Loading ...

Play interactive tourEdit tour

Analysis Report cigar.exe

Overview

General Information

Sample Name:cigar.exe
Analysis ID:356160
MD5:57261d6b5337c8d9f838617f2efd6c19
SHA1:9f2855adb0a71a6079bcbe73438e1212b51f0bed
SHA256:ee41c208f648cc461bf54a5d9e40040a25e51ebde8e9721937ca152d964bb10f

Most interesting Screenshot:

Detection

GuLoader
Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Detected RDTSC dummy instruction sequence (likely for instruction hammering)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cigar.exe (PID: 1088 cmdline: 'C:\Users\user\Desktop\cigar.exe' MD5: 57261D6B5337C8D9F838617F2EFD6C19)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: cigar.exe PID: 1088JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: cigar.exe PID: 1088JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: cigar.exeVirustotal: Detection: 22%Perma Link
      Source: cigar.exeReversingLabs: Detection: 17%

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: cigar.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

      System Summary:

      barindex
      Potential malicious icon foundShow sources
      Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
      Source: C:\Users\user\Desktop\cigar.exeProcess Stats: CPU usage > 98%
      Source: cigar.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: cigar.exe, 00000001.00000002.1158750477.00000000021E0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs cigar.exe
      Source: cigar.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal84.rans.troj.evad.winEXE@1/0@0/0
      Source: cigar.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\cigar.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\cigar.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: cigar.exeVirustotal: Detection: 22%
      Source: cigar.exeReversingLabs: Detection: 17%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: cigar.exe PID: 1088, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: cigar.exe PID: 1088, type: MEMORY
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_0040406A push ds; ret 1_2_00404078
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_00402E02 push ebx; ret 1_2_00402E03
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_0040642C push esi; retf 1_2_0040642D
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_004088B4 push ss; ret 1_2_004088D3
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_00406508 push esi; retf 1_2_00406509
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_00404B35 push esi; retf 1_2_00404B41
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_004065E8 push esi; retf 1_2_004065E9
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_00402D99 push ds; iretd 1_2_00402D9A
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022365BB push eax; ret 1_2_022365BC
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022321B8 push edx; ret 1_2_022321B9
      Source: C:\Users\user\Desktop\cigar.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Contains functionality to detect hardware virtualization (CPUID execution measurement)Show sources
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_02236D4F 1_2_02236D4F
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022315E0 1_2_022315E0
      Detected RDTSC dummy instruction sequence (likely for instruction hammering)Show sources
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235C68 second address: 0000000002235B72 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test bx, dx 0x0000000d cmp edx, ebx 0x0000000f cmp ah, FFFFFFF3h 0x00000012 test esi, BEA9A6B7h 0x00000018 jmp 00007F9F5087B95Ah 0x0000001a test bh, 00000010h 0x0000001d cmp ch, 00000030h 0x00000020 mov eax, 00000539h 0x00000025 test cx, ax 0x00000028 mov ecx, dword ptr [ebp+1Ch] 0x0000002b test cx, cx 0x0000002e mov edx, 8802EDACh 0x00000033 call 00007F9F5087B416h 0x00000038 jmp 00007F9F5087B95Ah 0x0000003a cmp ebx, ecx 0x0000003c push esi 0x0000003d push edx 0x0000003e push ecx 0x0000003f jmp 00007F9F5087B95Eh 0x00000041 test ah, bh 0x00000043 jmp 00007F9F5087B95Ah 0x00000045 test bh, dh 0x00000047 cmp eax, 00000539h 0x0000004c jne 00007F9F5087B9D6h 0x00000052 cmp dl, FFFFFF94h 0x00000055 test dl, dl 0x00000057 push 6DDB9555h 0x0000005c call 00007F9F5087BCA7h 0x00000061 mov eax, dword ptr fs:[00000030h] 0x00000067 cmp ch, bh 0x00000069 mov eax, dword ptr [eax+0Ch] 0x0000006c test dx, cx 0x0000006f mov eax, dword ptr [eax+14h] 0x00000072 pushad 0x00000073 rdtsc
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235B72 second address: 0000000002235B72 instructions:
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235C33 second address: 0000000002235C33 instructions:
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235CD1 second address: 0000000002235CD1 instructions:
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: cigar.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 000000000223026A second address: 0000000002230390 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 jmp 00007F9F50FF8EBEh 0x00000005 cmp bx, 6528h 0x0000000a mov ebp, esp 0x0000000c jmp 00007F9F50FF8EC2h 0x0000000e test dl, bl 0x00000010 jmp 00007F9F50FF8EBAh 0x00000012 test cx, bx 0x00000015 jmp 00007F9F50FF8EBEh 0x00000017 push ecx 0x00000018 jmp 00007F9F50FF8EEBh 0x0000001a call 00007F9F50FF8E7Ah 0x0000001f pop ecx 0x00000020 jmp ecx 0x00000022 pop ecx 0x00000023 call 00007F9F50FF8EA5h 0x00000028 jmp 00007F9F50FF8EBEh 0x0000002a cmp ecx, ebx 0x0000002c jmp 00007F9F50FF8EC2h 0x0000002e pushad 0x0000002f mov ecx, 000000FAh 0x00000034 rdtsc
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235C68 second address: 0000000002235B72 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a test bx, dx 0x0000000d cmp edx, ebx 0x0000000f cmp ah, FFFFFFF3h 0x00000012 test esi, BEA9A6B7h 0x00000018 jmp 00007F9F5087B95Ah 0x0000001a test bh, 00000010h 0x0000001d cmp ch, 00000030h 0x00000020 mov eax, 00000539h 0x00000025 test cx, ax 0x00000028 mov ecx, dword ptr [ebp+1Ch] 0x0000002b test cx, cx 0x0000002e mov edx, 8802EDACh 0x00000033 call 00007F9F5087B416h 0x00000038 jmp 00007F9F5087B95Ah 0x0000003a cmp ebx, ecx 0x0000003c push esi 0x0000003d push edx 0x0000003e push ecx 0x0000003f jmp 00007F9F5087B95Eh 0x00000041 test ah, bh 0x00000043 jmp 00007F9F5087B95Ah 0x00000045 test bh, dh 0x00000047 cmp eax, 00000539h 0x0000004c jne 00007F9F5087B9D6h 0x00000052 cmp dl, FFFFFF94h 0x00000055 test dl, dl 0x00000057 push 6DDB9555h 0x0000005c call 00007F9F5087BCA7h 0x00000061 mov eax, dword ptr fs:[00000030h] 0x00000067 cmp ch, bh 0x00000069 mov eax, dword ptr [eax+0Ch] 0x0000006c test dx, cx 0x0000006f mov eax, dword ptr [eax+14h] 0x00000072 pushad 0x00000073 rdtsc
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235B72 second address: 0000000002235B72 instructions:
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235C33 second address: 0000000002235C33 instructions:
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 0000000002235CD1 second address: 0000000002235CD1 instructions:
      Source: C:\Users\user\Desktop\cigar.exeRDTSC instruction interceptor: First address: 00000000022333D9 second address: 00000000022333D9 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F9F5087B969h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d jmp 00007F9F5087B95Ah 0x0000001f test cx, ax 0x00000022 test dx, cx 0x00000025 pop ecx 0x00000026 add edi, edx 0x00000028 cmp cx, 2037h 0x0000002d dec ecx 0x0000002e cmp ecx, E1F4F254h 0x00000034 cmp ecx, 00000000h 0x00000037 jne 00007F9F5087B908h 0x00000039 push ecx 0x0000003a call 00007F9F5087B9AEh 0x0000003f call 00007F9F5087B979h 0x00000044 lfence 0x00000047 mov edx, dword ptr [7FFE0014h] 0x0000004d lfence 0x00000050 ret 0x00000051 mov esi, edx 0x00000053 pushad 0x00000054 rdtsc
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_02236E30 rdtsc 1_2_02236E30
      Source: cigar.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_02236E30 rdtsc 1_2_02236E30
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_02235B60 mov eax, dword ptr fs:[00000030h]1_2_02235B60
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022355BA mov eax, dword ptr fs:[00000030h]1_2_022355BA
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022355D3 mov eax, dword ptr fs:[00000030h]1_2_022355D3
      Source: C:\Users\user\Desktop\cigar.exeCode function: 1_2_022331D4 mov eax, dword ptr fs:[00000030h]1_2_022331D4
      Source: cigar.exe, 00000001.00000002.1158697638.0000000000D90000.00000002.00000001.sdmpBinary or memory string: Program Manager
      Source: cigar.exe, 00000001.00000002.1158697638.0000000000D90000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: cigar.exe, 00000001.00000002.1158697638.0000000000D90000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: cigar.exe, 00000001.00000002.1158697638.0000000000D90000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Process Injection1OS Credential DumpingSecurity Software Discovery411Remote ServicesData from Local SystemExfiltration Over Other Network MediumData ObfuscationEavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery31SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      cigar.exe22%VirustotalBrowse
      cigar.exe11%MetadefenderBrowse
      cigar.exe17%ReversingLabsWin32.Trojan.Vebzenpak

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Emerald
      Analysis ID:356160
      Start date:22.02.2021
      Start time:17:24:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 6m 40s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:cigar.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:16
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal84.rans.troj.evad.winEXE@1/0@0/0
      EGA Information:
      • Successful, ratio: 100%
      HDC Information:
      • Successful, ratio: 38.9% (good quality ratio 29%)
      • Quality average: 42.6%
      • Quality standard deviation: 33.1%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):4.943112440364119
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:cigar.exe
      File size:61440
      MD5:57261d6b5337c8d9f838617f2efd6c19
      SHA1:9f2855adb0a71a6079bcbe73438e1212b51f0bed
      SHA256:ee41c208f648cc461bf54a5d9e40040a25e51ebde8e9721937ca152d964bb10f
      SHA512:a78e7cea98c8c47e05769beabfa0e75446ca04436ce24855a472fcd1359bb73a11c0e7e42b611c291a9f61e1736fc3a5b7e9d445209b2bf614389defd11efb4f
      SSDEEP:768:aZMuALMxEZYqNxh5Ran9a+Kge1eulY1Eu8cohd628fN6:fHCjqNj5Ral2l6Rdo
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....N.Y.....................0....................@................

      File Icon

      Icon Hash:20047c7c70f0e004

      Static PE Info

      General

      Entrypoint:0x4012c4
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x591E4E86 [Fri May 19 01:46:46 2017 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:f8fb5be8a6ea86fb9d04da61d8bfeb3a

      Entrypoint Preview

      Instruction
      push 004014FCh
      call 00007F9F51017913h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      inc eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add ch, bh
      push es
      mov edi, dword ptr [ecx+4D59FBEEh]
      test bl, bl
      int3
      dec ebp
      xlatb

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xc4440x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0xf0000x994.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xd0.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000xb8180xc000False0.468892415365data5.67760393294IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0xd0000x118c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0xf0000x9940x1000False0.17822265625data2.07916773939IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0xf8640x130data
      RT_ICON0xf57c0x2e8data
      RT_ICON0xf4540x128GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0xf4240x30data
      RT_VERSION0xf1500x2d4dataHungarianHungary

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaAryMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarDup, _CIatan, __vbaCastObj, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

      Version Infos

      DescriptionData
      Translation0x040e 0x04b0
      LegalCopyrightCopyright (C) AC
      InternalNamecigar
      FileVersion1.00
      CompanyNameAC
      LegalTrademarksCopyright (C) AC
      CommentsAC
      ProductNameAC
      ProductVersion1.00
      FileDescriptionAC
      OriginalFilenamecigar.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      HungarianHungary

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:17:24:43
      Start date:22/02/2021
      Path:C:\Users\user\Desktop\cigar.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\cigar.exe'
      Imagebase:0x400000
      File size:61440 bytes
      MD5 hash:57261D6B5337C8D9F838617F2EFD6C19
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Execution Graph

        Execution Coverage:3.5%
        Dynamic/Decrypted Code Coverage:1.1%
        Signature Coverage:0%
        Total number of Nodes:95
        Total number of Limit Nodes:17

        Graph

        execution_graph 5574 4098d1 5575 409888 5574->5575 5575->5575 5576 409c05 VirtualAlloc 5575->5576 5577 409e0a 5576->5577 5577->5577 5578 4012c4 #100 5579 40ac26 __vbaChkstk 5580 40ac71 __vbaVarDup #544 __vbaVarTstNe __vbaFreeVarList 5579->5580 5581 40aec1 5580->5581 5582 40acf5 5580->5582 5585 40aee5 __vbaObjSet 5581->5585 5586 40aeca __vbaNew2 5581->5586 5583 40ad19 __vbaObjSet 5582->5583 5584 40acfe __vbaNew2 5582->5584 5589 40ad64 5583->5589 5584->5583 5590 40af30 5585->5590 5586->5585 5591 40ad75 __vbaHresultCheckObj 5589->5591 5592 40ad98 5589->5592 5593 40af41 __vbaHresultCheckObj 5590->5593 5594 40af64 __vbaFreeStr __vbaFreeObj 5590->5594 5591->5592 5595 40adc3 5592->5595 5596 40ada8 __vbaNew2 5592->5596 5593->5594 5599 40afea __vbaObjSet 5594->5599 5600 40afcf __vbaNew2 5594->5600 5597 40adcd __vbaChkstk __vbaChkstk 5595->5597 5596->5597 5601 40ae49 5597->5601 5606 40b035 5599->5606 5600->5599 5602 40ae7a 5601->5602 5603 40ae5a __vbaHresultCheckObj 5601->5603 5604 40ae81 __vbaVar2Vec __vbaAryMove __vbaFreeObj __vbaFreeVarList 5602->5604 5603->5604 5604->5581 5607 40b046 __vbaHresultCheckObj 5606->5607 5608 40b069 5606->5608 5607->5608 5609 40b094 __vbaObjSet 5608->5609 5610 40b079 __vbaNew2 5608->5610 5612 40b0e2 5609->5612 5610->5609 5613 40b0f3 __vbaHresultCheckObj 5612->5613 5614 40b116 __vbaFreeObjList __vbaFreeVar 5612->5614 5613->5614 5616 40b1b2 __vbaObjSet 5614->5616 5617 40b197 __vbaNew2 5614->5617 5619 40b1fd 5616->5619 5617->5616 5620 40b231 __vbaVarMove __vbaFreeObj __vbaFreeVar 5619->5620 5621 40b20e __vbaHresultCheckObj 5619->5621 5623 40b2c6 5620->5623 5621->5620 5624 40b2f5 5623->5624 5625 40b2d5 __vbaHresultCheckObj 5623->5625 5626 40b329 __vbaObjSet 5624->5626 5627 40b30e __vbaNew2 5624->5627 5625->5624 5629 40b374 5626->5629 5627->5626 5630 40b3a5 5629->5630 5631 40b385 __vbaHresultCheckObj 5629->5631 5632 40b3d0 __vbaObjSet 5630->5632 5633 40b3b5 __vbaNew2 5630->5633 5631->5630 5635 40b41b 5632->5635 5633->5632 5636 40b44c __vbaFreeObjList 5635->5636 5637 40b42c __vbaHresultCheckObj 5635->5637 5639 40b4c2 __vbaObjSet 5636->5639 5640 40b4a7 __vbaNew2 5636->5640 5637->5636 5642 40b50d 5639->5642 5640->5639 5643 40b51e __vbaHresultCheckObj 5642->5643 5644 40b53e __vbaFreeObj 5642->5644 5643->5644 5646 40b596 5644->5646 5647 40b5c7 5646->5647 5648 40b5a7 __vbaHresultCheckObj 5646->5648 5649 40bac1 __vbaAryDestruct __vbaFreeVar 5647->5649 5650 40b609 5647->5650 5648->5647 5651 40b612 __vbaNew2 5650->5651 5652 40b62d __vbaObjSet 5650->5652 5651->5652 5655 40b678 5652->5655 5656 40b689 __vbaHresultCheckObj 5655->5656 5657 40b6ac 5655->5657 5656->5657 5658 40b6d7 __vbaObjSet 5657->5658 5659 40b6bc __vbaNew2 5657->5659 5661 40b725 5658->5661 5659->5658 5662 40b736 __vbaHresultCheckObj 5661->5662 5663 40b759 5661->5663 5662->5663 5664 40b784 __vbaObjSet 5663->5664 5665 40b769 __vbaNew2 5663->5665 5667 40b7d2 5664->5667 5665->5664 5668 40b7e3 __vbaHresultCheckObj 5667->5668 5669 40b806 5667->5669 5670 40b80d __vbaChkstk __vbaChkstk 5668->5670 5669->5670 5671 40b89c 5670->5671 5672 40b8cb 5671->5672 5673 40b8ab __vbaHresultCheckObj 5671->5673 5674 40b8d2 __vbaFreeObjList __vbaFreeVar 5672->5674 5673->5674 5675 40b902 __vbaNew2 5674->5675 5676 40b91d __vbaObjSet 5674->5676 5675->5676 5678 40b968 5676->5678 5679 40b999 5678->5679 5680 40b979 __vbaHresultCheckObj 5678->5680 5681 40ba1a 5679->5681 5682 40b9fa __vbaHresultCheckObj 5679->5682 5680->5679 5683 40ba21 __vbaFreeObj 5681->5683 5682->5683 5684 40ba74 5683->5684 5685 40baa3 5684->5685 5686 40ba83 __vbaHresultCheckObj 5684->5686 5686->5685

        Executed Functions

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 0 40ac24-40ac6b __vbaChkstk 1 40ac71-40acef __vbaVarDup #544 __vbaVarTstNe __vbaFreeVarList 0->1 2 40aec1-40aec8 1->2 3 40acf5-40acfc 1->3 6 40aee5 2->6 7 40aeca-40aee3 __vbaNew2 2->7 4 40ad19 3->4 5 40acfe-40ad17 __vbaNew2 3->5 8 40ad23-40ad73 __vbaObjSet 4->8 5->8 9 40aeef-40af3f __vbaObjSet 6->9 7->9 14 40ad75-40ad96 __vbaHresultCheckObj 8->14 15 40ad98 8->15 16 40af41-40af62 __vbaHresultCheckObj 9->16 17 40af64 9->17 18 40ad9f-40ada6 14->18 15->18 19 40af6b-40afcd __vbaFreeStr __vbaFreeObj 16->19 17->19 20 40adc3 18->20 21 40ada8-40adc1 __vbaNew2 18->21 24 40afea 19->24 25 40afcf-40afe8 __vbaNew2 19->25 22 40adcd-40ae58 __vbaChkstk * 2 20->22 21->22 28 40ae7a 22->28 29 40ae5a-40ae78 __vbaHresultCheckObj 22->29 27 40aff4-40b044 __vbaObjSet 24->27 25->27 33 40b046-40b067 __vbaHresultCheckObj 27->33 34 40b069 27->34 30 40ae81-40aebe __vbaVar2Vec __vbaAryMove __vbaFreeObj __vbaFreeVarList 28->30 29->30 30->2 35 40b070-40b077 33->35 34->35 36 40b094 35->36 37 40b079-40b092 __vbaNew2 35->37 38 40b09e-40b0f1 __vbaObjSet 36->38 37->38 41 40b0f3-40b114 __vbaHresultCheckObj 38->41 42 40b116 38->42 43 40b11d-40b195 __vbaFreeObjList __vbaFreeVar 41->43 42->43 45 40b1b2 43->45 46 40b197-40b1b0 __vbaNew2 43->46 47 40b1bc-40b20c __vbaObjSet 45->47 46->47 50 40b231 47->50 51 40b20e-40b22f __vbaHresultCheckObj 47->51 52 40b238-40b2d3 __vbaVarMove __vbaFreeObj __vbaFreeVar 50->52 51->52 55 40b2f5 52->55 56 40b2d5-40b2f3 __vbaHresultCheckObj 52->56 57 40b2fc-40b30c 55->57 56->57 58 40b329 57->58 59 40b30e-40b327 __vbaNew2 57->59 60 40b333-40b383 __vbaObjSet 58->60 59->60 63 40b3a5 60->63 64 40b385-40b3a3 __vbaHresultCheckObj 60->64 65 40b3ac-40b3b3 63->65 64->65 66 40b3d0 65->66 67 40b3b5-40b3ce __vbaNew2 65->67 68 40b3da-40b42a __vbaObjSet 66->68 67->68 71 40b44c 68->71 72 40b42c-40b44a __vbaHresultCheckObj 68->72 73 40b453-40b4a5 __vbaFreeObjList 71->73 72->73 75 40b4c2 73->75 76 40b4a7-40b4c0 __vbaNew2 73->76 77 40b4cc-40b51c __vbaObjSet 75->77 76->77 80 40b53e 77->80 81 40b51e-40b53c __vbaHresultCheckObj 77->81 82 40b545-40b56e 80->82 81->82 83 40b577-40b5a5 __vbaFreeObj 82->83 85 40b5c7 83->85 86 40b5a7-40b5c5 __vbaHresultCheckObj 83->86 87 40b5ce-40b603 85->87 86->87 89 40bac1-40bb33 __vbaAryDestruct __vbaFreeVar 87->89 90 40b609-40b610 87->90 91 40b612-40b62b __vbaNew2 90->91 92 40b62d 90->92 94 40b637-40b687 __vbaObjSet 91->94 92->94 98 40b689-40b6aa __vbaHresultCheckObj 94->98 99 40b6ac 94->99 100 40b6b3-40b6ba 98->100 99->100 101 40b6d7 100->101 102 40b6bc-40b6d5 __vbaNew2 100->102 103 40b6e1-40b734 __vbaObjSet 101->103 102->103 106 40b736-40b757 __vbaHresultCheckObj 103->106 107 40b759 103->107 108 40b760-40b767 106->108 107->108 109 40b784 108->109 110 40b769-40b782 __vbaNew2 108->110 111 40b78e-40b7e1 __vbaObjSet 109->111 110->111 114 40b7e3-40b804 __vbaHresultCheckObj 111->114 115 40b806 111->115 116 40b80d-40b8a9 __vbaChkstk * 2 114->116 115->116 118 40b8cb 116->118 119 40b8ab-40b8c9 __vbaHresultCheckObj 116->119 120 40b8d2-40b900 __vbaFreeObjList __vbaFreeVar 118->120 119->120 121 40b902-40b91b __vbaNew2 120->121 122 40b91d 120->122 123 40b927-40b977 __vbaObjSet 121->123 122->123 126 40b999 123->126 127 40b979-40b997 __vbaHresultCheckObj 123->127 128 40b9a0-40b9f8 126->128 127->128 130 40ba1a 128->130 131 40b9fa-40ba18 __vbaHresultCheckObj 128->131 132 40ba21-40ba81 __vbaFreeObj 130->132 131->132 134 40baa3 132->134 135 40ba83-40baa1 __vbaHresultCheckObj 132->135 136 40baaa-40babc 134->136 135->136
        C-Code - Quality: 60%
        			E0040AC24(void* __ebx, void* __edi, void* __esi, signed int _a4) {
        				signed int _v8;
        				intOrPtr _v12;
        				char** _v16;
        				intOrPtr _v28;
        				signed int _v32;
        				intOrPtr _v36;
        				intOrPtr _v40;
        				char _v44;
        				signed int _v48;
        				signed int _v52;
        				char _v56;
        				signed int* _v60;
        				signed int _v64;
        				void* _v76;
        				long long _v84;
        				char* _v88;
        				signed int _v92;
        				char _v96;
        				signed int _v100;
        				char _v104;
        				intOrPtr _v112;
        				char _v120;
        				char _v136;
        				char _v156;
        				char* _v164;
        				char _v172;
        				intOrPtr _v180;
        				char _v188;
        				char _v192;
        				void* _v196;
        				char* _v200;
        				char _v204;
        				char _v208;
        				char _v212;
        				char _v216;
        				char _v220;
        				intOrPtr _v224;
        				char _v228;
        				intOrPtr _v232;
        				char _v236;
        				signed int _v240;
        				signed int _v244;
        				signed int _v248;
        				signed int _v252;
        				intOrPtr* _v256;
        				signed int _v260;
        				signed int _v264;
        				intOrPtr _v268;
        				intOrPtr _v272;
        				signed int _v284;
        				signed int _v288;
        				signed int _v292;
        				void* _v296;
        				intOrPtr* _v300;
        				signed int _v304;
        				signed int* _v308;
        				signed int _v312;
        				intOrPtr* _v316;
        				signed int _v320;
        				intOrPtr* _v324;
        				signed int _v328;
        				intOrPtr* _v332;
        				signed int _v336;
        				intOrPtr* _v340;
        				signed int _v344;
        				signed int _v348;
        				intOrPtr* _v352;
        				signed int _v356;
        				intOrPtr* _v360;
        				signed int _v364;
        				intOrPtr* _v368;
        				signed int _v372;
        				signed int _v376;
        				intOrPtr* _v380;
        				signed int _v384;
        				intOrPtr* _v388;
        				signed int _v392;
        				intOrPtr* _v396;
        				signed int _v400;
        				signed int _v404;
        				intOrPtr* _v408;
        				signed int _v412;
        				signed int _v416;
        				signed int _v420;
        				void* _v440;
        				intOrPtr _v456;
        				char** _v460;
        				void* _v472;
        				signed int _t485;
        				signed int _t492;
        				signed int _t496;
        				signed int _t508;
        				signed int _t512;
        				signed int _t516;
        				signed int _t520;
        				signed int _t533;
        				signed int _t537;
        				signed int _t549;
        				signed int _t554;
        				signed int _t558;
        				signed int _t562;
        				signed int _t566;
        				signed int _t578;
        				signed int _t582;
        				signed int _t590;
        				char* _t593;
        				signed int _t597;
        				signed int _t601;
        				signed int _t605;
        				signed int _t609;
        				char* _t613;
        				signed int _t617;
        				signed int _t627;
        				signed int _t634;
        				signed int _t638;
        				signed int _t643;
        				signed int _t649;
        				signed int _t653;
        				signed int _t655;
        				signed int _t657;
        				char* _t658;
        				signed int _t664;
        				signed int _t668;
        				signed int _t678;
        				void* _t685;
        				intOrPtr _t697;
        				intOrPtr _t713;
        				intOrPtr _t726;
        				intOrPtr _t730;
        				char* _t731;
        				char** _t745;
        				char* _t750;
        				void* _t753;
        				void* _t754;
        				void* _t756;
        				char** _t757;
        				char** _t758;
        				char** _t759;
        				char** _t760;
        
        				_t685 = __ebx;
        				_t754 = _t756;
        				asm("in al, dx");
        				_t757 = _t756 - 0xc;
        				 *[fs:0x0] = _t757;
        				L00401190();
        				_v16 = _t757;
        				_v12 = 0x4010f8;
        				_v8 = _a4 & 0x00000001;
        				_a4 = _a4 & 0xfffffffe;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401196, _t753);
        				_v164 = L"19:19:19";
        				_v172 = 8;
        				L00401298();
        				_push( &_v120);
        				_push( &_v136); // executed
        				L0040129E(); // executed
        				_v180 = 0x13;
        				_v188 = 0x8002;
        				_push( &_v136);
        				_t485 =  &_v188;
        				_push(_t485);
        				L004012A4();
        				_v240 = _t485;
        				_push( &_v136);
        				_push( &_v120);
        				_push(2);
        				L00401292();
        				_t758 =  &(_t757[3]);
        				if(_v240 != 0) {
        					if( *0x40d010 != 0) {
        						_v300 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v300 = 0x40d010;
        					}
        					_t664 =  &_v96;
        					L0040128C();
        					_v240 = _t664;
        					_t668 =  *((intOrPtr*)( *_v240 + 0x108))(_v240,  &_v92, _t664,  *((intOrPtr*)( *((intOrPtr*)( *_v300)) + 0x314))( *_v300));
        					asm("fclex");
        					_v244 = _t668;
        					if(_v244 >= 0) {
        						_t40 =  &_v304;
        						 *_t40 = _v304 & 0x00000000;
        						__eflags =  *_t40;
        					} else {
        						_push(0x108);
        						_push(0x401cc8);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v304 = _t668;
        					}
        					if( *0x40d33c != 0) {
        						_v308 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf8);
        						L00401286();
        						_v308 = 0x40d33c;
        					}
        					_v248 =  *_v308;
        					_v284 = _v92;
        					_v92 = _v92 & 0x00000000;
        					_v112 = _v284;
        					_v120 = 8;
        					_v164 = 0xe3;
        					_v172 = 2;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t678 =  *((intOrPtr*)( *_v248 + 0x38))(_v248, 0x10, 0x10,  &_v136);
        					asm("fclex");
        					_v252 = _t678;
        					if(_v252 >= 0) {
        						_t66 =  &_v312;
        						 *_t66 = _v312 & 0x00000000;
        						__eflags =  *_t66;
        					} else {
        						_push(0x38);
        						_push(0x401ce8);
        						_push(_v248);
        						_push(_v252);
        						L00401280();
        						_v312 = _t678;
        					}
        					_push( &_v136);
        					_push( &_v156);
        					L00401274();
        					_push( &_v156);
        					_push( &_v56);
        					L0040127A();
        					L0040126E();
        					_push( &_v136);
        					_push( &_v120);
        					_push(2);
        					L00401292();
        					_t758 =  &(_t758[3]);
        				}
        				if( *0x40d010 != 0) {
        					_v316 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v316 = 0x40d010;
        				}
        				_t492 =  &_v96;
        				L0040128C();
        				_v240 = _t492;
        				_t496 =  *((intOrPtr*)( *_v240 + 0x158))(_v240,  &_v92, _t492,  *((intOrPtr*)( *((intOrPtr*)( *_v316)) + 0x300))( *_v316));
        				asm("fclex");
        				_v244 = _t496;
        				if(_v244 >= 0) {
        					_t91 =  &_v320;
        					 *_t91 = _v320 & 0x00000000;
        					__eflags =  *_t91;
        				} else {
        					_push(0x158);
        					_push(0x401d08);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v320 = _t496;
        				}
        				_v192 = 0x633;
        				_v200 = 0x1e68d1;
        				 *((intOrPtr*)( *_a4 + 0x70c))(_a4, _v92,  &_v200,  &_v192,  &_v220);
        				_v48 = _v220;
        				_v44 = _v216;
        				L00401268();
        				L0040126E();
        				if( *0x40d010 != 0) {
        					_v324 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v324 = 0x40d010;
        				}
        				_t508 =  &_v96;
        				L0040128C();
        				_v240 = _t508;
        				_t512 =  *((intOrPtr*)( *_v240 + 0xf8))(_v240,  &_v100, _t508,  *((intOrPtr*)( *((intOrPtr*)( *_v324)) + 0x300))( *_v324));
        				asm("fclex");
        				_v244 = _t512;
        				if(_v244 >= 0) {
        					_t124 =  &_v328;
        					 *_t124 = _v328 & 0x00000000;
        					__eflags =  *_t124;
        				} else {
        					_push(0xf8);
        					_push(0x401d08);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v328 = _t512;
        				}
        				if( *0x40d010 != 0) {
        					_v332 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v332 = 0x40d010;
        				}
        				_t697 =  *((intOrPtr*)( *_v332));
        				_t516 =  &_v104;
        				L0040128C();
        				_v248 = _t516;
        				_t520 =  *((intOrPtr*)( *_v248 + 0x88))(_v248,  &_v200, _t516,  *((intOrPtr*)(_t697 + 0x310))( *_v332));
        				asm("fclex");
        				_v252 = _t520;
        				if(_v252 >= 0) {
        					_t142 =  &_v336;
        					 *_t142 = _v336 & 0x00000000;
        					__eflags =  *_t142;
        				} else {
        					_push(0x88);
        					_push(0x401d18);
        					_push(_v248);
        					_push(_v252);
        					L00401280();
        					_v336 = _t520;
        				}
        				_v204 =  *0x4010f0;
        				_v288 = _v100;
        				_v100 = _v100 & 0x00000000;
        				_v112 = _v288;
        				_v120 = 9;
        				 *_t758 = _v200;
        				 *_t758 =  *0x4010e8;
        				 *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v120, _t697, _t697,  &_v204, _t697);
        				_push( &_v104);
        				_push( &_v96);
        				_push(2);
        				L00401262();
        				_t759 =  &(_t758[3]);
        				L0040125C();
        				if( *0x40d010 != 0) {
        					_v340 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v340 = 0x40d010;
        				}
        				_t533 =  &_v96;
        				L0040128C();
        				_v240 = _t533;
        				_t537 =  *((intOrPtr*)( *_v240 + 0x170))(_v240,  &_v92, _t533,  *((intOrPtr*)( *((intOrPtr*)( *_v340)) + 0x30c))( *_v340));
        				asm("fclex");
        				_v244 = _t537;
        				if(_v244 >= 0) {
        					_t177 =  &_v344;
        					 *_t177 = _v344 & 0x00000000;
        					__eflags =  *_t177;
        				} else {
        					_push(0x170);
        					_push(0x401d28);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v344 = _t537;
        				}
        				_v292 = _v92;
        				_v92 = _v92 & 0x00000000;
        				_v112 = _v292;
        				_v120 = 8;
        				_v220 = 0xc96ed9a0;
        				_v216 = 0x5b01;
        				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v220, 0x7cbc2ca0, 0x5afe,  &_v120,  &_v136);
        				L00401256();
        				L0040126E();
        				L0040125C();
        				_t549 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v200);
        				_v240 = _t549;
        				if(_v240 >= 0) {
        					_t207 =  &_v348;
        					 *_t207 = _v348 & 0x00000000;
        					__eflags =  *_t207;
        				} else {
        					_push(0x6f8);
        					_push(0x401b4c);
        					_push(_a4);
        					_push(_v240);
        					L00401280();
        					_v348 = _t549;
        				}
        				_v88 = _v200;
        				if( *0x40d010 != 0) {
        					_v352 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v352 = 0x40d010;
        				}
        				_t554 =  &_v96;
        				L0040128C();
        				_v240 = _t554;
        				_t558 =  *((intOrPtr*)( *_v240 + 0x50))(_v240,  &_v192, _t554,  *((intOrPtr*)( *((intOrPtr*)( *_v352)) + 0x310))( *_v352));
        				asm("fclex");
        				_v244 = _t558;
        				if(_v244 >= 0) {
        					_t227 =  &_v356;
        					 *_t227 = _v356 & 0x00000000;
        					__eflags =  *_t227;
        				} else {
        					_push(0x50);
        					_push(0x401d18);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v356 = _t558;
        				}
        				if( *0x40d010 != 0) {
        					_v360 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v360 = 0x40d010;
        				}
        				_t562 =  &_v100;
        				L0040128C();
        				_v248 = _t562;
        				_t566 =  *((intOrPtr*)( *_v248 + 0x78))(_v248,  &_v200, _t562,  *((intOrPtr*)( *((intOrPtr*)( *_v360)) + 0x30c))( *_v360));
        				asm("fclex");
        				_v252 = _t566;
        				if(_v252 >= 0) {
        					_t245 =  &_v364;
        					 *_t245 = _v364 & 0x00000000;
        					__eflags =  *_t245;
        				} else {
        					_push(0x78);
        					_push(0x401d28);
        					_push(_v248);
        					_push(_v252);
        					L00401280();
        					_v364 = _t566;
        				}
        				_v204 = _v200;
        				 *((intOrPtr*)( *_a4 + 0x718))(_a4, _v192,  &_v204,  &_v196);
        				_v60 = _v196;
        				_push( &_v100);
        				_push( &_v96);
        				_push(2);
        				L00401262();
        				_t760 =  &(_t759[3]);
        				if( *0x40d010 != 0) {
        					_v368 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v368 = 0x40d010;
        				}
        				_t713 =  *((intOrPtr*)( *_v368));
        				_t578 =  &_v96;
        				L0040128C();
        				_v240 = _t578;
        				_t582 =  *((intOrPtr*)( *_v240 + 0x68))(_v240,  &_v200, _t578,  *((intOrPtr*)(_t713 + 0x30c))( *_v368));
        				asm("fclex");
        				_v244 = _t582;
        				if(_v244 >= 0) {
        					_t275 =  &_v372;
        					 *_t275 = _v372 & 0x00000000;
        					__eflags =  *_t275;
        				} else {
        					_push(0x68);
        					_push(0x401d28);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v372 = _t582;
        				}
        				_v220 =  *0x4010e0;
        				_v296 = _v200;
        				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v220, _t713,  &_v228);
        				_v84 = _v228;
        				L0040126E();
        				_t590 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
        				asm("fclex");
        				_v240 = _t590;
        				if(_v240 >= 0) {
        					_t295 =  &_v376;
        					 *_t295 = _v376 & 0x00000000;
        					__eflags =  *_t295;
        				} else {
        					_push(0x2b4);
        					_push(0x401b1c);
        					_push(_a4);
        					_push(_v240);
        					L00401280();
        					_v376 = _t590;
        				}
        				_v272 = 0x5ae61;
        				_v268 = 1;
        				_v32 = _v32 & 0x00000000;
        				while(_v32 <= _v272) {
        					if( *0x40d010 != 0) {
        						_v380 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v380 = 0x40d010;
        					}
        					_t597 =  &_v96;
        					L0040128C();
        					_v240 = _t597;
        					_t601 =  *((intOrPtr*)( *_v240 + 0x218))(_v240,  &_v92, _t597,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x308))( *_v380));
        					asm("fclex");
        					_v244 = _t601;
        					if(_v244 >= 0) {
        						_t322 =  &_v384;
        						 *_t322 = _v384 & 0x00000000;
        						__eflags =  *_t322;
        					} else {
        						_push(0x218);
        						_push(0x401d38);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v384 = _t601;
        					}
        					if( *0x40d010 != 0) {
        						_v388 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v388 = 0x40d010;
        					}
        					_t605 =  &_v100;
        					L0040128C();
        					_v248 = _t605;
        					_t609 =  *((intOrPtr*)( *_v248 + 0x138))(_v248,  &_v200, _t605,  *((intOrPtr*)( *((intOrPtr*)( *_v388)) + 0x30c))( *_v388));
        					asm("fclex");
        					_v252 = _t609;
        					if(_v252 >= 0) {
        						_t340 =  &_v392;
        						 *_t340 = _v392 & 0x00000000;
        						__eflags =  *_t340;
        					} else {
        						_push(0x138);
        						_push(0x401d28);
        						_push(_v248);
        						_push(_v252);
        						L00401280();
        						_v392 = _t609;
        					}
        					if( *0x40d010 != 0) {
        						_v396 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v396 = 0x40d010;
        					}
        					_t726 =  *((intOrPtr*)( *_v396));
        					_t613 =  &_v104;
        					L0040128C();
        					_v256 = _t613;
        					_t617 =  *((intOrPtr*)( *_v256 + 0x188))(_v256,  &_v204, _t613,  *((intOrPtr*)(_t726 + 0x300))( *_v396));
        					asm("fclex");
        					_v260 = _t617;
        					if(_v260 >= 0) {
        						_t358 =  &_v400;
        						 *_t358 = _v400 & 0x00000000;
        						__eflags =  *_t358;
        					} else {
        						_push(0x188);
        						_push(0x401d08);
        						_push(_v256);
        						_push(_v260);
        						L00401280();
        						_v400 = _t617;
        					}
        					_v164 = _v200;
        					_v172 = 3;
        					_v296 = _v92;
        					_v92 = _v92 & 0x00000000;
        					_v112 = _v296;
        					_v120 = 8;
        					_v208 = 0x8227e0;
        					_v384 =  *0x4010d8;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					_t750 =  &_v120;
        					_t745 = _t760;
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t627 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v208, 0x10, 0x10, _t726, _t726, _v204,  &_v212);
        					_v264 = _t627;
        					if(_v264 >= 0) {
        						_t384 =  &_v404;
        						 *_t384 = _v404 & 0x00000000;
        						__eflags =  *_t384;
        					} else {
        						_push(0x6fc);
        						_push(0x401b4c);
        						_push(_a4);
        						_push(_v264);
        						L00401280();
        						_v404 = _t627;
        					}
        					_v28 = _v212;
        					_push( &_v104);
        					_push( &_v100);
        					_push( &_v96);
        					_push(3);
        					L00401262();
        					_t760 =  &(_t760[4]);
        					L0040125C();
        					if( *0x40d010 != 0) {
        						_v408 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v408 = 0x40d010;
        					}
        					_t730 =  *((intOrPtr*)( *_v408));
        					_t634 =  &_v96;
        					L0040128C();
        					_v240 = _t634;
        					_t638 =  *((intOrPtr*)( *_v240 + 0x70))(_v240,  &_v200, _t634,  *((intOrPtr*)(_t730 + 0x310))( *_v408));
        					asm("fclex");
        					_v244 = _t638;
        					if(_v244 >= 0) {
        						_t408 =  &_v412;
        						 *_t408 = _v412 & 0x00000000;
        						__eflags =  *_t408;
        					} else {
        						_push(0x70);
        						_push(0x401d18);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v412 = _t638;
        					}
        					_v228 =  *0x4010d0;
        					_v220 = 0x445fc8f0;
        					_v216 = 0x5af7;
        					 *_t760 = _v200;
        					_t643 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v220, _t730,  &_v228, 0xf6292);
        					_v248 = _t643;
        					if(_v248 >= 0) {
        						_t424 =  &_v416;
        						 *_t424 = _v416 & 0x00000000;
        						__eflags =  *_t424;
        					} else {
        						_push(0x700);
        						_push(0x401b4c);
        						_push(_a4);
        						_push(_v248);
        						L00401280();
        						_v416 = _t643;
        					}
        					_t731 =  &_v96;
        					L0040126E();
        					_v228 = 0xde5a6cd0;
        					_v224 = 0x5af7;
        					_v220 = 0xc72725d0;
        					_v216 = 0x5afc;
        					_t649 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v220,  &_v228,  &_v236);
        					_v240 = _t649;
        					if(_v240 >= 0) {
        						_t442 =  &_v420;
        						 *_t442 = _v420 & 0x00000000;
        						__eflags =  *_t442;
        					} else {
        						_push(0x704);
        						_push(0x401b4c);
        						_push(_a4);
        						_push(_v240);
        						L00401280();
        						_v420 = _t649;
        					}
        					_v40 = _v236;
        					_v36 = _v232;
        					_t653 = _v32 + _v268;
        					if(_t653 < 0) {
        						L0040124A();
        						_push(_t754);
        						_push(_t731);
        						_push(_t731);
        						_push(0x401196);
        						_push( *[fs:0x0]);
        						 *[fs:0x0] = _t760;
        						_t655 = 0x28;
        						L00401190();
        						_push(_t685);
        						_push(_t750);
        						_push(_t745);
        						_v460 = _t760;
        						_v456 = 0x401110;
        						L00401244();
        						asm("fldz");
        						L00401214();
        						L0040123E();
        						asm("fcomp qword [0x401108]");
        						asm("fnstsw ax");
        						asm("sahf");
        						if(__eflags != 0) {
        							__eflags =  *0x40d33c;
        							if( *0x40d33c != 0) {
        								_v60 = 0x40d33c;
        							} else {
        								_push(0x40d33c);
        								_push(0x401cf8);
        								L00401286();
        								_v60 = 0x40d33c;
        							}
        							_t657 =  *_v60;
        							_v48 = _t657;
        							L00401238();
        							_t658 =  &_v44;
        							L0040128C();
        							_t655 =  *((intOrPtr*)( *_v48 + 0x40))(_v48, _t658, _t658, _t657, _v32, 0x401d60, L"Filmbyer");
        							asm("fclex");
        							_v52 = _t655;
        							__eflags = _v52;
        							if(_v52 >= 0) {
        								_t468 =  &_v64;
        								 *_t468 = _v64 & 0x00000000;
        								__eflags =  *_t468;
        							} else {
        								_push(0x40);
        								_push(0x401ce8);
        								_push(_v48);
        								_push(_v52);
        								L00401280();
        								_v64 = _t655;
        							}
        							L0040126E();
        						}
        						asm("wait");
        						_push(E0040BC53);
        						L00401268();
        						L0040126E();
        						return _t655;
        					} else {
        						_v32 = _t653;
        						continue;
        					}
        					L114:
        				}
        				 *((intOrPtr*)(0x278681 + _v312))(0x19129e);
        				_push(E0040BB34);
        				_t593 =  &_v56;
        				_push(_t593);
        				_push(0);
        				L00401250();
        				L0040125C();
        				return _t593;
        				goto L114;
        			}














































































































































        0x0040ac24
        0x0040ac25
        0x0040ac26
        0x0040ac27
        0x0040ac36
        0x0040ac42
        0x0040ac4a
        0x0040ac4d
        0x0040ac5a
        0x0040ac63
        0x0040ac6e
        0x0040ac71
        0x0040ac7b
        0x0040ac8e
        0x0040ac96
        0x0040ac9d
        0x0040ac9e
        0x0040aca3
        0x0040acad
        0x0040acbd
        0x0040acbe
        0x0040acc4
        0x0040acc5
        0x0040acca
        0x0040acd7
        0x0040acdb
        0x0040acdc
        0x0040acde
        0x0040ace3
        0x0040acef
        0x0040acfc
        0x0040ad19
        0x0040acfe
        0x0040acfe
        0x0040ad03
        0x0040ad08
        0x0040ad0d
        0x0040ad0d
        0x0040ad3d
        0x0040ad41
        0x0040ad46
        0x0040ad5e
        0x0040ad64
        0x0040ad66
        0x0040ad73
        0x0040ad98
        0x0040ad98
        0x0040ad98
        0x0040ad75
        0x0040ad75
        0x0040ad7a
        0x0040ad7f
        0x0040ad85
        0x0040ad8b
        0x0040ad90
        0x0040ad90
        0x0040ada6
        0x0040adc3
        0x0040ada8
        0x0040ada8
        0x0040adad
        0x0040adb2
        0x0040adb7
        0x0040adb7
        0x0040add5
        0x0040adde
        0x0040ade4
        0x0040adee
        0x0040adf1
        0x0040adf8
        0x0040ae02
        0x0040ae16
        0x0040ae20
        0x0040ae21
        0x0040ae22
        0x0040ae23
        0x0040ae27
        0x0040ae34
        0x0040ae35
        0x0040ae36
        0x0040ae37
        0x0040ae46
        0x0040ae49
        0x0040ae4b
        0x0040ae58
        0x0040ae7a
        0x0040ae7a
        0x0040ae7a
        0x0040ae5a
        0x0040ae5a
        0x0040ae5c
        0x0040ae61
        0x0040ae67
        0x0040ae6d
        0x0040ae72
        0x0040ae72
        0x0040ae87
        0x0040ae8e
        0x0040ae8f
        0x0040ae9a
        0x0040ae9e
        0x0040ae9f
        0x0040aea7
        0x0040aeb2
        0x0040aeb6
        0x0040aeb7
        0x0040aeb9
        0x0040aebe
        0x0040aebe
        0x0040aec8
        0x0040aee5
        0x0040aeca
        0x0040aeca
        0x0040aecf
        0x0040aed4
        0x0040aed9
        0x0040aed9
        0x0040af09
        0x0040af0d
        0x0040af12
        0x0040af2a
        0x0040af30
        0x0040af32
        0x0040af3f
        0x0040af64
        0x0040af64
        0x0040af64
        0x0040af41
        0x0040af41
        0x0040af46
        0x0040af4b
        0x0040af51
        0x0040af57
        0x0040af5c
        0x0040af5c
        0x0040af6b
        0x0040af74
        0x0040af9e
        0x0040afaa
        0x0040afb3
        0x0040afb9
        0x0040afc1
        0x0040afcd
        0x0040afea
        0x0040afcf
        0x0040afcf
        0x0040afd4
        0x0040afd9
        0x0040afde
        0x0040afde
        0x0040b00e
        0x0040b012
        0x0040b017
        0x0040b02f
        0x0040b035
        0x0040b037
        0x0040b044
        0x0040b069
        0x0040b069
        0x0040b069
        0x0040b046
        0x0040b046
        0x0040b04b
        0x0040b050
        0x0040b056
        0x0040b05c
        0x0040b061
        0x0040b061
        0x0040b077
        0x0040b094
        0x0040b079
        0x0040b079
        0x0040b07e
        0x0040b083
        0x0040b088
        0x0040b088
        0x0040b0ae
        0x0040b0b8
        0x0040b0bc
        0x0040b0c1
        0x0040b0dc
        0x0040b0e2
        0x0040b0e4
        0x0040b0f1
        0x0040b116
        0x0040b116
        0x0040b116
        0x0040b0f3
        0x0040b0f3
        0x0040b0f8
        0x0040b0fd
        0x0040b103
        0x0040b109
        0x0040b10e
        0x0040b10e
        0x0040b123
        0x0040b12c
        0x0040b132
        0x0040b13c
        0x0040b13f
        0x0040b14d
        0x0040b15f
        0x0040b16e
        0x0040b177
        0x0040b17b
        0x0040b17c
        0x0040b17e
        0x0040b183
        0x0040b189
        0x0040b195
        0x0040b1b2
        0x0040b197
        0x0040b197
        0x0040b19c
        0x0040b1a1
        0x0040b1a6
        0x0040b1a6
        0x0040b1d6
        0x0040b1da
        0x0040b1df
        0x0040b1f7
        0x0040b1fd
        0x0040b1ff
        0x0040b20c
        0x0040b231
        0x0040b231
        0x0040b231
        0x0040b20e
        0x0040b20e
        0x0040b213
        0x0040b218
        0x0040b21e
        0x0040b224
        0x0040b229
        0x0040b229
        0x0040b23b
        0x0040b241
        0x0040b24b
        0x0040b24e
        0x0040b255
        0x0040b25f
        0x0040b28d
        0x0040b29c
        0x0040b2a4
        0x0040b2ac
        0x0040b2c0
        0x0040b2c6
        0x0040b2d3
        0x0040b2f5
        0x0040b2f5
        0x0040b2f5
        0x0040b2d5
        0x0040b2d5
        0x0040b2da
        0x0040b2df
        0x0040b2e2
        0x0040b2e8
        0x0040b2ed
        0x0040b2ed
        0x0040b302
        0x0040b30c
        0x0040b329
        0x0040b30e
        0x0040b30e
        0x0040b313
        0x0040b318
        0x0040b31d
        0x0040b31d
        0x0040b34d
        0x0040b351
        0x0040b356
        0x0040b371
        0x0040b374
        0x0040b376
        0x0040b383
        0x0040b3a5
        0x0040b3a5
        0x0040b3a5
        0x0040b385
        0x0040b385
        0x0040b387
        0x0040b38c
        0x0040b392
        0x0040b398
        0x0040b39d
        0x0040b39d
        0x0040b3b3
        0x0040b3d0
        0x0040b3b5
        0x0040b3b5
        0x0040b3ba
        0x0040b3bf
        0x0040b3c4
        0x0040b3c4
        0x0040b3f4
        0x0040b3f8
        0x0040b3fd
        0x0040b418
        0x0040b41b
        0x0040b41d
        0x0040b42a
        0x0040b44c
        0x0040b44c
        0x0040b44c
        0x0040b42c
        0x0040b42c
        0x0040b42e
        0x0040b433
        0x0040b439
        0x0040b43f
        0x0040b444
        0x0040b444
        0x0040b459
        0x0040b47b
        0x0040b488
        0x0040b48f
        0x0040b493
        0x0040b494
        0x0040b496
        0x0040b49b
        0x0040b4a5
        0x0040b4c2
        0x0040b4a7
        0x0040b4a7
        0x0040b4ac
        0x0040b4b1
        0x0040b4b6
        0x0040b4b6
        0x0040b4dc
        0x0040b4e6
        0x0040b4ea
        0x0040b4ef
        0x0040b50a
        0x0040b50d
        0x0040b50f
        0x0040b51c
        0x0040b53e
        0x0040b53e
        0x0040b53e
        0x0040b51e
        0x0040b51e
        0x0040b520
        0x0040b525
        0x0040b52b
        0x0040b531
        0x0040b536
        0x0040b536
        0x0040b54b
        0x0040b55f
        0x0040b571
        0x0040b57d
        0x0040b583
        0x0040b590
        0x0040b596
        0x0040b598
        0x0040b5a5
        0x0040b5c7
        0x0040b5c7
        0x0040b5c7
        0x0040b5a7
        0x0040b5a7
        0x0040b5ac
        0x0040b5b1
        0x0040b5b4
        0x0040b5ba
        0x0040b5bf
        0x0040b5bf
        0x0040b5ce
        0x0040b5d8
        0x0040b5e2
        0x0040b5fa
        0x0040b610
        0x0040b62d
        0x0040b612
        0x0040b612
        0x0040b617
        0x0040b61c
        0x0040b621
        0x0040b621
        0x0040b651
        0x0040b655
        0x0040b65a
        0x0040b672
        0x0040b678
        0x0040b67a
        0x0040b687
        0x0040b6ac
        0x0040b6ac
        0x0040b6ac
        0x0040b689
        0x0040b689
        0x0040b68e
        0x0040b693
        0x0040b699
        0x0040b69f
        0x0040b6a4
        0x0040b6a4
        0x0040b6ba
        0x0040b6d7
        0x0040b6bc
        0x0040b6bc
        0x0040b6c1
        0x0040b6c6
        0x0040b6cb
        0x0040b6cb
        0x0040b6fb
        0x0040b6ff
        0x0040b704
        0x0040b71f
        0x0040b725
        0x0040b727
        0x0040b734
        0x0040b759
        0x0040b759
        0x0040b759
        0x0040b736
        0x0040b736
        0x0040b73b
        0x0040b740
        0x0040b746
        0x0040b74c
        0x0040b751
        0x0040b751
        0x0040b767
        0x0040b784
        0x0040b769
        0x0040b769
        0x0040b76e
        0x0040b773
        0x0040b778
        0x0040b778
        0x0040b79e
        0x0040b7a8
        0x0040b7ac
        0x0040b7b1
        0x0040b7cc
        0x0040b7d2
        0x0040b7d4
        0x0040b7e1
        0x0040b806
        0x0040b806
        0x0040b806
        0x0040b7e3
        0x0040b7e3
        0x0040b7e8
        0x0040b7ed
        0x0040b7f3
        0x0040b7f9
        0x0040b7fe
        0x0040b7fe
        0x0040b813
        0x0040b819
        0x0040b826
        0x0040b82c
        0x0040b836
        0x0040b839
        0x0040b840
        0x0040b85f
        0x0040b865
        0x0040b872
        0x0040b873
        0x0040b874
        0x0040b875
        0x0040b879
        0x0040b87e
        0x0040b881
        0x0040b883
        0x0040b884
        0x0040b885
        0x0040b886
        0x0040b896
        0x0040b89c
        0x0040b8a9
        0x0040b8cb
        0x0040b8cb
        0x0040b8cb
        0x0040b8ab
        0x0040b8ab
        0x0040b8b0
        0x0040b8b5
        0x0040b8b8
        0x0040b8be
        0x0040b8c3
        0x0040b8c3
        0x0040b8d8
        0x0040b8de
        0x0040b8e2
        0x0040b8e6
        0x0040b8e7
        0x0040b8e9
        0x0040b8ee
        0x0040b8f4
        0x0040b900
        0x0040b91d
        0x0040b902
        0x0040b902
        0x0040b907
        0x0040b90c
        0x0040b911
        0x0040b911
        0x0040b937
        0x0040b941
        0x0040b945
        0x0040b94a
        0x0040b965
        0x0040b968
        0x0040b96a
        0x0040b977
        0x0040b999
        0x0040b999
        0x0040b999
        0x0040b979
        0x0040b979
        0x0040b97b
        0x0040b980
        0x0040b986
        0x0040b98c
        0x0040b991
        0x0040b991
        0x0040b9a6
        0x0040b9ac
        0x0040b9b6
        0x0040b9d3
        0x0040b9e5
        0x0040b9eb
        0x0040b9f8
        0x0040ba1a
        0x0040ba1a
        0x0040ba1a
        0x0040b9fa
        0x0040b9fa
        0x0040b9ff
        0x0040ba04
        0x0040ba07
        0x0040ba0d
        0x0040ba12
        0x0040ba12
        0x0040ba21
        0x0040ba24
        0x0040ba29
        0x0040ba33
        0x0040ba3d
        0x0040ba47
        0x0040ba6e
        0x0040ba74
        0x0040ba81
        0x0040baa3
        0x0040baa3
        0x0040baa3
        0x0040ba83
        0x0040ba83
        0x0040ba88
        0x0040ba8d
        0x0040ba90
        0x0040ba96
        0x0040ba9b
        0x0040ba9b
        0x0040bab0
        0x0040bab9
        0x0040b5eb
        0x0040b5f1
        0x0040bb53
        0x0040bb58
        0x0040bb5b
        0x0040bb5c
        0x0040bb5d
        0x0040bb68
        0x0040bb69
        0x0040bb72
        0x0040bb73
        0x0040bb78
        0x0040bb79
        0x0040bb7a
        0x0040bb7b
        0x0040bb7e
        0x0040bb8b
        0x0040bb90
        0x0040bb92
        0x0040bb97
        0x0040bb9c
        0x0040bba2
        0x0040bba4
        0x0040bba5
        0x0040bbab
        0x0040bbb2
        0x0040bbcc
        0x0040bbb4
        0x0040bbb4
        0x0040bbb9
        0x0040bbbe
        0x0040bbc3
        0x0040bbc3
        0x0040bbd6
        0x0040bbd8
        0x0040bbe8
        0x0040bbee
        0x0040bbf2
        0x0040bc00
        0x0040bc03
        0x0040bc05
        0x0040bc08
        0x0040bc0c
        0x0040bc25
        0x0040bc25
        0x0040bc25
        0x0040bc0e
        0x0040bc0e
        0x0040bc10
        0x0040bc15
        0x0040bc18
        0x0040bc1b
        0x0040bc20
        0x0040bc20
        0x0040bc2c
        0x0040bc2c
        0x0040bc31
        0x0040bc32
        0x0040bc45
        0x0040bc4d
        0x0040bc52
        0x0040b5f7
        0x0040b5f7
        0x00000000
        0x0040b5f7
        0x00000000
        0x0040b5f1
        0x0040bace
        0x0040bad0
        0x0040bb20
        0x0040bb23
        0x0040bb24
        0x0040bb26
        0x0040bb2e
        0x0040bb33
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040AC42
        • __vbaVarDup.MSVBVM60 ref: 0040AC8E
        • #544.MSVBVM60(?,?), ref: 0040AC9E
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 0040ACC5
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0040ACDE
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,00401196), ref: 0040AD08
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AD41
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CC8,00000108), ref: 0040AD8B
        • __vbaNew2.MSVBVM60(00401CF8,0040D33C), ref: 0040ADB2
        • __vbaChkstk.MSVBVM60(?), ref: 0040AE16
        • __vbaChkstk.MSVBVM60(?), ref: 0040AE27
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE8,00000038), ref: 0040AE6D
        • __vbaVar2Vec.MSVBVM60(?,?), ref: 0040AE8F
        • __vbaAryMove.MSVBVM60(?,?,?,?), ref: 0040AE9F
        • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0040AEA7
        • __vbaFreeVarList.MSVBVM60(00000002,00000008,?,?,?,?,?), ref: 0040AEB9
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,00401196), ref: 0040AED4
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AF0D
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,00000158), ref: 0040AF57
        • __vbaFreeStr.MSVBVM60 ref: 0040AFB9
        • __vbaFreeObj.MSVBVM60 ref: 0040AFC1
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040AFD9
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B012
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,000000F8), ref: 0040B05C
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040B083
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B0BC
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D18,00000088), ref: 0040B109
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?), ref: 0040B17E
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,00401196), ref: 0040B189
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?,?,00401196), ref: 0040B1A1
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B1DA
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D28,00000170), ref: 0040B224
        • __vbaVarMove.MSVBVM60 ref: 0040B29C
        • __vbaFreeObj.MSVBVM60 ref: 0040B2A4
        • __vbaFreeVar.MSVBVM60 ref: 0040B2AC
        • __vbaHresultCheckObj.MSVBVM60(00000000,004010F8,00401B4C,000006F8), ref: 0040B2E8
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040B318
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B351
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D18,00000050), ref: 0040B398
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040B3BF
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B3F8
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D28,00000078), ref: 0040B43F
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040B496
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?,?,?,?,?,00401196), ref: 0040B4B1
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B4EA
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D28,00000068), ref: 0040B531
        • __vbaFreeObj.MSVBVM60(?,?), ref: 0040B583
        • __vbaHresultCheckObj.MSVBVM60(00000000,004010F8,00401B1C,000002B4,?,?), ref: 0040B5BA
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?), ref: 0040B61C
        • __vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 0040B655
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D38,00000218,?,?), ref: 0040B69F
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?), ref: 0040B6C6
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?), ref: 0040B6FF
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$CheckHresult$FreeNew2$List$Chkstk$Move$#544Var2
        • String ID: 19:19:19
        • API String ID: 2805188520-362381601
        • Opcode ID: 75410255ebb41ef67381fe62fce17e49b14676aa2718c3edd9c2d2fddae8dd82
        • Instruction ID: 85bc8e9a2dfeef52f9c1fac94a422b6020d6ba132a221e4ba736e8878bfce2b6
        • Opcode Fuzzy Hash: 75410255ebb41ef67381fe62fce17e49b14676aa2718c3edd9c2d2fddae8dd82
        • Instruction Fuzzy Hash: 0492E374940219DFDB20DF90CC45BDDB7B8BF08304F1085EAE509BB2A1DB795A899F98
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 137 40ac26-40acef __vbaChkstk __vbaVarDup #544 __vbaVarTstNe __vbaFreeVarList 139 40aec1-40aec8 137->139 140 40acf5-40acfc 137->140 143 40aee5 139->143 144 40aeca-40aee3 __vbaNew2 139->144 141 40ad19 140->141 142 40acfe-40ad17 __vbaNew2 140->142 145 40ad23-40ad73 __vbaObjSet 141->145 142->145 146 40aeef-40af3f __vbaObjSet 143->146 144->146 151 40ad75-40ad96 __vbaHresultCheckObj 145->151 152 40ad98 145->152 153 40af41-40af62 __vbaHresultCheckObj 146->153 154 40af64 146->154 155 40ad9f-40ada6 151->155 152->155 156 40af6b-40afcd __vbaFreeStr __vbaFreeObj 153->156 154->156 157 40adc3 155->157 158 40ada8-40adc1 __vbaNew2 155->158 161 40afea 156->161 162 40afcf-40afe8 __vbaNew2 156->162 159 40adcd-40ae58 __vbaChkstk * 2 157->159 158->159 165 40ae7a 159->165 166 40ae5a-40ae78 __vbaHresultCheckObj 159->166 164 40aff4-40b044 __vbaObjSet 161->164 162->164 170 40b046-40b067 __vbaHresultCheckObj 164->170 171 40b069 164->171 167 40ae81-40aebe __vbaVar2Vec __vbaAryMove __vbaFreeObj __vbaFreeVarList 165->167 166->167 167->139 172 40b070-40b077 170->172 171->172 173 40b094 172->173 174 40b079-40b092 __vbaNew2 172->174 175 40b09e-40b0f1 __vbaObjSet 173->175 174->175 178 40b0f3-40b114 __vbaHresultCheckObj 175->178 179 40b116 175->179 180 40b11d-40b195 __vbaFreeObjList __vbaFreeVar 178->180 179->180 182 40b1b2 180->182 183 40b197-40b1b0 __vbaNew2 180->183 184 40b1bc-40b20c __vbaObjSet 182->184 183->184 187 40b231 184->187 188 40b20e-40b22f __vbaHresultCheckObj 184->188 189 40b238-40b2d3 __vbaVarMove __vbaFreeObj __vbaFreeVar 187->189 188->189 192 40b2f5 189->192 193 40b2d5-40b2f3 __vbaHresultCheckObj 189->193 194 40b2fc-40b30c 192->194 193->194 195 40b329 194->195 196 40b30e-40b327 __vbaNew2 194->196 197 40b333-40b383 __vbaObjSet 195->197 196->197 200 40b3a5 197->200 201 40b385-40b3a3 __vbaHresultCheckObj 197->201 202 40b3ac-40b3b3 200->202 201->202 203 40b3d0 202->203 204 40b3b5-40b3ce __vbaNew2 202->204 205 40b3da-40b42a __vbaObjSet 203->205 204->205 208 40b44c 205->208 209 40b42c-40b44a __vbaHresultCheckObj 205->209 210 40b453-40b4a5 __vbaFreeObjList 208->210 209->210 212 40b4c2 210->212 213 40b4a7-40b4c0 __vbaNew2 210->213 214 40b4cc-40b51c __vbaObjSet 212->214 213->214 217 40b53e 214->217 218 40b51e-40b53c __vbaHresultCheckObj 214->218 219 40b545-40b56e 217->219 218->219 220 40b577-40b5a5 __vbaFreeObj 219->220 222 40b5c7 220->222 223 40b5a7-40b5c5 __vbaHresultCheckObj 220->223 224 40b5ce-40b603 222->224 223->224 226 40bac1-40bb33 __vbaAryDestruct __vbaFreeVar 224->226 227 40b609-40b610 224->227 228 40b612-40b62b __vbaNew2 227->228 229 40b62d 227->229 231 40b637-40b687 __vbaObjSet 228->231 229->231 235 40b689-40b6aa __vbaHresultCheckObj 231->235 236 40b6ac 231->236 237 40b6b3-40b6ba 235->237 236->237 238 40b6d7 237->238 239 40b6bc-40b6d5 __vbaNew2 237->239 240 40b6e1-40b734 __vbaObjSet 238->240 239->240 243 40b736-40b757 __vbaHresultCheckObj 240->243 244 40b759 240->244 245 40b760-40b767 243->245 244->245 246 40b784 245->246 247 40b769-40b782 __vbaNew2 245->247 248 40b78e-40b7e1 __vbaObjSet 246->248 247->248 251 40b7e3-40b804 __vbaHresultCheckObj 248->251 252 40b806 248->252 253 40b80d-40b8a9 __vbaChkstk * 2 251->253 252->253 255 40b8cb 253->255 256 40b8ab-40b8c9 __vbaHresultCheckObj 253->256 257 40b8d2-40b900 __vbaFreeObjList __vbaFreeVar 255->257 256->257 258 40b902-40b91b __vbaNew2 257->258 259 40b91d 257->259 260 40b927-40b977 __vbaObjSet 258->260 259->260 263 40b999 260->263 264 40b979-40b997 __vbaHresultCheckObj 260->264 265 40b9a0-40b9f8 263->265 264->265 267 40ba1a 265->267 268 40b9fa-40ba18 __vbaHresultCheckObj 265->268 269 40ba21-40ba81 __vbaFreeObj 267->269 268->269 271 40baa3 269->271 272 40ba83-40baa1 __vbaHresultCheckObj 269->272 273 40baaa-40babc 271->273 272->273
        C-Code - Quality: 60%
        			E0040AC26(void* __ebx, void* __edi, void* __esi, signed int _a8) {
        				signed int _v4;
        				intOrPtr _v8;
        				char** _v12;
        				intOrPtr _v24;
        				signed int _v28;
        				intOrPtr _v32;
        				intOrPtr _v36;
        				char _v40;
        				signed int _v44;
        				signed int _v48;
        				char _v52;
        				signed int* _v56;
        				signed int _v60;
        				void* _v72;
        				long long _v80;
        				char* _v84;
        				signed int _v88;
        				char _v92;
        				signed int _v96;
        				char _v100;
        				intOrPtr _v108;
        				char _v116;
        				char _v132;
        				char _v152;
        				char* _v160;
        				char _v168;
        				intOrPtr _v176;
        				char _v184;
        				char _v188;
        				void* _v192;
        				char* _v196;
        				char _v200;
        				char _v204;
        				char _v208;
        				char _v212;
        				char _v216;
        				intOrPtr _v220;
        				char _v224;
        				intOrPtr _v228;
        				char _v232;
        				signed int _v236;
        				signed int _v240;
        				signed int _v244;
        				signed int _v248;
        				intOrPtr* _v252;
        				signed int _v256;
        				signed int _v260;
        				intOrPtr _v264;
        				intOrPtr _v268;
        				signed int _v280;
        				signed int _v284;
        				signed int _v288;
        				void* _v292;
        				intOrPtr* _v296;
        				signed int _v300;
        				signed int* _v304;
        				signed int _v308;
        				intOrPtr* _v312;
        				signed int _v316;
        				intOrPtr* _v320;
        				signed int _v324;
        				intOrPtr* _v328;
        				signed int _v332;
        				intOrPtr* _v336;
        				signed int _v340;
        				signed int _v344;
        				intOrPtr* _v348;
        				signed int _v352;
        				intOrPtr* _v356;
        				signed int _v360;
        				intOrPtr* _v364;
        				signed int _v368;
        				signed int _v372;
        				intOrPtr* _v376;
        				signed int _v380;
        				intOrPtr* _v384;
        				signed int _v388;
        				intOrPtr* _v392;
        				signed int _v396;
        				signed int _v400;
        				intOrPtr* _v404;
        				signed int _v408;
        				signed int _v412;
        				signed int _v416;
        				void* _v436;
        				intOrPtr _v452;
        				char** _v456;
        				void* _v468;
        				signed int _t485;
        				signed int _t492;
        				signed int _t496;
        				signed int _t508;
        				signed int _t512;
        				signed int _t516;
        				signed int _t520;
        				signed int _t533;
        				signed int _t537;
        				signed int _t549;
        				signed int _t554;
        				signed int _t558;
        				signed int _t562;
        				signed int _t566;
        				signed int _t578;
        				signed int _t582;
        				signed int _t590;
        				char* _t593;
        				signed int _t597;
        				signed int _t601;
        				signed int _t605;
        				signed int _t609;
        				char* _t613;
        				signed int _t617;
        				signed int _t627;
        				signed int _t634;
        				signed int _t638;
        				signed int _t643;
        				signed int _t649;
        				signed int _t653;
        				signed int _t655;
        				signed int _t657;
        				char* _t658;
        				signed int _t664;
        				signed int _t668;
        				signed int _t678;
        				void* _t685;
        				intOrPtr _t697;
        				intOrPtr _t713;
        				intOrPtr _t726;
        				intOrPtr _t730;
        				char* _t731;
        				char** _t745;
        				char* _t750;
        				void* _t755;
        				char** _t756;
        				char** _t757;
        				char** _t758;
        				char** _t759;
        
        				_t685 = __ebx;
        				asm("in al, dx");
        				_t756 = _t755 - 0xc;
        				 *[fs:0x0] = _t756;
        				L00401190();
        				_v12 = _t756;
        				_v8 = 0x4010f8;
        				_v4 = _a8 & 0x00000001;
        				_a8 = _a8 & 0xfffffffe;
        				 *((intOrPtr*)( *_a8 + 4))(_a8, __edi, __esi, __ebx,  *[fs:0x0], 0x401196);
        				_v160 = L"19:19:19";
        				_v168 = 8;
        				L00401298();
        				_push( &_v116);
        				_push( &_v132); // executed
        				L0040129E(); // executed
        				_v176 = 0x13;
        				_v184 = 0x8002;
        				_push( &_v132);
        				_t485 =  &_v184;
        				_push(_t485);
        				L004012A4();
        				_v236 = _t485;
        				_push( &_v132);
        				_push( &_v116);
        				_push(2);
        				L00401292();
        				_t757 =  &(_t756[3]);
        				if(_v236 != 0) {
        					if( *0x40d010 != 0) {
        						_v296 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v296 = 0x40d010;
        					}
        					_t664 =  &_v92;
        					L0040128C();
        					_v236 = _t664;
        					_t668 =  *((intOrPtr*)( *_v236 + 0x108))(_v236,  &_v88, _t664,  *((intOrPtr*)( *((intOrPtr*)( *_v296)) + 0x314))( *_v296));
        					asm("fclex");
        					_v240 = _t668;
        					if(_v240 >= 0) {
        						_t40 =  &_v300;
        						 *_t40 = _v300 & 0x00000000;
        						__eflags =  *_t40;
        					} else {
        						_push(0x108);
        						_push(0x401cc8);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v300 = _t668;
        					}
        					if( *0x40d33c != 0) {
        						_v304 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf8);
        						L00401286();
        						_v304 = 0x40d33c;
        					}
        					_v244 =  *_v304;
        					_v280 = _v88;
        					_v88 = _v88 & 0x00000000;
        					_v108 = _v280;
        					_v116 = 8;
        					_v160 = 0xe3;
        					_v168 = 2;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t678 =  *((intOrPtr*)( *_v244 + 0x38))(_v244, 0x10, 0x10,  &_v132);
        					asm("fclex");
        					_v248 = _t678;
        					if(_v248 >= 0) {
        						_t66 =  &_v308;
        						 *_t66 = _v308 & 0x00000000;
        						__eflags =  *_t66;
        					} else {
        						_push(0x38);
        						_push(0x401ce8);
        						_push(_v244);
        						_push(_v248);
        						L00401280();
        						_v308 = _t678;
        					}
        					_push( &_v132);
        					_push( &_v152);
        					L00401274();
        					_push( &_v152);
        					_push( &_v52);
        					L0040127A();
        					L0040126E();
        					_push( &_v132);
        					_push( &_v116);
        					_push(2);
        					L00401292();
        					_t757 =  &(_t757[3]);
        				}
        				if( *0x40d010 != 0) {
        					_v312 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v312 = 0x40d010;
        				}
        				_t492 =  &_v92;
        				L0040128C();
        				_v236 = _t492;
        				_t496 =  *((intOrPtr*)( *_v236 + 0x158))(_v236,  &_v88, _t492,  *((intOrPtr*)( *((intOrPtr*)( *_v312)) + 0x300))( *_v312));
        				asm("fclex");
        				_v240 = _t496;
        				if(_v240 >= 0) {
        					_t91 =  &_v316;
        					 *_t91 = _v316 & 0x00000000;
        					__eflags =  *_t91;
        				} else {
        					_push(0x158);
        					_push(0x401d08);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v316 = _t496;
        				}
        				_v188 = 0x633;
        				_v196 = 0x1e68d1;
        				 *((intOrPtr*)( *_a8 + 0x70c))(_a8, _v88,  &_v196,  &_v188,  &_v216);
        				_v44 = _v216;
        				_v40 = _v212;
        				L00401268();
        				L0040126E();
        				if( *0x40d010 != 0) {
        					_v320 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v320 = 0x40d010;
        				}
        				_t508 =  &_v92;
        				L0040128C();
        				_v236 = _t508;
        				_t512 =  *((intOrPtr*)( *_v236 + 0xf8))(_v236,  &_v96, _t508,  *((intOrPtr*)( *((intOrPtr*)( *_v320)) + 0x300))( *_v320));
        				asm("fclex");
        				_v240 = _t512;
        				if(_v240 >= 0) {
        					_t124 =  &_v324;
        					 *_t124 = _v324 & 0x00000000;
        					__eflags =  *_t124;
        				} else {
        					_push(0xf8);
        					_push(0x401d08);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v324 = _t512;
        				}
        				if( *0x40d010 != 0) {
        					_v328 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v328 = 0x40d010;
        				}
        				_t697 =  *((intOrPtr*)( *_v328));
        				_t516 =  &_v100;
        				L0040128C();
        				_v244 = _t516;
        				_t520 =  *((intOrPtr*)( *_v244 + 0x88))(_v244,  &_v196, _t516,  *((intOrPtr*)(_t697 + 0x310))( *_v328));
        				asm("fclex");
        				_v248 = _t520;
        				if(_v248 >= 0) {
        					_t142 =  &_v332;
        					 *_t142 = _v332 & 0x00000000;
        					__eflags =  *_t142;
        				} else {
        					_push(0x88);
        					_push(0x401d18);
        					_push(_v244);
        					_push(_v248);
        					L00401280();
        					_v332 = _t520;
        				}
        				_v200 =  *0x4010f0;
        				_v284 = _v96;
        				_v96 = _v96 & 0x00000000;
        				_v108 = _v284;
        				_v116 = 9;
        				 *_t757 = _v196;
        				 *_t757 =  *0x4010e8;
        				 *((intOrPtr*)( *_a8 + 0x710))(_a8,  &_v116, _t697, _t697,  &_v200, _t697);
        				_push( &_v100);
        				_push( &_v92);
        				_push(2);
        				L00401262();
        				_t758 =  &(_t757[3]);
        				L0040125C();
        				if( *0x40d010 != 0) {
        					_v336 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v336 = 0x40d010;
        				}
        				_t533 =  &_v92;
        				L0040128C();
        				_v236 = _t533;
        				_t537 =  *((intOrPtr*)( *_v236 + 0x170))(_v236,  &_v88, _t533,  *((intOrPtr*)( *((intOrPtr*)( *_v336)) + 0x30c))( *_v336));
        				asm("fclex");
        				_v240 = _t537;
        				if(_v240 >= 0) {
        					_t177 =  &_v340;
        					 *_t177 = _v340 & 0x00000000;
        					__eflags =  *_t177;
        				} else {
        					_push(0x170);
        					_push(0x401d28);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v340 = _t537;
        				}
        				_v288 = _v88;
        				_v88 = _v88 & 0x00000000;
        				_v108 = _v288;
        				_v116 = 8;
        				_v216 = 0xc96ed9a0;
        				_v212 = 0x5b01;
        				 *((intOrPtr*)( *_a8 + 0x714))(_a8,  &_v216, 0x7cbc2ca0, 0x5afe,  &_v116,  &_v132);
        				L00401256();
        				L0040126E();
        				L0040125C();
        				_t549 =  *((intOrPtr*)( *_a8 + 0x6f8))(_a8,  &_v196);
        				_v236 = _t549;
        				if(_v236 >= 0) {
        					_t207 =  &_v344;
        					 *_t207 = _v344 & 0x00000000;
        					__eflags =  *_t207;
        				} else {
        					_push(0x6f8);
        					_push(0x401b4c);
        					_push(_a8);
        					_push(_v236);
        					L00401280();
        					_v344 = _t549;
        				}
        				_v84 = _v196;
        				if( *0x40d010 != 0) {
        					_v348 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v348 = 0x40d010;
        				}
        				_t554 =  &_v92;
        				L0040128C();
        				_v236 = _t554;
        				_t558 =  *((intOrPtr*)( *_v236 + 0x50))(_v236,  &_v188, _t554,  *((intOrPtr*)( *((intOrPtr*)( *_v348)) + 0x310))( *_v348));
        				asm("fclex");
        				_v240 = _t558;
        				if(_v240 >= 0) {
        					_t227 =  &_v352;
        					 *_t227 = _v352 & 0x00000000;
        					__eflags =  *_t227;
        				} else {
        					_push(0x50);
        					_push(0x401d18);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v352 = _t558;
        				}
        				if( *0x40d010 != 0) {
        					_v356 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v356 = 0x40d010;
        				}
        				_t562 =  &_v96;
        				L0040128C();
        				_v244 = _t562;
        				_t566 =  *((intOrPtr*)( *_v244 + 0x78))(_v244,  &_v196, _t562,  *((intOrPtr*)( *((intOrPtr*)( *_v356)) + 0x30c))( *_v356));
        				asm("fclex");
        				_v248 = _t566;
        				if(_v248 >= 0) {
        					_t245 =  &_v360;
        					 *_t245 = _v360 & 0x00000000;
        					__eflags =  *_t245;
        				} else {
        					_push(0x78);
        					_push(0x401d28);
        					_push(_v244);
        					_push(_v248);
        					L00401280();
        					_v360 = _t566;
        				}
        				_v200 = _v196;
        				 *((intOrPtr*)( *_a8 + 0x718))(_a8, _v188,  &_v200,  &_v192);
        				_v56 = _v192;
        				_push( &_v96);
        				_push( &_v92);
        				_push(2);
        				L00401262();
        				_t759 =  &(_t758[3]);
        				if( *0x40d010 != 0) {
        					_v364 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v364 = 0x40d010;
        				}
        				_t713 =  *((intOrPtr*)( *_v364));
        				_t578 =  &_v92;
        				L0040128C();
        				_v236 = _t578;
        				_t582 =  *((intOrPtr*)( *_v236 + 0x68))(_v236,  &_v196, _t578,  *((intOrPtr*)(_t713 + 0x30c))( *_v364));
        				asm("fclex");
        				_v240 = _t582;
        				if(_v240 >= 0) {
        					_t275 =  &_v368;
        					 *_t275 = _v368 & 0x00000000;
        					__eflags =  *_t275;
        				} else {
        					_push(0x68);
        					_push(0x401d28);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v368 = _t582;
        				}
        				_v216 =  *0x4010e0;
        				_v292 = _v196;
        				 *((intOrPtr*)( *_a8 + 0x71c))(_a8,  &_v216, _t713,  &_v224);
        				_v80 = _v224;
        				L0040126E();
        				_t590 =  *((intOrPtr*)( *_a8 + 0x2b4))(_a8);
        				asm("fclex");
        				_v236 = _t590;
        				if(_v236 >= 0) {
        					_t295 =  &_v372;
        					 *_t295 = _v372 & 0x00000000;
        					__eflags =  *_t295;
        				} else {
        					_push(0x2b4);
        					_push(0x401b1c);
        					_push(_a8);
        					_push(_v236);
        					L00401280();
        					_v372 = _t590;
        				}
        				_v268 = 0x5ae61;
        				_v264 = 1;
        				_v28 = _v28 & 0x00000000;
        				while(_v28 <= _v268) {
        					if( *0x40d010 != 0) {
        						_v376 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v376 = 0x40d010;
        					}
        					_t597 =  &_v92;
        					L0040128C();
        					_v236 = _t597;
        					_t601 =  *((intOrPtr*)( *_v236 + 0x218))(_v236,  &_v88, _t597,  *((intOrPtr*)( *((intOrPtr*)( *_v376)) + 0x308))( *_v376));
        					asm("fclex");
        					_v240 = _t601;
        					if(_v240 >= 0) {
        						_t322 =  &_v380;
        						 *_t322 = _v380 & 0x00000000;
        						__eflags =  *_t322;
        					} else {
        						_push(0x218);
        						_push(0x401d38);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v380 = _t601;
        					}
        					if( *0x40d010 != 0) {
        						_v384 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v384 = 0x40d010;
        					}
        					_t605 =  &_v96;
        					L0040128C();
        					_v244 = _t605;
        					_t609 =  *((intOrPtr*)( *_v244 + 0x138))(_v244,  &_v196, _t605,  *((intOrPtr*)( *((intOrPtr*)( *_v384)) + 0x30c))( *_v384));
        					asm("fclex");
        					_v248 = _t609;
        					if(_v248 >= 0) {
        						_t340 =  &_v388;
        						 *_t340 = _v388 & 0x00000000;
        						__eflags =  *_t340;
        					} else {
        						_push(0x138);
        						_push(0x401d28);
        						_push(_v244);
        						_push(_v248);
        						L00401280();
        						_v388 = _t609;
        					}
        					if( *0x40d010 != 0) {
        						_v392 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v392 = 0x40d010;
        					}
        					_t726 =  *((intOrPtr*)( *_v392));
        					_t613 =  &_v100;
        					L0040128C();
        					_v252 = _t613;
        					_t617 =  *((intOrPtr*)( *_v252 + 0x188))(_v252,  &_v200, _t613,  *((intOrPtr*)(_t726 + 0x300))( *_v392));
        					asm("fclex");
        					_v256 = _t617;
        					if(_v256 >= 0) {
        						_t358 =  &_v396;
        						 *_t358 = _v396 & 0x00000000;
        						__eflags =  *_t358;
        					} else {
        						_push(0x188);
        						_push(0x401d08);
        						_push(_v252);
        						_push(_v256);
        						L00401280();
        						_v396 = _t617;
        					}
        					_v160 = _v196;
        					_v168 = 3;
        					_v292 = _v88;
        					_v88 = _v88 & 0x00000000;
        					_v108 = _v292;
        					_v116 = 8;
        					_v204 = 0x8227e0;
        					_v380 =  *0x4010d8;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					_t750 =  &_v116;
        					_t745 = _t759;
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t627 =  *((intOrPtr*)( *_a8 + 0x6fc))(_a8,  &_v204, 0x10, 0x10, _t726, _t726, _v200,  &_v208);
        					_v260 = _t627;
        					if(_v260 >= 0) {
        						_t384 =  &_v400;
        						 *_t384 = _v400 & 0x00000000;
        						__eflags =  *_t384;
        					} else {
        						_push(0x6fc);
        						_push(0x401b4c);
        						_push(_a8);
        						_push(_v260);
        						L00401280();
        						_v400 = _t627;
        					}
        					_v24 = _v208;
        					_push( &_v100);
        					_push( &_v96);
        					_push( &_v92);
        					_push(3);
        					L00401262();
        					_t759 =  &(_t759[4]);
        					L0040125C();
        					if( *0x40d010 != 0) {
        						_v404 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v404 = 0x40d010;
        					}
        					_t730 =  *((intOrPtr*)( *_v404));
        					_t634 =  &_v92;
        					L0040128C();
        					_v236 = _t634;
        					_t638 =  *((intOrPtr*)( *_v236 + 0x70))(_v236,  &_v196, _t634,  *((intOrPtr*)(_t730 + 0x310))( *_v404));
        					asm("fclex");
        					_v240 = _t638;
        					if(_v240 >= 0) {
        						_t408 =  &_v408;
        						 *_t408 = _v408 & 0x00000000;
        						__eflags =  *_t408;
        					} else {
        						_push(0x70);
        						_push(0x401d18);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v408 = _t638;
        					}
        					_v224 =  *0x4010d0;
        					_v216 = 0x445fc8f0;
        					_v212 = 0x5af7;
        					 *_t759 = _v196;
        					_t643 =  *((intOrPtr*)( *_a8 + 0x700))(_a8,  &_v216, _t730,  &_v224, 0xf6292);
        					_v244 = _t643;
        					if(_v244 >= 0) {
        						_t424 =  &_v412;
        						 *_t424 = _v412 & 0x00000000;
        						__eflags =  *_t424;
        					} else {
        						_push(0x700);
        						_push(0x401b4c);
        						_push(_a8);
        						_push(_v244);
        						L00401280();
        						_v412 = _t643;
        					}
        					_t731 =  &_v92;
        					L0040126E();
        					_v224 = 0xde5a6cd0;
        					_v220 = 0x5af7;
        					_v216 = 0xc72725d0;
        					_v212 = 0x5afc;
        					_t649 =  *((intOrPtr*)( *_a8 + 0x704))(_a8,  &_v216,  &_v224,  &_v232);
        					_v236 = _t649;
        					if(_v236 >= 0) {
        						_t442 =  &_v416;
        						 *_t442 = _v416 & 0x00000000;
        						__eflags =  *_t442;
        					} else {
        						_push(0x704);
        						_push(0x401b4c);
        						_push(_a8);
        						_push(_v236);
        						L00401280();
        						_v416 = _t649;
        					}
        					_v36 = _v232;
        					_v32 = _v228;
        					_t653 = _v28 + _v264;
        					if(_t653 < 0) {
        						L0040124A();
        						_push(_t731);
        						_push(_t731);
        						_push(0x401196);
        						_push( *[fs:0x0]);
        						 *[fs:0x0] = _t759;
        						_t655 = 0x28;
        						L00401190();
        						_push(_t685);
        						_push(_t750);
        						_push(_t745);
        						_v456 = _t759;
        						_v452 = 0x401110;
        						L00401244();
        						asm("fldz");
        						L00401214();
        						L0040123E();
        						asm("fcomp qword [0x401108]");
        						asm("fnstsw ax");
        						asm("sahf");
        						if(__eflags != 0) {
        							__eflags =  *0x40d33c;
        							if( *0x40d33c != 0) {
        								_v56 = 0x40d33c;
        							} else {
        								_push(0x40d33c);
        								_push(0x401cf8);
        								L00401286();
        								_v56 = 0x40d33c;
        							}
        							_t657 =  *_v56;
        							_v44 = _t657;
        							L00401238();
        							_t658 =  &_v40;
        							L0040128C();
        							_t655 =  *((intOrPtr*)( *_v44 + 0x40))(_v44, _t658, _t658, _t657, _v28, 0x401d60, L"Filmbyer");
        							asm("fclex");
        							_v48 = _t655;
        							__eflags = _v48;
        							if(_v48 >= 0) {
        								_t468 =  &_v60;
        								 *_t468 = _v60 & 0x00000000;
        								__eflags =  *_t468;
        							} else {
        								_push(0x40);
        								_push(0x401ce8);
        								_push(_v44);
        								_push(_v48);
        								L00401280();
        								_v60 = _t655;
        							}
        							L0040126E();
        						}
        						asm("wait");
        						_push(E0040BC53);
        						L00401268();
        						L0040126E();
        						return _t655;
        					} else {
        						_v28 = _t653;
        						continue;
        					}
        					L113:
        				}
        				 *((intOrPtr*)(0x278681 + _v308))(0x19129e);
        				_push(E0040BB34);
        				_t593 =  &_v52;
        				_push(_t593);
        				_push(0);
        				L00401250();
        				L0040125C();
        				return _t593;
        				goto L113;
        			}












































































































































        0x0040ac26
        0x0040ac26
        0x0040ac27
        0x0040ac36
        0x0040ac42
        0x0040ac4a
        0x0040ac4d
        0x0040ac5a
        0x0040ac63
        0x0040ac6e
        0x0040ac71
        0x0040ac7b
        0x0040ac8e
        0x0040ac96
        0x0040ac9d
        0x0040ac9e
        0x0040aca3
        0x0040acad
        0x0040acbd
        0x0040acbe
        0x0040acc4
        0x0040acc5
        0x0040acca
        0x0040acd7
        0x0040acdb
        0x0040acdc
        0x0040acde
        0x0040ace3
        0x0040acef
        0x0040acfc
        0x0040ad19
        0x0040acfe
        0x0040acfe
        0x0040ad03
        0x0040ad08
        0x0040ad0d
        0x0040ad0d
        0x0040ad3d
        0x0040ad41
        0x0040ad46
        0x0040ad5e
        0x0040ad64
        0x0040ad66
        0x0040ad73
        0x0040ad98
        0x0040ad98
        0x0040ad98
        0x0040ad75
        0x0040ad75
        0x0040ad7a
        0x0040ad7f
        0x0040ad85
        0x0040ad8b
        0x0040ad90
        0x0040ad90
        0x0040ada6
        0x0040adc3
        0x0040ada8
        0x0040ada8
        0x0040adad
        0x0040adb2
        0x0040adb7
        0x0040adb7
        0x0040add5
        0x0040adde
        0x0040ade4
        0x0040adee
        0x0040adf1
        0x0040adf8
        0x0040ae02
        0x0040ae16
        0x0040ae20
        0x0040ae21
        0x0040ae22
        0x0040ae23
        0x0040ae27
        0x0040ae34
        0x0040ae35
        0x0040ae36
        0x0040ae37
        0x0040ae46
        0x0040ae49
        0x0040ae4b
        0x0040ae58
        0x0040ae7a
        0x0040ae7a
        0x0040ae7a
        0x0040ae5a
        0x0040ae5a
        0x0040ae5c
        0x0040ae61
        0x0040ae67
        0x0040ae6d
        0x0040ae72
        0x0040ae72
        0x0040ae87
        0x0040ae8e
        0x0040ae8f
        0x0040ae9a
        0x0040ae9e
        0x0040ae9f
        0x0040aea7
        0x0040aeb2
        0x0040aeb6
        0x0040aeb7
        0x0040aeb9
        0x0040aebe
        0x0040aebe
        0x0040aec8
        0x0040aee5
        0x0040aeca
        0x0040aeca
        0x0040aecf
        0x0040aed4
        0x0040aed9
        0x0040aed9
        0x0040af09
        0x0040af0d
        0x0040af12
        0x0040af2a
        0x0040af30
        0x0040af32
        0x0040af3f
        0x0040af64
        0x0040af64
        0x0040af64
        0x0040af41
        0x0040af41
        0x0040af46
        0x0040af4b
        0x0040af51
        0x0040af57
        0x0040af5c
        0x0040af5c
        0x0040af6b
        0x0040af74
        0x0040af9e
        0x0040afaa
        0x0040afb3
        0x0040afb9
        0x0040afc1
        0x0040afcd
        0x0040afea
        0x0040afcf
        0x0040afcf
        0x0040afd4
        0x0040afd9
        0x0040afde
        0x0040afde
        0x0040b00e
        0x0040b012
        0x0040b017
        0x0040b02f
        0x0040b035
        0x0040b037
        0x0040b044
        0x0040b069
        0x0040b069
        0x0040b069
        0x0040b046
        0x0040b046
        0x0040b04b
        0x0040b050
        0x0040b056
        0x0040b05c
        0x0040b061
        0x0040b061
        0x0040b077
        0x0040b094
        0x0040b079
        0x0040b079
        0x0040b07e
        0x0040b083
        0x0040b088
        0x0040b088
        0x0040b0ae
        0x0040b0b8
        0x0040b0bc
        0x0040b0c1
        0x0040b0dc
        0x0040b0e2
        0x0040b0e4
        0x0040b0f1
        0x0040b116
        0x0040b116
        0x0040b116
        0x0040b0f3
        0x0040b0f3
        0x0040b0f8
        0x0040b0fd
        0x0040b103
        0x0040b109
        0x0040b10e
        0x0040b10e
        0x0040b123
        0x0040b12c
        0x0040b132
        0x0040b13c
        0x0040b13f
        0x0040b14d
        0x0040b15f
        0x0040b16e
        0x0040b177
        0x0040b17b
        0x0040b17c
        0x0040b17e
        0x0040b183
        0x0040b189
        0x0040b195
        0x0040b1b2
        0x0040b197
        0x0040b197
        0x0040b19c
        0x0040b1a1
        0x0040b1a6
        0x0040b1a6
        0x0040b1d6
        0x0040b1da
        0x0040b1df
        0x0040b1f7
        0x0040b1fd
        0x0040b1ff
        0x0040b20c
        0x0040b231
        0x0040b231
        0x0040b231
        0x0040b20e
        0x0040b20e
        0x0040b213
        0x0040b218
        0x0040b21e
        0x0040b224
        0x0040b229
        0x0040b229
        0x0040b23b
        0x0040b241
        0x0040b24b
        0x0040b24e
        0x0040b255
        0x0040b25f
        0x0040b28d
        0x0040b29c
        0x0040b2a4
        0x0040b2ac
        0x0040b2c0
        0x0040b2c6
        0x0040b2d3
        0x0040b2f5
        0x0040b2f5
        0x0040b2f5
        0x0040b2d5
        0x0040b2d5
        0x0040b2da
        0x0040b2df
        0x0040b2e2
        0x0040b2e8
        0x0040b2ed
        0x0040b2ed
        0x0040b302
        0x0040b30c
        0x0040b329
        0x0040b30e
        0x0040b30e
        0x0040b313
        0x0040b318
        0x0040b31d
        0x0040b31d
        0x0040b34d
        0x0040b351
        0x0040b356
        0x0040b371
        0x0040b374
        0x0040b376
        0x0040b383
        0x0040b3a5
        0x0040b3a5
        0x0040b3a5
        0x0040b385
        0x0040b385
        0x0040b387
        0x0040b38c
        0x0040b392
        0x0040b398
        0x0040b39d
        0x0040b39d
        0x0040b3b3
        0x0040b3d0
        0x0040b3b5
        0x0040b3b5
        0x0040b3ba
        0x0040b3bf
        0x0040b3c4
        0x0040b3c4
        0x0040b3f4
        0x0040b3f8
        0x0040b3fd
        0x0040b418
        0x0040b41b
        0x0040b41d
        0x0040b42a
        0x0040b44c
        0x0040b44c
        0x0040b44c
        0x0040b42c
        0x0040b42c
        0x0040b42e
        0x0040b433
        0x0040b439
        0x0040b43f
        0x0040b444
        0x0040b444
        0x0040b459
        0x0040b47b
        0x0040b488
        0x0040b48f
        0x0040b493
        0x0040b494
        0x0040b496
        0x0040b49b
        0x0040b4a5
        0x0040b4c2
        0x0040b4a7
        0x0040b4a7
        0x0040b4ac
        0x0040b4b1
        0x0040b4b6
        0x0040b4b6
        0x0040b4dc
        0x0040b4e6
        0x0040b4ea
        0x0040b4ef
        0x0040b50a
        0x0040b50d
        0x0040b50f
        0x0040b51c
        0x0040b53e
        0x0040b53e
        0x0040b53e
        0x0040b51e
        0x0040b51e
        0x0040b520
        0x0040b525
        0x0040b52b
        0x0040b531
        0x0040b536
        0x0040b536
        0x0040b54b
        0x0040b55f
        0x0040b571
        0x0040b57d
        0x0040b583
        0x0040b590
        0x0040b596
        0x0040b598
        0x0040b5a5
        0x0040b5c7
        0x0040b5c7
        0x0040b5c7
        0x0040b5a7
        0x0040b5a7
        0x0040b5ac
        0x0040b5b1
        0x0040b5b4
        0x0040b5ba
        0x0040b5bf
        0x0040b5bf
        0x0040b5ce
        0x0040b5d8
        0x0040b5e2
        0x0040b5fa
        0x0040b610
        0x0040b62d
        0x0040b612
        0x0040b612
        0x0040b617
        0x0040b61c
        0x0040b621
        0x0040b621
        0x0040b651
        0x0040b655
        0x0040b65a
        0x0040b672
        0x0040b678
        0x0040b67a
        0x0040b687
        0x0040b6ac
        0x0040b6ac
        0x0040b6ac
        0x0040b689
        0x0040b689
        0x0040b68e
        0x0040b693
        0x0040b699
        0x0040b69f
        0x0040b6a4
        0x0040b6a4
        0x0040b6ba
        0x0040b6d7
        0x0040b6bc
        0x0040b6bc
        0x0040b6c1
        0x0040b6c6
        0x0040b6cb
        0x0040b6cb
        0x0040b6fb
        0x0040b6ff
        0x0040b704
        0x0040b71f
        0x0040b725
        0x0040b727
        0x0040b734
        0x0040b759
        0x0040b759
        0x0040b759
        0x0040b736
        0x0040b736
        0x0040b73b
        0x0040b740
        0x0040b746
        0x0040b74c
        0x0040b751
        0x0040b751
        0x0040b767
        0x0040b784
        0x0040b769
        0x0040b769
        0x0040b76e
        0x0040b773
        0x0040b778
        0x0040b778
        0x0040b79e
        0x0040b7a8
        0x0040b7ac
        0x0040b7b1
        0x0040b7cc
        0x0040b7d2
        0x0040b7d4
        0x0040b7e1
        0x0040b806
        0x0040b806
        0x0040b806
        0x0040b7e3
        0x0040b7e3
        0x0040b7e8
        0x0040b7ed
        0x0040b7f3
        0x0040b7f9
        0x0040b7fe
        0x0040b7fe
        0x0040b813
        0x0040b819
        0x0040b826
        0x0040b82c
        0x0040b836
        0x0040b839
        0x0040b840
        0x0040b85f
        0x0040b865
        0x0040b872
        0x0040b873
        0x0040b874
        0x0040b875
        0x0040b879
        0x0040b87e
        0x0040b881
        0x0040b883
        0x0040b884
        0x0040b885
        0x0040b886
        0x0040b896
        0x0040b89c
        0x0040b8a9
        0x0040b8cb
        0x0040b8cb
        0x0040b8cb
        0x0040b8ab
        0x0040b8ab
        0x0040b8b0
        0x0040b8b5
        0x0040b8b8
        0x0040b8be
        0x0040b8c3
        0x0040b8c3
        0x0040b8d8
        0x0040b8de
        0x0040b8e2
        0x0040b8e6
        0x0040b8e7
        0x0040b8e9
        0x0040b8ee
        0x0040b8f4
        0x0040b900
        0x0040b91d
        0x0040b902
        0x0040b902
        0x0040b907
        0x0040b90c
        0x0040b911
        0x0040b911
        0x0040b937
        0x0040b941
        0x0040b945
        0x0040b94a
        0x0040b965
        0x0040b968
        0x0040b96a
        0x0040b977
        0x0040b999
        0x0040b999
        0x0040b999
        0x0040b979
        0x0040b979
        0x0040b97b
        0x0040b980
        0x0040b986
        0x0040b98c
        0x0040b991
        0x0040b991
        0x0040b9a6
        0x0040b9ac
        0x0040b9b6
        0x0040b9d3
        0x0040b9e5
        0x0040b9eb
        0x0040b9f8
        0x0040ba1a
        0x0040ba1a
        0x0040ba1a
        0x0040b9fa
        0x0040b9fa
        0x0040b9ff
        0x0040ba04
        0x0040ba07
        0x0040ba0d
        0x0040ba12
        0x0040ba12
        0x0040ba21
        0x0040ba24
        0x0040ba29
        0x0040ba33
        0x0040ba3d
        0x0040ba47
        0x0040ba6e
        0x0040ba74
        0x0040ba81
        0x0040baa3
        0x0040baa3
        0x0040baa3
        0x0040ba83
        0x0040ba83
        0x0040ba88
        0x0040ba8d
        0x0040ba90
        0x0040ba96
        0x0040ba9b
        0x0040ba9b
        0x0040bab0
        0x0040bab9
        0x0040b5eb
        0x0040b5f1
        0x0040bb53
        0x0040bb5b
        0x0040bb5c
        0x0040bb5d
        0x0040bb68
        0x0040bb69
        0x0040bb72
        0x0040bb73
        0x0040bb78
        0x0040bb79
        0x0040bb7a
        0x0040bb7b
        0x0040bb7e
        0x0040bb8b
        0x0040bb90
        0x0040bb92
        0x0040bb97
        0x0040bb9c
        0x0040bba2
        0x0040bba4
        0x0040bba5
        0x0040bbab
        0x0040bbb2
        0x0040bbcc
        0x0040bbb4
        0x0040bbb4
        0x0040bbb9
        0x0040bbbe
        0x0040bbc3
        0x0040bbc3
        0x0040bbd6
        0x0040bbd8
        0x0040bbe8
        0x0040bbee
        0x0040bbf2
        0x0040bc00
        0x0040bc03
        0x0040bc05
        0x0040bc08
        0x0040bc0c
        0x0040bc25
        0x0040bc25
        0x0040bc25
        0x0040bc0e
        0x0040bc0e
        0x0040bc10
        0x0040bc15
        0x0040bc18
        0x0040bc1b
        0x0040bc20
        0x0040bc20
        0x0040bc2c
        0x0040bc2c
        0x0040bc31
        0x0040bc32
        0x0040bc45
        0x0040bc4d
        0x0040bc52
        0x0040b5f7
        0x0040b5f7
        0x00000000
        0x0040b5f7
        0x00000000
        0x0040b5f1
        0x0040bace
        0x0040bad0
        0x0040bb20
        0x0040bb23
        0x0040bb24
        0x0040bb26
        0x0040bb2e
        0x0040bb33
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040AC42
        • __vbaVarDup.MSVBVM60 ref: 0040AC8E
        • #544.MSVBVM60(?,?), ref: 0040AC9E
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 0040ACC5
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0040ACDE
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,00401196), ref: 0040AD08
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AD41
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CC8,00000108), ref: 0040AD8B
        • __vbaNew2.MSVBVM60(00401CF8,0040D33C), ref: 0040ADB2
        • __vbaChkstk.MSVBVM60(?), ref: 0040AE16
        • __vbaChkstk.MSVBVM60(?), ref: 0040AE27
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE8,00000038), ref: 0040AE6D
        • __vbaVar2Vec.MSVBVM60(?,?), ref: 0040AE8F
        • __vbaAryMove.MSVBVM60(?,?,?,?), ref: 0040AE9F
        • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0040AEA7
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,00401196), ref: 0040AED4
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AF0D
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,00000158), ref: 0040AF57
        • __vbaFreeStr.MSVBVM60 ref: 0040AFB9
        • __vbaFreeObj.MSVBVM60 ref: 0040AFC1
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040AFD9
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B012
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,000000F8), ref: 0040B05C
        • __vbaNew2.MSVBVM60(00401F28,0040D010), ref: 0040B083
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$New2$CheckFreeHresult$Chkstk$#544ListMoveVar2
        • String ID: 19:19:19
        • API String ID: 1310212564-362381601
        • Opcode ID: 3c3dc0e2d3bd6f3cde9e0fe794caa80fb8c09095824f8f1baba0e15d6df4fd51
        • Instruction ID: 0f4cb08cae04ebba3e7a54ba54b2d06a3d04cb24a47c9563dc71870dea6d6b0b
        • Opcode Fuzzy Hash: 3c3dc0e2d3bd6f3cde9e0fe794caa80fb8c09095824f8f1baba0e15d6df4fd51
        • Instruction Fuzzy Hash: 0F82D274940219EFDB20DF90CC45BDDB7B8BF08304F1085EAE509BB2A1DB795A859F98
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 274 4012c4-4012ec #100
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: a327c935cb9afd8eaa389f92eb1f48e7ddd876e95509a3d4a2e94d9348f16cd3
        • Instruction ID: ff1d196db50113b9839f05876290471ed52781a40995303898d5efb940f021b1
        • Opcode Fuzzy Hash: a327c935cb9afd8eaa389f92eb1f48e7ddd876e95509a3d4a2e94d9348f16cd3
        • Instruction Fuzzy Hash: BBD02B2518E3C80EC30366611832A823FB48C136A431B02EB9580EB9B38129180A8376
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 275 40988d-4098a5 276 4098a7-4098aa 275->276 277 40991e-409932 275->277 279 4098d5-4098de 276->279 280 4098ac-4098b1 276->280 284 409937-4099d9 277->284 282 4098e0-4098e6 279->282 283 409908-40991d 279->283 281 4098b8-4098ce 280->281 281->279 282->281 285 4098e9-4098f1 282->285 283->277 284->284 286 4099df-409ba6 284->286 288 4098f3-409907 285->288 289 409888-40988a 285->289 287 409ba9-409c03 286->287 287->287 290 409c05-409e06 VirtualAlloc 287->290 288->283 289->275 292 409e0a-409ec4 290->292 292->292 293 409eca-409f02 292->293
        C-Code - Quality: 78%
        			E0040988D(intOrPtr __eax, signed int __ebx, void* __ecx, signed int __edx, void* __edi, void* __esi) {
        				signed int _t24;
        				signed int _t48;
        				signed int _t51;
        				void* _t74;
        				void* _t81;
        				void* _t88;
        				void* _t91;
        				signed int _t94;
        				signed int _t97;
        				intOrPtr _t125;
        				signed int _t174;
        				void* _t176;
        				void* _t180;
        				signed int _t212;
        				signed int _t214;
        				signed int _t242;
        				signed int _t250;
        				signed int _t257;
        				signed int _t271;
        				signed int _t286;
        				signed int _t289;
        				signed int _t292;
        				signed int _t301;
        				void* _t305;
        				void* _t328;
        				void* _t349;
        				void* _t356;
        				void* _t381;
        				void* _t406;
        				void* _t416;
        				signed int _t417;
        				void* _t422;
        				void* _t423;
        
        				L0:
        				while(1) {
        					L0:
        					_t302 = __edi;
        					_t250 = __edx;
        					_t176 = __ecx;
        					_t94 = __ebx;
        					asm("sbb al, cl");
        					asm("unpckhps xmm3, [eax]");
        					 *__ebx =  *__ebx - __edx;
        					asm("cld");
        					asm("les ebp, [ecx]");
        					_t1 = __edi - 0x4005b729;
        					 *_t1 = __eax;
        					_t356 = __esi - 1;
        					_t24 =  *_t1 - 0xbf;
        					if((_t24 & 0x000000a9) > 0) {
        						break;
        					}
        					L4:
        					 *_t24 =  *_t24 - __ecx;
        					_t423 =  *_t24;
        					_t24 = _t97;
        					if(_t423 > 0) {
        						L7:
        						asm("sbb [eax], ch");
        						asm("rcl byte [edi+0x11d788cf], 0x7e");
        						while(1) {
        							L8:
        							_t174 = _t250;
        							asm("adc [esi+0x77], edi");
        							_t9 = _t176 + 0x50a89781;
        							 *_t9 =  *(_t176 + 0x50a89781) - _t176;
        							__eflags =  *_t9;
        							__eflags = _t24 & 0x50a89781;
        							asm("popfd");
        							asm("repe loopne 0xffffffd2");
        							asm("sti");
        							_t250 = 0xf8;
        							_t356 = _t356 -  *0xf8;
        							_pop(_t416);
        							_t97 = _t174 + 1;
        							__eflags = _t97;
        							asm("cmpsd");
        							if(__eflags < 0) {
        								L1:
        								asm("lodsd");
        								_t302 = _t302 - 1;
        								_t422 = _t302;
        								L2:
        								if(_t422 >= 0) {
        									continue;
        								} else {
        									L3:
        									asm("invalid");
        									goto L0;
        								}
        							} else {
        								L10:
        								_push(_t416);
        								asm("rcr dword [edi-0x77], 0x4");
        								if(__eflags >= 0) {
        									L15:
        									_t257 = _t301;
        									__eflags = _t257;
        									_t180 = 0x531b408;
        									L16:
        									_t94 = _t97;
        									_t24 = _t24;
        									_t356 = _t356;
        									_t302 = _t305;
        									_t176 = _t180;
        									_t250 = _t257;
        									__eflags = _t250;
        								} else {
        									L11:
        									_t356 = 0x700b1c3;
        									 *_t24 =  *_t24 + _t24;
        									_pop(es);
        									 *_t24 =  *_t24 + _t24;
        									_pop(es);
        									 *_t24 =  *_t24 + _t24;
        									__eflags =  *_t24;
        									_pop(es);
        									break;
        								}
        								L17:
        								_t24 = _t24;
        								_t356 = _t356;
        								_t305 = _t302;
        								_t97 = _t94;
        								_t257 = _t250;
        								_t180 = _t176 - 0xffffffffffffffff;
        								__eflags = _t180 - 1;
        								if(_t180 != 1) {
        									goto L16;
        								}
        								L18:
        								_t271 = _t257;
        								_t381 = _t356;
        								_t328 = 0x3fffff + _t180;
        								_t212 = 0x1000;
        								_t125 =  *0x3a4769;
        								_t48 =  *0x003A27F4;
        								__eflags = _t48;
        								do {
        									L19:
        									asm("emms");
        									_t51 = _t48 - 1;
        									_push( *_t51);
        									_t271 = _t271;
        									_t125 = _t125;
        									_pop(_t214);
        									_t328 = _t328;
        									_t48 = _t51;
        									_t212 = _t214;
        									_t381 = _t381;
        									__eflags = _t212 - _t125;
        								} while (_t212 != _t125);
        								_t74 = VirtualAlloc(0, 0xc000, 0x1000, 0x40); // executed
        								_t286 = 0;
        								_t349 = _t328;
        								_t417 = 0x75e0;
        								_t81 = _t74;
        								_t406 = _t381;
        								_t289 = _t286 | 0x0040273c;
        								_t242 = _t212;
        								__eflags = _t242;
        								do {
        									L21:
        									_t292 = _t289;
        									 *_t19 = 0 +  *((intOrPtr*)(_t292 + _t417));
        									_t88 = _t81;
        									 *(_t88 + _t417) =  *(_t88 + _t417) ^ 0x28777ea9;
        									_t81 = _t88;
        									_t242 = _t242;
        									_t349 = _t349;
        									_t289 = _t292;
        									_t406 = _t406;
        									_t417 = _t417 - 0xc + 8;
        									__eflags = _t417;
        								} while (_t417 >= 0);
        								_t91 = _t81;
        								_push(_t91);
        								__eflags = _t289;
        								return _t91;
        							}
        							goto L23;
        						}
        						L12:
        						 *_t24 =  *_t24 + _t24;
        						_pop(es);
        						 *_t24 =  *_t24 + _t24;
        						_pop(es);
        						 *_t24 =  *_t24 + _t24;
        						_pop(es);
        						 *_t24 =  *_t24 + _t24;
        						_pop(es);
        						_t13 = _t250 - 0x7eb6eb61;
        						 *_t13 =  *(_t250 - 0x7eb6eb61) + _t24;
        						__eflags =  *_t13;
        						 *(_t416 + 0x26) = _t250;
        						_push(_t356);
        						break;
        					} else {
        						L5:
        						asm("adc dword [edi+0x700b1c3], 0x70000");
        						L6:
        						return __edi;
        					}
        					L23:
        				}
        				L13:
        				if(__eflags >= 0) {
        					_t305 = _t302;
        					_t97 = _t94;
        					_t301 = _t250;
        					__eflags = _t301;
        					goto L15;
        				}
        				goto L17;
        			}




































        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988d
        0x0040988f
        0x00409892
        0x00409894
        0x00409897
        0x00409899
        0x00409899
        0x0040989f
        0x004098a0
        0x004098a5
        0x00000000
        0x00000000
        0x004098a7
        0x004098a7
        0x004098a7
        0x004098a9
        0x004098aa
        0x004098d5
        0x004098d5
        0x004098d7
        0x004098da
        0x004098da
        0x004098da
        0x004098dc
        0x004098df
        0x004098df
        0x004098df
        0x004098e0
        0x004098e5
        0x004098e6
        0x004098e9
        0x004098ea
        0x004098ec
        0x004098ee
        0x004098ef
        0x004098ef
        0x004098f0
        0x004098f1
        0x00409888
        0x00409888
        0x00409889
        0x00409889
        0x0040988a
        0x0040988a
        0x00000000
        0x0040988c
        0x0040988c
        0x0040988c
        0x00000000
        0x0040988c
        0x004098f3
        0x004098f3
        0x004098f3
        0x004098f4
        0x004098f8
        0x0040992f
        0x0040992f
        0x0040992f
        0x00409932
        0x00409937
        0x0040996c
        0x00409976
        0x00409979
        0x0040997d
        0x00409981
        0x00409985
        0x00409985
        0x004098fa
        0x004098fa
        0x004098fa
        0x004098ff
        0x00409901
        0x00409902
        0x00409904
        0x00409905
        0x00409905
        0x00409907
        0x00000000
        0x00409907
        0x00409986
        0x004099b9
        0x004099bd
        0x004099c1
        0x004099c8
        0x004099cf
        0x004099d2
        0x004099d6
        0x004099d9
        0x00000000
        0x00000000
        0x004099df
        0x00409b94
        0x00409b97
        0x00409b9d
        0x00409ba0
        0x00409ba3
        0x00409ba6
        0x00409ba6
        0x00409ba9
        0x00409ba9
        0x00409bbd
        0x00409bc6
        0x00409bd1
        0x00409bd3
        0x00409be0
        0x00409be3
        0x00409be7
        0x00409bf2
        0x00409bf9
        0x00409bfd
        0x00409c01
        0x00409c01
        0x00409d7f
        0x00409db2
        0x00409ddf
        0x00409de7
        0x00409df3
        0x00409df7
        0x00409e03
        0x00409e06
        0x00409e06
        0x00409e0a
        0x00409e0a
        0x00409e2d
        0x00409e6f
        0x00409e78
        0x00409e82
        0x00409ea2
        0x00409eac
        0x00409eb3
        0x00409eb6
        0x00409eb9
        0x00409ec1
        0x00409ec1
        0x00409ec1
        0x00409ed8
        0x00409ee3
        0x00409efe
        0x00409f02
        0x00409f02
        0x00000000
        0x004098f1
        0x00409908
        0x00409908
        0x0040990a
        0x0040990b
        0x0040990d
        0x0040990e
        0x00409910
        0x00409911
        0x00409913
        0x00409914
        0x00409914
        0x00409914
        0x0040991a
        0x0040991d
        0x00000000
        0x004098ac
        0x004098ac
        0x004098b1
        0x004098b2
        0x004098b3
        0x004098b3
        0x00000000
        0x004098aa
        0x0040991e
        0x0040991e
        0x00409923
        0x0040992a
        0x0040992e
        0x0040992e
        0x00000000
        0x0040992e
        0x00000000

        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID:
        • String ID: iG:
        • API String ID: 0-3245550029
        • Opcode ID: 8214a14a682bac179f6452eeb5020b205cd6efe0723ffe8b5edd5f022fda3f88
        • Instruction ID: 1f90e8d6304d2ebb77651c4749cc6e93bf62586244a43c9f5d87f14954fde794
        • Opcode Fuzzy Hash: 8214a14a682bac179f6452eeb5020b205cd6efe0723ffe8b5edd5f022fda3f88
        • Instruction Fuzzy Hash: CFF19EDFE15A1207F3452938FE693DB1B8AC7717AFE1B42769D0966ECBB02E0B050144
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 294 4098d1-4098d3 295 4098d5-4098de 294->295 296 4098e0-4098e6 295->296 297 409908-40991d 295->297 298 4098b8-4098ce 296->298 299 4098e9-4098f1 296->299 300 40991e-409932 297->300 298->295 301 4098f3-409907 299->301 302 409888-4098a5 299->302 306 409937-4099d9 300->306 301->297 302->300 307 4098a7-4098aa 302->307 306->306 308 4099df-409ba6 306->308 307->295 310 4098ac-4098b1 307->310 309 409ba9-409c03 308->309 309->309 311 409c05-409e06 VirtualAlloc 309->311 310->298 312 409e0a-409ec4 311->312 312->312 313 409eca-409f02 312->313
        C-Code - Quality: 74%
        			E004098D1(signed char __eax, void* __ecx, signed int __edx, void* __edi, void* __esi) {
        				signed char _t22;
        				signed int _t47;
        				signed int _t50;
        				void* _t73;
        				void* _t80;
        				void* _t87;
        				void* _t90;
        				signed char _t93;
        				signed int _t94;
        				intOrPtr _t124;
        				void* _t174;
        				void* _t178;
        				signed int _t210;
        				signed int _t212;
        				signed int _t240;
        				signed int _t248;
        				signed int _t255;
        				signed int _t269;
        				signed int _t284;
        				signed int _t287;
        				signed int _t290;
        				void* _t299;
        				void* _t324;
        				void* _t345;
        				void* _t351;
        				void* _t376;
        				void* _t401;
        				void* _t411;
        				signed int _t412;
        				void* _t415;
        				signed int _t418;
        
        				_t351 = __esi;
        				_t299 = __edi;
        				_t248 = __edx;
        				_t174 = __ecx;
        				_t22 = __eax;
        				asm("sbb al, cl");
        				asm("sbb edi, ebp");
        				do {
        					asm("sbb [eax], ch");
        					asm("rcl byte [edi+0x11d788cf], 0x7e");
        					while(1) {
        						_t94 = _t248;
        						asm("adc [esi+0x77], edi");
        						_t9 = _t174 + 0x50a89781;
        						 *_t9 =  *(_t174 + 0x50a89781) - _t174;
        						__eflags =  *_t9;
        						__eflags = _t22 & 0x50a89781;
        						asm("popfd");
        						asm("repe loopne 0xffffffd2");
        						asm("sti");
        						_t248 = 0xf8;
        						_t351 = _t351 -  *0xf8;
        						_pop(_t411);
        						_t93 = _t94 + 1;
        						__eflags = _t93;
        						asm("cmpsd");
        						if(__eflags < 0) {
        							asm("lodsd");
        							_t299 = _t299 - 1;
        							_t415 = _t299;
        							if(_t415 >= 0) {
        								continue;
        							} else {
        								asm("invalid");
        								asm("sbb al, cl");
        								asm("unpckhps xmm3, [eax]");
        								 *_t93 =  *_t93 - 0xf8;
        								asm("cld");
        								asm("les ebp, [ecx]");
        								_t1 = _t299 - 0x4005b729;
        								 *_t1 = _t22;
        								_t351 = _t351 - 1;
        								_t22 =  *_t1 - 0xbf;
        								if((_t22 & 0x000000a9) > 0) {
        									L14:
        									if(__eflags >= 0) {
        										_t299 = _t299;
        										_t93 = _t93;
        										_t248 = _t248;
        										__eflags = _t248;
        										goto L16;
        									}
        									goto L18;
        								} else {
        									goto L5;
        								}
        							}
        						} else {
        							_push(_t411);
        							asm("rcr dword [edi-0x77], 0x4");
        							if(__eflags >= 0) {
        								L16:
        								_t255 = _t248;
        								__eflags = _t255;
        								_t178 = 0x531b408;
        								L17:
        								_t93 = _t93;
        								_t22 = _t22;
        								_t351 = _t351;
        								_t299 = _t299;
        								_t174 = _t178;
        								_t248 = _t255;
        								__eflags = _t248;
        							} else {
        								_t351 = 0x700b1c3;
        								 *_t22 =  *_t22 + _t22;
        								_pop(es);
        								 *_t22 =  *_t22 + _t22;
        								_pop(es);
        								 *_t22 =  *_t22 + _t22;
        								__eflags =  *_t22;
        								_pop(es);
        								break;
        							}
        							L18:
        							_t22 = _t22;
        							_t351 = _t351;
        							_t299 = _t299;
        							_t93 = _t93;
        							_t255 = _t248;
        							_t178 = _t174 - 0xffffffffffffffff;
        							__eflags = _t178 - 1;
        							if(_t178 != 1) {
        								goto L17;
        							}
        							_t269 = _t255;
        							_t376 = _t351;
        							_t324 = 0x3fffff + _t178;
        							_t210 = 0x1000;
        							_t124 =  *0x3a4769;
        							_t47 =  *0x003A27F4;
        							__eflags = _t47;
        							do {
        								asm("emms");
        								_t50 = _t47 - 1;
        								_push( *_t50);
        								_t269 = _t269;
        								_t124 = _t124;
        								_pop(_t212);
        								_t324 = _t324;
        								_t47 = _t50;
        								_t210 = _t212;
        								_t376 = _t376;
        								__eflags = _t210 - _t124;
        							} while (_t210 != _t124);
        							_t73 = VirtualAlloc(0, 0xc000, 0x1000, 0x40); // executed
        							_t284 = 0;
        							_t345 = _t324;
        							_t412 = 0x75e0;
        							_t80 = _t73;
        							_t401 = _t376;
        							_t287 = _t284 | 0x0040273c;
        							_t240 = _t210;
        							__eflags = _t240;
        							do {
        								_t290 = _t287;
        								 *_t19 = 0 +  *((intOrPtr*)(_t290 + _t412));
        								_t87 = _t80;
        								 *(_t87 + _t412) =  *(_t87 + _t412) ^ 0x28777ea9;
        								_t80 = _t87;
        								_t240 = _t240;
        								_t345 = _t345;
        								_t287 = _t290;
        								_t401 = _t401;
        								_t412 = _t412 - 0xc + 8;
        								__eflags = _t412;
        							} while (_t412 >= 0);
        							_t90 = _t80;
        							_push(_t90);
        							__eflags = _t287;
        							return _t90;
        						}
        						L24:
        					}
        					 *_t22 =  *_t22 + _t22;
        					_pop(es);
        					 *_t22 =  *_t22 + _t22;
        					_pop(es);
        					 *_t22 =  *_t22 + _t22;
        					_pop(es);
        					 *_t22 =  *_t22 + _t22;
        					_pop(es);
        					_t13 = _t248 - 0x7eb6eb61;
        					 *_t13 =  *(_t248 - 0x7eb6eb61) + _t22;
        					__eflags =  *_t13;
        					 *(_t411 + 0x26) = _t248;
        					_push(_t351);
        					goto L14;
        					L5:
        					 *_t22 =  *_t22 - _t174;
        					_t418 =  *_t22;
        					_t22 = _t93;
        				} while (_t418 > 0);
        				asm("adc dword [edi+0x700b1c3], 0x70000");
        				return _t299;
        				goto L24;
        			}


































        0x004098d1
        0x004098d1
        0x004098d1
        0x004098d1
        0x004098d1
        0x004098d1
        0x004098d3
        0x004098d5
        0x004098d5
        0x004098d7
        0x004098da
        0x004098da
        0x004098dc
        0x004098df
        0x004098df
        0x004098df
        0x004098e0
        0x004098e5
        0x004098e6
        0x004098e9
        0x004098ea
        0x004098ec
        0x004098ee
        0x004098ef
        0x004098ef
        0x004098f0
        0x004098f1
        0x00409888
        0x00409889
        0x00409889
        0x0040988a
        0x00000000
        0x0040988c
        0x0040988c
        0x0040988d
        0x0040988f
        0x00409892
        0x00409894
        0x00409897
        0x00409899
        0x00409899
        0x0040989f
        0x004098a0
        0x004098a5
        0x0040991e
        0x0040991e
        0x00409923
        0x0040992a
        0x0040992e
        0x0040992e
        0x00000000
        0x0040992e
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004098a5
        0x004098f3
        0x004098f3
        0x004098f4
        0x004098f8
        0x0040992f
        0x0040992f
        0x0040992f
        0x00409932
        0x00409937
        0x0040996c
        0x00409976
        0x00409979
        0x0040997d
        0x00409981
        0x00409985
        0x00409985
        0x004098fa
        0x004098fa
        0x004098ff
        0x00409901
        0x00409902
        0x00409904
        0x00409905
        0x00409905
        0x00409907
        0x00000000
        0x00409907
        0x00409986
        0x004099b9
        0x004099bd
        0x004099c1
        0x004099c8
        0x004099cf
        0x004099d2
        0x004099d6
        0x004099d9
        0x00000000
        0x00000000
        0x00409b94
        0x00409b97
        0x00409b9d
        0x00409ba0
        0x00409ba3
        0x00409ba6
        0x00409ba6
        0x00409ba9
        0x00409bbd
        0x00409bc6
        0x00409bd1
        0x00409bd3
        0x00409be0
        0x00409be3
        0x00409be7
        0x00409bf2
        0x00409bf9
        0x00409bfd
        0x00409c01
        0x00409c01
        0x00409d7f
        0x00409db2
        0x00409ddf
        0x00409de7
        0x00409df3
        0x00409df7
        0x00409e03
        0x00409e06
        0x00409e06
        0x00409e0a
        0x00409e2d
        0x00409e6f
        0x00409e78
        0x00409e82
        0x00409ea2
        0x00409eac
        0x00409eb3
        0x00409eb6
        0x00409eb9
        0x00409ec1
        0x00409ec1
        0x00409ec1
        0x00409ed8
        0x00409ee3
        0x00409efe
        0x00409f02
        0x00409f02
        0x00000000
        0x004098f1
        0x00409908
        0x0040990a
        0x0040990b
        0x0040990d
        0x0040990e
        0x00409910
        0x00409911
        0x00409913
        0x00409914
        0x00409914
        0x00409914
        0x0040991a
        0x0040991d
        0x00000000
        0x004098a7
        0x004098a7
        0x004098a7
        0x004098a9
        0x004098a9
        0x004098b1
        0x004098b3
        0x00000000

        APIs
        • VirtualAlloc.KERNELBASE(?,0000C000,00001000,00000040), ref: 00409D7F
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: AllocVirtual
        • String ID: iG:
        • API String ID: 4275171209-3245550029
        • Opcode ID: 43a5971abd3e6b029626e5fad27a66f657c78f9c9352001df4774c9547f74bc2
        • Instruction ID: 52338fdc4a014a31af5538d6186879b9626616754362dbd600d17e2abc738c42
        • Opcode Fuzzy Hash: 43a5971abd3e6b029626e5fad27a66f657c78f9c9352001df4774c9547f74bc2
        • Instruction Fuzzy Hash: B8E14ADFE11A1207F7452938FE6A3DB1B8AC7707AFE1B46355E0966ECBB42E4B060144
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 27214a86d785568ee62d127fa90afa0d3943fe899ac57824447107c408394d03
        • Instruction ID: 58ee11cdaa8721b7e50cd9bac6dc6c574094995c3aca21cc03fc6165d2fcd42e
        • Opcode Fuzzy Hash: 27214a86d785568ee62d127fa90afa0d3943fe899ac57824447107c408394d03
        • Instruction Fuzzy Hash: 4AE177F1330306EEEF264E90CD85BF976ABAF41714F644225EE859B1D8C3F99884C645
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6b1abfe981ff77c6c298c842166c617b19b046159483b1b6f7dcf1d0e5d8cd3c
        • Instruction ID: b7031ac4d69ee16df63b34a856f148770038b606d0b26dbb8e2f707fc56a3047
        • Opcode Fuzzy Hash: 6b1abfe981ff77c6c298c842166c617b19b046159483b1b6f7dcf1d0e5d8cd3c
        • Instruction Fuzzy Hash: EA3148F1234306DEEF370ED4C554BB6B2AAAF01324F95422AC992871BCC3B5C4C5CA46
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 7d4bc2a6fbb52208d016fa8329e85cde57beb76ae398ae29380589df42364cd5
        • Instruction ID: aa6535c113bfb101cb7066fc2eaa444a9292eee55666139e6a0163d4bab82b22
        • Opcode Fuzzy Hash: 7d4bc2a6fbb52208d016fa8329e85cde57beb76ae398ae29380589df42364cd5
        • Instruction Fuzzy Hash: 53213EE257024A9EEF3339D49C54BE622279F51710FD48011F88E5B18DD77549D2DA12
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5d057300eda3c5dd89513ed7b673262dc2050431945913d93c34dafd9692adfa
        • Instruction ID: f58fa191fc79cdbe4ce49636f0e571a9016f814490274c802291e8a699d8080a
        • Opcode Fuzzy Hash: 5d057300eda3c5dd89513ed7b673262dc2050431945913d93c34dafd9692adfa
        • Instruction Fuzzy Hash: D0F096B12147028FC316DE58C5A4BD672B6DF193A0FD14155E94AC75ADD364DC90CA14
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 5c1e3f0183bb82b2b5372f7cb25d3e9d33244640a14821efa03bf405dfa39c74
        • Instruction ID: caf6d300f54210db664e5485fecad7b826a0026443426bc2148ebbd0368d5521
        • Opcode Fuzzy Hash: 5c1e3f0183bb82b2b5372f7cb25d3e9d33244640a14821efa03bf405dfa39c74
        • Instruction Fuzzy Hash: C7C04CF263A780CBC64ACA49D260E7173F1FB48751F810494E80B8B615C3A4E920C910
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 4dfea3d70e9d87741ba6b3cff401244933f7ad2467f37c5c9ce49ced6896f079
        • Instruction ID: 3fe667b01d1e958cd4efd47ae4ced43cd8ab35a23da10587b315a007304e35ca
        • Opcode Fuzzy Hash: 4dfea3d70e9d87741ba6b3cff401244933f7ad2467f37c5c9ce49ced6896f079
        • Instruction Fuzzy Hash: 68C04CF167B780CBC64ACA49D260E6173F0FB48B40F410498E856CB615C364E910C910
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000001.00000002.1158774979.0000000002230000.00000040.00000001.sdmp, Offset: 02230000, based on PE: false
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_2230000_cigar.jbxd
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: ffd365ba848cb6ed2d9f4443cf92c768e43f25abd2a74dfefb05125d32df141a
        • Instruction ID: a7e309f6f5b530c8633ec9ed6e9879a0950b68524dfad50b3602e58b0d29c376
        • Opcode Fuzzy Hash: ffd365ba848cb6ed2d9f4443cf92c768e43f25abd2a74dfefb05125d32df141a
        • Instruction Fuzzy Hash: 59C092B2280580CFFF06CA88D4C2B8073A2FB15B44B8804E0F013CF691C328ED42CA00
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 314 40b5e8-40b5f1 315 40bb53-40bba5 __vbaErrorOverflow __vbaChkstk __vbaStrCopy _CItan __vbaFpR8 314->315 316 40b5f7-40b603 314->316 319 40bc31-40bc52 __vbaFreeStr __vbaFreeObj 315->319 320 40bbab-40bbb2 315->320 321 40bac1-40bb33 __vbaAryDestruct __vbaFreeVar 316->321 322 40b609-40b610 316->322 323 40bbb4-40bbca __vbaNew2 320->323 324 40bbcc 320->324 325 40b612-40b62b __vbaNew2 322->325 326 40b62d 322->326 329 40bbd3-40bc0c __vbaCastObj __vbaObjSet 323->329 324->329 330 40b637-40b687 __vbaObjSet 325->330 326->330 334 40bc25 329->334 335 40bc0e-40bc23 __vbaHresultCheckObj 329->335 338 40b689-40b6aa __vbaHresultCheckObj 330->338 339 40b6ac 330->339 336 40bc29-40bc2c __vbaFreeObj 334->336 335->336 336->319 340 40b6b3-40b6ba 338->340 339->340 341 40b6d7 340->341 342 40b6bc-40b6d5 __vbaNew2 340->342 343 40b6e1-40b734 __vbaObjSet 341->343 342->343 346 40b736-40b757 __vbaHresultCheckObj 343->346 347 40b759 343->347 348 40b760-40b767 346->348 347->348 349 40b784 348->349 350 40b769-40b782 __vbaNew2 348->350 351 40b78e-40b7e1 __vbaObjSet 349->351 350->351 354 40b7e3-40b804 __vbaHresultCheckObj 351->354 355 40b806 351->355 356 40b80d-40b8a9 __vbaChkstk * 2 354->356 355->356 358 40b8cb 356->358 359 40b8ab-40b8c9 __vbaHresultCheckObj 356->359 360 40b8d2-40b900 __vbaFreeObjList __vbaFreeVar 358->360 359->360 361 40b902-40b91b __vbaNew2 360->361 362 40b91d 360->362 363 40b927-40b977 __vbaObjSet 361->363 362->363 366 40b999 363->366 367 40b979-40b997 __vbaHresultCheckObj 363->367 368 40b9a0-40b9f8 366->368 367->368 370 40ba1a 368->370 371 40b9fa-40ba18 __vbaHresultCheckObj 368->371 372 40ba21-40ba81 __vbaFreeObj 370->372 371->372 374 40baa3 372->374 375 40ba83-40baa1 __vbaHresultCheckObj 372->375 376 40baaa-40babc 374->376 375->376
        APIs
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?), ref: 0040B61C
        • __vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 0040B655
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D38,00000218,?,?), ref: 0040B69F
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?), ref: 0040B6C6
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?), ref: 0040B6FF
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D28,00000138,?,?,?,?), ref: 0040B74C
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?,?,?), ref: 0040B773
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?), ref: 0040B7AC
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,00000188,?,?,?,?,?,?), ref: 0040B7F9
        • __vbaAryDestruct.MSVBVM60(00000000,?,0040BB34,?,?), ref: 0040BB26
        • __vbaFreeVar.MSVBVM60(00000000,?,0040BB34,?,?), ref: 0040BB2E
        • __vbaErrorOverflow.MSVBVM60 ref: 0040BB53
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BB73
        • __vbaStrCopy.MSVBVM60(?,?,?,?,00401196), ref: 0040BB8B
        • _CItan.MSVBVM60(?,?,?,?,00401196), ref: 0040BB92
        • __vbaFpR8.MSVBVM60(?,?,?,?,00401196), ref: 0040BB97
        • __vbaNew2.MSVBVM60(00401CF8,0040D33C,?,?,?,?,00401196), ref: 0040BBBE
        • __vbaCastObj.MSVBVM60(?,00401D60,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BBE8
        • __vbaObjSet.MSVBVM60(?,00000000,?,00401D60,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BBF2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE8,00000040,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BC1B
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BC2C
        • __vbaFreeStr.MSVBVM60(0040BC53,?,?,?,?,00401196), ref: 0040BC45
        • __vbaFreeObj.MSVBVM60(0040BC53,?,?,?,?,00401196), ref: 0040BC4D
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$CheckFreeHresultNew2$CastChkstkCopyDestructErrorItanOverflow
        • String ID: Filmbyer
        • API String ID: 2409742240-3873735245
        • Opcode ID: d3d3ddf1345e4de3d70fdcafc0ab46e24dd9f3a5a90331c87c8270e7262e576e
        • Instruction ID: fcab1837ba74f9e6e6bd404ed5f040b3b103cb570ff63e621ea5d515a5bb2187
        • Opcode Fuzzy Hash: d3d3ddf1345e4de3d70fdcafc0ab46e24dd9f3a5a90331c87c8270e7262e576e
        • Instruction Fuzzy Hash: 86E1E374941219EFDB20DF90CC45BDDBBB4EB08304F1084FAE509BB2A1DB795A859F98
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        C-Code - Quality: 58%
        			E0040BB58(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a8) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v24;
        				intOrPtr _v28;
        				char _v40;
        				intOrPtr* _v44;
        				signed int _v48;
        				intOrPtr* _v56;
        				signed int _v60;
        				signed int _t25;
        				intOrPtr* _t27;
        				char* _t28;
        				intOrPtr _t42;
        
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t42;
        				_t25 = 0x28;
        				L00401190();
        				_v12 = _t42;
        				_v8 = 0x401110;
        				L00401244();
        				asm("fldz");
        				L00401214();
        				L0040123E();
        				asm("fcomp qword [0x401108]");
        				asm("fnstsw ax");
        				asm("sahf");
        				if(__eflags != 0) {
        					if( *0x40d33c != 0) {
        						_v56 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf8);
        						L00401286();
        						_v56 = 0x40d33c;
        					}
        					_t27 =  *_v56;
        					_v44 = _t27;
        					L00401238();
        					_t28 =  &_v40;
        					L0040128C();
        					_t25 =  *((intOrPtr*)( *_v44 + 0x40))(_v44, _t28, _t28, _t27, _v28, 0x401d60, L"Filmbyer");
        					asm("fclex");
        					_v48 = _t25;
        					if(_v48 >= 0) {
        						_t19 =  &_v60;
        						 *_t19 = _v60 & 0x00000000;
        						__eflags =  *_t19;
        					} else {
        						_push(0x40);
        						_push(0x401ce8);
        						_push(_v44);
        						_push(_v48);
        						L00401280();
        						_v60 = _t25;
        					}
        					L0040126E();
        				}
        				asm("wait");
        				_push(E0040BC53);
        				L00401268();
        				L0040126E();
        				return _t25;
        			}
















        0x0040bb5d
        0x0040bb68
        0x0040bb69
        0x0040bb72
        0x0040bb73
        0x0040bb7b
        0x0040bb7e
        0x0040bb8b
        0x0040bb90
        0x0040bb92
        0x0040bb97
        0x0040bb9c
        0x0040bba2
        0x0040bba4
        0x0040bba5
        0x0040bbb2
        0x0040bbcc
        0x0040bbb4
        0x0040bbb4
        0x0040bbb9
        0x0040bbbe
        0x0040bbc3
        0x0040bbc3
        0x0040bbd6
        0x0040bbd8
        0x0040bbe8
        0x0040bbee
        0x0040bbf2
        0x0040bc00
        0x0040bc03
        0x0040bc05
        0x0040bc0c
        0x0040bc25
        0x0040bc25
        0x0040bc25
        0x0040bc0e
        0x0040bc0e
        0x0040bc10
        0x0040bc15
        0x0040bc18
        0x0040bc1b
        0x0040bc20
        0x0040bc20
        0x0040bc2c
        0x0040bc2c
        0x0040bc31
        0x0040bc32
        0x0040bc45
        0x0040bc4d
        0x0040bc52

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BB73
        • __vbaStrCopy.MSVBVM60(?,?,?,?,00401196), ref: 0040BB8B
        • _CItan.MSVBVM60(?,?,?,?,00401196), ref: 0040BB92
        • __vbaFpR8.MSVBVM60(?,?,?,?,00401196), ref: 0040BB97
        • __vbaNew2.MSVBVM60(00401CF8,0040D33C,?,?,?,?,00401196), ref: 0040BBBE
        • __vbaCastObj.MSVBVM60(?,00401D60,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BBE8
        • __vbaObjSet.MSVBVM60(?,00000000,?,00401D60,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BBF2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE8,00000040,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BC1B
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040BC2C
        • __vbaFreeStr.MSVBVM60(0040BC53,?,?,?,?,00401196), ref: 0040BC45
        • __vbaFreeObj.MSVBVM60(0040BC53,?,?,?,?,00401196), ref: 0040BC4D
        Strings
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$Free$CastCheckChkstkCopyHresultItanNew2
        • String ID: Filmbyer
        • API String ID: 2758753910-3873735245
        • Opcode ID: 0ed7b6f845316ff4213b98d15c1bf196286709962640caa5058e6c08c6a43ba1
        • Instruction ID: a8f7352eeea61e17a3493b37e5e5c725fd250a6f2a164483800e52ea6520a540
        • Opcode Fuzzy Hash: 0ed7b6f845316ff4213b98d15c1bf196286709962640caa5058e6c08c6a43ba1
        • Instruction Fuzzy Hash: 39210770945208ABDB00EBA5C946BEEBBB4EB18714F20447FF501B61E1DB7859448BAD
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        C-Code - Quality: 61%
        			E0040BD94(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v32;
        				char _v36;
        				char _v52;
        				char _v68;
        				intOrPtr _v92;
        				intOrPtr _v100;
        				intOrPtr _v108;
        				char _v116;
        				void* _v120;
        				signed int _v124;
        				intOrPtr* _v136;
        				signed int _v140;
        				short _t50;
        				signed int _t53;
        				char* _t57;
        				void* _t71;
        				void* _t73;
        				intOrPtr _t74;
        
        				_t74 = _t73 - 0xc;
        				 *[fs:0x0] = _t74;
        				L00401190();
        				_v16 = _t74;
        				_v12 = 0x401138;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x401196, _t71);
        				_v92 = 0x401d74;
        				_v100 = 8;
        				L00401298();
        				_push( &_v52);
        				_push( &_v68);
        				L0040122C();
        				_v108 = 0x401d80;
        				_v116 = 0x8008;
        				_push( &_v68);
        				_t50 =  &_v116;
        				_push(_t50);
        				L004012A4();
        				_v120 = _t50;
        				_push( &_v68);
        				_push( &_v52);
        				_push(2);
        				L00401292();
        				_t53 = _v120;
        				if(_t53 != 0) {
        					if( *0x40d010 != 0) {
        						_v136 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f28);
        						L00401286();
        						_v136 = 0x40d010;
        					}
        					_t57 =  &_v36;
        					L0040128C();
        					_v120 = _t57;
        					_t53 =  *((intOrPtr*)( *_v120 + 0x48))(_v120,  &_v32, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x310))( *_v136));
        					asm("fclex");
        					_v124 = _t53;
        					if(_v124 >= 0) {
        						_v140 = _v140 & 0x00000000;
        					} else {
        						_push(0x48);
        						_push(0x401d18);
        						_push(_v120);
        						_push(_v124);
        						L00401280();
        						_v140 = _t53;
        					}
        					_push(_v32);
        					L00401226();
        					L00401268();
        					L0040126E();
        				}
        				_push(E0040BF0D);
        				return _t53;
        			}
























        0x0040bd97
        0x0040bda6
        0x0040bdb0
        0x0040bdb8
        0x0040bdbb
        0x0040bdc2
        0x0040bdd1
        0x0040bdd4
        0x0040bddb
        0x0040bde8
        0x0040bdf0
        0x0040bdf4
        0x0040bdf5
        0x0040bdfa
        0x0040be01
        0x0040be0b
        0x0040be0c
        0x0040be0f
        0x0040be10
        0x0040be15
        0x0040be1c
        0x0040be20
        0x0040be21
        0x0040be23
        0x0040be2b
        0x0040be31
        0x0040be3e
        0x0040be5b
        0x0040be40
        0x0040be40
        0x0040be45
        0x0040be4a
        0x0040be4f
        0x0040be4f
        0x0040be7f
        0x0040be83
        0x0040be88
        0x0040be97
        0x0040be9a
        0x0040be9c
        0x0040bea3
        0x0040bebf
        0x0040bea5
        0x0040bea5
        0x0040bea7
        0x0040beac
        0x0040beaf
        0x0040beb2
        0x0040beb7
        0x0040beb7
        0x0040bec6
        0x0040bec9
        0x0040bed1
        0x0040bed9
        0x0040bed9
        0x0040bede
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BDB0
        • __vbaVarDup.MSVBVM60 ref: 0040BDE8
        • #522.MSVBVM60(?,?), ref: 0040BDF5
        • __vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?), ref: 0040BE10
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 0040BE23
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,00401196), ref: 0040BE4A
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040BE83
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D18,00000048), ref: 0040BEB2
        • #532.MSVBVM60(?), ref: 0040BEC9
        • __vbaFreeStr.MSVBVM60(?), ref: 0040BED1
        • __vbaFreeObj.MSVBVM60(?), ref: 0040BED9
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$Free$#522#532CheckChkstkHresultListNew2
        • String ID:
        • API String ID: 332616431-0
        • Opcode ID: 86ea5bcc927d42ce3cc58a86bdf69b6870598ac254d0b644e43ff09b16067b6e
        • Instruction ID: ee4278a52ca44fc99c57ac2caeb7933529d27a2cc8fe3e431abc6bfcc752c45a
        • Opcode Fuzzy Hash: 86ea5bcc927d42ce3cc58a86bdf69b6870598ac254d0b644e43ff09b16067b6e
        • Instruction Fuzzy Hash: BB41F871900218ABCB10DFA1C945BEEBBB8BF08704F20457EE505BB1A1DB785949CF98
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 401 40bf88-40bfbc __vbaChkstk 402 40bfd6 401->402 403 40bfbe-40bfd4 __vbaNew2 401->403 404 40bfdd-40c012 __vbaObjSet 402->404 403->404 406 40c014-40c02a __vbaNew2 404->406 407 40c02c 404->407 408 40c033-40c06e __vbaObjSet 406->408 407->408 411 40c070-40c088 __vbaHresultCheckObj 408->411 412 40c08a 408->412 413 40c08e-40c0b9 __vbaChkstk 411->413 412->413 415 40c0d5 413->415 416 40c0bb-40c0d3 __vbaHresultCheckObj 413->416 417 40c0d9-40c116 __vbaFreeStr __vbaFreeObjList 415->417 416->417
        C-Code - Quality: 46%
        			E0040BF88(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v32;
        				char _v36;
        				char _v40;
        				intOrPtr _v48;
        				intOrPtr _v56;
        				intOrPtr* _v60;
        				signed int _v64;
        				intOrPtr* _v68;
        				signed int _v72;
        				intOrPtr* _v80;
        				intOrPtr* _v84;
        				signed int _v88;
        				signed int _v92;
        				char* _t50;
        				char* _t54;
        				signed int _t58;
        				signed int _t62;
        				char* _t64;
        				intOrPtr _t80;
        
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t80;
        				_push(0x48);
        				L00401190();
        				_v12 = _t80;
        				_v8 = 0x401148;
        				if( *0x40d010 != 0) {
        					_v80 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v80 = 0x40d010;
        				}
        				_push( *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x310))( *_v80));
        				_t50 =  &_v40;
        				_push(_t50);
        				L0040128C();
        				_v68 = _t50;
        				_v48 = 0x80020004;
        				_v56 = 0xa;
        				if( *0x40d010 != 0) {
        					_v84 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v84 = 0x40d010;
        				}
        				_t54 =  &_v36;
        				L0040128C();
        				_v60 = _t54;
        				_t58 =  *((intOrPtr*)( *_v60 + 0x108))(_v60,  &_v32, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x2fc))( *_v84));
        				asm("fclex");
        				_v64 = _t58;
        				if(_v64 >= 0) {
        					_v88 = _v88 & 0x00000000;
        				} else {
        					_push(0x108);
        					_push(0x401d08);
        					_push(_v60);
        					_push(_v64);
        					L00401280();
        					_v88 = _t58;
        				}
        				L00401190();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_t62 =  *((intOrPtr*)( *_v68 + 0x1ec))(_v68, _v32, 0x10);
        				asm("fclex");
        				_v72 = _t62;
        				if(_v72 >= 0) {
        					_v92 = _v92 & 0x00000000;
        				} else {
        					_push(0x1ec);
        					_push(0x401d18);
        					_push(_v68);
        					_push(_v72);
        					L00401280();
        					_v92 = _t62;
        				}
        				L00401268();
        				_push( &_v40);
        				_t64 =  &_v36;
        				_push(_t64);
        				_push(2);
        				L00401262();
        				asm("wait");
        				_push(E0040C117);
        				return _t64;
        			}
























        0x0040bf8d
        0x0040bf98
        0x0040bf99
        0x0040bfa0
        0x0040bfa3
        0x0040bfab
        0x0040bfae
        0x0040bfbc
        0x0040bfd6
        0x0040bfbe
        0x0040bfbe
        0x0040bfc3
        0x0040bfc8
        0x0040bfcd
        0x0040bfcd
        0x0040bff0
        0x0040bff1
        0x0040bff4
        0x0040bff5
        0x0040bffa
        0x0040bffd
        0x0040c004
        0x0040c012
        0x0040c02c
        0x0040c014
        0x0040c014
        0x0040c019
        0x0040c01e
        0x0040c023
        0x0040c023
        0x0040c047
        0x0040c04b
        0x0040c050
        0x0040c05f
        0x0040c065
        0x0040c067
        0x0040c06e
        0x0040c08a
        0x0040c070
        0x0040c070
        0x0040c075
        0x0040c07a
        0x0040c07d
        0x0040c080
        0x0040c085
        0x0040c085
        0x0040c091
        0x0040c09b
        0x0040c09c
        0x0040c09d
        0x0040c09e
        0x0040c0aa
        0x0040c0b0
        0x0040c0b2
        0x0040c0b9
        0x0040c0d5
        0x0040c0bb
        0x0040c0bb
        0x0040c0c0
        0x0040c0c5
        0x0040c0c8
        0x0040c0cb
        0x0040c0d0
        0x0040c0d0
        0x0040c0dc
        0x0040c0e4
        0x0040c0e5
        0x0040c0e8
        0x0040c0e9
        0x0040c0eb
        0x0040c0f3
        0x0040c0f4
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BFA3
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?,00401196), ref: 0040BFC8
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040BFF5
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,00000000), ref: 0040C01E
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040C04B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D08,00000108), ref: 0040C080
        • __vbaChkstk.MSVBVM60 ref: 0040C091
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D18,000001EC), ref: 0040C0CB
        • __vbaFreeStr.MSVBVM60 ref: 0040C0DC
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040C0EB
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$CheckChkstkFreeHresultNew2$List
        • String ID:
        • API String ID: 2926503497-0
        • Opcode ID: e5394bbe9ebe4425606f717bf713efa519844d60aa547b3048bf0b696acbbd6f
        • Instruction ID: 5150767566db2dc111d6275a47114f29edcbd13bef44ff5d3690d687e3ee8085
        • Opcode Fuzzy Hash: e5394bbe9ebe4425606f717bf713efa519844d60aa547b3048bf0b696acbbd6f
        • Instruction Fuzzy Hash: 1941F475D41208EFCB10DFD0C885B9DBBB9BF48704F20446AF501BB2A1C7B96946DB59
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 419 40c2eb-40c332 __vbaChkstk 421 40c334-40c34a __vbaNew2 419->421 422 40c34c 419->422 423 40c353-40c38e __vbaObjSet 421->423 422->423 426 40c390-40c3a8 __vbaHresultCheckObj 423->426 427 40c3aa 423->427 428 40c3ae-40c3c8 426->428 427->428 430 40c3e4 428->430 431 40c3ca-40c3e2 __vbaHresultCheckObj 428->431 432 40c3e8-40c410 __vbaFreeStr __vbaFreeObj 430->432 431->432
        C-Code - Quality: 61%
        			E0040C2EB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v36;
        				char _v40;
        				intOrPtr* _v44;
        				signed int _v48;
        				signed int _v52;
        				intOrPtr* _v64;
        				signed int _v68;
        				signed int _v72;
        				char* _t46;
        				signed int _t50;
        				signed int _t53;
        				void* _t62;
        				void* _t64;
        				intOrPtr _t65;
        
        				_t65 = _t64 - 0xc;
        				 *[fs:0x0] = _t65;
        				L00401190();
        				_v16 = _t65;
        				_v12 = 0x401180;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x401196, _t62);
        				if( *0x40d010 != 0) {
        					_v64 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f28);
        					L00401286();
        					_v64 = 0x40d010;
        				}
        				_t46 =  &_v40;
        				L0040128C();
        				_v44 = _t46;
        				_t50 =  *((intOrPtr*)( *_v44 + 0x218))(_v44,  &_v36, _t46,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x310))( *_v64));
        				asm("fclex");
        				_v48 = _t50;
        				if(_v48 >= 0) {
        					_v68 = _v68 & 0x00000000;
        				} else {
        					_push(0x218);
        					_push(0x401d18);
        					_push(_v44);
        					_push(_v48);
        					L00401280();
        					_v68 = _t50;
        				}
        				_t53 =  *((intOrPtr*)( *_a4 + 0x16c))(_a4, _v36);
        				asm("fclex");
        				_v52 = _t53;
        				if(_v52 >= 0) {
        					_v72 = _v72 & 0x00000000;
        				} else {
        					_push(0x16c);
        					_push(0x401b1c);
        					_push(_a4);
        					_push(_v52);
        					L00401280();
        					_v72 = _t53;
        				}
        				L00401268();
        				L0040126E();
        				_push(E0040C411);
        				return _t53;
        			}




















        0x0040c2ee
        0x0040c2fd
        0x0040c307
        0x0040c30f
        0x0040c312
        0x0040c319
        0x0040c328
        0x0040c332
        0x0040c34c
        0x0040c334
        0x0040c334
        0x0040c339
        0x0040c33e
        0x0040c343
        0x0040c343
        0x0040c367
        0x0040c36b
        0x0040c370
        0x0040c37f
        0x0040c385
        0x0040c387
        0x0040c38e
        0x0040c3aa
        0x0040c390
        0x0040c390
        0x0040c395
        0x0040c39a
        0x0040c39d
        0x0040c3a0
        0x0040c3a5
        0x0040c3a5
        0x0040c3b9
        0x0040c3bf
        0x0040c3c1
        0x0040c3c8
        0x0040c3e4
        0x0040c3ca
        0x0040c3ca
        0x0040c3cf
        0x0040c3d4
        0x0040c3d7
        0x0040c3da
        0x0040c3df
        0x0040c3df
        0x0040c3eb
        0x0040c3f3
        0x0040c3f8
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040C307
        • __vbaNew2.MSVBVM60(00401F28,0040D010,?,?,?,?,00401196), ref: 0040C33E
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040C36B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D18,00000218), ref: 0040C3A0
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401180,00401B1C,0000016C), ref: 0040C3DA
        • __vbaFreeStr.MSVBVM60 ref: 0040C3EB
        • __vbaFreeObj.MSVBVM60 ref: 0040C3F3
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$CheckFreeHresult$ChkstkNew2
        • String ID:
        • API String ID: 304406766-0
        • Opcode ID: 77bc10dc86ec7cc0ffba5d5dd1a38ec61fccac66e01f574fa7f13cb0b2e4c98a
        • Instruction ID: 673e3aa29e7eea82018a78d70960b027de05f29cdf2a45a7baeee9dba4d09d5d
        • Opcode Fuzzy Hash: 77bc10dc86ec7cc0ffba5d5dd1a38ec61fccac66e01f574fa7f13cb0b2e4c98a
        • Instruction Fuzzy Hash: FE31D475940208EFCB00EF95C885BDDBBB4BB08744F10856AF805BA2A1C7795945DBA8
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 434 40c132-40c1a1 __vbaChkstk __vbaVarDup * 2 437 40c1a3-40c1bb __vbaHresultCheckObj 434->437 438 40c1bd 434->438 439 40c1c1-40c1d7 __vbaFreeVar * 2 437->439 438->439
        C-Code - Quality: 65%
        			E0040C132(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12, void* _a28) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v40;
        				void* _v56;
        				signed int _v64;
        				signed int _v76;
        				signed int _t30;
        				void* _t40;
        				void* _t42;
        				intOrPtr _t43;
        
        				_t43 = _t42 - 0xc;
        				 *[fs:0x0] = _t43;
        				L00401190();
        				_v16 = _t43;
        				_v12 = 0x401158;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x401196, _t40);
        				L00401298();
        				L00401298();
        				_t30 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, 0);
        				asm("fclex");
        				_v64 = _t30;
        				if(_v64 >= 0) {
        					_v76 = _v76 & 0x00000000;
        				} else {
        					_push(0x15c);
        					_push(0x401b1c);
        					_push(_a4);
        					_push(_v64);
        					L00401280();
        					_v76 = _t30;
        				}
        				asm("wait");
        				_push(E0040C1D8);
        				L0040125C();
        				L0040125C();
        				return _t30;
        			}














        0x0040c135
        0x0040c144
        0x0040c14e
        0x0040c156
        0x0040c159
        0x0040c160
        0x0040c16f
        0x0040c178
        0x0040c183
        0x0040c192
        0x0040c198
        0x0040c19a
        0x0040c1a1
        0x0040c1bd
        0x0040c1a3
        0x0040c1a3
        0x0040c1a8
        0x0040c1ad
        0x0040c1b0
        0x0040c1b3
        0x0040c1b8
        0x0040c1b8
        0x0040c1c1
        0x0040c1c2
        0x0040c1ca
        0x0040c1d2
        0x0040c1d7

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040C14E
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401196), ref: 0040C178
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401196), ref: 0040C183
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401158,00401B1C,0000015C), ref: 0040C1B3
        • __vbaFreeVar.MSVBVM60(0040C1D8), ref: 0040C1CA
        • __vbaFreeVar.MSVBVM60(0040C1D8), ref: 0040C1D2
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$Free$CheckChkstkHresult
        • String ID:
        • API String ID: 3894782938-0
        • Opcode ID: 51fc652447ed378a9e1a5a10c6a7d57a2e1cc4e0a32eb19683255eadb61117cf
        • Instruction ID: ccc8c8648b120a88ce899b0d5127aaccf6047b9406e2f8cbd5c578e13953b61e
        • Opcode Fuzzy Hash: 51fc652447ed378a9e1a5a10c6a7d57a2e1cc4e0a32eb19683255eadb61117cf
        • Instruction Fuzzy Hash: FE11F530940209EFCB04EF95D886BDDBBB5EF44744F10846AF505BB1A1D7785A45CF84
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        • Executed
        • Not Executed
        control_flow_graph 440 40bcc1-40bd76 __vbaChkstk #714 __vbaVarTstNe __vbaFreeVarList
        C-Code - Quality: 45%
        			E0040BCC1(void* __ebx, void* __edi, void* __esi, signed int* _a24) {
        				intOrPtr _v12;
        				intOrPtr _v16;
        				long long _v48;
        				char _v56;
        				char _v72;
        				intOrPtr _v112;
        				char _v120;
        				short _v124;
        				short _t21;
        				char* _t23;
        				void* _t29;
        				intOrPtr _t30;
        
        				_t30 = _t29 - 0xc;
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t30;
        				_push(0x6c);
        				L00401190();
        				_v16 = _t30;
        				_v12 = 0x401128;
        				 *_a24 =  *_a24 & 0x00000000;
        				_v48 =  *0x401120;
        				_v56 = 5;
        				_push(0);
        				_push( &_v56);
        				_push( &_v72);
        				L00401232();
        				_v112 = 1;
        				_v120 = 0x8002;
        				_push( &_v72);
        				_t21 =  &_v120;
        				_push(_t21);
        				L004012A4();
        				_v124 = _t21;
        				_push( &_v72);
        				_t23 =  &_v56;
        				_push(_t23);
        				_push(2);
        				L00401292();
        				asm("wait");
        				_push(E0040BD77);
        				return _t23;
        			}















        0x0040bcc4
        0x0040bcc7
        0x0040bcd2
        0x0040bcd3
        0x0040bcda
        0x0040bcdd
        0x0040bce5
        0x0040bce8
        0x0040bcf2
        0x0040bcfb
        0x0040bcfe
        0x0040bd05
        0x0040bd0a
        0x0040bd0e
        0x0040bd0f
        0x0040bd14
        0x0040bd1b
        0x0040bd25
        0x0040bd26
        0x0040bd29
        0x0040bd2a
        0x0040bd2f
        0x0040bd36
        0x0040bd37
        0x0040bd3a
        0x0040bd3b
        0x0040bd3d
        0x0040bd45
        0x0040bd46
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BCDD
        • #714.MSVBVM60(?,00000005,00000000), ref: 0040BD0F
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BD2A
        • __vbaFreeVarList.MSVBVM60(00000002,00000005,?,00008002,?), ref: 0040BD3D
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$#714ChkstkFreeList
        • String ID:
        • API String ID: 1770595079-0
        • Opcode ID: 36bd1b2d8634d585e0ebe510babe823ce83eb34b9d74937dae906cf469fc27de
        • Instruction ID: fe0a0945cb4b76d70cfc65fa4f3b877efd16363c9481e10a5b18e53c0bffad70
        • Opcode Fuzzy Hash: 36bd1b2d8634d585e0ebe510babe823ce83eb34b9d74937dae906cf469fc27de
        • Instruction Fuzzy Hash: C0011B71840608AADB01DBD1D946BDEB7BCAF08704F20452AF500BB191E77856148B59
        Uniqueness

        Uniqueness Score: -1.00%

        Control-flow Graph

        C-Code - Quality: 21%
        			E0040BAD7() {
        				void* _t15;
        				void* _t17;
        
        				L00401268();
        				_push(_t17 - 0x64);
        				_push(_t17 - 0x60);
        				_push(_t17 - 0x5c);
        				_push(3);
        				L00401262();
        				_push(_t17 - 0x94);
        				_push(_t17 - 0x84);
        				_push(_t17 - 0x74);
        				_push(3);
        				L00401292();
        				_t15 = _t17 - 0x98;
        				_push(_t15);
        				_push(0);
        				L00401250();
        				return _t15;
        			}





        0x0040bada
        0x0040bae2
        0x0040bae6
        0x0040baea
        0x0040baeb
        0x0040baed
        0x0040bafb
        0x0040bb02
        0x0040bb06
        0x0040bb07
        0x0040bb09
        0x0040bb11
        0x0040bb17
        0x0040bb18
        0x0040bb1a
        0x0040bb1f

        APIs
        • __vbaFreeStr.MSVBVM60 ref: 0040BADA
        • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040BAED
        • __vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040BB09
        • __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0040BB1A
        Memory Dump Source
        • Source File: 00000001.00000002.1158563023.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000001.00000002.1158558545.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158570810.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000001.00000002.1158575628.000000000040F000.00000002.00020000.sdmp Download File
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_1_2_400000_cigar.jbxd
        Similarity
        • API ID: __vba$Free$List$Destruct
        • String ID:
        • API String ID: 3099906924-0
        • Opcode ID: a693cf5a0d4fccf362410a8285de665e368797833ec0a0337ce6bf5fc9c4fdf2
        • Instruction ID: 964588bb2faed70f4d7e614628e25e8f72b33493092df665ad207290d4404638
        • Opcode Fuzzy Hash: a693cf5a0d4fccf362410a8285de665e368797833ec0a0337ce6bf5fc9c4fdf2
        • Instruction Fuzzy Hash: 35E0757284411CAAEB11EAD1CD41FEE737CAF14304F4041ABB609F6096EA345B458B65
        Uniqueness

        Uniqueness Score: -1.00%