _v296;
					_push( &_v152);
					_push( &_v148);
					_push(2);
					L0040143E();
					_t1747 = _t1746 + 0xc;
					if( *0x417010 != 0) {
						_v696 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v696 = 0x417010;
					}
					_t1499 =  &_v148;
					L0040145C();
					_v316 = _t1499;
					_t1503 =  *((intOrPtr*)( *_v316 + 0x168))(_v316,  &_v152, _t1499,  *((intOrPtr*)( *((intOrPtr*)( *_v696)) + 0x2fc))( *_v696));
					asm("fclex");
					_v320 = _t1503;
					if(_v320 >= 0) {
						_v700 = _v700 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x403024);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v700 = _t1503;
					}
					_push(0);
					_push(0);
					_push(_v152);
					_push( &_v184);
					L00401438();
					_t1748 = _t1747 + 0x10;
					if( *0x417010 != 0) {
						_v704 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v704 = 0x417010;
					}
					_t1508 =  &_v156;
					L0040145C();
					_v324 = _t1508;
					_t1512 =  *((intOrPtr*)( *_v324 + 0x60))(_v324,  &_v268, _t1508,  *((intOrPtr*)( *((intOrPtr*)( *_v704)) + 0x304))( *_v704));
					asm("fclex");
					_v328 = _t1512;
					if(_v328 >= 0) {
						_v708 = _v708 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x402ff8);
						_push(_v324);
						_push(_v328);
						L00401462();
						_v708 = _t1512;
					}
					if( *0x417010 != 0) {
						_v712 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v712 = 0x417010;
					}
					_t1516 =  &_v160;
					L0040145C();
					_v332 = _t1516;
					_t1520 =  *((intOrPtr*)( *_v332 + 0xd8))(_v332,  &_v252, _t1516,  *((intOrPtr*)( *((intOrPtr*)( *_v712)) + 0x300))( *_v712));
					asm("fclex");
					_v336 = _t1520;
					if(_v336 >= 0) {
						_v716 = _v716 & 0x00000000;
					} else {
						_push(0xd8);
						_push(0x403070);
						_push(_v332);
						_push(_v336);
						L00401462();
						_v716 = _t1520;
					}
					if( *0x417010 != 0) {
						_v720 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v720 = 0x417010;
					}
					_t1524 =  &_v164;
					L0040145C();
					_v340 = _t1524;
					_t1528 =  *((intOrPtr*)( *_v340 + 0x128))(_v340,  &_v256, _t1524,  *((intOrPtr*)( *((intOrPtr*)( *_v720)) + 0x300))( *_v720));
					asm("fclex");
					_v344 = _t1528;
					if(_v344 >= 0) {
						_v724 = _v724 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x403070);
						_push(_v340);
						_push(_v344);
						L00401462();
						_v724 = _t1528;
					}
					if( *0x417010 != 0) {
						_v728 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v728 = 0x417010;
					}
					_t1697 =  *((intOrPtr*)( *_v728));
					_t1532 =  &_v168;
					L0040145C();
					_v348 = _t1532;
					_t1536 =  *((intOrPtr*)( *_v348 + 0x70))(_v348,  &_v272, _t1532,  *((intOrPtr*)(_t1697 + 0x304))( *_v728));
					asm("fclex");
					_v352 = _t1536;
					if(_v352 >= 0) {
						_v732 = _v732 & 0x00000000;
					} else {
						_push(0x70);
						_push(0x402ff8);
						_push(_v348);
						_push(_v352);
						L00401462();
						_v732 = _t1536;
					}
					_v264 = _v256;
					_v276 = _v268;
					_v260 = 0x7454;
					 *_t1748 = _v272;
					_t1543 =  &_v184;
					L00401432();
					 *((intOrPtr*)( *_a4 + 0x738))(_a4, 0x75ae89, _t1543, _t1543,  &_v260,  &_v276, _v252,  &_v264, _t1697,  &_v280);
					_v96 = _v280;
					L0040143E();
					_t1746 = _t1748 + 0x1c;
					L00401420();
					 *((intOrPtr*)( *_a4 + 0x73c))(_a4, 6,  &_v148,  &_v156,  &_v160,  &_v164,  &_v168,  &_v152);
					if( *0x417010 != 0) {
						_v736 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v736 = 0x417010;
					}
					_t1701 =  *((intOrPtr*)( *_v736));
					_t1560 =  &_v148;
					L0040145C();
					_v316 = _t1560;
					_t1564 =  *((intOrPtr*)( *_v316 + 0x128))(_v316,  &_v252, _t1560,  *((intOrPtr*)(_t1701 + 0x304))( *_v736));
					asm("fclex");
					_v320 = _t1564;
					if(_v320 >= 0) {
						_v740 = _v740 & 0x00000000;
					} else {
						_push(0x128);
						_push(0x402ff8);
						_push(_v316);
						_push(_v320);
						L00401462();
						_v740 = _t1564;
					}
					_v268 = 0x7697d7;
					_v256 = _v252;
					 *_t1746 =  *E00401128;
					_t1571 =  *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v256,  &_v268, _t1701, 0x6fc4e4,  &_v184);
					_v324 = _t1571;
					if(_v324 >= 0) {
						_v744 = _v744 & 0x00000000;
					} else {
						_push(0x714);
						_push(0x402e70);
						_push(_a4);
						_push(_v324);
						L00401462();
						_v744 = _t1571;
					}
					_t1711 =  &_v184;
					L0040141A();
					L00401444();
					_push( &_v384);
					_push( &_v368);
					_t1574 =  &_v56;
					_push(_t1574);
					L0040140E();
					_v424 = _t1574;
				}
				_v208 = 0xae;
				_t1712 =  >=  ? 0x405a52 : _t1711;
				goto __edx;
			}

0x0040ecb6
0x0040ecc2
0x0040ecca
0x0040eccd
0x0040ecda
0x0040ece2
0x0040eced
0x0040ecf8
0x0040ecfe
0x0040ed0b
0x0040ed2d
0x0040ed0d
0x0040ed0d
0x0040ed12
0x0040ed17
0x0040ed1a
0x0040ed20
0x0040ed25
0x0040ed25
0x0040ed3b
0x0040ed58
0x0040ed3d
0x0040ed3d
0x0040ed42
0x0040ed47
0x0040ed4c
0x0040ed4c
0x0040ed7c
0x0040ed83
0x0040ed88
0x0040eda3
0x0040eda9
0x0040edab
0x0040edb8
0x0040eddd
0x0040edba
0x0040edba
0x0040edbf
0x0040edc4
0x0040edca
0x0040edd0
0x0040edd5
0x0040edd5
0x0040ede4
0x0040edee
0x0040edfe
0x0040ee04
0x0040ee0e
0x0040ee1e
0x0040ee24
0x0040ee2e
0x0040ee3d
0x0040ee43
0x0040ee5e
0x0040ee6b
0x0040ee6c
0x0040ee6d
0x0040ee6e
0x0040ee97
0x0040eea2
0x0040eea8
0x0040eeb5
0x0040eed7
0x0040eeb7
0x0040eeb7
0x0040eebc
0x0040eec1
0x0040eec4
0x0040eeca
0x0040eecf
0x0040eecf
0x0040eee4
0x0040eeef
0x0040eefb
0x0040ef18
0x0040eefd
0x0040eefd
0x0040ef02
0x0040ef07
0x0040ef0c
0x0040ef0c
0x0040ef3c
0x0040ef43
0x0040ef48
0x0040ef63
0x0040ef69
0x0040ef6b
0x0040ef78
0x0040ef9d
0x0040ef7a
0x0040ef7a
0x0040ef7f
0x0040ef84
0x0040ef8a
0x0040ef90
0x0040ef95
0x0040ef95
0x0040efab
0x0040efc8
0x0040efad
0x0040efad
0x0040efb2
0x0040efb7
0x0040efbc
0x0040efbc
0x0040efe2
0x0040efec
0x0040eff3
0x0040eff8
0x0040f013
0x0040f016
0x0040f018
0x0040f025
0x0040f047
0x0040f027
0x0040f027
0x0040f029
0x0040f02e
0x0040f034
0x0040f03a
0x0040f03f
0x0040f03f
0x0040f04e
0x0040f057
0x0040f061
0x0040f071
0x0040f07d
0x0040f098
0x0040f0aa
0x0040f0c3
0x0040f0c9
0x0040f0d6
0x0040f0f8
0x0040f0d8
0x0040f0d8
0x0040f0dd
0x0040f0e2
0x0040f0e5
0x0040f0eb
0x0040f0f0
0x0040f0f0
0x0040f106
0x0040f110
0x0040f117
0x0040f118
0x0040f11a
0x0040f11f
0x0040f129
0x0040f146
0x0040f12b
0x0040f12b
0x0040f130
0x0040f135
0x0040f13a
0x0040f13a
0x0040f16a
0x0040f171
0x0040f176
0x0040f191
0x0040f197
0x0040f199
0x0040f1a6
0x0040f1cb
0x0040f1a8
0x0040f1a8
0x0040f1ad
0x0040f1b2
0x0040f1b8
0x0040f1be
0x0040f1c3
0x0040f1c3
0x0040f1d9
0x0040f1f6
0x0040f1db
0x0040f1db
0x0040f1e0
0x0040f1e5
0x0040f1ea
0x0040f1ea
0x0040f21a
0x0040f221
0x0040f226
0x0040f241
0x0040f244
0x0040f246
0x0040f253
0x0040f275
0x0040f255
0x0040f255
0x0040f257
0x0040f25c
0x0040f262
0x0040f268
0x0040f26d
0x0040f26d
0x0040f283
0x0040f2a0
0x0040f285
0x0040f285
0x0040f28a
0x0040f28f
0x0040f294
0x0040f294
0x0040f2c4
0x0040f2cb
0x0040f2d0
0x0040f2eb
0x0040f2f1
0x0040f2f3
0x0040f300
0x0040f325
0x0040f302
0x0040f302
0x0040f307
0x0040f30c
0x0040f312
0x0040f318
0x0040f31d
0x0040f31d
0x0040f32c
0x0040f32e
0x0040f330
0x0040f33c
0x0040f33d
0x0040f342
0x0040f34c
0x0040f369
0x0040f34e
0x0040f34e
0x0040f353
0x0040f358
0x0040f35d
0x0040f35d
0x0040f38d
0x0040f394
0x0040f399
0x0040f3b4
0x0040f3ba
0x0040f3bc
0x0040f3c9
0x0040f3ee
0x0040f3cb
0x0040f3cb
0x0040f3d0
0x0040f3d5
0x0040f3db
0x0040f3e1
0x0040f3e6
0x0040f3e6
0x0040f406
0x0040f40e
0x0040f415
0x0040f41a
0x0040f426
0x0040f42c
0x0040f435
0x0040f43f
0x0040f44f
0x0040f455
0x0040f462
0x0040f468
0x0040f474
0x0040f47b
0x0040f48f
0x0040f49a
0x0040f4ae
0x0040f4bb
0x0040f4bc
0x0040f4bd
0x0040f4be
0x0040f4ce
0x0040f4da
0x0040f4e3
0x0040f4ec
0x0040f4f7
0x0040f4fe
0x0040f505
0x0040f50c
0x0040f513
0x0040f51a
0x0040f51b
0x0040f51d
0x0040f52b
0x0040f532
0x0040f533
0x0040f535
0x0040f53a
0x0040f544
0x0040f561
0x0040f546
0x0040f546
0x0040f54b
0x0040f550
0x0040f555
0x0040f555
0x0040f585
0x0040f58c
0x0040f591
0x0040f5ac
0x0040f5b2
0x0040f5b4
0x0040f5c1
0x0040f5e6
0x0040f5c3
0x0040f5c3
0x0040f5c8
0x0040f5cd
0x0040f5d3
0x0040f5d9
0x0040f5de
0x0040f5de
0x0040f5f4
0x0040f611
0x0040f5f6
0x0040f5f6
0x0040f5fb
0x0040f600
0x0040f605
0x0040f605
0x0040f635
0x0040f63c
0x0040f641
0x0040f65c
0x0040f662
0x0040f664
0x0040f671
0x0040f696
0x0040f673
0x0040f673
0x0040f678
0x0040f67d
0x0040f683
0x0040f689
0x0040f68e
0x0040f68e
0x0040f6a4
0x0040f6b1
0x0040f6b7
0x0040f6c1
0x0040f6d1
0x0040f6d7
0x0040f6e4
0x0040f6ea
0x0040f6f4
0x0040f6fe
0x0040f72c
0x0040f739
0x0040f73a
0x0040f73b
0x0040f73c
0x0040f74a
0x0040f756
0x0040f75d
0x0040f75e
0x0040f760
0x0040f76e
0x0040f775
0x0040f776
0x0040f778
0x0040f77d
0x0040f787
0x0040f7a4
0x0040f789
0x0040f789
0x0040f78e
0x0040f793
0x0040f798
0x0040f798
0x0040f7c8
0x0040f7cf
0x0040f7d4
0x0040f7ef
0x0040f7f5
0x0040f7f7
0x0040f804
0x0040f829
0x0040f806
0x0040f806
0x0040f80b
0x0040f810
0x0040f816
0x0040f81c
0x0040f821
0x0040f821
0x0040f837
0x0040f854
0x0040f839
0x0040f839
0x0040f83e
0x0040f843
0x0040f848
0x0040f848
0x0040f878
0x0040f87f
0x0040f884
0x0040f8a1
0x0040f8a7
0x0040f8a9
0x0040f8b6
0x0040f8db
0x0040f8b8
0x0040f8b8
0x0040f8bd
0x0040f8c2
0x0040f8c8
0x0040f8ce
0x0040f8d3
0x0040f8d3
0x0040f8e2
0x0040f8f1
0x0040f8f7
0x0040f90a
0x0040f937
0x0040f93d
0x0040f94a
0x0040f96c
0x0040f94c
0x0040f94c
0x0040f951
0x0040f956
0x0040f959
0x0040f95f
0x0040f964
0x0040f964
0x0040f979
0x0040f985
0x0040f98e
0x0040f999
0x0040f9a0
0x0040f9a1
0x0040f9a3
0x0040f9a8
0x0040f9b2
0x0040f9cf
0x0040f9b4
0x0040f9b4
0x0040f9b9
0x0040f9be
0x0040f9c3
0x0040f9c3
0x0040f9e9
0x0040f9f3
0x0040f9fa
0x0040f9ff
0x0040fa1a
0x0040fa20
0x0040fa22
0x0040fa2f
0x0040fa54
0x0040fa31
0x0040fa31
0x0040fa36
0x0040fa3b
0x0040fa41
0x0040fa47
0x0040fa4c
0x0040fa4c
0x0040fa61
0x0040fa67
0x0040fa74
0x0040fa7a
0x0040fa8a
0x0040faa6
0x0040fab1
0x0040fabd
0x0040fac8
0x0040fad4
0x0040faf1
0x0040fad6
0x0040fad6
0x0040fadb
0x0040fae0
0x0040fae5
0x0040fae5
0x0040fb15
0x0040fb1c
0x0040fb21
0x0040fb3c
0x0040fb42
0x0040fb44
0x0040fb51
0x0040fb76
0x0040fb53
0x0040fb53
0x0040fb58
0x0040fb5d
0x0040fb63
0x0040fb69
0x0040fb6e
0x0040fb6e
0x0040fb84
0x0040fba1
0x0040fb86
0x0040fb86
0x0040fb8b
0x0040fb90
0x0040fb95
0x0040fb95
0x0040fbbb
0x0040fbc5
0x0040fbcc
0x0040fbd1
0x0040fbec
0x0040fbf2
0x0040fbf4
0x0040fc01
0x0040fc26
0x0040fc03
0x0040fc03
0x0040fc08
0x0040fc0d
0x0040fc13
0x0040fc19
0x0040fc1e
0x0040fc1e
0x0040fc33
0x0040fc3f
0x0040fc45
0x0040fc52
0x0040fc58
0x0040fc68
0x0040fc6e
0x0040fc78
0x0040fca5
0x0040fcbc
0x0040fcc9
0x0040fcca
0x0040fccb
0x0040fccc
0x0040fcda
0x0040fce9
0x0040fcf4
0x0040fcff
0x0040fd06
0x0040fd07
0x0040fd09
0x0040fd0e
0x0040fd17
0x0040fd23
0x0040fd40
0x0040fd25
0x0040fd25
0x0040fd2a
0x0040fd2f
0x0040fd34
0x0040fd34
0x0040fd64
0x0040fd6b
0x0040fd70
0x0040fd8b
0x0040fd91
0x0040fd93
0x0040fda0
0x0040fdc5
0x0040fda2
0x0040fda2
0x0040fda7
0x0040fdac
0x0040fdb2
0x0040fdb8
0x0040fdbd
0x0040fdbd
0x0040fdd3
0x0040fdf0
0x0040fdd5
0x0040fdd5
0x0040fdda
0x0040fddf
0x0040fde4
0x0040fde4
0x0040fe14
0x0040fe1b
0x0040fe20
0x0040fe3b
0x0040fe41
0x0040fe43
0x0040fe50
0x0040fe75
0x0040fe52
0x0040fe52
0x0040fe57
0x0040fe5c
0x0040fe62
0x0040fe68
0x0040fe6d
0x0040fe6d
0x0040fe83
0x0040fe8a
0x0040fe94
0x0040fe9e
0x0040fea8
0x0040fed5
0x0040fee2
0x0040fee3
0x0040fee4
0x0040fee5
0x0040feee
0x0040fefa
0x0040ff03
0x0040ff0c
0x0040ff13
0x0040ff14
0x0040ff16
0x0040ff1b
0x0040ff25
0x0040ff42
0x0040ff27
0x0040ff27
0x0040ff2c
0x0040ff31
0x0040ff36
0x0040ff36
0x0040ff66
0x0040ff6d
0x0040ff72
0x0040ff8d
0x0040ff93
0x0040ff95
0x0040ffa2
0x0040ffc7
0x0040ffa4
0x0040ffa4
0x0040ffa9
0x0040ffae
0x0040ffb4
0x0040ffba
0x0040ffbf
0x0040ffbf
0x0040ffce
0x0040ffd8
0x0040ffe8
0x0040ffee
0x00410002
0x0041000f
0x00410010
0x00410011
0x00410012
0x0041001b
0x00410021
0x0041002e
0x00410050
0x00410030
0x00410030
0x00410035
0x0041003a
0x0041003d
0x00410043
0x00410048
0x00410048
0x0041005d
0x00410069
0x00410086
0x0041006b
0x0041006b
0x00410070
0x00410075
0x0041007a
0x0041007a
0x004100aa
0x004100b1
0x004100b6
0x004100d1
0x004100d4
0x004100d6
0x004100e3
0x00410105
0x004100e5
0x004100e5
0x004100e7
0x004100ec
0x004100f2
0x004100f8
0x004100fd
0x004100fd
0x00410113
0x00410130
0x00410115
0x00410115
0x0041011a
0x0041011f
0x00410124
0x00410124
0x00410154
0x0041015b
0x00410160
0x0041017b
0x00410181
0x00410183
0x00410190
0x004101b5
0x00410192
0x00410192
0x00410197
0x0041019c
0x004101a2
0x004101a8
0x004101ad
0x004101ad
0x004101c3
0x004101e0
0x004101c5
0x004101c5
0x004101ca
0x004101cf
0x004101d4
0x004101d4
0x00410204
0x0041020b
0x00410210
0x0041022b
0x00410231
0x00410233
0x00410240
0x00410265
0x00410242
0x00410242
0x00410247
0x0041024c
0x00410252
0x00410258
0x0041025d
0x0041025d
0x00410273
0x00410290
0x00410275
0x00410275
0x0041027a
0x0041027f
0x00410284
0x00410284
0x004102b4
0x004102bb
0x004102c0
0x004102db
0x004102e1
0x004102e3
0x004102f0
0x00410315
0x004102f2
0x004102f2
0x004102f7
0x004102fc
0x00410302
0x00410308
0x0041030d
0x0041030d
0x00410323
0x00410330
0x00410336
0x00410343
0x00410349
0x00410354
0x0041035a
0x00410364
0x00410388
0x0041039e
0x004103ab
0x004103b8
0x004103b9
0x004103ba
0x004103bb
0x004103c4
0x004103d0
0x004103d9
0x004103e4
0x004103eb
0x004103f2
0x004103f9
0x004103fa
0x004103fc
0x00410401
0x0041040b
0x00410428
0x0041040d
0x0041040d
0x00410412
0x00410417
0x0041041c
0x0041041c
0x0041044c
0x00410453
0x00410458
0x00410473
0x00410476
0x00410478
0x00410485
0x004104a7
0x00410487
0x00410487
0x00410489
0x0041048e
0x00410494
0x0041049a
0x0041049f
0x0041049f
0x004104b5
0x004104d2
0x004104b7
0x004104b7
0x004104bc
0x004104c1
0x004104c6
0x004104c6
0x004104f6
0x004104fd
0x00410502
0x0041051d
0x00410520
0x00410522
0x0041052f
0x00410551
0x00410531
0x00410531
0x00410533
0x00410538
0x0041053e
0x00410544
0x00410549
0x00410549
0x0041055f
0x0041057c
0x00410561
0x00410561
0x00410566
0x0041056b
0x00410570
0x00410570
0x00410596
0x004105a0
0x004105a7
0x004105ac
0x004105c7
0x004105cd
0x004105cf
0x004105dc
0x00410601
0x004105de
0x004105de
0x004105e3
0x004105e8
0x004105ee
0x004105f4
0x004105f9
0x004105f9
0x00410608
0x00410612
0x00410622
0x0041065a
0x00410665
0x0041066b
0x00410678
0x0041069a
0x0041067a
0x0041067a
0x0041067f
0x00410684
0x00410687
0x0041068d
0x00410692
0x00410692
0x004106a7
0x004106b0
0x004106b7
0x004106be
0x004106bf
0x004106c1
0x004106c6
0x004106d0
0x004106ed
0x004106d2
0x004106d2
0x004106d7
0x004106dc
0x004106e1
0x004106e1
0x00410711
0x00410718
0x0041071d
0x00410738
0x0041073e
0x00410740
0x0041074d
0x00410772
0x0041074f
0x0041074f
0x00410754
0x00410759
0x0041075f
0x00410765
0x0041076a
0x0041076a
0x00410780
0x0041079d
0x00410782
0x00410782
0x00410787
0x0041078c
0x00410791
0x00410791
0x004107c1
0x004107c8
0x004107cd
0x004107ea
0x004107f0
0x004107f2
0x004107ff
0x00410824
0x00410801
0x00410801
0x00410806
0x0041080b
0x00410811
0x00410817
0x0041081c
0x0041081c
0x00410832
0x0041084f
0x00410834
0x00410834
0x00410839
0x0041083e
0x00410843
0x00410843
0x00410873
0x0041087a
0x0041087f
0x0041089a
0x0041089d
0x0041089f
0x004108ac
0x004108ce
0x004108ae
0x004108ae
0x004108b0
0x004108b5
0x004108bb
0x004108c1
0x004108c6
0x004108c6
0x004108dc
0x004108f9
0x004108de
0x004108de
0x004108e3
0x004108e8
0x004108ed
0x004108ed
0x0041091d
0x00410924
0x00410929
0x00410944
0x0041094a
0x0041094c
0x00410959
0x0041097e
0x0041095b
0x0041095b
0x00410960
0x00410965
0x0041096b
0x00410971
0x00410976
0x00410976
0x0041098f
0x00410996
0x0041099b
0x0041099f
0x004109a4
0x004109aa
0x004109b4
0x004109be
0x004109ce
0x004109da
0x004109e0
0x004109e7
0x004109f3
0x004109f8
0x00410a02
0x00410a12
0x00410a18
0x00410a3c
0x00410a5e
0x00410a6b
0x00410a6c
0x00410a6d
0x00410a6e
0x00410a77
0x00410a83
0x00410a8e
0x00410a95
0x00410a9c
0x00410aa3
0x00410aaa
0x00410aab
0x00410aad
0x00410abb
0x00410ac2
0x00410ac3
0x00410ac5
0x00410aca
0x00410acd
0x00410ad7
0x00410ae1
0x00410aeb
0x00410af5
0x00410afc
0x00410b0c
0x00410b13
0x00410b1a
0x00410b21
0x00410b28
0x00410b29
0x00410b2c
0x00410b2d
0x00410b32
0x004112f0
0x00410b44
0x00410b61
0x00410b46
0x00410b46
0x00410b4b
0x00410b50
0x00410b55
0x00410b55
0x00410b85
0x00410b8c
0x00410b91
0x00410bac
0x00410baf
0x00410bb1
0x00410bbe
0x00410be0
0x00410bc0
0x00410bc0
0x00410bc2
0x00410bc7
0x00410bcd
0x00410bd3
0x00410bd8
0x00410bd8
0x00410bee
0x00410c0b
0x00410bf0
0x00410bf0
0x00410bf5
0x00410bfa
0x00410bff
0x00410bff
0x00410c2f
0x00410c36
0x00410c3b
0x00410c56
0x00410c5c
0x00410c5e
0x00410c6b
0x00410c90
0x00410c6d
0x00410c6d
0x00410c72
0x00410c77
0x00410c7d
0x00410c83
0x00410c88
0x00410c88
0x00410c9e
0x00410cab
0x00410cb7
0x00410ceb
0x00410cf1
0x00410cfe
0x00410d20
0x00410d00
0x00410d00
0x00410d05
0x00410d0a
0x00410d0d
0x00410d13
0x00410d18
0x00410d18
0x00410d2d
0x00410d36
0x00410d3d
0x00410d3e
0x00410d40
0x00410d45
0x00410d4f
0x00410d6c
0x00410d51
0x00410d51
0x00410d56
0x00410d5b
0x00410d60
0x00410d60
0x00410d90
0x00410d97
0x00410d9c
0x00410db7
0x00410dbd
0x00410dbf
0x00410dcc
0x00410df1
0x00410dce
0x00410dce
0x00410dd3
0x00410dd8
0x00410dde
0x00410de4
0x00410de9
0x00410de9
0x00410df8
0x00410dfa
0x00410dfc
0x00410e08
0x00410e09
0x00410e0e
0x00410e18
0x00410e35
0x00410e1a
0x00410e1a
0x00410e1f
0x00410e24
0x00410e29
0x00410e29
0x00410e59
0x00410e60
0x00410e65
0x00410e80
0x00410e83
0x00410e85
0x00410e92
0x00410eb4
0x00410e94
0x00410e94
0x00410e96
0x00410e9b
0x00410ea1
0x00410ea7
0x00410eac
0x00410eac
0x00410ec2
0x00410edf
0x00410ec4
0x00410ec4
0x00410ec9
0x00410ece
0x00410ed3
0x00410ed3
0x00410f03
0x00410f0a
0x00410f0f
0x00410f2a
0x00410f30
0x00410f32
0x00410f3f
0x00410f64
0x00410f41
0x00410f41
0x00410f46
0x00410f4b
0x00410f51
0x00410f57
0x00410f5c
0x00410f5c
0x00410f72
0x00410f8f
0x00410f74
0x00410f74
0x00410f79
0x00410f7e
0x00410f83
0x00410f83
0x00410fb3
0x00410fba
0x00410fbf
0x00410fda
0x00410fe0
0x00410fe2
0x00410fef
0x00411014
0x00410ff1
0x00410ff1
0x00410ff6
0x00410ffb
0x00411001
0x00411007
0x0041100c
0x0041100c
0x00411022
0x0041103f
0x00411024
0x00411024
0x00411029
0x0041102e
0x00411033
0x00411033
0x00411059
0x00411063
0x0041106a
0x0041106f
0x0041108a
0x0041108d
0x0041108f
0x0041109c
0x004110be
0x0041109e
0x0041109e
0x004110a0
0x004110a5
0x004110ab
0x004110b1
0x004110b6
0x004110b6
0x004110cc
0x004110d9
0x004110df
0x004110f6
0x00411114
0x0041111b
0x0041112e
0x0041113a
0x00411169
0x0041116e
0x00411177
0x00411184
0x00411191
0x004111ae
0x00411193
0x00411193
0x00411198
0x0041119d
0x004111a2
0x004111a2
0x004111c8
0x004111d2
0x004111d9
0x004111de
0x004111f9
0x004111ff
0x00411201
0x0041120e
0x00411233
0x00411210
0x00411210
0x00411215
0x0041121a
0x00411220
0x00411226
0x0041122b
0x0041122b
0x0041123a
0x0041124b
0x00411265
0x0041127e
0x00411284
0x00411291
0x004112b3
0x00411293
0x00411293
0x00411298
0x0041129d
0x004112a0
0x004112a6
0x004112ab
0x004112ab
0x004112ba
0x004112c3
0x004112ce
0x004112d9
0x004112e0
0x004112e1
0x004112e4
0x004112e5
0x004112ea
0x004112ea
0x004112fd
0x0041130f
0x00411312

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0040ECC2
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,000006F8), ref: 0040ED20
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040ED47
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040ED83
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402FF8,00000160), ref: 0040EDD0
__vbaStrCopy.MSVBVM60(00000000,00000000,00402FF8,00000160), ref: 0040EE43
__vbaChkstk.MSVBVM60(?,89A062F0,004CF1D8), ref: 0040EE5E
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,000006FC,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EECA
__vbaFreeStr.MSVBVM60(?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EEE4
__vbaFreeObj.MSVBVM60(?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EEEF
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF07
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF43
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402FF8,00000088,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EF90
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EFB7
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040EFF3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403024,00000078,?,?,?,00001BA0,295DF0F0,?,?,?,89A062F0,004CF1D8), ref: 0040F03A
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,00000700,?,?,EEA80150,?,0000417B,?,?,?,?,00001BA0,295DF0F0,?), ref: 0040F0EB
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,EEA80150,?,0000417B,?,?,?,?,00001BA0,295DF0F0,?,?), ref: 0040F11A
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,004012D6), ref: 0040F135
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F171
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000170), ref: 0040F1BE
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F1E5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F221
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000078), ref: 0040F268
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F28F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F2CB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000158), ref: 0040F318
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F33D
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,?,?,004012D6), ref: 0040F358
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F394
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000160), ref: 0040F3E1
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040F406
__vbaI4Var.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 0040F415
__vbaStrMove.MSVBVM60 ref: 0040F468
__vbaI4Var.MSVBVM60(?,?), ref: 0040F47B
__vbaChkstk.MSVBVM60(00006849,?,?,?,?,?,00000000,?,?), ref: 0040F4AE
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,?,?), ref: 0040F4EC
__vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0040F51D
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?), ref: 0040F535
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,?,?,?,?,?,?), ref: 0040F550
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F58C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000178), ref: 0040F5D9
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F600
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F63C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000000E0), ref: 0040F689
__vbaChkstk.MSVBVM60(00000009,00000003,?,000046A8,?), ref: 0040F72C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040F760
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040F778
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F793
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F7CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000000D0), ref: 0040F81C
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F843
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F87F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,000000F8), ref: 0040F8CE
__vbaStrMove.MSVBVM60(00000000,?,00402FF8,000000F8), ref: 0040F90A
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,00000704), ref: 0040F95F
__vbaFreeStr.MSVBVM60(00000000,004011B0,00402E70,00000704), ref: 0040F98E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040F9A3
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040F9BE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F9FA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000130), ref: 0040FA47
__vbaFreeObj.MSVBVM60(?,?,?,00000009), ref: 0040FABD
__vbaFreeVar.MSVBVM60(?,?,?,00000009), ref: 0040FAC8
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,00000009), ref: 0040FAE0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000009), ref: 0040FB1C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000130,?,?,?,00000009), ref: 0040FB69
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,00000009), ref: 0040FB90
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000009), ref: 0040FBCC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000170,?,?,?,00000009), ref: 0040FC19
__vbaChkstk.MSVBVM60(682F9540,00005AFB,?,?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FCBC
__vbaVarMove.MSVBVM60(?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FCE9
__vbaFreeStr.MSVBVM60(?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FCF4
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000009,?,?,?,?,?,?,00000009), ref: 0040FD09
__vbaFreeVar.MSVBVM60 ref: 0040FD17
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040FD2F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FD6B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000120), ref: 0040FDB8
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040FDDF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000128), ref: 0040FE68
__vbaChkstk.MSVBVM60(00577708,A17C2980,?,?,?), ref: 0040FED5
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040FF16
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0040FF31
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FF6D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000120), ref: 0040FFBA
__vbaChkstk.MSVBVM60(CFB51B00), ref: 00410002
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,00000708), ref: 00410043
__vbaFreeObj.MSVBVM60(00000000,004011B0,00402E70,00000708), ref: 0041005D
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00410075
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100B1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000070), ref: 004100F8
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0041011F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041015B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402FF8,00000218), ref: 004101A8
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 004101CF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041020B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000088), ref: 00410258
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0041027F
__vbaObjSet.MSVBVM60(?,00000000), ref: 004102BB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000128), ref: 00410308
__vbaStrMove.MSVBVM60(00000000,?,00402FF8,00000128), ref: 00410349
__vbaChkstk.MSVBVM60(CFB51B00,?,Abietic6,?,?,?,000249CD,?), ref: 004103AB
__vbaFreeStr.MSVBVM60(?,Abietic6,?,?,?,000249CD,?), ref: 004103D9
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,Abietic6,?,?,?,000249CD,?), ref: 004103FC
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00410417
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410453
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000078), ref: 0041049A
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 004104C1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004104FD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000050), ref: 00410544
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0041056B
__vbaObjSet.MSVBVM60(?,00000000), ref: 004105A7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000098), ref: 004105F4
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,0000070C,?,?,?,F1E53680,7A724D90,00005B07,?,?), ref: 0041068D
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?,?,F1E53680,7A724D90,00005B07,?,?), ref: 004106C1
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 004106DC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410718
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000198), ref: 00410765
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0041078C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004107C8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,000000F8), ref: 00410817
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 0041083E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041087A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000070), ref: 004108C1
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 004108E8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410924
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000158), ref: 00410971
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00410996
__vbaI4Var.MSVBVM60(00000000), ref: 0041099F
__vbaStrMove.MSVBVM60 ref: 004109F3
__vbaChkstk.MSVBVM60(A52D5FC0,?,?,0039DF66,?,00000003,0064C426,?), ref: 00410A5E
__vbaFreeStr.MSVBVM60(?,00000003,0064C426,?), ref: 00410A83
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,?,?,?,00000003,0064C426,?), ref: 00410AAD
__vbaFreeVarList.MSVBVM60(00000002,00000003,?), ref: 00410AC5
__vbaVarForInit.MSVBVM60(?,?,?,00000002,00000003,00000002), ref: 00410B2D
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00410B50
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410B8C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000060), ref: 00410BD3
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00410BFA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410C36
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000001D0), ref: 00410C83
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402E70,00000710), ref: 00410D13

Strings

Ih, xrefs: 0040F42C
Uncausative, xrefs: 0040EE38
Intetkoen6, xrefs: 0040EE04
lynfrysning, xrefs: 00410CDE
Abietic6, xrefs: 00410392
Performer, xrefs: 0040F435
PX_, xrefs: 0040ED34, 0040ED3D, 0040ED4C, 0040ED58, 0040EEF4, 0040EEFD, 0040EF0C, 0040EF18, 0040EFA4, 0040EFAD, 0040EFBC, 0040EFC8, 0040F122, 0040F12B, 0040F13A, 0040F146, 0040F1D2, 0040F1DB, 0040F1EA, 0040F1F6, 0040F27C, 0040F285, 0040F294, 0040F2A0, 0040F345, 0040F34E, 0040F35D, 0040F369, 0040F53D, 0040F546, 0040F555, 0040F561, 0040F5ED, 0040F5F6, 0040F605, 0040F611, 0040F780, 0040F789, 0040F798, 0040F7A4, 0040F830, 0040F839, 0040F848, 0040F854, 0040F9AB, 0040F9B4, 0040F9C3, 0040F9CF, 0040FACD, 0040FAD6, 0040FAE5, 0040FAF1, 0040FB7D, 0040FB86, 0040FB95, 0040FBA1, 0040FD1C, 0040FD25, 0040FD34, 0040FD40, 0040FDCC, 0040FDD5, 0040FDE4, 0040FDF0, 0040FF1E, 0040FF27, 0040FF36, 0040FF42, 00410062, 0041006B, 0041007A, 00410086, 0041010C, 00410115, 00410124, 00410130, 004101BC, 004101C5, 004101D4, 004101E0, 0041026C, 00410275, 00410284, 00410290, 00410404, 0041040D, 0041041C, 00410428, 004104AE, 004104B7, 004104C6, 004104D2, 00410558, 00410561, 00410570, 0041057C, 004106C9, 004106D2, 004106E1, 004106ED, 00410779, 00410782, 00410791, 0041079D, 0041082B, 00410834, 00410843, 0041084F, 004108D5, 004108DE, 004108ED, 004108F9, 00410B3D, 00410B46, 00410B55, 00410B61, 00410BE7, 00410BF0, 00410BFF, 00410C0B, 00410D48, 00410D51, 00410D60, 00410D6C, 00410E11, 00410E1A, 00410E29, 00410E35, 00410EBB, 00410EC4, 00410ED3, 00410EDF, 00410F6B, 00410F74, 00410F83, 00410F8F, 0041101B, 00411024, 00411033, 0041103F, 0041118A, 00411193, 004111A2, 004111AE
Baereevnen5, xrefs: 0040FCCD
Arbejdsfelterne, xrefs: 0040F6F4
Tt, xrefs: 004110DF

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$Move$CallLate$CopyInit
String ID: Abietic6$Arbejdsfelterne$Baereevnen5$Ih$Intetkoen6$PX_$Performer$Tt$Uncausative$lynfrysning
API String ID: 914953069-3347257978
Opcode ID: 3d87e37716be0ccd08cc6b3d09d27df03b3a22ab60549de231582b5a5bb6e38b
Instruction ID: 12d66bc62431228271290f15faa43146c23236cfd9b2be39e163f9c2392cfc32
Opcode Fuzzy Hash: 3d87e37716be0ccd08cc6b3d09d27df03b3a22ab60549de231582b5a5bb6e38b
Instruction Fuzzy Hash: 0B33D575940228EFDB21DF61CC49BD9B7B8BB08304F1044EAE149B72A1DBB95AC4DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00414372, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00414372(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v40;
				void* _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				char _v96;
				intOrPtr _v120;
				intOrPtr _v128;
				intOrPtr _v152;
				char _v160;
				void* _v164;
				signed int _v168;
				intOrPtr* _v172;
				signed int _v176;
				signed int _v184;
				char _v188;
				signed int _v192;
				signed int _v196;
				short _t67;
				char* _t71;
				signed int _t77;
				signed int _t83;
				intOrPtr _t98;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t98;
				L004012D0();
				_v12 = _t98;
				_v8 = 0x401200;
				L004013EA();
				_v72 = 0x80020004;
				_v80 = 0xa;
				_v56 = 0xc;
				_v64 = 2;
				_push(1);
				_push(1);
				_push( &_v80);
				_push( &_v64);
				_push( &_v96); // executed
				L004013C0(); // executed
				_v152 = 0xc;
				_v160 = 0x8002;
				_push( &_v96);
				_t67 =  &_v160;
				_push(_t67);
				L004013F6();
				_v164 = _t67;
				_push( &_v96);
				_push( &_v80);
				_push( &_v64);
				_push(3);
				L00401426();
				_t71 = _v164;
				if(_t71 != 0) {
					if( *0x41733c != 0) {
						_v188 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403108);
						L00401456();
						_v188 = 0x41733c;
					}
					_t23 =  &_v188; // 0x41733c
					_v164 =  *((intOrPtr*)( *_t23));
					_t77 =  *((intOrPtr*)( *_v164 + 0x4c))(_v164,  &_v44);
					asm("fclex");
					_v168 = _t77;
					if(_v168 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x4030f4);
						_push(_v164);
						_push(_v168);
						L00401462();
						_v192 = _t77;
					}
					_v172 = _v44;
					_v120 = 3;
					_v128 = 2;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t83 =  *((intOrPtr*)( *_v172 + 0x1c))(_v172, 0x10,  &_v48);
					asm("fclex");
					_v176 = _t83;
					if(_v176 >= 0) {
						_v196 = _v196 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x403118);
						_push(_v172);
						_push(_v176);
						L00401462();
						_v196 = _t83;
					}
					_v184 = _v48;
					_v48 = _v48 & 0x00000000;
					_push(_v184);
					_t71 =  &_v24;
					_push(_t71);
					L0040145C();
					L00401444();
				}
				_push(0x414594);
				L00401444();
				L00401420();
				return _t71;
			}

0x00414377
0x00414382
0x00414383
0x0041438f
0x00414397
0x0041439a
0x004143a7
0x004143ac
0x004143b3
0x004143ba
0x004143c1
0x004143c8
0x004143ca
0x004143cf
0x004143d3
0x004143d7
0x004143d8
0x004143dd
0x004143e7
0x004143f4
0x004143f5
0x004143fb
0x004143fc
0x00414401
0x0041440b
0x0041440f
0x00414413
0x00414414
0x00414416
0x0041441e
0x00414427
0x00414434
0x00414451
0x00414436
0x00414436
0x0041443b
0x00414440
0x00414445
0x00414445
0x0041445b
0x00414463
0x0041447b
0x0041447e
0x00414480
0x0041448d
0x004144af
0x0041448f
0x0041448f
0x00414491
0x00414496
0x0041449c
0x004144a2
0x004144a7
0x004144a7
0x004144b9
0x004144bf
0x004144c6
0x004144d4
0x004144de
0x004144df
0x004144e0
0x004144e1
0x004144f0
0x004144f3
0x004144f5
0x00414502
0x00414524
0x00414504
0x00414504
0x00414506
0x0041450b
0x00414511
0x00414517
0x0041451c
0x0041451c
0x0041452e
0x00414534
0x00414538
0x0041453e
0x00414541
0x00414542
0x0041454a
0x0041454a
0x0041454f
0x00414586
0x0041458e
0x00414593

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041438F
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 004143A7
#660.MSVBVM60(?,00000002,0000000A,00000001,00000001), ref: 004143D8
__vbaVarTstNe.MSVBVM60(00008002,?), ref: 004143FC
__vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?,00008002,?), ref: 00414416
__vbaNew2.MSVBVM60(00403108,0041733C), ref: 00414440
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,0000004C), ref: 004144A2
__vbaChkstk.MSVBVM60(?), ref: 004144D4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403118,0000001C), ref: 00414517
__vbaObjSet.MSVBVM60(?,?), ref: 00414542
__vbaFreeObj.MSVBVM60(?,?), ref: 0041454A
__vbaFreeObj.MSVBVM60(00414594), ref: 00414586
__vbaFreeVar.MSVBVM60(00414594), ref: 0041458E

Strings

<sA, xrefs: 0041445B

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#660ListNew2
String ID: <sA
API String ID: 2914822365-3623460565
Opcode ID: 4c3f6383945a45f54571fec354c17a8b64663e35416f4404728130d54a03e978
Instruction ID: 9f8c1d9047f06062277004449f56d17c010969c77d9daab127159b54100d8ae9
Opcode Fuzzy Hash: 4c3f6383945a45f54571fec354c17a8b64663e35416f4404728130d54a03e978
Instruction Fuzzy Hash: 3951F671D00218EFDB20DF91CC45BDEBBB9AF09704F1080AAE519B71A1D7B85A85CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401480, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 622
COMMON

Download Yara Rule

C-Code - Quality: 90%

			_entry_(signed int __eax, intOrPtr* __ebx, void* __edx, signed int __esi, void* __fp0) {
				intOrPtr* _t40;
				signed int _t41;
				signed int _t42;
				signed char _t43;
				intOrPtr* _t44;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t51;
				intOrPtr* _t56;
				intOrPtr* _t62;
				signed char _t63;
				signed char _t64;
				signed int _t66;
				signed int _t69;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				intOrPtr* _t73;
				void* _t74;
				intOrPtr* _t75;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed char _t78;
				signed char _t79;
				signed int _t82;
				signed int* _t84;
				void* _t86;
				intOrPtr* _t93;
				signed int _t101;
				void* _t104;
				intOrPtr* _t108;
				void* _t109;
				void* _t110;
				signed int _t111;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t125;

				_t111 = __esi;
				_t104 = __edx;
				_t83 = __ebx;
				_push("VB5!6&*"); // executed
				L0040147A(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t40 = __eax + 1;
				 *_t40 =  *_t40 + _t40;
				 *_t40 =  *_t40 + _t40;
				 *_t40 =  *_t40 + _t40;
				_t41 = _t40 + __edx;
				_t109 = 0x21;
				asm("aas");
				asm("insd");
				asm("aad 0x46");
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				 *_t41 =  *_t41 + _t41;
				_push(_t41);
				if( *_t41 >= 0) {
					asm("arpl [ecx+esi], si");
					 *_t41 =  *_t41 + _t41;
					 *_t41 =  *_t41 + _t41;
					 *_t41 =  *_t41 + _t41;
					 *_t41 =  *_t41 + _t41;
					 *_t41 =  *_t41 + _t41;
					 *_t41 =  *_t41 ^ _t41;
					asm("fldenv [ebp-0x4a24e1bf]");
					 *((intOrPtr*)(__esi + 0x54)) =  *((intOrPtr*)(__esi + 0x54)) + 1;
					 *0xb0 =  *0xb0 - 6;
					_t83 = 0x65;
					_pop(ss);
					_t82 = _t117 - 1;
					_t117 = _t41 + 0xe0;
					asm("lahf");
					asm("fbstp tword [ebp-0xd25b5a6]");
					asm("sbb eax, 0x33ad4f3a");
					asm("cdq");
					asm("iretw");
					asm("adc [edi+0xaa000c], esi");
					asm("pushad");
					asm("rcl dword [ebx], cl");
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					 *_t82 =  *_t82 + _t82;
					asm("salc");
					_t41 = _t82 |  *_t82;
					 *__esi =  *__esi + __edx;
				}
				_t42 = _t41 |  *_t41;
				 *_t42 =  *_t42 + _t42;
				_t43 = _t42 |  *_t42;
				_t110 = _t109 - 1;
				_t125 = _t110;
				if(_t125 <= 0) {
					L7:
					 *_t43 =  *_t43 + _t43;
					 *_t43 =  *_t43 + _t43;
					asm("lahf");
					asm("lahf");
					asm("lahf");
					 *0xFFFFFFFFA500A1E1 =  *((intOrPtr*)(0xffffffffa500a1e1)) + _t43;
					asm("movsd");
					asm("movsd");
				} else {
					if(_t125 >= 0) {
						asm("a16 jnz 0x70");
						asm("popad");
						if (_t125 < 0) goto L6;
						_t78 = _t43 | 0x67000501;
						asm("arpl [gs:ebx+0x6f], bp");
						 *0x40 =  *0x40 + _t83;
						 *_t78 =  *_t78 + _t78;
						_t108 = _t104 + 1;
						 *_t108 =  *_t108 + _t78;
						 *_t83 =  *_t83 + _t117;
						asm("out dx, al");
						_t79 = _t78 |  *_t78;
						 *((intOrPtr*)(_t117 + _t111 * 2)) =  *((intOrPtr*)(_t117 + _t111 * 2)) + 0x40;
						_t104 = _t108 + _t79;
						_t43 = _t79 |  *_t79;
						 *_t43 =  *_t43 + _t43;
						 *0x40 =  *0x40 + _t43;
						 *0x40 =  *0x40 + _t43;
						 *_t43 =  *_t43 + _t104;
						asm("adc [eax], al");
						 *0x40 =  *0x40 + _t43;
						 *_t43 =  *_t43 + 0x40;
						 *((intOrPtr*)(_t43 + 5)) =  *((intOrPtr*)(_t43 + 5)) + 0x40;
						 *_t43 =  *_t43 + _t43;
						_push(ss);
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + 0x40;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t104;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *0x40 =  *0x40 + _t43;
						 *_t43 =  *_t43 + 0x40;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						 *_t43 =  *_t43 + _t43;
						goto L7;
					}
				}
				 *((intOrPtr*)(_t104 - 0x4dff5556)) =  *((intOrPtr*)(_t104 - 0x4dff5556)) + 0x40;
				 *((intOrPtr*)(_t117 + _t111 * 4 - 0x4141ff4c)) =  *((intOrPtr*)(_t117 + _t111 * 4 - 0x4141ff4c)) + 0xb2;
				_pop(_t115);
				_t119 = _t115;
				asm("into");
				asm("into");
				asm("rcl ecx, 1");
				asm("aad 0xd5");
				_t93 = 0x1e4 + _t43;
				asm("loope 0xffffffe3");
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				_t84 = _t83 + _t83;
				asm("invalid");
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *_t43 =  *_t43 + _t43;
				 *0x00000132 =  *0x00000132 + _t43;
				_t44 = _t43 +  *0x00000132;
				 *_t44 =  *_t44 + _t44;
				 *_t44 =  *_t44 + _t44;
				 *_t44 =  *_t44 + _t44;
				 *_t44 =  *_t44 + _t44;
				 *_t44 =  *_t44 + _t44;
				 *_t44 =  *_t44 + _t44;
				_push(es);
				_push(es);
				_t46 = _t44 +  *0xc3c3c300 +  *((intOrPtr*)(_t44 +  *0xc3c3c300));
				 *_t46 =  *_t46 + _t46;
				 *_t46 =  *_t46 + _t46;
				 *_t46 =  *_t46 + _t46;
				 *_t46 =  *_t46 + _t46;
				 *_t46 =  *_t46 + _t46;
				_t47 = _t46 +  *_t93;
				 *_t93 =  *_t93 + _t47;
				_t48 = _t47 +  *_t47;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				 *_t48 =  *_t48 + _t48;
				_t51 = _t48 +  *0x00000132 +  *0x00000132 +  *((intOrPtr*)(_t48 +  *0x00000132 +  *0x00000132));
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *_t51 =  *_t51 + _t51;
				 *0x00000132 =  *0x00000132 + _t51;
				_t56 = _t51 +  *0x00000132 +  *0x00000132 +  *((intOrPtr*)(0x132 + _t51 +  *0x00000132 +  *0x00000132)) +  *0x00000132 +  *((intOrPtr*)(_t51 +  *0x00000132 +  *0x00000132 +  *((intOrPtr*)(0x132 + _t51 +  *0x00000132 +  *0x00000132)) +  *0x00000132));
				 *_t56 =  *_t56 + _t56;
				 *0x00000132 =  *0x00000132 + _t56;
				_t62 = _t56 + 0x16;
				 *_t62 =  *_t62 + _t62;
				 *0x00000132 =  *0x00000132 + _t62;
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_push(es);
				_t63 = _t62 +  *_t62;
				 *_t63 =  *_t63 + _t63;
				es = es;
				_t64 = _t63 |  *0x00000132;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + _t64;
				_t66 = _t64 +  *0x00000132 +  *0x00000132;
				_t69 = (_t66 |  *0x00000132) +  *0x00000132 +  *((intOrPtr*)((_t66 |  *0x00000132) +  *0x00000132));
				 *_t69 =  *_t69 + _t69;
				 *_t69 =  *_t69 + _t69;
				 *_t69 =  *_t69 + _t69;
				 *0x00000132 =  *0x00000132 + _t69;
				_t70 = _t69 |  *0x00000132;
				 *_t70 =  *_t70 + _t70;
				 *_t70 =  *_t70 + _t70;
				 *_t70 =  *_t70 + _t70;
				 *_t70 =  *_t70 + _t70;
				 *_t70 =  *_t70 + _t70;
				 *0x00000132 =  *0x00000132 + _t70;
				_t101 = _t93 +  *_t84 |  *_t84 |  *_t63 |  *0x00000132 |  *_t84 |  *_t66 |  *0x00000132 |  *0x00000132;
				_t71 = _t70 |  *0x00000132;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 + _t71;
				 *0x00000132 =  *0x00000132 + _t71;
				_t72 = _t71 | 0x00020d0d;
				 *_t72 =  *_t72 + _t72;
				 *_t72 =  *_t72 + _t72;
				 *_t72 =  *_t72 + _t72;
				 *_t72 =  *_t72 + _t72;
				 *_t72 =  *_t72 + _t72;
				 *0x00000132 =  *0x00000132 + _t72;
				_t73 = _t72 +  *0x00000132;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + _t73;
				 *_t73 =  *_t73 + 1;
				_t86 = _t84 + _t84 + _t84 + _t84;
				 *_t73 =  *_t73 + 1;
				_t74 = _t73 + _t86;
				if (_t74 > 0) goto L9;
				_t75 = _t74 + _t86;
				asm("aas");
				 *_t75 =  *_t75 + _t75;
				asm("clc");
				asm("aas");
				 *_t75 =  *_t75 + _t75;
				asm("clc");
				asm("aas");
				 *_t75 =  *_t75 + _t75;
				asm("rol byte [edi], 0x0");
				 *((intOrPtr*)(_t75 - 0x7ffffffd)) =  *((intOrPtr*)(_t75 - 0x7ffffffd)) + _t75;
				_t76 = _t75 +  *_t75;
				 *((intOrPtr*)(_t76 - 0x3ffffffd)) =  *((intOrPtr*)(_t76 - 0x3ffffffd)) + _t76;
				es = es;
				 *_t76 =  *_t76 + _t76;
				asm("clc");
				asm("aas");
				 *_t76 =  *_t76 + _t76;
				asm("clc");
				asm("aas");
				 *_t76 =  *_t76 + _t76;
				asm("clc");
				asm("aas");
				 *_t76 =  *_t76 + _t76;
				asm("cld");
				if ( *_t76 > 0) goto L10;
				 *_t76 =  *_t76 + 1;
				 *_t76 =  *_t76 + _t101;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + 0x132;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t101 =  *_t101 + _t76;
				 *_t76 =  *_t76 + _t101;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t76 =  *_t76 + _t76;
				 *((intOrPtr*)(_t110 - 0x5eff6061)) =  *((intOrPtr*)(_t110 - 0x5eff6061)) + _t86 + _t86;
				_t77 =  *0xa5a500a1;
				asm("movsd");
				 *0xFFFFFFFFB200ABDC =  *((intOrPtr*)(0xffffffffb200abdc)) + _t101;
				 *((intOrPtr*)(_t119 + 0xfffffffecdcd0cb4)) =  *((intOrPtr*)(_t119 + 0xfffffffecdcd0cb4)) + 0xb2;
				return _t77;
			}

0x00401480
0x00401480
0x00401480
0x00401480
0x00401485
0x0040148a
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401495
0x00401497
0x00401499
0x0040149b
0x004014a5
0x004014a6
0x004014a9
0x004014aa
0x004014ac
0x004014ae
0x004014b0
0x004014b2
0x004014b4
0x004014b6
0x004014b8
0x004014ba
0x004014bc
0x004014bd
0x004014c1
0x004014c5
0x004014c7
0x004014c9
0x004014cb
0x004014cd
0x004014d2
0x004014d6
0x004014df
0x004014e2
0x004014e8
0x004014e9
0x004014ea
0x004014ea
0x004014ed
0x004014ee
0x004014f4
0x004014f9
0x004014fa
0x004014fc
0x00401502
0x00401503
0x00401509
0x0040150b
0x0040150d
0x0040150f
0x00401511
0x00401513
0x00401515
0x00401517
0x00401519
0x0040151b
0x0040151d
0x0040151f
0x00401521
0x00401523
0x00401525
0x00401527
0x00401529
0x0040152a
0x0040152c
0x0040152c
0x0040152e
0x00401530
0x00401532
0x00401534
0x00401534
0x00401535
0x0040159c
0x0040159c
0x0040159e
0x004015a0
0x004015a1
0x004015a2
0x004015a3
0x004015a9
0x004015aa
0x00401537
0x00401537
0x00401539
0x0040153d
0x0040153e
0x00401540
0x00401545
0x00401549
0x0040154b
0x0040154d
0x0040154e
0x00401550
0x00401552
0x00401553
0x00401555
0x00401559
0x0040155b
0x0040155d
0x0040155f
0x00401561
0x00401563
0x00401565
0x00401567
0x00401569
0x0040156b
0x0040156e
0x00401570
0x00401571
0x00401573
0x00401575
0x00401577
0x00401579
0x0040157b
0x0040157d
0x0040157f
0x00401581
0x00401583
0x00401585
0x00401587
0x00401589
0x0040158b
0x0040158d
0x0040158f
0x00401591
0x00401593
0x00401595
0x00401597
0x00401599
0x0040159b
0x00000000
0x0040159b
0x00401537
0x004015ab
0x004015b3
0x004015c1
0x004015c2
0x004015c5
0x004015c6
0x004015c9
0x004015cd
0x004015cf
0x004015d1
0x004015d3
0x004015d5
0x004015d7
0x004015d9
0x004015db
0x004015dd
0x004015df
0x004015e1
0x004015e3
0x004015e5
0x004015e7
0x004015e9
0x004015eb
0x004015ed
0x004015ef
0x004015f1
0x004015f3
0x004015f5
0x004015f7
0x004015f9
0x004015fb
0x004015fd
0x004015ff
0x00401601
0x00401603
0x00401605
0x00401607
0x00401609
0x0040160b
0x0040160d
0x0040160f
0x00401611
0x00401613
0x00401615
0x00401617
0x00401619
0x0040161b
0x0040161d
0x0040161f
0x00401621
0x00401623
0x00401625
0x00401627
0x00401629
0x0040162b
0x0040162d
0x0040162f
0x00401631
0x00401633
0x00401635
0x00401637
0x00401639
0x0040163b
0x0040163d
0x0040163f
0x00401641
0x00401643
0x00401645
0x00401647
0x00401649
0x0040164b
0x0040164d
0x0040164f
0x00401651
0x00401653
0x00401655
0x00401657
0x00401659
0x0040165b
0x0040165d
0x0040165f
0x00401661
0x00401663
0x00401665
0x00401667
0x00401669
0x0040166b
0x0040166d
0x0040166f
0x00401671
0x00401673
0x00401675
0x00401677
0x00401679
0x0040167b
0x0040167d
0x0040167f
0x00401681
0x00401683
0x00401685
0x00401687
0x00401689
0x0040168b
0x0040168d
0x0040168f
0x00401691
0x00401693
0x00401695
0x00401697
0x00401699
0x0040169b
0x0040169d
0x0040169f
0x004016a1
0x004016a3
0x004016a5
0x004016a7
0x004016a9
0x004016ab
0x004016ad
0x004016af
0x004016b1
0x004016b3
0x004016b5
0x004016b7
0x004016b9
0x004016bb
0x004016bd
0x004016bf
0x004016c1
0x004016c3
0x004016c5
0x004016c7
0x004016c9
0x004016cb
0x004016cd
0x004016cf
0x004016d1
0x004016d3
0x004016d5
0x004016d7
0x004016d9
0x004016db
0x004016dd
0x004016df
0x004016e1
0x004016e3
0x004016e5
0x004016e7
0x004016e9
0x004016eb
0x004016ed
0x004016ef
0x004016f1
0x004016f3
0x004016f5
0x004016f7
0x004016f9
0x004016fb
0x004016fd
0x004016ff
0x00401701
0x00401703
0x00401705
0x00401707
0x00401709
0x0040170b
0x0040170d
0x0040170f
0x00401711
0x00401713
0x00401715
0x00401717
0x00401719
0x0040171b
0x0040171d
0x0040171f
0x00401721
0x00401723
0x00401725
0x00401727
0x00401729
0x0040172b
0x0040172d
0x0040172f
0x00401731
0x00401733
0x00401735
0x00401737
0x00401739
0x0040173b
0x0040173d
0x0040173f
0x00401741
0x00401743
0x00401745
0x00401747
0x00401749
0x0040174b
0x0040174d
0x0040174f
0x00401751
0x00401753
0x00401755
0x00401757
0x00401759
0x0040175b
0x0040175d
0x0040175f
0x00401761
0x00401763
0x00401765
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176f
0x00401771
0x00401773
0x00401775
0x00401777
0x00401779
0x0040177b
0x0040177d
0x0040177f
0x00401781
0x00401783
0x00401785
0x00401787
0x00401789
0x0040178b
0x0040178d
0x0040178f
0x00401791
0x00401793
0x00401795
0x00401797
0x00401799
0x0040179b
0x0040179d
0x0040179f
0x004017a1
0x004017a3
0x004017a5
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b1
0x004017b3
0x004017b5
0x004017b7
0x004017b9
0x004017bb
0x004017bd
0x004017bf
0x004017c1
0x004017c3
0x004017c5
0x004017c7
0x004017c9
0x004017cb
0x004017cd
0x004017cf
0x004017d1
0x004017d3
0x004017d5
0x004017d7
0x004017d9
0x004017db
0x004017dd
0x004017df
0x004017e1
0x004017e3
0x004017e5
0x004017e7
0x004017e9
0x004017eb
0x004017ed
0x004017ef
0x004017f1
0x004017f3
0x004017f5
0x004017f7
0x004017f9
0x004017fb
0x004017fd
0x004017ff
0x00401801
0x00401803
0x00401805
0x00401807
0x00401809
0x0040180b
0x0040180d
0x0040180f
0x00401811
0x00401813
0x00401815
0x00401817
0x00401819
0x0040181b
0x0040181d
0x0040181f
0x00401821
0x00401823
0x00401825
0x00401827
0x00401829
0x0040182b
0x0040182d
0x0040182f
0x00401831
0x00401833
0x00401835
0x00401837
0x00401839
0x0040183b
0x0040183d
0x0040183f
0x00401841
0x00401843
0x00401845
0x00401847
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x00401859
0x0040185b
0x0040185d
0x0040185f
0x00401861
0x00401863
0x00401865
0x00401867
0x00401869
0x0040186b
0x0040186d
0x0040186f
0x00401871
0x00401873
0x00401875
0x00401877
0x00401879
0x0040187b
0x0040187d
0x0040187f
0x00401881
0x00401883
0x00401885
0x00401887
0x00401889
0x0040188b
0x0040188d
0x0040188f
0x00401891
0x00401893
0x00401895
0x00401897
0x00401899
0x0040189b
0x0040189d
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b7
0x004018b9
0x004018bb
0x004018bd
0x004018bf
0x004018c1
0x004018c3
0x004018c5
0x004018c7
0x004018c9
0x004018cb
0x004018cd
0x004018cf
0x004018d1
0x004018d3
0x004018d5
0x004018d7
0x004018d9
0x004018db
0x004018dd
0x004018df
0x004018e1
0x004018e3
0x004018e5
0x004018e7
0x004018e9
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018ff
0x00401901
0x00401903
0x00401905
0x00401907
0x00401909
0x0040190b
0x0040190d
0x0040190f
0x00401911
0x00401913
0x00401915
0x00401917
0x00401919
0x0040191b
0x0040191d
0x0040191f
0x00401921
0x00401923
0x00401925
0x00401927
0x00401929
0x0040192b
0x0040192d
0x0040192f
0x00401931
0x00401933
0x00401935
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401943
0x00401945
0x00401947
0x00401949
0x0040194b
0x0040194d
0x0040194f
0x00401951
0x00401953
0x00401955
0x00401957
0x00401959
0x0040195b
0x0040195d
0x0040195f
0x00401961
0x00401963
0x00401965
0x00401967
0x00401969
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401977
0x00401979
0x0040197b
0x0040197d
0x0040197f
0x00401981
0x00401983
0x00401985
0x00401987
0x00401989
0x0040198b
0x0040198d
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401997
0x00401999
0x0040199b
0x0040199d
0x0040199f
0x004019a1
0x004019a3
0x004019a5
0x004019a7
0x004019a9
0x004019ab
0x004019ad
0x004019af
0x004019b1
0x004019b3
0x004019b5
0x004019b7
0x004019b9
0x004019bb
0x004019bd
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c7
0x004019c9
0x004019cb
0x004019cd
0x004019cf
0x004019d3
0x004019d4
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019e1
0x004019e3
0x004019e5
0x004019e7
0x004019e9
0x004019eb
0x004019ed
0x004019ef
0x004019f5
0x004019f7
0x004019f9
0x004019fb
0x004019fd
0x00401a08
0x00401a0a
0x00401a0c
0x00401a18
0x00401a1a
0x00401a1c
0x00401a1e
0x00401a1f
0x00401a20
0x00401a21
0x00401a22
0x00401a23
0x00401a24
0x00401a25
0x00401a26
0x00401a29
0x00401a2b
0x00401a33
0x00401a38
0x00401a3a
0x00401a3c
0x00401a40
0x00401a48
0x00401a4a
0x00401a4c
0x00401a4e
0x00401a50
0x00401a54
0x00401a56
0x00401a58
0x00401a5a
0x00401a5c
0x00401a5e
0x00401a60
0x00401a62
0x00401a64
0x00401a66
0x00401a68
0x00401a6a
0x00401a6c
0x00401a6e
0x00401a70
0x00401a72
0x00401a77
0x00401a79
0x00401a7b
0x00401a7d
0x00401a7f
0x00401a81
0x00401a83
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a8d
0x00401a8f
0x00401a91
0x00401a93
0x00401a95
0x00401a97
0x00401a99
0x00401a9d
0x00401a9f
0x00401aa1
0x00401aa3
0x00401aa5
0x00401aa7
0x00401aa9
0x00401aaa
0x00401aac
0x00401aad
0x00401aae
0x00401ab0
0x00401ab1
0x00401ab2
0x00401ab4
0x00401ab7
0x00401abd
0x00401abf
0x00401ac5
0x00401ac6
0x00401ac8
0x00401ac9
0x00401aca
0x00401acc
0x00401acd
0x00401ace
0x00401ad0
0x00401ad1
0x00401ad2
0x00401ad4
0x00401ad5
0x00401ad9
0x00401adb
0x00401add
0x00401adf
0x00401ae1
0x00401ae3
0x00401ae5
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af1
0x00401af3
0x00401af5
0x00401af7
0x00401af9
0x00401afb
0x00401afd
0x00401aff
0x00401b01
0x00401b03
0x00401b05
0x00401b07
0x00401b0d
0x00401b12
0x00401b13
0x00401b1b
0x00401b26

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401485

Strings

VB5!6&*, xrefs: 00401480

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 2201889460ffb192c2cff67246ede8715d20ce6bcb4e3a3a06c453c86e5c8e9f
Instruction ID: 9bc16e6fbd0e66e67ba1855c05e92e4c295855895e546a430bb2c3b4c00ca848
Opcode Fuzzy Hash: 2201889460ffb192c2cff67246ede8715d20ce6bcb4e3a3a06c453c86e5c8e9f
Instruction Fuzzy Hash: 6241DB2248E3C04FD30397704C665867FB09E57224B1A44DBC4C1DF5E3D1AD8C4AC766

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF9, Relevance: 1.5, APIs: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b255019416eb0e57bd454aa1686cedb380e0e5d82fb4f8371ece3d3723159086
Instruction ID: c14a6722ac8ebb56aa034da122d29bc3f90a46dd4d763add3f12d107beacad92
Opcode Fuzzy Hash: b255019416eb0e57bd454aa1686cedb380e0e5d82fb4f8371ece3d3723159086
Instruction Fuzzy Hash: 9E31182011EE4CEAE635475458882B72F54EACEB04310A47BB842B6FC1B4FD8D4E5ECD

Uniqueness

Uniqueness Score: -1.00%

Function 00405C25, Relevance: 1.4, APIs: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4109eb5f7f529e7bc248d928c93dbecfbca3fd943769b5553235a52480e54986
Instruction ID: d9f336726f80c28dadb7f2824203169f60a2c8285debc8bb6c21ba9dc12e2f7d
Opcode Fuzzy Hash: 4109eb5f7f529e7bc248d928c93dbecfbca3fd943769b5553235a52480e54986
Instruction Fuzzy Hash: FC1129A1127B16BAD72458B48C8866B5288DF07F04734FE7BD85AE23C0CE6D8AC3541A

Uniqueness

Uniqueness Score: -1.00%

Function 00405C18, Relevance: 1.4, APIs: 1, Instructions: 176memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 360c308793fe02ab192a31ddd7f34ea407901b69be5e4b3149277bb75302a8d3
Instruction ID: fb17fa3ef9aeaa346e289a0373486b94dd9f94b21cf4840c96f17885d217f918
Opcode Fuzzy Hash: 360c308793fe02ab192a31ddd7f34ea407901b69be5e4b3149277bb75302a8d3
Instruction Fuzzy Hash: E1113A6152BB55BAD72408B48C8816B1288DF07F04724FE7BD85AE23C1CE6D8AC3541A

Uniqueness

Uniqueness Score: -1.00%

Function 00405C5C, Relevance: 1.4, APIs: 1, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 155c275aeb374e8ead4131e3bc2ee3939f14d75d91f913004d5bc4d534a5d8e7
Instruction ID: baeae6a4dfa3b61ed565dac15d8035c9a7d22921a17ba46a5424f424eb82a443
Opcode Fuzzy Hash: 155c275aeb374e8ead4131e3bc2ee3939f14d75d91f913004d5bc4d534a5d8e7
Instruction Fuzzy Hash: 3401F961217A15BAD72454B08C8867B5249DF07F04734FE7FD85AE23C0DEAD47C3441A

Uniqueness

Uniqueness Score: -1.00%

Function 00405CB1, Relevance: 1.4, APIs: 1, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a25a51977cec36a1f7dae69920780585909b0c4838f4c108e55d1a1a8acb186
Instruction ID: 3ecd582db9c2e5d7446381c9a16298cca53282f62aef46f6fc7d2a77cbed810c
Opcode Fuzzy Hash: 2a25a51977cec36a1f7dae69920780585909b0c4838f4c108e55d1a1a8acb186
Instruction Fuzzy Hash: 9C01FC61217A55BBD71455B0CC8866B6255DF07F04720F97FD859A2380DD6D4783441B

Uniqueness

Uniqueness Score: -1.00%

Function 00405D48, Relevance: 1.4, APIs: 1, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000D000,FFFF9F4A), ref: 00405D75

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dcfd125e65ab4e8e806bcf4225c1b18a7a21da04827e433ad6df3f1494e1189c
Instruction ID: 35024e633f3eaf796a6f0694872da0f8e4d93cbdc4f8a4ac777cffc2156f4db9
Opcode Fuzzy Hash: dcfd125e65ab4e8e806bcf4225c1b18a7a21da04827e433ad6df3f1494e1189c
Instruction Fuzzy Hash: 2DF02721227A217BCA1555F19CC807B5295DF06E40330BE7FCC5AA5280DCAA8BC3045E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022C219E, Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

x, xrefs: 022C25A5
(@, xrefs: 022C24E7

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID: (@$x
API String ID: 0-2607730085
Opcode ID: 64ceadf2e26392156d2ab98acc3e05af4f3dfb1e1e2ff366f1e8afa3dc24aa2d
Instruction ID: a171e21289a458c191daee6ce2ea3af898d92c308eb50d5f8989a746ab6ce812
Opcode Fuzzy Hash: 64ceadf2e26392156d2ab98acc3e05af4f3dfb1e1e2ff366f1e8afa3dc24aa2d
Instruction Fuzzy Hash: 44916B30750702DFDB28DEA8CD90BD573A6BF06350F65432DEC9597288DB75A886CB90

Uniqueness

Uniqueness Score: -1.00%

Function 022C6CB5, Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ff182914f1842e77e19a7658b7639bf2489cfc948ed5dce0666b7d2d9bce90
Instruction ID: a7f00586062faf5a58fbf7531c55979f0cd77f62701f4cb429fc0d574238e68c
Opcode Fuzzy Hash: 97ff182914f1842e77e19a7658b7639bf2489cfc948ed5dce0666b7d2d9bce90
Instruction Fuzzy Hash: 14A118656243438EDB20CF7884D4BA5FB96AF53260F68C39DD9924B2DED770C046CB12

Uniqueness

Uniqueness Score: -1.00%

Function 022C274B, Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582817918a82c774a2773a01bc694d8018fae7ffb0d39293e25d2c8203a44fa8
Instruction ID: 307d58f17b2bacd635e4093d256ab4caf41c3cc25399cc4782790b80e033ff6b
Opcode Fuzzy Hash: 582817918a82c774a2773a01bc694d8018fae7ffb0d39293e25d2c8203a44fa8
Instruction Fuzzy Hash: FA4125702B03654EEB229E704DA4BD63A99AF05794F2052BCEED08F1D7C761D15DC690

Uniqueness

Uniqueness Score: -1.00%

Function 022C2737, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d989c32eba0eb40318411f4787b23a33da47535532603f19ffc05f5f8625606e
Instruction ID: e9c9d13309b5f57a489324607274a23dcebb3d7765499ab3fa891f68c262b22d
Opcode Fuzzy Hash: d989c32eba0eb40318411f4787b23a33da47535532603f19ffc05f5f8625606e
Instruction Fuzzy Hash: AE412670650301DFF7259EA4CC88BD973A6BF05360F6083ACED499B1D9DBB4C988CA51

Uniqueness

Uniqueness Score: -1.00%

Function 022C6621, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95b273e511d1892ffe833452be533dde89ea628d6fc773113d98e29b64f44ce3
Instruction ID: aca471944e5a616881875df329693821c9e0bd87a69287bda70be8b7e9c4d951
Opcode Fuzzy Hash: 95b273e511d1892ffe833452be533dde89ea628d6fc773113d98e29b64f44ce3
Instruction Fuzzy Hash: 0AE04F5C368B07AAAE1538D906F93F3119E8E633E0DE5463D4C8623444A7C68CCE4111

Uniqueness

Uniqueness Score: -1.00%

Function 022C6280, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9aa3adf956727ccb83b7fa2c46fc4fd2322aaaca9043c48716bab4554cad4ab
Instruction ID: ce4c10af79fc181fbf5bb6080ff89cc2228de638e4c8da3466a43ee54e68d06c
Opcode Fuzzy Hash: a9aa3adf956727ccb83b7fa2c46fc4fd2322aaaca9043c48716bab4554cad4ab
Instruction Fuzzy Hash: EFF01C353202018FDB15DB54CAD4F2A73A9AFD5A00FA28569D802CB219C334DC40CA26

Uniqueness

Uniqueness Score: -1.00%

Function 022C3642, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ab8deb80675e4e9f966a302270d75341e467c60b142663cb716fd13e4ae6cc
Instruction ID: d7b831d9af3a336b58edd1c3ec14d0717d661922d4ad84a65f6a6e4e5fed7dea
Opcode Fuzzy Hash: 44ab8deb80675e4e9f966a302270d75341e467c60b142663cb716fd13e4ae6cc
Instruction Fuzzy Hash: 4AC04C763515818FF705DE54C591B5173A0BB11944B5544D8D442CB611D358E945C600

Uniqueness

Uniqueness Score: -1.00%

Function 022C5D7D, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029880ee627acc9fa4e5f02d0e62163f625f47993f22e31565df7e63c646874d
Instruction ID: 6fe405c20844755ef65a297b374830ae08c20213716e78b0f4d9d77fd9254f0c
Opcode Fuzzy Hash: 029880ee627acc9fa4e5f02d0e62163f625f47993f22e31565df7e63c646874d
Instruction Fuzzy Hash: B6B09230221A44CFCB85CA08C2A0F8173B0BB40740F9108C0F9418BA52E3A8E800CA00

Uniqueness

Uniqueness Score: -1.00%

Function 022C76C7, Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1405523890.00000000022C0000.00000040.00000001.sdmp, Offset: 022C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab363e1f687982a25a74573190309fb21954a0c28801f506ecd2396f1be7947
Instruction ID: 97823a536341d26ee25dd179a310e71df1b5ff3ec8ba333344005d4fb636d18a
Opcode Fuzzy Hash: 1ab363e1f687982a25a74573190309fb21954a0c28801f506ecd2396f1be7947
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00414DB3, Relevance: 86.1, APIs: 42, Strings: 7, Instructions: 343
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00414DB3(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v40;
				char _v44;
				char _v48;
				signed int _v52;
				char _v68;
				signed int _v92;
				char _v100;
				char* _v124;
				intOrPtr _v132;
				char _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v176;
				signed int _v180;
				intOrPtr* _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				intOrPtr* _v200;
				signed int _v204;
				char _v208;
				signed int _v212;
				signed int _t148;
				char* _t151;
				signed int _t156;
				signed int _t160;
				signed int _t168;
				signed int _t172;
				char* _t176;
				signed int _t177;
				char* _t178;
				signed int _t182;
				signed int _t186;
				signed int _t193;
				void* _t235;
				intOrPtr _t237;

				 *[fs:0x0] = _t237;
				L004012D0();
				_v12 = _t237;
				_v8 = 0x401280;
				L004013EA();
				_v92 = L"VB.Line";
				_v100 = 8;
				_v124 = L"Dataskrmernes4";
				_v132 = 8;
				_t148 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v48, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, __ecx, __ecx, _t235);
				asm("fclex");
				_v156 = _t148;
				if(_v156 >= 0) {
					_v180 = _v180 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x402e40);
					_push(_a4);
					_push(_v156);
					L00401462();
					_v180 = _t148;
				}
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(2);
				_push(L"Add");
				_push(_v48);
				_t151 =  &_v68;
				_push(_t151);
				L00401384();
				_push(_t151);
				L0040138A();
				_push(_t151);
				_push( &_v44);
				L00401390();
				L00401444();
				L00401420();
				if( *0x417010 != 0) {
					_v184 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v184 = 0x417010;
				}
				_t156 =  &_v48;
				L0040145C();
				_v156 = _t156;
				_t160 =  *((intOrPtr*)( *_v156 + 0x98))(_v156,  &_v152, _t156,  *((intOrPtr*)( *((intOrPtr*)( *_v184)) + 0x2fc))( *_v184));
				asm("fclex");
				_v160 = _t160;
				if(_v160 >= 0) {
					_v188 = _v188 & 0x00000000;
				} else {
					_push(0x98);
					_push(0x403024);
					_push(_v156);
					_push(_v160);
					L00401462();
					_v188 = _t160;
				}
				_v92 = _v152;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"X1");
				_push(_v44);
				L0040137E();
				L00401444();
				_v92 = 0x64d1;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"X2");
				_push(_v44);
				L0040137E();
				_v92 = 0x3aae;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Y1");
				_push(_v44);
				L0040137E();
				if( *0x417010 != 0) {
					_v192 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v192 = 0x417010;
				}
				_t168 =  &_v48;
				L0040145C();
				_v156 = _t168;
				_t172 =  *((intOrPtr*)( *_v156 + 0xd0))(_v156,  &_v152, _t168,  *((intOrPtr*)( *((intOrPtr*)( *_v192)) + 0x300))( *_v192));
				asm("fclex");
				_v160 = _t172;
				if(_v160 >= 0) {
					_v196 = _v196 & 0x00000000;
				} else {
					_push(0xd0);
					_push(0x403070);
					_push(_v156);
					_push(_v160);
					L00401462();
					_v196 = _t172;
				}
				_v92 = _v152;
				_v100 = 2;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Y2");
				_push(_v44);
				L0040137E();
				L00401444();
				_v92 = _v92 | 0xffffffff;
				_v100 = 0xb;
				_push(0x10);
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Visible");
				_push(_v44);
				L0040137E();
				_v92 = 1;
				_v100 = 0x8002;
				_push(0);
				_push(L"BorderStyle");
				_push(_v44);
				_t176 =  &_v68;
				_push(_t176);
				L00401384();
				_push(_t176);
				_t177 =  &_v100;
				_push(_t177);
				L004013F6();
				_v156 = _t177;
				L00401420();
				_t178 = _v156;
				if(_t178 != 0) {
					if( *0x417010 != 0) {
						_v200 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v200 = 0x417010;
					}
					_t182 =  &_v48;
					L0040145C();
					_v156 = _t182;
					_t186 =  *((intOrPtr*)( *_v156 + 0x1d0))(_v156,  &_v152, _t182,  *((intOrPtr*)( *((intOrPtr*)( *_v200)) + 0x300))( *_v200));
					asm("fclex");
					_v160 = _t186;
					if(_v160 >= 0) {
						_v204 = _v204 & 0x00000000;
					} else {
						_push(0x1d0);
						_push(0x403070);
						_push(_v156);
						_push(_v160);
						L00401462();
						_v204 = _t186;
					}
					if( *0x41733c != 0) {
						_v208 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403108);
						L00401456();
						_v208 = 0x41733c;
					}
					_t116 =  &_v208; // 0x41733c
					_v164 =  *((intOrPtr*)( *_t116));
					_v92 = 0xa8;
					_v100 = 2;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t193 =  *((intOrPtr*)( *_v164 + 0x34))(_v164, 0x10, _v152,  &_v52);
					asm("fclex");
					_v168 = _t193;
					if(_v168 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x34);
						_push(0x4030f4);
						_push(_v164);
						_push(_v168);
						L00401462();
						_v212 = _t193;
					}
					_v176 = _v52;
					_v52 = _v52 & 0x00000000;
					_push(_v176);
					_t178 =  &_v24;
					_push(_t178);
					L0040145C();
					L00401444();
				}
				_push(0x415306);
				L00401444();
				L00401420();
				L00401444();
				return _t178;
			}

0x00414dc4
0x00414dd0
0x00414dd8
0x00414ddb
0x00414de8
0x00414ded
0x00414df4
0x00414dfb
0x00414e02
0x00414e15
0x00414e1b
0x00414e1d
0x00414e2a
0x00414e4c
0x00414e2c
0x00414e2c
0x00414e31
0x00414e36
0x00414e39
0x00414e3f
0x00414e44
0x00414e44
0x00414e53
0x00414e56
0x00414e60
0x00414e61
0x00414e62
0x00414e63
0x00414e64
0x00414e67
0x00414e71
0x00414e72
0x00414e73
0x00414e74
0x00414e75
0x00414e77
0x00414e7c
0x00414e7f
0x00414e82
0x00414e83
0x00414e8b
0x00414e8c
0x00414e91
0x00414e95
0x00414e96
0x00414e9e
0x00414ea6
0x00414eb2
0x00414ecf
0x00414eb4
0x00414eb4
0x00414eb9
0x00414ebe
0x00414ec3
0x00414ec3
0x00414ef3
0x00414ef7
0x00414efc
0x00414f17
0x00414f1d
0x00414f1f
0x00414f2c
0x00414f51
0x00414f2e
0x00414f2e
0x00414f33
0x00414f38
0x00414f3e
0x00414f44
0x00414f49
0x00414f49
0x00414f5f
0x00414f63
0x00414f6a
0x00414f6d
0x00414f77
0x00414f78
0x00414f79
0x00414f7a
0x00414f7b
0x00414f80
0x00414f83
0x00414f8b
0x00414f90
0x00414f97
0x00414f9e
0x00414fa1
0x00414fab
0x00414fac
0x00414fad
0x00414fae
0x00414faf
0x00414fb4
0x00414fb7
0x00414fbc
0x00414fc3
0x00414fca
0x00414fcd
0x00414fd7
0x00414fd8
0x00414fd9
0x00414fda
0x00414fdb
0x00414fe0
0x00414fe3
0x00414fef
0x0041500c
0x00414ff1
0x00414ff1
0x00414ff6
0x00414ffb
0x00415000
0x00415000
0x00415030
0x00415034
0x00415039
0x00415054
0x0041505a
0x0041505c
0x00415069
0x0041508e
0x0041506b
0x0041506b
0x00415070
0x00415075
0x0041507b
0x00415081
0x00415086
0x00415086
0x0041509c
0x004150a0
0x004150a7
0x004150aa
0x004150b4
0x004150b5
0x004150b6
0x004150b7
0x004150b8
0x004150bd
0x004150c0
0x004150c8
0x004150cd
0x004150d1
0x004150d8
0x004150db
0x004150e5
0x004150e6
0x004150e7
0x004150e8
0x004150e9
0x004150ee
0x004150f1
0x004150f6
0x004150fd
0x00415104
0x00415106
0x0041510b
0x0041510e
0x00415111
0x00415112
0x0041511a
0x0041511b
0x0041511e
0x0041511f
0x00415124
0x0041512e
0x00415133
0x0041513c
0x00415149
0x00415166
0x0041514b
0x0041514b
0x00415150
0x00415155
0x0041515a
0x0041515a
0x0041518a
0x0041518e
0x00415193
0x004151ae
0x004151b4
0x004151b6
0x004151c3
0x004151e8
0x004151c5
0x004151c5
0x004151ca
0x004151cf
0x004151d5
0x004151db
0x004151e0
0x004151e0
0x004151f6
0x00415213
0x004151f8
0x004151f8
0x004151fd
0x00415202
0x00415207
0x00415207
0x0041521d
0x00415225
0x0041522b
0x00415232
0x00415246
0x00415250
0x00415251
0x00415252
0x00415253
0x00415262
0x00415265
0x00415267
0x00415274
0x00415296
0x00415276
0x00415276
0x00415278
0x0041527d
0x00415283
0x00415289
0x0041528e
0x0041528e
0x004152a0
0x004152a6
0x004152aa
0x004152b0
0x004152b3
0x004152b4
0x004152bc
0x004152bc
0x004152c1
0x004152f0
0x004152f8
0x00415300
0x00415305

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414DD0
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414DE8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402E40,00000218), ref: 00414E3F
__vbaChkstk.MSVBVM60(00000000,?,00402E40,00000218), ref: 00414E56
__vbaChkstk.MSVBVM60(00000000,?,00402E40,00000218), ref: 00414E67
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00414E83
__vbaObjVar.MSVBVM60(00000000), ref: 00414E8C
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000), ref: 00414E96
__vbaFreeObj.MSVBVM60(?,00000000,00000000), ref: 00414E9E
__vbaFreeVar.MSVBVM60(?,00000000,00000000), ref: 00414EA6
__vbaNew2.MSVBVM60(0040287C,PX_,?,00000000,00000000), ref: 00414EBE
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414EF7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,00000098), ref: 00414F44
__vbaChkstk.MSVBVM60(00000000,?,00403024,00000098), ref: 00414F6D
__vbaLateMemSt.MSVBVM60(?,00403234), ref: 00414F83
__vbaFreeObj.MSVBVM60(?,00403234), ref: 00414F8B
__vbaChkstk.MSVBVM60(?,00403234), ref: 00414FA1
__vbaLateMemSt.MSVBVM60(?,0040323C,?,00403234), ref: 00414FB7
__vbaChkstk.MSVBVM60(?,0040323C,?,00403234), ref: 00414FCD
__vbaLateMemSt.MSVBVM60(?,00403244,?,0040323C,?,00403234), ref: 00414FE3
__vbaNew2.MSVBVM60(0040287C,PX_,?,00403244,?,0040323C,?,00403234), ref: 00414FFB
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415034
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000000D0), ref: 00415081
__vbaChkstk.MSVBVM60(00000000,?,00403070,000000D0), ref: 004150AA
__vbaLateMemSt.MSVBVM60(?,0040324C), ref: 004150C0
__vbaFreeObj.MSVBVM60(?,0040324C), ref: 004150C8
__vbaChkstk.MSVBVM60(?,0040324C), ref: 004150DB
__vbaLateMemSt.MSVBVM60(?,Visible,?,0040324C), ref: 004150F1
__vbaLateMemCallLd.MSVBVM60(?,?,BorderStyle,00000000,?,Visible,?,0040324C), ref: 00415112
__vbaVarTstNe.MSVBVM60(?,00000000,?,?,00000000,00000000), ref: 0041511F
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000,00000000), ref: 0041512E
__vbaNew2.MSVBVM60(0040287C,PX_,?,00000000,?,?,00000000,00000000), ref: 00415155
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041518E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000001D0), ref: 004151DB
__vbaNew2.MSVBVM60(00403108,0041733C), ref: 00415202
__vbaChkstk.MSVBVM60(?,?), ref: 00415246
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,00000034), ref: 00415289
__vbaObjSet.MSVBVM60(?,?), ref: 004152B4
__vbaFreeObj.MSVBVM60(?,?), ref: 004152BC
__vbaFreeObj.MSVBVM60(00415306,?,00000000,?,?,00000000,00000000), ref: 004152F0
__vbaFreeVar.MSVBVM60(00415306,?,00000000,?,?,00000000,00000000), ref: 004152F8
__vbaFreeObj.MSVBVM60(00415306,?,00000000,?,?,00000000,00000000), ref: 00415300

Strings

<sA, xrefs: 0041521D
Visible, xrefs: 004150E9
Dataskrmernes4, xrefs: 00414DFB
BorderStyle, xrefs: 00415106
Add, xrefs: 00414E77
PX_, xrefs: 00414EAB, 00414EB4, 00414EC3, 00414ECF, 00414FE8, 00414FF1, 00415000, 0041500C, 00415142, 0041514B, 0041515A, 00415166
VB.Line, xrefs: 00414DED

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$Late$CheckHresult$New2$Call$Addref
String ID: <sA$Add$BorderStyle$Dataskrmernes4$PX_$VB.Line$Visible
API String ID: 457741602-3472605022
Opcode ID: 38f6c2f2f24c51ed396d331ad5681d747b1ded1d5387c306fe7b2e6fc7202a73
Instruction ID: 170857273b32f6b4ac92bd75d50ed0021dc6c72ecc01deb2b9eeca8355d6c7c3
Opcode Fuzzy Hash: 38f6c2f2f24c51ed396d331ad5681d747b1ded1d5387c306fe7b2e6fc7202a73
Instruction Fuzzy Hash: EBE12D71900718DBDB11EFA1CC45BCDBBB5BF09308F1044AAE508BB2A2C7B95A84DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004158F2, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E004158F2(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				signed int _v28;
				char _v32;
				char _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v76;
				intOrPtr _v84;
				char _v104;
				void* _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _t61;
				char* _t65;
				char* _t69;
				signed int _t73;
				char* _t79;
				signed int _t83;
				intOrPtr _t109;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t109;
				_t61 = 0x7c;
				L004012D0();
				_v12 = _t109;
				_v8 = 0x4012b0;
				_push(0x4032ac);
				L00401366();
				L0040142C();
				_push(_t61);
				_push(0x4032b4);
				L004013E4();
				asm("sbb eax, eax");
				_v108 =  ~( ~( ~_t61));
				L0040144A();
				_t65 = _v108;
				if(_t65 != 0) {
					if( *0x417010 != 0) {
						_v132 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v132 = 0x417010;
					}
					_t69 =  &_v32;
					L0040145C();
					_v108 = _t69;
					_t73 =  *((intOrPtr*)( *_v108 + 0x48))(_v108,  &_v28, _t69,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x308))( *_v132));
					asm("fclex");
					_v112 = _t73;
					if(_v112 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x402ff8);
						_push(_v108);
						_push(_v112);
						L00401462();
						_v136 = _t73;
					}
					_v128 = _v28;
					_v28 = _v28 & 0x00000000;
					_v44 = _v128;
					_v52 = 8;
					if( *0x417010 != 0) {
						_v140 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v140 = 0x417010;
					}
					_t79 =  &_v36;
					L0040145C();
					_v116 = _t79;
					_t83 =  *((intOrPtr*)( *_v116 + 0x58))(_v116,  &_v104, _t79,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x300))( *_v140));
					asm("fclex");
					_v120 = _t83;
					if(_v120 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x403070);
						_push(_v116);
						_push(_v120);
						L00401462();
						_v144 = _t83;
					}
					_v76 = _v104;
					_v84 = 3;
					_push(0x10);
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0x10);
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(2);
					_push(L"ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126");
					_push(_v24);
					L00401360();
					_push( &_v36);
					_t65 =  &_v32;
					_push(_t65);
					_push(2);
					L0040143E();
					L00401420();
				}
				_push(0x415b15);
				L00401444();
				return _t65;
			}

0x004158f7
0x00415902
0x00415903
0x0041590c
0x0041590d
0x00415915
0x00415918
0x0041591f
0x00415924
0x0041592e
0x00415933
0x00415934
0x00415939
0x00415940
0x00415946
0x0041594d
0x00415952
0x00415958
0x00415965
0x0041597f
0x00415967
0x00415967
0x0041596c
0x00415971
0x00415976
0x00415976
0x0041599a
0x0041599e
0x004159a3
0x004159b2
0x004159b5
0x004159b7
0x004159be
0x004159da
0x004159c0
0x004159c0
0x004159c2
0x004159c7
0x004159ca
0x004159cd
0x004159d2
0x004159d2
0x004159e4
0x004159e7
0x004159ee
0x004159f1
0x004159ff
0x00415a1c
0x00415a01
0x00415a01
0x00415a06
0x00415a0b
0x00415a10
0x00415a10
0x00415a40
0x00415a44
0x00415a49
0x00415a58
0x00415a5b
0x00415a5d
0x00415a64
0x00415a80
0x00415a66
0x00415a66
0x00415a68
0x00415a6d
0x00415a70
0x00415a73
0x00415a78
0x00415a78
0x00415a8a
0x00415a8d
0x00415a94
0x00415a97
0x00415aa1
0x00415aa2
0x00415aa3
0x00415aa4
0x00415aa5
0x00415aa8
0x00415ab2
0x00415ab3
0x00415ab4
0x00415ab5
0x00415ab6
0x00415ab8
0x00415abd
0x00415ac0
0x00415acb
0x00415acc
0x00415acf
0x00415ad0
0x00415ad2
0x00415add
0x00415add
0x00415ae2
0x00415b0f
0x00415b14

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041590D
#527.MSVBVM60(004032AC,?,?,?,?,004012D6), ref: 00415924
__vbaStrMove.MSVBVM60(004032AC,?,?,?,?,004012D6), ref: 0041592E
__vbaStrCmp.MSVBVM60(004032B4,00000000,004032AC,?,?,?,?,004012D6), ref: 00415939
__vbaFreeStr.MSVBVM60(004032B4,00000000,004032AC,?,?,?,?,004012D6), ref: 0041594D
__vbaNew2.MSVBVM60(0040287C,PX_,004032B4,00000000,004032AC,?,?,?,?,004012D6), ref: 00415971
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041599E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000048), ref: 004159CD
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00415A0B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415A44
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,00000058), ref: 00415A73
__vbaChkstk.MSVBVM60(00000000,?,00403070,00000058), ref: 00415A97
__vbaChkstk.MSVBVM60(00000000,?,00403070,00000058), ref: 00415AA8
__vbaLateMemCall.MSVBVM60(?,ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126,00000002), ref: 00415AC0
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00415AD2
__vbaFreeVar.MSVBVM60 ref: 00415ADD
__vbaFreeObj.MSVBVM60(00415B15,004032B4,00000000,004032AC,?,?,?,?,004012D6), ref: 00415B0F

Strings

ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126, xrefs: 00415AB8
PX_, xrefs: 0041595E, 00415967, 00415976, 0041597F, 004159F8, 00415A01, 00415A10, 00415A1C

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$CheckHresultNew2$#527CallLateListMove
String ID: PX_$ikf3Wxrnxf0PZSxe1cvIGbQ2V4GpuEll3XF126
API String ID: 3951332288-2525207389
Opcode ID: 613e28c184c1845b37e9f61a7e27815c5c34a13ac71bfe71c5932c4a858d770c
Instruction ID: e25577d4c4afe97042a2daf4f1086b0ff646d33623122b2e49052b4a5835f5a2
Opcode Fuzzy Hash: 613e28c184c1845b37e9f61a7e27815c5c34a13ac71bfe71c5932c4a858d770c
Instruction Fuzzy Hash: 6D513870940718DFCB10DFA1C886BDEBBB8BF08704F20456AE505BB2A1DBB95984DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004113F9, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004113F9(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				signed int _v36;
				char _v40;
				char _v44;
				char _v60;
				char* _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				signed int _v140;
				signed int _v144;
				char _v148;
				intOrPtr* _v152;
				signed int _v156;
				signed int _v160;
				signed int _t83;
				char* _t84;
				signed int _t88;
				char* _t94;
				signed int _t98;
				char* _t100;
				signed int _t103;
				void* _t116;
				void* _t118;
				intOrPtr _t119;

				_t119 = _t118 - 0xc;
				 *[fs:0x0] = _t119;
				L004012D0();
				_v16 = _t119;
				_v12 = 0x4011c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t116);
				L00401450();
				_v84 =  &_v28;
				_v92 = 0x4008;
				_push(1);
				_push( &_v92);
				_push( &_v60);
				L004013F0();
				_v100 = 0x4030e0;
				_v108 = 0x8008;
				_push( &_v60);
				_t83 =  &_v108;
				_push(_t83);
				L004013F6();
				_v112 = _t83;
				L00401420();
				_t84 = _v112;
				if(_t84 != 0) {
					_t88 =  *((intOrPtr*)( *_a4 + 0x160))(_a4,  &_v36);
					asm("fclex");
					_v112 = _t88;
					if(_v112 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x160);
						_push(0x402e40);
						_push(_a4);
						_push(_v112);
						L00401462();
						_v144 = _t88;
					}
					if( *0x41733c != 0) {
						_v148 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403108);
						L00401456();
						_v148 = 0x41733c;
					}
					_t33 =  &_v148; // 0x41733c
					_v124 =  *((intOrPtr*)( *_t33));
					if( *0x417010 != 0) {
						_v152 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v152 = 0x417010;
					}
					_t94 =  &_v40;
					L0040145C();
					_v116 = _t94;
					_t98 =  *((intOrPtr*)( *_v116 + 0x218))(_v116,  &_v32, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v152)) + 0x304))( *_v152));
					asm("fclex");
					_v120 = _t98;
					if(_v120 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x218);
						_push(0x402ff8);
						_push(_v116);
						_push(_v120);
						L00401462();
						_v156 = _t98;
					}
					_v140 = _v36;
					_v36 = _v36 & 0x00000000;
					_t100 =  &_v44;
					L0040145C();
					_t103 =  *((intOrPtr*)( *_v124 + 0x40))(_v124, _t100, _t100, _v140, _v32);
					asm("fclex");
					_v128 = _t103;
					if(_v128 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x4030f4);
						_push(_v124);
						_push(_v128);
						L00401462();
						_v160 = _t103;
					}
					L0040144A();
					_push( &_v44);
					_t84 =  &_v40;
					_push(_t84);
					_push(2);
					L0040143E();
				}
				_push(0x411658);
				L0040144A();
				return _t84;
			}

0x004113fc
0x0041140b
0x00411417
0x0041141f
0x00411422
0x00411429
0x00411438
0x00411443
0x0041144b
0x0041144e
0x00411455
0x0041145a
0x0041145e
0x0041145f
0x00411464
0x0041146b
0x00411475
0x00411476
0x00411479
0x0041147a
0x0041147f
0x00411486
0x0041148b
0x00411491
0x004114a3
0x004114a9
0x004114ab
0x004114b2
0x004114d1
0x004114b4
0x004114b4
0x004114b9
0x004114be
0x004114c1
0x004114c4
0x004114c9
0x004114c9
0x004114df
0x004114fc
0x004114e1
0x004114e1
0x004114e6
0x004114eb
0x004114f0
0x004114f0
0x00411506
0x0041150e
0x00411518
0x00411535
0x0041151a
0x0041151a
0x0041151f
0x00411524
0x00411529
0x00411529
0x00411559
0x0041155d
0x00411562
0x00411571
0x00411577
0x00411579
0x00411580
0x0041159f
0x00411582
0x00411582
0x00411587
0x0041158c
0x0041158f
0x00411592
0x00411597
0x00411597
0x004115a9
0x004115af
0x004115bc
0x004115c0
0x004115ce
0x004115d1
0x004115d3
0x004115da
0x004115f6
0x004115dc
0x004115dc
0x004115de
0x004115e3
0x004115e6
0x004115e9
0x004115ee
0x004115ee
0x00411600
0x00411608
0x00411609
0x0041160c
0x0041160d
0x0041160f
0x00411614
0x00411617
0x00411652
0x00411657

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00411417
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00411443
#619.MSVBVM60(?,00004008,00000001), ref: 0041145F
__vbaVarTstNe.MSVBVM60(?,?,?,00004008,00000001), ref: 0041147A
__vbaFreeVar.MSVBVM60(?,?,?,00004008,00000001), ref: 00411486
__vbaHresultCheckObj.MSVBVM60(00000000,004011C0,00402E40,00000160), ref: 004114C4
__vbaNew2.MSVBVM60(00403108,0041733C), ref: 004114EB
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00411524
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041155D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000218), ref: 00411592
__vbaObjSet.MSVBVM60(?,?,?), ref: 004115C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,00000040), ref: 004115E9
__vbaFreeStr.MSVBVM60(00000000,?,004030F4,00000040), ref: 00411600
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041160F
__vbaFreeStr.MSVBVM60(00411658,?,?,?,00004008,00000001), ref: 00411652

Strings

ABC, xrefs: 0041143B
<sA, xrefs: 00411506
PX_, xrefs: 00411511, 0041151A, 00411529, 00411535

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#619ChkstkCopyList
String ID: <sA$ABC$PX_
API String ID: 1221161852-2511951767
Opcode ID: acb28ef83f0469758e3ab2f625f9334dfd07d9053e0e4588e3f2b7b3febe4760
Instruction ID: 25c6788a23e5ee61e9963d03141018c49af197e0c1a9ed1bb113b44d1a3685dc
Opcode Fuzzy Hash: acb28ef83f0469758e3ab2f625f9334dfd07d9053e0e4588e3f2b7b3febe4760
Instruction Fuzzy Hash: 90610970900218EFDB10EFA5C845BDDBBB9BF08704F10806AE609B72A2D7799985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00414810, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00414810(void* __ebx, void* __edi, void* __esi, void* _a8, void* _a12, void* _a56, signed int* _a60) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v44;
				void* _v48;
				void* _v64;
				void* _v68;
				char _v84;
				char* _v92;
				intOrPtr _v100;
				short _v104;
				char* _t32;
				char* _t33;
				void* _t58;
				intOrPtr _t59;

				_t59 = _t58 - 0xc;
				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t59;
				_push(0x58);
				L004012D0();
				_v16 = _t59;
				_v12 = 0x401230;
				L00401450();
				L004013EA();
				L00401450();
				 *_a60 =  *_a60 & 0x00000000;
				_push( &_v84);
				L004013A8();
				_t32 =  &_v84;
				_push(_t32);
				L004013AE();
				_v104 =  ~(0 | _t32 != 0x0000ffff);
				L00401420();
				_t33 = _v104;
				if(_t33 != 0) {
					_v92 = L"Ferskvandsomraadernes";
					_v100 = 8;
					L004013EA();
					_t33 =  &_v84;
					_push(_t33);
					L004013A2();
					L0040142C();
					L00401420();
				}
				_push(0x41490d);
				L0040144A();
				L0040144A();
				L00401420();
				L0040144A();
				return _t33;
			}

0x00414813
0x00414816
0x00414821
0x00414822
0x00414829
0x0041482c
0x00414834
0x00414837
0x00414844
0x0041484f
0x0041485a
0x00414862
0x00414868
0x00414869
0x0041486e
0x00414871
0x00414872
0x00414882
0x00414889
0x0041488e
0x00414894
0x00414896
0x0041489d
0x004148aa
0x004148af
0x004148b2
0x004148b3
0x004148bd
0x004148c5
0x004148c5
0x004148ca
0x004148ef
0x004148f7
0x004148ff
0x00414907
0x0041490c

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041482C
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00414844
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 0041484F
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 0041485A
#610.MSVBVM60(?,?,?,?,?,004012D6), ref: 00414869
#557.MSVBVM60(?,?,?,?,?,?,004012D6), ref: 00414872
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,004012D6), ref: 00414889
__vbaVarDup.MSVBVM60 ref: 004148AA
#667.MSVBVM60(?), ref: 004148B3
__vbaStrMove.MSVBVM60(?), ref: 004148BD
__vbaFreeVar.MSVBVM60(?), ref: 004148C5
__vbaFreeStr.MSVBVM60(0041490D,?,?,?,?,?,?,004012D6), ref: 004148EF
__vbaFreeStr.MSVBVM60(0041490D,?,?,?,?,?,?,004012D6), ref: 004148F7
__vbaFreeVar.MSVBVM60(0041490D,?,?,?,?,?,?,004012D6), ref: 004148FF
__vbaFreeStr.MSVBVM60(0041490D,?,?,?,?,?,?,004012D6), ref: 00414907

Strings

Ferskvandsomraadernes, xrefs: 00414896
IA, xrefs: 004148F4

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$#557#610#667ChkstkMove
String ID: IA$Ferskvandsomraadernes
API String ID: 1992133662-2121059240
Opcode ID: 1d59e2e053066fa66731fa230cee0c84de1fecf662b0255c4367891190d0c721
Instruction ID: 5bf603e11d57babc8aed5c262a22f22636ff5f34c2bb8db01a06c5639409de9e
Opcode Fuzzy Hash: 1d59e2e053066fa66731fa230cee0c84de1fecf662b0255c4367891190d0c721
Instruction Fuzzy Hash: 50210A319102099BCB04EBE1C891AEEB778BF00708F90843EF4017B5F5EB789949CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00415319, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00415319(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr _v104;
				char _v112;
				intOrPtr _v120;
				char _v128;
				intOrPtr _v136;
				char _v144;
				intOrPtr _v152;
				char _v160;
				intOrPtr _v184;
				char _v192;
				void* _v260;
				signed int _v264;
				signed int _v276;
				intOrPtr* _v280;
				signed int _v284;
				short _t84;
				char* _t87;
				char* _t91;
				signed int _t95;
				void* _t124;
				void* _t126;
				intOrPtr _t127;

				_t127 = _t126 - 0xc;
				 *[fs:0x0] = _t127;
				L004012D0();
				_v16 = _t127;
				_v12 = 0x401290;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t124);
				L00401450();
				_v56 = 0x4b;
				_v64 = 2;
				_push( &_v64);
				_push( &_v80);
				L00401378();
				_v184 = 0x403280;
				_v192 = 0x8008;
				_push( &_v80);
				_t84 =  &_v192;
				_push(_t84);
				L004013F6();
				_v260 = _t84;
				_push( &_v80);
				_push( &_v64);
				_push(2);
				L00401426();
				_t87 = _v260;
				if(_t87 != 0) {
					_v152 = 0x80020004;
					_v160 = 0xa;
					_v136 = 0x80020004;
					_v144 = 0xa;
					_v120 = 0x80020004;
					_v128 = 0xa;
					_v104 = 0x80020004;
					_v112 = 0xa;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					if( *0x417010 != 0) {
						_v280 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v280 = 0x417010;
					}
					_t91 =  &_v44;
					L0040145C();
					_v260 = _t91;
					_t95 =  *((intOrPtr*)( *_v260 + 0x180))(_v260,  &_v48, _t91,  *((intOrPtr*)( *((intOrPtr*)( *_v280)) + 0x300))( *_v280));
					asm("fclex");
					_v264 = _t95;
					if(_v264 >= 0) {
						_v284 = _v284 & 0x00000000;
					} else {
						_push(0x180);
						_push(0x403070);
						_push(_v260);
						_push(_v264);
						L00401462();
						_v284 = _t95;
					}
					_v276 = _v48;
					_v48 = _v48 & 0x00000000;
					_v56 = _v276;
					_v64 = 9;
					_push( &_v160);
					_push( &_v144);
					_push( &_v128);
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					L00401372();
					L0040142C();
					L00401444();
					_push( &_v160);
					_push( &_v144);
					_push( &_v128);
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_t87 =  &_v64;
					_push(_t87);
					_push(7);
					L00401426();
				}
				asm("wait");
				_push(0x4155b1);
				L0040144A();
				L0040144A();
				return _t87;
			}

0x0041531c
0x0041532b
0x00415337
0x0041533f
0x00415342
0x00415349
0x00415358
0x00415361
0x00415366
0x0041536d
0x00415377
0x0041537b
0x0041537c
0x00415381
0x0041538b
0x00415398
0x00415399
0x0041539f
0x004153a0
0x004153a5
0x004153af
0x004153b3
0x004153b4
0x004153b6
0x004153be
0x004153c7
0x004153cd
0x004153d7
0x004153e1
0x004153eb
0x004153f5
0x004153fc
0x00415403
0x0041540a
0x00415411
0x00415418
0x0041541f
0x00415426
0x00415434
0x00415451
0x00415436
0x00415436
0x0041543b
0x00415440
0x00415445
0x00415445
0x00415475
0x00415479
0x0041547e
0x00415496
0x0041549c
0x0041549e
0x004154ab
0x004154d0
0x004154ad
0x004154ad
0x004154b2
0x004154b7
0x004154bd
0x004154c3
0x004154c8
0x004154c8
0x004154da
0x004154e0
0x004154ea
0x004154ed
0x004154fa
0x00415501
0x00415505
0x00415509
0x0041550d
0x00415511
0x00415515
0x00415516
0x00415520
0x00415528
0x00415533
0x0041553a
0x0041553e
0x00415542
0x00415546
0x0041554a
0x0041554b
0x0041554e
0x0041554f
0x00415551
0x00415556
0x00415559
0x0041555a
0x004155a3
0x004155ab
0x004155b0

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00415337
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00415361
#573.MSVBVM60(?,00000002), ref: 0041537C
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 004153A0
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 004153B6
__vbaNew2.MSVBVM60(0040287C,PX_), ref: 00415440
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415479
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,00000180), ref: 004154C3
#596.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415516
__vbaStrMove.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415520
__vbaFreeObj.MSVBVM60(00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415528
__vbaFreeVarList.MSVBVM60(00000007,00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A,00000009,0000000A,0000000A,0000000A,0000000A,0000000A,0000000A), ref: 00415551
__vbaFreeStr.MSVBVM60(004155B1,?,?,004012D6), ref: 004155A3
__vbaFreeStr.MSVBVM60(004155B1,?,?,004012D6), ref: 004155AB

Strings

K, xrefs: 00415366
PX_, xrefs: 0041542D, 00415436, 00415445, 00415451

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$List$#573#596CheckChkstkCopyHresultMoveNew2
String ID: K$PX_
API String ID: 259192952-593171365
Opcode ID: 892c41a56bbd440ae168175f5bdce30a02d7ae5513e59d3575b2b7429c11dd4a
Instruction ID: e1e15e4a05b1f2572658b953068a08abc6468f2d69fa08ff21135b40cec01493
Opcode Fuzzy Hash: 892c41a56bbd440ae168175f5bdce30a02d7ae5513e59d3575b2b7429c11dd4a
Instruction Fuzzy Hash: 7D61BBB1D0021CEBDB11DF91C885BDEB7B9BF08304F1081AAE119B71A1DB799A85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 004155D8, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004155D8(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				short _v164;
				char _v168;
				intOrPtr* _v172;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				short _v188;
				char _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr* _v208;
				signed int _v212;
				signed int _v216;
				signed int _t93;
				signed int _t98;
				char* _t102;
				char* _t103;
				char* _t107;
				signed int _t111;
				signed int _t119;
				intOrPtr _t135;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t135;
				L004012D0();
				_v12 = _t135;
				_v8 = 0x4012a0;
				if( *0x41733c != 0) {
					_v196 = 0x41733c;
				} else {
					_push(0x41733c);
					_push(0x403108);
					L00401456();
					_v196 = 0x41733c;
				}
				_t5 =  &_v196; // 0x41733c
				_v172 =  *((intOrPtr*)( *_t5));
				_t93 =  *((intOrPtr*)( *_v172 + 0x14))(_v172,  &_v28);
				asm("fclex");
				_v176 = _t93;
				if(_v176 >= 0) {
					_v200 = _v200 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x4030f4);
					_push(_v172);
					_push(_v176);
					L00401462();
					_v200 = _t93;
				}
				_v180 = _v28;
				_t98 =  *((intOrPtr*)( *_v180 + 0x128))(_v180,  &_v168);
				asm("fclex");
				_v184 = _t98;
				if(_v184 >= 0) {
					_v204 = _v204 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x403288);
					_push(_v180);
					_push(_v184);
					L00401462();
					_v204 = _t98;
				}
				_v188 =  ~(0 | _v168 == 0x00000000);
				L00401444();
				_t102 = _v188;
				if(_t102 != 0) {
					L0040136C();
					_push(_t102);
					_t103 =  &_v32;
					_push(_t103);
					L0040145C();
					_v180 = _t103;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v40 = 0x80020004;
					_v48 = 0xa;
					if( *0x417010 != 0) {
						_v208 = 0x417010;
					} else {
						_push("PX_");
						_push(0x40287c);
						L00401456();
						_v208 = 0x417010;
					}
					_t107 =  &_v28;
					L0040145C();
					_v172 = _t107;
					_t111 =  *((intOrPtr*)( *_v172 + 0x158))(_v172,  &_v164, _t107,  *((intOrPtr*)( *((intOrPtr*)( *_v208)) + 0x300))( *_v208));
					asm("fclex");
					_v176 = _t111;
					if(_v176 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x158);
						_push(0x403070);
						_push(_v172);
						_push(_v176);
						L00401462();
						_v212 = _t111;
					}
					_t119 =  *((intOrPtr*)( *_v180 + 0x44))(_v180, _v164,  &_v48,  &_v64,  &_v80,  &_v96);
					asm("fclex");
					_v184 = _t119;
					if(_v184 >= 0) {
						_v216 = _v216 & 0x00000000;
					} else {
						_push(0x44);
						_push(0x403298);
						_push(_v180);
						_push(_v184);
						L00401462();
						_v216 = _t119;
					}
					_push( &_v32);
					_push( &_v28);
					_push(2);
					L0040143E();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_t102 =  &_v48;
					_push(_t102);
					_push(4);
					L00401426();
				}
				_push(0x4158d7);
				return _t102;
			}

0x004155dd
0x004155e8
0x004155e9
0x004155f5
0x004155fd
0x00415600
0x0041560e
0x0041562b
0x00415610
0x00415610
0x00415615
0x0041561a
0x0041561f
0x0041561f
0x00415635
0x0041563d
0x00415655
0x00415658
0x0041565a
0x00415667
0x00415689
0x00415669
0x00415669
0x0041566b
0x00415670
0x00415676
0x0041567c
0x00415681
0x00415681
0x00415693
0x004156ae
0x004156b4
0x004156b6
0x004156c3
0x004156e8
0x004156c5
0x004156c5
0x004156ca
0x004156cf
0x004156d5
0x004156db
0x004156e0
0x004156e0
0x004156fd
0x00415707
0x0041570c
0x00415715
0x0041571b
0x00415720
0x00415721
0x00415724
0x00415725
0x0041572a
0x00415730
0x00415737
0x0041573e
0x00415745
0x0041574c
0x00415753
0x0041575a
0x00415761
0x0041576f
0x0041578c
0x00415771
0x00415771
0x00415776
0x0041577b
0x00415780
0x00415780
0x004157b0
0x004157b4
0x004157b9
0x004157d4
0x004157da
0x004157dc
0x004157e9
0x0041580e
0x004157eb
0x004157eb
0x004157f0
0x004157f5
0x004157fb
0x00415801
0x00415806
0x00415806
0x0041583b
0x0041583e
0x00415840
0x0041584d
0x0041586f
0x0041584f
0x0041584f
0x00415851
0x00415856
0x0041585c
0x00415862
0x00415867
0x00415867
0x00415879
0x0041587d
0x0041587e
0x00415880
0x0041588b
0x0041588f
0x00415893
0x00415894
0x00415897
0x00415898
0x0041589a
0x0041589f
0x004158a2
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004155F5
__vbaNew2.MSVBVM60(00403108,0041733C,?,?,?,?,004012D6), ref: 0041561A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,00000014), ref: 0041567C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403288,00000128), ref: 004156DB
__vbaFreeObj.MSVBVM60(00000000,?,00403288,00000128), ref: 00415707
#685.MSVBVM60(00000000,?,00403288,00000128), ref: 0041571B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415725
__vbaNew2.MSVBVM60(0040287C,PX_,?,00000000), ref: 0041577B
__vbaObjSet.MSVBVM60(?,00000000), ref: 004157B4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,00000158), ref: 00415801
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403298,00000044), ref: 00415862
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00415880
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?), ref: 0041589A

Strings

<sA, xrefs: 00415635
PX_, xrefs: 00415768, 00415771, 00415780, 0041578C

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$ListNew2$#685Chkstk
String ID: <sA$PX_
API String ID: 509102008-3503330094
Opcode ID: 15ee7fa9997c6c6dd31bb26b4c9184f0252c2d897fc82d37f561e26c5e14f98a
Instruction ID: ed8ce4da2412b27a1dd7fcb989159b2be5f4961bc8d641b12a2b80d0cac788e8
Opcode Fuzzy Hash: 15ee7fa9997c6c6dd31bb26b4c9184f0252c2d897fc82d37f561e26c5e14f98a
Instruction Fuzzy Hash: 5281D771901618EFDB20DF91CC45FDEBBB9BB08304F1041EAE109B62A1D7785A85DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00414B02, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00414B02(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a8, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v40;
				void* _v48;
				char _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				void* _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				char _v104;
				signed int _v108;
				signed int _v112;
				char* _t54;
				signed int _t55;
				signed int _t61;
				intOrPtr _t87;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t87;
				_push(0x5c);
				L004012D0();
				_v12 = _t87;
				_v8 = 0x401260;
				L004013EA();
				L00401450();
				_v72 = _a4;
				_v80 = 9;
				L004013EA();
				_t54 =  &_v64;
				_push(_t54);
				L00401396();
				_v84 =  ~(0 | _t54 != 0x0000ffff);
				L00401420();
				_t55 = _v84;
				if(_t55 != 0) {
					if( *0x41733c != 0) {
						_v104 = 0x41733c;
					} else {
						_push(0x41733c);
						_push(0x403108);
						L00401456();
						_v104 = 0x41733c;
					}
					_t20 =  &_v104; // 0x41733c
					_v84 =  *((intOrPtr*)( *_t20));
					_t61 =  *((intOrPtr*)( *_v84 + 0x1c))(_v84,  &_v48);
					asm("fclex");
					_v88 = _t61;
					if(_v88 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x4030f4);
						_push(_v84);
						_push(_v88);
						L00401462();
						_v108 = _t61;
					}
					_v92 = _v48;
					_v72 = 0x80020004;
					_v80 = 0xa;
					L004012D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t55 =  *((intOrPtr*)( *_v92 + 0x60))(_v92, L"dissour", 0x10);
					asm("fclex");
					_v96 = _t55;
					if(_v96 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x4031e4);
						_push(_v92);
						_push(_v96);
						L00401462();
						_v112 = _t55;
					}
					L00401444();
				}
				_push(0x414c7a);
				L00401420();
				L0040144A();
				return _t55;
			}

0x00414b07
0x00414b12
0x00414b13
0x00414b1a
0x00414b1d
0x00414b25
0x00414b28
0x00414b35
0x00414b40
0x00414b48
0x00414b4b
0x00414b58
0x00414b5d
0x00414b60
0x00414b61
0x00414b71
0x00414b78
0x00414b7d
0x00414b83
0x00414b90
0x00414baa
0x00414b92
0x00414b92
0x00414b97
0x00414b9c
0x00414ba1
0x00414ba1
0x00414bb1
0x00414bb6
0x00414bc5
0x00414bc8
0x00414bca
0x00414bd1
0x00414bea
0x00414bd3
0x00414bd3
0x00414bd5
0x00414bda
0x00414bdd
0x00414be0
0x00414be5
0x00414be5
0x00414bf1
0x00414bf4
0x00414bfb
0x00414c05
0x00414c0f
0x00414c10
0x00414c11
0x00414c12
0x00414c20
0x00414c23
0x00414c25
0x00414c2c
0x00414c45
0x00414c2e
0x00414c2e
0x00414c30
0x00414c35
0x00414c38
0x00414c3b
0x00414c40
0x00414c40
0x00414c4c
0x00414c4c
0x00414c51
0x00414c6c
0x00414c74
0x00414c79

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414B1D
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414B35
__vbaStrCopy.MSVBVM60(?,?,?,?,004012D6), ref: 00414B40
__vbaVarDup.MSVBVM60 ref: 00414B58
#562.MSVBVM60(?), ref: 00414B61
__vbaFreeVar.MSVBVM60(?), ref: 00414B78
__vbaNew2.MSVBVM60(00403108,0041733C,?), ref: 00414B9C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,0000001C,?,?,?,?,?,?), ref: 00414BE0
__vbaChkstk.MSVBVM60(?,?,?,?,?,?), ref: 00414C05
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E4,00000060,?,?,?,?,?,?), ref: 00414C3B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?), ref: 00414C4C
__vbaFreeVar.MSVBVM60(00414C7A,?), ref: 00414C6C
__vbaFreeStr.MSVBVM60(00414C7A,?), ref: 00414C74

Strings

dissour, xrefs: 00414C13
<sA, xrefs: 00414BB1

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#562CopyNew2
String ID: <sA$dissour
API String ID: 3730601939-3631128563
Opcode ID: 175469977db2c4b243b7b7748db05c99cb631b6571f13f0ddbf663927a9f871f
Instruction ID: f6574b5929677ee65258c82e5ee685e54823721a6f3ee17564d26a61d36be016
Opcode Fuzzy Hash: 175469977db2c4b243b7b7748db05c99cb631b6571f13f0ddbf663927a9f871f
Instruction Fuzzy Hash: C741F670D00208AFDB00EFE5C945BDDBBB4BF08708F10802AF415BB2A5DBB86945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004145A7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004145A7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v48;
				intOrPtr _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				char* _v104;
				intOrPtr _v112;
				intOrPtr _v120;
				char _v128;
				short _v164;
				short _t47;
				char* _t50;
				void* _t65;
				void* _t67;
				intOrPtr _t68;

				_t68 = _t67 - 0xc;
				 *[fs:0x0] = _t68;
				L004012D0();
				_v16 = _t68;
				_v12 = 0x401210;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012d6, _t65);
				_v104 = 0x403154;
				_v112 = 8;
				L004013EA();
				_push(2);
				_push( &_v48);
				_push( &_v64);
				L004013BA();
				_v120 = 0x403160;
				_v128 = 0x8008;
				_push( &_v64);
				_t47 =  &_v128;
				_push(_t47);
				L004013F6();
				_v164 = _t47;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L00401426();
				_t50 = _v164;
				if(_t50 != 0) {
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v56 = 0x80020004;
					_v64 = 0xa;
					_v104 = L"ceterach";
					_v112 = 8;
					L004013EA();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_push(0);
					_push( &_v48);
					L004013B4();
					_push( &_v96);
					_push( &_v80);
					_push( &_v64);
					_t50 =  &_v48;
					_push(_t50);
					_push(4);
					L00401426();
				}
				_push(0x4146e7);
				return _t50;
			}

0x004145aa
0x004145b9
0x004145c5
0x004145cd
0x004145d0
0x004145d7
0x004145e6
0x004145e9
0x004145f0
0x004145fd
0x00414602
0x00414607
0x0041460b
0x0041460c
0x00414611
0x00414618
0x00414622
0x00414623
0x00414626
0x00414627
0x0041462c
0x00414636
0x0041463a
0x0041463b
0x0041463d
0x00414645
0x0041464e
0x00414650
0x00414657
0x0041465e
0x00414665
0x0041466c
0x00414673
0x0041467a
0x00414681
0x0041468e
0x00414696
0x0041469a
0x0041469e
0x0041469f
0x004146a4
0x004146a5
0x004146ad
0x004146b1
0x004146b5
0x004146b6
0x004146b9
0x004146ba
0x004146bc
0x004146c1
0x004146c4
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004145C5
__vbaVarDup.MSVBVM60 ref: 004145FD
#513.MSVBVM60(?,?,00000002), ref: 0041460C
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000002), ref: 00414627
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000002), ref: 0041463D
__vbaVarDup.MSVBVM60 ref: 0041468E
#595.MSVBVM60(?,00000000,0000000A,0000000A,0000000A), ref: 004146A5
__vbaFreeVarList.MSVBVM60(00000004,?,0000000A,0000000A,0000000A,?,00000000,0000000A,0000000A,0000000A), ref: 004146BC

Strings

ceterach, xrefs: 0041467A

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$FreeList$#513#595Chkstk
String ID: ceterach
API String ID: 910115642-2788406423
Opcode ID: 53efd289a60c92d1d864c859c2cf0a86a87f811be65087c70a5c748ed71eb5d6
Instruction ID: ec619e6d53cfa7fd7d675728aab3f6abd4f139d117fb074bbd3d263aa17151d5
Opcode Fuzzy Hash: 53efd289a60c92d1d864c859c2cf0a86a87f811be65087c70a5c748ed71eb5d6
Instruction Fuzzy Hash: 143198B2D0020CAADB01DFD5C885BDEBBBCEB08704F50C12AE515BB191DB789649CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411677, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00411677(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v56;
				signed int _v60;
				char _v72;
				signed int _v76;
				signed int _v80;
				signed int _t48;
				signed int _t52;
				void* _t60;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				 *[fs:0x0] = _t63;
				L004012D0();
				_v16 = _t63;
				_v12 = 0x4011d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4012d6, _t60);
				L004013EA();
				if( *0x41733c != 0) {
					_v72 = 0x41733c;
				} else {
					_push(0x41733c);
					_push(0x403108);
					L00401456();
					_v72 = 0x41733c;
				}
				_t11 =  &_v72; // 0x41733c
				_v48 =  *((intOrPtr*)( *_t11));
				_t48 =  *((intOrPtr*)( *_v48 + 0x4c))(_v48,  &_v44);
				asm("fclex");
				_v52 = _t48;
				if(_v52 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x4c);
					_push(0x4030f4);
					_push(_v48);
					_push(_v52);
					L00401462();
					_v76 = _t48;
				}
				_v56 = _v44;
				_t52 =  *((intOrPtr*)( *_v56 + 0x28))(_v56);
				asm("fclex");
				_v60 = _t52;
				if(_v60 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x28);
					_push(0x403118);
					_push(_v56);
					_push(_v60);
					L00401462();
					_v80 = _t52;
				}
				L00401444();
				_push(0x41177f);
				L00401420();
				return _t52;
			}

0x0041167a
0x00411689
0x00411693
0x0041169b
0x0041169e
0x004116a5
0x004116b4
0x004116bd
0x004116c9
0x004116e3
0x004116cb
0x004116cb
0x004116d0
0x004116d5
0x004116da
0x004116da
0x004116ea
0x004116ef
0x004116fe
0x00411701
0x00411703
0x0041170a
0x00411723
0x0041170c
0x0041170c
0x0041170e
0x00411713
0x00411716
0x00411719
0x0041171e
0x0041171e
0x0041172a
0x00411735
0x00411738
0x0041173a
0x00411741
0x0041175a
0x00411743
0x00411743
0x00411745
0x0041174a
0x0041174d
0x00411750
0x00411755
0x00411755
0x00411761
0x00411766
0x00411779
0x0041177e

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00411693
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 004116BD
__vbaNew2.MSVBVM60(00403108,0041733C,?,?,?,?,004012D6), ref: 004116D5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F4,0000004C), ref: 00411719
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403118,00000028), ref: 00411750
__vbaFreeObj.MSVBVM60(00000000,?,00403118,00000028), ref: 00411761
__vbaFreeVar.MSVBVM60(0041177F), ref: 00411779

Strings

<sA, xrefs: 004116EA

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$ChkstkNew2
String ID: <sA
API String ID: 304406766-3623460565
Opcode ID: 989b012b526b538ca76ad95517165f1a4672f6d6df839bdb93a194833fd385a3
Instruction ID: d33ead9b7cb14e72ca13e2772819bc0f975dc2c8c265c029b1c842048a4263c2
Opcode Fuzzy Hash: 989b012b526b538ca76ad95517165f1a4672f6d6df839bdb93a194833fd385a3
Instruction Fuzzy Hash: 4931D070901208EFCB10EFA6D985BCCBBB4BF18718F20802AF511B62A1C7B85985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00415B28, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00415B28(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v80;
				signed int _v84;
				char* _t38;
				signed int _t42;
				void* _t52;
				void* _t54;
				intOrPtr _t55;

				_t55 = _t54 - 0xc;
				 *[fs:0x0] = _t55;
				L004012D0();
				_v16 = _t55;
				_v12 = 0x4012c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4012d6, _t52);
				 *_a24 =  *_a24 & 0x00000000;
				if( *0x417010 != 0) {
					_v80 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v80 = 0x417010;
				}
				_t38 =  &_v44;
				L0040145C();
				_v64 = _t38;
				_v52 = 0x80020004;
				_v60 = 0xa;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t42 =  *((intOrPtr*)( *_v64 + 0x1ec))(_v64, L"Frilbsnavenes1", 0x10, _t38,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x308))( *_v80));
				asm("fclex");
				_v68 = _t42;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x402ff8);
					_push(_v64);
					_push(_v68);
					L00401462();
					_v84 = _t42;
				}
				L00401444();
				_push(0x415c3c);
				return _t42;
			}

0x00415b2b
0x00415b3a
0x00415b44
0x00415b4c
0x00415b4f
0x00415b56
0x00415b65
0x00415b6b
0x00415b75
0x00415b8f
0x00415b77
0x00415b77
0x00415b7c
0x00415b81
0x00415b86
0x00415b86
0x00415baa
0x00415bae
0x00415bb3
0x00415bb6
0x00415bbd
0x00415bc7
0x00415bd1
0x00415bd2
0x00415bd3
0x00415bd4
0x00415be2
0x00415be8
0x00415bea
0x00415bf1
0x00415c0d
0x00415bf3
0x00415bf3
0x00415bf8
0x00415bfd
0x00415c00
0x00415c03
0x00415c08
0x00415c08
0x00415c14
0x00415c19
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00415B44
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,004012D6), ref: 00415B81
__vbaObjSet.MSVBVM60(?,00000000), ref: 00415BAE
__vbaChkstk.MSVBVM60(?,00000000), ref: 00415BC7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,000001EC), ref: 00415C03
__vbaFreeObj.MSVBVM60 ref: 00415C14

Strings

Frilbsnavenes1, xrefs: 00415BD5
PX_, xrefs: 00415B6E, 00415B77, 00415B86, 00415B8F

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Frilbsnavenes1$PX_
API String ID: 3189907775-2428902436
Opcode ID: 792a5283b70604adcbf9c966428fdae988255f5ed3014b988916209b6caed9a1
Instruction ID: f73b8d8e0907ba043e1a6692cc5cdb585a5d59fca055c7a571c8530213a5f385
Opcode Fuzzy Hash: 792a5283b70604adcbf9c966428fdae988255f5ed3014b988916209b6caed9a1
Instruction Fuzzy Hash: 04311774940708EFCB10EF95D849BCDBBB8BF49744F10846AF411BB2A1C7B99841DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00414714, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00414714(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t29;
				signed int _t33;
				intOrPtr _t46;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x28);
				L004012D0();
				_v12 = _t46;
				_v8 = 0x401220;
				if( *0x417010 != 0) {
					_v56 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v56 = 0x417010;
				}
				_t29 =  &_v24;
				L0040145C();
				_v44 = _t29;
				_v32 = 0x80020004;
				_v40 = 0xa;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t33 =  *((intOrPtr*)( *_v44 + 0x1ec))(_v44, L"Ballbuster6", 0x10, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x300))( *_v56));
				asm("fclex");
				_v48 = _t33;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x403070);
					_push(_v44);
					_push(_v48);
					L00401462();
					_v60 = _t33;
				}
				L00401444();
				_push(0x4147fd);
				return _t33;
			}

0x00414719
0x00414724
0x00414725
0x0041472c
0x0041472f
0x00414737
0x0041473a
0x00414748
0x00414762
0x0041474a
0x0041474a
0x0041474f
0x00414754
0x00414759
0x00414759
0x0041477d
0x00414781
0x00414786
0x00414789
0x00414790
0x0041479a
0x004147a4
0x004147a5
0x004147a6
0x004147a7
0x004147b5
0x004147bb
0x004147bd
0x004147c4
0x004147e0
0x004147c6
0x004147c6
0x004147cb
0x004147d0
0x004147d3
0x004147d6
0x004147db
0x004147db
0x004147e7
0x004147ec
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 0041472F
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,004012D6), ref: 00414754
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 00414781
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 0041479A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403070,000001EC,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004147D6
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004147E7

Strings

Ballbuster6, xrefs: 004147A8
PX_, xrefs: 00414741, 0041474A, 00414759, 00414762

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Ballbuster6$PX_
API String ID: 3189907775-2682186601
Opcode ID: 5f61e05f488d6915870849e6dfe7fb7861a1b10cf38226843c82c5ad2b04f1a3
Instruction ID: 3dfec3b74909ee98545e65d759f99ad0329c9c0a195c401304554b29b2ef3d02
Opcode Fuzzy Hash: 5f61e05f488d6915870849e6dfe7fb7861a1b10cf38226843c82c5ad2b04f1a3
Instruction Fuzzy Hash: DD215C74A00308EFCB00EF95D986BDDBBB9FB09714F20446AF011BB2E1C7B959408B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041492A, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041492A(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v44;
				char _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v64;
				signed int _v68;
				char* _t29;
				signed int _t32;
				intOrPtr _t46;

				_push(0x4012d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x30);
				L004012D0();
				_v12 = _t46;
				_v8 = 0x401240;
				L004013EA();
				if( *0x417010 != 0) {
					_v64 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v64 = 0x417010;
				}
				_t29 =  &_v48;
				L0040145C();
				_v52 = _t29;
				_t32 =  *((intOrPtr*)( *_v52 + 0x208))(_v52, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x308))( *_v64));
				asm("fclex");
				_v56 = _t32;
				if(_v56 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x208);
					_push(0x402ff8);
					_push(_v52);
					_push(_v56);
					L00401462();
					_v68 = _t32;
				}
				L00401444();
				_push(0x414a02);
				L00401420();
				return _t32;
			}

0x0041492f
0x0041493a
0x0041493b
0x00414942
0x00414945
0x0041494d
0x00414950
0x0041495d
0x00414969
0x00414983
0x0041496b
0x0041496b
0x00414970
0x00414975
0x0041497a
0x0041497a
0x0041499e
0x004149a2
0x004149a7
0x004149b2
0x004149b8
0x004149ba
0x004149c1
0x004149dd
0x004149c3
0x004149c3
0x004149c8
0x004149cd
0x004149d0
0x004149d3
0x004149d8
0x004149d8
0x004149e4
0x004149e9
0x004149fc
0x00414a01

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414945
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 0041495D
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,004012D6), ref: 00414975
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004149A2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402FF8,00000208), ref: 004149D3
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004149E4
__vbaFreeVar.MSVBVM60(00414A02,?,?,?,?,?,?,?,?,?,?,?,?,004012D6), ref: 004149FC

Strings

PX_, xrefs: 00414962, 0041496B, 0041497A, 00414983

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID: PX_
API String ID: 1725699769-441150619
Opcode ID: f2ef029d153529e73d770ff744016245057416ed24fd00bf278d5be0d26af6f4
Instruction ID: d2aea383d17d35b4457b37846fac54444f0749ae9cc43b8600185f1e2009d556
Opcode Fuzzy Hash: f2ef029d153529e73d770ff744016245057416ed24fd00bf278d5be0d26af6f4
Instruction Fuzzy Hash: D2213970950208EFCB04DFA5D845FDDBBB8BF08748F10452AF011B72A1CBB85945DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00414C95, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00414C95(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t36;
				signed int _t40;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012D0();
				_v16 = _t53;
				_v12 = 0x401270;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4012d6, _t50);
				if( *0x417010 != 0) {
					_v68 = 0x417010;
				} else {
					_push("PX_");
					_push(0x40287c);
					L00401456();
					_v68 = 0x417010;
				}
				_t36 =  &_v32;
				L0040145C();
				_v52 = _t36;
				_v40 = 1;
				_v48 = 2;
				L004012D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t40 =  *((intOrPtr*)( *_v52 + 0x1b8))(_v52, 0x10, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x2fc))( *_v68));
				asm("fclex");
				_v56 = _t40;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x1b8);
					_push(0x403024);
					_push(_v52);
					_push(_v56);
					L00401462();
					_v72 = _t40;
				}
				L00401444();
				_push(0x414d8c);
				return _t40;
			}

0x00414c98
0x00414ca7
0x00414cb1
0x00414cb9
0x00414cbc
0x00414cc3
0x00414cd2
0x00414cdc
0x00414cf6
0x00414cde
0x00414cde
0x00414ce3
0x00414ce8
0x00414ced
0x00414ced
0x00414d11
0x00414d15
0x00414d1a
0x00414d1d
0x00414d24
0x00414d2e
0x00414d38
0x00414d39
0x00414d3a
0x00414d3b
0x00414d44
0x00414d4a
0x00414d4c
0x00414d53
0x00414d6f
0x00414d55
0x00414d55
0x00414d5a
0x00414d5f
0x00414d62
0x00414d65
0x00414d6a
0x00414d6a
0x00414d76
0x00414d7b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414CB1
__vbaNew2.MSVBVM60(0040287C,PX_,?,?,?,?,004012D6), ref: 00414CE8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414D15
__vbaChkstk.MSVBVM60(?,00000000), ref: 00414D2E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403024,000001B8), ref: 00414D65
__vbaFreeObj.MSVBVM60 ref: 00414D76

Strings

PX_, xrefs: 00414CD5, 00414CDE, 00414CED, 00414CF6

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: PX_
API String ID: 3189907775-441150619
Opcode ID: 8a49452cc752d22f2412a1ab972970dddd0ea337eed5ba46fdee19ac75fda6de
Instruction ID: ed1a82d0f0d34b6a0b96d40ecfb39f6a4fb63b20d83600dfd5d9f15766794e86
Opcode Fuzzy Hash: 8a49452cc752d22f2412a1ab972970dddd0ea337eed5ba46fdee19ac75fda6de
Instruction Fuzzy Hash: A0215770900308EFCB10EFA5D949BDDBBB9BF08748F10846AF401BB2A1C7B95945CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414A23, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00414A23(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				intOrPtr _v48;
				char _v56;
				char _v72;
				intOrPtr _v112;
				char _v120;
				short _v124;
				short _t29;
				char* _t31;
				void* _t38;
				void* _t40;
				intOrPtr _t41;

				_t41 = _t40 - 0xc;
				 *[fs:0x0] = _t41;
				L004012D0();
				_v16 = _t41;
				_v12 = 0x401250;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x6c,  *[fs:0x0], 0x4012d6, _t38);
				L004013EA();
				_v48 = 0x20;
				_v56 = 2;
				_push( &_v56);
				_push(1);
				_push( &_v72);
				L0040139C();
				_v112 = 0x4031cc;
				_v120 = 0x8008;
				_push( &_v72);
				_t29 =  &_v120;
				_push(_t29);
				L004013F6();
				_v124 = _t29;
				_push( &_v72);
				_t31 =  &_v56;
				_push(_t31);
				_push(2);
				L00401426();
				_push(0x414ae3);
				L00401420();
				return _t31;
			}

0x00414a26
0x00414a35
0x00414a3f
0x00414a47
0x00414a4a
0x00414a51
0x00414a60
0x00414a69
0x00414a6e
0x00414a75
0x00414a7f
0x00414a80
0x00414a85
0x00414a86
0x00414a8b
0x00414a92
0x00414a9c
0x00414a9d
0x00414aa0
0x00414aa1
0x00414aa6
0x00414aad
0x00414aae
0x00414ab1
0x00414ab2
0x00414ab4
0x00414abc
0x00414add
0x00414ae2

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 00414A3F
__vbaVarDup.MSVBVM60(?,?,?,?,004012D6), ref: 00414A69
#607.MSVBVM60(?,00000001,00000002), ref: 00414A86
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00414AA1
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008008,?), ref: 00414AB4
__vbaFreeVar.MSVBVM60(00414AE3,?,?,004012D6), ref: 00414ADD

Strings

, xrefs: 00414A6E

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#607ChkstkList
String ID:
API String ID: 3712179512-3916222277
Opcode ID: 53290a62ab139c2d2725e1cdf041c45deccb0f2ac405eac291f3f68fca88666a
Instruction ID: 6547b3bded4da4c0c92a8bef2a71ed33809c94560ed752d3826096f670693c1f
Opcode Fuzzy Hash: 53290a62ab139c2d2725e1cdf041c45deccb0f2ac405eac291f3f68fca88666a
Instruction Fuzzy Hash: 56110D71800208ABDB00EFD1C946BDEBBBCEF04704F60846AF505BB1A1D7789A49CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041179E, Relevance: 10.5, APIs: 7, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041179E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v32;
				void* _v36;
				intOrPtr _v44;
				char _v52;
				short _v72;
				signed int _t21;
				short _t25;
				void* _t33;
				void* _t35;
				intOrPtr _t36;

				_t36 = _t35 - 0xc;
				 *[fs:0x0] = _t36;
				L004012D0();
				_v16 = _t36;
				_v12 = 0x4011e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4012d6, _t33);
				_v44 = 9;
				_v52 = 2;
				_t21 =  &_v52;
				_push(_t21);
				L004013DE();
				L0040142C();
				_push(_t21);
				_push(0x40312c);
				L004013E4();
				asm("sbb eax, eax");
				_v72 =  ~( ~( ~_t21));
				L0040144A();
				L00401420();
				_t25 = _v72;
				if(_t25 != 0) {
					_push(0x5a);
					L004013D8();
					_v32 = _t25;
				}
				_push(0x411851);
				return _t25;
			}

0x004117a1
0x004117b0
0x004117ba
0x004117c2
0x004117c5
0x004117cc
0x004117db
0x004117de
0x004117e5
0x004117ec
0x004117ef
0x004117f0
0x004117fa
0x004117ff
0x00411800
0x00411805
0x0041180c
0x00411812
0x00411819
0x00411821
0x00411826
0x0041182c
0x0041182e
0x00411830
0x00411835
0x00411835
0x00411838
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012D6), ref: 004117BA
#574.MSVBVM60(00000002), ref: 004117F0
__vbaStrMove.MSVBVM60(00000002), ref: 004117FA
__vbaStrCmp.MSVBVM60(0040312C,00000000,00000002), ref: 00411805
__vbaFreeStr.MSVBVM60(0040312C,00000000,00000002), ref: 00411819
__vbaFreeVar.MSVBVM60(0040312C,00000000,00000002), ref: 00411821
#568.MSVBVM60(0000005A,0040312C,00000000,00000002), ref: 00411830

Memory Dump Source

Source File: 00000000.00000002.1404306668.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1404287760.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1404394408.0000000000417000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1404411560.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#568#574ChkstkMove
String ID:
API String ID: 288442590-0
Opcode ID: 562a8b0cc701c990af4349e940b9cf9bc70db456b78de43bfa0aae9fa06d2ba0
Instruction ID: a05470d6a6a3e2698342afda85afe46dc23c7248a60e6f5aee4a59c444f478e9
Opcode Fuzzy Hash: 562a8b0cc701c990af4349e940b9cf9bc70db456b78de43bfa0aae9fa06d2ba0
Instruction Fuzzy Hash: DC113070950208AADB00EFA2C845BEE7BB8EF08744F50812AF401FB1E1DB7C99458B55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Proforma Invoice 1009745.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Proforma Invoice 1009745.exe PID: 7064 Parent PID: 5868

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Proforma Invoice 1009745.exe PID: 7064 Parent PID: 5868 Proforma Invoice 1009745.exeCOMMON

Executed Functions

Function 0040ECA4, Relevance: 315.4, APIs: 169, Strings: 10, Instructions: 2191COMMON

Function 00414372, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127COMMON

Function 00401480, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 622COMMON

Function 00405CF9, Relevance: 1.5, APIs: 1, Instructions: 226memoryCOMMON

Function 00405C25, Relevance: 1.4, APIs: 1, Instructions: 192memoryCOMMON

Function 0040ECA4, Relevance: 315.4, APIs: 169, Strings: 10, Instructions: 2191
COMMON

Function 00414372, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 127
COMMON

Function 00401480, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 622
COMMON

Function 00414DB3, Relevance: 86.1, APIs: 42, Strings: 7, Instructions: 343
COMMON

Function 004158F2, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 156
COMMON

Function 004113F9, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 150
COMMON

Function 00414810, Relevance: 29.8, APIs: 15, Strings: 2, Instructions: 66
COMMON

Function 00415319, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 148
COMMON

Function 004155D8, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 173
COMMON

Function 00414B02, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 109
COMMON

Function 004145A7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83
COMMON

Function 00411677, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77
COMMON

Function 00415B28, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75
COMMON

Function 00414714, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 69
COMMON

Function 0041492A, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62
COMMON

Function 00414C95, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72
COMMON

Function 00414A23, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Function 0041179E, Relevance: 10.5, APIs: 7, Instructions: 49
COMMON