Play interactive tour

Edit tour

Analysis Report TNT Delivery Document.exe

Overview

General Information

Sample Name:	TNT Delivery Document.exe
Analysis ID:	358381
MD5:	cbaf832b5ff679eb876d12d89d337231
SHA1:	b95263edbe7c523e7d51396093209c187919257b
SHA256:	0b725a075b7e61c937650e5f643b40858563fa2f296e37f7d75d60ab35c28a33
Tags:	exeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Writes to foreign memory regions

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

TNT Delivery Document.exe (PID: 6288 cmdline: 'C:\Users\user\Desktop\TNT Delivery Document.exe' MD5: CBAF832B5FF679EB876D12D89D337231)

RegAsm.exe (PID: 6392 cmdline: 'C:\Users\user\Desktop\TNT Delivery Document.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: RegAsm.exe PID: 6392	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: TNT Delivery Document.exe	Virustotal: Detection: 39%			Perma Link
Source: TNT Delivery Document.exe	ReversingLabs: Detection: 17%

Compliance:

Uses 32bit PE files

Show sources

Source: TNT Delivery Document.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: TNT Delivery Document.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: TNT Delivery Document.exe

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Process Stats: CPU usage > 98%
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D037D NtSetInformationThread,	2_2_020D037D
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D03A3 NtSetInformationThread,	2_2_020D03A3
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D1BCA NtWriteVirtualMemory,	2_2_020D1BCA
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D4575 NtProtectVirtualMemory,	2_2_020D4575

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403C44	2_2_00403C44
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403845	2_2_00403845
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403812	2_2_00403812
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040343E	2_2_0040343E
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004034D5	2_2_004034D5
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004038DC	2_2_004038DC
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040348C	2_2_0040348C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403896	2_2_00403896
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040357E	2_2_0040357E
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403522	2_2_00403522
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403926	2_2_00403926
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004031EE	2_2_004031EE
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004031A1	2_2_004031A1
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004035B8	2_2_004035B8
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403650	2_2_00403650
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403604	2_2_00403604
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403A04	2_2_00403A04
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040323B	2_2_0040323B
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004032CC	2_2_004032CC
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004036D7	2_2_004036D7
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403287	2_2_00403287
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403A8B	2_2_00403A8B
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403693	2_2_00403693
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403B5E	2_2_00403B5E
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040335F	2_2_0040335F
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403773	2_2_00403773
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403B11	2_2_00403B11
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040331C	2_2_0040331C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_0040373A	2_2_0040373A
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004033F6	2_2_004033F6
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004037FD	2_2_004037FD
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00403BA1	2_2_00403BA1
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004033A3	2_2_004033A3
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004037BE	2_2_004037BE

Source: TNT Delivery Document.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: TNT Delivery Document.exe, 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDitikeres4.exe vs TNT Delivery Document.exe
Source: TNT Delivery Document.exe, 00000002.00000002.535385883.00000000020A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs TNT Delivery Document.exe
Source: TNT Delivery Document.exe	Binary or memory string: OriginalFilenameDitikeres4.exe vs TNT Delivery Document.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: TNT Delivery Document.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal96.rans.troj.evad.winEXE@4/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_01

Source: TNT Delivery Document.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TNT Delivery Document.exe	Virustotal: Detection: 39%
Source: TNT Delivery Document.exe	ReversingLabs: Detection: 17%

Source: unknown	Process created: C:\Users\user\Desktop\TNT Delivery Document.exe 'C:\Users\user\Desktop\TNT Delivery Document.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\TNT Delivery Document.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\TNT Delivery Document.exe'	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6392, type: MEMORY

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00408812 pushad ; iretd	2_2_0040881A
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004038DC push 0FE1DEC2h; retn E1DEh	2_2_0040396B
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_004080EF push es; ret	2_2_00408116
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00405894 pushad ; retf	2_2_00405895
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00404DAE push edx; ret	2_2_00404DB0
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_00408B53 pushfd ; ret	2_2_00408B56
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D0236 pushad ; retf	2_2_020D023D
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D4249 push eax; iretd	2_2_020D4270
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D426B push eax; iretd	2_2_020D4270
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D4271 push esi; iretd	2_2_020D4274
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D4285 push ecx; iretd	2_2_020D429C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D42A7 push esi; iretd	2_2_020D42B4
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D3F36 push es; retf	2_2_020D3F56
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D3768 push es; iretd	2_2_020D379C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D377D push es; iretd	2_2_020D379C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D377F push es; iretd	2_2_020D379C
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D03CB push FFFFFFE9h; iretd	2_2_020D03E6
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D347A pushad ; retf	2_2_020D346E
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D148B push edi; retf	2_2_020D1532
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D14F7 push edi; retf	2_2_020D1532
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D1507 push edi; retf	2_2_020D1532
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D151D push edi; retf	2_2_020D1532
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D1572 push edi; retf	2_2_020D1532
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Code function: 2_2_020D45AE push esi; iretd	2_2_020D45B8

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D1F67 second address: 00000000020D1F67 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FABAC75B868h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp al, al 0x0000001f cmp bh, 00000064h 0x00000022 pop ecx 0x00000023 test cx, AFDEh 0x00000028 add edi, edx 0x0000002a dec ecx 0x0000002b cmp ecx, 00000000h 0x0000002e jne 00007FABAC75B849h 0x00000030 push ecx 0x00000031 call 00007FABAC75B886h 0x00000036 call 00007FABAC75B878h 0x0000003b lfence 0x0000003e mov edx, dword ptr [7FFE0014h] 0x00000044 lfence 0x00000047 ret 0x00000048 mov esi, edx 0x0000004a pushad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D218D second address: 00000000020D218D instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D47CB second address: 00000000020D47CB instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D33C7 second address: 00000000020D33C7 instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D3489 second address: 00000000020D3489 instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D1DFF second address: 00000000020D1DFF instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: RegAsm.exe, 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D1F67 second address: 00000000020D1F67 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FABAC75B868h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d cmp al, al 0x0000001f cmp bh, 00000064h 0x00000022 pop ecx 0x00000023 test cx, AFDEh 0x00000028 add edi, edx 0x0000002a dec ecx 0x0000002b cmp ecx, 00000000h 0x0000002e jne 00007FABAC75B849h 0x00000030 push ecx 0x00000031 call 00007FABAC75B886h 0x00000036 call 00007FABAC75B878h 0x0000003b lfence 0x0000003e mov edx, dword ptr [7FFE0014h] 0x00000044 lfence 0x00000047 ret 0x00000048 mov esi, edx 0x0000004a pushad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D2074 second address: 00000000020D2074 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FABACBD10D3h 0x0000001d popad 0x0000001e call 00007FABACBCF648h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D218D second address: 00000000020D218D instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D47CB second address: 00000000020D47CB instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D0623 second address: 00000000020D067E instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp ah, 00000013h 0x0000000e add edi, 04h 0x00000011 push edi 0x00000012 cmp dl, bl 0x00000014 jmp 00007FABAC75B89Ch 0x00000016 push 0003E800h 0x0000001b pushad 0x0000001c mov esi, 000000CAh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D067E second address: 00000000020D3CFB instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add edi, 04h 0x00000006 cmp esi, F1A58B31h 0x0000000c push edi 0x0000000d push 00000003h 0x0000000f cmp eax, ebx 0x00000011 push 00000030h 0x00000013 cmp dl, dl 0x00000015 test cl, cl 0x00000017 push dword ptr [ebp+0000009Ch] 0x0000001d push eax 0x0000001e cmp ax, bx 0x00000021 call 00007FABACBD35DAh 0x00000026 call 00007FABACBCF625h 0x0000002b pop ebx 0x0000002c sub ebx, 05h 0x0000002f inc ebx 0x00000030 dec ebx 0x00000031 xor edx, edx 0x00000033 mov eax, ebx 0x00000035 mov ecx, 00000004h 0x0000003a div ecx 0x0000003c cmp edx, 00000000h 0x0000003f jne 00007FABACBCF611h 0x00000041 dec ebx 0x00000042 xor edx, edx 0x00000044 mov eax, ebx 0x00000046 mov ecx, 00000004h 0x0000004b div ecx 0x0000004d cmp edx, 00000000h 0x00000050 jne 00007FABACBCF611h 0x00000052 movd mm3, ebx 0x00000055 jmp 00007FABACBCF636h 0x00000057 cmp edx, eax 0x00000059 jmp 00007FABACBCF636h 0x0000005b test al, bl 0x0000005d pop eax 0x0000005e movd mm1, eax 0x00000061 call 00007FABACBCEC6Ch 0x00000066 pushad 0x00000067 lfence 0x0000006a rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D0825 second address: 00000000020D087F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b cmp ah, FFFFFFE8h 0x0000000e mov ecx, dword ptr [ebp+1Ch] 0x00000011 cmp dl, bl 0x00000013 jmp 00007FABAC75B89Ch 0x00000015 mov edx, D034FC62h 0x0000001a pushad 0x0000001b mov esi, 00000077h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D33C7 second address: 00000000020D33C7 instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D3489 second address: 00000000020D3489 instructions:
Source: C:\Users\user\Desktop\TNT Delivery Document.exe	RDTSC instruction interceptor: First address: 00000000020D1DFF second address: 00000000020D1DFF instructions:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00D00ACB rdtsc

14_2_00D00ACB

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: RegAsm.exe, 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00D00ACB rdtsc

14_2_00D00ACB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D01E93 mov eax, dword ptr fs:[00000030h]	14_2_00D01E93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D03E81 mov eax, dword ptr fs:[00000030h]	14_2_00D03E81
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D03EB0 mov eax, dword ptr fs:[00000030h]	14_2_00D03EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D038A5 mov eax, dword ptr fs:[00000030h]	14_2_00D038A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D035D3 mov eax, dword ptr fs:[00000030h]	14_2_00D035D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D00FBA mov eax, dword ptr fs:[00000030h]	14_2_00D00FBA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00D0151D mov eax, dword ptr fs:[00000030h]	14_2_00D0151D

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D00000

Jump to behavior

Source: C:\Users\user\Desktop\TNT Delivery Document.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\TNT Delivery Document.exe'

Jump to behavior

Source: RegAsm.exe, 0000000E.00000002.524161760.0000000001540000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: RegAsm.exe, 0000000E.00000002.524161760.0000000001540000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 0000000E.00000002.524161760.0000000001540000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 0000000E.00000002.524161760.0000000001540000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00D02220 cpuid

14_2_00D02220

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection112	Virtualization/Sandbox Evasion21	OS Credential Dumping	Security Software Discovery521	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Process Injection112	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	DLL Side-Loading1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Information Discovery211	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
TNT Delivery Document.exe	39%	Virustotal		Browse
TNT Delivery Document.exe	17%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	358381
Start date:	25.02.2021
Start time:	15:00:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TNT Delivery Document.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.rans.troj.evad.winEXE@4/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 31.2% (good quality ratio 12.2%) Quality average: 27.4% Quality standard deviation: 37.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.965175275325986
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TNT Delivery Document.exe
File size:	86016
MD5:	cbaf832b5ff679eb876d12d89d337231
SHA1:	b95263edbe7c523e7d51396093209c187919257b
SHA256:	0b725a075b7e61c937650e5f643b40858563fa2f296e37f7d75d60ab35c28a33
SHA512:	7945bb795afea268c020de30e1f57f2aac723e709c2dc97e8dc003c570d11257363ef82b922310c28732a836e551e1fe484962cf4179f09822baa896e1bdc327
SSDEEP:	768:sIuaeV9jhbnf4oEh/VgnruMFG8xJ43ptv37FTQDEJg/agbbf0WcmCp+5yS4AyW5X:KVFRQougnSoif35aMrFKg3AXKvitnf
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...sP7`................. ...0...............0....@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x4014bc
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x60375073 [Thu Feb 25 07:23:31 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3a6673b23cf9b03cd6b926c02ab84460

Entrypoint Preview

Instruction
push 0040178Ch
call 00007FABACD2B173h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi+56AD29B0h], cl
nop
and cl, byte ptr [edi-5Dh]
dec esi
or eax, 997B82A2h
rol byte ptr [eax], 1
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], ah
and byte ptr [eax], ah
push edi
imul esp, dword ptr [eax+ecx*2+61h], 62656E76h
popad
jnc 00007FABACD2B1F5h
imul ebp, dword ptr [esi+65h], 20007374h
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or ebx, esp
or al, 05h
daa
and edx, ebp
test dword ptr [ecx+eax*4+34h], ecx
or dh, byte ptr [8092E160h]
fcom dword ptr [ecx+7Bh]
loope 00007FABACD2B1C9h
nop
dec byte ptr [esi-5Fh]
movsb
cmp al, cl
loope 00007FABACD2B1A8h
dec esp
test byte ptr [edx], bh
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add al, byte ptr [eax]
add byte ptr [ebx+00h], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [ebx+79h], dl
arpl word ptr [edi+6Eh], bp
jnc 00007FABACD2B183h
or eax, 4C000701h
dec ecx
dec esi
inc esp
inc ebp
dec esi
inc ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12554	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0xa48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x120	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11a60	0x12000	False	0.456271701389	data	6.50422226854	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x11bc	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0xa48	0x1000	False	0.18798828125	data	2.2532231996	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15918	0x130	data
RT_ICON	0x15630	0x2e8	data
RT_ICON	0x15508	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x154d8	0x30	data
RT_VERSION	0x15150	0x388	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, __vbaInStrVar, _CIlog, __vbaNew2, __vbaR8Str, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarAdd, __vbaLateMemCall, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Copyright 2016-2021 Proton Clear
InternalName	Ditikeres4
FileVersion	1.00
CompanyName	Proton Clear Inc.
LegalTrademarks	Copyright 2016-2021 Proton Clear
Comments	Proton Clear
ProductName	Proton Clear
ProductVersion	1.00
FileDescription	ProtonClear
OriginalFilename	Ditikeres4.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: TNT Delivery Document.exe PID: 6288 Parent PID: 5712

General

Start time:	15:00:57
Start date:	25/02/2021
Path:	C:\Users\user\Desktop\TNT Delivery Document.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNT Delivery Document.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	CBAF832B5FF679EB876D12D89D337231
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 6392 Parent PID: 6288

General

Start time:	15:02:03
Start date:	25/02/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\TNT Delivery Document.exe'
Imagebase:	0x8f0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4932 Parent PID: 6392

General

Start time:	15:02:04
Start date:	25/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: TNT Delivery Document.exe PID: 6288 Parent PID: 5712 TNT Delivery Document.exeCOMMON

Executed Functions

Function 004031A1, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 1273memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

%C, xrefs: 00403260
.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: %C$.g$w
API String ID: 4275171209-2986072898
Opcode ID: 9593790b7732d8c0b3394275afe711064ce7569b56a89c1d38dc4cb5ac71ff47
Instruction ID: 549ab8d04167ec414302e007fe756b7419b67291ae94a5988e775218b7005705
Opcode Fuzzy Hash: 9593790b7732d8c0b3394275afe711064ce7569b56a89c1d38dc4cb5ac71ff47
Instruction Fuzzy Hash: FB823882F2A71145FF732064C1D055D5542DF97382E328B3BDA6A729E53B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 004031EE, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 1257memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

%C, xrefs: 00403260
.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: %C$.g$w
API String ID: 4275171209-2986072898
Opcode ID: 7eefd32c15913d89ce010c0c94bc6bab4c2b213d51449ad591a4085a7d3e4100
Instruction ID: 8e6659c7b7310b30ee2057b94c1793bc0716c842f9b80195ba68b8fad3bf63ef
Opcode Fuzzy Hash: 7eefd32c15913d89ce010c0c94bc6bab4c2b213d51449ad591a4085a7d3e4100
Instruction Fuzzy Hash: F0723882F2A71145FF732064C1D055D5542DF97382E328B3BDA6A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 0040323B, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 1246memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

%C, xrefs: 00403260
.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: %C$.g$w
API String ID: 4275171209-2986072898
Opcode ID: aeb5add4d6fe1a92780f2c21f50885e24fcaeb548da13fa700d3c9d64b4c3b69
Instruction ID: 52449203e1a45df5a1f29faae9e9c8b2a524d4a563d8b34acf0625f7dddd4fce
Opcode Fuzzy Hash: aeb5add4d6fe1a92780f2c21f50885e24fcaeb548da13fa700d3c9d64b4c3b69
Instruction Fuzzy Hash: C9723882F2A71145FF732064C1D059D5542DF97382E328B3BD96A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 004032CC, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1228COMMON

Download Yara Rule

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: .g$w
API String ID: 0-4232771504
Opcode ID: 1925418e19cbebda7b84024d72c6846351fd9bba0c6612bd6675c93bb245503f
Instruction ID: 60be77bcde70696918da0e0888546df9da066754565b9bda94162da02371a4ad
Opcode Fuzzy Hash: 1925418e19cbebda7b84024d72c6846351fd9bba0c6612bd6675c93bb245503f
Instruction Fuzzy Hash: E2723983F2A71145FF732064C1D059D5541DF97382E328B3BDA6A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 00403287, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1220memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: .g$w
API String ID: 4275171209-4232771504
Opcode ID: 3b06f09a083e076ab0bc0f32ec23c9fccb69b5d6321232b8edab7d1dc1d73a76
Instruction ID: a2fc6080a1197344e1cc4a48f90ab39152b831301d1ec20e4c8a91308d9c922f
Opcode Fuzzy Hash: 3b06f09a083e076ab0bc0f32ec23c9fccb69b5d6321232b8edab7d1dc1d73a76
Instruction Fuzzy Hash: FD724882F2A71145FF732064C1D059D5542DF97382F328B3BD96A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 0040331C, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1212memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: .g$w
API String ID: 4275171209-4232771504
Opcode ID: a8460d8f76e512460ffcde1b6cdd81442849210a7c4f1f61cafab180b2312706
Instruction ID: 48783b82d370b7f3b316618b6860a23bed00cd0f13cd3f7a6cc5063def3e0143
Opcode Fuzzy Hash: a8460d8f76e512460ffcde1b6cdd81442849210a7c4f1f61cafab180b2312706
Instruction Fuzzy Hash: A4723983F2A71145FF732064C1D059D5541DF97382E328B3BDA6A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 0040335F, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1198memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: .g$w
API String ID: 4275171209-4232771504
Opcode ID: 1e5f0408e66658fee4c4fc2421cec882142dca7e063af1c5642572b739657940
Instruction ID: f3993b092d4f54d244b1638d93c71fa3a9466898cbe00d3d8f24e1062afec740
Opcode Fuzzy Hash: 1e5f0408e66658fee4c4fc2421cec882142dca7e063af1c5642572b739657940
Instruction Fuzzy Hash: FD724983F2A71145FF732064C1D059D5541DF97382E328B3BDA6A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 004033A3, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1179memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: .g$w
API String ID: 4275171209-4232771504
Opcode ID: dd4b2e4509bdb7f450039553aaf9e1cc8464abd4777f3cb79240aa50e5184337
Instruction ID: cf0630d26fc1a00fabd24800afa948e8993c8dcaa4435ff25bfe13cd5663598a
Opcode Fuzzy Hash: dd4b2e4509bdb7f450039553aaf9e1cc8464abd4777f3cb79240aa50e5184337
Instruction Fuzzy Hash: 31724983F2A71145FF732064C1D059D5541DF97382E328B3BDA6A729E53B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 004033F6, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1166memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

.g, xrefs: 00403427
w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: .g$w
API String ID: 4275171209-4232771504
Opcode ID: 0271ae87c9f61685dd4624c8db9435a0d1fd42cac95bfcfac8ff7d5cc6ec8ad4
Instruction ID: a767bcdd364446d16065d90ac75fb15aad1d658a0e75cf4c9371a970ddbe0f3d
Opcode Fuzzy Hash: 0271ae87c9f61685dd4624c8db9435a0d1fd42cac95bfcfac8ff7d5cc6ec8ad4
Instruction Fuzzy Hash: 6F724983F2A71145FF732064C1D059D5541DF93382E328B3BDA6A729E57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 0040343E, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 1154memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

w, xrefs: 004034FA
E111, xrefs: 00403440

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: E111$w
API String ID: 4275171209-286010886
Opcode ID: 9166ed225ac5bedae59ce789c0a69f86012041556971757d9d364137bb5ade3c
Instruction ID: 46099a48d071481bfff4b38fbbab5a0d1016343ad5108e6af064e7b04f63b273
Opcode Fuzzy Hash: 9166ed225ac5bedae59ce789c0a69f86012041556971757d9d364137bb5ade3c
Instruction Fuzzy Hash: E2725983F2A71145FF732064C1D056D5541DF93382E328B3BDA6A729E57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 004034D5, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 1142memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: w
API String ID: 4275171209-4266656565
Opcode ID: 27a936229fde74668614dd646fc50be74c090f68947c2d45b3ec7afa38afcdbc
Instruction ID: 69a259b270925de611e60111456e73a8dff3240e0b53e8bbf9167feac27ce488
Opcode Fuzzy Hash: 27a936229fde74668614dd646fc50be74c090f68947c2d45b3ec7afa38afcdbc
Instruction Fuzzy Hash: 95624882F2A71145FF732064C1D056D5541DF93382E32CB3BDA6A729E57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 0040348C, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 1136memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

w, xrefs: 004034FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: w
API String ID: 4275171209-4266656565
Opcode ID: 5f1f29e5ad5eba8f890c3583229a26b3b40a1834d12a37fb74c821050a33408d
Instruction ID: 236638423e928e183cd779d6aa085e666999a646ec5f7024b9bb9c9670d2d64b
Opcode Fuzzy Hash: 5f1f29e5ad5eba8f890c3583229a26b3b40a1834d12a37fb74c821050a33408d
Instruction Fuzzy Hash: AC725A83F2A70145FF732064C1D056D5541DF93382E328B3BDA6A729E57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 004036D7, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1042memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Strings

_7%%, xrefs: 004036D7

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: _7%%
API String ID: 4275171209-821639005
Opcode ID: b99cdf13f2e359c9df2c0645a6051152273e8ef43459049cbbea638c62f36b51
Instruction ID: f78847f05aa64d01f83e76c12451c091724f0647a889a91cbb9be3264a7b087d
Opcode Fuzzy Hash: b99cdf13f2e359c9df2c0645a6051152273e8ef43459049cbbea638c62f36b51
Instruction Fuzzy Hash: D4624882F2A71145FF732064C1D056D5542DF93382E318B3BDA6A728E57B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 004038DC, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1010
COMMONCrypto

Download Yara Rule

C-Code - Quality: 42%

			E004038DC(void* __eax, void* __edx, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr* _t38;

				if(__eflags != 0) {
					L21:
					asm("punpckldq mm5, mm3");
					L22:
					L20:
					asm("punpckldq xmm5, xmm3");
					goto L21;
				}
				if(__eflags != 0) {
					goto L22;
				}
				if(__eflags != 0) {
					asm("repe fcomp st0, st5");
					L24:
					st4 = __fp0;
					L25:
					__edx = __eax *  *(__esi + 0xf) >> 0x20;
					__eax = __eax *  *(__esi + 0xf);
					__eflags = __eax;
					L26:
					asm("punpckhbw mm0, mm2");
					return __eax;
				}
				if(__eflags != 0) {
					goto L24;
				}
				if(__eflags != 0) {
					goto L25;
				}
				if(__eflags != 0) {
					goto L26;
				}
				if(__eflags != 0) {
					return __eax;
				} else {
					if(__eflags == 0) {
						if(__eflags != 0) {
							asm("invalid");
							L30:
							asm("psubd xmm5, xmm2");
							L31:
							asm("cli");
							L32:
							L34:
							__eflags = __esi - 0x6be9;
							_pop(__eax);
							__edx - 0x211d = __esi - 0xc213;
							asm("fst st6");
							asm("fsincos");
							asm("wait");
							asm("fclex");
							asm("paddw xmm3, xmm7");
							asm("fdivp st1, st0");
							asm("fclex");
							asm("wait");
							asm("fninit");
							__esi - 0xe34d = __edx - 0xc56a;
							__esi - 0xdae5 = __esi - 0xcd5d;
							asm("pandn xmm7, xmm7");
							asm("fldln2");
							asm("fdivrp st5, st0");
							asm("ffree st5");
							asm("psubd mm2, mm7");
							__edi - 0x7932 = __ecx - 0x97d0;
							__eflags = __eax - __ebx;
							__ecx = 0x8000;
							asm("packssdw xmm3, xmm0");
							asm("fnop");
							asm("wait");
							asm("fld1");
							asm("psrld xmm4, 0x9a");
							0x8000 = 0x8000;
							asm("fptan");
							asm("pause");
							asm("pmulhw xmm6, xmm7");
							asm("wait");
							asm("pslld xmm2, 0x7f");
							asm("psraw mm7, mm5");
							0x8000 = 0x8000;
							asm("fsincos");
							asm("fldl2e");
							asm("pmulhw mm3, mm4");
							asm("fsubrp st3, st0");
							__fp0 = __fp0 + st7;
							asm("psubw xmm5, xmm5");
							0x8000 = 0x8000;
							asm("fxch st0, st1");
							asm("faddp st6, st0");
							__fp0 = __fp0 - st5;
							asm("pcmpeqd mm4, mm0");
							asm("fdecstp");
							asm("fclex");
							0x8000 = 0x8000;
							asm("wait");
							asm("packssdw mm3, mm7");
							asm("psubsw mm3, mm2");
							asm("fchs");
							asm("fyl2x");
							asm("punpcklwd mm6, mm3");
							asm("psubusb xmm2, xmm2");
							asm("movd xmm0, esp");
							__ecx = 0x8000;
							__ecx = 0x8000;
							asm("pand mm5, mm2");
							asm("packssdw xmm6, xmm4");
							asm("ffree st7");
							asm("wait");
							asm("fclex");
							asm("pause");
							asm("fsincos");
							if (__eflags != 0) goto L1;
							__eflags =  *__edi & __esp;
							asm("cld");
							asm("invalid");
						}
						if(__eflags != 0) {
							goto L30;
						}
						if(__eflags != 0) {
							goto L31;
						}
						if(__eflags != 0) {
							goto L32;
						}
						if(__eflags != 0) {
							goto 0x4b4b;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__ebx = __ebx - 1;
							__eflags = __ebx;
							goto L34;
						}
						_push( *_t38);
						asm("psraw mm7, mm5");
						asm("psubw xmm1, xmm6");
						asm("fclex");
						asm("fldlg2");
						asm("fxch st0, st1");
						asm("psubsw mm0, mm6");
						asm("fxtract");
						goto L20;
					}
				}
				asm("loope 0x11");
			}

0x004038e2
0x0040395f
0x0040395f
0x00403961
0x00403946
0x0040395e
0x00000000
0x0040395e
0x004038e4
0x00000000
0x00000000
0x004038e6
0x00403963
0x00403965
0x00403965
0x00403967
0x00403967
0x00403967
0x00403967
0x00403969
0x00403969
0x00000000
0x00403969
0x004038e8
0x00000000
0x00000000
0x004038ea
0x00000000
0x00000000
0x004038ec
0x00000000
0x00000000
0x004038ee
0x0040396b
0x004038f0
0x004038f0
0x004038f2
0x0040396f
0x00403971
0x00403971
0x00403973
0x00403973
0x00403975
0x00403994
0x00403994
0x0040399a
0x004039a1
0x004039a7
0x004039a9
0x004039ab
0x004039ac
0x004039ae
0x004039b2
0x004039b4
0x004039b6
0x004039b7
0x004039e1
0x004039ed
0x004039f3
0x004039f7
0x004039fb
0x004039fd
0x004039ff
0x00403a2a
0x00403a30
0x00403a32
0x00403a37
0x00403a3b
0x00403a3d
0x00403a3e
0x00403a40
0x00403a73
0x00403a78
0x00403a7a
0x00403a7c
0x00403a80
0x00403a81
0x00403a86
0x00403ab8
0x00403abd
0x00403abf
0x00403ac1
0x00403ac4
0x00403ac6
0x00403ac8
0x00403afc
0x00403b01
0x00403b03
0x00403b06
0x00403b08
0x00403b0b
0x00403b0d
0x00403b3f
0x00403b44
0x00403b45
0x00403b48
0x00403b4b
0x00403b4d
0x00403b4f
0x00403b52
0x00403b56
0x00403b84
0x00403b89
0x00403b8e
0x00403b91
0x00403b95
0x00403b97
0x00403b98
0x00403b9a
0x00403b9c
0x00403bbd
0x00403bbe
0x00403bc0
0x00403bc1
0x00403bc1
0x004038f4
0x00000000
0x00000000
0x004038f6
0x00000000
0x00000000
0x004038f8
0x00000000
0x00000000
0x004038fa
0x00403977
0x0040397e
0x0040397f
0x00403980
0x00403981
0x00403982
0x00403983
0x00403984
0x00403985
0x00403986
0x00403987
0x00403988
0x00403989
0x0040398a
0x0040398b
0x0040398c
0x0040398d
0x0040398e
0x0040398f
0x00403990
0x00403991
0x00403992
0x00403993
0x00403993
0x00000000
0x00403993
0x0040390e
0x00403910
0x00403913
0x00403917
0x00403919
0x0040391b
0x0040391d
0x00403920
0x00000000
0x00403922
0x004038f0
0x0040396d

Strings

`2{{, xrefs: 004038DD

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: `2{{
API String ID: 0-915476840
Opcode ID: 65b79ac49e2d4dc190f4ae01d240d7dca5a1cd5e384ed24b6b59cc1a3adde39a
Instruction ID: 71076f2e4c61c1f12da7a2a9951a4135c2a8a407f47d2aed62b77e4e9bfcff3c
Opcode Fuzzy Hash: 65b79ac49e2d4dc190f4ae01d240d7dca5a1cd5e384ed24b6b59cc1a3adde39a
Instruction Fuzzy Hash: B2524882F2A71145FF732064C1D056D5541DF93782E328B3BDA6A728E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 004035B8, Relevance: 2.4, APIs: 1, Instructions: 1159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ec6ed9a69b8f036a336b9fb68639cd0b8609c93662205d44142acc4157e41d
Instruction ID: 953ece6a4e062b470467a7116b926f1855818d4bb7c1b2697b4090eaec34af4c
Opcode Fuzzy Hash: c2ec6ed9a69b8f036a336b9fb68639cd0b8609c93662205d44142acc4157e41d
Instruction Fuzzy Hash: 13726A82F2A70145FF732064C5D055D5945CF93782F328B7BDA6A729E13B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 00403522, Relevance: 2.4, APIs: 1, Instructions: 1111memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b1a8d256e2fe0ba98700301dbf9bda8af5badb985cf01a3b9e4f6bf640031e15
Instruction ID: 702dc86fc418d81726b02773d4ec436b914acb46d2c5ade8526d00713e319194
Opcode Fuzzy Hash: b1a8d256e2fe0ba98700301dbf9bda8af5badb985cf01a3b9e4f6bf640031e15
Instruction Fuzzy Hash: 4C623782F2A70145FF732064C1D056D5541DF93382F328B3BDA6A729E57B2F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403604, Relevance: 2.3, APIs: 1, Instructions: 1096memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 81a441b970433b262fabe3991c467cb281c3d25467b2073ef0332081fb15aa8d
Instruction ID: d83bfce6cb3b58764acd31b699618e0be77b1f22d3e5d20669749ab119fede04
Opcode Fuzzy Hash: 81a441b970433b262fabe3991c467cb281c3d25467b2073ef0332081fb15aa8d
Instruction Fuzzy Hash: CE624882F2A71145FF732064C1D056D5542DF93382E318B3BDA6A729E53B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 0040357E, Relevance: 2.3, APIs: 1, Instructions: 1093memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0c986b58ec539c98d8bc8856baa2f00be673f86fc80fb384562da5907af39684
Instruction ID: da2eaa37ca54111e37ea779eaf7bd8ae77f5869e984b9eb2a9d66deb8a2ba129
Opcode Fuzzy Hash: 0c986b58ec539c98d8bc8856baa2f00be673f86fc80fb384562da5907af39684
Instruction Fuzzy Hash: ED624982F2A70145FF732064C1D056D5541DF93382F328B3BDA6A729E57B2F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403650, Relevance: 2.3, APIs: 1, Instructions: 1081memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 236ed0ee64a22488527a1ade44bbaf4b4efe072d35cb92221c58622b6a732a09
Instruction ID: cf9db4b028254adfe033f66e927dd0d050dfb188b7f996a5a619e7d88f0888ab
Opcode Fuzzy Hash: 236ed0ee64a22488527a1ade44bbaf4b4efe072d35cb92221c58622b6a732a09
Instruction Fuzzy Hash: 40624882F2A71145FF732064C1D056D5541DF93382E318B3BDA6A729E53B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 00403693, Relevance: 2.3, APIs: 1, Instructions: 1076memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d6244d8e29d7e566fc1205513cbd7a28630b9d37833bb0f2407109f45585b912
Instruction ID: 3c65bcb2c8bf7771fe4b4e389ff5b6498d846255f5a56426d7d0e3b5b2c34b14
Opcode Fuzzy Hash: d6244d8e29d7e566fc1205513cbd7a28630b9d37833bb0f2407109f45585b912
Instruction Fuzzy Hash: 78624982F2A71145FF732064C1D056D5542DF93382E318B3BDA6A728E57B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 00403773, Relevance: 2.3, APIs: 1, Instructions: 1038memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 65ff96bf2824b71a662a10da32475de32ad701a33a3fa6faf9d361e4d998f9d2
Instruction ID: ab617dd30b431b936496e6eeb70d4bd42070cbadebaa0370220859be0fc7ef85
Opcode Fuzzy Hash: 65ff96bf2824b71a662a10da32475de32ad701a33a3fa6faf9d361e4d998f9d2
Instruction Fuzzy Hash: 74524882F2A70145FF732064C1D055D5541DF93782E318B3BDA6A728E57B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 0040373A, Relevance: 2.3, APIs: 1, Instructions: 1024memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 629b9df002bb38487fa6d763ceb99d84ef2c4187e7181e71c645cdc13d7df3cc
Instruction ID: 87602d648ead299f0fe5a0c1b4210899d31d4ebad8599c449f2650004975f3fd
Opcode Fuzzy Hash: 629b9df002bb38487fa6d763ceb99d84ef2c4187e7181e71c645cdc13d7df3cc
Instruction Fuzzy Hash: DC524882F2A70145FF732064C1D056D5542DF93782E318B3BDA6A728E57B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 004037BE, Relevance: 2.3, APIs: 1, Instructions: 1004memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cbb63a14085c8d331b19b440323f70528f7a87f3a6beecb5cdf81f7a885cee53
Instruction ID: af86943b0d21a55f66b59cb7aa6b853ce4d53af0076ff08649d24908f08a9c1b
Opcode Fuzzy Hash: cbb63a14085c8d331b19b440323f70528f7a87f3a6beecb5cdf81f7a885cee53
Instruction Fuzzy Hash: 4C523792F2A70145FF732064C1D056D5542DF93382E318B3BDA6A729D57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 00403845, Relevance: 2.2, APIs: 1, Instructions: 990memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f94185443fa3046d9f49c26a8838380fae45e12b81adb0b39d41ac4e5c4fa42e
Instruction ID: 6844ce1633cdab9d5b923ad24cb51bdd7fd96dd84aa8e9bbf49b4d4fe8609373
Opcode Fuzzy Hash: f94185443fa3046d9f49c26a8838380fae45e12b81adb0b39d41ac4e5c4fa42e
Instruction Fuzzy Hash: 6D524982F2A70145FF732064C1D056D5541DF93782E328B3BDA6A729E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 00403812, Relevance: 2.2, APIs: 1, Instructions: 989memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d99344445cd18e05a34e97de3391f5a6b1bf130552fc49ee42a514ef4093a004
Instruction ID: 8c839d0743d9eec4ebaf20fcebfa817dbe252e346a41cf270780026a6fad064e
Opcode Fuzzy Hash: d99344445cd18e05a34e97de3391f5a6b1bf130552fc49ee42a514ef4093a004
Instruction Fuzzy Hash: C5524882F2A70145FF732064C1D055D5541DF93782E328B3BDA6A728E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 00403896, Relevance: 2.2, APIs: 1, Instructions: 983memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8840fa8385be71b8ea77e5f2b552e960e6aa284c6d4368b70f9958a4578dfcb4
Instruction ID: 902a2145bc649552f42e858f8aac17025a3cc94d72e5fff02827efda28598ce5
Opcode Fuzzy Hash: 8840fa8385be71b8ea77e5f2b552e960e6aa284c6d4368b70f9958a4578dfcb4
Instruction Fuzzy Hash: 40524882F2A71145FF732064C1D056D5541DF93782E328B3BDA6A728E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 004037FD, Relevance: 2.2, APIs: 1, Instructions: 980COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1c73e600403a438d53fd67ce6bc9c298789a49467bcd7ee97dbd647e6ca0ea6
Instruction ID: 85b46771d0615bc54ede88507547ed2aea1bd7068dda3985eafb7f2f057e7fbd
Opcode Fuzzy Hash: a1c73e600403a438d53fd67ce6bc9c298789a49467bcd7ee97dbd647e6ca0ea6
Instruction Fuzzy Hash: 53523792F2A70145FF732064C1D056D5541DF93782E328B3BDA6A728E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 00403926, Relevance: 2.2, APIs: 1, Instructions: 959memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c6054249bba4b95f0e04cd4190e207a0e77c87d88dc35dd44ca7bfc01df3d3b
Instruction ID: 6734d9a27321431c38da771e2d31e4cf563a6b9f4078392ed80dc403d5868eef
Opcode Fuzzy Hash: 7c6054249bba4b95f0e04cd4190e207a0e77c87d88dc35dd44ca7bfc01df3d3b
Instruction Fuzzy Hash: BF523782F2A71145FF732064C1D056D5541DF93782E328B3BDA6A728E57B2F0ACA19CB

Uniqueness

Uniqueness Score: -1.00%

Function 00403A04, Relevance: 2.2, APIs: 1, Instructions: 926memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 175c5503c422d14e76bf5e95faaf5b37f9f2c795f47ced13ab92e054631db86c
Instruction ID: 992989468e0f024c32a4fb9cecc298abcba0e5d94273061f8b876ad43af92dd9
Opcode Fuzzy Hash: 175c5503c422d14e76bf5e95faaf5b37f9f2c795f47ced13ab92e054631db86c
Instruction Fuzzy Hash: 52423883F2A70145FF732064C1E056D5541DF93781E328B3BDA6A729E57B2F0ACA198B

Uniqueness

Uniqueness Score: -1.00%

Function 00403A8B, Relevance: 2.1, APIs: 1, Instructions: 899memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44bc20cb6b0d56879595162447b0ea07637549a8ed9aa4be1caf35573339f20b
Instruction ID: 81aa3a7724df453aa9beebd3ed27d6e0c7986b421ebf45a66ea4aaa2c500e2b8
Opcode Fuzzy Hash: 44bc20cb6b0d56879595162447b0ea07637549a8ed9aa4be1caf35573339f20b
Instruction Fuzzy Hash: 1F423782F2A70145FF732064C1D056D5541DF93782E328B3BDA6A728E57B2F0ACA19DB

Uniqueness

Uniqueness Score: -1.00%

Function 00403BA1, Relevance: 2.1, APIs: 1, Instructions: 874COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3f32a6b0a38a1b8724178bd874332b9a403f4d0edb14b56bee18d61d72458d
Instruction ID: 703c51f982ea729598afd7efa8df0a4634074d268c63ec50caa5d0f41bc1e63c
Opcode Fuzzy Hash: fc3f32a6b0a38a1b8724178bd874332b9a403f4d0edb14b56bee18d61d72458d
Instruction Fuzzy Hash: 23421492F2A70145FF732064C1D056D5541DF93782E328B3BDA6A728E5372F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403B11, Relevance: 2.1, APIs: 1, Instructions: 869memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1cbaaf57a9014179d3cbd5e93fc6cc6ac9fe5a67190d3f0a342c86b53bdd7e92
Instruction ID: 517ef85baf24bb4ae13df34ae6c6cca165c2e89df8281995452f216bb0d3a292
Opcode Fuzzy Hash: 1cbaaf57a9014179d3cbd5e93fc6cc6ac9fe5a67190d3f0a342c86b53bdd7e92
Instruction Fuzzy Hash: 65423692F2A70145FF732064C1D05AD5541DF93782F328B3BDA6A728E5372F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403B5E, Relevance: 2.1, APIs: 1, Instructions: 860memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dbbfae8740afae6a04bfa4a5dfb4647d6dfe94ad93d1629c3c417c09a0b2e5c7
Instruction ID: a4ac5e5634525fd34164227c9c6956d3db0b0e4b02efbb99661bfdcd5c5c37a6
Opcode Fuzzy Hash: dbbfae8740afae6a04bfa4a5dfb4647d6dfe94ad93d1629c3c417c09a0b2e5c7
Instruction Fuzzy Hash: C0421493F2A71144FF732064C1D05AD5541DF93782E328B3BDA6A728E5372F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403C44, Relevance: 2.1, APIs: 1, Instructions: 811memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 814eb9f59f92fb6bcd4f95fe3d56c901c059e3c77092d96a708f0f7f2ffead77
Instruction ID: cee46240f1463fe209d45710b0c2d7b527205ac22f67eaceb15b56419f079de2
Opcode Fuzzy Hash: 814eb9f59f92fb6bcd4f95fe3d56c901c059e3c77092d96a708f0f7f2ffead77
Instruction Fuzzy Hash: 7F320592F2A71185FF732064C2D059D5541DF93782F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A50C, Relevance: 260.8, APIs: 134, Strings: 14, Instructions: 1763
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040A50C(char _a1, signed int _a4, intOrPtr* _a8, char _a100, signed int _a108, char _a110) {
				void* _v3;
				intOrPtr _v12;
				signed int _v16;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				char _v40;
				char _v44;
				long long _v52;
				char _v68;
				short _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				signed int _v108;
				signed int _v112;
				char _v116;
				char _v120;
				char _v124;
				signed int _v128;
				char _v132;
				signed int _v136;
				char _v140;
				char _v148;
				char _v156;
				intOrPtr _v164;
				char _v172;
				char* _v180;
				char _v188;
				char* _v196;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				intOrPtr _v236;
				char _v240;
				intOrPtr _v244;
				char _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				char _v296;
				signed int _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				intOrPtr* _v332;
				signed int _v336;
				intOrPtr* _v340;
				signed int _v344;
				intOrPtr* _v348;
				signed int _v352;
				signed int _v356;
				intOrPtr* _v360;
				signed int _v364;
				intOrPtr* _v368;
				signed int _v372;
				intOrPtr* _v376;
				signed int _v380;
				signed int _v384;
				intOrPtr* _v388;
				signed int _v392;
				intOrPtr* _v396;
				signed int _v400;
				intOrPtr* _v404;
				signed int _v408;
				intOrPtr* _v412;
				signed int _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				signed int _v448;
				intOrPtr* _v452;
				signed int _v456;
				intOrPtr* _v460;
				signed int _v464;
				intOrPtr* _v468;
				signed int _v472;
				intOrPtr* _v476;
				signed int _v480;
				intOrPtr* _v484;
				signed int _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				intOrPtr* _v504;
				signed int _v508;
				intOrPtr* _v512;
				signed int _v516;
				signed int _v520;
				intOrPtr* _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				signed int _v564;
				void* _t895;
				void* _t896;
				intOrPtr* _t898;
				void* _t899;
				intOrPtr* _t901;
				void* _t902;
				void* _t904;
				void* _t907;
				void* _t908;
				signed int _t910;
				signed char _t912;
				signed int _t916;
				signed int _t920;
				signed int _t932;
				signed int _t936;
				signed int _t940;
				signed int _t944;
				signed int _t957;
				signed int _t961;
				signed int _t965;
				signed int _t969;
				signed int _t973;
				signed int _t977;
				signed int _t981;
				signed int _t991;
				signed int _t999;
				signed int _t1003;
				signed int _t1007;
				signed int _t1011;
				signed int _t1015;
				signed int _t1019;
				signed int _t1023;
				signed int _t1027;
				signed int _t1042;
				signed int _t1055;
				signed int _t1059;
				signed int _t1063;
				signed int _t1067;
				signed int _t1071;
				signed int _t1075;
				signed int _t1095;
				signed int _t1100;
				signed int _t1104;
				signed int _t1108;
				signed int _t1112;
				signed int _t1116;
				signed int _t1120;
				signed int _t1139;
				signed int _t1143;
				signed int _t1156;
				signed int _t1160;
				signed int _t1168;
				signed int _t1173;
				signed int _t1179;
				signed int _t1190;
				signed int _t1194;
				signed int _t1198;
				signed int _t1202;
				signed int _t1212;
				signed int _t1221;
				signed int _t1225;
				char* _t1228;
				signed int _t1240;
				signed int _t1244;
				signed int _t1252;
				signed int _t1256;
				signed int _t1260;
				signed int _t1264;
				signed int _t1268;
				signed int _t1272;
				signed int _t1285;
				char* _t1287;
				signed int _t1292;
				void* _t1293;
				void* _t1296;
				void* _t1297;
				void* _t1298;
				void* _t1299;
				signed int* _t1300;
				intOrPtr _t1303;
				intOrPtr _t1393;
				intOrPtr _t1401;
				void* _t1405;
				signed int _t1416;
				void* _t1422;
				signed int _t1423;
				signed int _t1434;
				char* _t1442;
				signed int _t1444;
				void* _t1445;
				void* _t1446;
				void* _t1449;
				void* _t1450;
				intOrPtr* _t1451;
				void* _t1453;
				intOrPtr* _t1455;
				void* _t1456;
				intOrPtr _t1459;
				intOrPtr _t1462;
				signed int _t1465;
				intOrPtr _t1468;
				signed int _t1470;
				signed int* _t1471;
				signed int _t1473;
				void* _t1474;
				signed int* _t1477;
				intOrPtr _t1478;
				signed int _t1484;

				0x8040e537();
				_t896 = _t895 + 1;
				 *((intOrPtr*)(_t896 + 0x33)) =  *((intOrPtr*)(_t896 + 0x33)) + _t896;
				_t1298 = _t1297 + 1;
				_t898 = _t896 + _t1298 + 1;
				 *_t898 =  *_t898 + _t1405;
				asm("daa");
				_t899 = _t898 + 1;
				 *((intOrPtr*)(_t1293 + _t1422 + 0x41)) =  *((intOrPtr*)(_t1293 + _t1422 + 0x41)) + _t899;
				_t901 = _t899 + _t1298 + 1;
				 *_t901 =  *_t901 + _t1405;
				asm("daa");
				_t902 = _t901 + 1;
				 *((intOrPtr*)(_t902 + 0x33)) =  *((intOrPtr*)(_t902 + 0x33)) + _t1298;
				_t1299 = _t1298 + 1;
				_t904 = _t902 + _t1299 + 1;
				 *((intOrPtr*)(_t904 + 0x27)) =  *((intOrPtr*)(_t904 + 0x27)) + _t1299;
				 *((intOrPtr*)(_t1293 + _t1422 + 0x41)) =  *((intOrPtr*)(_t1293 + _t1422 + 0x41)) + _t1299;
				_t907 = _t904 + 1 + _t1299 + 1;
				 *((intOrPtr*)(_t907 + 0x27)) =  *((intOrPtr*)(_t907 + 0x27)) + _t1299;
				_t908 = _t907 + 1;
				 *((intOrPtr*)(_t908 + 0x33)) =  *((intOrPtr*)(_t908 + 0x33)) + _t1405;
				_t1300 = _t1299 + 1;
				_t910 = _t908 + _t1300 + 1;
				 *((intOrPtr*)(_t910 + 0x54004027)) =  *((intOrPtr*)(_t910 + 0x54004027)) + _t910;
				_push(_t1293);
				_t1444 = _t1300[0x1b] * 0x64;
				asm("popad");
				asm("insb");
				_t912 = _t910 ^  *_t1300 ^ 0x4d000000;
				if(_t912 != 0) {
					L12:
					L13:
					_t1423 =  *(_t1405 + 0x65) * 0x736e;
					_t1465 = _t1423;
					L14:
					asm("outsb");
					L15:
					if (_t1465 >= 0) goto L16;
					 *_t912 =  *_t912 + _t912;
					 *((intOrPtr*)(_t1293 + 0x6c)) =  *((intOrPtr*)(_t1293 + 0x6c)) + _t1300;
					asm("outsb");
					_t1434 =  *(_t1423 + 0x67) * 0x6e65;
					 *_t912 =  *_t912 + _t912;
					_t1405 = _t1405 + 1;
					if(_t1405 < 0) {
						L37:
						 *_t912 =  *_t912 + _t912;
						_t49 =  &_a110;
						 *_t49 = _a110 + _t912;
						_t1478 =  *_t49;
						if(_t1478 == 0) {
							goto L54;
						}
						goto L38;
					} else {
						_t1423 =  *[gs:ebp+0x6c] * 0x74;
						if(_t1423 != 0) {
							L40:
							asm("outsb");
							L41:
							 *((intOrPtr*)(_t1293 + _t1423)) =  *((intOrPtr*)(_t1293 + _t1423)) + _t912;
							_t1416 = _t1416 - 1;
							if(_t1416 < 0) {
								L56:
								_t912 = _t912 + 0x68;
								_t1444 = 0x68004028;
								L57:
								 *((intOrPtr*)(_t912 - 0x5c)) =  *((intOrPtr*)(_t912 - 0x5c)) + _t1300;
								L58:
								_push(L"Forsrget");
								_push(L"Taylorismens");
								_push(L"VAGTPOSTERS"); // executed
								L0040149C(); // executed
								if( *0x413010 != 0) {
									_v332 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v332 = 0x413010;
								}
								_t1303 =  *((intOrPtr*)( *_v332));
								_t916 =  &_v124;
								L00401496();
								_v252 = _t916;
								_t920 =  *((intOrPtr*)( *_v252 + 0x140))(_v252,  &_v208, _t916,  *((intOrPtr*)(_t1303 + 0x314))( *_v332));
								asm("fclex");
								_v256 = _t920;
								if(_v256 >= 0) {
									_v336 = _v336 & 0x00000000;
								} else {
									_push(0x140);
									_push(0x4028d4);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v336 = _t920;
								}
								_v212 = _v208;
								 *_t1444 =  *0x401148;
								 *((intOrPtr*)( *_a8 + 0x728))(_a8,  &_v212, 0xa8d8e, _t1303, _t1303, 0x65ce);
								L00401484();
								 *((intOrPtr*)( *_a8 + 0x72c))(_a8);
								if( *0x413010 != 0) {
									_v340 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v340 = 0x413010;
								}
								_t932 =  &_v124;
								L00401496();
								_v252 = _t932;
								_t936 =  *((intOrPtr*)( *_v252 + 0x128))(_v252,  &_v216, _t932,  *((intOrPtr*)( *((intOrPtr*)( *_v340)) + 0x31c))( *_v340));
								asm("fclex");
								_v256 = _t936;
								if(_v256 >= 0) {
									_v344 = _v344 & 0x00000000;
								} else {
									_push(0x128);
									_push(0x4028fc);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v344 = _t936;
								}
								if( *0x413010 != 0) {
									_v348 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v348 = 0x413010;
								}
								_t940 =  &_v128;
								L00401496();
								_v260 = _t940;
								_t944 =  *((intOrPtr*)( *_v260 + 0x108))(_v260,  &_v108, _t940,  *((intOrPtr*)( *((intOrPtr*)( *_v348)) + 0x304))( *_v348));
								asm("fclex");
								_v264 = _t944;
								if(_v264 >= 0) {
									_v352 = _v352 & 0x00000000;
								} else {
									_push(0x108);
									_push(0x40290c);
									_push(_v260);
									_push(_v264);
									L0040148A();
									_v352 = _t944;
								}
								_v196 = L"Wackes";
								_v204 = 8;
								L0040147E();
								_v220 = _v216;
								_v180 = L"Afgivnes";
								_v188 = 8;
								L00401310();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								 *((intOrPtr*)( *_a8 + 0x730))(_a8, 0x10,  &_v220, _v108,  &_v156);
								L00401478();
								L00401472();
								_t1445 = _t1444 + 0xc;
								L0040146C();
								L00401466();
								_t957 =  *((intOrPtr*)( *_a8 + 0x6f8))(_a8, 0x1b9988,  &_v108, 2,  &_v124,  &_v128);
								_v252 = _t957;
								if(_v252 >= 0) {
									_v356 = _v356 & 0x00000000;
								} else {
									_push(0x6f8);
									_push(0x402670);
									_push(_a8);
									_push(_v252);
									L0040148A();
									_v356 = _t957;
								}
								L00401478();
								if( *0x413010 != 0) {
									_v360 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v360 = 0x413010;
								}
								_t961 =  &_v124;
								L00401496();
								_v252 = _t961;
								_t965 =  *((intOrPtr*)( *_v252 + 0x68))(_v252,  &_v216, _t961,  *((intOrPtr*)( *((intOrPtr*)( *_v360)) + 0x318))( *_v360));
								asm("fclex");
								_v256 = _t965;
								if(_v256 >= 0) {
									_v364 = _v364 & 0x00000000;
								} else {
									_push(0x68);
									_push(0x4028d4);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v364 = _t965;
								}
								if( *0x413010 != 0) {
									_v368 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v368 = 0x413010;
								}
								_t969 =  &_v128;
								L00401496();
								_v260 = _t969;
								_t973 =  *((intOrPtr*)( *_v260 + 0x178))(_v260,  &_v220, _t969,  *((intOrPtr*)( *((intOrPtr*)( *_v368)) + 0x314))( *_v368));
								asm("fclex");
								_v264 = _t973;
								if(_v264 >= 0) {
									_v372 = _v372 & 0x00000000;
								} else {
									_push(0x178);
									_push(0x4028d4);
									_push(_v260);
									_push(_v264);
									L0040148A();
									_v372 = _t973;
								}
								if( *0x413010 != 0) {
									_v376 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v376 = 0x413010;
								}
								_t977 =  &_v132;
								L00401496();
								_v268 = _t977;
								_t981 =  *((intOrPtr*)( *_v268 + 0x138))(_v268,  &_v136, _t977,  *((intOrPtr*)( *((intOrPtr*)( *_v376)) + 0x314))( *_v376));
								asm("fclex");
								_v272 = _t981;
								if(_v272 >= 0) {
									_v380 = _v380 & 0x00000000;
								} else {
									_push(0x138);
									_push(0x4028d4);
									_push(_v268);
									_push(_v272);
									L0040148A();
									_v380 = _t981;
								}
								_v296 = _v136;
								_v136 = _v136 & 0x00000000;
								_v148 = _v296;
								_v156 = 9;
								_v228 = _v220;
								_v224 = _v216;
								L00401310();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t991 =  *((intOrPtr*)( *_a8 + 0x6fc))(_a8,  &_v224, 0x6668d3,  &_v228, 0x10,  &_v232);
								_v276 = _t991;
								if(_v276 >= 0) {
									_v384 = _v384 & 0x00000000;
								} else {
									_push(0x6fc);
									_push(0x402670);
									_push(_a8);
									_push(_v276);
									L0040148A();
									_v384 = _t991;
								}
								_v28 = _v232;
								_push( &_v132);
								_push( &_v128);
								_push( &_v124);
								_push(3);
								L00401472();
								_t1446 = _t1445 + 0x10;
								L0040146C();
								if( *0x413010 != 0) {
									_v388 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v388 = 0x413010;
								}
								_t999 =  &_v124;
								L00401496();
								_v252 = _t999;
								_t1003 =  *((intOrPtr*)( *_v252 + 0x158))(_v252,  &_v128, _t999,  *((intOrPtr*)( *((intOrPtr*)( *_v388)) + 0x30c))( *_v388));
								asm("fclex");
								_v256 = _t1003;
								if(_v256 >= 0) {
									_v392 = _v392 & 0x00000000;
								} else {
									_push(0x158);
									_push(0x402950);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v392 = _t1003;
								}
								if( *0x413010 != 0) {
									_v396 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v396 = 0x413010;
								}
								_t1007 =  &_v132;
								L00401496();
								_v260 = _t1007;
								_t1011 =  *((intOrPtr*)( *_v260 + 0x170))(_v260,  &_v108, _t1007,  *((intOrPtr*)( *((intOrPtr*)( *_v396)) + 0x304))( *_v396));
								asm("fclex");
								_v264 = _t1011;
								if(_v264 >= 0) {
									_v400 = _v400 & 0x00000000;
								} else {
									_push(0x170);
									_push(0x40290c);
									_push(_v260);
									_push(_v264);
									L0040148A();
									_v400 = _t1011;
								}
								if( *0x413010 != 0) {
									_v404 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v404 = 0x413010;
								}
								_t1015 =  &_v136;
								L00401496();
								_v268 = _t1015;
								_t1019 =  *((intOrPtr*)( *_v268 + 0x130))(_v268,  &_v208, _t1015,  *((intOrPtr*)( *((intOrPtr*)( *_v404)) + 0x318))( *_v404));
								asm("fclex");
								_v272 = _t1019;
								if(_v272 >= 0) {
									_v408 = _v408 & 0x00000000;
								} else {
									_push(0x130);
									_push(0x4028d4);
									_push(_v268);
									_push(_v272);
									L0040148A();
									_v408 = _t1019;
								}
								if( *0x413010 != 0) {
									_v412 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v412 = 0x413010;
								}
								_t1023 =  &_v140;
								L00401496();
								_v276 = _t1023;
								_t1027 =  *((intOrPtr*)( *_v276 + 0x198))(_v276,  &_v112, _t1023,  *((intOrPtr*)( *((intOrPtr*)( *_v412)) + 0x318))( *_v412));
								asm("fclex");
								_v280 = _t1027;
								if(_v280 >= 0) {
									_v416 = _v416 & 0x00000000;
								} else {
									_push(0x198);
									_push(0x4028d4);
									_push(_v276);
									_push(_v280);
									L0040148A();
									_v416 = _t1027;
								}
								_v300 = _v112;
								_v112 = _v112 & 0x00000000;
								_v164 = _v300;
								_v172 = 8;
								_v212 = _v208;
								L00401466();
								_v304 = _v108;
								_v108 = _v108 & 0x00000000;
								L00401460();
								_v308 = _v128;
								_v128 = _v128 & 0x00000000;
								_v148 = _v308;
								_v156 = 9;
								L00401310();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t1042 =  *((intOrPtr*)( *_a8 + 0x700))(_a8, 0x10,  &_v116,  &_v120,  &_v212,  &_v172,  &_v216);
								_v284 = _t1042;
								if(_v284 >= 0) {
									_v420 = _v420 & 0x00000000;
								} else {
									_push(0x700);
									_push(0x402670);
									_push(_a8);
									_push(_v284);
									L0040148A();
									_v420 = _t1042;
								}
								_v88 = _v216;
								_push( &_v120);
								_push( &_v116);
								_push(2);
								L0040145A();
								_push( &_v140);
								_push( &_v136);
								_push( &_v132);
								_push( &_v124);
								_push(4);
								L00401472();
								_push( &_v172);
								_push( &_v156);
								_push(2);
								L00401454();
								_t1449 = _t1446 + 0x2c;
								if( *0x413010 != 0) {
									_v424 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v424 = 0x413010;
								}
								_t1055 =  &_v124;
								L00401496();
								_v252 = _t1055;
								_t1059 =  *((intOrPtr*)( *_v252 + 0x178))(_v252,  &_v216, _t1055,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x314))( *_v424));
								asm("fclex");
								_v256 = _t1059;
								if(_v256 >= 0) {
									_v428 = _v428 & 0x00000000;
								} else {
									_push(0x178);
									_push(0x4028d4);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v428 = _t1059;
								}
								if( *0x413010 != 0) {
									_v432 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v432 = 0x413010;
								}
								_t1063 =  &_v128;
								L00401496();
								_v260 = _t1063;
								_t1067 =  *((intOrPtr*)( *_v260 + 0x98))(_v260,  &_v208, _t1063,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x30c))( *_v432));
								asm("fclex");
								_v264 = _t1067;
								if(_v264 >= 0) {
									_v436 = _v436 & 0x00000000;
								} else {
									_push(0x98);
									_push(0x402950);
									_push(_v260);
									_push(_v264);
									L0040148A();
									_v436 = _t1067;
								}
								if( *0x413010 != 0) {
									_v440 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v440 = 0x413010;
								}
								_t1071 =  &_v132;
								L00401496();
								_v268 = _t1071;
								_t1075 =  *((intOrPtr*)( *_v268 + 0x158))(_v268,  &_v136, _t1071,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x30c))( *_v440));
								asm("fclex");
								_v272 = _t1075;
								if(_v272 >= 0) {
									_v444 = _v444 & 0x00000000;
								} else {
									_push(0x158);
									_push(0x402950);
									_push(_v268);
									_push(_v272);
									L0040148A();
									_v444 = _t1075;
								}
								_v240 = 0x2707c260;
								_v236 = 0x5af4;
								_v312 = _v136;
								_v136 = _v136 & 0x00000000;
								_v148 = _v312;
								_v156 = 9;
								_v212 = _v208;
								L00401310();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								 *((intOrPtr*)( *_a8 + 0x734))(_a8, _v216, 0x1fb383,  &_v212, 0x10,  &_v240);
								L00401472();
								_t1450 = _t1449 + 0x10;
								L0040146C();
								 *((intOrPtr*)( *_a8 + 0x738))(_a8,  &_v240, 3,  &_v124,  &_v128,  &_v132);
								_v52 = _v240;
								_t1095 =  *((intOrPtr*)( *_a8 + 0x704))(_a8,  &_v216);
								_v252 = _t1095;
								if(_v252 >= 0) {
									_v448 = _v448 & 0x00000000;
								} else {
									_push(0x704);
									_push(0x402670);
									_push(_a8);
									_push(_v252);
									L0040148A();
									_v448 = _t1095;
								}
								_v44 = _v216;
								if( *0x413010 != 0) {
									_v452 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v452 = 0x413010;
								}
								_t1100 =  &_v124;
								L00401496();
								_v252 = _t1100;
								_t1104 =  *((intOrPtr*)( *_v252 + 0xf0))(_v252,  &_v108, _t1100,  *((intOrPtr*)( *((intOrPtr*)( *_v452)) + 0x310))( *_v452));
								asm("fclex");
								_v256 = _t1104;
								if(_v256 >= 0) {
									_v456 = _v456 & 0x00000000;
								} else {
									_push(0xf0);
									_push(0x4028d4);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v456 = _t1104;
								}
								if( *0x413010 != 0) {
									_v460 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v460 = 0x413010;
								}
								_t1108 =  &_v128;
								L00401496();
								_v260 = _t1108;
								_t1112 =  *((intOrPtr*)( *_v260 + 0x140))(_v260,  &_v208, _t1108,  *((intOrPtr*)( *((intOrPtr*)( *_v460)) + 0x314))( *_v460));
								asm("fclex");
								_v264 = _t1112;
								if(_v264 >= 0) {
									_v464 = _v464 & 0x00000000;
								} else {
									_push(0x140);
									_push(0x4028d4);
									_push(_v260);
									_push(_v264);
									L0040148A();
									_v464 = _t1112;
								}
								if( *0x413010 != 0) {
									_v468 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v468 = 0x413010;
								}
								_t1116 =  &_v132;
								L00401496();
								_v268 = _t1116;
								_t1120 =  *((intOrPtr*)( *_v268 + 0x88))(_v268,  &_v216, _t1116,  *((intOrPtr*)( *((intOrPtr*)( *_v468)) + 0x31c))( *_v468));
								asm("fclex");
								_v272 = _t1120;
								if(_v272 >= 0) {
									_v472 = _v472 & 0x00000000;
								} else {
									_push(0x88);
									_push(0x4028fc);
									_push(_v268);
									_push(_v272);
									L0040148A();
									_v472 = _t1120;
								}
								_v220 = _v216;
								_v212 = _v208;
								L00401466();
								_v316 = _v108;
								_v108 = _v108 & 0x00000000;
								_v148 = _v316;
								_v156 = 8;
								 *((intOrPtr*)( *_a8 + 0x73c))(_a8,  &_v156,  &_v112,  &_v212, 0xfee914b0, 0x5af7,  &_v220,  &_v224);
								_v84 = _v224;
								L00401478();
								_push( &_v132);
								_push( &_v128);
								_push( &_v124);
								_push(3);
								L00401472();
								_t1451 = _t1450 + 0x10;
								L0040146C();
								if( *0x413010 != 0) {
									_v476 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v476 = 0x413010;
								}
								_t1139 =  &_v124;
								L00401496();
								_v252 = _t1139;
								_t1143 =  *((intOrPtr*)( *_v252 + 0x160))(_v252,  &_v128, _t1139,  *((intOrPtr*)( *((intOrPtr*)( *_v476)) + 0x308))( *_v476));
								asm("fclex");
								_v256 = _t1143;
								if(_v256 >= 0) {
									_v480 = _v480 & 0x00000000;
								} else {
									_push(0x160);
									_push(0x402950);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v480 = _t1143;
								}
								_v216 =  *0x401140;
								_v320 = _v128;
								_v128 = _v128 & 0x00000000;
								_v148 = _v320;
								_v156 = 9;
								L00401466();
								_v240 =  *0x401138;
								L00401310();
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								 *((intOrPtr*)( *_a8 + 0x740))(_a8,  &_v240, 0x87a95ba0, 0x5b04,  &_v108, 0x10,  &_v216);
								L00401478();
								L00401484();
								L0040146C();
								if( *0x413010 != 0) {
									_v484 = 0x413010;
								} else {
									_push(0x413010);
									_push(0x401cc8);
									L00401490();
									_v484 = 0x413010;
								}
								_t1156 =  &_v124;
								L00401496();
								_v252 = _t1156;
								_t1160 =  *((intOrPtr*)( *_v252 + 0x238))(_v252,  &_v108, _t1156,  *((intOrPtr*)( *((intOrPtr*)( *_v484)) + 0x310))( *_v484));
								asm("fclex");
								_v256 = _t1160;
								if(_v256 >= 0) {
									_v488 = _v488 & 0x00000000;
								} else {
									_push(0x238);
									_push(0x4028d4);
									_push(_v252);
									_push(_v256);
									L0040148A();
									_v488 = _t1160;
								}
								 *((intOrPtr*)( *_a8 + 0x744))(_a8, _v108, 0x375d6d,  &_v216);
								_v24 = _v216;
								L00401478();
								L00401484();
								_t1168 =  *((intOrPtr*)( *_a8 + 0x708))(_a8,  &_v240);
								_v252 = _t1168;
								if(_v252 >= 0) {
									_v492 = _v492 & 0x00000000;
								} else {
									_push(0x708);
									_push(0x402670);
									_push(_a8);
									_push(_v252);
									L0040148A();
									_v492 = _t1168;
								}
								_v40 = _v240;
								_v36 = _v236;
								_t1173 =  *((intOrPtr*)( *_a8 + 0x2b4))(_a8);
								asm("fclex");
								_v252 = _t1173;
								if(_v252 >= 0) {
									_v496 = _v496 & 0x00000000;
								} else {
									_push(0x2b4);
									_push(0x402640);
									_push(_a8);
									_push(_v252);
									L0040148A();
									_v496 = _t1173;
								}
								while(1) {
									_v180 = 1;
									_v188 = 2;
									L00401448();
									L0040144E();
									_t1179 =  *((intOrPtr*)( *_a8 + 0x70c))(_a8,  &_v156,  &_v188,  &_v68);
									_v252 = _t1179;
									if(_v252 >= 0) {
										_v500 = _v500 & 0x00000000;
									} else {
										_push(0x70c);
										_push(0x402670);
										_push(_a8);
										_push(_v252);
										L0040148A();
										_v500 = _t1179;
									}
									_v180 = L"BAKTERIOLOGERNES";
									_v188 = 8;
									L0040147E();
									 *_t1451 =  *0x401130;
									 *((intOrPtr*)( *_a8 + 0x748))(_a8, 0x22d435,  &_v156, 0x1ddbd3f0, 0x5b05,  &_v156,  &_v240);
									_v104 = _v240;
									_v100 = _v236;
									L0040146C();
									if( *0x413010 != 0) {
										_v504 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v504 = 0x413010;
									}
									_t1190 =  &_v124;
									L00401496();
									_v252 = _t1190;
									_t1194 =  *((intOrPtr*)( *_v252 + 0x150))(_v252,  &_v216, _t1190,  *((intOrPtr*)( *((intOrPtr*)( *_v504)) + 0x300))( *_v504));
									asm("fclex");
									_v256 = _t1194;
									if(_v256 >= 0) {
										_v508 = _v508 & 0x00000000;
									} else {
										_push(0x150);
										_push(0x40290c);
										_push(_v252);
										_push(_v256);
										L0040148A();
										_v508 = _t1194;
									}
									if( *0x413010 != 0) {
										_v512 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v512 = 0x413010;
									}
									_t1198 =  &_v128;
									L00401496();
									_v260 = _t1198;
									_t1202 =  *((intOrPtr*)( *_v260 + 0x50))(_v260,  &_v108, _t1198,  *((intOrPtr*)( *((intOrPtr*)( *_v512)) + 0x2fc))( *_v512));
									asm("fclex");
									_v264 = _t1202;
									if(_v264 >= 0) {
										_v516 = _v516 & 0x00000000;
									} else {
										_push(0x50);
										_push(0x40290c);
										_push(_v260);
										_push(_v264);
										L0040148A();
										_v516 = _t1202;
									}
									_v324 = _v108;
									_v108 = _v108 & 0x00000000;
									_v164 = _v324;
									_v172 = 8;
									L00401466();
									_v148 = _v216;
									_v156 = 3;
									_t1212 =  *((intOrPtr*)( *_a8 + 0x714))(_a8, 0x7eaf79,  &_v156,  &_v112,  &_v172,  &_v220);
									_v268 = _t1212;
									if(_v268 >= 0) {
										_v520 = _v520 & 0x00000000;
									} else {
										_push(0x714);
										_push(0x402670);
										_push(_a8);
										_push(_v268);
										L0040148A();
										_v520 = _t1212;
									}
									_v96 = _v220;
									L00401478();
									_push( &_v128);
									_push( &_v124);
									_push(2);
									L00401472();
									_push( &_v172);
									_push( &_v156);
									_push(2);
									L00401454();
									_t1453 = _t1451 + 0x18;
									if( *0x413010 != 0) {
										_v524 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v524 = 0x413010;
									}
									_t1221 =  &_v124;
									L00401496();
									_v252 = _t1221;
									_t1225 =  *((intOrPtr*)( *_v252 + 0x168))(_v252,  &_v128, _t1221,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x30c))( *_v524));
									asm("fclex");
									_v256 = _t1225;
									if(_v256 >= 0) {
										_v528 = _v528 & 0x00000000;
									} else {
										_push(0x168);
										_push(0x402950);
										_push(_v252);
										_push(_v256);
										L0040148A();
										_v528 = _t1225;
									}
									L00401442();
									_v248 = 0x26339ac0;
									_v244 = 0x5afa;
									L00401466();
									_v240 =  *0x401128;
									_t1228 =  &_v156;
									L0040143C();
									 *((intOrPtr*)( *_a8 + 0x74c))(_a8,  &_v240,  &_v108, 0x2fd3,  &_v248, _t1228, _t1228,  &_v216,  &_v156, _v128, 0, 0);
									_v92 = _v216;
									L00401478();
									_push( &_v128);
									_push( &_v124);
									_push(2);
									L00401472();
									_t1455 = _t1453 + 0x1c;
									L0040146C();
									if( *0x413010 != 0) {
										_v532 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v532 = 0x413010;
									}
									_t1393 =  *((intOrPtr*)( *_v532));
									_t1240 =  &_v124;
									L00401496();
									_v252 = _t1240;
									_t1244 =  *((intOrPtr*)( *_v252 + 0xa0))(_v252,  &_v108, _t1240,  *((intOrPtr*)(_t1393 + 0x314))( *_v532));
									asm("fclex");
									_v256 = _t1244;
									if(_v256 >= 0) {
										_v536 = _v536 & 0x00000000;
									} else {
										_push(0xa0);
										_push(0x4028d4);
										_push(_v252);
										_push(_v256);
										L0040148A();
										_v536 = _t1244;
									}
									_v328 = _v108;
									_v108 = _v108 & 0x00000000;
									_v148 = _v328;
									_v156 = 8;
									_v240 = 0x81b04a80;
									_v236 = 0x5afd;
									 *_t1455 =  *0x401120;
									_t1252 =  *((intOrPtr*)( *_a8 + 0x718))(_a8,  &_v240, _t1393, _t1393,  &_v156,  &_v208);
									_v260 = _t1252;
									if(_v260 >= 0) {
										_v540 = _v540 & 0x00000000;
									} else {
										_push(0x718);
										_push(0x402670);
										_push(_a8);
										_push(_v260);
										L0040148A();
										_v540 = _t1252;
									}
									_v72 = _v208;
									L00401484();
									L0040146C();
									_t1256 =  *((intOrPtr*)( *_a8 + 0x71c))(_a8);
									_v252 = _t1256;
									if(_v252 >= 0) {
										_v544 = _v544 & 0x00000000;
									} else {
										_push(0x71c);
										_push(0x402670);
										_push(_a8);
										_push(_v252);
										L0040148A();
										_v544 = _t1256;
									}
									if( *0x413010 != 0) {
										_v548 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v548 = 0x413010;
									}
									_t1260 =  &_v124;
									L00401496();
									_v252 = _t1260;
									_t1264 =  *((intOrPtr*)( *_v252 + 0x78))(_v252,  &_v216, _t1260,  *((intOrPtr*)( *((intOrPtr*)( *_v548)) + 0x314))( *_v548));
									asm("fclex");
									_v256 = _t1264;
									if(_v256 >= 0) {
										_v552 = _v552 & 0x00000000;
									} else {
										_push(0x78);
										_push(0x4028d4);
										_push(_v252);
										_push(_v256);
										L0040148A();
										_v552 = _t1264;
									}
									if( *0x413010 != 0) {
										_v556 = 0x413010;
									} else {
										_push(0x413010);
										_push(0x401cc8);
										L00401490();
										_v556 = 0x413010;
									}
									_t1401 =  *((intOrPtr*)( *_v556));
									_t1268 =  &_v128;
									L00401496();
									_v260 = _t1268;
									_t1272 =  *((intOrPtr*)( *_v260 + 0xe0))(_v260,  &_v208, _t1268,  *((intOrPtr*)(_t1401 + 0x310))( *_v556));
									asm("fclex");
									_v264 = _t1272;
									if(_v264 >= 0) {
										_v560 = _v560 & 0x00000000;
									} else {
										_push(0xe0);
										_push(0x4028d4);
										_push(_v260);
										_push(_v264);
										L0040148A();
										_v560 = _t1272;
									}
									_v212 = _v208;
									 *_t1455 = _v216;
									 *((intOrPtr*)( *_a8 + 0x750))(_a8, _t1401,  &_v212,  &_v240);
									_v80 = _v240;
									_v76 = _v236;
									L00401472();
									_t1451 = _t1455 + 0xc;
									_t1285 =  *((intOrPtr*)( *_a8 + 0x720))(_a8, 2,  &_v124,  &_v128);
									_v252 = _t1285;
									if(_v252 >= 0) {
										_v564 = _v564 & 0x00000000;
									} else {
										_push(0x720);
										_push(0x402670);
										_push(_a8);
										_push(_v252);
										L0040148A();
										_v564 = _t1285;
									}
									_v180 = 0x4ffff;
									_v188 = 0x8003;
									_push( &_v68);
									_t1287 =  &_v188;
									_push(_t1287);
									L00401436();
									if(_t1287 == 0) {
										goto __ebx;
									}
								}
							}
							asm("insb");
							asm("popad");
							asm("gs insd");
							_t1444 = _t1300[0xc] * 0xcccc0000;
							asm("int3");
							asm("int3");
							L43:
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t1434);
							_t1444 = _t1444 - 0xc;
							L45:
							_push(ss);
							asm("adc eax, [eax]");
							_t912 =  *[fs:0x0];
							_push(_t912);
							L46:
							 *[fs:0x0] = _t1444;
							L47:
							 *0 = _t1444;
							L48:
							 *_t912 =  *_t912 + _t912;
							 *((intOrPtr*)(_t912 + 0x220)) =  *((intOrPtr*)(_t912 + 0x220)) + _t1293;
							L00401310();
							 *((intOrPtr*)(_t1293 + 0x56))();
							_push(_t1416);
							_v16 = _t1444;
							_v12 = 0x401150;
							_t912 = _a4;
							L51:
							 *(_t1293 + 0x458901e0) =  *(_t1293 + 0x458901e0) | _t912;
							asm("cld");
							_t1292 = _a4 & 0xfffffffe;
							_t1484 = _t1292;
							_a4 = _t1292;
							L52:
							_t912 = _a4;
							L53:
							_t912 =  *_t912;
							_push(_a4);
							L54:
							if(_t1484 != 0) {
								goto L58;
							}
							_t912 =  *((intOrPtr*)(_t912 + 4))();
							goto L56;
						}
						asm("bound esi, [edx+0x6f]");
						 *_t912 =  *_t912 + _t912;
						_t39 = _t1405 + 0x61;
						 *_t39 =  *((intOrPtr*)(_t1405 + 0x61)) + _t912;
						_t1468 =  *_t39;
						if(_t1468 < 0) {
							L38:
							if(_t1478 < 0) {
								goto L57;
							}
							asm("outsb");
							_t1434 =  *(_t1423 + 0x67) * 0x784f0000;
							goto L40;
						}
						asm("a16 jz 0x68");
						if(_t1468 < 0) {
							asm("outsb");
							asm("a16 gs outsb");
							if (_t1474 >= 0) goto L32;
							 *_t912 =  *_t912 + _t912;
							_push(_t1444);
							if( *_t912 < 0) {
								goto L51;
							} else {
								if ( *(_t1423 + 0x6f) * 0x69676f6c >= 0) goto L34;
								 *_t912 =  *_t912 + _t912;
								_t1300 =  &(_t1300[0]);
								_t1477 = _t1300;
								if(_t1477 < 0) {
									goto L53;
								} else {
									asm("outsd");
									if(_t1477 > 0) {
										goto L52;
									}
									asm("popad");
									asm("o16 add [eax], al");
									goto L37;
								}
							}
						}
						 *_t912 =  *_t912 + _t912;
						 *_t912 =  *_t912 + _t912;
						asm("outsd");
						asm("outsb");
						asm("outsb");
						asm("popad");
						if(_t1423 - 1 <= 0) {
							goto L43;
						}
						asm("a16 popad");
						asm("bound ebp, [ecx+0x6c]");
						_t1423 =  *(_t1300 + 0x39 + _t1416 * 2) * 0;
						_t1470 = _t1423;
						if (_t1470 >= 0) goto L45;
						L22:
						if(_t1470 >= 0) {
							goto L45;
						}
						if(_t1470 < 0) {
							goto L48;
						}
						 *_t912 =  *_t912 + _t912;
						_t1300 =  &(_t1300[0]);
						_t1471 = _t1300;
						asm("insb");
						asm("insb");
						if(_t1471 <= 0) {
							goto L47;
						}
						asm("popad");
						if(_t1471 == 0) {
							goto L46;
						}
						if(_t1471 >= 0) {
							goto L41;
						}
						_t44 =  &_a100;
						 *_t44 = _a100 + _t1405;
						if ( *_t44 >= 0) goto L49;
						L28:
						_t1416 = _t1300[0x1b] * 0x6e;
						_t1473 = _t1416;
					}
				}
				_t1423 = _a108 * 0x73;
				if(_t1423 == 0) {
					L7:
					 *_t912 =  *_t912 + _t912;
					asm("insb");
					_t1423 =  *[gs:edx+esi*2+0x6f] * 0x6e;
					_t1434 =  *(_t1293 + 0x66) * 0x6b656572;
					if (_t1434 >= 0) goto L8;
					 *_t912 =  *_t912 + _t912;
					_t28 = _t1293 + 0x6b;
					 *_t28 =  *((intOrPtr*)(_t1293 + 0x6b)) + _t1405;
					_t1462 =  *_t28;
					if(_t1462 < 0) {
						goto L22;
					} else {
						asm("o16 jz 0x6e");
						asm("outsd");
						asm("gs outsb");
						if (_t1462 >= 0) goto L10;
						 *_t912 =  *_t912 + _t912;
						_t30 =  &(_t1300[0x1b]);
						 *_t30 = _t1300 + _t1300[0x1b];
						asm("insd");
						if( *_t30 != 0) {
							goto L28;
						} else {
							asm("outsd");
							asm("insb");
							asm("outsd");
							_t1444 =  *(_t1434 + _t1416 + 0x38) * 0;
							asm("popad");
							goto L12;
						}
					}
				}
				 *_t912 =  *_t912 + _t912;
				_t23 = _t1405 + 0x65;
				 *_t23 =  *(_t1405 + 0x65) + _t912;
				_t1459 =  *_t23;
				if(_t1459 >= 0) {
					goto L15;
				}
				if(_t1459 != 0) {
					goto L13;
				}
				asm("insb");
				if(_t1459 >= 0) {
					goto L14;
				}
				if (_t1459 < 0) goto L6;
				 *((intOrPtr*)(_t912 + 0x4f)) =  *((intOrPtr*)(_t912 + 0x4f)) + _t1405;
				_t1456 = _t1444 - 1;
				_push(_t1456);
				 *_t912 =  *_t912 + _t912;
				 *_t912 =  *_t912 + _t912;
				_push(_t1456);
				_t912 = _t912 - 1;
				_t1442 =  &_a1;
				_t1296 = _t1293 + 2;
				_push(_t1456);
				_push(_t1296);
				 *_t912 =  *_t912 + _t912;
				 *_t912 =  *_t912 + _t912;
				_t1444 = _t1456 + 1;
				_push(_t1444);
				_t1300 =  &(_t1300[0]);
				_push(_t1296);
				_push(_t1444);
				_push(_t1405);
				_push(_t1442);
				_t1293 = _t1296 - 1;
				_push(_t1444);
				_push(_t1442);
				_push(_t1405);
				_push(_t1405);
				goto L7;
			}

0x0040a50c
0x0040a511
0x0040a513
0x0040a516
0x0040a519
0x0040a51b
0x0040a51d
0x0040a51e
0x0040a51f
0x0040a525
0x0040a527
0x0040a529
0x0040a52a
0x0040a52b
0x0040a52e
0x0040a531
0x0040a533
0x0040a537
0x0040a53d
0x0040a53f
0x0040a542
0x0040a543
0x0040a546
0x0040a549
0x0040a54b
0x0040a554
0x0040a555
0x0040a559
0x0040a55a
0x0040a55b
0x0040a561
0x0040a5d6
0x0040a5d7
0x0040a5d7
0x0040a5d7
0x0040a5da
0x0040a5da
0x0040a5db
0x0040a5db
0x0040a5dd
0x0040a5df
0x0040a5e2
0x0040a5e3
0x0040a5ea
0x0040a5ec
0x0040a5ed
0x0040a65d
0x0040a65d
0x0040a65f
0x0040a65f
0x0040a65f
0x0040a662
0x00000000
0x00000000
0x00000000
0x0040a5ef
0x0040a5ef
0x0040a5f4
0x0040a668
0x0040a668
0x0040a669
0x0040a669
0x0040a66c
0x0040a66d
0x0040a6d0
0x0040a6d0
0x0040a6d2
0x0040a6d5
0x0040a6d5
0x0040a6d6
0x0040a6d6
0x0040a6db
0x0040a6e0
0x0040a6e5
0x0040a6f1
0x0040a70e
0x0040a6f3
0x0040a6f3
0x0040a6f8
0x0040a6fd
0x0040a702
0x0040a702
0x0040a728
0x0040a732
0x0040a736
0x0040a73b
0x0040a756
0x0040a75c
0x0040a75e
0x0040a76b
0x0040a790
0x0040a76d
0x0040a76d
0x0040a772
0x0040a777
0x0040a77d
0x0040a783
0x0040a788
0x0040a788
0x0040a79e
0x0040a7b2
0x0040a7c9
0x0040a7d2
0x0040a7df
0x0040a7ec
0x0040a809
0x0040a7ee
0x0040a7ee
0x0040a7f3
0x0040a7f8
0x0040a7fd
0x0040a7fd
0x0040a82d
0x0040a831
0x0040a836
0x0040a851
0x0040a857
0x0040a859
0x0040a866
0x0040a88b
0x0040a868
0x0040a868
0x0040a86d
0x0040a872
0x0040a878
0x0040a87e
0x0040a883
0x0040a883
0x0040a899
0x0040a8b6
0x0040a89b
0x0040a89b
0x0040a8a0
0x0040a8a5
0x0040a8aa
0x0040a8aa
0x0040a8da
0x0040a8de
0x0040a8e3
0x0040a8fb
0x0040a901
0x0040a903
0x0040a910
0x0040a935
0x0040a912
0x0040a912
0x0040a917
0x0040a91c
0x0040a922
0x0040a928
0x0040a92d
0x0040a92d
0x0040a93c
0x0040a946
0x0040a95c
0x0040a967
0x0040a96d
0x0040a977
0x0040a995
0x0040a9a2
0x0040a9a3
0x0040a9a4
0x0040a9a5
0x0040a9ae
0x0040a9b7
0x0040a9c6
0x0040a9cb
0x0040a9d4
0x0040a9e1
0x0040a9f7
0x0040a9fd
0x0040aa0a
0x0040aa2c
0x0040aa0c
0x0040aa0c
0x0040aa11
0x0040aa16
0x0040aa19
0x0040aa1f
0x0040aa24
0x0040aa24
0x0040aa36
0x0040aa42
0x0040aa5f
0x0040aa44
0x0040aa44
0x0040aa49
0x0040aa4e
0x0040aa53
0x0040aa53
0x0040aa83
0x0040aa87
0x0040aa8c
0x0040aaa7
0x0040aaaa
0x0040aaac
0x0040aab9
0x0040aadb
0x0040aabb
0x0040aabb
0x0040aabd
0x0040aac2
0x0040aac8
0x0040aace
0x0040aad3
0x0040aad3
0x0040aae9
0x0040ab06
0x0040aaeb
0x0040aaeb
0x0040aaf0
0x0040aaf5
0x0040aafa
0x0040aafa
0x0040ab2a
0x0040ab2e
0x0040ab33
0x0040ab4e
0x0040ab54
0x0040ab56
0x0040ab63
0x0040ab88
0x0040ab65
0x0040ab65
0x0040ab6a
0x0040ab6f
0x0040ab75
0x0040ab7b
0x0040ab80
0x0040ab80
0x0040ab96
0x0040abb3
0x0040ab98
0x0040ab98
0x0040ab9d
0x0040aba2
0x0040aba7
0x0040aba7
0x0040abd7
0x0040abde
0x0040abe3
0x0040abfe
0x0040ac04
0x0040ac06
0x0040ac13
0x0040ac38
0x0040ac15
0x0040ac15
0x0040ac1a
0x0040ac1f
0x0040ac25
0x0040ac2b
0x0040ac30
0x0040ac30
0x0040ac45
0x0040ac4b
0x0040ac58
0x0040ac5e
0x0040ac6e
0x0040ac7a
0x0040ac8a
0x0040ac97
0x0040ac98
0x0040ac99
0x0040ac9a
0x0040acb6
0x0040acbc
0x0040acc9
0x0040aceb
0x0040accb
0x0040accb
0x0040acd0
0x0040acd5
0x0040acd8
0x0040acde
0x0040ace3
0x0040ace3
0x0040acf8
0x0040ad01
0x0040ad05
0x0040ad09
0x0040ad0a
0x0040ad0c
0x0040ad11
0x0040ad1a
0x0040ad26
0x0040ad43
0x0040ad28
0x0040ad28
0x0040ad2d
0x0040ad32
0x0040ad37
0x0040ad37
0x0040ad67
0x0040ad6b
0x0040ad70
0x0040ad88
0x0040ad8e
0x0040ad90
0x0040ad9d
0x0040adc2
0x0040ad9f
0x0040ad9f
0x0040ada4
0x0040ada9
0x0040adaf
0x0040adb5
0x0040adba
0x0040adba
0x0040add0
0x0040aded
0x0040add2
0x0040add2
0x0040add7
0x0040addc
0x0040ade1
0x0040ade1
0x0040ae11
0x0040ae18
0x0040ae1d
0x0040ae35
0x0040ae3b
0x0040ae3d
0x0040ae4a
0x0040ae6f
0x0040ae4c
0x0040ae4c
0x0040ae51
0x0040ae56
0x0040ae5c
0x0040ae62
0x0040ae67
0x0040ae67
0x0040ae7d
0x0040ae9a
0x0040ae7f
0x0040ae7f
0x0040ae84
0x0040ae89
0x0040ae8e
0x0040ae8e
0x0040aebe
0x0040aec5
0x0040aeca
0x0040aee5
0x0040aeeb
0x0040aeed
0x0040aefa
0x0040af1f
0x0040aefc
0x0040aefc
0x0040af01
0x0040af06
0x0040af0c
0x0040af12
0x0040af17
0x0040af17
0x0040af2d
0x0040af4a
0x0040af2f
0x0040af2f
0x0040af34
0x0040af39
0x0040af3e
0x0040af3e
0x0040af6e
0x0040af75
0x0040af7a
0x0040af92
0x0040af98
0x0040af9a
0x0040afa7
0x0040afcc
0x0040afa9
0x0040afa9
0x0040afae
0x0040afb3
0x0040afb9
0x0040afbf
0x0040afc4
0x0040afc4
0x0040afd6
0x0040afdc
0x0040afe6
0x0040afec
0x0040affd
0x0040b00c
0x0040b014
0x0040b01a
0x0040b027
0x0040b02f
0x0040b035
0x0040b03f
0x0040b045
0x0040b06f
0x0040b07c
0x0040b07d
0x0040b07e
0x0040b07f
0x0040b088
0x0040b08e
0x0040b09b
0x0040b0bd
0x0040b09d
0x0040b09d
0x0040b0a2
0x0040b0a7
0x0040b0aa
0x0040b0b0
0x0040b0b5
0x0040b0b5
0x0040b0ca
0x0040b0d0
0x0040b0d4
0x0040b0d5
0x0040b0d7
0x0040b0e5
0x0040b0ec
0x0040b0f3
0x0040b0f7
0x0040b0f8
0x0040b0fa
0x0040b108
0x0040b10f
0x0040b110
0x0040b112
0x0040b117
0x0040b121
0x0040b13e
0x0040b123
0x0040b123
0x0040b128
0x0040b12d
0x0040b132
0x0040b132
0x0040b162
0x0040b166
0x0040b16b
0x0040b186
0x0040b18c
0x0040b18e
0x0040b19b
0x0040b1c0
0x0040b19d
0x0040b19d
0x0040b1a2
0x0040b1a7
0x0040b1ad
0x0040b1b3
0x0040b1b8
0x0040b1b8
0x0040b1ce
0x0040b1eb
0x0040b1d0
0x0040b1d0
0x0040b1d5
0x0040b1da
0x0040b1df
0x0040b1df
0x0040b20f
0x0040b213
0x0040b218
0x0040b233
0x0040b239
0x0040b23b
0x0040b248
0x0040b26d
0x0040b24a
0x0040b24a
0x0040b24f
0x0040b254
0x0040b25a
0x0040b260
0x0040b265
0x0040b265
0x0040b27b
0x0040b298
0x0040b27d
0x0040b27d
0x0040b282
0x0040b287
0x0040b28c
0x0040b28c
0x0040b2bc
0x0040b2c3
0x0040b2c8
0x0040b2e3
0x0040b2e9
0x0040b2eb
0x0040b2f8
0x0040b31d
0x0040b2fa
0x0040b2fa
0x0040b2ff
0x0040b304
0x0040b30a
0x0040b310
0x0040b315
0x0040b315
0x0040b324
0x0040b32e
0x0040b33e
0x0040b344
0x0040b351
0x0040b357
0x0040b368
0x0040b379
0x0040b386
0x0040b387
0x0040b388
0x0040b389
0x0040b3a4
0x0040b3bb
0x0040b3c0
0x0040b3c9
0x0040b3dd
0x0040b3e9
0x0040b3fb
0x0040b401
0x0040b40e
0x0040b430
0x0040b410
0x0040b410
0x0040b415
0x0040b41a
0x0040b41d
0x0040b423
0x0040b428
0x0040b428
0x0040b43d
0x0040b447
0x0040b464
0x0040b449
0x0040b449
0x0040b44e
0x0040b453
0x0040b458
0x0040b458
0x0040b488
0x0040b48c
0x0040b491
0x0040b4a9
0x0040b4af
0x0040b4b1
0x0040b4be
0x0040b4e3
0x0040b4c0
0x0040b4c0
0x0040b4c5
0x0040b4ca
0x0040b4d0
0x0040b4d6
0x0040b4db
0x0040b4db
0x0040b4f1
0x0040b50e
0x0040b4f3
0x0040b4f3
0x0040b4f8
0x0040b4fd
0x0040b502
0x0040b502
0x0040b532
0x0040b536
0x0040b53b
0x0040b556
0x0040b55c
0x0040b55e
0x0040b56b
0x0040b590
0x0040b56d
0x0040b56d
0x0040b572
0x0040b577
0x0040b57d
0x0040b583
0x0040b588
0x0040b588
0x0040b59e
0x0040b5bb
0x0040b5a0
0x0040b5a0
0x0040b5a5
0x0040b5aa
0x0040b5af
0x0040b5af
0x0040b5df
0x0040b5e6
0x0040b5eb
0x0040b606
0x0040b60c
0x0040b60e
0x0040b61b
0x0040b640
0x0040b61d
0x0040b61d
0x0040b622
0x0040b627
0x0040b62d
0x0040b633
0x0040b638
0x0040b638
0x0040b64d
0x0040b65a
0x0040b669
0x0040b671
0x0040b677
0x0040b681
0x0040b687
0x0040b6c3
0x0040b6cf
0x0040b6d5
0x0040b6e0
0x0040b6e4
0x0040b6e8
0x0040b6e9
0x0040b6eb
0x0040b6f0
0x0040b6f9
0x0040b705
0x0040b722
0x0040b707
0x0040b707
0x0040b70c
0x0040b711
0x0040b716
0x0040b716
0x0040b746
0x0040b74a
0x0040b74f
0x0040b767
0x0040b76d
0x0040b76f
0x0040b77c
0x0040b7a1
0x0040b77e
0x0040b77e
0x0040b783
0x0040b788
0x0040b78e
0x0040b794
0x0040b799
0x0040b799
0x0040b7ae
0x0040b7b7
0x0040b7bd
0x0040b7c7
0x0040b7cd
0x0040b7df
0x0040b7ea
0x0040b7fa
0x0040b807
0x0040b808
0x0040b809
0x0040b80a
0x0040b828
0x0040b831
0x0040b839
0x0040b844
0x0040b850
0x0040b86d
0x0040b852
0x0040b852
0x0040b857
0x0040b85c
0x0040b861
0x0040b861
0x0040b891
0x0040b895
0x0040b89a
0x0040b8b2
0x0040b8b8
0x0040b8ba
0x0040b8c7
0x0040b8ec
0x0040b8c9
0x0040b8c9
0x0040b8ce
0x0040b8d3
0x0040b8d9
0x0040b8df
0x0040b8e4
0x0040b8e4
0x0040b90a
0x0040b916
0x0040b91c
0x0040b924
0x0040b938
0x0040b93e
0x0040b94b
0x0040b96d
0x0040b94d
0x0040b94d
0x0040b952
0x0040b957
0x0040b95a
0x0040b960
0x0040b965
0x0040b965
0x0040b97a
0x0040b983
0x0040b98e
0x0040b994
0x0040b996
0x0040b9a3
0x0040b9c5
0x0040b9a5
0x0040b9a5
0x0040b9aa
0x0040b9af
0x0040b9b2
0x0040b9b8
0x0040b9bd
0x0040b9bd
0x0040b9cc
0x0040b9cc
0x0040b9d6
0x0040b9f2
0x0040b9fc
0x0040ba09
0x0040ba0f
0x0040ba1c
0x0040ba3e
0x0040ba1e
0x0040ba1e
0x0040ba23
0x0040ba28
0x0040ba2b
0x0040ba31
0x0040ba36
0x0040ba36
0x0040ba45
0x0040ba4f
0x0040ba65
0x0040ba78
0x0040ba99
0x0040baa5
0x0040baae
0x0040bab7
0x0040bac3
0x0040bae0
0x0040bac5
0x0040bac5
0x0040baca
0x0040bacf
0x0040bad4
0x0040bad4
0x0040bb04
0x0040bb08
0x0040bb0d
0x0040bb28
0x0040bb2e
0x0040bb30
0x0040bb3d
0x0040bb62
0x0040bb3f
0x0040bb3f
0x0040bb44
0x0040bb49
0x0040bb4f
0x0040bb55
0x0040bb5a
0x0040bb5a
0x0040bb70
0x0040bb8d
0x0040bb72
0x0040bb72
0x0040bb77
0x0040bb7c
0x0040bb81
0x0040bb81
0x0040bbb1
0x0040bbb5
0x0040bbba
0x0040bbd2
0x0040bbd5
0x0040bbd7
0x0040bbe4
0x0040bc06
0x0040bbe6
0x0040bbe6
0x0040bbe8
0x0040bbed
0x0040bbf3
0x0040bbf9
0x0040bbfe
0x0040bbfe
0x0040bc10
0x0040bc16
0x0040bc20
0x0040bc26
0x0040bc38
0x0040bc43
0x0040bc49
0x0040bc79
0x0040bc7f
0x0040bc8c
0x0040bcae
0x0040bc8e
0x0040bc8e
0x0040bc93
0x0040bc98
0x0040bc9b
0x0040bca1
0x0040bca6
0x0040bca6
0x0040bcbb
0x0040bcc1
0x0040bcc9
0x0040bccd
0x0040bcce
0x0040bcd0
0x0040bcde
0x0040bce5
0x0040bce6
0x0040bce8
0x0040bced
0x0040bcf7
0x0040bd14
0x0040bcf9
0x0040bcf9
0x0040bcfe
0x0040bd03
0x0040bd08
0x0040bd08
0x0040bd38
0x0040bd3c
0x0040bd41
0x0040bd59
0x0040bd5f
0x0040bd61
0x0040bd6e
0x0040bd93
0x0040bd70
0x0040bd70
0x0040bd75
0x0040bd7a
0x0040bd80
0x0040bd86
0x0040bd8b
0x0040bd8b
0x0040bda8
0x0040bdb0
0x0040bdba
0x0040bdcc
0x0040bdd7
0x0040bde4
0x0040bdeb
0x0040be10
0x0040be1c
0x0040be22
0x0040be2a
0x0040be2e
0x0040be2f
0x0040be31
0x0040be36
0x0040be3f
0x0040be4b
0x0040be68
0x0040be4d
0x0040be4d
0x0040be52
0x0040be57
0x0040be5c
0x0040be5c
0x0040be82
0x0040be8c
0x0040be90
0x0040be95
0x0040bead
0x0040beb3
0x0040beb5
0x0040bec2
0x0040bee7
0x0040bec4
0x0040bec4
0x0040bec9
0x0040bece
0x0040bed4
0x0040beda
0x0040bedf
0x0040bedf
0x0040bef1
0x0040bef7
0x0040bf01
0x0040bf07
0x0040bf11
0x0040bf1b
0x0040bf3b
0x0040bf4d
0x0040bf53
0x0040bf60
0x0040bf82
0x0040bf62
0x0040bf62
0x0040bf67
0x0040bf6c
0x0040bf6f
0x0040bf75
0x0040bf7a
0x0040bf7a
0x0040bf90
0x0040bf97
0x0040bfa2
0x0040bfaf
0x0040bfb5
0x0040bfc2
0x0040bfe4
0x0040bfc4
0x0040bfc4
0x0040bfc9
0x0040bfce
0x0040bfd1
0x0040bfd7
0x0040bfdc
0x0040bfdc
0x0040bff2
0x0040c00f
0x0040bff4
0x0040bff4
0x0040bff9
0x0040bffe
0x0040c003
0x0040c003
0x0040c033
0x0040c037
0x0040c03c
0x0040c057
0x0040c05a
0x0040c05c
0x0040c069
0x0040c08b
0x0040c06b
0x0040c06b
0x0040c06d
0x0040c072
0x0040c078
0x0040c07e
0x0040c083
0x0040c083
0x0040c099
0x0040c0b6
0x0040c09b
0x0040c09b
0x0040c0a0
0x0040c0a5
0x0040c0aa
0x0040c0aa
0x0040c0d0
0x0040c0da
0x0040c0de
0x0040c0e3
0x0040c0fe
0x0040c104
0x0040c106
0x0040c113
0x0040c138
0x0040c115
0x0040c115
0x0040c11a
0x0040c11f
0x0040c125
0x0040c12b
0x0040c130
0x0040c130
0x0040c146
0x0040c162
0x0040c16d
0x0040c179
0x0040c182
0x0040c18f
0x0040c194
0x0040c19f
0x0040c1a5
0x0040c1b2
0x0040c1d4
0x0040c1b4
0x0040c1b4
0x0040c1b9
0x0040c1be
0x0040c1c1
0x0040c1c7
0x0040c1cc
0x0040c1cc
0x0040c1db
0x0040c1e5
0x0040c1f2
0x0040c1f3
0x0040c1f9
0x0040c1fa
0x0040c204
0x0040c210
0x0040c210
0x0040c206
0x0040b9cc
0x0040a66f
0x0040a670
0x0040a671
0x0040a673
0x0040a67a
0x0040a67b
0x0040a67c
0x0040a67c
0x0040a67d
0x0040a67e
0x0040a67f
0x0040a684
0x0040a687
0x0040a689
0x0040a68b
0x0040a68c
0x0040a68f
0x0040a695
0x0040a696
0x0040a696
0x0040a697
0x0040a697
0x0040a69a
0x0040a69a
0x0040a69c
0x0040a6a2
0x0040a6a6
0x0040a6a9
0x0040a6aa
0x0040a6ad
0x0040a6b4
0x0040a6b5
0x0040a6b6
0x0040a6bc
0x0040a6c0
0x0040a6c0
0x0040a6c3
0x0040a6c6
0x0040a6c6
0x0040a6c9
0x0040a6c9
0x0040a6cb
0x0040a6cc
0x0040a6cc
0x00000000
0x00000000
0x0040a6ce
0x00000000
0x0040a6ce
0x0040a5f6
0x0040a5f9
0x0040a5fb
0x0040a5fb
0x0040a5fb
0x0040a5fe
0x0040a664
0x0040a664
0x00000000
0x00000000
0x0040a666
0x0040a667
0x00000000
0x0040a667
0x0040a603
0x0040a606
0x0040a63c
0x0040a63d
0x0040a640
0x0040a642
0x0040a644
0x0040a645
0x00000000
0x0040a648
0x0040a64f
0x0040a652
0x0040a654
0x0040a654
0x0040a655
0x00000000
0x0040a657
0x0040a657
0x0040a658
0x00000000
0x00000000
0x0040a65a
0x0040a65c
0x00000000
0x0040a65c
0x0040a655
0x0040a645
0x0040a608
0x0040a60a
0x0040a60d
0x0040a60e
0x0040a60f
0x0040a610
0x0040a611
0x00000000
0x00000000
0x0040a613
0x0040a615
0x0040a618
0x0040a618
0x0040a620
0x0040a621
0x0040a621
0x00000000
0x00000000
0x0040a624
0x00000000
0x00000000
0x0040a626
0x0040a628
0x0040a628
0x0040a629
0x0040a62a
0x0040a62b
0x00000000
0x00000000
0x0040a62e
0x0040a62f
0x00000000
0x00000000
0x0040a631
0x00000000
0x00000000
0x0040a633
0x0040a633
0x0040a636
0x0040a637
0x0040a637
0x0040a637
0x0040a637
0x0040a5ed
0x0040a563
0x0040a567
0x0040a59e
0x0040a59e
0x0040a5a1
0x0040a5a2
0x0040a5a8
0x0040a5af
0x0040a5b1
0x0040a5b3
0x0040a5b3
0x0040a5b3
0x0040a5b6
0x00000000
0x0040a5b8
0x0040a5b8
0x0040a5bb
0x0040a5bc
0x0040a5bf
0x0040a5c1
0x0040a5c3
0x0040a5c3
0x0040a5c6
0x0040a5c7
0x00000000
0x0040a5c9
0x0040a5c9
0x0040a5ca
0x0040a5cb
0x0040a5cc
0x0040a5d5
0x00000000
0x0040a5d5
0x0040a5c7
0x0040a5b6
0x0040a569
0x0040a56b
0x0040a56b
0x0040a56b
0x0040a56e
0x00000000
0x00000000
0x0040a570
0x00000000
0x00000000
0x0040a572
0x0040a573
0x00000000
0x00000000
0x0040a575
0x0040a577
0x0040a57c
0x0040a57f
0x0040a580
0x0040a582
0x0040a584
0x0040a585
0x0040a586
0x0040a587
0x0040a589
0x0040a58b
0x0040a58c
0x0040a58e
0x0040a590
0x0040a592
0x0040a593
0x0040a594
0x0040a595
0x0040a596
0x0040a597
0x0040a598
0x0040a599
0x0040a59a
0x0040a59b
0x0040a59d
0x00000000

Strings

Afgivnes, xrefs: 0040A96D
GULLION, xrefs: 0040B661
Forsrget, xrefs: 0040A6D6
serviceaftales, xrefs: 0040BC30
Krusedullers, xrefs: 0040B004
Taylorismens, xrefs: 0040A6DB
Wackes, xrefs: 0040A93C
Vareprves4, xrefs: 0040A6D1
(@, xrefs: 0040A6D2
VAGTPOSTERS, xrefs: 0040A6E0
MINIMERENDES, xrefs: 0040A9D9
BUBALE, xrefs: 0040B7D7
BAKTERIOLOGERNES, xrefs: 0040BA45
Oaty3, xrefs: 0040BDC4

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: (@$Afgivnes$BAKTERIOLOGERNES$BUBALE$Forsrget$GULLION$Krusedullers$MINIMERENDES$Oaty3$Taylorismens$VAGTPOSTERS$Vareprves4$Wackes$serviceaftales
API String ID: 0-4279179636
Opcode ID: 0c131b696bf66a5e4d6d53c42fdfa990d97f6b8bc827a0dadfd0c2eae963d568
Instruction ID: 6bc61359c348783b083a04b7ae8f1951a116a3a4f655708cbe45c8599fe1813e
Opcode Fuzzy Hash: 0c131b696bf66a5e4d6d53c42fdfa990d97f6b8bc827a0dadfd0c2eae963d568
Instruction Fuzzy Hash: B9033470940219DFDB21DF60CC45FE9BBB8BB08304F1084EAE549BB2A1DB785A85DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A684, Relevance: 258.9, APIs: 134, Strings: 13, Instructions: 1618
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040A684(signed int _a4) {
				void* _v3;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				char _v44;
				char _v48;
				long long _v56;
				char _v72;
				short _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v108;
				signed int _v112;
				signed int _v116;
				char _v120;
				char _v124;
				char _v128;
				signed int _v132;
				char _v136;
				signed int _v140;
				char _v144;
				char _v152;
				char _v160;
				intOrPtr _v168;
				char _v176;
				char* _v184;
				char _v192;
				char* _v200;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				intOrPtr _v240;
				char _v244;
				intOrPtr _v248;
				char _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				char _v300;
				signed int _v304;
				signed int _v308;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				signed int _v332;
				intOrPtr* _v336;
				signed int _v340;
				intOrPtr* _v344;
				signed int _v348;
				intOrPtr* _v352;
				signed int _v356;
				signed int _v360;
				intOrPtr* _v364;
				signed int _v368;
				intOrPtr* _v372;
				signed int _v376;
				intOrPtr* _v380;
				signed int _v384;
				signed int _v388;
				intOrPtr* _v392;
				signed int _v396;
				intOrPtr* _v400;
				signed int _v404;
				intOrPtr* _v408;
				signed int _v412;
				intOrPtr* _v416;
				signed int _v420;
				signed int _v424;
				intOrPtr* _v428;
				signed int _v432;
				intOrPtr* _v436;
				signed int _v440;
				intOrPtr* _v444;
				signed int _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				intOrPtr* _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				signed int _v496;
				signed int _v500;
				signed int _v504;
				intOrPtr* _v508;
				signed int _v512;
				intOrPtr* _v516;
				signed int _v520;
				signed int _v524;
				intOrPtr* _v528;
				signed int _v532;
				intOrPtr* _v536;
				signed int _v540;
				signed int _v544;
				signed int _v548;
				intOrPtr* _v552;
				signed int _v556;
				intOrPtr* _v560;
				signed int _v564;
				signed int _v568;
				intOrPtr* _t843;
				signed char _t845;
				signed int _t847;
				intOrPtr* _t848;
				intOrPtr _t849;
				signed int _t853;
				signed int _t857;
				signed int _t869;
				signed int _t873;
				signed int _t877;
				signed int _t881;
				signed int _t894;
				signed int _t898;
				signed int _t902;
				signed int _t906;
				signed int _t910;
				signed int _t914;
				signed int _t918;
				signed int _t928;
				signed int _t936;
				signed int _t940;
				signed int _t944;
				signed int _t948;
				signed int _t952;
				signed int _t956;
				signed int _t960;
				signed int _t964;
				signed int _t979;
				signed int _t992;
				signed int _t996;
				signed int _t1000;
				signed int _t1004;
				signed int _t1008;
				signed int _t1012;
				signed int _t1032;
				signed int _t1037;
				signed int _t1041;
				signed int _t1045;
				signed int _t1049;
				signed int _t1053;
				signed int _t1057;
				signed int _t1076;
				signed int _t1080;
				signed int _t1093;
				signed int _t1097;
				signed int _t1105;
				signed int _t1110;
				signed int _t1116;
				signed int _t1127;
				signed int _t1131;
				signed int _t1135;
				signed int _t1139;
				signed int _t1149;
				signed int _t1158;
				signed int _t1162;
				char* _t1165;
				signed int _t1177;
				signed int _t1181;
				signed int _t1189;
				signed int _t1193;
				signed int _t1197;
				signed int _t1201;
				signed int _t1205;
				signed int _t1209;
				signed int _t1222;
				char* _t1224;
				void* _t1226;
				void* _t1227;
				void* _t1228;
				void* _t1230;
				intOrPtr _t1233;
				intOrPtr _t1323;
				intOrPtr _t1331;
				void* _t1356;
				void* _t1357;
				void* _t1360;
				void* _t1361;
				intOrPtr* _t1362;
				void* _t1364;
				intOrPtr* _t1366;
				signed int _t1370;

				asm("adc eax, [eax]");
				_t843 =  *[fs:0x0];
				 *[fs:0x0] = 0x68004028;
				 *0 = 0x68004028;
				 *_t843 =  *_t843 + _t843;
				 *((intOrPtr*)(_t843 + 0x220)) =  *((intOrPtr*)(_t843 + 0x220)) + _t1228;
				L00401310();
				 *((intOrPtr*)(_t1228 + 0x56))(_t843, ss);
				_v16 = 0x68004028;
				_v12 = 0x401150;
				_t845 = _a4;
				 *(_t1228 + 0x458901e0) =  *(_t1228 + 0x458901e0) | _t845;
				asm("cld");
				_t847 = _a4 & 0xfffffffe;
				_t1370 = _t847;
				_a4 = _t847;
				_t848 = _a4;
				_t849 =  *_t848;
				_push(_a4);
				if(_t1370 == 0) {
					_t1226 =  *((intOrPtr*)(_t849 + 4))();
					_t1227 = _t1226 + 0x68;
					 *((intOrPtr*)(_t1227 - 0x5c)) =  *((intOrPtr*)(_t1227 - 0x5c)) + _t1230;
				}
				_push(L"Forsrget");
				_push(L"Taylorismens");
				_push(L"VAGTPOSTERS"); // executed
				L0040149C(); // executed
				if( *0x413010 != 0) {
					_v336 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v336 = 0x413010;
				}
				_t1233 =  *((intOrPtr*)( *_v336));
				_t853 =  &_v128;
				L00401496();
				_v256 = _t853;
				_t857 =  *((intOrPtr*)( *_v256 + 0x140))(_v256,  &_v212, _t853,  *((intOrPtr*)(_t1233 + 0x314))( *_v336));
				asm("fclex");
				_v260 = _t857;
				if(_v260 >= 0) {
					_v340 = _v340 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x4028d4);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v340 = _t857;
				}
				_v216 = _v212;
				_v76 =  *0x401148;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4,  &_v216, 0xa8d8e, _t1233, _t1233, 0x65ce);
				L00401484();
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4);
				if( *0x413010 != 0) {
					_v344 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v344 = 0x413010;
				}
				_t869 =  &_v128;
				L00401496();
				_v256 = _t869;
				_t873 =  *((intOrPtr*)( *_v256 + 0x128))(_v256,  &_v220, _t869,  *((intOrPtr*)( *((intOrPtr*)( *_v344)) + 0x31c))( *_v344));
				asm("fclex");
				_v260 = _t873;
				if(_v260 >= 0) {
					_v348 = _v348 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x4028fc);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v348 = _t873;
				}
				if( *0x413010 != 0) {
					_v352 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v352 = 0x413010;
				}
				_t877 =  &_v132;
				L00401496();
				_v264 = _t877;
				_t881 =  *((intOrPtr*)( *_v264 + 0x108))(_v264,  &_v112, _t877,  *((intOrPtr*)( *((intOrPtr*)( *_v352)) + 0x304))( *_v352));
				asm("fclex");
				_v268 = _t881;
				if(_v268 >= 0) {
					_v356 = _v356 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x40290c);
					_push(_v264);
					_push(_v268);
					L0040148A();
					_v356 = _t881;
				}
				_v200 = L"Wackes";
				_v208 = 8;
				L0040147E();
				_v224 = _v220;
				_v184 = L"Afgivnes";
				_v192 = 8;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x10,  &_v224, _v112,  &_v160);
				L00401478();
				L00401472();
				_t1356 = 0x68004034;
				L0040146C();
				L00401466();
				_t894 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4, 0x1b9988,  &_v112, 2,  &_v128,  &_v132);
				_v256 = _t894;
				if(_v256 >= 0) {
					_v360 = _v360 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402670);
					_push(_a4);
					_push(_v256);
					L0040148A();
					_v360 = _t894;
				}
				L00401478();
				if( *0x413010 != 0) {
					_v364 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v364 = 0x413010;
				}
				_t898 =  &_v128;
				L00401496();
				_v256 = _t898;
				_t902 =  *((intOrPtr*)( *_v256 + 0x68))(_v256,  &_v220, _t898,  *((intOrPtr*)( *((intOrPtr*)( *_v364)) + 0x318))( *_v364));
				asm("fclex");
				_v260 = _t902;
				if(_v260 >= 0) {
					_v368 = _v368 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x4028d4);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v368 = _t902;
				}
				if( *0x413010 != 0) {
					_v372 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v372 = 0x413010;
				}
				_t906 =  &_v132;
				L00401496();
				_v264 = _t906;
				_t910 =  *((intOrPtr*)( *_v264 + 0x178))(_v264,  &_v224, _t906,  *((intOrPtr*)( *((intOrPtr*)( *_v372)) + 0x314))( *_v372));
				asm("fclex");
				_v268 = _t910;
				if(_v268 >= 0) {
					_v376 = _v376 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x4028d4);
					_push(_v264);
					_push(_v268);
					L0040148A();
					_v376 = _t910;
				}
				if( *0x413010 != 0) {
					_v380 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v380 = 0x413010;
				}
				_t914 =  &_v136;
				L00401496();
				_v272 = _t914;
				_t918 =  *((intOrPtr*)( *_v272 + 0x138))(_v272,  &_v140, _t914,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x314))( *_v380));
				asm("fclex");
				_v276 = _t918;
				if(_v276 >= 0) {
					_v384 = _v384 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x4028d4);
					_push(_v272);
					_push(_v276);
					L0040148A();
					_v384 = _t918;
				}
				_v300 = _v140;
				_v140 = _v140 & 0x00000000;
				_v152 = _v300;
				_v160 = 9;
				_v232 = _v224;
				_v228 = _v220;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t928 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v228, 0x6668d3,  &_v232, 0x10,  &_v236);
				_v280 = _t928;
				if(_v280 >= 0) {
					_v388 = _v388 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402670);
					_push(_a4);
					_push(_v280);
					L0040148A();
					_v388 = _t928;
				}
				_v32 = _v236;
				_push( &_v136);
				_push( &_v132);
				_push( &_v128);
				_push(3);
				L00401472();
				_t1357 = _t1356 + 0x10;
				L0040146C();
				if( *0x413010 != 0) {
					_v392 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v392 = 0x413010;
				}
				_t936 =  &_v128;
				L00401496();
				_v256 = _t936;
				_t940 =  *((intOrPtr*)( *_v256 + 0x158))(_v256,  &_v132, _t936,  *((intOrPtr*)( *((intOrPtr*)( *_v392)) + 0x30c))( *_v392));
				asm("fclex");
				_v260 = _t940;
				if(_v260 >= 0) {
					_v396 = _v396 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x402950);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v396 = _t940;
				}
				if( *0x413010 != 0) {
					_v400 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v400 = 0x413010;
				}
				_t944 =  &_v136;
				L00401496();
				_v264 = _t944;
				_t948 =  *((intOrPtr*)( *_v264 + 0x170))(_v264,  &_v112, _t944,  *((intOrPtr*)( *((intOrPtr*)( *_v400)) + 0x304))( *_v400));
				asm("fclex");
				_v268 = _t948;
				if(_v268 >= 0) {
					_v404 = _v404 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x40290c);
					_push(_v264);
					_push(_v268);
					L0040148A();
					_v404 = _t948;
				}
				if( *0x413010 != 0) {
					_v408 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v408 = 0x413010;
				}
				_t952 =  &_v140;
				L00401496();
				_v272 = _t952;
				_t956 =  *((intOrPtr*)( *_v272 + 0x130))(_v272,  &_v212, _t952,  *((intOrPtr*)( *((intOrPtr*)( *_v408)) + 0x318))( *_v408));
				asm("fclex");
				_v276 = _t956;
				if(_v276 >= 0) {
					_v412 = _v412 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x4028d4);
					_push(_v272);
					_push(_v276);
					L0040148A();
					_v412 = _t956;
				}
				if( *0x413010 != 0) {
					_v416 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v416 = 0x413010;
				}
				_t960 =  &_v144;
				L00401496();
				_v280 = _t960;
				_t964 =  *((intOrPtr*)( *_v280 + 0x198))(_v280,  &_v116, _t960,  *((intOrPtr*)( *((intOrPtr*)( *_v416)) + 0x318))( *_v416));
				asm("fclex");
				_v284 = _t964;
				if(_v284 >= 0) {
					_v420 = _v420 & 0x00000000;
				} else {
					_push(0x198);
					_push(0x4028d4);
					_push(_v280);
					_push(_v284);
					L0040148A();
					_v420 = _t964;
				}
				_v304 = _v116;
				_v116 = _v116 & 0x00000000;
				_v168 = _v304;
				_v176 = 8;
				_v216 = _v212;
				L00401466();
				_v308 = _v112;
				_v112 = _v112 & 0x00000000;
				L00401460();
				_v312 = _v132;
				_v132 = _v132 & 0x00000000;
				_v152 = _v312;
				_v160 = 9;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t979 =  *((intOrPtr*)( *_a4 + 0x700))(_a4, 0x10,  &_v120,  &_v124,  &_v216,  &_v176,  &_v220);
				_v288 = _t979;
				if(_v288 >= 0) {
					_v424 = _v424 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x402670);
					_push(_a4);
					_push(_v288);
					L0040148A();
					_v424 = _t979;
				}
				_v92 = _v220;
				_push( &_v124);
				_push( &_v120);
				_push(2);
				L0040145A();
				_push( &_v144);
				_push( &_v140);
				_push( &_v136);
				_push( &_v128);
				_push(4);
				L00401472();
				_push( &_v176);
				_push( &_v160);
				_push(2);
				L00401454();
				_t1360 = _t1357 + 0x2c;
				if( *0x413010 != 0) {
					_v428 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v428 = 0x413010;
				}
				_t992 =  &_v128;
				L00401496();
				_v256 = _t992;
				_t996 =  *((intOrPtr*)( *_v256 + 0x178))(_v256,  &_v220, _t992,  *((intOrPtr*)( *((intOrPtr*)( *_v428)) + 0x314))( *_v428));
				asm("fclex");
				_v260 = _t996;
				if(_v260 >= 0) {
					_v432 = _v432 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x4028d4);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v432 = _t996;
				}
				if( *0x413010 != 0) {
					_v436 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v436 = 0x413010;
				}
				_t1000 =  &_v132;
				L00401496();
				_v264 = _t1000;
				_t1004 =  *((intOrPtr*)( *_v264 + 0x98))(_v264,  &_v212, _t1000,  *((intOrPtr*)( *((intOrPtr*)( *_v436)) + 0x30c))( *_v436));
				asm("fclex");
				_v268 = _t1004;
				if(_v268 >= 0) {
					_v440 = _v440 & 0x00000000;
				} else {
					_push(0x98);
					_push(0x402950);
					_push(_v264);
					_push(_v268);
					L0040148A();
					_v440 = _t1004;
				}
				if( *0x413010 != 0) {
					_v444 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v444 = 0x413010;
				}
				_t1008 =  &_v136;
				L00401496();
				_v272 = _t1008;
				_t1012 =  *((intOrPtr*)( *_v272 + 0x158))(_v272,  &_v140, _t1008,  *((intOrPtr*)( *((intOrPtr*)( *_v444)) + 0x30c))( *_v444));
				asm("fclex");
				_v276 = _t1012;
				if(_v276 >= 0) {
					_v448 = _v448 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x402950);
					_push(_v272);
					_push(_v276);
					L0040148A();
					_v448 = _t1012;
				}
				_v244 = 0x2707c260;
				_v240 = 0x5af4;
				_v316 = _v140;
				_v140 = _v140 & 0x00000000;
				_v152 = _v316;
				_v160 = 9;
				_v216 = _v212;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x734))(_a4, _v220, 0x1fb383,  &_v216, 0x10,  &_v244);
				L00401472();
				_t1361 = _t1360 + 0x10;
				L0040146C();
				 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v244, 3,  &_v128,  &_v132,  &_v136);
				_v56 = _v244;
				_t1032 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v220);
				_v256 = _t1032;
				if(_v256 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x402670);
					_push(_a4);
					_push(_v256);
					L0040148A();
					_v452 = _t1032;
				}
				_v48 = _v220;
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v456 = 0x413010;
				}
				_t1037 =  &_v128;
				L00401496();
				_v256 = _t1037;
				_t1041 =  *((intOrPtr*)( *_v256 + 0xf0))(_v256,  &_v112, _t1037,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x310))( *_v456));
				asm("fclex");
				_v260 = _t1041;
				if(_v260 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x4028d4);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v460 = _t1041;
				}
				if( *0x413010 != 0) {
					_v464 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v464 = 0x413010;
				}
				_t1045 =  &_v132;
				L00401496();
				_v264 = _t1045;
				_t1049 =  *((intOrPtr*)( *_v264 + 0x140))(_v264,  &_v212, _t1045,  *((intOrPtr*)( *((intOrPtr*)( *_v464)) + 0x314))( *_v464));
				asm("fclex");
				_v268 = _t1049;
				if(_v268 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x4028d4);
					_push(_v264);
					_push(_v268);
					L0040148A();
					_v468 = _t1049;
				}
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v472 = 0x413010;
				}
				_t1053 =  &_v136;
				L00401496();
				_v272 = _t1053;
				_t1057 =  *((intOrPtr*)( *_v272 + 0x88))(_v272,  &_v220, _t1053,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x31c))( *_v472));
				asm("fclex");
				_v276 = _t1057;
				if(_v276 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x88);
					_push(0x4028fc);
					_push(_v272);
					_push(_v276);
					L0040148A();
					_v476 = _t1057;
				}
				_v224 = _v220;
				_v216 = _v212;
				L00401466();
				_v320 = _v112;
				_v112 = _v112 & 0x00000000;
				_v152 = _v320;
				_v160 = 8;
				 *((intOrPtr*)( *_a4 + 0x73c))(_a4,  &_v160,  &_v116,  &_v216, 0xfee914b0, 0x5af7,  &_v224,  &_v228);
				_v88 = _v228;
				L00401478();
				_push( &_v136);
				_push( &_v132);
				_push( &_v128);
				_push(3);
				L00401472();
				_t1362 = _t1361 + 0x10;
				L0040146C();
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v480 = 0x413010;
				}
				_t1076 =  &_v128;
				L00401496();
				_v256 = _t1076;
				_t1080 =  *((intOrPtr*)( *_v256 + 0x160))(_v256,  &_v132, _t1076,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x308))( *_v480));
				asm("fclex");
				_v260 = _t1080;
				if(_v260 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x402950);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v484 = _t1080;
				}
				_v220 =  *0x401140;
				_v324 = _v132;
				_v132 = _v132 & 0x00000000;
				_v152 = _v324;
				_v160 = 9;
				L00401466();
				_v244 =  *0x401138;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x740))(_a4,  &_v244, 0x87a95ba0, 0x5b04,  &_v112, 0x10,  &_v220);
				L00401478();
				L00401484();
				L0040146C();
				if( *0x413010 != 0) {
					_v488 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v488 = 0x413010;
				}
				_t1093 =  &_v128;
				L00401496();
				_v256 = _t1093;
				_t1097 =  *((intOrPtr*)( *_v256 + 0x238))(_v256,  &_v112, _t1093,  *((intOrPtr*)( *((intOrPtr*)( *_v488)) + 0x310))( *_v488));
				asm("fclex");
				_v260 = _t1097;
				if(_v260 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x238);
					_push(0x4028d4);
					_push(_v256);
					_push(_v260);
					L0040148A();
					_v492 = _t1097;
				}
				 *((intOrPtr*)( *_a4 + 0x744))(_a4, _v112, 0x375d6d,  &_v220);
				_v28 = _v220;
				L00401478();
				L00401484();
				_t1105 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v244);
				_v256 = _t1105;
				if(_v256 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x402670);
					_push(_a4);
					_push(_v256);
					L0040148A();
					_v496 = _t1105;
				}
				_v44 = _v244;
				_v40 = _v240;
				_t1110 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
				asm("fclex");
				_v256 = _t1110;
				if(_v256 >= 0) {
					_v500 = _v500 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x402640);
					_push(_a4);
					_push(_v256);
					L0040148A();
					_v500 = _t1110;
				}
				while(1) {
					_v184 = 1;
					_v192 = 2;
					L00401448();
					L0040144E();
					_t1116 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v160,  &_v192,  &_v72);
					_v256 = _t1116;
					if(_v256 >= 0) {
						_v504 = _v504 & 0x00000000;
					} else {
						_push(0x70c);
						_push(0x402670);
						_push(_a4);
						_push(_v256);
						L0040148A();
						_v504 = _t1116;
					}
					_v184 = L"BAKTERIOLOGERNES";
					_v192 = 8;
					L0040147E();
					 *_t1362 =  *0x401130;
					 *((intOrPtr*)( *_a4 + 0x748))(_a4, 0x22d435,  &_v160, 0x1ddbd3f0, 0x5b05,  &_v160,  &_v244);
					_v108 = _v244;
					_v104 = _v240;
					L0040146C();
					if( *0x413010 != 0) {
						_v508 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v508 = 0x413010;
					}
					_t1127 =  &_v128;
					L00401496();
					_v256 = _t1127;
					_t1131 =  *((intOrPtr*)( *_v256 + 0x150))(_v256,  &_v220, _t1127,  *((intOrPtr*)( *((intOrPtr*)( *_v508)) + 0x300))( *_v508));
					asm("fclex");
					_v260 = _t1131;
					if(_v260 >= 0) {
						_v512 = _v512 & 0x00000000;
					} else {
						_push(0x150);
						_push(0x40290c);
						_push(_v256);
						_push(_v260);
						L0040148A();
						_v512 = _t1131;
					}
					if( *0x413010 != 0) {
						_v516 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v516 = 0x413010;
					}
					_t1135 =  &_v132;
					L00401496();
					_v264 = _t1135;
					_t1139 =  *((intOrPtr*)( *_v264 + 0x50))(_v264,  &_v112, _t1135,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x2fc))( *_v516));
					asm("fclex");
					_v268 = _t1139;
					if(_v268 >= 0) {
						_v520 = _v520 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x40290c);
						_push(_v264);
						_push(_v268);
						L0040148A();
						_v520 = _t1139;
					}
					_v328 = _v112;
					_v112 = _v112 & 0x00000000;
					_v168 = _v328;
					_v176 = 8;
					L00401466();
					_v152 = _v220;
					_v160 = 3;
					_t1149 =  *((intOrPtr*)( *_a4 + 0x714))(_a4, 0x7eaf79,  &_v160,  &_v116,  &_v176,  &_v224);
					_v272 = _t1149;
					if(_v272 >= 0) {
						_v524 = _v524 & 0x00000000;
					} else {
						_push(0x714);
						_push(0x402670);
						_push(_a4);
						_push(_v272);
						L0040148A();
						_v524 = _t1149;
					}
					_v100 = _v224;
					L00401478();
					_push( &_v132);
					_push( &_v128);
					_push(2);
					L00401472();
					_push( &_v176);
					_push( &_v160);
					_push(2);
					L00401454();
					_t1364 = _t1362 + 0x18;
					if( *0x413010 != 0) {
						_v528 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v528 = 0x413010;
					}
					_t1158 =  &_v128;
					L00401496();
					_v256 = _t1158;
					_t1162 =  *((intOrPtr*)( *_v256 + 0x168))(_v256,  &_v132, _t1158,  *((intOrPtr*)( *((intOrPtr*)( *_v528)) + 0x30c))( *_v528));
					asm("fclex");
					_v260 = _t1162;
					if(_v260 >= 0) {
						_v532 = _v532 & 0x00000000;
					} else {
						_push(0x168);
						_push(0x402950);
						_push(_v256);
						_push(_v260);
						L0040148A();
						_v532 = _t1162;
					}
					L00401442();
					_v252 = 0x26339ac0;
					_v248 = 0x5afa;
					L00401466();
					_v244 =  *0x401128;
					_t1165 =  &_v160;
					L0040143C();
					 *((intOrPtr*)( *_a4 + 0x74c))(_a4,  &_v244,  &_v112, 0x2fd3,  &_v252, _t1165, _t1165,  &_v220,  &_v160, _v132, 0, 0);
					_v96 = _v220;
					L00401478();
					_push( &_v132);
					_push( &_v128);
					_push(2);
					L00401472();
					_t1366 = _t1364 + 0x1c;
					L0040146C();
					if( *0x413010 != 0) {
						_v536 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v536 = 0x413010;
					}
					_t1323 =  *((intOrPtr*)( *_v536));
					_t1177 =  &_v128;
					L00401496();
					_v256 = _t1177;
					_t1181 =  *((intOrPtr*)( *_v256 + 0xa0))(_v256,  &_v112, _t1177,  *((intOrPtr*)(_t1323 + 0x314))( *_v536));
					asm("fclex");
					_v260 = _t1181;
					if(_v260 >= 0) {
						_v540 = _v540 & 0x00000000;
					} else {
						_push(0xa0);
						_push(0x4028d4);
						_push(_v256);
						_push(_v260);
						L0040148A();
						_v540 = _t1181;
					}
					_v332 = _v112;
					_v112 = _v112 & 0x00000000;
					_v152 = _v332;
					_v160 = 8;
					_v244 = 0x81b04a80;
					_v240 = 0x5afd;
					 *_t1366 =  *0x401120;
					_t1189 =  *((intOrPtr*)( *_a4 + 0x718))(_a4,  &_v244, _t1323, _t1323,  &_v160,  &_v212);
					_v264 = _t1189;
					if(_v264 >= 0) {
						_v544 = _v544 & 0x00000000;
					} else {
						_push(0x718);
						_push(0x402670);
						_push(_a4);
						_push(_v264);
						L0040148A();
						_v544 = _t1189;
					}
					_v76 = _v212;
					L00401484();
					L0040146C();
					_t1193 =  *((intOrPtr*)( *_a4 + 0x71c))(_a4);
					_v256 = _t1193;
					if(_v256 >= 0) {
						_v548 = _v548 & 0x00000000;
					} else {
						_push(0x71c);
						_push(0x402670);
						_push(_a4);
						_push(_v256);
						L0040148A();
						_v548 = _t1193;
					}
					if( *0x413010 != 0) {
						_v552 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v552 = 0x413010;
					}
					_t1197 =  &_v128;
					L00401496();
					_v256 = _t1197;
					_t1201 =  *((intOrPtr*)( *_v256 + 0x78))(_v256,  &_v220, _t1197,  *((intOrPtr*)( *((intOrPtr*)( *_v552)) + 0x314))( *_v552));
					asm("fclex");
					_v260 = _t1201;
					if(_v260 >= 0) {
						_v556 = _v556 & 0x00000000;
					} else {
						_push(0x78);
						_push(0x4028d4);
						_push(_v256);
						_push(_v260);
						L0040148A();
						_v556 = _t1201;
					}
					if( *0x413010 != 0) {
						_v560 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v560 = 0x413010;
					}
					_t1331 =  *((intOrPtr*)( *_v560));
					_t1205 =  &_v132;
					L00401496();
					_v264 = _t1205;
					_t1209 =  *((intOrPtr*)( *_v264 + 0xe0))(_v264,  &_v212, _t1205,  *((intOrPtr*)(_t1331 + 0x310))( *_v560));
					asm("fclex");
					_v268 = _t1209;
					if(_v268 >= 0) {
						_v564 = _v564 & 0x00000000;
					} else {
						_push(0xe0);
						_push(0x4028d4);
						_push(_v264);
						_push(_v268);
						L0040148A();
						_v564 = _t1209;
					}
					_v216 = _v212;
					 *_t1366 = _v220;
					 *((intOrPtr*)( *_a4 + 0x750))(_a4, _t1331,  &_v216,  &_v244);
					_v84 = _v244;
					_v80 = _v240;
					L00401472();
					_t1362 = _t1366 + 0xc;
					_t1222 =  *((intOrPtr*)( *_a4 + 0x720))(_a4, 2,  &_v128,  &_v132);
					_v256 = _t1222;
					if(_v256 >= 0) {
						_v568 = _v568 & 0x00000000;
					} else {
						_push(0x720);
						_push(0x402670);
						_push(_a4);
						_push(_v256);
						L0040148A();
						_v568 = _t1222;
					}
					_v184 = 0x4ffff;
					_v192 = 0x8003;
					_push( &_v72);
					_t1224 =  &_v192;
					_push(_t1224);
					L00401436();
					if(_t1224 == 0) {
						goto __ebx;
					}
				}
			}

0x0040a68c
0x0040a68f
0x0040a696
0x0040a697
0x0040a69a
0x0040a69c
0x0040a6a2
0x0040a6a6
0x0040a6aa
0x0040a6ad
0x0040a6b4
0x0040a6b6
0x0040a6bc
0x0040a6c0
0x0040a6c0
0x0040a6c3
0x0040a6c6
0x0040a6c9
0x0040a6cb
0x0040a6cc
0x0040a6ce
0x0040a6d0
0x0040a6d5
0x0040a6d5
0x0040a6d6
0x0040a6db
0x0040a6e0
0x0040a6e5
0x0040a6f1
0x0040a70e
0x0040a6f3
0x0040a6f3
0x0040a6f8
0x0040a6fd
0x0040a702
0x0040a702
0x0040a728
0x0040a732
0x0040a736
0x0040a73b
0x0040a756
0x0040a75c
0x0040a75e
0x0040a76b
0x0040a790
0x0040a76d
0x0040a76d
0x0040a772
0x0040a777
0x0040a77d
0x0040a783
0x0040a788
0x0040a788
0x0040a79e
0x0040a7b2
0x0040a7c9
0x0040a7d2
0x0040a7df
0x0040a7ec
0x0040a809
0x0040a7ee
0x0040a7ee
0x0040a7f3
0x0040a7f8
0x0040a7fd
0x0040a7fd
0x0040a82d
0x0040a831
0x0040a836
0x0040a851
0x0040a857
0x0040a859
0x0040a866
0x0040a88b
0x0040a868
0x0040a868
0x0040a86d
0x0040a872
0x0040a878
0x0040a87e
0x0040a883
0x0040a883
0x0040a899
0x0040a8b6
0x0040a89b
0x0040a89b
0x0040a8a0
0x0040a8a5
0x0040a8aa
0x0040a8aa
0x0040a8da
0x0040a8de
0x0040a8e3
0x0040a8fb
0x0040a901
0x0040a903
0x0040a910
0x0040a935
0x0040a912
0x0040a912
0x0040a917
0x0040a91c
0x0040a922
0x0040a928
0x0040a92d
0x0040a92d
0x0040a93c
0x0040a946
0x0040a95c
0x0040a967
0x0040a96d
0x0040a977
0x0040a995
0x0040a9a2
0x0040a9a3
0x0040a9a4
0x0040a9a5
0x0040a9ae
0x0040a9b7
0x0040a9c6
0x0040a9cb
0x0040a9d4
0x0040a9e1
0x0040a9f7
0x0040a9fd
0x0040aa0a
0x0040aa2c
0x0040aa0c
0x0040aa0c
0x0040aa11
0x0040aa16
0x0040aa19
0x0040aa1f
0x0040aa24
0x0040aa24
0x0040aa36
0x0040aa42
0x0040aa5f
0x0040aa44
0x0040aa44
0x0040aa49
0x0040aa4e
0x0040aa53
0x0040aa53
0x0040aa83
0x0040aa87
0x0040aa8c
0x0040aaa7
0x0040aaaa
0x0040aaac
0x0040aab9
0x0040aadb
0x0040aabb
0x0040aabb
0x0040aabd
0x0040aac2
0x0040aac8
0x0040aace
0x0040aad3
0x0040aad3
0x0040aae9
0x0040ab06
0x0040aaeb
0x0040aaeb
0x0040aaf0
0x0040aaf5
0x0040aafa
0x0040aafa
0x0040ab2a
0x0040ab2e
0x0040ab33
0x0040ab4e
0x0040ab54
0x0040ab56
0x0040ab63
0x0040ab88
0x0040ab65
0x0040ab65
0x0040ab6a
0x0040ab6f
0x0040ab75
0x0040ab7b
0x0040ab80
0x0040ab80
0x0040ab96
0x0040abb3
0x0040ab98
0x0040ab98
0x0040ab9d
0x0040aba2
0x0040aba7
0x0040aba7
0x0040abd7
0x0040abde
0x0040abe3
0x0040abfe
0x0040ac04
0x0040ac06
0x0040ac13
0x0040ac38
0x0040ac15
0x0040ac15
0x0040ac1a
0x0040ac1f
0x0040ac25
0x0040ac2b
0x0040ac30
0x0040ac30
0x0040ac45
0x0040ac4b
0x0040ac58
0x0040ac5e
0x0040ac6e
0x0040ac7a
0x0040ac8a
0x0040ac97
0x0040ac98
0x0040ac99
0x0040ac9a
0x0040acb6
0x0040acbc
0x0040acc9
0x0040aceb
0x0040accb
0x0040accb
0x0040acd0
0x0040acd5
0x0040acd8
0x0040acde
0x0040ace3
0x0040ace3
0x0040acf8
0x0040ad01
0x0040ad05
0x0040ad09
0x0040ad0a
0x0040ad0c
0x0040ad11
0x0040ad1a
0x0040ad26
0x0040ad43
0x0040ad28
0x0040ad28
0x0040ad2d
0x0040ad32
0x0040ad37
0x0040ad37
0x0040ad67
0x0040ad6b
0x0040ad70
0x0040ad88
0x0040ad8e
0x0040ad90
0x0040ad9d
0x0040adc2
0x0040ad9f
0x0040ad9f
0x0040ada4
0x0040ada9
0x0040adaf
0x0040adb5
0x0040adba
0x0040adba
0x0040add0
0x0040aded
0x0040add2
0x0040add2
0x0040add7
0x0040addc
0x0040ade1
0x0040ade1
0x0040ae11
0x0040ae18
0x0040ae1d
0x0040ae35
0x0040ae3b
0x0040ae3d
0x0040ae4a
0x0040ae6f
0x0040ae4c
0x0040ae4c
0x0040ae51
0x0040ae56
0x0040ae5c
0x0040ae62
0x0040ae67
0x0040ae67
0x0040ae7d
0x0040ae9a
0x0040ae7f
0x0040ae7f
0x0040ae84
0x0040ae89
0x0040ae8e
0x0040ae8e
0x0040aebe
0x0040aec5
0x0040aeca
0x0040aee5
0x0040aeeb
0x0040aeed
0x0040aefa
0x0040af1f
0x0040aefc
0x0040aefc
0x0040af01
0x0040af06
0x0040af0c
0x0040af12
0x0040af17
0x0040af17
0x0040af2d
0x0040af4a
0x0040af2f
0x0040af2f
0x0040af34
0x0040af39
0x0040af3e
0x0040af3e
0x0040af6e
0x0040af75
0x0040af7a
0x0040af92
0x0040af98
0x0040af9a
0x0040afa7
0x0040afcc
0x0040afa9
0x0040afa9
0x0040afae
0x0040afb3
0x0040afb9
0x0040afbf
0x0040afc4
0x0040afc4
0x0040afd6
0x0040afdc
0x0040afe6
0x0040afec
0x0040affd
0x0040b00c
0x0040b014
0x0040b01a
0x0040b027
0x0040b02f
0x0040b035
0x0040b03f
0x0040b045
0x0040b06f
0x0040b07c
0x0040b07d
0x0040b07e
0x0040b07f
0x0040b088
0x0040b08e
0x0040b09b
0x0040b0bd
0x0040b09d
0x0040b09d
0x0040b0a2
0x0040b0a7
0x0040b0aa
0x0040b0b0
0x0040b0b5
0x0040b0b5
0x0040b0ca
0x0040b0d0
0x0040b0d4
0x0040b0d5
0x0040b0d7
0x0040b0e5
0x0040b0ec
0x0040b0f3
0x0040b0f7
0x0040b0f8
0x0040b0fa
0x0040b108
0x0040b10f
0x0040b110
0x0040b112
0x0040b117
0x0040b121
0x0040b13e
0x0040b123
0x0040b123
0x0040b128
0x0040b12d
0x0040b132
0x0040b132
0x0040b162
0x0040b166
0x0040b16b
0x0040b186
0x0040b18c
0x0040b18e
0x0040b19b
0x0040b1c0
0x0040b19d
0x0040b19d
0x0040b1a2
0x0040b1a7
0x0040b1ad
0x0040b1b3
0x0040b1b8
0x0040b1b8
0x0040b1ce
0x0040b1eb
0x0040b1d0
0x0040b1d0
0x0040b1d5
0x0040b1da
0x0040b1df
0x0040b1df
0x0040b20f
0x0040b213
0x0040b218
0x0040b233
0x0040b239
0x0040b23b
0x0040b248
0x0040b26d
0x0040b24a
0x0040b24a
0x0040b24f
0x0040b254
0x0040b25a
0x0040b260
0x0040b265
0x0040b265
0x0040b27b
0x0040b298
0x0040b27d
0x0040b27d
0x0040b282
0x0040b287
0x0040b28c
0x0040b28c
0x0040b2bc
0x0040b2c3
0x0040b2c8
0x0040b2e3
0x0040b2e9
0x0040b2eb
0x0040b2f8
0x0040b31d
0x0040b2fa
0x0040b2fa
0x0040b2ff
0x0040b304
0x0040b30a
0x0040b310
0x0040b315
0x0040b315
0x0040b324
0x0040b32e
0x0040b33e
0x0040b344
0x0040b351
0x0040b357
0x0040b368
0x0040b379
0x0040b386
0x0040b387
0x0040b388
0x0040b389
0x0040b3a4
0x0040b3bb
0x0040b3c0
0x0040b3c9
0x0040b3dd
0x0040b3e9
0x0040b3fb
0x0040b401
0x0040b40e
0x0040b430
0x0040b410
0x0040b410
0x0040b415
0x0040b41a
0x0040b41d
0x0040b423
0x0040b428
0x0040b428
0x0040b43d
0x0040b447
0x0040b464
0x0040b449
0x0040b449
0x0040b44e
0x0040b453
0x0040b458
0x0040b458
0x0040b488
0x0040b48c
0x0040b491
0x0040b4a9
0x0040b4af
0x0040b4b1
0x0040b4be
0x0040b4e3
0x0040b4c0
0x0040b4c0
0x0040b4c5
0x0040b4ca
0x0040b4d0
0x0040b4d6
0x0040b4db
0x0040b4db
0x0040b4f1
0x0040b50e
0x0040b4f3
0x0040b4f3
0x0040b4f8
0x0040b4fd
0x0040b502
0x0040b502
0x0040b532
0x0040b536
0x0040b53b
0x0040b556
0x0040b55c
0x0040b55e
0x0040b56b
0x0040b590
0x0040b56d
0x0040b56d
0x0040b572
0x0040b577
0x0040b57d
0x0040b583
0x0040b588
0x0040b588
0x0040b59e
0x0040b5bb
0x0040b5a0
0x0040b5a0
0x0040b5a5
0x0040b5aa
0x0040b5af
0x0040b5af
0x0040b5df
0x0040b5e6
0x0040b5eb
0x0040b606
0x0040b60c
0x0040b60e
0x0040b61b
0x0040b640
0x0040b61d
0x0040b61d
0x0040b622
0x0040b627
0x0040b62d
0x0040b633
0x0040b638
0x0040b638
0x0040b64d
0x0040b65a
0x0040b669
0x0040b671
0x0040b677
0x0040b681
0x0040b687
0x0040b6c3
0x0040b6cf
0x0040b6d5
0x0040b6e0
0x0040b6e4
0x0040b6e8
0x0040b6e9
0x0040b6eb
0x0040b6f0
0x0040b6f9
0x0040b705
0x0040b722
0x0040b707
0x0040b707
0x0040b70c
0x0040b711
0x0040b716
0x0040b716
0x0040b746
0x0040b74a
0x0040b74f
0x0040b767
0x0040b76d
0x0040b76f
0x0040b77c
0x0040b7a1
0x0040b77e
0x0040b77e
0x0040b783
0x0040b788
0x0040b78e
0x0040b794
0x0040b799
0x0040b799
0x0040b7ae
0x0040b7b7
0x0040b7bd
0x0040b7c7
0x0040b7cd
0x0040b7df
0x0040b7ea
0x0040b7fa
0x0040b807
0x0040b808
0x0040b809
0x0040b80a
0x0040b828
0x0040b831
0x0040b839
0x0040b844
0x0040b850
0x0040b86d
0x0040b852
0x0040b852
0x0040b857
0x0040b85c
0x0040b861
0x0040b861
0x0040b891
0x0040b895
0x0040b89a
0x0040b8b2
0x0040b8b8
0x0040b8ba
0x0040b8c7
0x0040b8ec
0x0040b8c9
0x0040b8c9
0x0040b8ce
0x0040b8d3
0x0040b8d9
0x0040b8df
0x0040b8e4
0x0040b8e4
0x0040b90a
0x0040b916
0x0040b91c
0x0040b924
0x0040b938
0x0040b93e
0x0040b94b
0x0040b96d
0x0040b94d
0x0040b94d
0x0040b952
0x0040b957
0x0040b95a
0x0040b960
0x0040b965
0x0040b965
0x0040b97a
0x0040b983
0x0040b98e
0x0040b994
0x0040b996
0x0040b9a3
0x0040b9c5
0x0040b9a5
0x0040b9a5
0x0040b9aa
0x0040b9af
0x0040b9b2
0x0040b9b8
0x0040b9bd
0x0040b9bd
0x0040b9cc
0x0040b9cc
0x0040b9d6
0x0040b9f2
0x0040b9fc
0x0040ba09
0x0040ba0f
0x0040ba1c
0x0040ba3e
0x0040ba1e
0x0040ba1e
0x0040ba23
0x0040ba28
0x0040ba2b
0x0040ba31
0x0040ba36
0x0040ba36
0x0040ba45
0x0040ba4f
0x0040ba65
0x0040ba78
0x0040ba99
0x0040baa5
0x0040baae
0x0040bab7
0x0040bac3
0x0040bae0
0x0040bac5
0x0040bac5
0x0040baca
0x0040bacf
0x0040bad4
0x0040bad4
0x0040bb04
0x0040bb08
0x0040bb0d
0x0040bb28
0x0040bb2e
0x0040bb30
0x0040bb3d
0x0040bb62
0x0040bb3f
0x0040bb3f
0x0040bb44
0x0040bb49
0x0040bb4f
0x0040bb55
0x0040bb5a
0x0040bb5a
0x0040bb70
0x0040bb8d
0x0040bb72
0x0040bb72
0x0040bb77
0x0040bb7c
0x0040bb81
0x0040bb81
0x0040bbb1
0x0040bbb5
0x0040bbba
0x0040bbd2
0x0040bbd5
0x0040bbd7
0x0040bbe4
0x0040bc06
0x0040bbe6
0x0040bbe6
0x0040bbe8
0x0040bbed
0x0040bbf3
0x0040bbf9
0x0040bbfe
0x0040bbfe
0x0040bc10
0x0040bc16
0x0040bc20
0x0040bc26
0x0040bc38
0x0040bc43
0x0040bc49
0x0040bc79
0x0040bc7f
0x0040bc8c
0x0040bcae
0x0040bc8e
0x0040bc8e
0x0040bc93
0x0040bc98
0x0040bc9b
0x0040bca1
0x0040bca6
0x0040bca6
0x0040bcbb
0x0040bcc1
0x0040bcc9
0x0040bccd
0x0040bcce
0x0040bcd0
0x0040bcde
0x0040bce5
0x0040bce6
0x0040bce8
0x0040bced
0x0040bcf7
0x0040bd14
0x0040bcf9
0x0040bcf9
0x0040bcfe
0x0040bd03
0x0040bd08
0x0040bd08
0x0040bd38
0x0040bd3c
0x0040bd41
0x0040bd59
0x0040bd5f
0x0040bd61
0x0040bd6e
0x0040bd93
0x0040bd70
0x0040bd70
0x0040bd75
0x0040bd7a
0x0040bd80
0x0040bd86
0x0040bd8b
0x0040bd8b
0x0040bda8
0x0040bdb0
0x0040bdba
0x0040bdcc
0x0040bdd7
0x0040bde4
0x0040bdeb
0x0040be10
0x0040be1c
0x0040be22
0x0040be2a
0x0040be2e
0x0040be2f
0x0040be31
0x0040be36
0x0040be3f
0x0040be4b
0x0040be68
0x0040be4d
0x0040be4d
0x0040be52
0x0040be57
0x0040be5c
0x0040be5c
0x0040be82
0x0040be8c
0x0040be90
0x0040be95
0x0040bead
0x0040beb3
0x0040beb5
0x0040bec2
0x0040bee7
0x0040bec4
0x0040bec4
0x0040bec9
0x0040bece
0x0040bed4
0x0040beda
0x0040bedf
0x0040bedf
0x0040bef1
0x0040bef7
0x0040bf01
0x0040bf07
0x0040bf11
0x0040bf1b
0x0040bf3b
0x0040bf4d
0x0040bf53
0x0040bf60
0x0040bf82
0x0040bf62
0x0040bf62
0x0040bf67
0x0040bf6c
0x0040bf6f
0x0040bf75
0x0040bf7a
0x0040bf7a
0x0040bf90
0x0040bf97
0x0040bfa2
0x0040bfaf
0x0040bfb5
0x0040bfc2
0x0040bfe4
0x0040bfc4
0x0040bfc4
0x0040bfc9
0x0040bfce
0x0040bfd1
0x0040bfd7
0x0040bfdc
0x0040bfdc
0x0040bff2
0x0040c00f
0x0040bff4
0x0040bff4
0x0040bff9
0x0040bffe
0x0040c003
0x0040c003
0x0040c033
0x0040c037
0x0040c03c
0x0040c057
0x0040c05a
0x0040c05c
0x0040c069
0x0040c08b
0x0040c06b
0x0040c06b
0x0040c06d
0x0040c072
0x0040c078
0x0040c07e
0x0040c083
0x0040c083
0x0040c099
0x0040c0b6
0x0040c09b
0x0040c09b
0x0040c0a0
0x0040c0a5
0x0040c0aa
0x0040c0aa
0x0040c0d0
0x0040c0da
0x0040c0de
0x0040c0e3
0x0040c0fe
0x0040c104
0x0040c106
0x0040c113
0x0040c138
0x0040c115
0x0040c115
0x0040c11a
0x0040c11f
0x0040c125
0x0040c12b
0x0040c130
0x0040c130
0x0040c146
0x0040c162
0x0040c16d
0x0040c179
0x0040c182
0x0040c18f
0x0040c194
0x0040c19f
0x0040c1a5
0x0040c1b2
0x0040c1d4
0x0040c1b4
0x0040c1b4
0x0040c1b9
0x0040c1be
0x0040c1c1
0x0040c1c7
0x0040c1cc
0x0040c1cc
0x0040c1db
0x0040c1e5
0x0040c1f2
0x0040c1f3
0x0040c1f9
0x0040c1fa
0x0040c204
0x0040c210
0x0040c210
0x0040c206

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040A6A2
#690.MSVBVM60(VAGTPOSTERS,Taylorismens,Forsrget,Vareprves4,?,?,?,?,00401316), ref: 0040A6E5
__vbaNew2.MSVBVM60(00401CC8,00413010,VAGTPOSTERS,Taylorismens,Forsrget,Vareprves4,?,?,?,?,00401316), ref: 0040A6FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040A736
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000140), ref: 0040A783
__vbaFreeObj.MSVBVM60(?,?,000065CE), ref: 0040A7D2
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,000065CE), ref: 0040A7F8
__vbaObjSet.MSVBVM60(?,00000000,?,?,000065CE), ref: 0040A831
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028FC,00000128,?,?,000065CE), ref: 0040A87E
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,000065CE), ref: 0040A8A5
__vbaObjSet.MSVBVM60(?,00000000,?,?,000065CE), ref: 0040A8DE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040290C,00000108,?,?,000065CE), ref: 0040A928
__vbaVarDup.MSVBVM60(?,?,?,?,000065CE), ref: 0040A95C
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,000065CE), ref: 0040A995
__vbaFreeStr.MSVBVM60(?,?,?,?,000065CE), ref: 0040A9B7
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,000065CE), ref: 0040A9C6
__vbaFreeVar.MSVBVM60(?,?,00401316), ref: 0040A9D4
__vbaStrCopy.MSVBVM60(?,?,00401316), ref: 0040A9E1
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,000006F8), ref: 0040AA1F
__vbaFreeStr.MSVBVM60(00000000,00401150,00402670,000006F8), ref: 0040AA36
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040AA4E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AA87
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004028D4,00000068), ref: 0040AACE
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040AAF5
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AB2E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000178), ref: 0040AB7B
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040ABA2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040ABDE
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000138), ref: 0040AC2B
__vbaChkstk.MSVBVM60(?), ref: 0040AC8A
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,000006FC), ref: 0040ACDE
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040AD0C
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,00401316), ref: 0040AD1A
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,?,?,00401316), ref: 0040AD32
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AD6B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402950,00000158), ref: 0040ADB5
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040ADDC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AE18
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040290C,00000170), ref: 0040AE62
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040AE89
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AEC5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000130), ref: 0040AF12
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040AF39
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040AF75
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000198), ref: 0040AFBF
__vbaStrCopy.MSVBVM60(00000000,?,004028D4,00000198), ref: 0040B00C
__vbaStrMove.MSVBVM60(00000000,?,004028D4,00000198), ref: 0040B027
__vbaChkstk.MSVBVM60(?,?,?,00000008,?), ref: 0040B06F
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000700), ref: 0040B0B0
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B0D7
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040B0FA
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040B112
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B12D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B166
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000178), ref: 0040B1B3
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B1DA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B213
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402950,00000098), ref: 0040B260
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B287
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B2C3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402950,00000158), ref: 0040B310
__vbaChkstk.MSVBVM60(2707C260), ref: 0040B379
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040B3BB
__vbaFreeVar.MSVBVM60(?,?,00401CC8,00413010,?,?,?,?,?,?,?,?,?,00401CC8,00413010), ref: 0040B3C9
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000704), ref: 0040B423
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B453
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B48C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004028D4,000000F0), ref: 0040B4D6
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B4FD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B536
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000140), ref: 0040B583
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B5AA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B5E6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028FC,00000088), ref: 0040B633
__vbaStrCopy.MSVBVM60(00000000,?,004028FC,00000088), ref: 0040B669
__vbaFreeStr.MSVBVM60 ref: 0040B6D5
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 0040B6EB
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,00401CC8,00413010), ref: 0040B6F9
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B711
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B74A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402950,00000160), ref: 0040B794
__vbaStrCopy.MSVBVM60(00000000,?,00402950,00000160), ref: 0040B7DF
__vbaChkstk.MSVBVM60(?), ref: 0040B7FA
__vbaFreeStr.MSVBVM60 ref: 0040B831
__vbaFreeObj.MSVBVM60 ref: 0040B839
__vbaFreeVar.MSVBVM60 ref: 0040B844
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040B85C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040B895
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000238), ref: 0040B8DF
__vbaFreeStr.MSVBVM60 ref: 0040B91C
__vbaFreeObj.MSVBVM60 ref: 0040B924
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000708), ref: 0040B960
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402640,000002B4), ref: 0040B9B8
__vbaVarAdd.MSVBVM60(00000009,00000002,?), ref: 0040B9F2
__vbaVarMove.MSVBVM60(00000009,00000002,?), ref: 0040B9FC
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,0000070C), ref: 0040BA31
__vbaVarDup.MSVBVM60(00000000,00401150,00402670,0000070C), ref: 0040BA65
__vbaFreeVar.MSVBVM60(?,?), ref: 0040BAB7
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,00000000,00401150,00402670,0000070C), ref: 0040BACF
__vbaObjSet.MSVBVM60(?,00000000,?,?), ref: 0040BB08
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040290C,00000150,?,?,00000000,00401150,00402670,0000070C), ref: 0040BB55
__vbaNew2.MSVBVM60(00401CC8,00413010,00000000,00000000,0040290C,00000150,?,?,00000000,00401150,00402670,0000070C), ref: 0040BB7C
__vbaObjSet.MSVBVM60(00000000,00000000,?,?), ref: 0040BBB5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040290C,00000050,?,?,00000000,00401150,00402670,0000070C), ref: 0040BBF9
__vbaStrCopy.MSVBVM60(?,?,?,?), ref: 0040BC38
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000714,?,?,00000000,00401150,00402670,0000070C), ref: 0040BCA1
__vbaFreeStr.MSVBVM60(?,?,?,?), ref: 0040BCC1
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,?,?,?,?), ref: 0040BCD0
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0040BCE8
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040BD03
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040BD3C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402950,00000168), ref: 0040BD86
__vbaLateIdCallLd.MSVBVM60(?,00000000,00000000,00000000), ref: 0040BDA8
__vbaStrCopy.MSVBVM60 ref: 0040BDCC
__vbaI4Var.MSVBVM60(?,?), ref: 0040BDEB
__vbaFreeStr.MSVBVM60 ref: 0040BE22
__vbaFreeObjList.MSVBVM60(00000002,?,00000000), ref: 0040BE31
__vbaFreeVar.MSVBVM60(?,?,?,?,?,00401CC8,00413010), ref: 0040BE3F
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,?,00401CC8,00413010), ref: 0040BE57
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040BE90
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,000000A0), ref: 0040BEDA
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000718,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040BF75
__vbaFreeObj.MSVBVM60(?,?,00000008,?), ref: 0040BF97
__vbaFreeVar.MSVBVM60(?,?,00000008,?), ref: 0040BFA2
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,0000071C,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040BFD7
__vbaNew2.MSVBVM60(00401CC8,00413010,00000000,00401150,00402670,0000071C,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040BFFE
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000008,?), ref: 0040C037
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004028D4,00000078,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040C07E
__vbaNew2.MSVBVM60(00401CC8,00413010,00000000,00000000,004028D4,00000078,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040C0A5
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,00000008,?), ref: 0040C0DE
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004028D4,000000E0,?,?,00000008,00413010,00000000,?,004028D4,000000A0), ref: 0040C12B
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,?,?,81B04A80,?,?,?,?,00000008,?), ref: 0040C18F
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00402670,00000720), ref: 0040C1C7
__vbaVarTstLt.MSVBVM60(00008003,?), ref: 0040C1FA

Strings

Afgivnes, xrefs: 0040A96D
GULLION, xrefs: 0040B661
Forsrget, xrefs: 0040A6D6
serviceaftales, xrefs: 0040BC30
Krusedullers, xrefs: 0040B004
Taylorismens, xrefs: 0040A6DB
Wackes, xrefs: 0040A93C
Vareprves4, xrefs: 0040A6D1
VAGTPOSTERS, xrefs: 0040A6E0
MINIMERENDES, xrefs: 0040A9D9
BUBALE, xrefs: 0040B7D7
BAKTERIOLOGERNES, xrefs: 0040BA45
Oaty3, xrefs: 0040BDC4

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$List$ChkstkCopy$Move$#690CallLate
String ID: Afgivnes$BAKTERIOLOGERNES$BUBALE$Forsrget$GULLION$Krusedullers$MINIMERENDES$Oaty3$Taylorismens$VAGTPOSTERS$Vareprves4$Wackes$serviceaftales
API String ID: 709597434-910969321
Opcode ID: 7a94f0f19ee13db17cbb8c7faf44179ae4476b2a4215e826f0146e710e2c5806
Instruction ID: ac437a80c9fa98f97894031e451b5104f75866397bf73d9215cf380e5669c4ee
Opcode Fuzzy Hash: 7a94f0f19ee13db17cbb8c7faf44179ae4476b2a4215e826f0146e710e2c5806
Instruction Fuzzy Hash: 3D030671940229DFDB20DF60CC49BE9BBB4BF08305F1084EAE549BB2A1DB795A84DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004014BC, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 344
COMMON

Download Yara Rule

C-Code - Quality: 87%

			_entry_(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, intOrPtr* __edi, void* __esi, void* __fp0, char _a1, intOrPtr _a53, char _a64, intOrPtr _a78, intOrPtr _a116, intOrPtr _a807141440) {
				intOrPtr _v15;
				char _v24;
				intOrPtr _v27;
				intOrPtr _v31;
				void* _v32;
				signed int _v36;
				intOrPtr _v44;
				void* _v47;
				intOrPtr _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				short _v75;
				signed int _v76;
				char _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr _v1711259612;
				signed int _t372;
				signed int _t373;
				signed char _t374;
				signed int _t375;
				signed int _t376;
				signed char _t377;
				signed char _t378;
				intOrPtr* _t379;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed char _t383;
				signed int _t384;
				intOrPtr* _t385;
				signed char _t387;
				signed int* _t389;
				signed int _t390;
				intOrPtr* _t392;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				signed char _t397;
				signed char _t399;
				intOrPtr* _t400;
				intOrPtr* _t401;
				intOrPtr* _t402;
				intOrPtr* _t403;
				signed char _t405;
				void* _t406;
				signed int* _t407;
				intOrPtr* _t409;
				intOrPtr* _t413;
				intOrPtr* _t414;
				signed int* _t415;
				signed char _t419;
				intOrPtr* _t420;
				void* _t421;
				signed int _t422;
				signed int _t423;
				intOrPtr* _t424;
				signed char _t425;
				signed int _t426;
				intOrPtr* _t428;
				void* _t429;
				intOrPtr* _t430;
				intOrPtr* _t431;
				intOrPtr* _t432;
				intOrPtr* _t433;
				signed int _t434;
				intOrPtr* _t435;
				intOrPtr* _t436;
				intOrPtr* _t437;
				signed int* _t438;
				signed int _t439;
				void* _t440;
				intOrPtr* _t441;
				intOrPtr* _t443;
				signed int* _t444;
				signed char _t447;
				signed char _t450;
				signed int _t454;
				signed char _t460;
				signed char _t462;
				signed char _t465;
				intOrPtr* _t467;
				signed int _t469;
				intOrPtr* _t470;
				intOrPtr* _t472;
				intOrPtr* _t474;
				intOrPtr* _t476;
				intOrPtr* _t478;
				intOrPtr* _t480;
				intOrPtr* _t483;
				char* _t485;
				signed int _t487;
				char* _t491;
				signed int _t497;
				signed int _t503;
				signed char _t506;
				intOrPtr* _t509;
				signed int _t510;
				intOrPtr* _t514;
				intOrPtr* _t515;
				signed int _t517;
				signed int _t518;
				intOrPtr* _t520;
				void* _t521;
				signed char _t523;
				signed int _t524;
				intOrPtr* _t526;
				void* _t527;
				intOrPtr* _t528;
				intOrPtr* _t529;
				signed int _t530;
				signed int _t533;
				signed int _t534;
				void* _t535;
				intOrPtr* _t536;
				void* _t537;
				signed int* _t539;
				void* _t540;
				void* _t541;
				void* _t542;
				signed char _t548;
				intOrPtr* _t549;
				void* _t550;
				signed int* _t554;
				void* _t558;
				signed int _t561;
				signed char* _t564;
				signed int _t570;
				char* _t572;
				signed int _t575;
				void* _t576;
				signed int _t578;
				void* _t579;
				intOrPtr _t581;
				signed int _t582;
				signed int _t586;
				signed int _t590;
				signed int _t591;
				signed int _t603;
				signed char _t617;
				intOrPtr* _t620;

				_t553 = __edi;
				_t547 = __edx;
				_t525 = __ebx;
				_push("VB5!6&*"); // executed
				L004014B4(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t372 = __eax + 1;
				 *_t372 =  *_t372 + _t372;
				 *_t372 =  *_t372 + _t372;
				 *_t372 =  *_t372 + _t372;
				 *((intOrPtr*)(__edi + 0x56ad29b0)) =  *((intOrPtr*)(__edi + 0x56ad29b0)) + __ecx;
				_t533 = __ecx &  *(__edi - 0x5d);
				_t558 = __esi - 1;
				_t373 = _t372 | 0x997b82a2;
				asm("rol byte [eax], 1");
				 *_t373 =  *_t373 + _t373;
				 *_t373 =  *_t373 + _t373;
				 *_t533 =  *_t533 + _t373;
				 *_t373 =  *_t373 + _t373;
				 *_t373 =  *_t373 + _t373;
				 *_t373 =  *_t373 & _t373;
				_push(__edi);
				_t575 =  *(_t373 + 0x61 + _t533 * 2) * 0x62656e76;
				asm("popad");
				if(_t575 < 0) {
					 *_t373 =  *_t373 + _t373;
					 *_t373 =  *_t373 + _t373;
					_t582 = _t575 - 1;
					 *_t373 =  *_t373 ^ _t373;
					_t530 = __ebx | _t582;
					asm("daa");
					_t547 = __edx &  *(_t558 + 0x65) * 0x20007374 |  *0x8092e160;
					asm("fcom dword [ecx+0x7b]");
					asm("loope 0x49");
					 *((char*)(_t558 - 0x5f)) =  *((char*)(_t558 - 0x5f)) - 1;
					asm("movsb");
					asm("loope 0x28");
					_t575 = _t582 - 1;
					_t586 =  *_t547 & _t530;
					_t553 = __edi - 1;
					asm("lodsd");
					_t523 = _t373 | 0x00000005;
					asm("stosb");
					 *((intOrPtr*)(_t523 - 0x2d)) =  *((intOrPtr*)(_t523 - 0x2d)) + _t523;
					_t524 = _t530 ^  *(_t533 - 0x48ee309a);
					_t525 = _t523;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					 *_t524 =  *_t524 + _t524;
					_pop(ds);
					_t373 = _t524 +  *_t524;
					 *_t525 =  *_t525 + _t373;
					 *_t373 =  *_t373 + _t373;
					 *_t553 =  *_t553 + _t373;
					 *((intOrPtr*)(_t525 + 0x79)) =  *((intOrPtr*)(_t525 + 0x79)) + _t547;
					asm("arpl [edi+0x6e], bp");
				}
				asm("outsb");
				if (_t586 >= 0) goto L3;
				_t374 = _t373 | 0x4c000701;
				_t534 = _t533 - 1;
				_t576 = _t575 + 1;
				 *_t534 =  *_t534 + _t525;
				 *_t374 =  *_t374 + _t374;
				_t548 = _t547 + 1;
				 *_t548 =  *_t548 + _t374;
				 *((intOrPtr*)(_t553 + _t374)) =  *((intOrPtr*)(_t553 + _t374)) + _t576;
				 *((intOrPtr*)(_t534 + 0x4e + _t534 * 2)) =  *((intOrPtr*)(_t534 + 0x4e + _t534 * 2)) + _t534;
				_t561 = _t558 - 0xffffffffffffffff;
				 *0x1124 =  *0x1124 + _t548;
				asm("out dx, eax");
				_pop(ss);
				 *_t374 =  *_t374 + _t374;
				_pop(_t570);
				asm("adc [eax], al");
				 *((intOrPtr*)(_t548 + 0x16)) =  *((intOrPtr*)(_t548 + 0x16)) + _t525;
				 *_t374 =  *_t374 + _t374;
				_t578 = _t576 + 2;
				 *(_t561 + 3) =  *(_t561 + 3) + _t374;
				 *_t534 =  *_t534 + 1;
				 *[cs:eax] =  *[cs:eax] + _t374;
				 *_t534 =  *_t534 + _t374;
				_push(es);
				 *((intOrPtr*)(_t525 + 0x68)) =  *((intOrPtr*)(_t525 + 0x68)) + _t374;
				asm("arpl [gs:ebx+0x33], bp");
				 *0x50000e01 =  *0x50000e01 + _t374;
				asm("popad");
				if( *0x50000e01 < 0) {
					L10:
					if(_t590 < 0) {
						goto L17;
					} else {
						 *[ss:0x7450183] =  *[ss:0x7450183] + _t374;
						_push(es);
						_t525 = _t525 + _t525;
						_t570 = _t570 +  *_t534;
						 *_t374 =  *_t374 + _t374;
						 *((intOrPtr*)(_t374 + _t534)) =  *((intOrPtr*)(_t374 + _t534)) + _t374;
						 *((intOrPtr*)(_t525 + 0x6f)) =  *((intOrPtr*)(_t525 + 0x6f)) + _t374;
						asm("insd");
						asm("insd");
						asm("popad");
						asm("outsb");
						_t517 = (_t374 ^  *[fs:eax]) + 1;
						_pop(es);
						 *((intOrPtr*)(_t525 + 0x6c)) =  *((intOrPtr*)(_t525 + 0x6c)) + _t517;
						asm("arpl [gs:eax+0x39], bp");
						 *((intOrPtr*)(_t578 + _t534 * 4)) =  *((intOrPtr*)(_t578 + _t534 * 4)) + _t517;
						_t578 = _t578 + 0x1201ef04;
						_push(es);
						_t553 = 0x1101ef04;
						_t518 = _t517;
						 *_t525 =  *_t525 + 1;
						asm("das");
						 *_t518 =  *_t518 + _t518;
						 *0x6f430008 =  *0x6f430008 + _t518;
						asm("insd");
						asm("insd");
						asm("popad");
						asm("outsb");
						 *[fs:eax] =  *[fs:eax] ^ _t518;
						_t510 = _t518 + 0x00000001 | 0x63654400;
						_t591 = _t510;
						_push(0x65726669);
						if(_t591 < 0) {
							goto L23;
						} else {
							asm("popad");
							if(_t591 < 0) {
								goto L19;
							} else {
								 *((intOrPtr*)(_t510 + 0x4407bc10)) =  *((intOrPtr*)(_t510 + 0x4407bc10)) + _t510;
								goto L14;
							}
						}
					}
				} else {
					_t578 =  *(_t534 + 0x6d) * 0x65746e65;
					if(_t578 >= 0) {
						 *0x6120484 =  *0x6120484 + _t374;
						_t553 = 0x1201ef04;
						 *_t374 =  *_t374 | _t374;
						 *_t525 =  *_t525 + 1;
						_t520 = _t374 -  *_t374;
						 *_t520 =  *_t520 + _t520;
						_t521 = _t520 +  *_t561;
						 *((intOrPtr*)(_t525 + 0x68)) =  *((intOrPtr*)(_t525 + 0x68)) + _t521;
						asm("arpl [gs:ebx+0x32], bp");
						 *0x63000b01 =  *0x63000b01 + _t521;
						_push(0x68637275);
						_t570 =  *(_t561 + 0x65) * 0x5007373;
						_t374 = _t521 + 0xef;
						 *_t548 =  *_t548 + _t548;
						es = 0xbf036e01;
					}
					_t525 = _t525 + _t525;
					_t553 = _t553 +  *_t525;
					 *_t374 =  *_t374 + _t374;
					 *_t525 =  *_t525 + _t374;
					_push(es);
					 *((intOrPtr*)(_t525 + 0x68)) =  *((intOrPtr*)(_t525 + 0x68)) + _t374;
					asm("arpl [gs:ebx+0x31], bp");
					 *0x52001b01 =  *0x52001b01 + _t374;
					asm("popad");
					asm("popad");
					_t561 =  *[fs:bp+0x6e] * 0x73676e69;
					_t590 = _t561;
					if(_t590 <= 0) {
						L14:
						_t374 = 0xbf032106;
						goto L15;
					} else {
						if(_t590 < 0) {
							L15:
							_t553 = 0x1101ef04;
							_t374 = _t374 +  *_t374;
							goto L16;
						} else {
							if(_t590 >= 0) {
								L16:
								_t525 = _t525 + _t525;
								_t578 = _t578 +  *_t561;
								 *_t374 =  *_t374 + _t374;
								L17:
								 *_t561 =  *_t561 + _t374;
								_t375 = 0x78655400 + _t374;
								if(_t375 == 0) {
									L21:
									_pop(es);
									_t62 = _t553 + 0x72;
									 *_t62 =  *((intOrPtr*)(_t553 + 0x72)) + _t534;
									asm("fs insb");
									if( *_t62 >= 0) {
										goto L31;
									} else {
										 *[gs:edx] =  *[gs:edx] + _t548;
										 *_t375 =  *_t375 + _t375;
										 *_t525 =  *_t525 + 1;
										_t510 = _t375 ^  *_t375;
										L23:
										 *_t510 =  *_t510 + _t510;
										 *0x78655400 =  *0x78655400 | _t510;
										if( *0x78655400 == 0) {
											goto L29;
										} else {
											 *_t548 =  *_t548 + _t510;
											_t377 = _t510 + 0x4bf01d8;
											asm("out dx, eax");
											 *_t525 =  *_t525 + _t534;
											goto L25;
										}
									}
								} else {
									 *_t548 =  *_t548 + _t375;
									_t514 = _t375 + 0x28;
									_t548 = _t548;
									_t525 = _t525 +  *((intOrPtr*)(_t553 + 0xb01ef04));
									_pop(es);
									_a78 = _a78 + _t514;
									_push(_t578);
									_push(_t548);
									_t553 = _t553 - 1;
									_push(_t514);
									_t534 = _t534 - 1;
									 *_t548 =  *_t548 + _t548;
									_t515 = _t514 +  *_t514;
									 *_t525 =  *_t525 + 1;
									 *[es:eax] =  *[es:eax] + _t515;
									L19:
									 *_t515 =  *_t515 + _t515;
									_pop(es);
									_t377 = _t515 + 0x78655400;
									if(_t377 == 0) {
										L25:
										_t548 = _t548 |  *(_t377 + _t377);
										_t534 = _t534 + 1;
										asm("outsb");
										asm("gs outsb");
										_t570 =  *(_t534 + 0x73) * 0x73;
										_t603 = _t570;
										if(_t603 >= 0) {
											L35:
											_t525 = _t525 + _t525;
											_t509 = _t377 +  *_t377 +  *((intOrPtr*)(_t561 + _t377 +  *_t377));
											goto L36;
										} else {
											if(_t603 != 0) {
												L36:
												 *_t509 =  *_t509 + _t509;
												 *((intOrPtr*)(_t509 + 0x2b)) =  *((intOrPtr*)(_t509 + 0x2b)) + _t509;
												_t376 = _t509 + 1;
												goto L37;
											} else {
												asm("gs outsb");
												if(_t603 >= 0) {
													L32:
													_push(es);
													_t69 = _t534 + 0x6d + _t570 * 2;
													 *_t69 =  *((intOrPtr*)(_t534 + 0x6d + _t570 * 2)) + _t548;
													if( *_t69 < 0) {
														L37:
														 *((intOrPtr*)(_t561 + 0x42)) =  *((intOrPtr*)(_t561 + 0x42)) + _t548;
														_t377 = _t376 ^ 0x2a263621;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														goto L38;
													} else {
														 *_t525 =  *_t525 + _t534;
														_pop(es);
														_t377 = _t376 + 5;
														 *_t377 =  *_t377 + _t377;
														 *(_t534 - 0xfffffc) =  *(_t534 - 0xfffffc) | _t548;
														_t525 = _t525 +  *_t548;
														 *_t377 =  *_t377 + _t377;
														 *_t525 =  *_t525 + _t534;
														_push(es);
														_t77 = _t534 + 0x6d + _t570 * 2;
														 *_t77 =  *((intOrPtr*)(_t534 + 0x6d + _t570 * 2)) + _t548;
														if( *_t77 >= 0) {
															 *_t525 =  *_t525 + _t534;
															_pop(es);
															asm("std");
															_pop(es);
															 *_t377 =  *_t377 + _t377;
															 *(_t561 + 3) =  *(_t561 + 3) | _t548;
															goto L35;
														}
													}
												} else {
													 *_t548 =  *_t548 + _t548;
													 *_t377 =  *_t377 + _t377;
													 *_t525 =  *_t525 + 1;
													_t510 = _t377;
													 *_t510 =  *_t510 + _t510;
													 *_t561 =  *_t561 | _t510;
													 *((intOrPtr*)(_t561 + 0x72)) =  *((intOrPtr*)(_t561 + 0x72)) + _t510;
													L29:
													asm("popad");
													asm("insd");
													 *[gs:eax] =  *[gs:eax] ^ _t510;
													_t377 = _t510 +  *_t534;
													_push(_t578);
													if(_t377 < 0) {
														L38:
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														if ( *_t377 <= 0) goto L39;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
														 *_t377 =  *_t377 + _t377;
													} else {
														_t570 =  *(_t534 + 0x6e) * 0x67;
														asm("gs outsb");
														_t375 = (_t377 ^ 0x00000000) + 0x243032e;
														asm("daa");
														asm("adc eax, 0x5120ad7");
														L31:
														_t376 = _t375 + 0x1a03ff00;
														 *_t376 =  *_t376 + _t376;
														 *_t548 =  *_t548 + _t534;
														goto L32;
													}
												}
											}
										}
									} else {
										 *_t548 =  *_t548 + _t377;
										_t375 = _t377 + 0xd8;
										 *((intOrPtr*)(_t561 + 1)) =  *((intOrPtr*)(_t561 + 1)) + _t548;
										_t553 = 0xb01ef04;
										goto L21;
									}
								}
							} else {
								asm("insd");
								_push(0x72656465);
								goto L10;
							}
						}
					}
				}
				 *_t377 =  *_t377 + _t377;
				 *_t377 =  *_t377 + _t377;
				 *_t377 =  *_t377 + _t377;
				 *_t548 =  *_t548 + _t534;
				 *_t534 =  *_t534 + _t534;
				_t378 = _t377;
				 *_t378 =  *_t378 + _t378;
				 *_t378 =  *_t378 + _t378;
				 *_t378 =  *_t378 + _t378;
				 *_t378 =  *_t378 + _t378;
				 *((intOrPtr*)(_t548 + _t525 - 0x7c3ffc0)) =  *((intOrPtr*)(_t548 + _t525 - 0x7c3ffc0)) + _t534;
				 *_t378 =  *_t378 ^ _t378;
				_t526 = _t525 + _t525;
				asm("invalid");
				 *_t378 =  *_t378 | _t378;
				 *_t378 =  *_t378 + _t378;
				 *_t378 =  *_t378 + _t378;
				 *_t378 =  *_t378 + _t378;
				_t379 = _t378 +  *_t378;
				 *_t379 =  *_t379 + _t379;
				goto 0x2c4017d9;
				asm("sbb [eax], al");
				_t381 = _t379 + 1 + _t534;
				asm("adc al, 0x40");
				 *_t381 =  *_t381 + _t526;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381;
				 *((intOrPtr*)(_t561 - 0x71000000)) =  *((intOrPtr*)(_t561 - 0x71000000)) + _t534;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *_t381 =  *_t381 + _t381;
				 *((intOrPtr*)(_t534 + 0x74 + _t570 * 2)) =  *((intOrPtr*)(_t534 + 0x74 + _t570 * 2)) + _t381;
				 *((intOrPtr*)(_t553 + 0x50)) =  *((intOrPtr*)(_t553 + 0x50)) + _t534;
				_t382 = _t381 - 1;
				_t549 = _t548 - 1;
				_t535 = _t534 - 1;
				_t554 = _t553 + 1;
				_t572 =  &_a1;
				_t564 = _t561 - 0xffffffffffffffff;
				 *_t382 =  *_t382 + _t382;
				_t383 = _t382 - 1;
				_t617 = _t383;
				asm("popad");
				if(_t617 <= 0) {
					L47:
					if (_t620 > 0) goto L50;
					goto L48;
				} else {
					asm("bound esp, [gs:ecx+0x73]");
					if(_t617 >= 0) {
						L48:
						_t535 = _t535 + _t549;
					} else {
						asm("outsb");
						if(_t617 != 0) {
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t549;
							 *_t383 =  *_t383 + _t383;
							_t578 = _t578 - 1;
							 *(_t549 + _t535) =  *(_t549 + _t535) ^ 0x92e16035;
							 *_t383 =  *_t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							 *_t383 =  *_t383 + _t383;
							_t506 = _t383;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							if( *_t506 >= 0) {
								 *_t506 =  *_t506 + _t506;
							}
							 *_t506 =  *_t506 + _t506;
							 *_t506 =  *_t506 + _t506;
							_t383 = (_t506 | 0x00000015) + 1;
							 *((intOrPtr*)(_t383 + _t383)) =  *((intOrPtr*)(_t383 + _t383)) + _t535;
							 *_t383 =  *_t383 + _t549;
							 *_t383 =  *_t383 + _t383;
							 *0xb83c7a1c =  *0xb83c7a1c | _t383;
							asm("daa");
							_t526 = _t526 + 1;
							_t620 = _t526;
							_t549 = 0xdf8d30d;
							goto L47;
						}
					}
				}
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				_a116 = _a116 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				 *_t383 =  *_t383 + _t383;
				_t384 = _t383 - 0x9c0040;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *0x40 =  *0x40 | _t384;
				 *_t384 =  *_t384 + _t384;
				 *(_t384 + _t384 * 2 - 0x100) =  *(_t384 + _t384 * 2 - 0x100) | _t384;
				 *_t384 =  *_t384 + 1;
				 *_t384 =  *_t384 + _t384;
				_a807141440 = _a807141440 + _t535;
				_t536 = _t535 + 1;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t384 + 1)) =  *((intOrPtr*)(_t384 + 1)) + _t384;
				_push(0);
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t536 + _t526 + 0x40)) =  *((intOrPtr*)(_t536 + _t526 + 0x40)) + _t384;
				 *_t536 =  *_t536 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t572 +  &_a64)) =  *((intOrPtr*)(_t572 +  &_a64)) + _t536;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t536 + _t526 + 0x40)) =  *((intOrPtr*)(_t536 + _t526 + 0x40)) + _t384;
				 *_t536 =  *_t536 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t536 + _t526 + 0x40)) =  *((intOrPtr*)(_t536 + _t526 + 0x40)) + _t536;
				 *_t384 =  *_t384 + _t384;
				 *_t384 =  *_t384 + _t384;
				 *((intOrPtr*)(_t384 + 0x19)) =  *((intOrPtr*)(_t384 + 0x19)) + _t536;
				_t385 = _t384 + 1;
				 *_t549 =  *_t549 + _t385;
				 *_t385 =  *_t385 + _t385;
				 *((intOrPtr*)(_t536 + _t526 + 0x40)) =  *((intOrPtr*)(_t536 + _t526 + 0x40)) + _t536;
				 *_t385 =  *_t385 + _t385;
				_t554[0x1b001a00] = _t554[0x1b001a00] + _t549;
				 *((intOrPtr*)(_t536 + _t526 + 0x33580040)) =  *((intOrPtr*)(_t536 + _t526 + 0x33580040)) + _t526;
				_t537 = _t536 + 1;
				 *_t385 =  *_t385 + _t385;
				 *_t385 =  *_t385 + _t385;
				_t387 = _t385 + _t385;
				asm("insb");
				 *((intOrPtr*)(_t572 +  &_a64)) =  *((intOrPtr*)(_t572 +  &_a64)) + _t526;
				 *((intOrPtr*)(_t572 +  &_a64)) =  *((intOrPtr*)(_t572 +  &_a64)) + _t537;
				 *_t387 =  *_t387 + _t387;
				asm("adc [eax], eax");
				 *(_t387 ^ 0x00000000) =  *(_t387 ^ 0x00000000) + (_t387 ^ 0x00000000);
				_t389 =  *0x1004027;
				 *_t526 =  *_t526 + _t389;
				 *_t389 = _t389 +  *_t389;
				 *_t389 = _t389 +  *_t389;
				 *_t389 = _t389 +  *_t389;
				 *_t389 = _t389 +  *_t389;
				 *((intOrPtr*)(_t537 + _t526 - 0x544fffc0)) =  *((intOrPtr*)(_t537 + _t526 - 0x544fffc0)) + _t526;
				_t390 =  *_t389 * 0x402d7c;
				 *_t390 =  *_t390 + _t390;
				_t392 = _t390 +  *_t390 + 1;
				 *_t554 =  *_t554 + _t526;
				 *_t392 =  *_t392 + _t526;
				 *_t392 =  *_t392 + _t392;
				 *((intOrPtr*)(_t392 - 0xffbfda)) =  *((intOrPtr*)(_t392 - 0xffbfda)) + _t392;
				asm("invalid");
				 *_t392 =  *_t392 + 1;
				 *_t392 =  *_t392 + _t392;
				 *_t392 =  *_t392 + _t392;
				 *_t392 =  *_t392 + _t392;
				asm("sbb [eax], eax");
				asm("pushad");
				asm("stosd");
				_t394 =  *(_t392 + _t526) * 0x402690;
				asm("invalid");
				asm("invalid");
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				_t579 = _t578 - 1;
				asm("sbb [eax], eax");
				asm("int3");
				asm("sbb [eax], al");
				 *0xa8004014 = _t394;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t537;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *_t394 =  *_t394 + _t394;
				 *((intOrPtr*)(_t537 + _t526 + 0x40)) =  *((intOrPtr*)(_t537 + _t526 + 0x40)) + _t549;
				_t395 = _t394 + _t537;
				asm("sbb [eax], al");
				 *0xa8004014 = _t395;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t537;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				 *_t395 =  *_t395 + _t395;
				_t396 = _t395 + _t549;
				 *_t396 =  *_t396 + _t396;
				 *_t396 =  *_t396 + _t537;
				_t397 = _t396 & 0x00000040;
				 *_t397 =  *_t397 + _t397;
				_t564[0x25500040] = _t564[0x25500040] & 0x00000041;
				 *((intOrPtr*)(_t537 + _t549 + 0x30080000)) =  *((intOrPtr*)(_t537 + _t549 + 0x30080000)) + _t549;
				 *_t564 =  *_t564 + _t549;
				asm("adc eax, [eax]");
				 *_t397 =  *_t397 + _t549;
				_t539 = _t537 + 2;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *((intOrPtr*)(_t554 + _t549 + 0x10040)) =  *((intOrPtr*)(_t554 + _t549 + 0x10040)) + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *_t397 =  *_t397 + _t397;
				 *0x40 =  *0x40 | _t397;
				 *_t397 =  *_t397 + _t397;
				asm("movsb");
				_t399 = _t397 - 1 + 1;
				_t527 = _t526 + _t526;
				asm("invalid");
				 *_t399 =  *_t399 + 1;
				 *_t399 =  *_t399 + _t399;
				_a64 = _a64 + _t527;
				 *_t399 =  *_t399 + _t539;
				 *_t539 =  *_t539 ^ _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t527;
				asm("insb");
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *_t399 =  *_t399 + _t399;
				 *((intOrPtr*)(_t399 + 0x1d)) =  *((intOrPtr*)(_t399 + 0x1d)) + _t399;
				_t400 = _t399 + 1;
				 *_t539 =  *_t539 + _t400;
				 *_t400 =  *_t400 + _t400;
				 *((intOrPtr*)(_t400 + 0x26)) =  *((intOrPtr*)(_t400 + 0x26)) + _t549;
				_t401 = _t400 + 1;
				 *_t401 =  *_t401 + _t401;
				 *_t401 =  *_t401 + _t401;
				 *((intOrPtr*)(_t401 + 0x1d)) =  *((intOrPtr*)(_t401 + 0x1d)) + _t401;
				_t402 = _t401 + 1;
				 *_t539 =  *_t539 + _t402;
				 *_t402 =  *_t402 + _t402;
				 *((intOrPtr*)(_t402 + 0x1d)) =  *((intOrPtr*)(_t402 + 0x1d)) + _t539;
				_t403 = _t402 + 1;
				 *_t403 =  *_t403 + _t403;
				 *_t403 =  *_t403 + _t403;
				 *((intOrPtr*)(_t572 + _t527 + 0x40)) =  *((intOrPtr*)(_t572 + _t527 + 0x40)) + _t403;
				 *((intOrPtr*)(_t403 + _t403)) =  *((intOrPtr*)(_t403 + _t403)) + _t539;
				 *_t403 =  *_t403 + _t403;
				asm("sbb eax, 0x170040");
				_t528 = 1;
				ds = 0x28006c00;
				_t405 = _t403 - 1 + 1;
				 *((intOrPtr*)(_t549 +  &(_t554[0x10]))) =  *((intOrPtr*)(_t549 +  &(_t554[0x10]))) + 1;
				 *_t405 =  *_t405 + _t405;
				do {
					 *_t405 =  *_t405 + _t405;
					_t554[0x998001a] = _t554[0x998001a] + _t405;
					_t406 = _t405 + 1;
					 *((intOrPtr*)(_t406 + 0x26)) =  *((intOrPtr*)(_t406 + 0x26)) + _t549;
					_t407 = _t406 + 1;
					 *_t407 = _t407 +  *_t407;
					_pop(ds);
					 *((intOrPtr*)(_t407 + _t407)) =  *((intOrPtr*)(_t407 + _t407)) + _t549;
					 *_t407 = _t407 +  *_t407;
					 *_t564 =  *_t564 & 0x00000040;
					_t528 = _t528 + _t528;
					asm("invalid");
					 *_t407 =  *_t407 + 1;
					 *_t407 = _t407 +  *_t407;
					 *_t407 = _t407 +  *_t407;
					 *_t407 = _t407 +  *_t407;
					 *((intOrPtr*)(_t554 + _t528 - 0x549fffc0)) =  *((intOrPtr*)(_t554 + _t528 - 0x549fffc0)) + _t407;
					asm("invalid");
					asm("invalid");
					_t409 = 1 +  *_t407 * 0x402690;
					 *_t539 =  *_t539 + _t409;
					 *_t409 =  *_t409 + _t528;
					 *_t409 =  *_t409 + _t409;
					 *_t409 =  *_t409 + _t549;
					asm("daa");
					_t405 = _t409 + 1;
					 *_t549 =  *_t549 + _t539;
					 *_t528 =  *_t528 + _t405;
					 *_t405 =  *_t405 + _t405;
					 *_t405 =  *_t405 + _t405;
					 *_t405 =  *_t405 + _t405;
					 *_t405 =  *_t405 + _t405;
					 *_t405 =  *_t405 + _t528;
					 *_t405 =  *_t405 & _t405;
				} while ( *_t405 < 0);
				_t413 = ( *_t405 * "Timer1" |  *( *_t405 * "Timer1")) +  *( *_t405 * "Timer1" |  *( *_t405 * "Timer1")) + 1;
				 *_t539 =  *_t539 + _t413;
				 *((intOrPtr*)(_t413 + _t413)) =  *((intOrPtr*)(_t413 + _t413)) + _t528;
				 *_t413 =  *_t413 + _t413;
				asm("adc [edi], ah");
				_t414 = _t413 + 1;
				 *_t528 =  *_t528 + _t539;
				 *_t528 =  *_t528 + _t414;
				 *_t414 =  *_t414 + _t414;
				 *_t414 =  *_t414 + _t414;
				 *_t414 =  *_t414 + _t414;
				 *_t414 =  *_t414 + _t414;
				 *_t414 =  *_t414 + _t549;
				_t415 = _t414 + 1;
				 *((intOrPtr*)(_t415 - 0x55)) =  *((intOrPtr*)(_t415 - 0x55)) + _t549;
				_t419 = ( *_t415 * "Timer2" |  *( *_t415 * "Timer2")) +  *( *_t415 * "Timer2" |  *( *_t415 * "Timer2")) + 1;
				 *_t419 =  *_t419 + _t528;
				 *_t419 =  *_t419 + _t419;
				 *_t419 =  *_t419 + _t419;
				 *_t554 =  *_t554 ^ _t419;
				_t420 = _t419 + 1;
				 *_t554 =  *_t554 + _t420;
				 *_t528 =  *_t528 + _t420;
				 *_t420 =  *_t420 + _t420;
				 *_t420 =  *_t420 + _t420;
				 *_t420 =  *_t420 + _t420;
				 *_t420 =  *_t420 + _t420;
				 *((intOrPtr*)(_t420 + 0x20)) =  *((intOrPtr*)(_t420 + 0x20)) + _t549;
				_t421 = _t420 + 1;
				 *((intOrPtr*)(_t421 + 0x400069ab)) =  *((intOrPtr*)(_t421 + 0x400069ab)) + _t421;
				asm("daa");
				_t422 = _t421 + 1;
				 *_t554 =  *_t554 + _t422;
				 *_t528 =  *_t528 + _t422;
				 *_t422 =  *_t422 + _t422;
				_t423 = _t422 | 0x00004400;
				 *((intOrPtr*)(_t423 + 0x27)) =  *((intOrPtr*)(_t423 + 0x27)) + _t539;
				_t424 = _t423 + 1;
				 *_t539 = _t539 +  *_t539;
				 *_t528 =  *_t528 + _t424;
				 *_t424 =  *_t424 + _t424;
				 *_t424 =  *_t424 + _t424;
				 *_t424 =  *_t424 + _t424;
				 *_t424 =  *_t424 + _t424;
				_t425 = _t424 + _t539;
				 *_t425 =  *_t425 & _t425;
				asm("stosd");
				_t426 =  *_t425 * "Frame1";
				 *_t426 =  *_t426 | _t426;
				_t428 = _t426 +  *_t426 + 1;
				 *_t549 =  *_t549 + _t549;
				 *_t428 =  *_t428 + _t539;
				 *_t428 =  *_t428 + _t428;
				_push(0x3004027);
				 *_t528 =  *_t528 + _t428;
				 *_t428 =  *_t428 + _t428;
				 *_t428 =  *_t428 + _t428;
				 *_t428 =  *_t428 + _t428;
				 *_t428 =  *_t428 + _t428;
				 *_t539 =  *_t539 + _t549;
				_t429 = _t428 + 1;
				 *((intOrPtr*)(_t429 + 0x780069ab)) =  *((intOrPtr*)(_t429 + 0x780069ab)) + _t429;
				asm("daa");
				_t430 = _t429 + 1;
				 *_t528 =  *_t528 + _t430;
				 *_t528 =  *_t528 + _t430;
				 *_t430 =  *_t430 + _t430;
				asm("adc al, [eax]");
				 *_t430 =  *_t430 + _t430;
				 *((intOrPtr*)(_t430 + 0x27)) =  *((intOrPtr*)(_t430 + 0x27)) + _t539;
				_t431 = _t430 + 1;
				 *_t549 =  *_t549 + _t431;
				 *_t528 =  *_t528 + _t431;
				 *_t431 =  *_t431 + _t431;
				 *_t431 =  *_t431 + _t431;
				 *_t431 =  *_t431 + _t431;
				 *_t431 =  *_t431 + _t431;
				_t539[0x10] = _t539[0x10] + _t549;
				 *((intOrPtr*)(_t431 - 0x7fff9655)) =  *((intOrPtr*)(_t431 - 0x7fff9655)) + _t431;
				asm("daa");
				_t432 = _t431 + 1;
				 *_t549 =  *_t549 + _t432;
				 *_t528 =  *_t528 + _t432;
				 *_t432 =  *_t432 + _t432;
				asm("sbb [eax], al");
				_push(_t432);
				 *_t432 =  *_t432 + _t432;
				 *_t432 =  *_t432 + _t549;
				asm("daa");
				_t433 = _t432 + 1;
				 *_t433 =  *_t433 + _t539;
				 *_t528 =  *_t528 + _t433;
				 *_t433 =  *_t433 + _t433;
				 *_t433 =  *_t433 + _t433;
				 *_t433 =  *_t433 + _t433;
				 *_t433 =  *_t433 + _t433;
				_t434 = _t433 + _t549;
				 *_t434 =  *_t434 & _t434;
				 *((char*)(_t528 + 0x27880069)) =  *((char*)(_t528 + 0x27880069)) - 0x40;
				 *_t434 = _t539 +  *_t434;
				 *_t528 =  *_t528 + _t434;
				 *_t434 =  *_t434 + _t434;
				asm("adc al, [eax]");
				_push(_t579 - 1);
				 *_t434 =  *_t434 + _t434;
				 *((intOrPtr*)(_t434 + 0x27)) =  *((intOrPtr*)(_t434 + 0x27)) + _t539;
				_t435 = _t434 + 1;
				 *_t539 =  *_t539 + _t435;
				 *_t528 =  *_t528 + _t435;
				 *_t435 =  *_t435 + _t435;
				 *_t435 =  *_t435 + _t435;
				 *_t435 =  *_t435 + _t435;
				 *_t435 =  *_t435 + _t435;
				 *((intOrPtr*)(_t549 + 0x40)) =  *((intOrPtr*)(_t549 + 0x40)) + _t539;
				 *((intOrPtr*)(_t435 - 0x6fff9655)) =  *((intOrPtr*)(_t435 - 0x6fff9655)) + _t435;
				asm("daa");
				_t436 = _t435 + 1;
				 *_t539 =  *_t539 + _t436;
				 *_t528 =  *_t528 + _t436;
				 *_t436 =  *_t436 + _t436;
				asm("sbb [eax], al");
				_pop(_t437);
				 *_t437 =  *_t437 + _t437;
				 *_t437 =  *_t437 + _t549;
				asm("daa");
				_t438 = _t437 + 1;
				 *_t564 = _t438 +  *_t564;
				 *_t528 =  *_t528 + _t438;
				 *_t438 = _t438 +  *_t438;
				 *_t438 = _t438 +  *_t438;
				 *_t438 = _t438 +  *_t438;
				 *_t438 = _t438 +  *_t438;
				 *((intOrPtr*)(_t549 - 0x547fffc0)) =  *((intOrPtr*)(_t549 - 0x547fffc0)) + _t539;
				_t439 =  *_t438 * "Text3";
				 *_t528 =  *_t528 + _t439;
				 *_t439 =  *_t439 + _t439;
				asm("adc [eax], eax");
				_t581 = es;
				 *_t439 =  *_t439 + _t439;
				 *((intOrPtr*)(_t439 + 0x4004027)) =  *((intOrPtr*)(_t439 + 0x4004027)) + _t439;
				 *_t528 =  *_t528 + _t439;
				 *_t439 =  *_t439 + _t439;
				 *_t439 =  *_t439 + _t439;
				 *_t439 =  *_t439 + _t439;
				 *_t439 =  *_t439 + _t439;
				 *_t528 =  *_t528 + _t439;
				_t440 = _t439 + 1;
				 *((intOrPtr*)(_t440 - 0x4fff9655)) =  *((intOrPtr*)(_t440 - 0x4fff9655)) + _t549;
				asm("daa");
				_t441 = _t440 + 1;
				 *((intOrPtr*)(_t441 + _t441)) =  *((intOrPtr*)(_t441 + _t441)) + _t441;
				_t443 = _t441 +  *_t441 + 1;
				 *_t539 =  *_t539 + _t549;
				 *_t443 =  *_t443 + _t443;
				 *_t443 =  *_t443 + _t443;
				_t444 =  *0x5004027;
				 *_t528 =  *_t528 + _t444;
				 *_t444 = _t444 +  *_t444;
				 *_t444 = _t444 +  *_t444;
				 *_t444 = _t444 +  *_t444;
				 *_t444 = _t444 +  *_t444;
				 *((intOrPtr*)(_t444 - 0x4fffbfdd)) =  *((intOrPtr*)(_t444 - 0x4fffbfdd)) + _t444;
				asm("stosd");
				_t447 =  *_t444 * "Command1" + 0x18000300 & 0x00000040;
				 *0x32004024 =  *0x32004024 + _t447;
				_t539[9] = _t539[9] + _t528;
				_v1711259612 = _v1711259612 + _t539;
				_t450 = (_t447 & 0x00000040) + 0x00000001 & 0x00000040;
				 *((intOrPtr*)(_t554 - 0x3effbfdc)) =  *((intOrPtr*)(_t554 - 0x3effbfdc)) + _t450;
				_t529 = _t528 + _t528;
				_t454 = _t539 + (_t450 & 0x40) & 0x00000040;
				 *_t549 =  *_t549 + _t454;
				_t540 = _t539 + _t549;
				asm("invalid");
				 *_t529 =  *_t529 + _t540;
				 *_t554 =  *_t554 + _t529;
				_t460 = ((_t454 & 0x23e40040) + 0x00000001 &  *((_t454 & 0x23e40040) + 1)) + 0x00000001 & 0x40;
				_a53 = _a53 + _t540;
				_t564[0x24] = _t564[0x24] + _t460;
				 *((intOrPtr*)(_t529 + 0x24)) =  *((intOrPtr*)(_t529 + 0x24)) + _t549;
				_t462 = _t460 + 2;
				 *((intOrPtr*)(_t462 - 0x4bffbfdc)) =  *((intOrPtr*)(_t462 - 0x4bffbfdc)) + _t462;
				_t550 = _t549 + _t540;
				_t541 = _t540 + _t550;
				_t465 = _t462 & 0x40;
				 *_t465 =  *_t465 + _t465;
				 *_t465 =  *_t465 + _t465;
				 *((intOrPtr*)(_t465 + 0x1d)) =  *((intOrPtr*)(_t465 + 0x1d)) + _t541;
				_t467 = _t465 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t467;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				 *_t467 =  *_t467 + _t467;
				_t469 = _t467 + _t529 &  *(_t467 + _t529);
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				 *_t469 =  *_t469 + _t469;
				if( *_t469 >= 0) {
					_t469 = _t469 + 1 + _t541;
					asm("sbb al, 0x40");
					 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t469;
					asm("adc al, 0x40");
					_t564[0x4014] = _t564[0x4014] + _t541;
					 *_t469 =  *_t469 + _t469;
					 *_t469 =  *_t469 + _t469;
					 *_t469 =  *_t469 + _t469;
					 *((intOrPtr*)(_t469 - 0x37ffbfe3)) =  *((intOrPtr*)(_t469 - 0x37ffbfe3)) + _t529;
				}
				_t470 = _t469 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t470;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t470 =  *_t470 + _t470;
				 *_t470 =  *_t470 + _t470;
				 *_t470 =  *_t470 + _t470;
				asm("sbb eax, 0x1cc80040");
				_t472 = _t470 + _t470 + 1;
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t472;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				 *_t472 =  *_t472 + _t472;
				asm("sbb eax, 0x1cc80040");
				_t474 = _t472 + _t541 + 1;
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t474;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t474;
				 *_t474 =  *_t474 + _t550;
				_push(ds);
				_t476 = _t474 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t476;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t476;
				 *_t476 =  *_t476 + _t529;
				_push(ds);
				_t478 = _t476 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t478;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *_t478 =  *_t478 + _t478;
				 *((intOrPtr*)(_t478 + 0x1e)) =  *((intOrPtr*)(_t478 + 0x1e)) + _t478;
				_t480 = _t478 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t480;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *((intOrPtr*)(_t480 - 0x37ffbfe2)) =  *((intOrPtr*)(_t480 - 0x37ffbfe2)) + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t480;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *((intOrPtr*)(_t480 - 0x37ffbfe2)) =  *((intOrPtr*)(_t480 - 0x37ffbfe2)) + _t550;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t480;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				 *_t480 =  *_t480 + _t480;
				_t483 = _t480 + _t529 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t483;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				 *_t483 =  *_t483 + _t483;
				ds = ds;
				_t485 = _t483 + 1 + _t541;
				asm("sbb al, 0x40");
				 *((intOrPtr*)(_t550 - 0x57ffbfec)) =  *((intOrPtr*)(_t550 - 0x57ffbfec)) + _t485;
				asm("adc al, 0x40");
				_t564[0x4014] = _t564[0x4014] + _t541;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *_t485 =  *_t485 + _t485;
				 *((intOrPtr*)(_t541 + 0x3304246c)) =  *((intOrPtr*)(_t541 + 0x3304246c)) + _t485;
				 *_t485 =  *_t485 + _t485;
				_t542 = _t541 + _t541;
				asm("wait");
				 *_t485 =  *_t485;
				_v15 = _v15 - 0xffff;
				_push(_t572);
				_push(_t542);
				_push(_t542);
				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t581;
				_t487 = 0x44;
				L00401310();
				_push(_t529);
				_push(_t564);
				_push(_t554);
				_v31 = _t581;
				_v27 = E00401160;
				_push(0x402a08);
				L00401424();
				L00401460();
				_push(_t487);
				_push(0x402a14);
				L0040142A();
				asm("sbb eax, eax");
				_v75 =  ~( ~( ~_t487));
				L00401478();
				_t491 = _v75;
				if(_t491 != 0) {
					if( *0x41333c != 0) {
						_v80 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v80 = 0x41333c;
					}
					_t334 =  &_v80; // 0x41333c
					_v56 =  *((intOrPtr*)( *_t334));
					_t497 =  *((intOrPtr*)( *_v56 + 0x4c))(_v56,  &_v32);
					asm("fclex");
					_v60 = _t497;
					if(_v60 >= 0) {
						_v84 = _v84 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x402a2c);
						_push(_v56);
						_push(_v60);
						L0040148A();
						_v84 = _t497;
					}
					_v64 = _v32;
					_v44 = 1;
					_v52 = 2;
					L00401310();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t503 =  *((intOrPtr*)( *_v64 + 0x1c))(_v64, 0x10,  &_v36);
					asm("fclex");
					_v68 = _t503;
					if(_v68 >= 0) {
						_v88 = _v88 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a4c);
						_push(_v64);
						_push(_v68);
						L0040148A();
						_v88 = _t503;
					}
					_v76 = _v36;
					_v36 = _v36 & 0x00000000;
					_push(_v76);
					_t491 =  &_v24;
					_push(_t491);
					L00401496();
					L00401484();
				}
				_push(E0040C41E);
				L00401484();
				return _t491;
			}

0x004014bc
0x004014bc
0x004014bc
0x004014bc
0x004014c1
0x004014c6
0x004014c8
0x004014ca
0x004014cc
0x004014ce
0x004014d0
0x004014d1
0x004014d3
0x004014d5
0x004014d7
0x004014de
0x004014e1
0x004014e2
0x004014e7
0x004014e9
0x004014eb
0x004014ed
0x004014ef
0x004014f1
0x004014f3
0x004014f5
0x004014f6
0x004014fe
0x004014ff
0x00401508
0x0040150a
0x0040150c
0x0040150e
0x00401510
0x00401514
0x0040151b
0x00401521
0x00401524
0x00401527
0x0040152a
0x0040152d
0x0040152f
0x00401530
0x00401532
0x00401533
0x0040153a
0x0040153c
0x0040153d
0x00401540
0x00401540
0x00401541
0x00401543
0x00401545
0x00401547
0x00401549
0x0040154b
0x0040154d
0x0040154f
0x00401551
0x00401553
0x00401555
0x00401557
0x00401559
0x0040155b
0x0040155d
0x0040155f
0x00401561
0x00401563
0x00401565
0x00401566
0x00401568
0x0040156b
0x0040156d
0x0040156f
0x00401572
0x00401572
0x00401574
0x00401575
0x00401578
0x0040157d
0x0040157f
0x00401583
0x00401585
0x00401587
0x00401588
0x0040158a
0x0040158d
0x00401593
0x00401595
0x0040159b
0x0040159c
0x0040159d
0x0040159f
0x004015a0
0x004015a2
0x004015a5
0x004015a7
0x004015a8
0x004015ab
0x004015ad
0x004015b0
0x004015b2
0x004015b3
0x004015b6
0x004015ba
0x004015c0
0x004015c1
0x0040162f
0x0040162f
0x00000000
0x00401633
0x00401633
0x00401640
0x00401641
0x00401643
0x00401645
0x00401647
0x0040164a
0x0040164d
0x0040164e
0x0040164f
0x00401650
0x00401654
0x00401656
0x00401657
0x0040165a
0x0040165f
0x00401662
0x00401664
0x00401665
0x0040166a
0x0040166c
0x0040166e
0x0040166f
0x00401671
0x00401677
0x00401678
0x00401679
0x0040167a
0x0040167b
0x00401680
0x00401680
0x00401685
0x0040168a
0x00000000
0x0040168c
0x0040168c
0x0040168d
0x00000000
0x0040168f
0x0040168f
0x00000000
0x0040168f
0x0040168d
0x0040168a
0x004015c3
0x004015c3
0x004015ca
0x004015cd
0x004015d3
0x004015d8
0x004015da
0x004015dc
0x004015de
0x004015e0
0x004015e2
0x004015e5
0x004015e9
0x004015ef
0x004015f4
0x00401600
0x00401602
0x00401604
0x00401604
0x00401605
0x00401607
0x00401609
0x0040160b
0x0040160d
0x0040160e
0x00401611
0x00401615
0x0040161b
0x0040161c
0x0040161d
0x0040161d
0x00401626
0x00401691
0x00401691
0x00000000
0x00401628
0x00401628
0x00401695
0x00401695
0x0040169a
0x00000000
0x0040162a
0x0040162a
0x0040169b
0x0040169b
0x0040169d
0x0040169f
0x004016a1
0x004016a1
0x004016a3
0x004016a8
0x004016dd
0x004016dd
0x004016de
0x004016de
0x004016e1
0x004016e3
0x00000000
0x004016e5
0x004016e5
0x004016e8
0x004016ea
0x004016ec
0x004016ee
0x004016ee
0x004016f0
0x004016f6
0x00000000
0x004016f8
0x004016f8
0x004016fc
0x00401701
0x00401702
0x00000000
0x00401702
0x004016f6
0x004016aa
0x004016aa
0x004016ac
0x004016ae
0x004016b0
0x004016b6
0x004016b7
0x004016ba
0x004016bb
0x004016bc
0x004016bd
0x004016be
0x004016bf
0x004016c1
0x004016c3
0x004016c5
0x004016c7
0x004016c7
0x004016c9
0x004016ca
0x004016cf
0x00401703
0x00401703
0x00401706
0x00401707
0x00401708
0x0040170b
0x0040170b
0x00401710
0x0040177e
0x00401780
0x00401782
0x00000000
0x00401713
0x00401713
0x00401785
0x00401785
0x00401787
0x0040178a
0x00000000
0x00401715
0x00401715
0x00401718
0x00401752
0x00401752
0x00401753
0x00401753
0x00401757
0x0040178b
0x0040178b
0x0040178e
0x00401793
0x00401795
0x00401797
0x00401799
0x00000000
0x0040175a
0x0040175a
0x0040175c
0x0040175d
0x0040175f
0x00401761
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176e
0x0040176e
0x00401772
0x00401775
0x00401777
0x00401778
0x00401779
0x0040177a
0x0040177c
0x00000000
0x0040177c
0x00401772
0x0040171a
0x0040171a
0x0040171c
0x0040171e
0x00401720
0x00401722
0x00401724
0x00401726
0x00401729
0x00401729
0x0040172a
0x0040172b
0x00401730
0x00401732
0x00401733
0x0040179a
0x0040179a
0x0040179c
0x0040179e
0x004017a0
0x004017a2
0x004017a4
0x004017a6
0x00401735
0x00401735
0x0040173a
0x0040173f
0x00401744
0x00401745
0x00401749
0x00401749
0x0040174e
0x00401750
0x00000000
0x00401750
0x00401733
0x00401718
0x00401713
0x004016d1
0x004016d1
0x004016d3
0x004016d5
0x004016d8
0x00000000
0x004016d8
0x004016cf
0x0040162c
0x0040162c
0x0040162d
0x00000000
0x0040162d
0x0040162a
0x00401628
0x00401626
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b1
0x004017b3
0x004017b5
0x004017b7
0x004017b9
0x004017bb
0x004017c2
0x004017c4
0x004017c6
0x004017c8
0x004017ca
0x004017cc
0x004017ce
0x004017d0
0x004017d2
0x004017d4
0x004017d9
0x004017df
0x004017e1
0x004017e3
0x004017e6
0x004017e8
0x004017eb
0x004017f1
0x004017f3
0x004017f5
0x004017f7
0x004017f9
0x004017fb
0x004017fd
0x004017ff
0x00401801
0x00401803
0x0040180e
0x00401811
0x00401812
0x00401814
0x00401816
0x00401817
0x00401818
0x00401819
0x0040181b
0x0040181b
0x0040181c
0x0040181d
0x0040188d
0x0040188d
0x00000000
0x0040181f
0x0040181f
0x00401823
0x0040188e
0x0040188e
0x00401825
0x00401825
0x00401826
0x00401829
0x0040182b
0x0040182e
0x00401837
0x00401838
0x0040183f
0x00401842
0x00401844
0x00401846
0x00401848
0x0040184a
0x0040184c
0x0040184e
0x00401850
0x00401852
0x00401855
0x0040185a
0x0040185c
0x0040185e
0x00401860
0x00401862
0x00401864
0x00401866
0x00401868
0x0040186a
0x0040186c
0x0040186e
0x0040186e
0x00401870
0x00401872
0x00401876
0x00401877
0x0040187b
0x0040187e
0x00401880
0x00401886
0x00401887
0x00401887
0x00401888
0x00000000
0x00401888
0x00401826
0x00401823
0x0040189c
0x0040189e
0x004018a0
0x004018a2
0x004018a4
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b7
0x004018b9
0x004018bb
0x004018be
0x004018c0
0x004018c2
0x004018c5
0x004018ca
0x004018cc
0x004018ce
0x004018d0
0x004018d6
0x004018d8
0x004018df
0x004018e1
0x004018e3
0x004018ea
0x004018eb
0x004018ed
0x004018ef
0x004018f2
0x004018f7
0x004018f9
0x004018fb
0x004018fd
0x004018ff
0x00401903
0x00401905
0x00401907
0x0040190b
0x0040190d
0x0040190f
0x00401913
0x00401915
0x00401917
0x0040191b
0x0040191d
0x0040191f
0x00401922
0x00401923
0x00401925
0x00401927
0x0040192b
0x0040192d
0x00401933
0x0040193a
0x0040193b
0x0040193d
0x00401941
0x00401942
0x00401943
0x00401947
0x0040194b
0x0040194e
0x00401952
0x00401954
0x00401959
0x0040195b
0x0040195d
0x0040195f
0x00401961
0x00401963
0x0040196a
0x00401970
0x00401974
0x00401975
0x00401977
0x00401979
0x0040197b
0x00401981
0x00401983
0x00401985
0x00401987
0x00401989
0x0040198d
0x00401990
0x00401991
0x00401992
0x00401998
0x0040199a
0x0040199c
0x0040199e
0x004019a0
0x004019a1
0x004019a4
0x004019a5
0x004019a8
0x004019ad
0x004019af
0x004019b5
0x004019b7
0x004019b9
0x004019bb
0x004019bd
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c7
0x004019c9
0x004019cb
0x004019cd
0x004019cf
0x004019d1
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019e1
0x004019e3
0x004019e5
0x004019e7
0x004019e9
0x004019eb
0x004019ed
0x004019ef
0x004019f1
0x004019f3
0x004019f5
0x004019f7
0x004019f9
0x004019fb
0x004019ff
0x00401a01
0x00401a04
0x00401a09
0x00401a0b
0x00401a11
0x00401a13
0x00401a15
0x00401a17
0x00401a19
0x00401a1b
0x00401a1d
0x00401a1f
0x00401a21
0x00401a23
0x00401a25
0x00401a27
0x00401a29
0x00401a2b
0x00401a2d
0x00401a2f
0x00401a31
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a41
0x00401a43
0x00401a45
0x00401a47
0x00401a49
0x00401a4b
0x00401a4d
0x00401a4f
0x00401a51
0x00401a53
0x00401a55
0x00401a57
0x00401a59
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a61
0x00401a63
0x00401a65
0x00401a67
0x00401a69
0x00401a6b
0x00401a6d
0x00401a6f
0x00401a71
0x00401a73
0x00401a75
0x00401a77
0x00401a79
0x00401a7b
0x00401a7d
0x00401a7f
0x00401a81
0x00401a83
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a8d
0x00401a8f
0x00401a91
0x00401a96
0x00401a98
0x00401a9f
0x00401aa7
0x00401aa9
0x00401aac
0x00401aae
0x00401aaf
0x00401ab1
0x00401ab3
0x00401ab5
0x00401ab7
0x00401ab9
0x00401abb
0x00401abd
0x00401abf
0x00401ac1
0x00401ac3
0x00401ac5
0x00401ac7
0x00401ac9
0x00401acb
0x00401acd
0x00401acf
0x00401ad1
0x00401ad3
0x00401ad5
0x00401ad7
0x00401ad9
0x00401adb
0x00401add
0x00401adf
0x00401ae1
0x00401ae3
0x00401ae5
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af1
0x00401af3
0x00401af5
0x00401af7
0x00401af9
0x00401afb
0x00401afd
0x00401aff
0x00401b01
0x00401b03
0x00401b05
0x00401b07
0x00401b09
0x00401b0b
0x00401b0d
0x00401b0f
0x00401b11
0x00401b13
0x00401b15
0x00401b17
0x00401b19
0x00401b1b
0x00401b1d
0x00401b1f
0x00401b21
0x00401b23
0x00401b25
0x00401b27
0x00401b29
0x00401b2b
0x00401b2d
0x00401b2f
0x00401b31
0x00401b33
0x00401b35
0x00401b37
0x00401b39
0x00401b3b
0x00401b3d
0x00401b3f
0x00401b41
0x00401b43
0x00401b45
0x00401b47
0x00401b49
0x00401b4b
0x00401b4d
0x00401b4f
0x00401b51
0x00401b53
0x00401b55
0x00401b57
0x00401b59
0x00401b5b
0x00401b5d
0x00401b5f
0x00401b61
0x00401b63
0x00401b65
0x00401b67
0x00401b69
0x00401b6b
0x00401b6d
0x00401b6f
0x00401b71
0x00401b73
0x00401b75
0x00401b77
0x00401b79
0x00401b7b
0x00401b7d
0x00401b7f
0x00401b81
0x00401b83
0x00401b85
0x00401b87
0x00401b89
0x00401b8b
0x00401b8d
0x00401b8f
0x00401b91
0x00401b93
0x00401b95
0x00401b97
0x00401b99
0x00401b9b
0x00401b9d
0x00401b9f
0x00401ba1
0x00401ba3
0x00401ba5
0x00401ba7
0x00401ba9
0x00401bab
0x00401bad
0x00401baf
0x00401bb1
0x00401bb3
0x00401bb5
0x00401bb7
0x00401bb9
0x00401bbb
0x00401bbd
0x00401bbf
0x00401bc1
0x00401bc3
0x00401bc5
0x00401bc7
0x00401bc9
0x00401bcb
0x00401bcd
0x00401bcf
0x00401bd1
0x00401bd3
0x00401bd5
0x00401bd7
0x00401bd9
0x00401bdb
0x00401bdd
0x00401bdf
0x00401be1
0x00401be3
0x00401be5
0x00401be7
0x00401be9
0x00401beb
0x00401bed
0x00401bef
0x00401bf1
0x00401bf3
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfb
0x00401bfd
0x00401bff
0x00401c01
0x00401c03
0x00401c05
0x00401c07
0x00401c09
0x00401c0b
0x00401c0d
0x00401c0f
0x00401c11
0x00401c13
0x00401c15
0x00401c17
0x00401c19
0x00401c1b
0x00401c1d
0x00401c1f
0x00401c21
0x00401c23
0x00401c25
0x00401c27
0x00401c29
0x00401c2b
0x00401c2d
0x00401c2f
0x00401c31
0x00401c33
0x00401c35
0x00401c37
0x00401c39
0x00401c3b
0x00401c3d
0x00401c3f
0x00401c41
0x00401c43
0x00401c45
0x00401c47
0x00401c49
0x00401c4b
0x00401c4d
0x00401c4f
0x00401c51
0x00401c53
0x00401c55
0x00401c57
0x00401c59
0x00401c5b
0x00401c5d
0x00401c5f
0x00401c61
0x00401c63
0x00401c65
0x00401c67
0x00401c69
0x00401c6b
0x00401c6d
0x00401c6f
0x00401c71
0x00401c73
0x00401c75
0x00401c77
0x00401c79
0x00401c7b
0x00401c7d
0x00401c7f
0x00401c81
0x00401c83
0x00401c85
0x00401c87
0x00401c89
0x00401c8b
0x00401c8d
0x00401c8f
0x00401c91
0x00401c93
0x00401c95
0x00401c97
0x00401c99
0x00401c9b
0x00401c9d
0x00401c9f
0x00401ca1
0x00401ca3
0x00401ca5
0x00401ca7
0x00401ca9
0x00401cab
0x00401cad
0x00401caf
0x00401cb1
0x00401cb3
0x00401cb5
0x00401cb7
0x00401cb9
0x00401cbb
0x00401cbd
0x00401cbf
0x00401cc6
0x00401cc8
0x00401cca
0x00401ccc
0x00401cd2
0x00401cd5
0x00401cd6
0x00401cd7
0x00401cd9
0x00401cdb
0x00401cdd
0x00401cdf
0x00401ce3
0x00401ce5
0x00401ce8
0x00401cea
0x00401cec
0x00401cee
0x00401cef
0x00401cf1
0x00401cf3
0x00401cf5
0x00401cf7
0x00401cf9
0x00401cfb
0x00401cfe
0x00401cff
0x00401d01
0x00401d03
0x00401d06
0x00401d07
0x00401d09
0x00401d0b
0x00401d0e
0x00401d0f
0x00401d11
0x00401d13
0x00401d16
0x00401d17
0x00401d19
0x00401d1b
0x00401d1f
0x00401d22
0x00401d25
0x00401d2a
0x00401d31
0x00401d32
0x00401d33
0x00401d37
0x00401d39
0x00401d39
0x00401d3b
0x00401d42
0x00401d43
0x00401d46
0x00401d47
0x00401d4a
0x00401d4b
0x00401d4e
0x00401d50
0x00401d53
0x00401d55
0x00401d57
0x00401d59
0x00401d5b
0x00401d5d
0x00401d5f
0x00401d6c
0x00401d6e
0x00401d70
0x00401d71
0x00401d73
0x00401d75
0x00401d77
0x00401d79
0x00401d7a
0x00401d7b
0x00401d7d
0x00401d7f
0x00401d81
0x00401d83
0x00401d85
0x00401d87
0x00401d89
0x00401d89
0x00401d98
0x00401d99
0x00401d9b
0x00401d9e
0x00401da0
0x00401da2
0x00401da3
0x00401da5
0x00401da7
0x00401da9
0x00401dab
0x00401dad
0x00401daf
0x00401db2
0x00401db3
0x00401dc0
0x00401dc1
0x00401dc3
0x00401dc6
0x00401dc8
0x00401dca
0x00401dcb
0x00401dcd
0x00401dcf
0x00401dd1
0x00401dd3
0x00401dd5
0x00401dd7
0x00401dda
0x00401ddb
0x00401de1
0x00401de2
0x00401de3
0x00401de5
0x00401de7
0x00401dea
0x00401def
0x00401df2
0x00401df3
0x00401df5
0x00401df7
0x00401df9
0x00401dfb
0x00401dfd
0x00401dff
0x00401e01
0x00401e05
0x00401e06
0x00401e0c
0x00401e10
0x00401e11
0x00401e13
0x00401e16
0x00401e18
0x00401e1d
0x00401e1f
0x00401e21
0x00401e23
0x00401e25
0x00401e27
0x00401e2a
0x00401e2b
0x00401e31
0x00401e32
0x00401e33
0x00401e35
0x00401e37
0x00401e3a
0x00401e3d
0x00401e3f
0x00401e42
0x00401e43
0x00401e45
0x00401e47
0x00401e49
0x00401e4b
0x00401e4d
0x00401e4f
0x00401e53
0x00401e59
0x00401e5a
0x00401e5b
0x00401e5d
0x00401e5f
0x00401e62
0x00401e64
0x00401e65
0x00401e67
0x00401e69
0x00401e6a
0x00401e6b
0x00401e6d
0x00401e6f
0x00401e71
0x00401e73
0x00401e75
0x00401e77
0x00401e79
0x00401e7c
0x00401e83
0x00401e85
0x00401e87
0x00401e8a
0x00401e8c
0x00401e8d
0x00401e8f
0x00401e92
0x00401e93
0x00401e95
0x00401e97
0x00401e99
0x00401e9b
0x00401e9d
0x00401e9f
0x00401ea3
0x00401ea9
0x00401eaa
0x00401eab
0x00401ead
0x00401eaf
0x00401eb2
0x00401eb4
0x00401eb5
0x00401eb7
0x00401eb9
0x00401eba
0x00401ebb
0x00401ebd
0x00401ebf
0x00401ec1
0x00401ec3
0x00401ec5
0x00401ec7
0x00401ece
0x00401ed5
0x00401ed7
0x00401eda
0x00401edc
0x00401edd
0x00401edf
0x00401ee5
0x00401ee7
0x00401ee9
0x00401eeb
0x00401eed
0x00401eef
0x00401ef2
0x00401ef3
0x00401ef9
0x00401efa
0x00401efb
0x00401f00
0x00401f01
0x00401f03
0x00401f06
0x00401f08
0x00401f0d
0x00401f0f
0x00401f11
0x00401f13
0x00401f15
0x00401f17
0x00401f1d
0x00401f29
0x00401f2b
0x00401f33
0x00401f37
0x00401f3d
0x00401f3f
0x00401f47
0x00401f4d
0x00401f4f
0x00401f57
0x00401f5c
0x00401f5f
0x00401f63
0x00401f65
0x00401f67
0x00401f6b
0x00401f6f
0x00401f72
0x00401f73
0x00401f7b
0x00401f7f
0x00401f81
0x00401f83
0x00401f85
0x00401f87
0x00401f8b
0x00401f8d
0x00401f8f
0x00401f95
0x00401f97
0x00401f9d
0x00401f9f
0x00401fa1
0x00401fa3
0x00401fa5
0x00401fa7
0x00401fa9
0x00401fab
0x00401fad
0x00401faf
0x00401fb1
0x00401fb3
0x00401fb5
0x00401fb7
0x00401fb9
0x00401fbb
0x00401fbd
0x00401fbf
0x00401fc1
0x00401fc3
0x00401fc5
0x00401fc7
0x00401fc9
0x00401fcb
0x00401fcd
0x00401fcf
0x00401fd1
0x00401fd3
0x00401fd5
0x00401fd7
0x00401fd9
0x00401fdb
0x00401fdd
0x00401fdf
0x00401fe1
0x00401fe3
0x00401fe5
0x00401fe7
0x00401fe9
0x00401feb
0x00401fed
0x00401fef
0x00401ff1
0x00401ff5
0x00401ff8
0x00401ffa
0x00401ffc
0x00401ffe
0x00402000
0x00402002
0x00402004
0x00402006
0x00402008
0x0040200a
0x0040200c
0x0040200e
0x00402010
0x00402012
0x00402014
0x00402016
0x00402018
0x0040201a
0x0040201c
0x0040201f
0x00402021
0x00402023
0x00402029
0x0040202b
0x00402031
0x00402033
0x00402035
0x00402037
0x00402037
0x0040203b
0x0040203d
0x0040203f
0x00402045
0x00402047
0x0040204d
0x0040204f
0x00402051
0x00402055
0x0040205a
0x0040205b
0x00402061
0x00402063
0x00402069
0x0040206b
0x0040206d
0x0040206f
0x00402071
0x00402073
0x00402075
0x00402077
0x00402079
0x0040207b
0x0040207d
0x0040207f
0x00402081
0x00402083
0x00402085
0x00402087
0x00402089
0x0040208b
0x0040208d
0x0040208f
0x00402091
0x00402093
0x00402095
0x00402097
0x00402099
0x0040209b
0x0040209d
0x0040209f
0x004020a1
0x004020a3
0x004020a5
0x004020a7
0x004020a9
0x004020ab
0x004020ad
0x004020af
0x004020b1
0x004020b3
0x004020b5
0x004020b7
0x004020b9
0x004020bb
0x004020bd
0x004020bf
0x004020c1
0x004020c3
0x004020c5
0x004020c7
0x004020c9
0x004020cd
0x004020d2
0x004020d3
0x004020d9
0x004020db
0x004020e1
0x004020e3
0x004020e5
0x004020e7
0x004020e9
0x004020eb
0x004020ed
0x004020ef
0x004020f1
0x004020f3
0x004020f5
0x004020f7
0x004020f9
0x004020fb
0x004020fd
0x004020ff
0x00402101
0x00402103
0x00402105
0x00402107
0x00402109
0x0040210b
0x0040210d
0x0040210f
0x00402111
0x00402113
0x00402115
0x00402117
0x00402119
0x0040211b
0x0040211d
0x0040211f
0x00402125
0x00402127
0x0040212d
0x0040212f
0x00402131
0x00402133
0x00402135
0x00402137
0x00402139
0x0040213b
0x0040213d
0x0040213f
0x00402141
0x00402143
0x00402145
0x00402147
0x00402149
0x0040214b
0x0040214d
0x0040214f
0x00402151
0x00402153
0x00402155
0x00402157
0x00402159
0x0040215b
0x0040215d
0x0040215f
0x00402161
0x00402163
0x00402165
0x00402167
0x00402169
0x0040216b
0x0040216d
0x0040216f
0x00402171
0x00402173
0x00402175
0x00402177
0x00402179
0x0040217b
0x0040217d
0x0040217f
0x00402185
0x00402187
0x0040218d
0x0040218f
0x00402191
0x00402193
0x00402195
0x00402197
0x00402199
0x0040219b
0x0040219d
0x0040219f
0x004021a1
0x004021a3
0x004021a5
0x004021a7
0x004021a9
0x004021ab
0x004021ad
0x004021af
0x004021b1
0x004021b3
0x004021b5
0x004021b7
0x004021b9
0x004021bb
0x004021bd
0x004021bf
0x004021c1
0x004021c3
0x004021c5
0x004021c7
0x004021c9
0x004021cb
0x004021cd
0x004021cf
0x004021d1
0x004021d3
0x004021d5
0x004021d7
0x004021db
0x004021dd
0x004021df
0x004021e5
0x004021e7
0x004021ed
0x004021ef
0x004021f1
0x004021f3
0x004021f5
0x004021f7
0x004021f9
0x004021fb
0x004021fd
0x004021ff
0x00402201
0x00402203
0x00402205
0x00402207
0x00402209
0x0040220b
0x0040220d
0x0040220f
0x00402211
0x00402213
0x00402215
0x00402217
0x00402219
0x0040221b
0x0040221d
0x0040221f
0x00402221
0x00402223
0x00402225
0x00402227
0x00402229
0x0040222b
0x0040222d
0x0040222f
0x00402231
0x00402233
0x00402235
0x00402237
0x00402239
0x0040223b
0x0040223d
0x0040223f
0x00402241
0x00402243
0x00402245
0x00402247
0x00402249
0x0040224b
0x0040224d
0x0040224f
0x00402255
0x00402257
0x0040225d
0x0040225f
0x00402265
0x00402267
0x00402269
0x0040226b
0x0040226d
0x0040226f
0x00402271
0x00402273
0x00402275
0x00402277
0x00402279
0x0040227b
0x0040227d
0x0040227f
0x00402281
0x00402283
0x00402285
0x00402287
0x00402289
0x0040228b
0x0040228d
0x0040228f
0x00402291
0x00402293
0x00402295
0x00402297
0x00402299
0x0040229b
0x0040229d
0x0040229f
0x004022a1
0x004022a3
0x004022a5
0x004022a7
0x004022a9
0x004022ab
0x004022ad
0x004022af
0x004022b5
0x004022b7
0x004022bd
0x004022bf
0x004022c5
0x004022c7
0x004022c9
0x004022cb
0x004022cd
0x004022cf
0x004022d1
0x004022d3
0x004022d5
0x004022d7
0x004022d9
0x004022db
0x004022dd
0x004022df
0x004022e1
0x004022e3
0x004022e5
0x004022e7
0x004022e9
0x004022eb
0x004022ed
0x004022ef
0x004022f1
0x004022f3
0x004022f5
0x004022f7
0x004022f9
0x004022fb
0x004022fd
0x004022ff
0x00402301
0x00402303
0x00402305
0x00402307
0x00402309
0x0040230b
0x0040230d
0x0040230f
0x00402311
0x00402313
0x00402315
0x00402317
0x00402319
0x0040231b
0x0040231d
0x0040231f
0x00402321
0x00402323
0x00402325
0x0040232b
0x0040232d
0x0040232f
0x00402335
0x00402337
0x0040233d
0x0040233f
0x00402341
0x00402343
0x00402345
0x00402347
0x00402349
0x0040234b
0x0040234d
0x0040234f
0x00402351
0x00402353
0x00402355
0x00402357
0x00402359
0x0040235b
0x0040235d
0x0040235f
0x00402361
0x00402363
0x00402365
0x00402367
0x00402369
0x0040236b
0x0040236d
0x0040236f
0x00402371
0x00402373
0x00402375
0x00402377
0x00402379
0x0040237b
0x0040237d
0x0040237f
0x00402381
0x00402383
0x00402385
0x00402387
0x00402389
0x0040238b
0x00402391
0x00402393
0x00402399
0x0040239b
0x0040239d
0x0040239f
0x004023a1
0x004023a3
0x004023a5
0x004023a7
0x004023a9
0x004023ab
0x004023ad
0x004023af
0x004023b1
0x004023b3
0x004023b5
0x004023b7
0x004023b9
0x004023bb
0x004023bd
0x004023bf
0x004023c1
0x004023c3
0x004023c5
0x004023c7
0x004023c9
0x004023cb
0x004023cd
0x004023cf
0x004023d1
0x004023d3
0x004023d5
0x004023d7
0x004023d9
0x004023db
0x004023e1
0x004023e3
0x004023e5
0x004023e6
0x004023e9
0x0040c2aa
0x0040c2ad
0x0040c2ae
0x0040c2af
0x0040c2ba
0x0040c2bb
0x0040c2c4
0x0040c2c5
0x0040c2ca
0x0040c2cb
0x0040c2cc
0x0040c2cd
0x0040c2d0
0x0040c2d7
0x0040c2dc
0x0040c2e6
0x0040c2eb
0x0040c2ec
0x0040c2f1
0x0040c2f8
0x0040c2fe
0x0040c305
0x0040c30a
0x0040c310
0x0040c31d
0x0040c337
0x0040c31f
0x0040c31f
0x0040c324
0x0040c329
0x0040c32e
0x0040c32e
0x0040c33e
0x0040c343
0x0040c352
0x0040c355
0x0040c357
0x0040c35e
0x0040c377
0x0040c360
0x0040c360
0x0040c362
0x0040c367
0x0040c36a
0x0040c36d
0x0040c372
0x0040c372
0x0040c37e
0x0040c381
0x0040c388
0x0040c396
0x0040c3a0
0x0040c3a1
0x0040c3a2
0x0040c3a3
0x0040c3ac
0x0040c3af
0x0040c3b1
0x0040c3b8
0x0040c3d1
0x0040c3ba
0x0040c3ba
0x0040c3bc
0x0040c3c1
0x0040c3c4
0x0040c3c7
0x0040c3cc
0x0040c3cc
0x0040c3d8
0x0040c3db
0x0040c3df
0x0040c3e2
0x0040c3e5
0x0040c3e6
0x0040c3ee
0x0040c3ee
0x0040c3f3
0x0040c418
0x0040c41d

APIs

#100.MSVBVM60(VB5!6&*), ref: 004014C1

Strings

VB5!6&*, xrefs: 004014BC

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: d194f24e6c3d7790a35ca97ff070774f751d88984bc0d96af9f1c03e26d1e51e
Instruction ID: d367181078a4f7c184ce1a5fbaa764abba473afb49577ec6dcecf31e4539f1df
Opcode Fuzzy Hash: d194f24e6c3d7790a35ca97ff070774f751d88984bc0d96af9f1c03e26d1e51e
Instruction Fuzzy Hash: 5CB1786244E3D14FD7138B748DA61A17FB0AE1331435E05DBC8C1CE0B3E12D6A5AD766

Uniqueness

Uniqueness Score: -1.00%

Function 00403D61, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 794COMMON

Download Yara Rule

Strings

nR, xrefs: 00403D62

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: nR
API String ID: 0-4205305712
Opcode ID: c725d322ec0a1a4f67a01e6dd69ee52cf91293a9d9c0fbc537a5899fb4d68a28
Instruction ID: 891a53f5a59f4f7915465c52cdda217dd699b1feb6d08bc10185e29d5d1ee052
Opcode Fuzzy Hash: c725d322ec0a1a4f67a01e6dd69ee52cf91293a9d9c0fbc537a5899fb4d68a28
Instruction Fuzzy Hash: B7320292F2A70185FF732064C1D059D5541DF93782F328B3BDA6A728E5362F4ACA18DB

Uniqueness

Uniqueness Score: -1.00%

Function 0040466F, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 417
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040466F(signed int __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed int _t9;

				asm("aad 0x32");
				_t9 = __eax ^  *(__ebx - 0x67efe39);
			}

0x0040466f
0x0040468e

Strings

D333, xrefs: 00404671

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: D333
API String ID: 0-1487163289
Opcode ID: 2e046e87474c17854341aee65f1f0fccf12edcbddd09738757ad3eb549a1309a
Instruction ID: 64910345f1cc54ad40111107494f1a83f24e61922f759b14af9ff3d6ef7be6e3
Opcode Fuzzy Hash: 2e046e87474c17854341aee65f1f0fccf12edcbddd09738757ad3eb549a1309a
Instruction Fuzzy Hash: FDC12482F2A71184FFB36064C5D015D9542DF93781F328B3BDA2A728D03B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 00403CE0, Relevance: 2.0, APIs: 1, Instructions: 787memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3249255562ca2ac49963a8edb51a73aa9a6ca6a8953f8ce879d6169d88c491d2
Instruction ID: 37140a5a932a18b81ddf642bed6b2ffc0b1f788990a487d4b650067ff0465f0b
Opcode Fuzzy Hash: 3249255562ca2ac49963a8edb51a73aa9a6ca6a8953f8ce879d6169d88c491d2
Instruction Fuzzy Hash: EB321692F2A71144FF732064C2D059D5541DF93782F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403D18, Relevance: 2.0, APIs: 1, Instructions: 783memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 92e060044a978a867deffb68f2318dd6e46dfec50282c1d91457a38b4aa6250c
Instruction ID: 2085bb4f0a60243ff920eab39c58be98424ff9f2bdf283a7bd9c468f36c331f5
Opcode Fuzzy Hash: 92e060044a978a867deffb68f2318dd6e46dfec50282c1d91457a38b4aa6250c
Instruction Fuzzy Hash: 95323682F2A70185FF732064C1D059D9541DF93782F328B3BDA6A728D5372F0ACA199B

Uniqueness

Uniqueness Score: -1.00%

Function 00403DAC, Relevance: 2.0, APIs: 1, Instructions: 782memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4ef88ff5d3ed9d7453f8c193cb10a58d664373c3df67297c1ed769b3fedcc342
Instruction ID: 49635476d7ec1a148f9617573571033f1d7053852a1441540c6cc3cdc28d7381
Opcode Fuzzy Hash: 4ef88ff5d3ed9d7453f8c193cb10a58d664373c3df67297c1ed769b3fedcc342
Instruction Fuzzy Hash: CF223792F2A71184FF732064C6D059D9541DF93781F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403E3F, Relevance: 2.0, APIs: 1, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ed97e5d6fecc2fbd82f442ebed23953ae1afac47e17b46451c0f73241e9439
Instruction ID: 421be8b9d426f03732feead4f64506041b61feb54df0411d0e88bb1cb1a48679
Opcode Fuzzy Hash: b3ed97e5d6fecc2fbd82f442ebed23953ae1afac47e17b46451c0f73241e9439
Instruction Fuzzy Hash: A3224692F2A71184FF732064C5D059D9541DF93782F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6, Relevance: 2.0, APIs: 1, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4575cd9ce2f0980bf6903d29c95edfce3f0938a32a3a3e4e214b9e6acffc505b
Instruction ID: b633084dc120fcc485bf4736106a5fd7078f0cad25179bc7c8fe29852ae39088
Opcode Fuzzy Hash: 4575cd9ce2f0980bf6903d29c95edfce3f0938a32a3a3e4e214b9e6acffc505b
Instruction Fuzzy Hash: ED223892F2A71184FF732064C5D059D5541DF93782F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403E89, Relevance: 2.0, APIs: 1, Instructions: 744memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8fe51b297bdf80f619d1137a24474a199dc800c679d6a79e2c87f8015abf6d07
Instruction ID: a37e52ed81a3e494bba6952f37a14d73e447e407a5b3f9533a9065f7cc5b811e
Opcode Fuzzy Hash: 8fe51b297bdf80f619d1137a24474a199dc800c679d6a79e2c87f8015abf6d07
Instruction Fuzzy Hash: BC223692F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D5372F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED1, Relevance: 2.0, APIs: 1, Instructions: 731memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 853c67119dc0e2e1ce463c4b943dc13ff4baee4d4d7c02fa58cac6eb2b0c6e0a
Instruction ID: 573681b0547dd7ffc4b74d3f2ed3ab0bf7777003d78794cf9a7d25bc4d5a224b
Opcode Fuzzy Hash: 853c67119dc0e2e1ce463c4b943dc13ff4baee4d4d7c02fa58cac6eb2b0c6e0a
Instruction Fuzzy Hash: C8224682F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403F14, Relevance: 2.0, APIs: 1, Instructions: 722memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 28e3b16078ba4a93b9833214aa0f2e6fc56076c8124a0897cbcc7bb3b560690b
Instruction ID: 257811e364a4aff3876cd7377bbf60763acb080a3b684ca24491017007e0eec8
Opcode Fuzzy Hash: 28e3b16078ba4a93b9833214aa0f2e6fc56076c8124a0897cbcc7bb3b560690b
Instruction Fuzzy Hash: 74124682F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F0ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403F5F, Relevance: 1.9, APIs: 1, Instructions: 687memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 42cff724b97b724f93eb8def421ddb14be181fa88765b5ef518e941e6b12e619
Instruction ID: c8d49b3ef629c4d420cbfeff2430c555742a1ea31efcefdcd904841b07de0c2f
Opcode Fuzzy Hash: 42cff724b97b724f93eb8def421ddb14be181fa88765b5ef518e941e6b12e619
Instruction Fuzzy Hash: 26123782F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403FFB, Relevance: 1.9, APIs: 1, Instructions: 682memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e5b0bd6d38fdbb84d773e91c8eb2d1c375892b8e63222257a0b3a29b784365fe
Instruction ID: e16880a87b084e880b691e4c78530d77ea314491ac3beee38b893e88dbc69c0f
Opcode Fuzzy Hash: e5b0bd6d38fdbb84d773e91c8eb2d1c375892b8e63222257a0b3a29b784365fe
Instruction Fuzzy Hash: EE122582F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00403FAF, Relevance: 1.9, APIs: 1, Instructions: 681memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5e2c4cfca0335065a60f50de4efa8728ccd398780bf48dace646f99ff0876911
Instruction ID: 35bd32eda968f05480aa052934225ff539904324b5413906e4523c0e39980a81
Opcode Fuzzy Hash: 5e2c4cfca0335065a60f50de4efa8728ccd398780bf48dace646f99ff0876911
Instruction Fuzzy Hash: 04123582F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404083, Relevance: 1.9, APIs: 1, Instructions: 661memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b60340a92fef0c9f83d7c59cb606c20761c39e531720bbcfaefae14816e7d838
Instruction ID: 4f8b4233435a66f701e45f9ce509236b2030048dce026c8251577bec395b8341
Opcode Fuzzy Hash: b60340a92fef0c9f83d7c59cb606c20761c39e531720bbcfaefae14816e7d838
Instruction Fuzzy Hash: 96024582F2A71184FF732064C5D049D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404041, Relevance: 1.9, APIs: 1, Instructions: 659memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b4ea71e3e8cabfa9e325a6bc1de0fd1e5bf777293736cbb648afe9a64eea15e
Instruction ID: f65f7f2be2b3c89124f0f02eaf20e87cd27737ac265639050c453d4229085930
Opcode Fuzzy Hash: 1b4ea71e3e8cabfa9e325a6bc1de0fd1e5bf777293736cbb648afe9a64eea15e
Instruction Fuzzy Hash: F3122682F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004040C6, Relevance: 1.9, APIs: 1, Instructions: 652memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7b4983fde69f85315917992c1a674f7b01f84801b3a10ca8d304cef4b2b70fb7
Instruction ID: fb66472aeedda9f617316b6b4571192b99aa590c6abddc5bed4ab8e8293bfc6c
Opcode Fuzzy Hash: 7b4983fde69f85315917992c1a674f7b01f84801b3a10ca8d304cef4b2b70fb7
Instruction Fuzzy Hash: 0E023582F2A71184FF732064C5D059D5542DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 0040410B, Relevance: 1.9, APIs: 1, Instructions: 624memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 266b3be74a4f9e74f48578611597d1f378e2b8323ba737cf47aff69c49a83560
Instruction ID: 2fd1692be939495ccaf37b0bf0c27b9dd5949900569e85f92ca31c68e465061f
Opcode Fuzzy Hash: 266b3be74a4f9e74f48578611597d1f378e2b8323ba737cf47aff69c49a83560
Instruction Fuzzy Hash: 25024682F2A70184FF732064C5D055D5541DF93781F328B3BDA6A728E53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004041A1, Relevance: 1.9, APIs: 1, Instructions: 616memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 81a7c3e420ba52e7e6a662ccf2cd3ce289ce658a6731c14b3479980866db20fd
Instruction ID: e27d972ec113aeee91204c032936909ae6cbcd036ebbe5ad8a08b964e3c9b11b
Opcode Fuzzy Hash: 81a7c3e420ba52e7e6a662ccf2cd3ce289ce658a6731c14b3479980866db20fd
Instruction Fuzzy Hash: A7022682F2A71185FF732064C1D055D5541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404155, Relevance: 1.9, APIs: 1, Instructions: 613memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ecebe3b873a12bee08c5c2069bf7f12c0b5dd899cb5e72b3cb8375b5b958c542
Instruction ID: c09894b3daf23af99710d6b3e002bcd7d8e8ab0d65e3ce551d73d727f6027b6d
Opcode Fuzzy Hash: ecebe3b873a12bee08c5c2069bf7f12c0b5dd899cb5e72b3cb8375b5b958c542
Instruction Fuzzy Hash: E4023582F2A71184FF732064C1D055D5542DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004042C7, Relevance: 1.8, APIs: 1, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0475afc8f89eb01d614a3c00ff17240c19a5fd4aab7c4656a2798bb73682b4e
Instruction ID: e71241b98586d552aca3d3e6a28e249c3f0a6b1666686e81ca5e7c6c8793042a
Opcode Fuzzy Hash: a0475afc8f89eb01d614a3c00ff17240c19a5fd4aab7c4656a2798bb73682b4e
Instruction Fuzzy Hash: ABF12482F1A71184FF732064C1D04AD5541DFD3781E328B3BDA6A729E4763F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404230, Relevance: 1.8, APIs: 1, Instructions: 586memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9da81896d9b1796a0fda4956f60a63c5241f8196eb10689a7e9c7840f098f019
Instruction ID: bc08613179d973e78f8b341fc4ee8528191b5de9c84bc8f767f5f123e33cbb9c
Opcode Fuzzy Hash: 9da81896d9b1796a0fda4956f60a63c5241f8196eb10689a7e9c7840f098f019
Instruction Fuzzy Hash: 46F11682F2A71184FF732064C5D055D5541DF93782F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004041E9, Relevance: 1.8, APIs: 1, Instructions: 582memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 92b919b61365f410f48b4959e68d8610b8a35f0627d823558080a1b582a6a969
Instruction ID: 796bbed1f4c0d033744867dc53e6fa56d4a5d99997469fcbb9b90789827c11ed
Opcode Fuzzy Hash: 92b919b61365f410f48b4959e68d8610b8a35f0627d823558080a1b582a6a969
Instruction Fuzzy Hash: 51022682F2A71184FF732064C5D059D9541DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404278, Relevance: 1.8, APIs: 1, Instructions: 581memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 121b6cc056d5780a2e7ef4c9dd8823a6b7e5e5c0890502b97247422359c58c44
Instruction ID: fd542acda9c6b839d001f680efc4b24f2618becf6cb1b4c5a93608ab5844c61e
Opcode Fuzzy Hash: 121b6cc056d5780a2e7ef4c9dd8823a6b7e5e5c0890502b97247422359c58c44
Instruction Fuzzy Hash: 88F12682F2A71184FF732024C6D055D5542DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 0040430C, Relevance: 1.8, APIs: 1, Instructions: 554memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8e3d762436a5a98bea95d493092d888e5d33885f72f19fe2eb9fa4d3ada933bb
Instruction ID: 16b57997e3485f5d6361fa3489bcd4abfd71f8a65c8a8c36dde4f015b0f4eefb
Opcode Fuzzy Hash: 8e3d762436a5a98bea95d493092d888e5d33885f72f19fe2eb9fa4d3ada933bb
Instruction Fuzzy Hash: 53F12682F2A71184FF732064C5D055D5542DF93781F328B3BDA6A728E53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004043E9, Relevance: 1.8, APIs: 1, Instructions: 508memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5436f5f89ebf71354d83feabd17fe10004a5adec80f1e2144d1d4bc1f60b40c0
Instruction ID: ac0443edcf24a32276ff21e2c90298de6ed360247a65839961c4b5331456a5f4
Opcode Fuzzy Hash: 5436f5f89ebf71354d83feabd17fe10004a5adec80f1e2144d1d4bc1f60b40c0
Instruction Fuzzy Hash: BBE13682F2A71184FF736064C5D055D9641DF93781F328B3BDA6A728D13B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404432, Relevance: 1.8, APIs: 1, Instructions: 504memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cd2831953037b3daea578669809b73c33796d8fb2d4c8f4f86c532d8147db01f
Instruction ID: 3f7b015eda3c8e60868c4b8a9616acb757c779ad642a3ac12747726c733a7c9b
Opcode Fuzzy Hash: cd2831953037b3daea578669809b73c33796d8fb2d4c8f4f86c532d8147db01f
Instruction Fuzzy Hash: 20E11682F2A71184FF736064C5D055D9542DF93781F328B3BDA6A728D43B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404479, Relevance: 1.7, APIs: 1, Instructions: 484memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b0d4f6b1604ef40d0f86149784dc17158112944efb75a33a0978f3f4dd4c7896
Instruction ID: 85f6ca827c839d81d557d73eac3f1d19528fe3fbb56170e7353194a392ca478a
Opcode Fuzzy Hash: b0d4f6b1604ef40d0f86149784dc17158112944efb75a33a0978f3f4dd4c7896
Instruction Fuzzy Hash: 1FD11682F2A71184FF736024C5D055D9542DF93781F328B3BDA6A728D53B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004044BE, Relevance: 1.7, APIs: 1, Instructions: 470memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 70f1adb0e31045b806c07e03f2b7c4060b79521bf3fcc55b2cac5321a5e2a9da
Instruction ID: 5867298b287420636473d5f02c43cbc78028eabd146bbadf823b767c56e3f78b
Opcode Fuzzy Hash: 70f1adb0e31045b806c07e03f2b7c4060b79521bf3fcc55b2cac5321a5e2a9da
Instruction Fuzzy Hash: 5AD10682F2A71184FF736024C5D055D9542DF93785F328B3BDA6A729D03B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 00404508, Relevance: 1.7, APIs: 1, Instructions: 462memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7c4b710e8487db70788bce1336ae461cfb3c3acd3702fd16291519267497311a
Instruction ID: bbc401cfa03b7f535c383090e8d6372675c601a4303010dea63911edc79486bd
Opcode Fuzzy Hash: 7c4b710e8487db70788bce1336ae461cfb3c3acd3702fd16291519267497311a
Instruction Fuzzy Hash: E1D10482F2A71184FF736024C6D055D9542DF93781F328B3BDA2A729D03B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 0040454C, Relevance: 1.7, APIs: 1, Instructions: 461memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a49625aac0e90f3ac91dcbe9404d300d94dbb1f4530fa96f235b3b9d187282fc
Instruction ID: ca44b1e3f41f9a25b96c2acfffaf404ed41b039103bc2d96528219ab950082d2
Opcode Fuzzy Hash: a49625aac0e90f3ac91dcbe9404d300d94dbb1f4530fa96f235b3b9d187282fc
Instruction Fuzzy Hash: EAC1F382F2A71184FF736024C6D055D9542DF97781F328B3BDA2A728D43B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 00404595, Relevance: 1.7, APIs: 1, Instructions: 449memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2653e874123fec4c5e89bfc2052d5ff85d8467cc4d429e680c0fd092f18c52ec
Instruction ID: a7ea9d6c2d52b9a47e5641bb1ede7676c672bd68cb446c2f54875c160ecd49b9
Opcode Fuzzy Hash: 2653e874123fec4c5e89bfc2052d5ff85d8467cc4d429e680c0fd092f18c52ec
Instruction Fuzzy Hash: C8C1E182F2A71184FF736064C5D055D9542DF93781F328B3BDA2A728D43B2F4ACA189B

Uniqueness

Uniqueness Score: -1.00%

Function 004045DA, Relevance: 1.7, APIs: 1, Instructions: 442
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004045DA() {
				void* _t9;
				void* _t11;
				void* _t12;
				intOrPtr _t17;
				intOrPtr _t23;

				asm("ror ecx, 0xb4");
				_t1 = _t11 + 0x71;
				 *_t1 =  *((intOrPtr*)(_t11 + 0x71)) + _t12;
				_t17 =  *_t1;
				if(_t17 >= 0) {
					L17:
					asm("stc");
					asm("cmpsd");
					L18:
					if (_t23 < 0) goto L19;
					L19:
					L20:
					asm("out dx, eax");
					asm("pmulhw xmm4, xmm7");
					L21:
					asm("pmulhw mm4, mm7");
					L22:
					asm("out 0xf, eax");
					L23:
					asm("loope 0xffffffe1");
					L24:
					asm("fdivrp st5, st0");
					L25:
					asm("ftst");
					L26:
					asm("pcmpgtw xmm4, xmm0");
					L27:
					asm("loopne 0xffffffdc");
					L28:
					asm("fldpi");
					L29:
					asm("fprem1");
					L15:
					 *((intOrPtr*)(_t11 + 0x2bdffb)) =  *((intOrPtr*)(_t11 + 0x2bdffb)) + _t9;
					 *((intOrPtr*)(_t11 + 0xe4eafe)) =  *((intOrPtr*)(_t11 + 0xe4eafe)) + _t9;
					_t7 = _t11 + 0x72a7f9;
					 *_t7 =  *((intOrPtr*)(_t11 + 0x72a7f9)) + _t9;
					_t23 =  *_t7;
					goto L17;
				}
				if(_t17 >= 0) {
					goto L18;
				}
				if(_t17 >= 0) {
					goto L19;
				}
				if(_t17 >= 0) {
					goto L20;
				}
				if(_t17 >= 0) {
					goto L21;
				}
				if(_t17 >= 0) {
					goto L22;
				}
				if(_t17 >= 0) {
					goto L23;
				}
				if(_t17 >= 0) {
					goto L24;
				}
				if(_t17 >= 0) {
					goto L25;
				}
				if(_t17 >= 0) {
					goto L26;
				}
				if(_t17 >= 0) {
					goto L27;
				}
				if(_t17 >= 0) {
					goto L28;
				}
				if(_t17 >= 0) {
					goto L29;
				}
				asm("wait");
				asm("fucom st1");
				asm("emms");
				asm("lfence");
				asm("fpatan");
				asm("por xmm4, xmm0");
				goto L15;
			}

0x004045da
0x004045dd
0x004045dd
0x004045dd
0x004045e0
0x00404653
0x00404653
0x00404654
0x00404655
0x00404655
0x00404657
0x00404659
0x00404659
0x0040465a
0x0040465b
0x0040465b
0x0040465d
0x0040465d
0x0040465f
0x0040465f
0x00404661
0x00404661
0x00404663
0x00404663
0x00404665
0x00404665
0x00404667
0x00404667
0x00404669
0x00404669
0x0040466b
0x0040466b
0x00404645
0x00404645
0x0040464b
0x00404651
0x00404651
0x00404651
0x00000000
0x00404651
0x004045e2
0x00000000
0x00000000
0x004045e4
0x00000000
0x00000000
0x004045e6
0x00000000
0x00000000
0x004045e8
0x00000000
0x00000000
0x004045ea
0x00000000
0x00000000
0x004045ec
0x00000000
0x00000000
0x004045ee
0x00000000
0x00000000
0x004045f0
0x00000000
0x00000000
0x004045f2
0x00000000
0x00000000
0x004045f4
0x00000000
0x00000000
0x004045f6
0x00000000
0x00000000
0x004045f8
0x00000000
0x00000000
0x00404611
0x00404612
0x00404614
0x00404616
0x00404619
0x0040461b
0x00000000

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9215d3111b07a3b81bdc7994caa0a9740226bc6e807da960a4e192031fdca268
Instruction ID: 1232932dd703f17ef7c557b9aec34db7920b8257b8ca9fc0376c248b64c5cd1f
Opcode Fuzzy Hash: 9215d3111b07a3b81bdc7994caa0a9740226bc6e807da960a4e192031fdca268
Instruction Fuzzy Hash: 37D1F082F2A71184FFB32064C5D056D5542DFE3791F328B3BDA2A728D0762F4ACA159B

Uniqueness

Uniqueness Score: -1.00%

Function 00404622, Relevance: 1.7, APIs: 1, Instructions: 430
memoryCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00404622() {
				void* _t61;
				void* _t63;
				void* _t66;
				intOrPtr _t96;

				asm("aaa");
				_t61 = _t66;
				while(1) {
					 *((intOrPtr*)(_t63 + 0x2bdffb)) =  *((intOrPtr*)(_t63 + 0x2bdffb)) + _t61;
					 *((intOrPtr*)(_t63 + 0xe4eafe)) =  *((intOrPtr*)(_t63 + 0xe4eafe)) + _t61;
					_t32 = _t63 + 0x72a7f9;
					 *_t32 =  *((intOrPtr*)(_t63 + 0x72a7f9)) + _t61;
					_t96 =  *_t32;
					asm("stc");
					asm("cmpsd");
					if (_t96 < 0) goto L6;
					asm("out dx, eax");
					asm("pmulhw xmm4, xmm7");
					asm("pmulhw mm4, mm7");
					asm("out 0xf, eax");
					asm("loope 0xffffffe1");
					asm("fdivrp st5, st0");
					asm("ftst");
					asm("pcmpgtw xmm4, xmm0");
					asm("loopne 0xffffffdc");
					asm("fldpi");
					asm("fprem1");
				}
			}

0x00404624
0x0040463f
0x00404645
0x00404645
0x0040464b
0x00404651
0x00404651
0x00404651
0x00404653
0x00404654
0x00404655
0x00404659
0x0040465a
0x0040465b
0x0040465d
0x0040465f
0x00404661
0x00404663
0x00404665
0x00404667
0x00404669
0x0040466b
0x0040466b

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 89963a62cbf639d0e7ebf3bc8c2c262c5458eb740082013889e0c5c4f5325407
Instruction ID: 96ec04131210c26c271e6085180fd7b6c0eec921e27af229bdabd66e829e1838
Opcode Fuzzy Hash: 89963a62cbf639d0e7ebf3bc8c2c262c5458eb740082013889e0c5c4f5325407
Instruction Fuzzy Hash: 32C1F482F2A71184FF736064C5D056D9542DF93785F328B3BDA2A718D43B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 004046BA, Relevance: 1.6, APIs: 1, Instructions: 399memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a1f3d53cf8757da33776f5911870263a503e2d76cb770c9007ab596025747751
Instruction ID: cff452715d97a344244fc5ddd203db9456ae0eb7e50125a653d294d3aed645ec
Opcode Fuzzy Hash: a1f3d53cf8757da33776f5911870263a503e2d76cb770c9007ab596025747751
Instruction Fuzzy Hash: 91B1F482F2A71184FFB36064C5D055D9542DF97781F328B3BDA2A718D43B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 00404702, Relevance: 1.6, APIs: 1, Instructions: 389memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0a0c8e5e40c0706cd41d0321340ccebeb4863e4da96321ef9a25b0ff20ba018f
Instruction ID: 881731a9677bea202f9ddd4787f634ba9598208543154c56afd65af1f7725e4e
Opcode Fuzzy Hash: 0a0c8e5e40c0706cd41d0321340ccebeb4863e4da96321ef9a25b0ff20ba018f
Instruction Fuzzy Hash: ABB11386F2A71184FF732064C1D055D9942DFD3781F328B7BDA6A728D1362F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 00404752, Relevance: 1.6, APIs: 1, Instructions: 376memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e01f0ff1509f93b98f2f20cf7f2126aa2458d4729154c895694da485910c7f25
Instruction ID: 6679b3bd6112a01be68d501d49b3754a4791d342fe75c79bc7d27481c1da3337
Opcode Fuzzy Hash: e01f0ff1509f93b98f2f20cf7f2126aa2458d4729154c895694da485910c7f25
Instruction Fuzzy Hash: 4BA10582F2A71184FF732064C5D056D9542DF97785F328B3BDA2A728D43B2F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 020D465E, Relevance: 1.6, APIs: 1, Instructions: 110processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 7a8a8a4c95017102c8e49c03a116e149cd18f1109732b8604f8fcf6e0d64e535
Instruction ID: b994226b906e9504d02ba1fcc8c3244e894e87cbab4a2e9839ca6395555dac36
Opcode Fuzzy Hash: 7a8a8a4c95017102c8e49c03a116e149cd18f1109732b8604f8fcf6e0d64e535
Instruction Fuzzy Hash: 05314830647785CEEF6A5E24C8A87AC36F2BF06754F994229C996D7490D338C4C4DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00404836, Relevance: 1.6, APIs: 1, Instructions: 357memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 026a85ab3c0ed463ed12c49cf2952ce56ac930a70bd8ca9a55fa6e11425c53f7
Instruction ID: 59fa85c3b42df8fbcd1d3843e8ee51854fb8044a40cfaa6e50fa1330f4f22197
Opcode Fuzzy Hash: 026a85ab3c0ed463ed12c49cf2952ce56ac930a70bd8ca9a55fa6e11425c53f7
Instruction Fuzzy Hash: 1EA11386F2A75188FB732064C1D006E5542DFD3781F32CB3BDA2A719D5263F4ACA159B

Uniqueness

Uniqueness Score: -1.00%

Function 020D4679, Relevance: 1.6, APIs: 1, Instructions: 106processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: b51037fcb008b7b6c1d1ea91aa891539620613d5da725c33c38ef897190d8d91
Instruction ID: 34ccd7a018198ce3d258313f3d2746bd4c35e552aaf8c1a3e41d738f3179fc90
Opcode Fuzzy Hash: b51037fcb008b7b6c1d1ea91aa891539620613d5da725c33c38ef897190d8d91
Instruction Fuzzy Hash: A9310230A47382CEEF5A9E24C8687AC37F1FF0A755F98416AC892DB491E33594C5DB42

Uniqueness

Uniqueness Score: -1.00%

Function 00404799, Relevance: 1.6, APIs: 1, Instructions: 352memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fd6ee0a01d6cf0ba79662e7c4d9b48544ab2947bd7247264422f15e6194bbbc2
Instruction ID: d168e344d864dc773c369b598f7f3ef4a08a276b6b5cb9e257c24a843322899e
Opcode Fuzzy Hash: fd6ee0a01d6cf0ba79662e7c4d9b48544ab2947bd7247264422f15e6194bbbc2
Instruction Fuzzy Hash: 87A11482F2A71184FF732064C5D016D9542DFD7781F328B3BDA6A728E4272F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 020D4691, Relevance: 1.6, APIs: 1, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: bb514306ee07d55891f33e6f199316af2c8943cafce96e85dd59c23143cac7aa
Instruction ID: 7ebf82606232541b3ec8ea5648e8034ad8f8cc85e6e35e6c8a209835f7dc6ca2
Opcode Fuzzy Hash: bb514306ee07d55891f33e6f199316af2c8943cafce96e85dd59c23143cac7aa
Instruction Fuzzy Hash: 30310230A073C5CEEF2A9E24C8687AC37F1FF16751F89016AC8969B4A1D33594C5DB42

Uniqueness

Uniqueness Score: -1.00%

Function 004047EA, Relevance: 1.6, APIs: 1, Instructions: 350memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 58e2a0e1f03f1ffd9b6e577ee18e3fe9d86f446b86ca08098e73b53aa366b64f
Instruction ID: 342646e4aac166afe5adc4996f36e262f034f16bca311383d140a5f865ca896a
Opcode Fuzzy Hash: 58e2a0e1f03f1ffd9b6e577ee18e3fe9d86f446b86ca08098e73b53aa366b64f
Instruction Fuzzy Hash: 39A10586F2A71184FF732064C6D016D9542DF97785F328B3BDA2A718E4272F4ACA149B

Uniqueness

Uniqueness Score: -1.00%

Function 020D46B3, Relevance: 1.6, APIs: 1, Instructions: 96processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 6759bc1af76d700b269fc6d99e1d179089bfc704dafd6749d22be275b78a4f62
Instruction ID: 1e5f2fd3d45b5cac640c11969e180d20f149d934a83e03f22432cbec8810db9e
Opcode Fuzzy Hash: 6759bc1af76d700b269fc6d99e1d179089bfc704dafd6749d22be275b78a4f62
Instruction Fuzzy Hash: 743120306473C6CEEF2A9E24C8687AC36F1FF06751F884169C896DB490D33594C5DB42

Uniqueness

Uniqueness Score: -1.00%

Function 020D46C7, Relevance: 1.6, APIs: 1, Instructions: 95processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 89308b7b74b6f6ba09c3076a07ad319c951d17bc089fe83f58c1e46e8019630c
Instruction ID: 09aafe5811970bf095e99daf37fad2cd559b171892e57a5c765f9416e576d7e7
Opcode Fuzzy Hash: 89308b7b74b6f6ba09c3076a07ad319c951d17bc089fe83f58c1e46e8019630c
Instruction Fuzzy Hash: EF312030646381CEEF1A9E24C8A87AC76F1FF0A751F884169C896DB4A1E33594C5DB41

Uniqueness

Uniqueness Score: -1.00%

Function 020D46E2, Relevance: 1.6, APIs: 1, Instructions: 90processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 90b8a101c18d22d240b089a5977de606fd1f8c9bfabbd67c47e869c0f53fd47e
Instruction ID: c2fb9d95606d0cf57853045acb3a90605086876d619a00f6f6465fac31704eca
Opcode Fuzzy Hash: 90b8a101c18d22d240b089a5977de606fd1f8c9bfabbd67c47e869c0f53fd47e
Instruction Fuzzy Hash: 78313030A463C6CEEF2A9E24C8687AC36F1FF0A751F894169C895DB4A1E33494C5DB41

Uniqueness

Uniqueness Score: -1.00%

Function 020D472B, Relevance: 1.6, APIs: 1, Instructions: 82processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 27286573dbc8f0a8a7c902962adafc417daf5d0f81670668c3892b6dd642721c
Instruction ID: fd503e0de2e7eaaf8f8bdb8c3807b3af5d46e1c34193dd880676eb95ff18ec1c
Opcode Fuzzy Hash: 27286573dbc8f0a8a7c902962adafc417daf5d0f81670668c3892b6dd642721c
Instruction Fuzzy Hash: 50213130A423C5CEEF6A9E24C86CBAC76F1EF0A361F894169C895DB491D37494C6DB81

Uniqueness

Uniqueness Score: -1.00%

Function 020D4725, Relevance: 1.6, APIs: 1, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 020D4817

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: a07ef44834d8f05bcce651cec52f74d1b5bbdfb235572daab229324c3b8a9c23
Instruction ID: 47643d28e60bc698d334b298e7e07adbcfff45ae395fc70c42459181bd68bf7c
Opcode Fuzzy Hash: a07ef44834d8f05bcce651cec52f74d1b5bbdfb235572daab229324c3b8a9c23
Instruction Fuzzy Hash: A62102306437C5CEEF6A8E24C86C7AC76F2AF06765F894159C8A4DB4A1C37494C5DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00404893, Relevance: 1.5, APIs: 1, Instructions: 296memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(FFFFFFFB,00009000,-00001BA0,00000034), ref: 004048FA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c7d3ee40a92c024996d9d08fda36c9d002df5cce4ae7c9ca5a999c49965c51a8
Instruction ID: b3869d5786985ebff7324e064ee9d559e3a442936c32070743bdd12556ed247b
Opcode Fuzzy Hash: c7d3ee40a92c024996d9d08fda36c9d002df5cce4ae7c9ca5a999c49965c51a8
Instruction Fuzzy Hash: F3911582F2A71244FF732064C5D056D9502DFD7781F328B3BDA2A728E5273E46CA159B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020D4575, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841aa8f26eb4835f5faa371cbc6fe0cebaa010514da8bc509581f2e3ef998be6
Instruction ID: 9c9bfc50f2cff563556e9e939fa64e9303db4a1b7705a045a36bfe88e19af9ab
Opcode Fuzzy Hash: 841aa8f26eb4835f5faa371cbc6fe0cebaa010514da8bc509581f2e3ef998be6
Instruction Fuzzy Hash: 56219C8ADA6E802BE3170A540577CE3FFF2E9652653654D4CD9C3E615EDB07C903834A

Uniqueness

Uniqueness Score: -1.00%

Function 020D037D, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a92a2b6808fa05d89f12636ec866d90434bd1b8998144b863b5e5ef3427627
Instruction ID: b8d8b23e56b262d6e4f1928d3742b60f2c90dabe30a860d80ea1cdd79aa44646
Opcode Fuzzy Hash: d3a92a2b6808fa05d89f12636ec866d90434bd1b8998144b863b5e5ef3427627
Instruction Fuzzy Hash: 18D02E0980F730DBDA2B0AAC04CA6E8072F8224715FE80A14E0DDA0803A7A0D84AA380

Uniqueness

Uniqueness Score: -1.00%

Function 020D1BCA, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1d17717b3821631b976ef6e38c3572c3856baa81e66cecd20d4a5036e69b5b
Instruction ID: e2b13a17cf3b3259c29edf6e844959e996611fed172c6dfcbf5cd46bde8bf418
Opcode Fuzzy Hash: ec1d17717b3821631b976ef6e38c3572c3856baa81e66cecd20d4a5036e69b5b
Instruction Fuzzy Hash: C8E0C24B386AA09BC3130A7854520C5BF62EF7E2843540D8ED5C1EB255DA6AE14197A1

Uniqueness

Uniqueness Score: -1.00%

Function 020D03A3, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.537459009.00000000020D0000.00000040.00000001.sdmp, Offset: 020D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4973be51ad449a28abe734ca784e939fdd40351cbae47674c3028c8830b6293d
Instruction ID: a53607a1137fb2a323a2c4c93720f0d71ddea84cb60853c057ecc3ec133210f8
Opcode Fuzzy Hash: 4973be51ad449a28abe734ca784e939fdd40351cbae47674c3028c8830b6293d
Instruction Fuzzy Hash: B3D0124196FB51E6D3752E3C98E17D4B7969B25678F4C0B05C8F5400C2D7275A4B8245

Uniqueness

Uniqueness Score: -1.00%

Function 0040C8AA, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0040C8AA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				short _v48;
				signed int _v52;
				void* _v56;
				char _v60;
				intOrPtr _v68;
				char _v76;
				void* _v80;
				intOrPtr* _v84;
				signed int _v88;
				void* _v92;
				signed int _v96;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				intOrPtr* _v120;
				signed int _v124;
				signed int _v128;
				char* _t81;
				signed int _t85;
				signed int _t88;
				short _t92;
				signed int _t98;
				signed int _t103;
				void* _t119;
				void* _t121;
				intOrPtr _t122;

				_t122 = _t121 - 0xc;
				 *[fs:0x0] = _t122;
				L00401310();
				_v16 = _t122;
				_v12 = 0x4011c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x68,  *[fs:0x0], 0x401316, _t119);
				L0040147E();
				if( *0x413010 != 0) {
					_v112 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v112 = 0x413010;
				}
				_t81 =  &_v60;
				L00401496();
				_v84 = _t81;
				_t85 =  *((intOrPtr*)( *_v84 + 0x158))(_v84,  &_v52, _t81,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x318))( *_v112));
				asm("fclex");
				_v88 = _t85;
				if(_v88 >= 0) {
					_v116 = _v116 & 0x00000000;
				} else {
					_push(0x158);
					_push(0x4028d4);
					_push(_v84);
					_push(_v88);
					L0040148A();
					_v116 = _t85;
				}
				_v108 = _v52;
				_v52 = _v52 & 0x00000000;
				_v68 = _v108;
				_v76 = 8;
				_t88 =  &_v76;
				_push(_t88);
				L00401418();
				L00401460();
				_push(_t88);
				_push(L"String");
				L0040142A();
				asm("sbb eax, eax");
				_v92 =  ~( ~( ~_t88));
				L00401478();
				L00401484();
				L0040146C();
				_t92 = _v92;
				if(_t92 != 0) {
					if( *0x41333c != 0) {
						_v120 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v120 = 0x41333c;
					}
					_v84 =  *_v120;
					_t98 =  *((intOrPtr*)( *_v84 + 0x1c))(_v84,  &_v60);
					asm("fclex");
					_v88 = _t98;
					if(_v88 >= 0) {
						_v124 = _v124 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a2c);
						_push(_v84);
						_push(_v88);
						L0040148A();
						_v124 = _t98;
					}
					_v92 = _v60;
					_t103 =  *((intOrPtr*)( *_v92 + 0x64))(_v92, 1,  &_v80);
					asm("fclex");
					_v96 = _t103;
					if(_v96 >= 0) {
						_v128 = _v128 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402a78);
						_push(_v92);
						_push(_v96);
						L0040148A();
						_v128 = _t103;
					}
					_t92 = _v80;
					_v48 = _t92;
					L00401484();
				}
				_push(E0040CAC2);
				L0040146C();
				return _t92;
			}

0x0040c8ad
0x0040c8bc
0x0040c8c6
0x0040c8ce
0x0040c8d1
0x0040c8d8
0x0040c8e7
0x0040c8f0
0x0040c8fc
0x0040c916
0x0040c8fe
0x0040c8fe
0x0040c903
0x0040c908
0x0040c90d
0x0040c90d
0x0040c931
0x0040c935
0x0040c93a
0x0040c949
0x0040c94f
0x0040c951
0x0040c958
0x0040c974
0x0040c95a
0x0040c95a
0x0040c95f
0x0040c964
0x0040c967
0x0040c96a
0x0040c96f
0x0040c96f
0x0040c97b
0x0040c97e
0x0040c985
0x0040c988
0x0040c98f
0x0040c992
0x0040c993
0x0040c99d
0x0040c9a2
0x0040c9a3
0x0040c9a8
0x0040c9af
0x0040c9b5
0x0040c9bc
0x0040c9c4
0x0040c9cc
0x0040c9d1
0x0040c9d7
0x0040c9e4
0x0040c9fe
0x0040c9e6
0x0040c9e6
0x0040c9eb
0x0040c9f0
0x0040c9f5
0x0040c9f5
0x0040ca0a
0x0040ca19
0x0040ca1c
0x0040ca1e
0x0040ca25
0x0040ca3e
0x0040ca27
0x0040ca27
0x0040ca29
0x0040ca2e
0x0040ca31
0x0040ca34
0x0040ca39
0x0040ca39
0x0040ca45
0x0040ca56
0x0040ca59
0x0040ca5b
0x0040ca62
0x0040ca7b
0x0040ca64
0x0040ca64
0x0040ca66
0x0040ca6b
0x0040ca6e
0x0040ca71
0x0040ca76
0x0040ca76
0x0040ca7f
0x0040ca83
0x0040ca8a
0x0040ca8a
0x0040ca8f
0x0040cabc
0x0040cac1

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C8C6
__vbaVarDup.MSVBVM60(?,?,?,?,00401316), ref: 0040C8F0
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040C908
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C935
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000158), ref: 0040C96A
#591.MSVBVM60(00000008), ref: 0040C993
__vbaStrMove.MSVBVM60(00000008), ref: 0040C99D
__vbaStrCmp.MSVBVM60(String,00000000,00000008), ref: 0040C9A8
__vbaFreeStr.MSVBVM60(String,00000000,00000008), ref: 0040C9BC
__vbaFreeObj.MSVBVM60(String,00000000,00000008), ref: 0040C9C4
__vbaFreeVar.MSVBVM60(String,00000000,00000008), ref: 0040C9CC
__vbaNew2.MSVBVM60(00402A3C,0041333C,String,00000000,00000008), ref: 0040C9F0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A2C,0000001C), ref: 0040CA34
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A78,00000064), ref: 0040CA71
__vbaFreeObj.MSVBVM60(00000000,?,00402A78,00000064), ref: 0040CA8A
__vbaFreeVar.MSVBVM60(0040CAC2,String,00000000,00000008), ref: 0040CABC

Strings

String, xrefs: 0040C9A3
<3A, xrefs: 0040C9FE

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#591ChkstkMove
String ID: <3A$String
API String ID: 3521217132-1894530839
Opcode ID: 2ce896b7d1734bec42557ec83a4b961f368b14f2efce749cd6d6e9df71df0392
Instruction ID: 9918ba27f5400eef207ddc4bca55bf17f3c338ad0b6a0188f1d04044af395c3b
Opcode Fuzzy Hash: 2ce896b7d1734bec42557ec83a4b961f368b14f2efce749cd6d6e9df71df0392
Instruction Fuzzy Hash: 1251C570A40248EFCB10EFE5C985BDDBBB4BF08709F20812AE401BB2A5DB785945DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00411B9C, Relevance: 25.7, APIs: 17, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00411B9C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				signed int _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				signed int _v56;
				char _v72;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				char _v104;
				char _v120;
				intOrPtr* _v124;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				intOrPtr* _v172;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				char* _t93;
				char* _t97;
				signed int _t101;
				char* _t105;
				signed int _t109;
				char* _t115;
				signed int _t119;
				signed int _t122;
				char* _t126;
				void* _t146;
				void* _t148;
				intOrPtr _t149;

				_t149 = _t148 - 0xc;
				 *[fs:0x0] = _t149;
				L00401310();
				_v16 = _t149;
				_v12 = 0x4012a8;
				_v8 = 0;
				_t93 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401316, _t146);
				_push(0x402acc);
				L004013C4();
				if(_t93 != 1) {
					if( *0x413010 != 0) {
						_v164 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v164 = 0x413010;
					}
					_t97 =  &_v40;
					L00401496();
					_v140 = _t97;
					_t101 =  *((intOrPtr*)( *_v140 + 0xf8))(_v140,  &_v44, _t97,  *((intOrPtr*)( *((intOrPtr*)( *_v164)) + 0x304))( *_v164));
					asm("fclex");
					_v144 = _t101;
					if(_v144 >= 0) {
						_v168 = _v168 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x40290c);
						_push(_v140);
						_push(_v144);
						L0040148A();
						_v168 = _t101;
					}
					if( *0x413010 != 0) {
						_v172 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v172 = 0x413010;
					}
					_t105 =  &_v48;
					L00401496();
					_v132 = _t105;
					_t109 =  *((intOrPtr*)( *_v132 + 0x1e0))(_v132,  &_v36, _t105,  *((intOrPtr*)( *((intOrPtr*)( *_v172)) + 0x314))( *_v172));
					asm("fclex");
					_v136 = _t109;
					if(_v136 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x4028d4);
						_push(_v132);
						_push(_v136);
						L0040148A();
						_v176 = _t109;
					}
					_v156 = _v36;
					_v36 = _v36 & 0x00000000;
					_v96 = _v156;
					_v104 = 8;
					if( *0x413010 != 0) {
						_v180 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v180 = 0x413010;
					}
					_t115 =  &_v52;
					L00401496();
					_v124 = _t115;
					_t119 =  *((intOrPtr*)( *_v124 + 0x1b8))(_v124,  &_v56, _t115,  *((intOrPtr*)( *((intOrPtr*)( *_v180)) + 0x310))( *_v180));
					asm("fclex");
					_v128 = _t119;
					if(_v128 >= 0) {
						_v184 = _v184 & 0x00000000;
					} else {
						_push(0x1b8);
						_push(0x4028d4);
						_push(_v124);
						_push(_v128);
						L0040148A();
						_v184 = _t119;
					}
					_v160 = _v56;
					_v56 = _v56 & 0x00000000;
					_v80 = _v160;
					_v88 = 9;
					_push(0);
					_push(0);
					_push(_v44);
					_t122 =  &_v72;
					_push(_t122);
					L00401442();
					_push(_t122);
					L0040143C();
					_push( ~_t122);
					_push( &_v104);
					_push( &_v88);
					_push(0);
					_t126 =  &_v120;
					_push(_t126);
					L004013BE();
					_push(_t126);
					L0040143C();
					_v28 = _t126;
					_push( &_v52);
					_push( &_v48);
					_push( &_v44);
					_push( &_v40);
					_push(4);
					L00401472();
					_push( &_v120);
					_push( &_v104);
					_push( &_v88);
					_t93 =  &_v72;
					_push(_t93);
					_push(4);
					L00401454();
				}
				_push(0x411ebe);
				return _t93;
			}

0x00411b9f
0x00411bae
0x00411bba
0x00411bc2
0x00411bc5
0x00411bcc
0x00411bdb
0x00411bde
0x00411be3
0x00411bec
0x00411bf9
0x00411c16
0x00411bfb
0x00411bfb
0x00411c00
0x00411c05
0x00411c0a
0x00411c0a
0x00411c3a
0x00411c3e
0x00411c43
0x00411c5b
0x00411c61
0x00411c63
0x00411c70
0x00411c95
0x00411c72
0x00411c72
0x00411c77
0x00411c7c
0x00411c82
0x00411c88
0x00411c8d
0x00411c8d
0x00411ca3
0x00411cc0
0x00411ca5
0x00411ca5
0x00411caa
0x00411caf
0x00411cb4
0x00411cb4
0x00411ce4
0x00411ce8
0x00411ced
0x00411cfc
0x00411d02
0x00411d04
0x00411d11
0x00411d33
0x00411d13
0x00411d13
0x00411d18
0x00411d1d
0x00411d20
0x00411d26
0x00411d2b
0x00411d2b
0x00411d3d
0x00411d43
0x00411d4d
0x00411d50
0x00411d5e
0x00411d7b
0x00411d60
0x00411d60
0x00411d65
0x00411d6a
0x00411d6f
0x00411d6f
0x00411d9f
0x00411da3
0x00411da8
0x00411db7
0x00411dbd
0x00411dbf
0x00411dc6
0x00411de5
0x00411dc8
0x00411dc8
0x00411dcd
0x00411dd2
0x00411dd5
0x00411dd8
0x00411ddd
0x00411ddd
0x00411def
0x00411df5
0x00411dff
0x00411e02
0x00411e09
0x00411e0b
0x00411e0d
0x00411e10
0x00411e13
0x00411e14
0x00411e1c
0x00411e1d
0x00411e24
0x00411e28
0x00411e2c
0x00411e2d
0x00411e2f
0x00411e32
0x00411e33
0x00411e38
0x00411e39
0x00411e3e
0x00411e44
0x00411e48
0x00411e4c
0x00411e50
0x00411e51
0x00411e53
0x00411e5e
0x00411e62
0x00411e66
0x00411e67
0x00411e6a
0x00411e6b
0x00411e6d
0x00411e72
0x00411e75
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 00411BBA
__vbaI2Str.MSVBVM60(00402ACC,?,?,?,?,00401316), ref: 00411BE3
__vbaNew2.MSVBVM60(00401CC8,00413010,00402ACC,?,?,?,?,00401316), ref: 00411C05
__vbaObjSet.MSVBVM60(00402ACC,00000000), ref: 00411C3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040290C,000000F8), ref: 00411C88
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 00411CAF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411CE8
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,000001E0), ref: 00411D26
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 00411D6A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411DA3
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,000001B8), ref: 00411DD8
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00411E14
__vbaI4Var.MSVBVM60(00000000,?,?,?,00401316), ref: 00411E1D
__vbaInStrVar.MSVBVM60(?,00000000,?,?,00000000,00000000,?,?,?,00401316), ref: 00411E33
__vbaI4Var.MSVBVM60(00000000,?,00000000,?,?,00000000,00000000,?,?,?,00401316), ref: 00411E39
__vbaFreeObjList.MSVBVM60(00000004,00000000,?,?,00000000,00000000,?,00000000,?,?,00000000,00000000,?,?,?,00401316), ref: 00411E53
__vbaFreeVarList.MSVBVM60(00000004,?,?,?,?,00000000,?,?,00000000,00000000,?,?,?,00401316), ref: 00411E6D

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$FreeList$CallChkstkLate
String ID:
API String ID: 691630307-0
Opcode ID: cc41337a654ae9d9452b74bdac37ad23eca5dc9e627e485e8d778335bb2d91e0
Instruction ID: 42d99973c186ed5d33ac97c8aaf54e014470ad2230d3fa45edbc9a7eff15588e
Opcode Fuzzy Hash: cc41337a654ae9d9452b74bdac37ad23eca5dc9e627e485e8d778335bb2d91e0
Instruction Fuzzy Hash: AA811A71A40218AFDB10DFA4C945FDEBBF8BF08304F1044AAE149B72A1DB799A849F55

Uniqueness

Uniqueness Score: -1.00%

Function 00411EE5, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00411EE5(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, char __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				char _v64;
				intOrPtr* _v68;
				signed int _v72;
				signed int _v76;
				char* _t43;
				char* _t49;
				signed int _t53;
				char* _t54;
				signed int _t57;
				intOrPtr _t70;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t70;
				_t43 = 0x38;
				L00401310();
				_v12 = _t70;
				_v8 = 0x4012c0;
				asm("fldz");
				_v40 = __fp0;
				L004013B2();
				L004013B8();
				asm("fcomp qword [0x4012b8]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					if( *0x41333c != 0) {
						_v64 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v64 = 0x41333c;
					}
					_t5 =  &_v64; // 0x41333c
					_v52 =  *((intOrPtr*)( *_t5));
					if( *0x413010 != 0) {
						_v68 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v68 = 0x413010;
					}
					_t49 =  &_v36;
					L00401496();
					_v44 = _t49;
					_t53 =  *((intOrPtr*)( *_v44 + 0xf8))(_v44,  &_v32, _t49,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x31c))( *_v68));
					asm("fclex");
					_v48 = _t53;
					if(_v48 >= 0) {
						_t23 =  &_v72;
						 *_t23 = _v72 & 0x00000000;
						__eflags =  *_t23;
					} else {
						_push(0xf8);
						_push(0x4028fc);
						_push(_v44);
						_push(_v48);
						L0040148A();
						_v72 = _t53;
					}
					L004013AC();
					_t54 =  &_v40;
					L00401496();
					_t57 =  *((intOrPtr*)( *_v52 + 0x40))(_v52, _t54, _t54, _t53, _v24, 0x402ad0, _v32);
					asm("fclex");
					_v56 = _t57;
					if(_v56 >= 0) {
						_t36 =  &_v76;
						 *_t36 = _v76 & 0x00000000;
						__eflags =  *_t36;
					} else {
						_push(0x40);
						_push(0x402a2c);
						_push(_v52);
						_push(_v56);
						L0040148A();
						_v76 = _t57;
					}
					L00401478();
					_push( &_v40);
					_t43 =  &_v36;
					_push(_t43);
					_push(2);
					L00401472();
				}
				asm("wait");
				_push(0x412077);
				L00401484();
				return _t43;
			}

0x00411eea
0x00411ef5
0x00411ef6
0x00411eff
0x00411f00
0x00411f08
0x00411f0b
0x00411f12
0x00411f16
0x00411f19
0x00411f1e
0x00411f23
0x00411f29
0x00411f2b
0x00411f2c
0x00411f39
0x00411f53
0x00411f3b
0x00411f3b
0x00411f40
0x00411f45
0x00411f4a
0x00411f4a
0x00411f5a
0x00411f5f
0x00411f69
0x00411f83
0x00411f6b
0x00411f6b
0x00411f70
0x00411f75
0x00411f7a
0x00411f7a
0x00411f9e
0x00411fa2
0x00411fa7
0x00411fb6
0x00411fbc
0x00411fbe
0x00411fc5
0x00411fe1
0x00411fe1
0x00411fe1
0x00411fc7
0x00411fc7
0x00411fcc
0x00411fd1
0x00411fd4
0x00411fd7
0x00411fdc
0x00411fdc
0x00411ff0
0x00411ff6
0x00411ffa
0x00412008
0x0041200b
0x0041200d
0x00412014
0x0041202d
0x0041202d
0x0041202d
0x00412016
0x00412016
0x00412018
0x0041201d
0x00412020
0x00412023
0x00412028
0x00412028
0x00412034
0x0041203c
0x0041203d
0x00412040
0x00412041
0x00412043
0x00412048
0x0041204b
0x0041204c
0x00412071
0x00412076

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 00411F00
#585.MSVBVM60(?,?,?,?,?,?,00401316), ref: 00411F19
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,00401316), ref: 00411F1E
__vbaNew2.MSVBVM60(00402A3C,0041333C,?,?,?,?,?,?,00401316), ref: 00411F45
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00411F75
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00411FA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028FC,000000F8), ref: 00411FD7
__vbaCastObj.MSVBVM60(?,00402AD0,?), ref: 00411FF0
__vbaObjSet.MSVBVM60(?,00000000,?,00402AD0,?), ref: 00411FFA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A2C,00000040), ref: 00412023
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401316), ref: 00412034
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00412043
__vbaFreeObj.MSVBVM60(00412077,?,?,?,?,?,?,00401316), ref: 00412071

Strings

<3A, xrefs: 00411F5A

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultNew2$#585CastChkstkList
String ID: <3A
API String ID: 3665031410-662753744
Opcode ID: 07948042cdf56270066cce435e93a5d050877486aeb0e7278e408b57efa612a0
Instruction ID: e931f6dad372237985cc0069700b2242095431e2c5734468816c78dfb53e97ec
Opcode Fuzzy Hash: 07948042cdf56270066cce435e93a5d050877486aeb0e7278e408b57efa612a0
Instruction Fuzzy Hash: 0B410970940208EFCB10EF91C945FEEBBB8FB08705F10812BF501B61B1DBB959459B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2AA, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0040C2AA(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				void* _v28;
				void* _v32;
				signed int _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				void* _v56;
				signed int _v60;
				intOrPtr* _v64;
				signed int _v68;
				signed int _v76;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed int _t47;
				char* _t51;
				signed int _t57;
				signed int _t63;
				intOrPtr _t78;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t78;
				_t47 = 0x44;
				L00401310();
				_v12 = _t78;
				_v8 = E00401160;
				_push(0x402a08);
				L00401424();
				L00401460();
				_push(_t47);
				_push(0x402a14);
				L0040142A();
				asm("sbb eax, eax");
				_v56 =  ~( ~( ~_t47));
				L00401478();
				_t51 = _v56;
				if(_t51 != 0) {
					if( *0x41333c != 0) {
						_v80 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v80 = 0x41333c;
					}
					_t9 =  &_v80; // 0x41333c
					_v56 =  *((intOrPtr*)( *_t9));
					_t57 =  *((intOrPtr*)( *_v56 + 0x4c))(_v56,  &_v32);
					asm("fclex");
					_v60 = _t57;
					if(_v60 >= 0) {
						_v84 = _v84 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x402a2c);
						_push(_v56);
						_push(_v60);
						L0040148A();
						_v84 = _t57;
					}
					_v64 = _v32;
					_v44 = 1;
					_v52 = 2;
					L00401310();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t63 =  *((intOrPtr*)( *_v64 + 0x1c))(_v64, 0x10,  &_v36);
					asm("fclex");
					_v68 = _t63;
					if(_v68 >= 0) {
						_v88 = _v88 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a4c);
						_push(_v64);
						_push(_v68);
						L0040148A();
						_v88 = _t63;
					}
					_v76 = _v36;
					_v36 = _v36 & 0x00000000;
					_push(_v76);
					_t51 =  &_v24;
					_push(_t51);
					L00401496();
					L00401484();
				}
				_push(E0040C41E);
				L00401484();
				return _t51;
			}

0x0040c2af
0x0040c2ba
0x0040c2bb
0x0040c2c4
0x0040c2c5
0x0040c2cd
0x0040c2d0
0x0040c2d7
0x0040c2dc
0x0040c2e6
0x0040c2eb
0x0040c2ec
0x0040c2f1
0x0040c2f8
0x0040c2fe
0x0040c305
0x0040c30a
0x0040c310
0x0040c31d
0x0040c337
0x0040c31f
0x0040c31f
0x0040c324
0x0040c329
0x0040c32e
0x0040c32e
0x0040c33e
0x0040c343
0x0040c352
0x0040c355
0x0040c357
0x0040c35e
0x0040c377
0x0040c360
0x0040c360
0x0040c362
0x0040c367
0x0040c36a
0x0040c36d
0x0040c372
0x0040c372
0x0040c37e
0x0040c381
0x0040c388
0x0040c396
0x0040c3a0
0x0040c3a1
0x0040c3a2
0x0040c3a3
0x0040c3ac
0x0040c3af
0x0040c3b1
0x0040c3b8
0x0040c3d1
0x0040c3ba
0x0040c3ba
0x0040c3bc
0x0040c3c1
0x0040c3c4
0x0040c3c7
0x0040c3cc
0x0040c3cc
0x0040c3d8
0x0040c3db
0x0040c3df
0x0040c3e2
0x0040c3e5
0x0040c3e6
0x0040c3ee
0x0040c3ee
0x0040c3f3
0x0040c418
0x0040c41d

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C2C5
#713.MSVBVM60(00402A08,?,?,?,?,00401316), ref: 0040C2DC
__vbaStrMove.MSVBVM60(00402A08,?,?,?,?,00401316), ref: 0040C2E6
__vbaStrCmp.MSVBVM60(00402A14,00000000,00402A08,?,?,?,?,00401316), ref: 0040C2F1
__vbaFreeStr.MSVBVM60(00402A14,00000000,00402A08,?,?,?,?,00401316), ref: 0040C305
__vbaNew2.MSVBVM60(00402A3C,0041333C,00402A14,00000000,00402A08,?,?,?,?,00401316), ref: 0040C329
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A2C,0000004C,?,?,?,?,?,?,?,?,?,00402A14,00000000,00402A08), ref: 0040C36D
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00402A14,00000000,00402A08), ref: 0040C396
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,0000001C,?,?,?,?,?,?,?,?,?,00402A14,00000000,00402A08), ref: 0040C3C7
__vbaObjSet.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00402A14,00000000,00402A08), ref: 0040C3E6
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00402A14,00000000,00402A08), ref: 0040C3EE
__vbaFreeObj.MSVBVM60(0040C41E,00402A14,00000000,00402A08,?,?,?,?,00401316), ref: 0040C418

Strings

<3A, xrefs: 0040C33E

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresult$#713MoveNew2
String ID: <3A
API String ID: 357845636-662753744
Opcode ID: 8c322d18a4e13772a4f7d5c8245c0b69768a6a485b709b9f8c59075ca75a2cc4
Instruction ID: 9239f663805147c979d49e2f0c7d15c080e390843c81cf945a3102d56a9e8fad
Opcode Fuzzy Hash: 8c322d18a4e13772a4f7d5c8245c0b69768a6a485b709b9f8c59075ca75a2cc4
Instruction Fuzzy Hash: B2412970D50209EFDF10DF91D985BEEBBB5AF04714F10812AF801B71E1DBB859458B18

Uniqueness

Uniqueness Score: -1.00%

Function 00412092, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00412092(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v80;
				intOrPtr _v88;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				void* _t44;
				char* _t48;
				signed int _t52;
				void* _t69;
				void* _t71;
				intOrPtr _t72;

				_t72 = _t71 - 0xc;
				 *[fs:0x0] = _t72;
				L00401310();
				_v16 = _t72;
				_v12 = 0x4012d0;
				_v8 = 0;
				_t44 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x6c,  *[fs:0x0], 0x401316, _t69);
				_push(2);
				_push("ABC");
				_push(0x402af0);
				_push(0);
				L004013A6();
				if(_t44 != 3) {
					if( *0x413010 != 0) {
						_v128 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v128 = 0x413010;
					}
					_t48 =  &_v36;
					L00401496();
					_v108 = _t48;
					_t52 =  *((intOrPtr*)( *_v108 + 0x148))(_v108,  &_v40, _t48,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x2fc))( *_v128));
					asm("fclex");
					_v112 = _t52;
					if(_v112 >= 0) {
						_v132 = _v132 & 0x00000000;
					} else {
						_push(0x148);
						_push(0x40290c);
						_push(_v108);
						_push(_v112);
						L0040148A();
						_v132 = _t52;
					}
					_v124 = _v40;
					_v40 = _v40 & 0x00000000;
					_v48 = _v124;
					_v56 = 9;
					_v80 = 0x2a44b0;
					_v88 = 3;
					_push(0x10);
					L00401310();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t44 = 0x10;
					L00401310();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(2);
					_push(L"rDBIlIexW47");
					_push(_v32);
					L004013A0();
					L00401484();
					L0040146C();
				}
				_push(0x412205);
				L00401484();
				return _t44;
			}

0x00412095
0x004120a4
0x004120ae
0x004120b6
0x004120b9
0x004120c0
0x004120cf
0x004120d2
0x004120d4
0x004120d9
0x004120de
0x004120e0
0x004120e8
0x004120f5
0x0041210f
0x004120f7
0x004120f7
0x004120fc
0x00412101
0x00412106
0x00412106
0x0041212a
0x0041212e
0x00412133
0x00412142
0x00412148
0x0041214a
0x00412151
0x0041216d
0x00412153
0x00412153
0x00412158
0x0041215d
0x00412160
0x00412163
0x00412168
0x00412168
0x00412174
0x00412177
0x0041217e
0x00412181
0x00412188
0x0041218f
0x00412196
0x00412199
0x004121a3
0x004121a4
0x004121a5
0x004121a6
0x004121a9
0x004121aa
0x004121b4
0x004121b5
0x004121b6
0x004121b7
0x004121b8
0x004121ba
0x004121bf
0x004121c2
0x004121cd
0x004121d5
0x004121d5
0x004121da
0x004121ff
0x00412204

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 004120AE
__vbaInStr.MSVBVM60(00000000,00402AF0,ABC,00000002,?,?,?,?,00401316), ref: 004120E0
__vbaNew2.MSVBVM60(00401CC8,00413010,00000000,00402AF0,ABC,00000002,?,?,?,?,00401316), ref: 00412101
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041212E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040290C,00000148), ref: 00412163
__vbaChkstk.MSVBVM60(00000000,?,0040290C,00000148), ref: 00412199
__vbaChkstk.MSVBVM60(00000000,?,0040290C,00000148), ref: 004121AA
__vbaLateMemCall.MSVBVM60(?,rDBIlIexW47,00000002), ref: 004121C2
__vbaFreeObj.MSVBVM60 ref: 004121CD
__vbaFreeVar.MSVBVM60 ref: 004121D5
__vbaFreeObj.MSVBVM60(00412205,00000000,00402AF0,ABC,00000002,?,?,?,?,00401316), ref: 004121FF

Strings

rDBIlIexW47, xrefs: 004121BA
ABC, xrefs: 004120D4

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CallCheckHresultLateNew2
String ID: ABC$rDBIlIexW47
API String ID: 802748602-430002389
Opcode ID: f9bdb9f84db22f4ac3fb1242efc0e1ff168d7afb3182c5a4c2839ccbb7342903
Instruction ID: 48749f4e9045e1b4a35476c6326ca2e1e29471d89acd985040c409526d0600cb
Opcode Fuzzy Hash: f9bdb9f84db22f4ac3fb1242efc0e1ff168d7afb3182c5a4c2839ccbb7342903
Instruction Fuzzy Hash: 93412971D40208EBDB10DFA5C94ABDEBBB5AF08704F20442AF501BB2A1CBB959949F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE25, Relevance: 22.6, APIs: 15, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040CE25(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v68;
				char _v88;
				signed int _v92;
				signed int _v96;
				signed int _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				signed int _t59;
				signed int _t63;
				intOrPtr _t64;
				signed int _t68;
				signed int _t72;
				void* _t90;
				intOrPtr _t92;

				 *[fs:0x0] = _t92;
				L00401310();
				_v12 = _t92;
				_v8 = 0x401208;
				L0040147E();
				_t59 =  *((intOrPtr*)( *_a4 + 0x114))(_a4, 1, __edi, __esi, __ebx, 0x60,  *[fs:0x0], 0x401316, __ecx, __ecx, _t90);
				asm("fclex");
				_v92 = _t59;
				if(_v92 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x114);
					_push(0x402640);
					_push(_a4);
					_push(_v92);
					L0040148A();
					_v104 = _t59;
				}
				_t63 =  *((intOrPtr*)( *_a4 + 0x110))(_a4,  &_v88);
				asm("fclex");
				_v92 = _t63;
				if(_v92 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x402640);
					_push(_a4);
					_push(_v92);
					L0040148A();
					_v108 = _t63;
				}
				_t64 = _v88;
				if(_t64 == _v24) {
					if( *0x413010 != 0) {
						_v112 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v112 = 0x413010;
					}
					_t68 =  &_v52;
					L00401496();
					_v92 = _t68;
					_t72 =  *((intOrPtr*)( *_v92 + 0xa0))(_v92,  &_v48, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v112)) + 0x310))( *_v112));
					asm("fclex");
					_v96 = _t72;
					if(_v96 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0xa0);
						_push(0x4028d4);
						_push(_v92);
						_push(_v96);
						L0040148A();
						_v116 = _t72;
					}
					_push(0);
					_push(_v48);
					_push( &_v68);
					L004013F4();
					_t64 = 0x10;
					L00401310();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v44);
					L004013FA();
					L00401478();
					L00401484();
					L0040146C();
				}
				_push(E0040CFD4);
				L0040146C();
				L00401484();
				return _t64;
			}

0x0040ce36
0x0040ce40
0x0040ce48
0x0040ce4b
0x0040ce58
0x0040ce67
0x0040ce6d
0x0040ce6f
0x0040ce76
0x0040ce92
0x0040ce78
0x0040ce78
0x0040ce7d
0x0040ce82
0x0040ce85
0x0040ce88
0x0040ce8d
0x0040ce8d
0x0040cea2
0x0040cea8
0x0040ceaa
0x0040ceb1
0x0040cecd
0x0040ceb3
0x0040ceb3
0x0040ceb8
0x0040cebd
0x0040cec0
0x0040cec3
0x0040cec8
0x0040cec8
0x0040ced1
0x0040ced9
0x0040cee6
0x0040cf00
0x0040cee8
0x0040cee8
0x0040ceed
0x0040cef2
0x0040cef7
0x0040cef7
0x0040cf1b
0x0040cf1f
0x0040cf24
0x0040cf33
0x0040cf39
0x0040cf3b
0x0040cf42
0x0040cf5e
0x0040cf44
0x0040cf44
0x0040cf49
0x0040cf4e
0x0040cf51
0x0040cf54
0x0040cf59
0x0040cf59
0x0040cf62
0x0040cf64
0x0040cf6a
0x0040cf6b
0x0040cf72
0x0040cf73
0x0040cf7d
0x0040cf7e
0x0040cf7f
0x0040cf80
0x0040cf81
0x0040cf83
0x0040cf86
0x0040cf8e
0x0040cf96
0x0040cf9e
0x0040cf9e
0x0040cfa3
0x0040cfc6
0x0040cfce
0x0040cfd3

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040CE40
__vbaVarDup.MSVBVM60(?,?,?,?,00401316), ref: 0040CE58
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402640,00000114), ref: 0040CE88
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402640,00000110), ref: 0040CEC3
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040CEF2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CF1F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004028D4,000000A0), ref: 0040CF54
#716.MSVBVM60(?,?,00000000), ref: 0040CF6B
__vbaChkstk.MSVBVM60(?,?,00000000), ref: 0040CF73
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,00000000), ref: 0040CF86
__vbaFreeStr.MSVBVM60(?,00000000,?,?,00000000), ref: 0040CF8E
__vbaFreeObj.MSVBVM60(?,00000000,?,?,00000000), ref: 0040CF96
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000), ref: 0040CF9E
__vbaFreeVar.MSVBVM60(0040CFD4), ref: 0040CFC6
__vbaFreeObj.MSVBVM60(0040CFD4), ref: 0040CFCE

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Chkstk$#716LateNew2
String ID:
API String ID: 2341781037-0
Opcode ID: 316f475811cc2713880a317cbfb9686919397ee31db6537c9a843a8b8749aae9
Instruction ID: 73c7ae9e41fa3ac36580b2eb247502caaddb883a140b5b3b0c8c6515dbab0c44
Opcode Fuzzy Hash: 316f475811cc2713880a317cbfb9686919397ee31db6537c9a843a8b8749aae9
Instruction Fuzzy Hash: F541F671900208EFDB00EFA1C886BDDBBB5BF08704F20442AF505BB1E1D7B96985DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1E5, Relevance: 19.6, APIs: 13, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040D1E5(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v44;
				char _v52;
				char _v56;
				intOrPtr* _v60;
				signed int _v64;
				short _v68;
				signed int _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				void* _t60;
				char* _t61;
				signed int _t65;
				char* _t69;
				char* _t73;
				signed int _t77;
				void* _t92;
				void* _t94;
				intOrPtr _t95;

				_t95 = _t94 - 0xc;
				 *[fs:0x0] = _t95;
				L00401310();
				_v16 = _t95;
				_v12 = 0x401240;
				_v8 = 0;
				_t60 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x401316, _t92);
				L004013EE();
				_t61 =  &_v36;
				L00401496();
				_v60 = _t61;
				_t65 =  *((intOrPtr*)( *_v60 + 0x1c))(_v60,  &_v56, _t61, _t60);
				asm("fclex");
				_v64 = _t65;
				if(_v64 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1c);
					_push(0x402a9c);
					_push(_v60);
					_push(_v64);
					L0040148A();
					_v84 = _t65;
				}
				_v68 =  ~(0 | _v56 != 0x00000000);
				L00401484();
				_t69 = _v68;
				if(_t69 != 0) {
					if( *0x413010 != 0) {
						_v88 = 0x413010;
					} else {
						_push(0x413010);
						_push(0x401cc8);
						L00401490();
						_v88 = 0x413010;
					}
					_t73 =  &_v36;
					L00401496();
					_v60 = _t73;
					_t77 =  *((intOrPtr*)( *_v60 + 0x48))(_v60,  &_v32, _t73,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x318))( *_v88));
					asm("fclex");
					_v64 = _t77;
					if(_v64 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x4028d4);
						_push(_v60);
						_push(_v64);
						L0040148A();
						_v92 = _t77;
					}
					_v80 = _v32;
					_v32 = _v32 & 0x00000000;
					_v44 = _v80;
					_v52 = 8;
					_t69 =  &_v52;
					_push(_t69);
					L004013E8();
					L00401460();
					L00401484();
					L0040146C();
				}
				_push(E0040D36F);
				L00401478();
				return _t69;
			}

0x0040d1e8
0x0040d1f7
0x0040d201
0x0040d209
0x0040d20c
0x0040d213
0x0040d222
0x0040d225
0x0040d22b
0x0040d22f
0x0040d234
0x0040d243
0x0040d246
0x0040d248
0x0040d24f
0x0040d268
0x0040d251
0x0040d251
0x0040d253
0x0040d258
0x0040d25b
0x0040d25e
0x0040d263
0x0040d263
0x0040d277
0x0040d27e
0x0040d283
0x0040d289
0x0040d296
0x0040d2b0
0x0040d298
0x0040d298
0x0040d29d
0x0040d2a2
0x0040d2a7
0x0040d2a7
0x0040d2cb
0x0040d2cf
0x0040d2d4
0x0040d2e3
0x0040d2e6
0x0040d2e8
0x0040d2ef
0x0040d308
0x0040d2f1
0x0040d2f1
0x0040d2f3
0x0040d2f8
0x0040d2fb
0x0040d2fe
0x0040d303
0x0040d303
0x0040d30f
0x0040d312
0x0040d319
0x0040d31c
0x0040d323
0x0040d326
0x0040d327
0x0040d331
0x0040d339
0x0040d341
0x0040d341
0x0040d346
0x0040d369
0x0040d36e

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040D201
#685.MSVBVM60(?,?,?,?,00401316), ref: 0040D225
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00401316), ref: 0040D22F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A9C,0000001C), ref: 0040D25E
__vbaFreeObj.MSVBVM60(00000000,?,00402A9C,0000001C), ref: 0040D27E
__vbaNew2.MSVBVM60(00401CC8,00413010), ref: 0040D2A2
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D2CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000048), ref: 0040D2FE
#667.MSVBVM60(00000008), ref: 0040D327
__vbaStrMove.MSVBVM60(00000008), ref: 0040D331
__vbaFreeObj.MSVBVM60(00000008), ref: 0040D339
__vbaFreeVar.MSVBVM60(00000008), ref: 0040D341
__vbaFreeStr.MSVBVM60(0040D36F), ref: 0040D369

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$#667#685ChkstkMoveNew2
String ID:
API String ID: 1825799265-0
Opcode ID: ab745a9bbe17acd8c1ccca77c075719607907047be9c25f3ced89a2bffa66ae1
Instruction ID: bdfe9b999cd333c6e14f5c247415e192160493226564fb58037942e5d835faa8
Opcode Fuzzy Hash: ab745a9bbe17acd8c1ccca77c075719607907047be9c25f3ced89a2bffa66ae1
Instruction Fuzzy Hash: 8A419271D00208AFCB00EFE5D985BDEBBB4BF08705F10846AF501BB2A1DB789949DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C528, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040C528(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* _a8, void* _a28) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v40;
				void* _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr _v64;
				char _v68;
				signed int _v72;
				signed int _t32;
				signed int _t38;
				intOrPtr _t54;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t54;
				_t32 = 0x34;
				L00401310();
				_v12 = _t54;
				_v8 = 0x401188;
				L0040147E();
				L00401466();
				_push(0x402a60);
				L0040141E();
				asm("fcomp qword [0x401180]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					if( *0x41333c != 0) {
						_v68 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v68 = 0x41333c;
					}
					_t9 =  &_v68; // 0x41333c
					_v52 =  *((intOrPtr*)( *_t9));
					_t38 =  *((intOrPtr*)( *_v52 + 0x48))(_v52, 0x13,  &_v48);
					asm("fclex");
					_v56 = _t38;
					if(_v56 >= 0) {
						_t20 =  &_v72;
						 *_t20 = _v72 & 0x00000000;
						__eflags =  *_t20;
					} else {
						_push(0x48);
						_push(0x402a2c);
						_push(_v52);
						_push(_v56);
						L0040148A();
						_v72 = _t38;
					}
					_t32 = _v48;
					_v64 = _t32;
					_v48 = _v48 & 0x00000000;
					L00401460();
				}
				asm("wait");
				_push(E0040C626);
				L00401478();
				L0040146C();
				L00401478();
				return _t32;
			}

0x0040c52d
0x0040c538
0x0040c539
0x0040c542
0x0040c543
0x0040c54b
0x0040c54e
0x0040c55b
0x0040c566
0x0040c56b
0x0040c570
0x0040c575
0x0040c57b
0x0040c57d
0x0040c57e
0x0040c587
0x0040c5a1
0x0040c589
0x0040c589
0x0040c58e
0x0040c593
0x0040c598
0x0040c598
0x0040c5a8
0x0040c5ad
0x0040c5be
0x0040c5c1
0x0040c5c3
0x0040c5ca
0x0040c5e3
0x0040c5e3
0x0040c5e3
0x0040c5cc
0x0040c5cc
0x0040c5ce
0x0040c5d3
0x0040c5d6
0x0040c5d9
0x0040c5de
0x0040c5de
0x0040c5e7
0x0040c5ea
0x0040c5ed
0x0040c5f7
0x0040c5f7
0x0040c5fc
0x0040c5fd
0x0040c610
0x0040c618
0x0040c620
0x0040c625

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C543
__vbaVarDup.MSVBVM60(?,?,?,?,00401316), ref: 0040C55B
__vbaStrCopy.MSVBVM60(?,?,?,?,00401316), ref: 0040C566
__vbaR8Str.MSVBVM60(00402A60,?,?,?,?,00401316), ref: 0040C570
__vbaNew2.MSVBVM60(00402A3C,0041333C,00402A60,?,?,?,?,00401316), ref: 0040C593
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A2C,00000048,?,?,?,?,?,?,?,?,00402A60), ref: 0040C5D9
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,00402A60,?,?,?,?,00401316), ref: 0040C5F7
__vbaFreeStr.MSVBVM60(0040C626,00402A60,?,?,?,?,00401316), ref: 0040C610
__vbaFreeVar.MSVBVM60(0040C626,00402A60,?,?,?,?,00401316), ref: 0040C618
__vbaFreeStr.MSVBVM60(0040C626,00402A60,?,?,?,?,00401316), ref: 0040C620

Strings

<3A, xrefs: 0040C5A8

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultMoveNew2
String ID: <3A
API String ID: 3351146962-662753744
Opcode ID: a826216f6ff8d8e2047c592262049231c7490926943ea5ca24c598dec2a71876
Instruction ID: 794f32a740ba2efc16a80d632a5adb389ab2179dcc346acf05bc916b61037065
Opcode Fuzzy Hash: a826216f6ff8d8e2047c592262049231c7490926943ea5ca24c598dec2a71876
Instruction Fuzzy Hash: C821F574901218EFCB14EF96C986ADEB7B4FB08749F10812AF401772E1DBB86A45CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041242F, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0041242F(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				char _v48;
				char* _v56;
				intOrPtr _v64;
				char _v68;
				intOrPtr* _v72;
				signed int _v76;
				short _v80;
				signed int _v92;
				void* _t38;
				char* _t39;
				signed int _t43;
				char* _t47;
				void* _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 = _t60 - 0xc;
				 *[fs:0x0] = _t61;
				L00401310();
				_v16 = _t61;
				_v12 = 0x401300;
				_v8 = 0;
				_t38 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x401316, _t58);
				L004013EE();
				_t39 =  &_v32;
				L00401496();
				_v72 = _t39;
				_t43 =  *((intOrPtr*)( *_v72 + 0x1c))(_v72,  &_v68, _t39, _t38);
				asm("fclex");
				_v76 = _t43;
				if(_v76 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x1c);
					_push(0x402a9c);
					_push(_v72);
					_push(_v76);
					L0040148A();
					_v92 = _t43;
				}
				_v80 =  ~(0 | _v68 != 0x00000000);
				L00401484();
				_t47 = _v80;
				if(_t47 != 0) {
					_v56 = L"Masjids6";
					_v64 = 8;
					L0040147E();
					_t47 =  &_v48;
					_push(_t47);
					L004013E8();
					L00401460();
					L0040146C();
				}
				_push(0x41252a);
				L00401478();
				return _t47;
			}

0x00412432
0x00412441
0x0041244b
0x00412453
0x00412456
0x0041245d
0x0041246c
0x0041246f
0x00412475
0x00412479
0x0041247e
0x0041248d
0x00412490
0x00412492
0x00412499
0x004124b2
0x0041249b
0x0041249b
0x0041249d
0x004124a2
0x004124a5
0x004124a8
0x004124ad
0x004124ad
0x004124c1
0x004124c8
0x004124cd
0x004124d3
0x004124d5
0x004124dc
0x004124e9
0x004124ee
0x004124f1
0x004124f2
0x004124fc
0x00412504
0x00412504
0x00412509
0x00412524
0x00412529

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0041244B
#685.MSVBVM60(?,?,?,?,00401316), ref: 0041246F
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00401316), ref: 00412479
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A9C,0000001C), ref: 004124A8
__vbaFreeObj.MSVBVM60 ref: 004124C8
__vbaVarDup.MSVBVM60 ref: 004124E9
#667.MSVBVM60(?), ref: 004124F2
__vbaStrMove.MSVBVM60(?), ref: 004124FC
__vbaFreeVar.MSVBVM60(?), ref: 00412504
__vbaFreeStr.MSVBVM60(0041252A), ref: 00412524

Strings

Masjids6, xrefs: 004124D5

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#667#685CheckChkstkHresultMove
String ID: Masjids6
API String ID: 651225607-1712798558
Opcode ID: dd4299456a3adaf234febf192415d30b0928a417b80e58306a3647e256170335
Instruction ID: f148373d8f3546e38d118c343fc6a3612807927329ae1977154572f0b5c006e5
Opcode Fuzzy Hash: dd4299456a3adaf234febf192415d30b0928a417b80e58306a3647e256170335
Instruction Fuzzy Hash: D821F671D00208EFDB00EFE5C986BDEBBB8AF04704F10842AF401B71A1DBB89956CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAE9, Relevance: 16.6, APIs: 11, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E0040CAE9(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed int _v56;
				signed int _t24;
				signed int _t28;
				intOrPtr _t46;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_t24 = 0x24;
				L00401310();
				_v12 = _t46;
				_v8 = 0x4011d8;
				L0040147E();
				L00401466();
				_push(_v40);
				L00401412();
				L00401460();
				_push(_t24);
				_push(0x402a98);
				L0040142A();
				asm("sbb eax, eax");
				_v48 =  ~( ~( ~_t24));
				L00401478();
				_t28 = _v48;
				if(_t28 != 0) {
					L0040140C();
					_t28 =  *((intOrPtr*)( *_a4 + 0x64))(_a4, _t28);
					asm("fclex");
					_v48 = _t28;
					if(_v48 >= 0) {
						_v56 = _v56 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402640);
						_push(_a4);
						_push(_v48);
						L0040148A();
						_v56 = _t28;
					}
				}
				asm("wait");
				_push(E0040CBC6);
				L0040146C();
				L00401478();
				return _t28;
			}

0x0040caee
0x0040caf9
0x0040cafa
0x0040cb03
0x0040cb04
0x0040cb0c
0x0040cb0f
0x0040cb1c
0x0040cb29
0x0040cb2e
0x0040cb31
0x0040cb3b
0x0040cb40
0x0040cb41
0x0040cb46
0x0040cb4d
0x0040cb53
0x0040cb5a
0x0040cb5f
0x0040cb65
0x0040cb6d
0x0040cb7b
0x0040cb7e
0x0040cb80
0x0040cb87
0x0040cba0
0x0040cb89
0x0040cb89
0x0040cb8b
0x0040cb90
0x0040cb93
0x0040cb96
0x0040cb9b
0x0040cb9b
0x0040cb87
0x0040cba4
0x0040cba5
0x0040cbb8
0x0040cbc0
0x0040cbc5

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040CB04
__vbaVarDup.MSVBVM60(?,?,?,?,00401316), ref: 0040CB1C
__vbaStrCopy.MSVBVM60(?,?,?,?,00401316), ref: 0040CB29
#523.MSVBVM60(?,?,?,?,?,00401316), ref: 0040CB31
__vbaStrMove.MSVBVM60(?,?,?,?,?,00401316), ref: 0040CB3B
__vbaStrCmp.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040CB46
__vbaFreeStr.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040CB5A
__vbaFpI4.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040CB6D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402640,00000064,?,?,?,?,?,?,?,?,00401316), ref: 0040CB96
__vbaFreeVar.MSVBVM60(0040CBC6,00402A98,00000000,?,?,?,?,?,00401316), ref: 0040CBB8
__vbaFreeStr.MSVBVM60(0040CBC6,00402A98,00000000,?,?,?,?,?,00401316), ref: 0040CBC0

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#523CheckChkstkCopyHresultMove
String ID:
API String ID: 3833852711-0
Opcode ID: ddb650c8d17c2ff3a49adc796014236c32fb574faf415084bf121fc5eb2e2a77
Instruction ID: 7033910369229abd53b130c02f2a347eed676f19cc72d817a457ff1c80fd66db
Opcode Fuzzy Hash: ddb650c8d17c2ff3a49adc796014236c32fb574faf415084bf121fc5eb2e2a77
Instruction Fuzzy Hash: 64213B71900209EACB14EFA6D986FED7BB5EF08744F10817BF401B61F1DBB869448B69

Uniqueness

Uniqueness Score: -1.00%

Function 00411A35, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00411A35(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v44;
				char* _v68;
				char _v76;
				signed int _v80;
				signed long long _v88;
				signed int _v92;
				signed int _t29;
				signed int _t30;
				intOrPtr _t39;

				_push(__ecx);
				_push(__ecx);
				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t39;
				_push(0x48);
				L00401310();
				_v12 = _t39;
				_v8 = 0x401298;
				_push( &_v44);
				L004013CA();
				_v68 = L"Stoltestes4";
				_v76 = 0x8008;
				_push( &_v44);
				_t29 =  &_v76;
				_push(_t29);
				L004013D0();
				_v80 = _t29;
				L0040146C();
				_t30 = _v80;
				if(_t30 == 0) {
					L9:
					asm("wait");
					_push(0x411b76);
					return _t30;
				} else {
					__fp0 =  *0x401290;
					_push(__ecx);
					 *__esp =  *0x401290;
					__fp0 =  *0x401288;
					__fp0 =  *0x401288 *  *0x401280;
					if( *0x413000 != 0) {
						_push( *0x401184);
						_push( *0x401180);
						L00401334();
					} else {
						__fp0 = __fp0 /  *0x401180;
					}
					asm("fnstsw ax");
					if((__al & 0x0000000d) != 0) {
						goto L1;
					} else {
						_v88 = __fp0;
						__fp0 = _v88;
						 *__esp = _v88;
						__fp0 =  *0x401278;
						 *__esp =  *0x401278;
						__fp0 =  *0x401270;
						L0040140C();
						__fp0 =  *0x401268;
						 *__esp =  *0x401268;
						__fp0 =  *0x401264;
						_v76 =  *0x401264;
						__fp0 =  *0x401260;
						_v80 =  *0x401260;
						_a4 =  *_a4;
						__eax =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, __ecx, __ecx, __ecx, __eax, __ecx, __ecx);
						asm("fclex");
						_v80 = __eax;
						if(_v80 >= 0) {
							_v92 = _v92 & 0x00000000;
						} else {
							_push(0x2c0);
							_push(0x402640);
							_push(_a4);
							_push(_v80);
							L0040148A();
							_v92 = __eax;
						}
						goto L9;
					}
				}
				L1:
				return __imp____vbaFPException();
			}

0x00411a38
0x00411a39
0x00411a3a
0x00411a45
0x00411a46
0x00411a4d
0x00411a50
0x00411a58
0x00411a5b
0x00411a65
0x00411a66
0x00411a6b
0x00411a72
0x00411a7c
0x00411a7d
0x00411a80
0x00411a81
0x00411a86
0x00411a8d
0x00411a92
0x00411a98
0x00411b5a
0x00411b5a
0x00411b5b
0x00000000
0x00411a9e
0x00411a9e
0x00411aa4
0x00411aa5
0x00411aa8
0x00411aae
0x00411abb
0x00411ac5
0x00411acb
0x00411ad1
0x00411abd
0x00411abd
0x00411abd
0x00411ad6
0x00411ada
0x00000000
0x00411ae0
0x00411ae0
0x00411ae3
0x00411ae7
0x00411aea
0x00411af1
0x00411af4
0x00411afa
0x00411b00
0x00411b07
0x00411b0a
0x00411b11
0x00411b14
0x00411b1b
0x00411b26
0x00411b2b
0x00411b31
0x00411b33
0x00411b3a
0x00411b56
0x00411b3c
0x00411b3c
0x00411b41
0x00411b46
0x00411b49
0x00411b4c
0x00411b51
0x00411b51
0x00000000
0x00411b3a
0x00411ada
0x0040131c
0x0040131c

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 00411A50
#670.MSVBVM60(?,?,?,?,?,00401316), ref: 00411A66
__vbaVarTstEq.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A81
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A8D
_adj_fdiv_m64.MSVBVM60(?,00008008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411AD1
__vbaFpI4.MSVBVM60(?,?,?,00008008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411AFA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402640,000002C0,?,?,?,00000000,?,?,?,00008008,?), ref: 00411B4C

Strings

Stoltestes4, xrefs: 00411A6B

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#670CheckChkstkFreeHresult_adj_fdiv_m64
String ID: Stoltestes4
API String ID: 220120595-7128292
Opcode ID: aa0e2742dbe90476bdf8def8ec45b00a760ae9a0325dd8945a7ebf6e74ac24c4
Instruction ID: f194c4c6b403f8574f8659582e8d9d021fa34e82d30aa3bf2bf0cf512e31b942
Opcode Fuzzy Hash: aa0e2742dbe90476bdf8def8ec45b00a760ae9a0325dd8945a7ebf6e74ac24c4
Instruction Fuzzy Hash: E3314771905208EFDB009FA2DD49AEEBFB8FB08740F00896AF681B61B0D7785495DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0DB, Relevance: 13.6, APIs: 9, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040D0DB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v40;
				signed int _v44;
				signed int _v56;
				signed int _t28;
				signed int _t32;
				void* _t44;
				void* _t46;
				intOrPtr _t47;

				_t47 = _t46 - 0xc;
				 *[fs:0x0] = _t47;
				L00401310();
				_v16 = _t47;
				_v12 = 0x401230;
				_v8 = 0;
				_t28 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x20,  *[fs:0x0], 0x401316, _t44);
				L00401466();
				_push(_v28);
				L00401412();
				L00401460();
				_push(_t28);
				_push(0x402a98);
				L0040142A();
				asm("sbb eax, eax");
				_v44 =  ~( ~( ~_t28));
				L00401478();
				_t32 = _v44;
				if(_t32 != 0) {
					L0040140C();
					_t32 =  *((intOrPtr*)( *_a4 + 0x64))(_a4, _t32);
					asm("fclex");
					_v44 = _t32;
					if(_v44 >= 0) {
						_v56 = _v56 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402640);
						_push(_a4);
						_push(_v44);
						L0040148A();
						_v56 = _t32;
					}
				}
				asm("wait");
				_push(E0040D1B8);
				L00401478();
				return _t32;
			}

0x0040d0de
0x0040d0ed
0x0040d0f7
0x0040d0ff
0x0040d102
0x0040d109
0x0040d118
0x0040d123
0x0040d128
0x0040d12b
0x0040d135
0x0040d13a
0x0040d13b
0x0040d140
0x0040d147
0x0040d14d
0x0040d154
0x0040d159
0x0040d15f
0x0040d167
0x0040d175
0x0040d178
0x0040d17a
0x0040d181
0x0040d19a
0x0040d183
0x0040d183
0x0040d185
0x0040d18a
0x0040d18d
0x0040d190
0x0040d195
0x0040d195
0x0040d181
0x0040d19e
0x0040d19f
0x0040d1b2
0x0040d1b7

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040D0F7
__vbaStrCopy.MSVBVM60(?,?,?,?,00401316), ref: 0040D123
#523.MSVBVM60(?,?,?,?,?,00401316), ref: 0040D12B
__vbaStrMove.MSVBVM60(?,?,?,?,?,00401316), ref: 0040D135
__vbaStrCmp.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040D140
__vbaFreeStr.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040D154
__vbaFpI4.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 0040D167
__vbaHresultCheckObj.MSVBVM60(00000000,00401230,00402640,00000064), ref: 0040D190
__vbaFreeStr.MSVBVM60(0040D1B8,00402A98,00000000,?,?,?,?,?,00401316), ref: 0040D1B2

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#523CheckChkstkCopyHresultMove
String ID:
API String ID: 3833852711-0
Opcode ID: 753d9b8c67ab4e507a195efc9511da9afb277577037896b88ec1812ed8f8c076
Instruction ID: c78728bbbb5733d7f858fefd90c87bd8828aae9078ee91aebcb022409befa62c
Opcode Fuzzy Hash: 753d9b8c67ab4e507a195efc9511da9afb277577037896b88ec1812ed8f8c076
Instruction Fuzzy Hash: 7A211D70940209AFCB00EFA5C946B9DBFB5EF08754F10407AF401BB1F1DB7999858B58

Uniqueness

Uniqueness Score: -1.00%

Function 00412344, Relevance: 13.6, APIs: 9, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00412344(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v36;
				signed int _v40;
				signed int _v48;
				signed int _t21;
				signed int _t25;
				intOrPtr _t40;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t40;
				_t21 = 0x1c;
				L00401310();
				_v12 = _t40;
				_v8 = 0x4012f0;
				L00401466();
				_push(_v24);
				L00401412();
				L00401460();
				_push(_t21);
				_push(0x402a98);
				L0040142A();
				asm("sbb eax, eax");
				_v40 =  ~( ~( ~_t21));
				L00401478();
				_t25 = _v40;
				if(_t25 != 0) {
					L0040140C();
					_t25 =  *((intOrPtr*)( *_a4 + 0x64))(_a4, _t25);
					asm("fclex");
					_v40 = _t25;
					if(_v40 >= 0) {
						_v48 = _v48 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402640);
						_push(_a4);
						_push(_v40);
						L0040148A();
						_v48 = _t25;
					}
				}
				asm("wait");
				_push(0x41240e);
				L00401478();
				return _t25;
			}

0x00412349
0x00412354
0x00412355
0x0041235e
0x0041235f
0x00412367
0x0041236a
0x00412379
0x0041237e
0x00412381
0x0041238b
0x00412390
0x00412391
0x00412396
0x0041239d
0x004123a3
0x004123aa
0x004123af
0x004123b5
0x004123bd
0x004123cb
0x004123ce
0x004123d0
0x004123d7
0x004123f0
0x004123d9
0x004123d9
0x004123db
0x004123e0
0x004123e3
0x004123e6
0x004123eb
0x004123eb
0x004123d7
0x004123f4
0x004123f5
0x00412408
0x0041240d

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0041235F
__vbaStrCopy.MSVBVM60(?,?,?,?,00401316), ref: 00412379
#523.MSVBVM60(?,?,?,?,?,00401316), ref: 00412381
__vbaStrMove.MSVBVM60(?,?,?,?,?,00401316), ref: 0041238B
__vbaStrCmp.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 00412396
__vbaFreeStr.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 004123AA
__vbaFpI4.MSVBVM60(00402A98,00000000,?,?,?,?,?,00401316), ref: 004123BD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402640,00000064,?,?,?,?,?,?,00401316), ref: 004123E6
__vbaFreeStr.MSVBVM60(0041240E,00402A98,00000000,?,?,?,?,?,00401316), ref: 00412408

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#523CheckChkstkCopyHresultMove
String ID:
API String ID: 3833852711-0
Opcode ID: 50969a48a0475bc3a3545815a16bc04e6327ee2b43404afbda6a777f4da312fc
Instruction ID: 6d0eb421da825896bb3ef5982a2c0370ad482290a00557a58e451e3c00a01053
Opcode Fuzzy Hash: 50969a48a0475bc3a3545815a16bc04e6327ee2b43404afbda6a777f4da312fc
Instruction Fuzzy Hash: D4112C70940209ABDB10EBA5CA06BEE7AB4EB08744F20407AF501F61F1DBBD99509A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD15, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040CD15(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				char _v52;
				signed int _v56;
				signed int _v60;
				signed int _t32;
				signed int _t38;
				intOrPtr _t49;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t49;
				_t32 = 0x28;
				L00401310();
				_v12 = _t49;
				_v8 = 0x4011f8;
				_push(0x402764);
				L00401400();
				if(_t32 != 2) {
					if( *0x41333c != 0) {
						_v52 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a3c);
						L00401490();
						_v52 = 0x41333c;
					}
					_t5 =  &_v52; // 0x41333c
					_v32 =  *((intOrPtr*)( *_t5));
					_t38 =  *((intOrPtr*)( *_v32 + 0x1c))(_v32,  &_v28);
					asm("fclex");
					_v36 = _t38;
					if(_v36 >= 0) {
						_v56 = _v56 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a2c);
						_push(_v32);
						_push(_v36);
						L0040148A();
						_v56 = _t38;
					}
					_v40 = _v28;
					_t32 =  *((intOrPtr*)( *_v40 + 0x50))(_v40);
					asm("fclex");
					_v44 = _t32;
					if(_v44 >= 0) {
						_v60 = _v60 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x402a78);
						_push(_v40);
						_push(_v44);
						L0040148A();
						_v60 = _t32;
					}
					L00401484();
				}
				_push(E0040CE0A);
				return _t32;
			}

0x0040cd1a
0x0040cd25
0x0040cd26
0x0040cd2f
0x0040cd30
0x0040cd38
0x0040cd3b
0x0040cd42
0x0040cd47
0x0040cd4f
0x0040cd5c
0x0040cd76
0x0040cd5e
0x0040cd5e
0x0040cd63
0x0040cd68
0x0040cd6d
0x0040cd6d
0x0040cd7d
0x0040cd82
0x0040cd91
0x0040cd94
0x0040cd96
0x0040cd9d
0x0040cdb6
0x0040cd9f
0x0040cd9f
0x0040cda1
0x0040cda6
0x0040cda9
0x0040cdac
0x0040cdb1
0x0040cdb1
0x0040cdbd
0x0040cdc8
0x0040cdcb
0x0040cdcd
0x0040cdd4
0x0040cded
0x0040cdd6
0x0040cdd6
0x0040cdd8
0x0040cddd
0x0040cde0
0x0040cde3
0x0040cde8
0x0040cde8
0x0040cdf4
0x0040cdf4
0x0040cdf9
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040CD30
__vbaLenBstrB.MSVBVM60(00402764,?,?,?,?,00401316), ref: 0040CD47
__vbaNew2.MSVBVM60(00402A3C,0041333C,00402764,?,?,?,?,00401316), ref: 0040CD68
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A2C,0000001C,?,?,?,?,00402764,?,?,?,?,00401316), ref: 0040CDAC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A78,00000050,?,?,?,?,00402764,?,?,?,?,00401316), ref: 0040CDE3
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,00402764,?,?,?,?,00401316), ref: 0040CDF4

Strings

<3A, xrefs: 0040CD7D

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$BstrChkstkFreeNew2
String ID: <3A
API String ID: 670077848-662753744
Opcode ID: ce081a79720ffc8f1e81255755673334113b3b9e2307917df91e1bb53fdf8549
Instruction ID: 09a1e038054f09b5eac07328975e7c82fd08ad4b502a6ce41c28e28a0a9cb5c1
Opcode Fuzzy Hash: ce081a79720ffc8f1e81255755673334113b3b9e2307917df91e1bb53fdf8549
Instruction Fuzzy Hash: 2821F270940608EFCB10EF95C98ABEEBBB5EF08715F20413AF501B62E1D7B859419B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040C639, Relevance: 12.1, APIs: 8, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0040C639(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				intOrPtr* _v80;
				signed int _v84;
				intOrPtr* _v96;
				signed int _v100;
				char* _t42;
				signed int _t48;
				intOrPtr _t52;
				void* _t62;
				void* _t64;
				intOrPtr* _t65;

				_t65 = _t64 - 0xc;
				 *[fs:0x0] = _t65;
				L00401310();
				_v16 = _t65;
				_v12 = 0x4011a0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x4c,  *[fs:0x0], 0x401316, _t62);
				if( *0x413010 != 0) {
					_v96 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v96 = 0x413010;
				}
				_t52 =  *((intOrPtr*)( *_v96));
				_t42 =  &_v28;
				L00401496();
				_v80 = _t42;
				_v68 = 0x80020004;
				_v76 = 0xa;
				_v52 = 0x80020004;
				_v60 = 0xa;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t65 =  *0x401198;
				_t48 =  *((intOrPtr*)( *_v80 + 0x224))(_v80, _t52, 0x10, 0x10, 0x10, _t42,  *((intOrPtr*)(_t52 + 0x318))( *_v96));
				asm("fclex");
				_v84 = _t48;
				if(_v84 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x224);
					_push(0x4028d4);
					_push(_v80);
					_push(_v84);
					L0040148A();
					_v100 = _t48;
				}
				L00401484();
				asm("wait");
				_push(E0040C779);
				return _t48;
			}

0x0040c63c
0x0040c64b
0x0040c655
0x0040c65d
0x0040c660
0x0040c667
0x0040c676
0x0040c680
0x0040c69a
0x0040c682
0x0040c682
0x0040c687
0x0040c68c
0x0040c691
0x0040c691
0x0040c6ab
0x0040c6b5
0x0040c6b9
0x0040c6be
0x0040c6c1
0x0040c6c8
0x0040c6cf
0x0040c6d6
0x0040c6dd
0x0040c6e4
0x0040c6ee
0x0040c6f8
0x0040c6f9
0x0040c6fa
0x0040c6fb
0x0040c6ff
0x0040c709
0x0040c70a
0x0040c70b
0x0040c70c
0x0040c710
0x0040c71a
0x0040c71b
0x0040c71c
0x0040c71d
0x0040c725
0x0040c730
0x0040c736
0x0040c738
0x0040c73f
0x0040c75b
0x0040c741
0x0040c741
0x0040c746
0x0040c74b
0x0040c74e
0x0040c751
0x0040c756
0x0040c756
0x0040c762
0x0040c767
0x0040c768
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C655
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040C68C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C6B9
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040C6EE
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040C6FF
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040C710
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000224,?,?,00000000), ref: 0040C751
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0040C762

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: 03159807cc2cf9eb01c1c0d645ee4ce89d22c66b35fc3482f94108f7226beb29
Instruction ID: 39743974dd80c1499f4ee1ba5b84ebe074b910a69ac41d86608c84ac1a299447
Opcode Fuzzy Hash: 03159807cc2cf9eb01c1c0d645ee4ce89d22c66b35fc3482f94108f7226beb29
Instruction Fuzzy Hash: 0D311871940608EFDB01EF94C889BDEBBB5BF09714F10452AF901BB2A1C7B958858F59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C798, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040C798(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				char _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t36;
				signed int _t39;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L00401310();
				_v16 = _t53;
				_v12 = 0x4011b0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x401316, _t50);
				L0040147E();
				if( *0x413010 != 0) {
					_v68 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v68 = 0x413010;
				}
				_t36 =  &_v48;
				L00401496();
				_v52 = _t36;
				_t39 =  *((intOrPtr*)( *_v52 + 0x22c))(_v52, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x318))( *_v68));
				asm("fclex");
				_v56 = _t39;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x22c);
					_push(0x4028d4);
					_push(_v52);
					_push(_v56);
					L0040148A();
					_v72 = _t39;
				}
				L00401484();
				_push(E0040C883);
				L0040146C();
				return _t39;
			}

0x0040c79b
0x0040c7aa
0x0040c7b4
0x0040c7bc
0x0040c7bf
0x0040c7c6
0x0040c7d5
0x0040c7de
0x0040c7ea
0x0040c804
0x0040c7ec
0x0040c7ec
0x0040c7f1
0x0040c7f6
0x0040c7fb
0x0040c7fb
0x0040c81f
0x0040c823
0x0040c828
0x0040c833
0x0040c839
0x0040c83b
0x0040c842
0x0040c85e
0x0040c844
0x0040c844
0x0040c849
0x0040c84e
0x0040c851
0x0040c854
0x0040c859
0x0040c859
0x0040c865
0x0040c86a
0x0040c87d
0x0040c882

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C7B4
__vbaVarDup.MSVBVM60(?,?,?,?,00401316), ref: 0040C7DE
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040C7F6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C823
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,0000022C), ref: 0040C854
__vbaFreeObj.MSVBVM60 ref: 0040C865
__vbaFreeVar.MSVBVM60(0040C883), ref: 0040C87D

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2
String ID:
API String ID: 1725699769-0
Opcode ID: 7fb664b41aa51e40176264c953b2afdc4458efbd3c12ce7855bc1cc40b4d0257
Instruction ID: 56bbfc50a0ff364eff061933f5de202a96b71b158711e9053004d7e6ce0f3146
Opcode Fuzzy Hash: 7fb664b41aa51e40176264c953b2afdc4458efbd3c12ce7855bc1cc40b4d0257
Instruction Fuzzy Hash: 7721F871900208EFCB00EFA5C989FDDBBB4BF08709F20856AF401B72A1D7799A45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFE7, Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040CFE7(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v48;
				signed int _v52;
				char* _t29;
				signed int _t32;
				intOrPtr _t46;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x20);
				L00401310();
				_v12 = _t46;
				_v8 = 0x401218;
				L00401466();
				if( *0x413010 != 0) {
					_v48 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v48 = 0x413010;
				}
				_t29 =  &_v32;
				L00401496();
				_v36 = _t29;
				_t32 =  *((intOrPtr*)( *_v36 + 0x22c))(_v36, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v48)) + 0x310))( *_v48));
				asm("fclex");
				_v40 = _t32;
				if(_v40 >= 0) {
					_v52 = _v52 & 0x00000000;
				} else {
					_push(0x22c);
					_push(0x4028d4);
					_push(_v36);
					_push(_v40);
					L0040148A();
					_v52 = _t32;
				}
				L00401484();
				asm("wait");
				_push(E0040D0C0);
				L00401478();
				return _t32;
			}

0x0040cfec
0x0040cff7
0x0040cff8
0x0040cfff
0x0040d002
0x0040d00a
0x0040d00d
0x0040d01a
0x0040d026
0x0040d040
0x0040d028
0x0040d028
0x0040d02d
0x0040d032
0x0040d037
0x0040d037
0x0040d05b
0x0040d05f
0x0040d064
0x0040d06f
0x0040d075
0x0040d077
0x0040d07e
0x0040d09a
0x0040d080
0x0040d080
0x0040d085
0x0040d08a
0x0040d08d
0x0040d090
0x0040d095
0x0040d095
0x0040d0a1
0x0040d0a6
0x0040d0a7
0x0040d0ba
0x0040d0bf

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040D002
__vbaStrCopy.MSVBVM60(?,?,?,?,00401316), ref: 0040D01A
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040D032
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00401316), ref: 0040D05F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,0000022C,?,?,?,?,?,?,?,?,00401316), ref: 0040D090
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00401316), ref: 0040D0A1
__vbaFreeStr.MSVBVM60(0040D0C0,?,?,?,?,?,?,?,?,00401316), ref: 0040D0BA

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID:
API String ID: 2810356740-0
Opcode ID: 797a2958006a7c976fd7ed02b0f3016f9b41414bd04ca5b53379c599bccb01c0
Instruction ID: d99c9c4a801ef83e73f49a2d55709b0ed190bdb6402f2267f90b165411862b40
Opcode Fuzzy Hash: 797a2958006a7c976fd7ed02b0f3016f9b41414bd04ca5b53379c599bccb01c0
Instruction Fuzzy Hash: 9E21D870D40208AFCB00EFE5C849FEDB7B4BB48709F20846AF505B72E1D77959459B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041222E, Relevance: 9.1, APIs: 6, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0041222E(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				char* _t36;
				signed int _t40;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L00401310();
				_v16 = _t53;
				_v12 = 0x4012e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x401316, _t50);
				if( *0x413010 != 0) {
					_v64 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v64 = 0x413010;
				}
				_t36 =  &_v28;
				L00401496();
				_v48 = _t36;
				_v36 = 0x80020004;
				_v44 = 0xa;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t40 =  *((intOrPtr*)( *_v48 + 0x220))(_v48, 0x10, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x318))( *_v64));
				asm("fclex");
				_v52 = _t40;
				if(_v52 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x220);
					_push(0x4028d4);
					_push(_v48);
					_push(_v52);
					L0040148A();
					_v68 = _t40;
				}
				L00401484();
				_push(0x412325);
				return _t40;
			}

0x00412231
0x00412240
0x0041224a
0x00412252
0x00412255
0x0041225c
0x0041226b
0x00412275
0x0041228f
0x00412277
0x00412277
0x0041227c
0x00412281
0x00412286
0x00412286
0x004122aa
0x004122ae
0x004122b3
0x004122b6
0x004122bd
0x004122c7
0x004122d1
0x004122d2
0x004122d3
0x004122d4
0x004122dd
0x004122e3
0x004122e5
0x004122ec
0x00412308
0x004122ee
0x004122ee
0x004122f3
0x004122f8
0x004122fb
0x004122fe
0x00412303
0x00412303
0x0041230f
0x00412314
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0041224A
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 00412281
__vbaObjSet.MSVBVM60(?,00000000), ref: 004122AE
__vbaChkstk.MSVBVM60(?,00000000), ref: 004122C7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000220), ref: 004122FE
__vbaFreeObj.MSVBVM60 ref: 0041230F

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: a671db165ee692d356002dd5f219552ac74dcab78edd5a446d946d61ea8a9bcf
Instruction ID: 504d0a1d662c0ba8a9161e197e4f91b0256f0b3cdd6769eb03adcaccd26eebfc
Opcode Fuzzy Hash: a671db165ee692d356002dd5f219552ac74dcab78edd5a446d946d61ea8a9bcf
Instruction Fuzzy Hash: B9211570900208EFDB00DFA4D949BDDBBB5BF08704F10846AF901BB2A1C7B99985CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBF7, Relevance: 9.1, APIs: 6, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E0040CBF7(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t36;
				signed int _t40;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L00401310();
				_v16 = _t53;
				_v12 = 0x4011e8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x401316, _t50);
				if( *0x413010 != 0) {
					_v68 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v68 = 0x413010;
				}
				_t36 =  &_v32;
				L00401496();
				_v52 = _t36;
				_v40 = 1;
				_v48 = 2;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t40 =  *((intOrPtr*)( *_v52 + 0x228))(_v52, 0x10, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x310))( *_v68));
				asm("fclex");
				_v56 = _t40;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x228);
					_push(0x4028d4);
					_push(_v52);
					_push(_v56);
					L0040148A();
					_v72 = _t40;
				}
				L00401484();
				_push(E0040CCEE);
				return _t40;
			}

0x0040cbfa
0x0040cc09
0x0040cc13
0x0040cc1b
0x0040cc1e
0x0040cc25
0x0040cc34
0x0040cc3e
0x0040cc58
0x0040cc40
0x0040cc40
0x0040cc45
0x0040cc4a
0x0040cc4f
0x0040cc4f
0x0040cc73
0x0040cc77
0x0040cc7c
0x0040cc7f
0x0040cc86
0x0040cc90
0x0040cc9a
0x0040cc9b
0x0040cc9c
0x0040cc9d
0x0040cca6
0x0040ccac
0x0040ccae
0x0040ccb5
0x0040ccd1
0x0040ccb7
0x0040ccb7
0x0040ccbc
0x0040ccc1
0x0040ccc4
0x0040ccc7
0x0040cccc
0x0040cccc
0x0040ccd8
0x0040ccdd
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040CC13
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040CC4A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CC77
__vbaChkstk.MSVBVM60(?,00000000), ref: 0040CC90
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000228), ref: 0040CCC7
__vbaFreeObj.MSVBVM60 ref: 0040CCD8

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: a1a520568308ffc5a03b5e8506a16e591d3d624a782bd259831ec0924653f96a
Instruction ID: 22353b252e7c222e416ed3f2198fa486f5af4797975e521f999c3c63db5e7757
Opcode Fuzzy Hash: a1a520568308ffc5a03b5e8506a16e591d3d624a782bd259831ec0924653f96a
Instruction Fuzzy Hash: D3211970940208EFDB00EF94C989B9DBBB5BF09704F10452AF405BB2E1C7B99945DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C431, Relevance: 9.1, APIs: 6, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040C431(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v56;
				signed int _v60;
				char* _t29;
				signed int _t33;
				intOrPtr _t46;

				_push(0x401316);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t46;
				_push(0x28);
				L00401310();
				_v12 = _t46;
				_v8 = 0x401170;
				if( *0x413010 != 0) {
					_v56 = 0x413010;
				} else {
					_push(0x413010);
					_push(0x401cc8);
					L00401490();
					_v56 = 0x413010;
				}
				_t29 =  &_v24;
				L00401496();
				_v44 = _t29;
				_v32 = 0x80020004;
				_v40 = 0xa;
				L00401310();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t33 =  *((intOrPtr*)( *_v44 + 0x220))(_v44, 0x10, _t29,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x318))( *_v56));
				asm("fclex");
				_v48 = _t33;
				if(_v48 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x220);
					_push(0x4028d4);
					_push(_v44);
					_push(_v48);
					L0040148A();
					_v60 = _t33;
				}
				L00401484();
				_push(E0040C515);
				return _t33;
			}

0x0040c436
0x0040c441
0x0040c442
0x0040c449
0x0040c44c
0x0040c454
0x0040c457
0x0040c465
0x0040c47f
0x0040c467
0x0040c467
0x0040c46c
0x0040c471
0x0040c476
0x0040c476
0x0040c49a
0x0040c49e
0x0040c4a3
0x0040c4a6
0x0040c4ad
0x0040c4b7
0x0040c4c1
0x0040c4c2
0x0040c4c3
0x0040c4c4
0x0040c4cd
0x0040c4d3
0x0040c4d5
0x0040c4dc
0x0040c4f8
0x0040c4de
0x0040c4de
0x0040c4e3
0x0040c4e8
0x0040c4eb
0x0040c4ee
0x0040c4f3
0x0040c4f3
0x0040c4ff
0x0040c504
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,00401316), ref: 0040C44C
__vbaNew2.MSVBVM60(00401CC8,00413010,?,?,?,?,00401316), ref: 0040C471
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040C49E
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040C4B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028D4,00000220,?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040C4EE
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,00401316), ref: 0040C4FF

Memory Dump Source

Source File: 00000002.00000002.495392987.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.494891082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.497606602.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.498209731.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID:
API String ID: 3189907775-0
Opcode ID: 080426aca1e9d2de1c49e6989de6723e73fba02723286545be9e9f0dcada401d
Instruction ID: 038d1729654287ec7f419289757f17226c5fe98df3b27027a892efb6e68718fe
Opcode Fuzzy Hash: 080426aca1e9d2de1c49e6989de6723e73fba02723286545be9e9f0dcada401d
Instruction Fuzzy Hash: 12215C70940608EFDB00DF94C889BEDBBB5FB09714F20442AF501BB2A0C7B969449B68

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 6392 Parent PID: 6288 RegAsm.exeCOMMON

Executed Functions

Non-executed Functions

Function 00D03E81, Relevance: 4.3, Strings: 3, Instructions: 538COMMON

Download Yara Rule

Strings

{%@, xrefs: 00D03F26
O-A=, xrefs: 00D03ED2
{%@, xrefs: 00D03F2B

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID: O-A=${%@${%@
API String ID: 0-3635599137
Opcode ID: 90a546d6e4a8d19fa5bca49696ce55449440471081b108f4e59068a2756ebd94
Instruction ID: aa07bf029d05e070bae6ad5ed1bcf51d37f7ce048ab34e05b6edc0ae5e5bfcb1
Opcode Fuzzy Hash: 90a546d6e4a8d19fa5bca49696ce55449440471081b108f4e59068a2756ebd94
Instruction Fuzzy Hash: E81259B06403069FEF219F24CC95FD97BA1EF12350F988219EB9D9B2D1D3758885CB26

Uniqueness

Uniqueness Score: -1.00%

Function 00D03EB0, Relevance: 3.9, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

{%@, xrefs: 00D03F26
O-A=, xrefs: 00D03ED2
{%@, xrefs: 00D03F2B

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID: O-A=${%@${%@
API String ID: 0-3635599137
Opcode ID: f542a3d8025efe01866752d81f505a5924409cbe5de0332a1e8f619657c3feb9
Instruction ID: 5911880f679aad06dce59a0b0b37f1d347db02b6323988707a40b5d16f8e9af7
Opcode Fuzzy Hash: f542a3d8025efe01866752d81f505a5924409cbe5de0332a1e8f619657c3feb9
Instruction Fuzzy Hash: 3851C670A543428EDB25CF28C8C4B59BBE1EF52320F58C299C6998F2E7C335D482C726

Uniqueness

Uniqueness Score: -1.00%

Function 00D00FBA, Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5cc1b59715be0236dba83599b1049b8005824c14004426bf9cb1db7246111a
Instruction ID: 79e8b98e2aeed59f3b3e89fa709d1f92ffca2f0f393791f8d415fb30e5206396
Opcode Fuzzy Hash: ef5cc1b59715be0236dba83599b1049b8005824c14004426bf9cb1db7246111a
Instruction Fuzzy Hash: A5D1E475B00702AFE7189E68CCD5BE5B3A5FF09350F98422DEC9D93681D724E8858BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D0151D, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd026541b050b2def2d8633f8b91cb0555c8f5f557877950c383001b7cb8d0a4
Instruction ID: 9d42587fcbaf3ff93e75957721dda67d8df47634df6d82622b0b21d9b61a8aca
Opcode Fuzzy Hash: cd026541b050b2def2d8633f8b91cb0555c8f5f557877950c383001b7cb8d0a4
Instruction Fuzzy Hash: B131E3746443009FEB259F24CC8ABEA73A6FF05750FA48158FD8E9B1D2C3A5D884CA31

Uniqueness

Uniqueness Score: -1.00%

Function 00D02220, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d976bd0534403ff026a759b923a08407584456079bb5ba31aefaab8b461974d0
Instruction ID: a5ca12f76775ae0c375e867a56dfc63e5613a87c7a1db1e6be815baa1b8c89c1
Opcode Fuzzy Hash: d976bd0534403ff026a759b923a08407584456079bb5ba31aefaab8b461974d0
Instruction Fuzzy Hash: 2C0128B52012049FD7119A64C9C9FE93258FF1A360F748172ED0ACB1E2D364C8C19635

Uniqueness

Uniqueness Score: -1.00%

Function 00D00ACB, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2bdf77365abe2af8df92841ec47617e0f4ea9a2c11c2b59958d0c6944697529
Instruction ID: 1cff22d55d04659ba3292db64e962cd217e24e6696e3fb780e1fa8ffb0273d7f
Opcode Fuzzy Hash: a2bdf77365abe2af8df92841ec47617e0f4ea9a2c11c2b59958d0c6944697529
Instruction Fuzzy Hash: 9F01197120438AEAEF312F64DD45BDE3A27EF04758F404528FE4D19095D7768B90EA36

Uniqueness

Uniqueness Score: -1.00%

Function 00D038A5, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e56c9cbe147b0e74bda7fde7e308945cfd9636b489cf4bba615d5fea10412fe
Instruction ID: a412d6e240a2e3bf21cbf8cc56c0f79dd195e53d5ddda2633ce294deee8f79a5
Opcode Fuzzy Hash: 1e56c9cbe147b0e74bda7fde7e308945cfd9636b489cf4bba615d5fea10412fe
Instruction Fuzzy Hash: C1F0A9303042018FCB14DA18C9D4F5A73AAAF58720F8985A9FD09CB2E1C334EE80CA21

Uniqueness

Uniqueness Score: -1.00%

Function 00D01E93, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb5fe23b5745a2d46426985e3011ccdb8457504994a31645ae0ceff59b0911d2
Instruction ID: e42a3bfa9f50545feff4b2a2024b7667a8d4a007d74d6b6bd9e38aae2c54c942
Opcode Fuzzy Hash: bb5fe23b5745a2d46426985e3011ccdb8457504994a31645ae0ceff59b0911d2
Instruction Fuzzy Hash: 92B092BA2015C18FEF02DF08C491B4073A0FB18648F8804D0E042CF712C224E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00D035D3, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.494187486.0000000000D00000.00000040.00000001.sdmp, Offset: 00D00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f8296434b3fd7b7745b81403690b31ddabc8b7710f59af9133044bf329e1bc
Instruction ID: abd49783f53a66fd56a7323fe992f48a326f60b79ffaf633452d53751850bede
Opcode Fuzzy Hash: 53f8296434b3fd7b7745b81403690b31ddabc8b7710f59af9133044bf329e1bc
Instruction Fuzzy Hash: 17B002356515408FCE55CE09C1D0E54B3A5BB44650B9154A4E41687A51C264E944C900

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TNT Delivery Document.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: TNT Delivery Document.exe PID: 6288 Parent PID: 5712

General

Chronological Activities

Analysis Process: RegAsm.exe PID: 6392 Parent PID: 6288

General

Chronological Activities

Analysis Process: conhost.exe PID: 4932 Parent PID: 6392

General

Function 004038DC, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1010
COMMONCrypto

Function 0040A50C, Relevance: 260.8, APIs: 134, Strings: 14, Instructions: 1763
COMMON

Function 0040A684, Relevance: 258.9, APIs: 134, Strings: 13, Instructions: 1618
COMMON

Function 004014BC, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 344
COMMON

Function 0040466F, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 417
COMMON