Play interactive tour

Edit tour

Analysis Report documentos.exe

Overview

General Information

Sample Name:	documentos.exe
Analysis ID:	383467
MD5:	71d102249808e46de207ba5d1e1441ee
SHA1:	b0538afec6fe730a0e01b8fd81febf68e03d2f54
SHA256:	1b1622ce9c633a2c53dac43aaea43712544b7385d457b05574d4754cf850293c
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected GuLoader

Executable has a suspicious name (potential lure to open the executable)

Found potential dummy code loops (likely to delay analysis)

Initial sample is a PE file and has a suspicious name

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains strange resources

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

documentos.exe (PID: 7124 cmdline: 'C:\Users\user\Desktop\documentos.exe' MD5: 71D102249808E46DE207BA5D1E1441EE)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: documentos.exe PID: 7124	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: documentos.exe PID: 7124	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: documentos.exe	Virustotal: Detection: 31%			Perma Link
Source: documentos.exe	ReversingLabs: Detection: 10%

Source: documentos.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: documentos.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: documentos.exe

Source: C:\Users\user\Desktop\documentos.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\documentos.exe

Code function: 0_2_00401564

0_2_00401564

Source: documentos.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: documentos.exe, 00000000.00000002.1170338790.00000000020A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs documentos.exe
Source: documentos.exe, 00000000.00000000.644285775.0000000000426000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameOutpiped.exe vs documentos.exe
Source: documentos.exe	Binary or memory string: OriginalFilenameOutpiped.exe vs documentos.exe

Source: documentos.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal88.rans.troj.evad.winEXE@1/0@0/0

Source: documentos.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\documentos.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\documentos.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: documentos.exe	Virustotal: Detection: 31%
Source: documentos.exe	ReversingLabs: Detection: 10%

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: documentos.exe PID: 7124, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: documentos.exe PID: 7124, type: MEMORY

Source: C:\Users\user\Desktop\documentos.exe	Code function: 0_2_00403E6C push ss; retf	0_2_00403E6D
Source: C:\Users\user\Desktop\documentos.exe	Code function: 0_2_00406E3F push FFFFFFF6h; iretd	0_2_00406E41
Source: C:\Users\user\Desktop\documentos.exe	Code function: 0_2_00406DA7 push FFFFFFF6h; iretd	0_2_00406DA9

Source: C:\Users\user\Desktop\documentos.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: documentos.exe, 00000000.00000002.1170152810.0000000000500000.00000040.00000001.sdmp

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\documentos.exe	RDTSC instruction interceptor: First address: 0000000000502BB1 second address: 0000000000502BB1 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add eax, ecx 0x00000005 inc esi 0x00000006 cmp byte ptr [esi], 00000000h 0x00000009 jne 00007FB6847551BBh 0x0000000b cmp al, bl 0x0000000d cmp byte ptr [esi], FFFFFFA4h 0x00000010 jnc 00007FB684755207h 0x00000012 fnop 0x00000014 mov ebx, eax 0x00000016 test ax, ax 0x00000019 shl eax, 05h 0x0000001c add eax, ebx 0x0000001e movzx ecx, byte ptr [esi] 0x00000021 pushad 0x00000022 mov eax, 0000007Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\documentos.exe	RDTSC instruction interceptor: First address: 0000000000502D46 second address: 0000000000502D83 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add esi, 00001000h 0x00000009 test dl, bl 0x0000000b cmp esi, 0000F000h 0x00000011 je 00007FB684B851D4h 0x00000017 cmp edx, C6B28C40h 0x0000001d cmp esi, 7FFFF000h 0x00000023 je 00007FB684B851C2h 0x00000029 push 00000000h 0x0000002b push 0000001Ch 0x0000002d cmp al, bl 0x0000002f fnop 0x00000031 push edi 0x00000032 test ax, ax 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 mov eax, 0000004Fh 0x0000003d rdtsc

Source: C:\Users\user\Desktop\documentos.exe

API coverage: 2.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: documentos.exe, 00000000.00000002.1170152810.0000000000500000.00000040.00000001.sdmp

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\documentos.exe

Process Stats: CPU usage > 90% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: documentos.exe, 00000000.00000002.1170281468.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: documentos.exe, 00000000.00000002.1170281468.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: documentos.exe, 00000000.00000002.1170281468.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: documentos.exe, 00000000.00000002.1170281468.0000000000C80000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery31	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
documentos.exe	32%	Virustotal		Browse
documentos.exe	10%	ReversingLabs	Win32.Backdoor.Remcos

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383467
Start date:	07.04.2021
Start time:	20:37:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	documentos.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.1% (good quality ratio 9.8%) Quality average: 52.1% Quality standard deviation: 22.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.800179475931607
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	documentos.exe
File size:	155648
MD5:	71d102249808e46de207ba5d1e1441ee
SHA1:	b0538afec6fe730a0e01b8fd81febf68e03d2f54
SHA256:	1b1622ce9c633a2c53dac43aaea43712544b7385d457b05574d4754cf850293c
SHA512:	27a3229760a9d5a2f8324ea094daa9be596ce8fb576c2f592c2d67df7c8843268fe2edbd571bea5fda30dcfacbdfb4ef0d808cc213c75d31f03a25710180b386
SSDEEP:	1536:/siCE7hAX1SvRtIo02gPS2QY4qNw+6dbg3Oad/HfGRXuNbNnvwD7IoG5QzI6mUQp:UpE7yXetag2xhZzd/HfiYZnvmzLRQpz
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....hm`.................0...0......d........@....@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401564
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x606D688C [Wed Apr 7 08:08:44 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	545536ea1fbc91386e1294093d2f717e

Entrypoint Preview

Instruction
push 00401740h
call 00007FB684A89825h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, dh
popad
pushfd
jns 00007FB684A8986Bh
fistp word ptr [eax+4Dh]
movsb
or eax, dword ptr [eax+3Ch]
pushad
fbstp [esi+000000BCh]
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+64h], ah
adc dword ptr [ebx], eax
jnc 00007FB684A898A6h
jc 00007FB684A89893h
outsb
jnc 00007FB684A8989Eh
popad
add byte ptr fs:[eax], ah
or byte ptr [ecx+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
add eax, 59164BAAh
mov bh, byte ptr [edx+edx*2-4AC754B9h]
mov word ptr [ebp+35h], cs
push ds
rcr dword ptr [eax-17h], 7Dh
and bh, byte ptr [ebx-7DB36973h]
jne 00007FB684A8984Fh
fadd dword ptr [eax+3A978C9Fh]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub eax, dword ptr [ecx]
add byte ptr [eax], al
push eax
add byte ptr [eax], al
add byte ptr [eax], al
push cs
add byte ptr [ebx+6Fh], cl
outsb
jbe 00007FB684A89897h
outsb
je 00007FB684A8989Bh
outsd
outsb
insb
insb
add byte ptr [53000A01h], cl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23834	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x9d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x17c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22e04	0x23000	False	0.348597935268	data	6.03854398613	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x24000	0x1194	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x9d8	0x1000	False	0.179443359375	data	2.13350863125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x268a8	0x130	data
RT_ICON	0x265c0	0x2e8	data
RT_ICON	0x26498	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x26468	0x30	data
RT_VERSION	0x26150	0x318	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaI2I4, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaVarErrI4, __vbaFPException, __vbaInStrVar, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarAdd, __vbaLateMemCall, __vbaVarDup, __vbaFpI4, _CIatan, __vbaUI1Str, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	Collutions
InternalName	Outpiped
FileVersion	1.00
CompanyName	Collutions
LegalTrademarks	Collutions
Comments	Collutions
ProductName	Collutions
ProductVersion	1.00
FileDescription	Creepy Collutions
OriginalFilename	Outpiped.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: documentos.exe PID: 7124 Parent PID: 5908

General

Start time:	20:38:26
Start date:	07/04/2021
Path:	C:\Users\user\Desktop\documentos.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\documentos.exe'
Imagebase:	0x400000
File size:	155648 bytes
MD5 hash:	71D102249808E46DE207BA5D1E1441EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: documentos.exe PID: 7124 Parent PID: 5908 documentos.exeCOMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	0.5%
Total number of Nodes:	390
Total number of Limit Nodes:	0

Executed Functions

Function 00401564, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 456
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			_entry_(signed int __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, char _a1, signed int* _a4, intOrPtr _a7, signed int _a24, char _a97) {
				char _v1;
				char _v3;
				intOrPtr _v12;
				signed int _v16;
				char _v28;
				short _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				char _v48;
				char _v64;
				void* _v68;
				signed int* _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v96;
				signed int* _v100;
				signed int _v104;
				signed int _v108;
				signed int* _v112;
				signed int _v116;
				signed int _v120;
				signed int* _v124;
				signed int _v128;
				signed int _v132;
				signed long long _v140;
				signed long long _v144;
				signed int _v148;
				signed int* _v152;
				signed int _v156;
				intOrPtr* _t386;

				_push("VB5!6&*"); // executed
				L0040155E(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t386 = __eax + 1;
				 *_t386 =  *_t386 + _t386;
				 *_t386 =  *_t386 + _t386;
				 *_t386 =  *_t386 + _t386;
				__edx = __eax *  *(__ecx - 0x64) >> 0x20;
				__eax = __eax *  *(__ecx - 0x64);
				__eflags = __eax;
				if(__eax >= 0) {
					L7:
					__esp = 0x38ab4752;
					__ch = 0x8c;
					__ebp =  &_v1;
					__eax = __eax ^ 0xe958c11e;
					__eflags = __eax;
					if(__eflags >= 0) {
						L10:
						 *__eax =  *__eax + __al;
						__eflags =  *__eax;
					} else {
						__ebx = 0x824c968d;
						if(__eflags == 0) {
							__fp0 = __fp0 +  *((intOrPtr*)(__eax + 0x3a978c9f));
							__edi = __edi - 1;
							asm("lodsd");
							__ebx = 0x824c968d ^  *(__ecx - 0x48ee309a);
							asm("stosb");
							 *((intOrPtr*)(__eax - 0x2d)) =  *((intOrPtr*)(__eax - 0x2d)) + __ah;
							_t17 = __eax;
							__eax = 0x824c968d ^  *(__ecx - 0x48ee309a);
							__ebx = _t17;
							 *__eax =  *__eax + __al;
							 *__eax =  *__eax + __al;
							 *__eax =  *__eax + __al;
							__eflags =  *__eax;
							goto L10;
						}
					}
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					__eflags =  *__eax;
					goto L12;
				} else {
					asm("fistp word [eax+0x4d]");
					asm("movsb");
					__eax = __eax |  *(__eax + 0x3c);
					asm("pushad");
					asm("fbstp tword [esi+0xbc]");
					 *__eax =  *__eax + __al;
					 *__ecx =  *__ecx + __al;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					_t8 = __eax + 0x64;
					 *_t8 =  *(__eax + 0x64) + __ah;
					__eflags =  *_t8;
					asm("adc [ebx], eax");
					if(__eflags < 0) {
						if(__eflags < 0) {
							L12:
							 *__eax =  *__eax + __al;
							 *__eax =  *__eax + __al;
							 *__eax =  *__eax + __al;
							 *__eax =  *__eax + __al;
							__eax = __eax -  *__ecx;
							 *__eax =  *__eax + __al;
							_push(__eax);
							 *__eax =  *__eax + __al;
							__eflags =  *__eax;
						} else {
							asm("outsb");
							if(__eflags < 0) {
								asm("popad");
								 *[gs:eax] =  *[gs:eax] + __ah;
								 *__ecx =  *__ecx | __al;
								 *__eax =  *__eax + __al;
								 *__eax =  *__eax + __al;
								__esp = __esp - 1;
								 *__eax =  *__eax ^ __eax;
								__eax = __eax + 0x59164baa;
								__eflags = __eax;
								__bh =  *((intOrPtr*)(__edx + __edx * 2 - 0x4ac754b9));
								goto L7;
							}
						}
						 *__eax =  *__eax + __al;
						 *__esi =  *__esi + __cl;
						__eflags =  *__esi;
					}
				}
				_push(cs);
				_t18 = __ebx + 0x6f;
				 *_t18 =  *(__ebx + 0x6f) + __cl;
				__eflags =  *_t18;
				asm("outsb");
				if(__eflags <= 0) {
					L26:
					__edi = __edi +  *((intOrPtr*)(__edi + 0x1101ef04));
					__eax = __eax +  *__eax;
					__eflags = __eax;
					goto L27;
				} else {
					asm("outsb");
					if(__eflags == 0) {
						L27:
						__bh = __bh + __bh;
						__ebp = __ebp +  *(__eax + __eax);
						 *__eax =  *__eax + __al;
						__cl = __cl +  *__eax;
						 *(__ebx + 0x6f) =  *(__ebx + 0x6f) + __al;
						asm("insd");
						asm("insd");
						asm("popad");
						asm("outsb");
						 *[fs:eax] =  *[fs:eax] ^ __eax;
						__al = __al + 1;
						__al = __al |  *__eax;
						__ecx = __ecx + 1;
						__ebp =  *(__ebx + 0x75) * 0x6d;
						__eflags = __ebp;
						if(__eflags != 0) {
							goto L40;
						} else {
							if(__eflags < 0) {
								goto L36;
							} else {
								 *((intOrPtr*)(__eax + __edi * 2)) =  *((intOrPtr*)(__eax + __edi * 2)) + __al;
								_t36 = __eax + 3;
								 *_t36 =  *(__eax + 3) + __cl;
								__eflags =  *_t36;
								__edi = 0x1101ef04;
								goto L30;
							}
						}
					} else {
						asm("outsd");
						asm("outsb");
						asm("gs insb");
						asm("insb");
						 *[gs:0x53000a01] =  *[gs:0x53000a01] + __cl;
						__ebp =  *(__esi + 0x75) * 0x6c73756f;
						__eflags = __ebp;
						if(__ebp >= 0) {
							L23:
							asm("popad");
							asm("outsb");
							__al = __al ^  *[fs:eax];
							__al = __al + 1;
							_pop(es);
							_t25 =  &_a97;
							 *_t25 = _a97 + __ch;
							__eflags =  *_t25;
							if(__eflags < 0) {
								goto L37;
							} else {
								asm("insb");
								if (__eflags == 0) goto L25;
								__al = __al + 0x80;
								_pop(es);
								__eax = __eax - 1;
								__eflags = __eax;
								goto L26;
							}
						} else {
							 *__ecx =  *__ecx + __bl;
							 *__eax =  *__eax + __eax;
							__edx = __edx + 1;
							 *__edx =  *__edx + __ah;
							 *((intOrPtr*)(__edx + __ecx)) =  *((intOrPtr*)(__edx + __ecx)) + __esp;
							_t23 = __ebx + 0x69;
							 *_t23 =  *(__ebx + 0x69) + __dl;
							__eflags =  *_t23;
							asm("outsb");
							if(__eflags != 0) {
								L30:
								asm("adc [edx], eax");
								__bh = __bh + __bh;
								__ebp = __ebp +  *__ecx;
								__eflags = __ebp;
								goto L31;
							} else {
								if(__eflags != 0) {
									L31:
									 *__eax =  *__eax + __al;
									 *__ebx =  *__ebx + __al;
									__eax = __eax + 0x78655400;
									__eflags = __eax;
									if(__eax == 0) {
										__al = __al + 0xef;
										 *__ebx =  *__ebx + __ecx;
										_pop(es);
										 *((intOrPtr*)(__ebx + 0x54)) =  *((intOrPtr*)(__ebx + 0x54)) + __dl;
										__ecx = __ecx + 1;
										__esp = __esp - 1;
										__esp = __esp + 1;
										__ebp =  &_a1;
										_push(__ebx);
										 *__edx =  *__edx + __dl;
										 *__eax =  *__eax + __al;
										 *__ebx =  *__ebx + 1;
										__al = __al;
										 *__eax =  *__eax + __al;
										__eax = __eax + 0x72460006;
										__eflags = __eax;
										L40:
										asm("popad");
										asm("insd");
										 *[gs:eax] =  *[gs:eax] ^ __eax;
										__eax = __eax +  *__ecx;
										__esi = __esi + 1;
										__eflags = __esi;
										asm("popad");
										asm("outsb");
										if (__eflags == 0) goto L48;
										asm("popad");
									} else {
										 *__edx =  *__edx + __al;
										__al = __al + 0xf8;
										__eflags = __al;
										_pop(es);
										if (__al < 0) goto L33;
										__edi = 0xb01ef04;
										__al = __al |  *__eax;
										__eflags = __al;
										__esp = __esp - 1;
										if(__eflags == 0) {
											 *__esi =  *__esi & __esi;
											__al = __al -  *[es:eax];
											__eflags = __al;
											goto L46;
										} else {
											asm("popad");
											asm("outsb");
											if(__eflags >= 0) {
												L46:
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__esi =  *__esi + __bh;
												__eflags =  *__esi;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												__al = __al |  *__eax;
												 *(__eax + __eax) =  *(__eax + __eax) | __eax;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *((intOrPtr*)(__eax + 0x1a)) =  *((intOrPtr*)(__eax + 0x1a)) + __al;
												__eax = __eax + 1;
												 *((intOrPtr*)(__eax + __esi * 8)) =  *((intOrPtr*)(__eax + __esi * 8)) + __bl;
												 *__eax =  *__eax ^ __al;
												__bh = __bh + __bh;
												asm("invalid");
												 *__eax =  *__eax | __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __eax;
												__eflags =  *__eax;
												 *__eax =  *__eax + __al;
												__al = __al +  *__eax;
												 *__eax =  *__eax + __al;
											} else {
												__eax = __eax ^  *__eax;
												asm("adc al, [ecx]");
												__bh = __bh + __bh;
												__eflags = __bh;
												L36:
												 *__ebx =  *__ebx + 1;
												 *[es:eax] =  *[es:eax] + __al;
												_t38 = __eax + 0x78655400;
												 *_t38 =  *(__eax + 0x78655400) + __al;
												__eflags =  *_t38;
												if ( *_t38 == 0) goto L41;
												L37:
												 *__eax =  *__eax ^ __eax;
												__eflags =  *__eax;
											}
										}
									}
								} else {
									asm("insb");
									if(__eflags >= 0) {
										goto L26;
									} else {
										 *0x159c =  *0x159c + __dh;
										__eflags =  *0x159c;
										if( *0x159c == 0) {
											 *__eax =  *__eax + __al;
											asm("loope 0x12");
											 *__eax =  *__eax + __al;
											goto 0x4600;
											__edi = __edi + __edi;
											__eflags = __edi;
										}
										 *__ecx =  *__ecx + __ebp;
										 *__eax =  *__eax + __al;
										 *__ecx =  *__ecx + __al;
										 *__eax =  *__eax | __al;
										__ebx = __ebx + 1;
										asm("outsd");
										asm("insd");
										asm("insd");
										goto L23;
									}
								}
							}
						}
					}
				}
				asm("loopne 0x19");
				__eax = __eax + 1;
				 *__eax =  *__eax + __bh;
				_pop(ss);
				__eax = __eax + 1;
				 *((intOrPtr*)(__eax + 0x15)) =  *((intOrPtr*)(__eax + 0x15)) + __dh;
				__eax = __eax + 1;
				 *__eax =  *__eax + __bh;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + 0x920000;
				 *__eax =  *__eax + __al;
				_t55 = __eax;
				__eax = __ebx;
				__ebx = _t55;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				_t56 = __edi + 0x75;
				 *_t56 =  *(__edi + 0x75) + __cl;
				__eflags =  *_t56;
				if( *_t56 == 0) {
					L61:
					__esp = __esp - 1;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __dl;
					__eflags =  *__eax;
					goto L62;
				} else {
					__esi =  *(__eax + 0x65) * 0x69440064;
					__eflags = __esi;
					if(__esi < 0) {
						L60:
						__eax = __eax + 1;
						_t66 = __eax + __eax;
						 *_t66 =  *(__eax + __eax) + __cl;
						__eflags =  *_t66;
						goto L61;
					} else {
						__esi =  *(__edi + 0x72 + __ebp * 2) * 0x61;
						__eflags = __esi;
						if(__eflags == 0) {
							L62:
							 *__eax =  *__eax + __al;
							 *((intOrPtr*)(__ebx + 0x70)) =  *((intOrPtr*)(__ebx + 0x70)) + __dl;
							asm("rcr dword [edx], cl");
						} else {
							if(__eflags < 0) {
								L65:
								_t75 = __eax;
								__eax = __ebp;
								_t75 = _t75;
								__ebp =  &_a1;
								__ebp = 0x28f2d;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
								goto L66;
							} else {
								if(__eflags >= 0) {
									L58:
									__al = __al +  *__eax;
									__eflags = __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									__eflags =  *__ecx & __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
									__ah = 0x15;
									goto L60;
								} else {
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
									if(__eflags < 0) {
										if(__eflags < 0) {
											asm("cld");
											__edi = __edi + 1;
											__eflags =  *(__ebp + 9 + __edx * 4) & 0x000000ed;
											goto L65;
										} else {
											asm("outsb");
											if(__eflags < 0) {
												asm("popad");
												 *[gs:eax] =  *[gs:eax] + __al;
												_push(__eax);
												 *__eax =  *__eax + __al;
												 *((intOrPtr*)(__edx - 0x75a6e9b5)) =  *((intOrPtr*)(__edx - 0x75a6e9b5)) + __ch;
												__esp = 0x38ab4752;
												__ch = 0x8c;
												__ebp =  &_v1;
												__eax = __eax ^ 0x0000c11e;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												 *__eax =  *__eax + __al;
												__eflags =  *__eax;
												goto L58;
											}
										}
										L66:
										 *__eax =  *__eax + __al;
										 *__eax =  *__eax + __al;
										__eflags =  *__eax;
									}
								}
							}
						}
					}
				}
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__ecx =  *__ecx + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *0x49 =  *0x49 + __ch;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __cl;
				__eax = __eax + 1;
				 *((intOrPtr*)(__eax + __eax + 0x10000)) =  *((intOrPtr*)(__eax + __eax + 0x10000)) + __bl;
				 *__eax =  *__eax + __eax;
				__eflags =  *__eax;
				if( *__eax != 0) {
					__eax = __eax + 1;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					 *((intOrPtr*)(__eax - 0xffbf7f)) =  *((intOrPtr*)(__eax - 0xffbf7f)) + __cl;
					asm("invalid");
					 *__eax =  *__eax + 1;
					 *__eax =  *__eax + __al;
					__al = __al + __bh;
					 *__eax =  *__eax & __eax;
					asm("sbb al, 0x40");
					__edx = __edx + 1;
					 *__eax =  *__eax + __al;
					 *__eax =  *__eax + __al;
					__al = __al + __cl;
					__eflags =  *__edi & __dh;
				}
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				__al = __al + __bh;
				asm("sbb [eax], al");
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __al;
				__eax = 0x4035;
				 *0x4035 =  *0x4035 + __al;
				__al = __al + __bh;
				asm("sbb [eax], al");
				 *0x4035 =  *0x4035 + 0x4035;
				 *0x4035 =  *0x4035 + __al;
				 *__ecx =  *__ecx + __bl;
				__eax = 0x4036;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				__ah = __ah + __bh;
				asm("sbb [eax], al");
				__al = __al +  *0x4035;
				 *0x4035 =  *0x4035 + __al;
				 *__ecx =  *__ecx + __bl;
				__eax = 0x4037;
				 *0x4035 =  *0x4035 + __al;
				 *((intOrPtr*)(__edi + 0x6c006801)) =  *((intOrPtr*)(__edi + 0x6c006801)) + __dh;
				 *0x0000404E =  *((intOrPtr*)(0x404e)) + __dl;
				__eax = 0x4038;
				 *0x00004078 =  *((intOrPtr*)(0x4078)) + __dl;
				__edx = __edx + 1;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				__ah = __ah + __ah;
				__eflags = __ah;
				asm("lodsd");
				if (__ah < 0) goto L70;
				asm("enter 0x4035, 0x0");
				__fp0 = __fp0 /  *0x400040;
				_pop(ds);
				 *0x0000806A =  *((intOrPtr*)(0x806a)) + __dh;
				 *0x4035 =  *0x4035 + __al;
				 *__edx =  *__edx << 1;
				__eax = 0x4039;
				__bh = __bh + __bh;
				asm("invalid");
				 *0x4035 =  *0x4035 + 1;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *((intOrPtr*)(0x404e)) =  *((intOrPtr*)(0x404e)) + __dl;
				__eax = 0x403a;
				 *0xFFFFFFFFE000B896 =  *0xFFFFFFFFE000B896 + __dh;
				__al = __al &  *0x4035;
				asm("invalid");
				asm("invalid");
				__eax = 0x403b;
				 *__ecx =  *__ecx + __dl;
				 *0x4035 =  *0x4035 + __bh;
				 *0x4035 =  *0x4035 + __al;
				 *0x00004058 =  *((intOrPtr*)(0x4058)) + __bh;
				__eax = 0x403c;
				 *__ecx =  *__ecx + __al;
				 *__ebx =  *__ebx + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				__ah = __ah + __ah;
				asm("sbb [eax], eax");
				 *(__ecx + 0x78) =  *(__ecx + 0x78) << 1;
				__al = __al + __ch;
				__eax = 0x1407c;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c));
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *__ecx =  *__ecx + __bl;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 1;
				 *0x4C00804D =  *((intOrPtr*)(0x4c00804d)) + __al;
				asm("adc eax, 0x15520040");
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 2;
				 *0x0000404A =  *((intOrPtr*)(0x404a)) + __bl;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 3;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __ch;
				asm("sbb [eax], eax");
				asm("sbb byte [eax], 0x40");
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 4;
				 *((intOrPtr*)(0x404a)) =  *((intOrPtr*)(0x404a)) + __bl;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 5;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				__ah = __ah + __dh;
				 *0x4035 =  *0x4035 + 0x4035;
				 *((intOrPtr*)(__ecx + 0x40)) =  *((intOrPtr*)(__ecx + 0x40)) + __dh;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x300080B8 =  *((intOrPtr*)(0x300080b8)) + __dl;
				__eflags =  *__edx - __al;
				 *__ecx = ss;
				 *0x4035 =  *0x4035 + __al;
				 *0x00004077 =  *0x00004077 | __al;
				 *__esi =  *__esi + __dh;
				asm("adc eax, [eax]");
				 *0x00004077 =  *0x00004077 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __bh;
				_pop(ss);
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 6;
				 *__ecx =  *__ecx + __al;
				 *0x4035 =  *0x4035 + __al;
				 *__ecx =  *__ecx + __al;
				 *0x4035 =  *0x4035 + __al;
				 *((intOrPtr*)(__ecx + 0x40)) =  *((intOrPtr*)(__ecx + 0x40)) + __dh;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x00003FB6 =  *((intOrPtr*)(0x3fb6)) + __cl;
				__eax = 0x1407c +  *((intOrPtr*)(0x1407c)) + 7;
				__bh = __bh + __bh;
				asm("invalid");
				 *0x4035 =  *0x4035 + 1;
				 *0x4035 =  *0x4035 + __al;
				__al = __al + __cl;
				 *0x4035 =  *0x4035 & 0x00004035;
				 *0x00004077 =  *0x00004077 | __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __al;
				 *0x4035 =  *0x4035 + __ah;
				__eflags =  *0x4035;
				if(__eflags < 0) {
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					__ah = __ah + __dh;
					asm("sbb al, 0x40");
					 *__ecx =  *__ecx + __al;
					 *0x4035 =  *0x4035 + __al;
					 *0x00008057 =  *((intOrPtr*)(0x8057)) + __ah;
					 *0x4035 =  *0x4035 + __al;
					__ah = __ah + __dh;
					asm("sbb al, 0x40");
					 *__ecx =  *__ecx + __al;
					 *0x4035 =  *0x4035 + __al;
					__ah = __ah + __bh;
					asm("sbb al, 0x40");
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					__al = __al + __bh;
					asm("sbb al, 0x40");
					 *__esi =  *__esi + __al;
					 *0x4035 =  *0x4035 + __al;
					__ah = __ah + __bh;
					asm("sbb al, 0x40");
					 *__edi =  *__edi + __cl;
					 *((intOrPtr*)(__edi + 0x6c006801)) =  *((intOrPtr*)(__edi + 0x6c006801)) + __dh;
					__ah = __ah + __ch;
					asm("sbb eax, 0x4a540040");
					__edx = __edx + 1;
					 *0x4035 =  *0x4035 + __al;
					 *0x4035 =  *0x4035 + __al;
					__al = __al + __bl;
					__eflags = __al;
					_pop(__ebp);
					if (__al < 0) goto L72;
					__al = 0x22;
					__eax = __eax + 1;
					__al = 0x44;
					__al = 0x44 &  *0x4035;
					__eax = __eax + 1;
					 *__edi =  *__edi + __bl;
					 *((intOrPtr*)(0x806a)) =  *((intOrPtr*)(0x806a)) + __dh;
					 *0x4035 =  *0x4035 + 0x22;
					 *__edx =  *__edx << 1;
					__eax = __eax + 1;
					__bh = __bh + __bh;
					asm("invalid");
					 *0x4035 =  *0x4035 + 1;
					 *0x4035 =  *0x4035 + 0x22;
					 *0x4035 =  *0x4035 + 0x22;
					 *0x4035 =  *0x4035 + 0x22;
					 *0x4035 =  *0x4035 + __ch;
					_push(ds);
					__eax = __eax + 1;
					 *0xFFFFFFFFE000B896 =  *0xFFFFFFFFE000B896 + __dh;
					__eflags =  *0xFFFFFFFFE000B896;
				}
				asm("popad");
				if (__eflags < 0) goto L74;
				asm("loopne 0x24");
				__eax = __eax + 1;
				__bh = __bh + __bh;
				asm("invalid");
				 *__eax =  *__eax + 1;
				asm("sbb [eax], al");
				__eflags =  *__eax - __al;
				 *__eax =  *__eax + __al;
				asm("pushad");
				__eax = __eax &  *__eax;
				__al = __al;
				__eax = __eax +  *__eax;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				__eflags =  *__eax;
				__esp = 0xc000401e;
				asm("popad");
				if (__eflags < 0) goto L75;
				if(__eflags < 0) {
					L78:
					asm("popad");
					if (__eflags < 0) goto L79;
					 *__ebx = __ah;
					__eax = __eax + 1;
					 *__ecx =  *__ecx + __al;
					 *__ebx =  *__ebx + __al;
					 *__eax =  *__eax + __al;
					asm("adc [eax], eax");
					__eax = __eax + 1;
					__eflags = __eax;
				} else {
					__eax = __eax + 1;
					 *(__eax + __eax) =  *(__eax + __eax) + __al;
					__eax = __eax +  *__eax;
					__eax = __eax + 1;
					 *__ecx =  *__ecx + __dl;
					 *(__eax + __eax) =  *(__eax + __eax) + __bh;
					 *__eax =  *__eax + __al;
					__eflags =  *__eax;
					if( *__eax >= 0) {
						__eax = __eax + 1;
						 *__ecx =  *__ecx + __al;
						 *__ebx =  *__ebx + __al;
						 *__eax =  *__eax + __al;
						 *__eax =  *__eax + __al;
						 *__eax =  *__eax + __al;
						 *__eax =  *__eax + __al;
						 *((intOrPtr*)(__edi + __ebx)) =  *((intOrPtr*)(__edi + __ebx)) + __dh;
						__eax = __eax + 1;
						__al = __al + __dl;
						__eflags = __al;
						goto L78;
					}
				}
				 *__eax =  *__eax + __al;
				 *((intOrPtr*)(__eax + 0x23)) =  *((intOrPtr*)(__eax + 0x23)) + __bh;
				__eax = __eax + 1;
				 *__edx =  *__edx + __al;
				 *__ebx =  *__ebx + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				_t142 = __eax - 0x2fffbfe1;
				 *_t142 =  *(__eax - 0x2fffbfe1) + __dl;
				__eflags =  *_t142;
				asm("popad");
				if ( *_t142 < 0) goto L81;
				_t144 = __eax;
				__eax = __esp;
				__esp = _t144;
				__eax = __eax &  *__eax;
				__al = __al +  *__eax;
				__eax = __eax +  *__eax;
				__eax = __eax + 1;
				 *__eax =  *__eax + __bl;
				 *(__eax + __eax) =  *(__eax + __eax) + __al;
				 *((intOrPtr*)(__eax + 0x23)) =  *((intOrPtr*)(__eax + 0x23)) + __ah;
				__eax = __eax + 1;
				 *__ebx =  *__ebx + __al;
				 *__ebx =  *__ebx + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				__ah = __ah + __ch;
				_pop(ds);
				__eax = __eax + 1;
				__al = __al + __al;
				__eflags = __al;
				asm("popad");
				if (__al < 0) goto L82;
				__al =  *0x3004023;
				 *__ebx =  *__ebx + __al;
				 *__eax =  *__eax + __al;
				__eax = __eax | 0x00004800;
				 *((intOrPtr*)(0x5004023 + __eax)) =  *((intOrPtr*)(0x5004023 + __eax)) + __ch;
				 *__ebx =  *__ebx + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *__eax =  *__eax + __al;
				 *((intOrPtr*)(__eax + 0x40)) =  *((intOrPtr*)(__eax + 0x40)) + __ah;
				__al = __al + __ah;
				__eflags = __al;
				asm("popad");
				if (__al < 0) goto L83;
				__eax = 0x5004023;
				 *__ebx =  *__ebx + __al;
				 *0xFFFFFFFFD7008043 =  *((intOrPtr*)(0xffffffffd7008043)) + __bh;
				 *0x5004023 =  *0x5004023 & __al;
				asm("in al, dx");
				 *0x5004023 =  *0x5004023 & __al;
				asm("adc esp, [ecx]");
				__eax = 0x5004024;
				 *((intOrPtr*)(__edi + 0x21)) =  *((intOrPtr*)(__edi + 0x21)) + __al;
				__eax = 0x5004025;
				 *((intOrPtr*)(__ecx + 0x40)) =  *((intOrPtr*)(__ecx + 0x40)) + __dl;
				 *((intOrPtr*)(__ecx + 0x21)) =  *((intOrPtr*)(__ecx + 0x21)) + __ah;
				__eax = 0x5004026;
				 *((intOrPtr*)(__esi + 0x21)) =  *((intOrPtr*)(__esi + 0x21)) + __ch;
				__eax = 0x5004027;
				__ch = __ch + __al;
				 *0x5004023 =  *0x5004023 & __al;
				asm("fbld tword [eax]");
				__eax = 0x5004028;
				__cl = __cl + __bh;
				 *0x5004023 =  *0x5004023 & __al;
				 *0x5004023 =  *0x5004023 & 0x05004023;
				 *__ecx =  *__ecx & __ah;
				__eax = 0x5004029;
				 *0x3a004021 =  *0x3a004021 + __ch;
				 *0x5004023 =  *0x5004023 & 0x05004023;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				asm("cld");
				asm("sbb al, 0x40");
				 *((intOrPtr*)(__esp + __ebx + 0x40)) =  *((intOrPtr*)(__esp + __ebx + 0x40)) + __bh;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x500402a;
				 *0x05004038 =  *0x05004038 + __bl;
				__eax = 0x500402b;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				__cl = __cl + __dh;
				 *0x5004023 =  *0x5004023 & __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				__al = __al & 0x0000001d;
				__eax = 0x500402c;
				 *((intOrPtr*)(__esp + __ebx + 0x40)) =  *((intOrPtr*)(__esp + __ebx + 0x40)) + __bh;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x500402d;
				 *0x05004038 =  *0x05004038 + __bl;
				__eax = 0x500402e;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *((intOrPtr*)(__ebp + __ebx + 0x40)) =  *((intOrPtr*)(__ebp + __ebx + 0x40)) + __cl;
				 *((intOrPtr*)(__esp + __ebx + 0x40)) =  *((intOrPtr*)(__esp + __ebx + 0x40)) + __bh;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x500402f;
				 *0x05004038 =  *0x05004038 + __bl;
				__eax = 0x5004030;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *((intOrPtr*)(__ebp + __ebx + 0x40)) =  *((intOrPtr*)(__ebp + __ebx + 0x40)) + __dh;
				 *((intOrPtr*)(__esp + __ebx + 0x40)) =  *((intOrPtr*)(__esp + __ebx + 0x40)) + __bh;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x5004031;
				 *0x05004038 =  *0x05004038 + __bl;
				__eax = 0x5004032;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *((intOrPtr*)(__ebp + __ebx + 0x1c7c0040)) =  *((intOrPtr*)(__ebp + __ebx + 0x1c7c0040)) + __bl;
				__eax = 0x5004033;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x5004034;
				 *0x05004038 =  *0x05004038 + __bl;
				__eax = 0x5004035;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				__ah = __ah + __al;
				asm("sbb eax, 0x1c7c0040");
				__eax = 0x5004036;
				 *((intOrPtr*)(__ebp + __edx + 0x40)) =  *((intOrPtr*)(__ebp + __edx + 0x40)) + __cl;
				 *((intOrPtr*)(__edx + 0x15)) =  *((intOrPtr*)(__edx + 0x15)) + __dl;
				__eax = 0x5004037;
				 *0x05004038 =  *0x0500404C + __bl;
				__eflags =  *0x05004038;
				__eax = es;
				asm("adc eax, 0x40");
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *0x5004023 =  *0x5004023 + __al;
				 *((intOrPtr*)(0x5004037)) =  *((intOrPtr*)(0x5004037)) + __al;
				_a7 = _a7 - 0xffff;
				while(1) {
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0xc;
					_push(0x401336);
					__eax =  *[fs:0x0];
					_push( *[fs:0x0]);
					 *[fs:0x0] = __esp;
					__eax = 0x84;
					__al = __al + __ch;
					__eflags = __al;
					if(__eflags >= 0) {
						asm("popad");
						asm("fs insd");
						__esi =  *(__edx + 0x61) * 0x6c66736c;
						asm("popad");
						asm("a16 gs outsb");
						asm("outsb");
						if (__eflags >= 0) goto L87;
						 *0x84 =  *0x84 + __al;
						_t242 = __esi + 0x6f;
						 *_t242 =  *(__esi + 0x6f) + __cl;
						__eflags =  *_t242;
						asm("outsd");
						asm("outsb");
						asm("insb");
						asm("outsd");
						__esi =  *(__bp + __di + 0x74) * 0x346369;
						 *0x84 =  *0x84 + __al;
						_t246 = __ebx + 0x65;
						 *_t246 =  *(__ebx + 0x65) + __cl;
						__eflags =  *_t246;
						if(__eflags >= 0) {
							goto L102;
						} else {
							asm("outsd");
							asm("outsd");
							if (__eflags == 0) goto L91;
							__ebx = __ebx - 1;
							__eflags = __ebx;
							if(__ebx >= 0) {
								goto L103;
							} else {
								asm("popad");
								asm("insd");
								 *[gs:ebx+0x75] =  *[gs:ebx+0x75] + __dl;
								asm("bound ecx, [ebx+0x65]");
								__ebx = __ebx - 1;
								__eflags = __ebx;
								if (__eflags >= 0) goto L104;
								if(__eflags >= 0) {
									goto L104;
								} else {
									asm("o16 add [gs:eax], al");
									 *0x84 =  *0x84 + __al;
									_t248 = __ebx + 0x65;
									 *_t248 =  *(__ebx + 0x65) + __cl;
									__eflags =  *_t248;
									if( *_t248 < 0) {
										asm("popad");
										asm("insb");
										 *0x84 =  *0x84 + __al;
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										continue;
									}
								}
							}
						}
					} else {
						asm("invalid");
						_push(__ebx);
						_push(__esi);
						_push(__edi);
						_v16 = __esp;
						_v12 = 0x401188;
						L102:
						__ebp =  &_v3;
						__eflags =  &_v3;
						asm("clc");
						 *__ecx = __dl;
						L103:
						__eax = __eax + 1;
						__bh = __bh + __al;
						__ebp =  &_v3;
						asm("cld");
						 *__eax =  *__eax + __al;
						 *__eax =  *__eax + __al;
						__eflags =  *__eax;
						__eax = _a4;
						__eax =  *_a4;
						_push(_a4);
						L104:
						if(__eflags == 0) {
							__eax =  *((intOrPtr*)(__eax + 4))();
							__edx = _a24;
							__ecx =  &_v36;
						}
						asm("loopne 0xffffffea");
						_t257 = __eax;
						__eax = __ecx;
						__ecx = _t257;
					}
					_t258 = __eax;
					__eax = __ecx;
					__ecx = _t258;
					asm("invalid");
					_push(0x402430);
					L00401540();
					__eflags = (__al & 0x000000ff) - 2;
					if((__al & 0x000000ff) != 2) {
						__eflags =  *0x42433c;
						if( *0x42433c != 0) {
							_v100 = 0x42433c;
						} else {
							_push(0x42433c);
							_push(0x402454);
							L00401534();
							_v100 = 0x42433c;
						}
						_t261 =  &_v100; // 0x42433c
						 *_t261 =  *((intOrPtr*)( *_t261));
						_v72 =  *((intOrPtr*)( *_t261));
						_t263 =  &_v44; // 0x42433c
						__eax = _t263;
						__eax = _v72;
						__eax =  *_v72;
						__eax =  *((intOrPtr*)( *_v72 + 0x14))(_v72, _t263);
						asm("fclex");
						_v76 = __eax;
						__eflags = _v76;
						if(_v76 >= 0) {
							_t272 =  &_v104;
							 *_t272 = _v104 & 0x00000000;
							__eflags =  *_t272;
						} else {
							_push(0x14);
							_push(0x402444);
							_push(_v72);
							_push(_v76);
							L0040152E();
							_v104 = __eax;
						}
						__eax = _v44;
						_v80 = _v44;
						_t276 =  &_v40; // 0x402430
						__eax = _t276;
						__eax = _v80;
						__eax =  *_v80;
						__eax =  *((intOrPtr*)( *_v80 + 0xe8))(_v80, _t276);
						asm("fclex");
						_v84 = __eax;
						__eflags = _v84;
						if(_v84 >= 0) {
							_t285 =  &_v108;
							 *_t285 = _v108 & 0x00000000;
							__eflags =  *_t285;
						} else {
							_push(0xe8);
							_push(0x402464);
							_push(_v80);
							_push(_v84);
							L0040152E();
							_v108 = __eax;
						}
						_t287 =  &_v40; // 0x402430
						__eax =  *_t287;
						_v96 =  *_t287;
						_v40 = _v40 & 0x00000000;
						__edx = _v96;
						__ecx =  &_v28;
						L0040153A();
						__ecx =  &_v44;
						L00401528();
						__eflags =  *0x42433c;
						if( *0x42433c != 0) {
							_v112 = 0x42433c;
						} else {
							_push(0x42433c);
							_push(0x402454);
							L00401534();
							_v112 = 0x42433c;
						}
						_t296 =  &_v112; // 0x42433c
						 *_t296 =  *((intOrPtr*)( *_t296));
						_v72 =  *((intOrPtr*)( *_t296));
						__eax =  &_v44;
						__eax = _v72;
						__eax =  *_v72;
						__eax =  *((intOrPtr*)( *_v72 + 0x14))(_v72,  &_v44);
						asm("fclex");
						_v76 = __eax;
						__eflags = _v76;
						if(_v76 >= 0) {
							_t307 =  &_v116;
							 *_t307 = _v116 & 0x00000000;
							__eflags =  *_t307;
						} else {
							_push(0x14);
							_push(0x402444);
							_push(_v72);
							_push(_v76);
							L0040152E();
							_v116 = __eax;
						}
						__eax = _v44;
						_v80 = _v44;
						__eax =  &_v68;
						__eax = _v80;
						__eax =  *_v80;
						__eax =  *((intOrPtr*)( *_v80 + 0x70))(_v80,  &_v68);
						asm("fclex");
						_v84 = __eax;
						__eflags = _v84;
						if(_v84 >= 0) {
							_t320 =  &_v120;
							 *_t320 = _v120 & 0x00000000;
							__eflags =  *_t320;
						} else {
							_push(0x70);
							_push(0x402464);
							_push(_v80);
							_push(_v84);
							L0040152E();
							_v120 = __eax;
						}
						_v32 = _v68;
						__ecx =  &_v44;
						L00401528();
						__eflags =  *0x424010;
						if( *0x424010 != 0) {
							_v124 = 0x424010;
						} else {
							_push(0x424010);
							_push(0x401c7c);
							L00401534();
							_v124 = 0x424010;
						}
						_v124 =  *_v124;
						_v124 =  *_v124;
						__ecx =  *( *_v124);
						__eax =  *((intOrPtr*)(__ecx + 0x2fc))( *_v124);
						__eax =  &_v44;
						L00401516();
						_v72 = __eax;
						__eax =  &_v48;
						__eax = _v72;
						__eax =  *_v72;
						__eax =  *((intOrPtr*)( *_v72 + 0x158))(_v72,  &_v48, __eax,  *_v124);
						asm("fclex");
						_v76 = __eax;
						__eflags = _v76;
						if(_v76 >= 0) {
							_t341 =  &_v128;
							 *_t341 = _v128 & 0x00000000;
							__eflags =  *_t341;
						} else {
							_push(0x158);
							_push(0x402474);
							_push(_v72);
							_push(_v76);
							L0040152E();
							_v128 = __eax;
						}
						_push(0);
						_push(0);
						_push(_v48);
						__eax =  &_v64;
						_push(__eax);
						L0040151C();
						__esp = __esp + 0x10;
						_push(__eax);
						L00401522();
						_v132 = __eax;
						asm("fild dword [ebp-0x80]");
						_v140 = __fp0;
						__fp0 = _v140;
						__fp0 = _v140 *  *0x401180;
						asm("fnstsw ax");
						__eflags = __al & 0x0000000d;
						if((__al & 0x0000000d) != 0) {
							return __imp____vbaFPException();
						}
						_v144 = __fp0;
						__fp0 = _v144;
						 *__esp = _v144;
						__eax = _a4;
						__eax =  *_a4;
						__eax =  *((intOrPtr*)( *_a4 + 0x84))(_a4, __ecx);
						asm("fclex");
						_v80 = __eax;
						__eflags = _v80;
						if(_v80 >= 0) {
							_t360 =  &_v148;
							 *_t360 = _v148 & 0x00000000;
							__eflags =  *_t360;
						} else {
							_push(0x84);
							_push(0x402290);
							_push(_a4);
							_push(_v80);
							L0040152E();
							_v148 = __eax;
						}
						__eax =  &_v48;
						_push( &_v48);
						__eax =  &_v44;
						_push( &_v44);
						_push(2);
						L00401510();
						__esp = __esp + 0xc;
						__ecx =  &_v64;
						L0040150A();
					}
					__eflags =  *0x424010;
					if( *0x424010 != 0) {
						_v152 = 0x424010;
					} else {
						_push(0x424010);
						_push(0x401c7c);
						L00401534();
						_v152 = 0x424010;
					}
					_v152 =  *_v152;
					_v152 =  *_v152;
					__ecx =  *( *_v152);
					__eax =  *((intOrPtr*)( *( *_v152) + 0x30c))( *_v152);
					__eax =  &_v44;
					L00401516();
					_v72 = __eax;
					__eax = _v72;
					__eax =  *_v72;
					__eax =  *((intOrPtr*)( *_v72 + 0x170))(_v72, __eax,  *_v152);
					asm("fclex");
					_v76 = __eax;
					__eflags = _v76;
					if(_v76 >= 0) {
						_t380 =  &_v156;
						 *_t380 = _v156 & 0x00000000;
						__eflags =  *_t380;
					} else {
						_push(0x170);
						_push(0x402484);
						_push(_v72);
						_push(_v76);
						L0040152E();
						_v156 = __eax;
					}
					__ecx =  &_v44;
					L00401528();
					asm("wait");
					_push(E00408766);
					__ecx =  &_v28;
					L00401504();
					__ecx =  &_v36;
					L00401504();
					return __eax;
				}
			}

0x00401564
0x00401569
0x0040156e
0x00401570
0x00401572
0x00401574
0x00401576
0x00401578
0x00401579
0x0040157b
0x0040157d
0x00401580
0x00401580
0x00401580
0x00401583
0x004015be
0x004015be
0x004015c3
0x004015c5
0x004015c6
0x004015c6
0x004015cb
0x004015ef
0x004015ef
0x004015ef
0x004015cd
0x004015cd
0x004015d2
0x004015d4
0x004015da
0x004015db
0x004015dc
0x004015e4
0x004015e5
0x004015e8
0x004015e8
0x004015e8
0x004015e9
0x004015eb
0x004015ed
0x004015ed
0x00000000
0x004015ed
0x004015d2
0x004015f1
0x004015f3
0x004015f5
0x004015f7
0x004015f9
0x004015fb
0x004015fd
0x004015ff
0x00401601
0x00401603
0x00401603
0x00000000
0x00401585
0x00401585
0x00401588
0x00401589
0x0040158c
0x0040158d
0x00401593
0x00401595
0x00401597
0x00401599
0x0040159b
0x0040159b
0x0040159b
0x0040159e
0x004015a0
0x004015a2
0x00401605
0x00401605
0x00401607
0x00401609
0x0040160b
0x0040160d
0x0040160f
0x00401611
0x00401612
0x00401612
0x004015a4
0x004015a4
0x004015a5
0x004015a8
0x004015a9
0x004015ad
0x004015b0
0x004015b2
0x004015b4
0x004015b6
0x004015b8
0x004015b8
0x004015bd
0x00000000
0x004015bd
0x004015a5
0x00401613
0x00401615
0x00401615
0x00401615
0x004015a0
0x00401616
0x00401617
0x00401617
0x00401617
0x0040161a
0x0040161b
0x00401682
0x00401682
0x00401688
0x00401688
0x00000000
0x0040161d
0x0040161d
0x0040161e
0x00401689
0x00401689
0x0040168b
0x0040168e
0x00401690
0x00401692
0x00401695
0x00401696
0x00401697
0x00401698
0x00401699
0x0040169c
0x0040169e
0x004016a0
0x004016a1
0x004016a1
0x004016a5
0x00000000
0x004016a7
0x004016a7
0x00000000
0x004016aa
0x004016aa
0x004016ad
0x004016ad
0x004016ad
0x004016b0
0x00000000
0x004016b0
0x004016a7
0x00401620
0x00401620
0x00401621
0x00401622
0x00401624
0x00401625
0x0040162c
0x0040162c
0x00401633
0x0040166d
0x0040166d
0x0040166e
0x0040166f
0x00401672
0x00401674
0x00401675
0x00401675
0x00401675
0x00401678
0x00000000
0x0040167a
0x0040167a
0x0040167b
0x0040167e
0x00401680
0x00401681
0x00401681
0x00000000
0x00401681
0x00401635
0x00401635
0x00401637
0x00401639
0x0040163a
0x0040163c
0x0040163f
0x0040163f
0x0040163f
0x00401642
0x00401643
0x004016b4
0x004016b4
0x004016b6
0x004016b8
0x004016b8
0x00000000
0x00401645
0x00401645
0x004016ba
0x004016ba
0x004016bc
0x004016be
0x004016be
0x004016c3
0x004016f7
0x004016f9
0x004016fb
0x004016fc
0x004016ff
0x00401700
0x00401701
0x00401702
0x00401703
0x00401704
0x00401706
0x00401708
0x0040170a
0x0040170c
0x0040170e
0x0040170e
0x00401713
0x00401713
0x00401714
0x00401715
0x00401718
0x0040171c
0x0040171c
0x0040171d
0x0040171e
0x0040171f
0x00401720
0x004016c5
0x004016c5
0x004016c7
0x004016c7
0x004016c9
0x004016ca
0x004016cc
0x004016d1
0x004016d1
0x004016d3
0x004016d4
0x00401743
0x00401745
0x00401745
0x00000000
0x004016d7
0x004016d7
0x004016d8
0x004016d9
0x00401747
0x00401747
0x00401749
0x0040174b
0x0040174d
0x0040174f
0x00401751
0x00401753
0x00401753
0x00401756
0x00401758
0x0040175a
0x0040175c
0x0040175e
0x00401760
0x00401762
0x00401764
0x00401767
0x00401769
0x0040176b
0x0040176d
0x0040176f
0x00401772
0x00401773
0x00401776
0x00401778
0x0040177a
0x0040177c
0x0040177e
0x00401780
0x00401780
0x00401782
0x00401784
0x00401786
0x004016dc
0x004016dc
0x004016de
0x004016e0
0x004016e0
0x004016e1
0x004016e1
0x004016e3
0x004016e6
0x004016e6
0x004016e6
0x004016ed
0x004016ee
0x004016ee
0x004016ee
0x004016ee
0x004016d9
0x004016d4
0x00401647
0x00401647
0x00401648
0x00000000
0x0040164a
0x0040164a
0x0040164a
0x00401650
0x00401652
0x00401654
0x00401656
0x00401658
0x0040165f
0x0040165f
0x0040165f
0x00401661
0x00401663
0x00401665
0x00401667
0x00401669
0x0040166a
0x0040166b
0x0040166c
0x00000000
0x0040166c
0x00401648
0x00401645
0x00401643
0x00401633
0x0040161e
0x0040178c
0x0040178e
0x0040178f
0x00401791
0x00401792
0x00401793
0x00401796
0x00401797
0x0040179a
0x0040179c
0x004017a2
0x004017a4
0x004017a4
0x004017a4
0x004017a5
0x004017a7
0x004017a9
0x004017ab
0x004017ad
0x004017af
0x004017b1
0x004017b3
0x004017b5
0x004017b7
0x004017b7
0x004017b7
0x004017ba
0x0040182c
0x0040182c
0x0040182d
0x0040182f
0x0040182f
0x00000000
0x004017bc
0x004017bc
0x004017bc
0x004017c3
0x0040182a
0x0040182a
0x0040182b
0x0040182b
0x0040182b
0x00000000
0x004017c5
0x004017c5
0x004017c5
0x004017ca
0x00401831
0x00401831
0x00401833
0x00401836
0x004017cc
0x004017cc
0x0040183c
0x0040183c
0x0040183c
0x0040183d
0x0040183f
0x00401840
0x00401845
0x00401845
0x00000000
0x004017ce
0x004017ce
0x00401809
0x00401809
0x00401809
0x0040180a
0x0040180c
0x0040180e
0x00401810
0x00401812
0x00401814
0x00401816
0x00401818
0x0040181a
0x0040181c
0x0040181e
0x00401820
0x00401822
0x00401824
0x00401826
0x00401826
0x00401828
0x00000000
0x004017d1
0x004017d1
0x004017d1
0x004017d3
0x004017d5
0x00401838
0x00401839
0x0040183a
0x00000000
0x004017d7
0x004017d7
0x004017d8
0x004017db
0x004017dc
0x004017e0
0x004017e1
0x004017e3
0x004017e9
0x004017ee
0x004017f0
0x004017f1
0x004017f6
0x004017f8
0x004017fa
0x004017fc
0x004017fe
0x00401800
0x00401802
0x00401804
0x00401806
0x00401806
0x00000000
0x00401806
0x004017d8
0x00401846
0x00401846
0x00401848
0x00401848
0x00401848
0x004017d3
0x004017ce
0x004017cc
0x004017ca
0x004017c3
0x00401849
0x0040184b
0x0040184d
0x0040184f
0x00401851
0x00401853
0x00401855
0x00401857
0x0040185d
0x0040185f
0x00401861
0x00401863
0x00401865
0x00401867
0x00401869
0x0040186b
0x0040186d
0x0040186f
0x00401875
0x00401877
0x00401879
0x0040187b
0x00401882
0x00401882
0x00401884
0x00401886
0x00401887
0x00401889
0x0040188b
0x00401891
0x00401893
0x00401895
0x00401897
0x00401899
0x0040189c
0x0040189e
0x0040189f
0x004018a1
0x004018a3
0x004018a5
0x004018a5
0x004018a7
0x004018a9
0x004018ab
0x004018ad
0x004018af
0x004018b1
0x004018b3
0x004018b5
0x004018b8
0x004018ba
0x004018bc
0x004018c1
0x004018c3
0x004018c5
0x004018c8
0x004018ca
0x004018cc
0x004018ce
0x004018cf
0x004018d1
0x004018d3
0x004018d5
0x004018d8
0x004018da
0x004018dc
0x004018de
0x004018df
0x004018e1
0x004018e7
0x004018ea
0x004018eb
0x004018ee
0x004018ef
0x004018f1
0x004018f3
0x004018f3
0x004018f5
0x004018f6
0x004018f8
0x004018fc
0x00401902
0x00401903
0x00401906
0x00401908
0x0040190a
0x0040190b
0x0040190d
0x0040190f
0x00401911
0x00401913
0x00401915
0x00401917
0x0040191a
0x0040191b
0x00401921
0x00401924
0x00401926
0x00401928
0x00401929
0x0040192b
0x0040192d
0x0040192f
0x00401932
0x00401933
0x00401935
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401944
0x00401947
0x00401949
0x0040194e
0x00401950
0x00401952
0x00401954
0x00401956
0x00401957
0x0040195d
0x00401962
0x00401963
0x00401966
0x00401967
0x00401969
0x0040196b
0x0040196d
0x0040196f
0x00401971
0x00401973
0x00401975
0x00401977
0x00401979
0x0040197b
0x0040197d
0x0040197f
0x00401981
0x00401983
0x00401985
0x00401987
0x00401989
0x0040198b
0x0040198d
0x0040198f
0x00401991
0x00401993
0x00401995
0x00401997
0x00401999
0x0040199b
0x0040199d
0x0040199f
0x004019a1
0x004019a3
0x004019a5
0x004019a7
0x004019a9
0x004019ab
0x004019ad
0x004019af
0x004019b1
0x004019b3
0x004019b5
0x004019b7
0x004019b9
0x004019bb
0x004019bd
0x004019bf
0x004019c1
0x004019c3
0x004019c5
0x004019c7
0x004019c9
0x004019cb
0x004019cd
0x004019cf
0x004019d1
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019df
0x004019e1
0x004019e3
0x004019e5
0x004019e7
0x004019e9
0x004019ec
0x004019ef
0x004019f3
0x004019f6
0x004019f7
0x004019fa
0x004019fb
0x004019fd
0x004019ff
0x00401a01
0x00401a03
0x00401a05
0x00401a07
0x00401a09
0x00401a0b
0x00401a0d
0x00401a0f
0x00401a11
0x00401a13
0x00401a15
0x00401a17
0x00401a19
0x00401a1b
0x00401a1d
0x00401a1f
0x00401a21
0x00401a23
0x00401a25
0x00401a27
0x00401a29
0x00401a2b
0x00401a2d
0x00401a2f
0x00401a31
0x00401a33
0x00401a35
0x00401a37
0x00401a39
0x00401a3b
0x00401a3d
0x00401a3f
0x00401a41
0x00401a43
0x00401a47
0x00401a49
0x00401a4b
0x00401a51
0x00401a54
0x00401a56
0x00401a58
0x00401a5b
0x00401a5d
0x00401a60
0x00401a63
0x00401a65
0x00401a67
0x00401a69
0x00401a6b
0x00401a6d
0x00401a6f
0x00401a71
0x00401a73
0x00401a75
0x00401a77
0x00401a79
0x00401a7b
0x00401a7d
0x00401a7f
0x00401a81
0x00401a83
0x00401a85
0x00401a87
0x00401a89
0x00401a8b
0x00401a8d
0x00401a8f
0x00401a91
0x00401a93
0x00401a95
0x00401a97
0x00401a99
0x00401a9b
0x00401a9d
0x00401a9f
0x00401aa1
0x00401aa3
0x00401aa5
0x00401aa7
0x00401aa9
0x00401aab
0x00401aad
0x00401aaf
0x00401ab1
0x00401ab3
0x00401ab5
0x00401ab7
0x00401ab9
0x00401abb
0x00401abd
0x00401abf
0x00401ac1
0x00401ac3
0x00401ac5
0x00401ac7
0x00401ac9
0x00401acb
0x00401acd
0x00401acf
0x00401ad1
0x00401ad3
0x00401ad5
0x00401ad7
0x00401ad9
0x00401adb
0x00401add
0x00401adf
0x00401ae1
0x00401ae3
0x00401ae5
0x00401ae7
0x00401ae9
0x00401aeb
0x00401aed
0x00401aef
0x00401af1
0x00401af3
0x00401af5
0x00401af7
0x00401af9
0x00401afb
0x00401afd
0x00401aff
0x00401b01
0x00401b03
0x00401b05
0x00401b07
0x00401b09
0x00401b0b
0x00401b0d
0x00401b0f
0x00401b11
0x00401b13
0x00401b15
0x00401b17
0x00401b19
0x00401b1b
0x00401b1d
0x00401b1f
0x00401b21
0x00401b23
0x00401b25
0x00401b27
0x00401b29
0x00401b2b
0x00401b2d
0x00401b2f
0x00401b31
0x00401b33
0x00401b35
0x00401b37
0x00401b39
0x00401b3b
0x00401b3d
0x00401b3f
0x00401b41
0x00401b43
0x00401b45
0x00401b47
0x00401b49
0x00401b4b
0x00401b4d
0x00401b4f
0x00401b51
0x00401b53
0x00401b55
0x00401b57
0x00401b59
0x00401b5b
0x00401b5d
0x00401b5f
0x00401b61
0x00401b63
0x00401b65
0x00401b67
0x00401b69
0x00401b6b
0x00401b6d
0x00401b6f
0x00401b71
0x00401b73
0x00401b75
0x00401b77
0x00401b79
0x00401b7b
0x00401b7d
0x00401b7f
0x00401b81
0x00401b83
0x00401b85
0x00401b87
0x00401b89
0x00401b8b
0x00401b8d
0x00401b8f
0x00401b91
0x00401b93
0x00401b95
0x00401b97
0x00401b99
0x00401b9b
0x00401b9d
0x00401b9f
0x00401ba1
0x00401ba3
0x00401ba5
0x00401ba7
0x00401ba9
0x00401bab
0x00401bad
0x00401baf
0x00401bb1
0x00401bb3
0x00401bb5
0x00401bb7
0x00401bb9
0x00401bbb
0x00401bbd
0x00401bbf
0x00401bc1
0x00401bc3
0x00401bc5
0x00401bc7
0x00401bc9
0x00401bcb
0x00401bcd
0x00401bcf
0x00401bd1
0x00401bd3
0x00401bd5
0x00401bd7
0x00401bd9
0x00401bdb
0x00401bdd
0x00401bdf
0x00401be1
0x00401be3
0x00401be5
0x00401be7
0x00401be9
0x00401beb
0x00401bed
0x00401bef
0x00401bf1
0x00401bf3
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfb
0x00401bfd
0x00401bff
0x00401c01
0x00401c03
0x00401c05
0x00401c07
0x00401c09
0x00401c0b
0x00401c0d
0x00401c0f
0x00401c11
0x00401c13
0x00401c15
0x00401c17
0x00401c19
0x00401c1b
0x00401c1d
0x00401c1f
0x00401c21
0x00401c23
0x00401c25
0x00401c27
0x00401c29
0x00401c2b
0x00401c2d
0x00401c2f
0x00401c31
0x00401c33
0x00401c35
0x00401c37
0x00401c39
0x00401c3b
0x00401c3d
0x00401c3f
0x00401c41
0x00401c43
0x00401c45
0x00401c47
0x00401c49
0x00401c4b
0x00401c4d
0x00401c4f
0x00401c51
0x00401c53
0x00401c55
0x00401c57
0x00401c59
0x00401c5b
0x00401c5d
0x00401c5f
0x00401c61
0x00401c63
0x00401c65
0x00401c67
0x00401c69
0x00401c6b
0x00401c6d
0x00401c6f
0x00401c71
0x00401c73
0x00401c75
0x00401c76
0x00401c77
0x00401c79
0x00401c7b
0x00401c7d
0x00401c7f
0x00401c83
0x00401c85
0x00401c87
0x00401c8a
0x00401c8b
0x00401c8d
0x00401c8f
0x00401c91
0x00401c93
0x00401c95
0x00401c98
0x00401c9b
0x00401c9d
0x00401c9f
0x00401c9f
0x00401ca1
0x00401ca3
0x00401ca5
0x00401ca7
0x00401ca9
0x00401cab
0x00401cad
0x00401caf
0x00401cb1
0x00401cb3
0x00401cb5
0x00401cb7
0x00401cbd
0x00401cbf
0x00401cc1
0x00401cc3
0x00401cc5
0x00401cc7
0x00401cc9
0x00401ccb
0x00401ccd
0x00401ccf
0x00401cd1
0x00401cd3
0x00401cd5
0x00401cd7
0x00401cd9
0x00401cdb
0x00401cdd
0x00401ce3
0x00401ce5
0x00401cea
0x00401ceb
0x00401ced
0x00401cef
0x00401cef
0x00401cf1
0x00401cf2
0x00401cf4
0x00401cf6
0x00401cf7
0x00401cf9
0x00401cfc
0x00401cfd
0x00401cff
0x00401d02
0x00401d04
0x00401d06
0x00401d07
0x00401d09
0x00401d0b
0x00401d0d
0x00401d0f
0x00401d11
0x00401d13
0x00401d15
0x00401d16
0x00401d17
0x00401d17
0x00401d17
0x00401d19
0x00401d1a
0x00401d1c
0x00401d1e
0x00401d1f
0x00401d21
0x00401d23
0x00401d26
0x00401d28
0x00401d2a
0x00401d2c
0x00401d2d
0x00401d30
0x00401d32
0x00401d34
0x00401d36
0x00401d38
0x00401d3a
0x00401d3a
0x00401d3c
0x00401d41
0x00401d42
0x00401d44
0x00401d69
0x00401d69
0x00401d6a
0x00401d6c
0x00401d6e
0x00401d6f
0x00401d71
0x00401d73
0x00401d76
0x00401d78
0x00401d78
0x00401d46
0x00401d46
0x00401d47
0x00401d4a
0x00401d4c
0x00401d4d
0x00401d4f
0x00401d52
0x00401d52
0x00401d54
0x00401d56
0x00401d57
0x00401d59
0x00401d5b
0x00401d5d
0x00401d5f
0x00401d61
0x00401d63
0x00401d66
0x00401d67
0x00401d67
0x00000000
0x00401d67
0x00401d54
0x00401d79
0x00401d7b
0x00401d7e
0x00401d7f
0x00401d81
0x00401d83
0x00401d85
0x00401d87
0x00401d89
0x00401d8b
0x00401d8b
0x00401d8b
0x00401d91
0x00401d92
0x00401d94
0x00401d94
0x00401d94
0x00401d95
0x00401d98
0x00401d9a
0x00401d9c
0x00401d9d
0x00401d9f
0x00401da3
0x00401da6
0x00401da7
0x00401da9
0x00401dab
0x00401dad
0x00401daf
0x00401db1
0x00401db3
0x00401db5
0x00401db6
0x00401db7
0x00401db7
0x00401db9
0x00401dba
0x00401dbc
0x00401dc1
0x00401dc3
0x00401dc6
0x00401dcb
0x00401dd1
0x00401dd3
0x00401dd5
0x00401dd7
0x00401dd9
0x00401ddb
0x00401ddf
0x00401ddf
0x00401de1
0x00401de2
0x00401de4
0x00401de9
0x00401deb
0x00401df1
0x00401df4
0x00401df5
0x00401df8
0x00401dfa
0x00401dfb
0x00401dfe
0x00401dff
0x00401e03
0x00401e06
0x00401e07
0x00401e0a
0x00401e0b
0x00401e0d
0x00401e10
0x00401e12
0x00401e13
0x00401e15
0x00401e19
0x00401e1c
0x00401e1e
0x00401e1f
0x00401e25
0x00401e28
0x00401e2a
0x00401e2c
0x00401e2d
0x00401e2f
0x00401e33
0x00401e37
0x00401e3a
0x00401e3b
0x00401e3e
0x00401e3f
0x00401e41
0x00401e43
0x00401e45
0x00401e47
0x00401e49
0x00401e4b
0x00401e4d
0x00401e4f
0x00401e51
0x00401e53
0x00401e55
0x00401e57
0x00401e59
0x00401e5b
0x00401e5d
0x00401e5f
0x00401e61
0x00401e63
0x00401e65
0x00401e67
0x00401e69
0x00401e6b
0x00401e6d
0x00401e6f
0x00401e71
0x00401e73
0x00401e75
0x00401e77
0x00401e79
0x00401e7b
0x00401e7d
0x00401e7f
0x00401e81
0x00401e83
0x00401e85
0x00401e87
0x00401e89
0x00401e8b
0x00401e8d
0x00401e8f
0x00401e91
0x00401e93
0x00401e95
0x00401e97
0x00401e99
0x00401e9c
0x00401e9e
0x00401ea0
0x00401ea2
0x00401ea4
0x00401ea6
0x00401ea8
0x00401eaa
0x00401eac
0x00401eae
0x00401eb0
0x00401eb2
0x00401eb4
0x00401eb6
0x00401eb8
0x00401eba
0x00401ebc
0x00401ebe
0x00401ec0
0x00401ec2
0x00401ec3
0x00401ec7
0x00401ecb
0x00401ece
0x00401ecf
0x00401ed2
0x00401ed3
0x00401ed5
0x00401ed7
0x00401ed9
0x00401edb
0x00401edd
0x00401edf
0x00401ee1
0x00401ee3
0x00401ee5
0x00401ee7
0x00401ee9
0x00401eeb
0x00401eed
0x00401eef
0x00401ef1
0x00401ef3
0x00401ef5
0x00401ef7
0x00401ef9
0x00401efb
0x00401efd
0x00401eff
0x00401f01
0x00401f03
0x00401f05
0x00401f07
0x00401f09
0x00401f0b
0x00401f0d
0x00401f0f
0x00401f11
0x00401f13
0x00401f15
0x00401f17
0x00401f19
0x00401f1b
0x00401f1d
0x00401f1f
0x00401f21
0x00401f23
0x00401f25
0x00401f27
0x00401f29
0x00401f2b
0x00401f2d
0x00401f2f
0x00401f31
0x00401f33
0x00401f35
0x00401f37
0x00401f3b
0x00401f3f
0x00401f43
0x00401f46
0x00401f47
0x00401f4a
0x00401f4b
0x00401f4d
0x00401f4f
0x00401f51
0x00401f53
0x00401f55
0x00401f57
0x00401f59
0x00401f5b
0x00401f5d
0x00401f5f
0x00401f61
0x00401f63
0x00401f65
0x00401f67
0x00401f69
0x00401f6b
0x00401f6d
0x00401f6f
0x00401f71
0x00401f73
0x00401f75
0x00401f77
0x00401f79
0x00401f7b
0x00401f7d
0x00401f7f
0x00401f81
0x00401f83
0x00401f85
0x00401f87
0x00401f89
0x00401f8b
0x00401f8d
0x00401f8f
0x00401f91
0x00401f93
0x00401f97
0x00401f9b
0x00401f9f
0x00401fa2
0x00401fa3
0x00401fa6
0x00401fa7
0x00401fa9
0x00401fab
0x00401fad
0x00401faf
0x00401fb1
0x00401fb3
0x00401fb5
0x00401fb7
0x00401fb9
0x00401fbb
0x00401fbd
0x00401fbf
0x00401fc1
0x00401fc3
0x00401fc5
0x00401fc7
0x00401fc9
0x00401fcb
0x00401fcd
0x00401fcf
0x00401fd1
0x00401fd3
0x00401fd5
0x00401fd7
0x00401fd9
0x00401fdb
0x00401fdd
0x00401fdf
0x00401fe1
0x00401fe3
0x00401fe5
0x00401fe7
0x00401fe9
0x00401feb
0x00401fed
0x00401fef
0x00401ff6
0x00401ff7
0x00401ffb
0x00401ffe
0x00401fff
0x00402002
0x00402003
0x00402005
0x00402007
0x00402009
0x0040200b
0x0040200d
0x0040200f
0x00402011
0x00402013
0x00402015
0x00402017
0x00402019
0x0040201b
0x0040201d
0x0040201f
0x00402021
0x00402023
0x00402025
0x00402027
0x00402029
0x0040202b
0x0040202d
0x0040202f
0x00402031
0x00402033
0x00402035
0x00402037
0x00402039
0x0040203b
0x0040203d
0x0040203f
0x00402041
0x00402043
0x00402045
0x00402047
0x00402049
0x0040204b
0x0040204d
0x0040204f
0x00402051
0x00402053
0x00402055
0x00402057
0x00402059
0x0040205b
0x0040205d
0x0040205f
0x00402061
0x00402063
0x00402065
0x00402067
0x00402069
0x0040206e
0x0040206f
0x00402073
0x00402076
0x00402077
0x00402077
0x00402078
0x00402079
0x0040207e
0x00402080
0x00402082
0x00402084
0x00402086
0x00402088
0x0040208a
0x0040208c
0x0040208e
0x00402090
0x00402092
0x00402094
0x00402096
0x00402098
0x0040209a
0x0040209c
0x0040209e
0x004020a0
0x004020a2
0x004020a4
0x004020a6
0x004020a8
0x004020aa
0x004020ac
0x004020ae
0x004020b0
0x00408394
0x00408394
0x00408395
0x00408397
0x0040839a
0x0040839f
0x004083a5
0x004083a6
0x004083ad
0x004083b1
0x004083b1
0x004083b3
0x00408344
0x00408345
0x00408347
0x0040834e
0x0040834f
0x00408351
0x00408352
0x00408355
0x00408357
0x00408357
0x00408357
0x00408359
0x0040835a
0x0040835b
0x0040835c
0x0040835d
0x00408365
0x00408367
0x00408367
0x00408367
0x0040836a
0x00000000
0x0040836c
0x0040836c
0x0040836d
0x0040836e
0x00408370
0x00408370
0x00408371
0x00000000
0x00408374
0x00408374
0x00408375
0x00408376
0x0040837a
0x0040837b
0x0040837b
0x0040837c
0x0040837d
0x00000000
0x0040837f
0x0040837f
0x00408381
0x00408383
0x00408383
0x00408383
0x00408386
0x00408388
0x00408389
0x0040838a
0x0040838c
0x0040838d
0x0040838e
0x0040838f
0x00000000
0x0040838f
0x00408386
0x0040837d
0x00408371
0x004083b5
0x004083b5
0x004083b7
0x004083b8
0x004083b9
0x004083ba
0x004083bd
0x004083be
0x004083be
0x004083be
0x004083bf
0x004083c0
0x004083c2
0x004083c2
0x004083c3
0x004083c5
0x004083c6
0x004083c7
0x004083c9
0x004083c9
0x004083cb
0x004083ce
0x004083d0
0x004083d1
0x004083d1
0x004083d3
0x004083d6
0x004083d9
0x004083d9
0x004083db
0x004083dd
0x004083dd
0x004083dd
0x004083dd
0x004083de
0x004083de
0x004083de
0x004083df
0x004083e1
0x004083e6
0x004083ef
0x004083f3
0x004083f9
0x00408400
0x0040841a
0x00408402
0x00408402
0x00408407
0x0040840c
0x00408411
0x00408411
0x00408421
0x00408424
0x00408426
0x00408429
0x00408429
0x0040842d
0x00408430
0x00408435
0x00408438
0x0040843a
0x0040843d
0x00408441
0x0040845a
0x0040845a
0x0040845a
0x00408443
0x00408443
0x00408445
0x0040844a
0x0040844d
0x00408450
0x00408455
0x00408455
0x0040845e
0x00408461
0x00408464
0x00408464
0x00408468
0x0040846b
0x00408470
0x00408476
0x00408478
0x0040847b
0x0040847f
0x0040849b
0x0040849b
0x0040849b
0x00408481
0x00408481
0x00408486
0x0040848b
0x0040848e
0x00408491
0x00408496
0x00408496
0x0040849f
0x0040849f
0x004084a2
0x004084a5
0x004084a9
0x004084ac
0x004084af
0x004084b4
0x004084b7
0x004084bc
0x004084c3
0x004084dd
0x004084c5
0x004084c5
0x004084ca
0x004084cf
0x004084d4
0x004084d4
0x004084e4
0x004084e7
0x004084e9
0x004084ec
0x004084f0
0x004084f3
0x004084f8
0x004084fb
0x004084fd
0x00408500
0x00408504
0x0040851d
0x0040851d
0x0040851d
0x00408506
0x00408506
0x00408508
0x0040850d
0x00408510
0x00408513
0x00408518
0x00408518
0x00408521
0x00408524
0x00408527
0x0040852b
0x0040852e
0x00408533
0x00408536
0x00408538
0x0040853b
0x0040853f
0x00408558
0x00408558
0x00408558
0x00408541
0x00408541
0x00408543
0x00408548
0x0040854b
0x0040854e
0x00408553
0x00408553
0x00408560
0x00408564
0x00408567
0x0040856c
0x00408573
0x0040858d
0x00408575
0x00408575
0x0040857a
0x0040857f
0x00408584
0x00408584
0x00408597
0x0040859c
0x0040859e
0x004085a1
0x004085a8
0x004085ac
0x004085b1
0x004085b4
0x004085b8
0x004085bb
0x004085c0
0x004085c6
0x004085c8
0x004085cb
0x004085cf
0x004085eb
0x004085eb
0x004085eb
0x004085d1
0x004085d1
0x004085d6
0x004085db
0x004085de
0x004085e1
0x004085e6
0x004085e6
0x004085ef
0x004085f1
0x004085f3
0x004085f6
0x004085f9
0x004085fa
0x004085ff
0x00408602
0x00408603
0x00408608
0x0040860b
0x0040860e
0x00408614
0x0040861a
0x00408620
0x00408622
0x00408624
0x0040133c
0x0040133c
0x0040862a
0x00408630
0x00408637
0x0040863a
0x0040863d
0x00408642
0x00408648
0x0040864a
0x0040864d
0x00408651
0x00408670
0x00408670
0x00408670
0x00408653
0x00408653
0x00408658
0x0040865d
0x00408660
0x00408663
0x00408668
0x00408668
0x00408677
0x0040867a
0x0040867b
0x0040867e
0x0040867f
0x00408681
0x00408686
0x00408689
0x0040868c
0x0040868c
0x00408691
0x00408698
0x004086b5
0x0040869a
0x0040869a
0x0040869f
0x004086a4
0x004086a9
0x004086a9
0x004086c5
0x004086cd
0x004086cf
0x004086d2
0x004086d9
0x004086dd
0x004086e2
0x004086e5
0x004086e8
0x004086ed
0x004086f3
0x004086f5
0x004086f8
0x004086fc
0x0040871b
0x0040871b
0x0040871b
0x004086fe
0x004086fe
0x00408703
0x00408708
0x0040870b
0x0040870e
0x00408713
0x00408713
0x00408722
0x00408725
0x0040872a
0x0040872b
0x00408755
0x00408758
0x0040875d
0x00408760
0x00408765
0x00408765

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401569

Strings

VB5!6&*, xrefs: 00401564

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: cb8063cceedc5cbec2977c028411e471a595a63dfe7dd2e57ca1d89a1cbb0962
Instruction ID: 8bc5e7c167994ac95778279ed77bfb73ba8fe74ce641d5826ede081869342d32
Opcode Fuzzy Hash: cb8063cceedc5cbec2977c028411e471a595a63dfe7dd2e57ca1d89a1cbb0962
Instruction Fuzzy Hash: E1D1FF6244E3C18FC7135BB489696A17FB0AE2322070E45EBC8C1DF1F3D26D595AD72A

Uniqueness

Uniqueness Score: -1.00%

Function 00411223, Relevance: 21.0, APIs: 11, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00411223(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				short _v32;
				void* _v36;
				char _v52;
				char* _v60;
				intOrPtr _v68;
				char* _t20;
				intOrPtr _t39;

				_push(0x401336);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t39;
				_push(0x34);
				L00401330();
				_v12 = _t39;
				_v8 = 0x401288;
				L00401546();
				L00401546();
				_push(0x402624);
				L00401450();
				_v60 = L"Sekstetter9";
				_v68 = 8;
				L004014B0();
				_push(0);
				_t20 =  &_v52;
				_push(_t20); // executed
				L0040144A(); // executed
				L0040153A();
				L0040150A();
				_v32 = 0x36a2;
				_push(0x4112d5);
				L00401504();
				L00401504();
				L00401504();
				return _t20;
			}

0x00411228
0x00411233
0x00411234
0x0041123b
0x0041123e
0x00411246
0x00411249
0x00411256
0x00411261
0x00411266
0x0041126b
0x00411270
0x00411277
0x00411284
0x00411289
0x0041128b
0x0041128e
0x0041128f
0x00411299
0x004112a1
0x004112a6
0x004112ac
0x004112bf
0x004112c7
0x004112cf
0x004112d4

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 0041123E
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 00411256
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 00411261
#530.MSVBVM60(00402624,?,?,?,?,00401336), ref: 0041126B
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,00402624,?,?,?,?,00401336), ref: 00411284
#645.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00402624,?,?,?,?,00401336), ref: 0041128F
__vbaStrMove.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00402624,?,?,?,?,00401336), ref: 00411299
__vbaFreeVar.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,00402624,?,?,?,?,00401336), ref: 004112A1
__vbaFreeStr.MSVBVM60(004112D5,?,00000000,?,?,?,?,?,?,?,?,00402624), ref: 004112BF
__vbaFreeStr.MSVBVM60(004112D5,?,00000000,?,?,?,?,?,?,?,?,00402624), ref: 004112C7
__vbaFreeStr.MSVBVM60(004112D5,?,00000000,?,?,?,?,?,?,?,?,00402624), ref: 004112CF

Strings

Sekstetter9, xrefs: 00411270

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$Copy$#530#645ChkstkMove
String ID: Sekstetter9
API String ID: 877686742-3858615637
Opcode ID: 59aa94fd4ebe54df9f2720616a6fc95698c95b494c15bf9e5b10e6300c3411b6
Instruction ID: 553966674614feeb38e6829796d2f0376104fd71696e7f9bed8ea97fa0956952
Opcode Fuzzy Hash: 59aa94fd4ebe54df9f2720616a6fc95698c95b494c15bf9e5b10e6300c3411b6
Instruction Fuzzy Hash: 8B110D70810119AACB04EF91CC92EEEB774AF50708F50412EF1027B1F1DB786A06CB99

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00410A14, Relevance: 96.7, APIs: 48, Strings: 7, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00410A14(void* __ebx, void* __ecx, void* __edi, void* __esi, char* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				short _v28;
				void* _v32;
				char _v36;
				void* _v52;
				short _v56;
				void* _v60;
				void* _v64;
				signed int _v68;
				signed int _v72;
				char _v88;
				char _v104;
				char* _v112;
				char _v120;
				void* _v124;
				char _v128;
				void* _v132;
				signed int _v136;
				void* _v140;
				signed int _v144;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				char _v172;
				signed int _v176;
				signed int _v180;
				char _v184;
				signed int _v188;
				signed int _v192;
				char _v196;
				signed int _v200;
				signed int _v204;
				char _v208;
				signed int _v212;
				signed int _v216;
				char _v220;
				signed int _v224;
				signed int _v228;
				char _v232;
				signed int _v236;
				signed int* _t248;
				signed int _t252;
				char* _t254;
				signed int _t261;
				signed int _t266;
				char* _t268;
				char* _t269;
				signed int _t275;
				signed int _t280;
				signed int _t287;
				signed int _t292;
				signed int _t300;
				signed int _t307;
				signed int _t312;
				signed int _t319;
				signed int _t324;
				intOrPtr _t372;

				_push(0x401336);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t372;
				L00401330();
				_v12 = _t372;
				_v8 = 0x401268;
				L00401546();
				if( *0x424010 != 0) {
					_v164 = 0x424010;
				} else {
					_push(0x424010);
					_push(0x401c7c);
					L00401534();
					_v164 = 0x424010;
				}
				_t248 =  &_v72;
				L00401516();
				_v132 = _t248;
				_t252 =  *((intOrPtr*)( *_v132 + 0xf8))(_v132,  &_v124, _t248,  *((intOrPtr*)( *((intOrPtr*)( *_v164)) + 0x300))( *_v164));
				asm("fclex");
				_v136 = _t252;
				if(_v136 >= 0) {
					_v168 = _v168 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x402474);
					_push(_v132);
					_push(_v136);
					L0040152E();
					_v168 = _t252;
				}
				_push(_v124);
				_t254 =  &_v120;
				_push(_t254);
				L0040146E();
				_push(_t254);
				L00401474();
				_v140 =  ~(0 | _t254 != 0x0000ffff);
				L00401528();
				L0040150A();
				if(_v140 != 0) {
					if( *0x42433c != 0) {
						_v172 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v172 = 0x42433c;
					}
					_t33 =  &_v172; // 0x42433c
					_v132 =  *((intOrPtr*)( *_t33));
					_t307 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
					asm("fclex");
					_v136 = _t307;
					if(_v136 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x402444);
						_push(_v132);
						_push(_v136);
						L0040152E();
						_v176 = _t307;
					}
					_v140 = _v72;
					_t312 =  *((intOrPtr*)( *_v140 + 0xe0))(_v140,  &_v68);
					asm("fclex");
					_v144 = _t312;
					if(_v144 >= 0) {
						_v180 = _v180 & 0x00000000;
					} else {
						_push(0xe0);
						_push(0x402464);
						_push(_v140);
						_push(_v144);
						L0040152E();
						_v180 = _t312;
					}
					_v152 = _v68;
					_v68 = _v68 & 0x00000000;
					L0040153A();
					L00401528();
					if( *0x42433c != 0) {
						_v184 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v184 = 0x42433c;
					}
					_t68 =  &_v184; // 0x42433c
					_v132 =  *((intOrPtr*)( *_t68));
					_t319 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
					asm("fclex");
					_v136 = _t319;
					if(_v136 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x402444);
						_push(_v132);
						_push(_v136);
						L0040152E();
						_v188 = _t319;
					}
					_v140 = _v72;
					_t324 =  *((intOrPtr*)( *_v140 + 0x68))(_v140,  &_v124);
					asm("fclex");
					_v144 = _t324;
					if(_v144 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x68);
						_push(0x402464);
						_push(_v140);
						_push(_v144);
						L0040152E();
						_v192 = _t324;
					}
					_v56 = _v124;
					L00401528();
					_v112 = L"HYDROLOGI";
					_v120 = 8;
					L004014B0();
					_push( &_v88);
					_push( &_v104);
					L00401468();
					L0040148C();
					L0040150A();
				}
				if( *0x42433c != 0) {
					_v196 = 0x42433c;
				} else {
					_push(0x42433c);
					_push(0x402454);
					L00401534();
					_v196 = 0x42433c;
				}
				_t108 =  &_v196; // 0x42433c
				_v132 =  *((intOrPtr*)( *_t108));
				_t261 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
				asm("fclex");
				_v136 = _t261;
				if(_v136 >= 0) {
					_v200 = _v200 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x402444);
					_push(_v132);
					_push(_v136);
					L0040152E();
					_v200 = _t261;
				}
				_v140 = _v72;
				_t266 =  *((intOrPtr*)( *_v140 + 0x118))(_v140,  &_v128);
				asm("fclex");
				_v144 = _t266;
				if(_v144 >= 0) {
					_v204 = _v204 & 0x00000000;
				} else {
					_push(0x118);
					_push(0x402464);
					_push(_v140);
					_push(_v144);
					L0040152E();
					_v204 = _t266;
				}
				L00401462();
				_v24 = _t266;
				L00401528();
				_v112 = _a4;
				_v120 = 9;
				L004014B0();
				_t268 =  &_v88;
				_push(_t268);
				L0040145C();
				_v132 =  ~(0 | _t268 != 0x0000ffff);
				L0040150A();
				_t269 = _v132;
				if(_t269 != 0) {
					if( *0x42433c != 0) {
						_v208 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v208 = 0x42433c;
					}
					_t150 =  &_v208; // 0x42433c
					_v132 =  *((intOrPtr*)( *_t150));
					_t275 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
					asm("fclex");
					_v136 = _t275;
					if(_v136 >= 0) {
						_v212 = _v212 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x402444);
						_push(_v132);
						_push(_v136);
						L0040152E();
						_v212 = _t275;
					}
					_v140 = _v72;
					_t280 =  *((intOrPtr*)( *_v140 + 0xb8))(_v140,  &_v124);
					asm("fclex");
					_v144 = _t280;
					if(_v144 >= 0) {
						_v216 = _v216 & 0x00000000;
					} else {
						_push(0xb8);
						_push(0x402464);
						_push(_v140);
						_push(_v144);
						L0040152E();
						_v216 = _t280;
					}
					_v28 = _v124;
					L00401528();
					if( *0x42433c != 0) {
						_v220 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v220 = 0x42433c;
					}
					_t181 =  &_v220; // 0x42433c
					_v132 =  *((intOrPtr*)( *_t181));
					_t287 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
					asm("fclex");
					_v136 = _t287;
					if(_v136 >= 0) {
						_v224 = _v224 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x402444);
						_push(_v132);
						_push(_v136);
						L0040152E();
						_v224 = _t287;
					}
					_v140 = _v72;
					_t292 =  *((intOrPtr*)( *_v140 + 0xf8))(_v140,  &_v68);
					asm("fclex");
					_v144 = _t292;
					if(_v144 >= 0) {
						_v228 = _v228 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x402464);
						_push(_v140);
						_push(_v144);
						L0040152E();
						_v228 = _t292;
					}
					_v156 = _v68;
					_v68 = _v68 & 0x00000000;
					L0040153A();
					L00401528();
					if( *0x42433c != 0) {
						_v232 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v232 = 0x42433c;
					}
					_t216 =  &_v232; // 0x42433c
					_v132 =  *((intOrPtr*)( *_t216));
					_v112 = 0xf3;
					_v120 = 2;
					L00401330();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t300 =  *((intOrPtr*)( *_v132 + 0x34))(_v132, 0x10, 0x54bb,  &_v72);
					asm("fclex");
					_v136 = _t300;
					if(_v136 >= 0) {
						_v236 = _v236 & 0x00000000;
					} else {
						_push(0x34);
						_push(0x402444);
						_push(_v132);
						_push(_v136);
						L0040152E();
						_v236 = _t300;
					}
					_v160 = _v72;
					_v72 = _v72 & 0x00000000;
					_push(_v160);
					_t269 =  &_v36;
					_push(_t269);
					L00401516();
				}
				_push(0x41116f);
				L00401504();
				L00401528();
				L0040150A();
				L00401504();
				L00401504();
				return _t269;
			}

0x00410a19
0x00410a24
0x00410a25
0x00410a31
0x00410a39
0x00410a3c
0x00410a49
0x00410a55
0x00410a72
0x00410a57
0x00410a57
0x00410a5c
0x00410a61
0x00410a66
0x00410a66
0x00410a96
0x00410a9a
0x00410a9f
0x00410aae
0x00410ab4
0x00410ab6
0x00410ac3
0x00410ae5
0x00410ac5
0x00410ac5
0x00410aca
0x00410acf
0x00410ad2
0x00410ad8
0x00410add
0x00410add
0x00410af0
0x00410af1
0x00410af4
0x00410af5
0x00410afa
0x00410afb
0x00410b0b
0x00410b15
0x00410b1d
0x00410b2b
0x00410b38
0x00410b55
0x00410b3a
0x00410b3a
0x00410b3f
0x00410b44
0x00410b49
0x00410b49
0x00410b5f
0x00410b67
0x00410b76
0x00410b79
0x00410b7b
0x00410b88
0x00410ba7
0x00410b8a
0x00410b8a
0x00410b8c
0x00410b91
0x00410b94
0x00410b9a
0x00410b9f
0x00410b9f
0x00410bb1
0x00410bc9
0x00410bcf
0x00410bd1
0x00410bde
0x00410c03
0x00410be0
0x00410be0
0x00410be5
0x00410bea
0x00410bf0
0x00410bf6
0x00410bfb
0x00410bfb
0x00410c0d
0x00410c13
0x00410c20
0x00410c28
0x00410c34
0x00410c51
0x00410c36
0x00410c36
0x00410c3b
0x00410c40
0x00410c45
0x00410c45
0x00410c5b
0x00410c63
0x00410c72
0x00410c75
0x00410c77
0x00410c84
0x00410ca3
0x00410c86
0x00410c86
0x00410c88
0x00410c8d
0x00410c90
0x00410c96
0x00410c9b
0x00410c9b
0x00410cad
0x00410cc5
0x00410cc8
0x00410cca
0x00410cd7
0x00410cf9
0x00410cd9
0x00410cd9
0x00410cdb
0x00410ce0
0x00410ce6
0x00410cec
0x00410cf1
0x00410cf1
0x00410d04
0x00410d0b
0x00410d10
0x00410d17
0x00410d24
0x00410d2c
0x00410d30
0x00410d31
0x00410d3c
0x00410d44
0x00410d44
0x00410d50
0x00410d6d
0x00410d52
0x00410d52
0x00410d57
0x00410d5c
0x00410d61
0x00410d61
0x00410d77
0x00410d7f
0x00410d8e
0x00410d91
0x00410d93
0x00410da0
0x00410dbf
0x00410da2
0x00410da2
0x00410da4
0x00410da9
0x00410dac
0x00410db2
0x00410db7
0x00410db7
0x00410dc9
0x00410de1
0x00410de7
0x00410de9
0x00410df6
0x00410e1b
0x00410df8
0x00410df8
0x00410dfd
0x00410e02
0x00410e08
0x00410e0e
0x00410e13
0x00410e13
0x00410e25
0x00410e2a
0x00410e31
0x00410e39
0x00410e3c
0x00410e49
0x00410e4e
0x00410e51
0x00410e52
0x00410e62
0x00410e69
0x00410e6e
0x00410e74
0x00410e81
0x00410e9e
0x00410e83
0x00410e83
0x00410e88
0x00410e8d
0x00410e92
0x00410e92
0x00410ea8
0x00410eb0
0x00410ebf
0x00410ec2
0x00410ec4
0x00410ed1
0x00410ef0
0x00410ed3
0x00410ed3
0x00410ed5
0x00410eda
0x00410edd
0x00410ee3
0x00410ee8
0x00410ee8
0x00410efa
0x00410f12
0x00410f18
0x00410f1a
0x00410f27
0x00410f4c
0x00410f29
0x00410f29
0x00410f2e
0x00410f33
0x00410f39
0x00410f3f
0x00410f44
0x00410f44
0x00410f57
0x00410f5e
0x00410f6a
0x00410f87
0x00410f6c
0x00410f6c
0x00410f71
0x00410f76
0x00410f7b
0x00410f7b
0x00410f91
0x00410f99
0x00410fa8
0x00410fab
0x00410fad
0x00410fba
0x00410fd9
0x00410fbc
0x00410fbc
0x00410fbe
0x00410fc3
0x00410fc6
0x00410fcc
0x00410fd1
0x00410fd1
0x00410fe3
0x00410ffb
0x00411001
0x00411003
0x00411010
0x00411035
0x00411012
0x00411012
0x00411017
0x0041101c
0x00411022
0x00411028
0x0041102d
0x0041102d
0x0041103f
0x00411045
0x00411052
0x0041105a
0x00411066
0x00411083
0x00411068
0x00411068
0x0041106d
0x00411072
0x00411077
0x00411077
0x0041108d
0x00411095
0x00411098
0x0041109f
0x004110b2
0x004110bc
0x004110bd
0x004110be
0x004110bf
0x004110c8
0x004110cb
0x004110cd
0x004110da
0x004110f9
0x004110dc
0x004110dc
0x004110de
0x004110e3
0x004110e6
0x004110ec
0x004110f1
0x004110f1
0x00411103
0x00411109
0x0041110d
0x00411113
0x00411116
0x00411117
0x00411117
0x0041111c
0x00411149
0x00411151
0x00411159
0x00411161
0x00411169
0x0041116e

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 00410A31
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 00410A49
__vbaNew2.MSVBVM60(00401C7C,00424010,?,?,?,?,00401336), ref: 00410A61
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410A9A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402474,000000F8), ref: 00410AD8
__vbaVarErrI4.MSVBVM60(?,?), ref: 00410AF5
#559.MSVBVM60(00000000,?,?), ref: 00410AFB
__vbaFreeObj.MSVBVM60(00000000,?,?), ref: 00410B15
__vbaFreeVar.MSVBVM60(00000000,?,?), ref: 00410B1D
__vbaNew2.MSVBVM60(00402454,0042433C,00000000,?,?), ref: 00410B44
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014), ref: 00410B9A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,000000E0), ref: 00410BF6
__vbaStrMove.MSVBVM60(00000000,?,00402464,000000E0), ref: 00410C20
__vbaFreeObj.MSVBVM60(00000000,?,00402464,000000E0), ref: 00410C28
__vbaNew2.MSVBVM60(00402454,0042433C), ref: 00410C40
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014), ref: 00410C96
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,00000068), ref: 00410CEC
__vbaFreeObj.MSVBVM60(00000000,?,00402464,00000068), ref: 00410D0B
__vbaVarDup.MSVBVM60(00000000,?,00402464,00000068), ref: 00410D24
#666.MSVBVM60(?,?), ref: 00410D31
__vbaVarMove.MSVBVM60(?,?), ref: 00410D3C
__vbaFreeVar.MSVBVM60(?,?), ref: 00410D44
__vbaNew2.MSVBVM60(00402454,0042433C,00000000,?,?), ref: 00410D5C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014,?,?,?,?,?,00000000,?,?), ref: 00410DB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,00000118,?,?,?,?,?,00000000,?,?), ref: 00410E0E
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,00000000,?,?), ref: 00410E25
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00000000,?,?), ref: 00410E31
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000000,?,?), ref: 00410E49
#562.MSVBVM60(?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410E52
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410E69
__vbaNew2.MSVBVM60(00402454,0042433C,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410E8D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014,?,?,?,?,?,?,?,00000000,?,?), ref: 00410EE3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,000000B8,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410F3F
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410F5E
__vbaNew2.MSVBVM60(00402454,0042433C,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00410F76
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00410FCC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,000000F8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411028
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411052
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 0041105A
__vbaNew2.MSVBVM60(00402454,0042433C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411072
__vbaChkstk.MSVBVM60(000054BB,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004110B2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000034), ref: 004110EC
__vbaObjSet.MSVBVM60(?,?), ref: 00411117
__vbaFreeStr.MSVBVM60(0041116F,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411149
__vbaFreeObj.MSVBVM60(0041116F,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411151
__vbaFreeVar.MSVBVM60(0041116F,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411159
__vbaFreeStr.MSVBVM60(0041116F,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411161
__vbaFreeStr.MSVBVM60(0041116F,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00411169

Strings

HYDROLOGI, xrefs: 00410D10
<CB, xrefs: 00410B5F
<CB, xrefs: 00410F91
<CB, xrefs: 00410D77
<CB, xrefs: 0041108D
<CB, xrefs: 00410EA8
<CB, xrefs: 00410C5B

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$Chkstk$#559#562#666Copy
String ID: <CB$<CB$<CB$<CB$<CB$<CB$HYDROLOGI
API String ID: 3350952093-2897747602
Opcode ID: 743c03689263dc440ed321c4f8e024ed866c89608ecbf49641862bb18a5fb70f
Instruction ID: 392089d2c5a13725fa4d652feebd17f58d5b3fefd4b6fe77e429bb14189c42ed
Opcode Fuzzy Hash: 743c03689263dc440ed321c4f8e024ed866c89608ecbf49641862bb18a5fb70f
Instruction Fuzzy Hash: C322D671A00229EFDB20DF95CD45BDDBBB0BF04308F5080AAE149B72A1DBB85A85DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408394, Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 004083B2
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 004083DC
__vbaUI1Str.MSVBVM60(00402430,?,?,?,?,00401336), ref: 004083E6
__vbaNew2.MSVBVM60(00402454,0042433C,00402430,?,?,?,?,00401336), ref: 0040840C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014), ref: 00408450
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,000000E8), ref: 00408491
__vbaStrMove.MSVBVM60(00000000,?,00402464,000000E8), ref: 004084AF
__vbaFreeObj.MSVBVM60(00000000,?,00402464,000000E8), ref: 004084B7
__vbaNew2.MSVBVM60(00402454,0042433C), ref: 004084CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014), ref: 00408513
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,00000070), ref: 0040854E
__vbaFreeObj.MSVBVM60(00000000,?,00402464,00000070), ref: 00408567
__vbaNew2.MSVBVM60(00401C7C,00424010), ref: 0040857F
__vbaObjSet.MSVBVM60(?,00000000), ref: 004085AC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402474,00000158), ref: 004085E1
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004085FA
__vbaI4Var.MSVBVM60(00000000,?,?,?,00401336), ref: 00408603
__vbaHresultCheckObj.MSVBVM60(00000000,00401188,00402290,00000084), ref: 00408663
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00408681
__vbaFreeVar.MSVBVM60(?,?,00000000,?,?,?,00401336), ref: 0040868C
__vbaNew2.MSVBVM60(00401C7C,00424010,00402430,?,?,?,?,00401336), ref: 004086A4
__vbaObjSet.MSVBVM60(?,00000000), ref: 004086DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402484,00000170), ref: 0040870E
__vbaFreeObj.MSVBVM60(00000000,?,00402484,00000170), ref: 00408725
__vbaFreeStr.MSVBVM60(00408766), ref: 00408758
__vbaFreeStr.MSVBVM60(00408766), ref: 00408760

Strings

<CB, xrefs: 00408421
<CB0$@, xrefs: 00408429, 004086D9, 0040842C, 004086DC
<CB, xrefs: 004084E4

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$CheckFreeHresult$New2$CallChkstkCopyLateListMove
String ID: <CB$<CB$<CB0$@
API String ID: 3947525305-2180067637
Opcode ID: 62cd5cf3a5a69a80c9551303ee12254ac369045ffc92fa32d1c4ff4940eb1234
Instruction ID: 7b16960e7bb9f5c1bebcbc3c95a7416a97ebe8ce78d99171dd02ba1fa8eca571
Opcode Fuzzy Hash: 62cd5cf3a5a69a80c9551303ee12254ac369045ffc92fa32d1c4ff4940eb1234
Instruction Fuzzy Hash: 83C1F571D00218EFCB10DFA4C949BDDBBB4BF48304F60406AE146BB2A1DB785986DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00417EE0, Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00417EE0(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				char _v44;
				char _v48;
				intOrPtr _v56;
				char _v64;
				char _v84;
				intOrPtr* _v88;
				signed int _v92;
				short _v96;
				intOrPtr* _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				char* _t65;
				signed int _t69;
				char* _t71;
				signed int _t72;
				char* _t78;
				char* _t79;
				intOrPtr _t106;

				_push(0x401336);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t106;
				_push(0x60);
				L00401330();
				_v12 = _t106;
				_v8 = 0x4012b0;
				if( *0x424010 != 0) {
					_v104 = 0x424010;
				} else {
					_push(0x424010);
					_push(0x401c7c);
					L00401534();
					_v104 = 0x424010;
				}
				_t65 =  &_v48;
				L00401516();
				_v88 = _t65;
				_t69 =  *((intOrPtr*)( *_v88 + 0x170))(_v88,  &_v84, _t65,  *((intOrPtr*)( *((intOrPtr*)( *_v104)) + 0x304))( *_v104));
				asm("fclex");
				_v92 = _t69;
				if(_v92 >= 0) {
					_v108 = _v108 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x4024a8);
					_push(_v88);
					_push(_v92);
					L0040152E();
					_v108 = _t69;
				}
				_v56 = _v84;
				_v64 = 3;
				_t71 =  &_v64;
				_push(_t71);
				L00401426();
				_v96 =  ~(0 | _t71 != 0x0000ffff);
				L00401528();
				L0040150A();
				_t72 = _v96;
				if(_t72 != 0) {
					_push(L"17:17:17");
					_push( &_v64);
					L00401420();
					_push( &_v64);
					L004014C2();
					L0040153A();
					L0040150A();
					_v56 = 1;
					_v64 = 2;
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xffffffff);
					_push( &_v64);
					L00401438();
					L0040153A();
					L0040150A();
					if( *0x42433c != 0) {
						_v112 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v112 = 0x42433c;
					}
					_v88 =  *_v112;
					_t78 =  &_v44;
					L00401414();
					_t79 =  &_v48;
					L0040141A();
					_t72 =  *((intOrPtr*)( *_v88 + 0x10))(_v88, _t79, _t79, _t78, _t78);
					asm("fclex");
					_v92 = _t72;
					if(_v92 >= 0) {
						_v116 = _v116 & 0x00000000;
					} else {
						_push(0x10);
						_push(0x402444);
						_push(_v88);
						_push(_v92);
						L0040152E();
						_v116 = _t72;
					}
					L00401528();
				}
				_push(0x4180d9);
				L00401504();
				L00401504();
				L0040150A();
				return _t72;
			}

0x00417ee5
0x00417ef0
0x00417ef1
0x00417ef8
0x00417efb
0x00417f03
0x00417f06
0x00417f14
0x00417f2e
0x00417f16
0x00417f16
0x00417f1b
0x00417f20
0x00417f25
0x00417f25
0x00417f49
0x00417f4d
0x00417f52
0x00417f61
0x00417f67
0x00417f69
0x00417f70
0x00417f8c
0x00417f72
0x00417f72
0x00417f77
0x00417f7c
0x00417f7f
0x00417f82
0x00417f87
0x00417f87
0x00417f93
0x00417f96
0x00417f9d
0x00417fa0
0x00417fa1
0x00417fb1
0x00417fb8
0x00417fc0
0x00417fc5
0x00417fcb
0x00417fd1
0x00417fd9
0x00417fda
0x00417fe2
0x00417fe3
0x00417fed
0x00417ff5
0x00417ffa
0x00418001
0x00418008
0x0041800a
0x0041800c
0x0041800e
0x00418013
0x00418014
0x0041801e
0x00418026
0x00418032
0x0041804c
0x00418034
0x00418034
0x00418039
0x0041803e
0x00418043
0x00418043
0x00418058
0x0041805b
0x0041805f
0x00418065
0x00418069
0x00418077
0x0041807a
0x0041807c
0x00418083
0x0041809c
0x00418085
0x00418085
0x00418087
0x0041808c
0x0041808f
0x00418092
0x00418097
0x00418097
0x004180a3
0x004180a3
0x004180a8
0x004180c3
0x004180cb
0x004180d3
0x004180d8

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 00417EFB
__vbaNew2.MSVBVM60(00401C7C,00424010,?,?,?,?,00401336), ref: 00417F20
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417F4D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004024A8,00000170), ref: 00417F82
#561.MSVBVM60(00000003), ref: 00417FA1
__vbaFreeObj.MSVBVM60(00000003), ref: 00417FB8
__vbaFreeVar.MSVBVM60(00000003), ref: 00417FC0
#541.MSVBVM60(00000003,17:17:17,00000003), ref: 00417FDA
__vbaStrVarMove.MSVBVM60(00000003,00000003,17:17:17,00000003), ref: 00417FE3
__vbaStrMove.MSVBVM60(00000003,00000003,17:17:17,00000003), ref: 00417FED
__vbaFreeVar.MSVBVM60(00000003,00000003,17:17:17,00000003), ref: 00417FF5
#703.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 00418014
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 0041801E
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 00418026
__vbaNew2.MSVBVM60(00402454,0042433C,00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 0041803E
__vbaObjVar.MSVBVM60(?,00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 0041805F
__vbaObjSetAddref.MSVBVM60(?,00000000,?,00000002,000000FF,000000FE,000000FE,000000FE,00000003,00000003,17:17:17,00000003), ref: 00418069
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000010), ref: 00418092
__vbaFreeObj.MSVBVM60(00000000,?,00402444,00000010), ref: 004180A3
__vbaFreeStr.MSVBVM60(004180D9,00000003), ref: 004180C3
__vbaFreeStr.MSVBVM60(004180D9,00000003), ref: 004180CB
__vbaFreeVar.MSVBVM60(004180D9,00000003), ref: 004180D3

Strings

<CB, xrefs: 0041804C
17:17:17, xrefs: 00417FD1

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$Move$CheckHresultNew2$#541#561#703AddrefChkstk
String ID: 17:17:17$<CB
API String ID: 2120616596-2902994170
Opcode ID: 1ff1d077cb7cb10f953ea639869c3eb60355e1179d98ea93ec4232445a5113db
Instruction ID: 3eb2e79a8baa19d7f1d2f0c010f033e47e67ba67381e39345aedd5252125926e
Opcode Fuzzy Hash: 1ff1d077cb7cb10f953ea639869c3eb60355e1179d98ea93ec4232445a5113db
Instruction Fuzzy Hash: 6851F871D00208AFCB04EFE1D945ADEBBB8EF48314F60852AF112BB1E1DB785949CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE79, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0040CE79(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				void* _v32;
				intOrPtr _v36;
				char _v40;
				signed int _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				char* _v84;
				char _v92;
				void* _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				signed int _v124;
				char _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				char* _t78;
				signed int _t84;
				signed int _t89;
				char* _t94;
				signed int _t98;
				char* _t103;
				void* _t116;
				void* _t118;
				intOrPtr _t119;

				_t119 = _t118 - 0xc;
				 *[fs:0x0] = _t119;
				L00401330();
				_v16 = _t119;
				_v12 = 0x4011e8;
				_v8 = 0;
				_t78 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x78,  *[fs:0x0], 0x401336, _t116);
				_push(0x4024d8);
				L004014DA();
				if(_t78 != 1) {
					_push(0);
					_push(0);
					_push(1);
					L004014D4();
					L0040153A();
					if( *0x42433c != 0) {
						_v128 = 0x42433c;
					} else {
						_push(0x42433c);
						_push(0x402454);
						L00401534();
						_v128 = 0x42433c;
					}
					_t10 =  &_v128; // 0x42433c
					_v100 =  *((intOrPtr*)( *_t10));
					_t84 =  *((intOrPtr*)( *_v100 + 0x14))(_v100,  &_v40);
					asm("fclex");
					_v104 = _t84;
					if(_v104 >= 0) {
						_v132 = _v132 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x402444);
						_push(_v100);
						_push(_v104);
						L0040152E();
						_v132 = _t84;
					}
					_v108 = _v40;
					_t89 =  *((intOrPtr*)( *_v108 + 0xc0))(_v108,  &_v96);
					asm("fclex");
					_v112 = _t89;
					if(_v112 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0xc0);
						_push(0x402464);
						_push(_v108);
						_push(_v112);
						L0040152E();
						_v136 = _t89;
					}
					_v28 = _v96;
					L00401528();
					if( *0x424010 != 0) {
						_v140 = 0x424010;
					} else {
						_push(0x424010);
						_push(0x401c7c);
						L00401534();
						_v140 = 0x424010;
					}
					_t94 =  &_v40;
					L00401516();
					_v100 = _t94;
					_t98 =  *((intOrPtr*)( *_v100 + 0x130))(_v100,  &_v44, _t94,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x2fc))( *_v140));
					asm("fclex");
					_v104 = _t98;
					if(_v104 >= 0) {
						_v144 = _v144 & 0x00000000;
					} else {
						_push(0x130);
						_push(0x402474);
						_push(_v100);
						_push(_v104);
						L0040152E();
						_v144 = _t98;
					}
					_v124 = _v44;
					_v44 = _v44 & 0x00000000;
					_v52 = _v124;
					_v60 = 9;
					_v84 = L"Bigeminy";
					_v92 = 8;
					_push(0xfff3ab58);
					_push( &_v60);
					_push( &_v92);
					_push(0);
					_t103 =  &_v76;
					_push(_t103);
					L004014CE();
					_push(_t103);
					L00401522();
					_v36 = _t103;
					L00401528();
					_push( &_v76);
					_t78 =  &_v60;
					_push(_t78);
					_push(2);
					L004014C8();
				}
				_push(0x40d0c8);
				L00401504();
				return _t78;
			}

0x0040ce7c
0x0040ce8b
0x0040ce95
0x0040ce9d
0x0040cea0
0x0040cea7
0x0040ceb6
0x0040ceb9
0x0040cebe
0x0040cec7
0x0040cecd
0x0040cecf
0x0040ced1
0x0040ced3
0x0040cedd
0x0040cee9
0x0040cf03
0x0040ceeb
0x0040ceeb
0x0040cef0
0x0040cef5
0x0040cefa
0x0040cefa
0x0040cf0a
0x0040cf0f
0x0040cf1e
0x0040cf21
0x0040cf23
0x0040cf2a
0x0040cf43
0x0040cf2c
0x0040cf2c
0x0040cf2e
0x0040cf33
0x0040cf36
0x0040cf39
0x0040cf3e
0x0040cf3e
0x0040cf4a
0x0040cf59
0x0040cf5f
0x0040cf61
0x0040cf68
0x0040cf87
0x0040cf6a
0x0040cf6a
0x0040cf6f
0x0040cf74
0x0040cf77
0x0040cf7a
0x0040cf7f
0x0040cf7f
0x0040cf92
0x0040cf99
0x0040cfa5
0x0040cfc2
0x0040cfa7
0x0040cfa7
0x0040cfac
0x0040cfb1
0x0040cfb6
0x0040cfb6
0x0040cfe6
0x0040cfea
0x0040cfef
0x0040cffe
0x0040d004
0x0040d006
0x0040d00d
0x0040d02c
0x0040d00f
0x0040d00f
0x0040d014
0x0040d019
0x0040d01c
0x0040d01f
0x0040d024
0x0040d024
0x0040d036
0x0040d039
0x0040d040
0x0040d043
0x0040d04a
0x0040d051
0x0040d058
0x0040d060
0x0040d064
0x0040d065
0x0040d067
0x0040d06a
0x0040d06b
0x0040d070
0x0040d071
0x0040d076
0x0040d07c
0x0040d084
0x0040d085
0x0040d088
0x0040d089
0x0040d08b
0x0040d090
0x0040d093
0x0040d0c2
0x0040d0c7

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 0040CE95
__vbaI2Str.MSVBVM60(004024D8,?,?,?,?,00401336), ref: 0040CEBE
#706.MSVBVM60(00000001,00000000,00000000,004024D8,?,?,?,?,00401336), ref: 0040CED3
__vbaStrMove.MSVBVM60(00000001,00000000,00000000,004024D8,?,?,?,?,00401336), ref: 0040CEDD
__vbaNew2.MSVBVM60(00402454,0042433C,00000001,00000000,00000000,004024D8,?,?,?,?,00401336), ref: 0040CEF5
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402444,00000014), ref: 0040CF39
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402464,000000C0), ref: 0040CF7A
__vbaFreeObj.MSVBVM60(00000000,?,00402464,000000C0), ref: 0040CF99
__vbaNew2.MSVBVM60(00401C7C,00424010), ref: 0040CFB1
__vbaObjSet.MSVBVM60(004024D8,00000000), ref: 0040CFEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402474,00000130), ref: 0040D01F
__vbaInStrVar.MSVBVM60(?,00000000,00000008,00000009,FFF3AB58), ref: 0040D06B
__vbaI4Var.MSVBVM60(00000000,?,00000000,00000008,00000009,FFF3AB58), ref: 0040D071
__vbaFreeObj.MSVBVM60(00000000,?,00000000,00000008,00000009,FFF3AB58), ref: 0040D07C
__vbaFreeVarList.MSVBVM60(00000002,00000009,?,00000000,?,00000000,00000008,00000009,FFF3AB58), ref: 0040D08B
__vbaFreeStr.MSVBVM60(0040D0C8,004024D8,?,?,?,?,00401336), ref: 0040D0C2

Strings

Bigeminy, xrefs: 0040D04A
<CB, xrefs: 0040CF0A

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$CheckHresult$New2$#706ChkstkListMove
String ID: <CB$Bigeminy
API String ID: 1519236314-223780239
Opcode ID: c2736da0015a86f1dd72758fc432aef504596d4d39bb769f9705268af4245d48
Instruction ID: ef0d0f8ab82a97bdb82e615b70c95b99aced2e81af9bd6d90de01814dd02dc9d
Opcode Fuzzy Hash: c2736da0015a86f1dd72758fc432aef504596d4d39bb769f9705268af4245d48
Instruction Fuzzy Hash: 54610471E00218EFDB10DFE0D889BDDBBB5BB08304F20416AE109BB2A1D7785985DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D0E7, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E0040D0E7(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				char _v28;
				char _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v60;
				signed int _v64;
				char* _t31;
				signed int _t34;
				char* _t36;
				intOrPtr _t51;

				_push(0x401336);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t51;
				_push(0x2c);
				L00401330();
				_v12 = _t51;
				_v8 = 0x4011f8;
				if( *0x424010 != 0) {
					_v60 = 0x424010;
				} else {
					_push(0x424010);
					_push(0x401c7c);
					L00401534();
					_v60 = 0x424010;
				}
				_t31 =  &_v28;
				L00401516();
				_v48 = _t31;
				_t34 =  *((intOrPtr*)( *_v48 + 0x16c))(_v48, _t31,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x30c))( *_v60));
				asm("fclex");
				_v52 = _t34;
				if(_v52 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x16c);
					_push(0x402484);
					_push(_v48);
					_push(_v52);
					L0040152E();
					_v64 = _t34;
				}
				L00401528();
				_push( &_v44);
				L004014BC();
				_t36 =  &_v44;
				_push(_t36);
				L004014C2();
				L0040153A();
				L0040150A();
				_push(0x40d1e0);
				L00401504();
				return _t36;
			}

0x0040d0ec
0x0040d0f7
0x0040d0f8
0x0040d0ff
0x0040d102
0x0040d10a
0x0040d10d
0x0040d11b
0x0040d135
0x0040d11d
0x0040d11d
0x0040d122
0x0040d127
0x0040d12c
0x0040d12c
0x0040d150
0x0040d154
0x0040d159
0x0040d164
0x0040d16a
0x0040d16c
0x0040d173
0x0040d18f
0x0040d175
0x0040d175
0x0040d17a
0x0040d17f
0x0040d182
0x0040d185
0x0040d18a
0x0040d18a
0x0040d196
0x0040d19e
0x0040d19f
0x0040d1a4
0x0040d1a7
0x0040d1a8
0x0040d1b2
0x0040d1ba
0x0040d1bf
0x0040d1da
0x0040d1df

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 0040D102
__vbaNew2.MSVBVM60(00401C7C,00424010,?,?,?,?,00401336), ref: 0040D127
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D154
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402484,0000016C,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D185
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D196
#612.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D19F
__vbaStrVarMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D1A8
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D1B2
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D1BA
__vbaFreeStr.MSVBVM60(0040D1E0,?,?,?,?,?,?,?,?,?,?,?,?,?,00401336), ref: 0040D1DA

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$Move$#612CheckChkstkHresultNew2
String ID:
API String ID: 2857252598-0
Opcode ID: 3d1f2b116753096815c4993fcd0c5956fa4adee7205825f1023da4b7a0bed0fd
Instruction ID: 94d088a22807f0f4a334b5f356112aa722fa774b7d45aa629a17f2237c774148
Opcode Fuzzy Hash: 3d1f2b116753096815c4993fcd0c5956fa4adee7205825f1023da4b7a0bed0fd
Instruction Fuzzy Hash: C921E671D00208ABDB04EFE5D886FDEBBB8AB48714F50453AF102BB1A1DB785545CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00421357, Relevance: 13.6, APIs: 9, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E00421357(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long long _v32;
				void* _v36;
				char _v40;
				signed int _v48;
				char _v56;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				char* _t42;
				signed int _t45;
				void* _t57;
				void* _t59;
				intOrPtr _t60;

				_t60 = _t59 - 0xc;
				 *[fs:0x0] = _t60;
				L00401330();
				_v16 = _t60;
				_v12 = 0x4012e8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x401336, _t57);
				_v48 = _v48 & 0x00000000;
				_v56 = 2;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_push( &_v56);
				L004013FC();
				L0040153A();
				L0040150A();
				if( *0x424010 != 0) {
					_v92 = 0x424010;
				} else {
					_push(0x424010);
					_push(0x401c7c);
					L00401534();
					_v92 = 0x424010;
				}
				_t42 =  &_v40;
				L00401516();
				_v76 = _t42;
				_t45 =  *((intOrPtr*)( *_v76 + 0x1a8))(_v76, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x300))( *_v92));
				asm("fclex");
				_v80 = _t45;
				if(_v80 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1a8);
					_push(0x402474);
					_push(_v76);
					_push(_v80);
					L0040152E();
					_v96 = _t45;
				}
				L00401528();
				_v32 =  *0x4012e0;
				asm("wait");
				_push(0x421477);
				L00401504();
				return _t45;
			}

0x0042135a
0x00421369
0x00421373
0x0042137b
0x0042137e
0x00421385
0x00421394
0x00421397
0x0042139b
0x004213a2
0x004213a4
0x004213a6
0x004213a8
0x004213ad
0x004213ae
0x004213b8
0x004213c0
0x004213cc
0x004213e6
0x004213ce
0x004213ce
0x004213d3
0x004213d8
0x004213dd
0x004213dd
0x00421401
0x00421405
0x0042140a
0x00421415
0x0042141b
0x0042141d
0x00421424
0x00421440
0x00421426
0x00421426
0x0042142b
0x00421430
0x00421433
0x00421436
0x0042143b
0x0042143b
0x00421447
0x00421452
0x00421455
0x00421456
0x00421471
0x00421476

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 00421373
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004213AE
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004213B8
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004213C0
__vbaNew2.MSVBVM60(00401C7C,00424010,00000002,000000FF,000000FE,000000FE,000000FE), ref: 004213D8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00421405
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402474,000001A8,?,?,?,?,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00421436
__vbaFreeObj.MSVBVM60(?,?,?,?,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00421447
__vbaFreeStr.MSVBVM60(00421477,?,?,?,?,00000002,000000FF,000000FE,000000FE,000000FE), ref: 00421471

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$#704CheckChkstkHresultMoveNew2
String ID:
API String ID: 2174863854-0
Opcode ID: 0fd3555b76d6fd564e90033c7878f797f0d941269e6ca314c2329603d67d0a10
Instruction ID: 701eee91fc5825a63fffe5c5e19bb78ff6cd1559a9f7bb2db37688b54f65cefd
Opcode Fuzzy Hash: 0fd3555b76d6fd564e90033c7878f797f0d941269e6ca314c2329603d67d0a10
Instruction Fuzzy Hash: D331F371A00218ABDB00EFD5D889B9DBBB5AF45318F60416AE052BB2E1CB785945CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F3, Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E0040D1F3(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				short _v36;
				char _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v60;
				signed int _v64;
				char* _t40;
				signed int _t43;
				void* _t57;
				void* _t59;
				intOrPtr _t60;

				_t60 = _t59 - 0xc;
				 *[fs:0x0] = _t60;
				L00401330();
				_v16 = _t60;
				_v12 = 0x401208;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x401336, _t57);
				L00401546();
				L00401546();
				if( *0x424010 != 0) {
					_v60 = 0x424010;
				} else {
					_push(0x424010);
					_push(0x401c7c);
					L00401534();
					_v60 = 0x424010;
				}
				_t40 =  &_v40;
				L00401516();
				_v44 = _t40;
				_t43 =  *((intOrPtr*)( *_v44 + 0x170))(_v44, _t40,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x30c))( *_v60));
				asm("fclex");
				_v48 = _t43;
				if(_v48 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x402484);
					_push(_v44);
					_push(_v48);
					L0040152E();
					_v64 = _t43;
				}
				L00401528();
				_v36 = 0x4915;
				_push(0x40d2f7);
				L00401504();
				L00401504();
				return _t43;
			}

0x0040d1f6
0x0040d205
0x0040d20f
0x0040d217
0x0040d21a
0x0040d221
0x0040d230
0x0040d239
0x0040d244
0x0040d250
0x0040d26a
0x0040d252
0x0040d252
0x0040d257
0x0040d25c
0x0040d261
0x0040d261
0x0040d285
0x0040d289
0x0040d28e
0x0040d299
0x0040d29f
0x0040d2a1
0x0040d2a8
0x0040d2c4
0x0040d2aa
0x0040d2aa
0x0040d2af
0x0040d2b4
0x0040d2b7
0x0040d2ba
0x0040d2bf
0x0040d2bf
0x0040d2cb
0x0040d2d0
0x0040d2d6
0x0040d2e9
0x0040d2f1
0x0040d2f6

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 0040D20F
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 0040D239
__vbaStrCopy.MSVBVM60(?,?,?,?,00401336), ref: 0040D244
__vbaNew2.MSVBVM60(00401C7C,00424010,?,?,?,?,00401336), ref: 0040D25C
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D289
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402484,00000170), ref: 0040D2BA
__vbaFreeObj.MSVBVM60 ref: 0040D2CB
__vbaFreeStr.MSVBVM60(0040D2F7), ref: 0040D2E9
__vbaFreeStr.MSVBVM60(0040D2F7), ref: 0040D2F1

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$Copy$CheckChkstkHresultNew2
String ID:
API String ID: 1208621462-0
Opcode ID: bf8424602c6e0cf32ab609c446d220ec713b9b57c2bec0cae87071f01a32d4a6
Instruction ID: 2c8044029a7975c31d98c81d7a4cf0b3936ae6f7054cb7740504a85430355782
Opcode Fuzzy Hash: bf8424602c6e0cf32ab609c446d220ec713b9b57c2bec0cae87071f01a32d4a6
Instruction Fuzzy Hash: 71310574900209AFCB00EFA5D885BDDBBB4EF48318F50806AF102BB2A1D7789945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00411182, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E00411182(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v36;
				char _v44;
				char* _t18;
				void* _t26;
				void* _t28;
				intOrPtr _t29;

				_t29 = _t28 - 0xc;
				 *[fs:0x0] = _t29;
				L00401330();
				_v16 = _t29;
				_v12 = 0x401278;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x2c,  *[fs:0x0], 0x401336, _t26);
				_v36 = 2;
				_v44 = 2;
				_t18 =  &_v44;
				_push(_t18);
				L00401456();
				L0040153A();
				L0040150A();
				_push(0x411204);
				L00401504();
				return _t18;
			}

0x00411185
0x00411194
0x0041119e
0x004111a6
0x004111a9
0x004111b0
0x004111bf
0x004111c2
0x004111c9
0x004111d0
0x004111d3
0x004111d4
0x004111de
0x004111e6
0x004111eb
0x004111fe
0x00411203

APIs

__vbaChkstk.MSVBVM60(?,00401336), ref: 0041119E
#536.MSVBVM60(00000002), ref: 004111D4
__vbaStrMove.MSVBVM60(00000002), ref: 004111DE
__vbaFreeVar.MSVBVM60(00000002), ref: 004111E6
__vbaFreeStr.MSVBVM60(00411204,00000002), ref: 004111FE

Memory Dump Source

Source File: 00000000.00000002.1170020722.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1170011898.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1170046866.0000000000424000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1170062358.0000000000426000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_documentos.jbxd

Similarity

API ID: __vba$Free$#536ChkstkMove
String ID:
API String ID: 2104488870-0
Opcode ID: 2f292838a171b14b141971d52e75d93ad690995fae18a55ba1823fb42d54836a
Instruction ID: b6248de2d76230347b2f8351967d394781985a2c36cb5bbbf0ed35c66e54a8f4
Opcode Fuzzy Hash: 2f292838a171b14b141971d52e75d93ad690995fae18a55ba1823fb42d54836a
Instruction Fuzzy Hash: D501CD71900208ABDB00EF95C94ABDEBFB4BB44754F50406AF502BB2A1D7785945CB59

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report documentos.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: documentos.exe PID: 7124 Parent PID: 5908

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: documentos.exe PID: 7124 Parent PID: 5908 documentos.exeCOMMON

Execution Graph

Graph

Executed Functions

Function 00401564, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 456COMMONCrypto

Function 00401564, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 456
COMMONCrypto

Function 00411223, Relevance: 21.0, APIs: 11, Strings: 1, Instructions: 48
COMMON

Function 00410A14, Relevance: 96.7, APIs: 48, Strings: 7, Instructions: 444
COMMON

Function 00408394, Relevance: 51.0, APIs: 26, Strings: 3, Instructions: 268
COMMON

Function 00417EE0, Relevance: 42.1, APIs: 22, Strings: 2, Instructions: 144
COMMON

Function 0040CE79, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 156
COMMON

Function 0040D0E7, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Function 00421357, Relevance: 13.6, APIs: 9, Instructions: 80
COMMON

Function 0040D1F3, Relevance: 13.6, APIs: 9, Instructions: 72
COMMON

Function 00411182, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON